@event4u/agent-config 17.3.0 → 17.4.0

package/dist/cli-delegate/dist-25AZAHOP.js

@@ -0,0 +1,3240 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  require_dist,
+  require_envelope,
+  require_sigstore_common
+} from "./chunk-DIFZBP4G.js";
+import {
+  __commonJS,
+  __require
+} from "./chunk-J55WI3RR.js";
+
+// node_modules/@sigstore/core/dist/stream.js
+var require_stream = __commonJS({
+  "node_modules/@sigstore/core/dist/stream.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ByteStream = void 0;
+    var StreamError = class extends Error {
+    };
+    var ByteStream = class _ByteStream {
+      static BLOCK_SIZE = 1024;
+      buf;
+      view;
+      start = 0;
+      constructor(buffer) {
+        if (buffer) {
+          this.buf = buffer;
+          this.view = Buffer.from(buffer);
+        } else {
+          this.buf = Buffer.alloc(0);
+          this.view = Buffer.from(this.buf);
+        }
+      }
+      get buffer() {
+        return this.view.subarray(0, this.start);
+      }
+      get length() {
+        return this.view.byteLength;
+      }
+      get position() {
+        return this.start;
+      }
+      seek(position) {
+        this.start = position;
+      }
+      // Returns a Buffer containing the specified number of bytes starting at the
+      // given start position.
+      slice(start, len) {
+        const end = start + len;
+        if (end > this.length) {
+          throw new StreamError("request past end of buffer");
+        }
+        return this.view.subarray(start, end);
+      }
+      appendChar(char) {
+        this.ensureCapacity(1);
+        this.view[this.start] = char;
+        this.start += 1;
+      }
+      appendUint16(num) {
+        this.ensureCapacity(2);
+        const value = new Uint16Array([num]);
+        const view = new Uint8Array(value.buffer);
+        this.view[this.start] = view[1];
+        this.view[this.start + 1] = view[0];
+        this.start += 2;
+      }
+      appendUint24(num) {
+        this.ensureCapacity(3);
+        const value = new Uint32Array([num]);
+        const view = new Uint8Array(value.buffer);
+        this.view[this.start] = view[2];
+        this.view[this.start + 1] = view[1];
+        this.view[this.start + 2] = view[0];
+        this.start += 3;
+      }
+      appendView(view) {
+        this.ensureCapacity(view.length);
+        this.view.set(view, this.start);
+        this.start += view.length;
+      }
+      getBlock(size) {
+        if (size <= 0) {
+          return Buffer.alloc(0);
+        }
+        if (this.start + size > this.view.length) {
+          throw new Error("request past end of buffer");
+        }
+        const result = this.view.subarray(this.start, this.start + size);
+        this.start += size;
+        return result;
+      }
+      getUint8() {
+        return this.getBlock(1)[0];
+      }
+      getUint16() {
+        const block = this.getBlock(2);
+        return block[0] << 8 | block[1];
+      }
+      ensureCapacity(size) {
+        if (this.start + size > this.view.byteLength) {
+          const blockSize = _ByteStream.BLOCK_SIZE + (size > _ByteStream.BLOCK_SIZE ? size : 0);
+          this.realloc(this.view.byteLength + blockSize);
+        }
+      }
+      realloc(size) {
+        const newArray = Buffer.alloc(size);
+        const newView = Buffer.from(newArray);
+        newView.set(this.view);
+        this.buf = newArray;
+        this.view = newView;
+      }
+    };
+    exports.ByteStream = ByteStream;
+  }
+});
+
+// node_modules/@sigstore/core/dist/asn1/error.js
+var require_error = __commonJS({
+  "node_modules/@sigstore/core/dist/asn1/error.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ASN1TypeError = exports.ASN1ParseError = void 0;
+    var ASN1ParseError = class extends Error {
+    };
+    exports.ASN1ParseError = ASN1ParseError;
+    var ASN1TypeError = class extends Error {
+    };
+    exports.ASN1TypeError = ASN1TypeError;
+  }
+});
+
+// node_modules/@sigstore/core/dist/asn1/length.js
+var require_length = __commonJS({
+  "node_modules/@sigstore/core/dist/asn1/length.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.decodeLength = decodeLength;
+    exports.encodeLength = encodeLength;
+    var error_1 = require_error();
+    function decodeLength(stream) {
+      const buf = stream.getUint8();
+      if ((buf & 128) === 0) {
+        return buf;
+      }
+      const byteCount = buf & 127;
+      if (byteCount > 6) {
+        throw new error_1.ASN1ParseError("length exceeds 6 byte limit");
+      }
+      let len = 0;
+      for (let i = 0; i < byteCount; i++) {
+        const byte = stream.getUint8();
+        if (i === 0 && byte === 0) {
+          throw new error_1.ASN1ParseError("non-minimal length encoding");
+        }
+        len = len * 256 + byte;
+      }
+      if (len === 0) {
+        throw new error_1.ASN1ParseError("indefinite length encoding not supported");
+      }
+      if (len < 128) {
+        throw new error_1.ASN1ParseError("non-minimal length encoding");
+      }
+      return len;
+    }
+    function encodeLength(len) {
+      if (len < 128) {
+        return Buffer.from([len]);
+      }
+      let val = BigInt(len);
+      const bytes = [];
+      while (val > 0n) {
+        bytes.unshift(Number(val & 255n));
+        val = val >> 8n;
+      }
+      return Buffer.from([128 | bytes.length, ...bytes]);
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/asn1/parse.js
+var require_parse = __commonJS({
+  "node_modules/@sigstore/core/dist/asn1/parse.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.parseInteger = parseInteger;
+    exports.parseStringASCII = parseStringASCII;
+    exports.parseTime = parseTime;
+    exports.parseOID = parseOID;
+    exports.parseBoolean = parseBoolean;
+    exports.parseBitString = parseBitString;
+    var error_1 = require_error();
+    var RE_TIME_SHORT_YEAR = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
+    var RE_TIME_LONG_YEAR = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
+    function parseInteger(buf) {
+      let pos = 0;
+      const end = buf.length;
+      let val = buf[pos];
+      const neg = val > 127;
+      const pad = neg ? 255 : 0;
+      while (val == pad && ++pos < end) {
+        val = buf[pos];
+      }
+      const len = end - pos;
+      if (len === 0)
+        return BigInt(neg ? -1 : 0);
+      val = neg ? val - 256 : val;
+      let n = BigInt(val);
+      for (let i = pos + 1; i < end; ++i) {
+        n = n * BigInt(256) + BigInt(buf[i]);
+      }
+      return n;
+    }
+    function parseStringASCII(buf) {
+      return buf.toString("ascii");
+    }
+    function parseTime(buf, shortYear) {
+      const timeStr = parseStringASCII(buf);
+      const m = shortYear ? RE_TIME_SHORT_YEAR.exec(timeStr) : RE_TIME_LONG_YEAR.exec(timeStr);
+      if (!m) {
+        throw new Error("invalid time");
+      }
+      if (shortYear) {
+        let year = Number(m[1]);
+        year += year >= 50 ? 1900 : 2e3;
+        m[1] = year.toString();
+      }
+      return /* @__PURE__ */ new Date(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`);
+    }
+    function parseOID(buf) {
+      let pos = 0;
+      const end = buf.length;
+      let n = buf[pos++];
+      const first = Math.floor(n / 40);
+      const second = n % 40;
+      let oid = `${first}.${second}`;
+      let val = 0n;
+      for (; pos < end; ++pos) {
+        n = buf[pos];
+        val = (val << 7n) + BigInt(n & 127);
+        if ((n & 128) === 0) {
+          oid += `.${val}`;
+          val = 0n;
+        }
+      }
+      return oid;
+    }
+    function parseBoolean(buf) {
+      if (buf.length !== 1) {
+        throw new error_1.ASN1ParseError("invalid boolean");
+      }
+      switch (buf[0]) {
+        case 0:
+          return false;
+        case 255:
+          return true;
+        default:
+          throw new error_1.ASN1ParseError("invalid boolean");
+      }
+    }
+    function parseBitString(buf) {
+      const unused = buf[0];
+      if (unused > 7) {
+        throw new error_1.ASN1ParseError("invalid bit string");
+      }
+      const start = 1;
+      const end = buf.length;
+      const bits = [];
+      for (let i = start; i < end; ++i) {
+        const byte = buf[i];
+        const skip = i === end - 1 ? unused : 0;
+        for (let j = 7; j >= skip; --j) {
+          bits.push(byte >> j & 1);
+        }
+      }
+      return bits;
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/asn1/tag.js
+var require_tag = __commonJS({
+  "node_modules/@sigstore/core/dist/asn1/tag.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ASN1Tag = void 0;
+    var error_1 = require_error();
+    var UNIVERSAL_TAG = {
+      BOOLEAN: 1,
+      INTEGER: 2,
+      BIT_STRING: 3,
+      OCTET_STRING: 4,
+      OBJECT_IDENTIFIER: 6,
+      SEQUENCE: 16,
+      SET: 17,
+      PRINTABLE_STRING: 19,
+      UTC_TIME: 23,
+      GENERALIZED_TIME: 24
+    };
+    var TAG_CLASS = {
+      UNIVERSAL: 0,
+      APPLICATION: 1,
+      CONTEXT_SPECIFIC: 2,
+      PRIVATE: 3
+    };
+    var ASN1Tag = class {
+      number;
+      constructed;
+      class;
+      constructor(enc) {
+        this.number = enc & 31;
+        this.constructed = (enc & 32) === 32;
+        this.class = enc >> 6;
+        if (this.number === 31) {
+          throw new error_1.ASN1ParseError("long form tags not supported");
+        }
+        if (this.class === TAG_CLASS.UNIVERSAL && this.number === 0) {
+          throw new error_1.ASN1ParseError("unsupported tag 0x00");
+        }
+      }
+      isUniversal() {
+        return this.class === TAG_CLASS.UNIVERSAL;
+      }
+      isContextSpecific(num) {
+        const res = this.class === TAG_CLASS.CONTEXT_SPECIFIC;
+        return num !== void 0 ? res && this.number === num : res;
+      }
+      isBoolean() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.BOOLEAN;
+      }
+      isInteger() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.INTEGER;
+      }
+      isBitString() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.BIT_STRING;
+      }
+      isOctetString() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.OCTET_STRING;
+      }
+      isOID() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.OBJECT_IDENTIFIER;
+      }
+      isUTCTime() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.UTC_TIME;
+      }
+      isGeneralizedTime() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.GENERALIZED_TIME;
+      }
+      toDER() {
+        return this.number | (this.constructed ? 32 : 0) | this.class << 6;
+      }
+    };
+    exports.ASN1Tag = ASN1Tag;
+  }
+});
+
+// node_modules/@sigstore/core/dist/asn1/obj.js
+var require_obj = __commonJS({
+  "node_modules/@sigstore/core/dist/asn1/obj.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ASN1Obj = void 0;
+    var stream_1 = require_stream();
+    var error_1 = require_error();
+    var length_1 = require_length();
+    var parse_1 = require_parse();
+    var tag_1 = require_tag();
+    var ASN1Obj = class {
+      tag;
+      subs;
+      value;
+      constructor(tag, value, subs) {
+        this.tag = tag;
+        this.value = value;
+        this.subs = subs;
+      }
+      // Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
+      static parseBuffer(buf) {
+        const stream = new stream_1.ByteStream(buf);
+        const obj = parseStream(stream);
+        if (stream.position !== stream.length) {
+          throw new error_1.ASN1ParseError("invalid trailing data");
+        }
+        return obj;
+      }
+      toDER() {
+        const valueStream = new stream_1.ByteStream();
+        if (this.subs.length > 0) {
+          for (const sub of this.subs) {
+            valueStream.appendView(sub.toDER());
+          }
+        } else {
+          valueStream.appendView(this.value);
+        }
+        const value = valueStream.buffer;
+        const obj = new stream_1.ByteStream();
+        obj.appendChar(this.tag.toDER());
+        obj.appendView((0, length_1.encodeLength)(value.length));
+        obj.appendView(value);
+        return obj.buffer;
+      }
+      /////////////////////////////////////////////////////////////////////////////
+      // Convenience methods for parsing ASN.1 primitives into JS types
+      // Returns the ASN.1 object's value as a boolean. Throws an error if the
+      // object is not a boolean.
+      toBoolean() {
+        if (!this.tag.isBoolean()) {
+          throw new error_1.ASN1TypeError("not a boolean");
+        }
+        return (0, parse_1.parseBoolean)(this.value);
+      }
+      // Returns the ASN.1 object's value as a BigInt. Throws an error if the
+      // object is not an integer.
+      toInteger() {
+        if (!this.tag.isInteger()) {
+          throw new error_1.ASN1TypeError("not an integer");
+        }
+        return (0, parse_1.parseInteger)(this.value);
+      }
+      // Returns the ASN.1 object's value as an OID string. Throws an error if the
+      // object is not an OID.
+      toOID() {
+        if (!this.tag.isOID()) {
+          throw new error_1.ASN1TypeError("not an OID");
+        }
+        return (0, parse_1.parseOID)(this.value);
+      }
+      // Returns the ASN.1 object's value as a Date. Throws an error if the object
+      // is not either a UTCTime or a GeneralizedTime.
+      toDate() {
+        switch (true) {
+          case this.tag.isUTCTime():
+            return (0, parse_1.parseTime)(this.value, true);
+          case this.tag.isGeneralizedTime():
+            return (0, parse_1.parseTime)(this.value, false);
+          default:
+            throw new error_1.ASN1TypeError("not a date");
+        }
+      }
+      // Returns the ASN.1 object's value as a number[] where each number is the
+      // value of a bit in the bit string. Throws an error if the object is not a
+      // bit string.
+      toBitString() {
+        if (!this.tag.isBitString()) {
+          throw new error_1.ASN1TypeError("not a bit string");
+        }
+        return (0, parse_1.parseBitString)(this.value);
+      }
+    };
+    exports.ASN1Obj = ASN1Obj;
+    var MAX_DEPTH = 100;
+    function parseStream(stream, depth = 0) {
+      if (depth > MAX_DEPTH) {
+        throw new error_1.ASN1ParseError("maximum nesting depth exceeded");
+      }
+      const tag = new tag_1.ASN1Tag(stream.getUint8());
+      const len = (0, length_1.decodeLength)(stream);
+      const value = stream.slice(stream.position, len);
+      const start = stream.position;
+      let subs = [];
+      if (tag.constructed) {
+        subs = collectSubs(stream, len, depth);
+      } else if (tag.isOctetString()) {
+        try {
+          subs = collectSubs(stream, len, depth);
+        } catch (e) {
+        }
+      }
+      if (subs.length === 0) {
+        stream.seek(start + len);
+      }
+      return new ASN1Obj(tag, value, subs);
+    }
+    function collectSubs(stream, len, depth) {
+      const end = stream.position + len;
+      if (end > stream.length) {
+        throw new error_1.ASN1ParseError("invalid length");
+      }
+      const subs = [];
+      while (stream.position < end) {
+        subs.push(parseStream(stream, depth + 1));
+      }
+      if (stream.position !== end) {
+        throw new error_1.ASN1ParseError("invalid length");
+      }
+      return subs;
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/asn1/index.js
+var require_asn1 = __commonJS({
+  "node_modules/@sigstore/core/dist/asn1/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ASN1Obj = void 0;
+    var obj_1 = require_obj();
+    Object.defineProperty(exports, "ASN1Obj", { enumerable: true, get: function() {
+      return obj_1.ASN1Obj;
+    } });
+  }
+});
+
+// node_modules/@sigstore/core/dist/crypto.js
+var require_crypto = __commonJS({
+  "node_modules/@sigstore/core/dist/crypto.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.createPublicKey = createPublicKey;
+    exports.digest = digest;
+    exports.verify = verify;
+    exports.bufferEqual = bufferEqual;
+    var crypto_1 = __importDefault(__require("crypto"));
+    function createPublicKey(key, type = "spki") {
+      if (typeof key === "string") {
+        if (key.startsWith("-----")) {
+          return crypto_1.default.createPublicKey(key);
+        } else {
+          return crypto_1.default.createPublicKey({
+            key: Buffer.from(key, "base64"),
+            format: "der",
+            type
+          });
+        }
+      } else {
+        return crypto_1.default.createPublicKey({ key, format: "der", type });
+      }
+    }
+    function digest(algorithm, ...data) {
+      const hash = crypto_1.default.createHash(algorithm);
+      for (const d of data) {
+        hash.update(d);
+      }
+      return hash.digest();
+    }
+    function verify(data, key, signature, algorithm) {
+      try {
+        return crypto_1.default.verify(algorithm, data, key, signature);
+      } catch (e) {
+        return false;
+      }
+    }
+    function bufferEqual(a, b) {
+      try {
+        return crypto_1.default.timingSafeEqual(a, b);
+      } catch {
+        return false;
+      }
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/dsse.js
+var require_dsse = __commonJS({
+  "node_modules/@sigstore/core/dist/dsse.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.preAuthEncoding = preAuthEncoding;
+    var PAE_PREFIX = "DSSEv1";
+    function preAuthEncoding(payloadType, payload) {
+      const typeBytes = Buffer.from(payloadType, "utf-8");
+      return Buffer.concat([
+        Buffer.from(`${PAE_PREFIX} ${typeBytes.length} `, "ascii"),
+        typeBytes,
+        Buffer.from(` ${payload.length} `, "ascii"),
+        payload
+      ]);
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/encoding.js
+var require_encoding = __commonJS({
+  "node_modules/@sigstore/core/dist/encoding.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.base64Encode = base64Encode;
+    exports.base64Decode = base64Decode;
+    var BASE64_ENCODING = "base64";
+    var UTF8_ENCODING = "utf-8";
+    function base64Encode(str) {
+      return Buffer.from(str, UTF8_ENCODING).toString(BASE64_ENCODING);
+    }
+    function base64Decode(str) {
+      return Buffer.from(str, BASE64_ENCODING).toString(UTF8_ENCODING);
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/json.js
+var require_json = __commonJS({
+  "node_modules/@sigstore/core/dist/json.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.canonicalize = canonicalize;
+    function canonicalize(object) {
+      let buffer = "";
+      if (object === null || typeof object !== "object" || object.toJSON != null) {
+        buffer += JSON.stringify(object);
+      } else if (Array.isArray(object)) {
+        buffer += "[";
+        let first = true;
+        object.forEach((element) => {
+          if (!first) {
+            buffer += ",";
+          }
+          first = false;
+          buffer += canonicalize(element);
+        });
+        buffer += "]";
+      } else {
+        buffer += "{";
+        let first = true;
+        Object.keys(object).sort().forEach((property) => {
+          if (!first) {
+            buffer += ",";
+          }
+          first = false;
+          buffer += JSON.stringify(property);
+          buffer += ":";
+          buffer += canonicalize(object[property]);
+        });
+        buffer += "}";
+      }
+      return buffer;
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/pem.js
+var require_pem = __commonJS({
+  "node_modules/@sigstore/core/dist/pem.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.toDER = toDER;
+    exports.fromDER = fromDER;
+    var PEM_HEADER = /-----BEGIN (.*)-----/;
+    var PEM_FOOTER = /-----END (.*)-----/;
+    function toDER(certificate) {
+      let der = "";
+      certificate.split("\n").forEach((line) => {
+        if (line.match(PEM_HEADER) || line.match(PEM_FOOTER)) {
+          return;
+        }
+        der += line;
+      });
+      return Buffer.from(der, "base64");
+    }
+    function fromDER(certificate, type = "CERTIFICATE") {
+      const der = certificate.toString("base64");
+      const lines = der.match(/.{1,64}/g) || "";
+      return [`-----BEGIN ${type}-----`, ...lines, `-----END ${type}-----`].join("\n").concat("\n");
+    }
+  }
+});
+
+// node_modules/@sigstore/core/dist/oid.js
+var require_oid = __commonJS({
+  "node_modules/@sigstore/core/dist/oid.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SHA2_HASH_ALGOS = exports.RSA_SIGNATURE_ALGOS = exports.ECDSA_SIGNATURE_ALGOS = void 0;
+    exports.ECDSA_SIGNATURE_ALGOS = {
+      "1.2.840.10045.4.3.1": "sha224",
+      "1.2.840.10045.4.3.2": "sha256",
+      "1.2.840.10045.4.3.3": "sha384",
+      "1.2.840.10045.4.3.4": "sha512"
+    };
+    exports.RSA_SIGNATURE_ALGOS = {
+      "1.2.840.113549.1.1.14": "sha224",
+      "1.2.840.113549.1.1.11": "sha256",
+      "1.2.840.113549.1.1.12": "sha384",
+      "1.2.840.113549.1.1.13": "sha512"
+    };
+    exports.SHA2_HASH_ALGOS = {
+      "2.16.840.1.101.3.4.2.1": "sha256",
+      "2.16.840.1.101.3.4.2.2": "sha384",
+      "2.16.840.1.101.3.4.2.3": "sha512"
+    };
+  }
+});
+
+// node_modules/@sigstore/core/dist/rfc3161/error.js
+var require_error2 = __commonJS({
+  "node_modules/@sigstore/core/dist/rfc3161/error.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.RFC3161TimestampVerificationError = void 0;
+    var RFC3161TimestampVerificationError = class extends Error {
+    };
+    exports.RFC3161TimestampVerificationError = RFC3161TimestampVerificationError;
+  }
+});
+
+// node_modules/@sigstore/core/dist/rfc3161/tstinfo.js
+var require_tstinfo = __commonJS({
+  "node_modules/@sigstore/core/dist/rfc3161/tstinfo.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.TSTInfo = void 0;
+    var crypto = __importStar(require_crypto());
+    var oid_1 = require_oid();
+    var error_1 = require_error2();
+    var TSTInfo = class {
+      root;
+      constructor(asn1) {
+        this.root = asn1;
+      }
+      get version() {
+        return this.root.subs[0].toInteger();
+      }
+      get genTime() {
+        return this.root.subs[4].toDate();
+      }
+      get messageImprintHashAlgorithm() {
+        const oid = this.messageImprintObj.subs[0].subs[0].toOID();
+        return oid_1.SHA2_HASH_ALGOS[oid];
+      }
+      get messageImprintHashedMessage() {
+        return this.messageImprintObj.subs[1].value;
+      }
+      get raw() {
+        return this.root.toDER();
+      }
+      verify(data) {
+        const digest = crypto.digest(this.messageImprintHashAlgorithm, data);
+        if (!crypto.bufferEqual(digest, this.messageImprintHashedMessage)) {
+          throw new error_1.RFC3161TimestampVerificationError("message imprint does not match artifact");
+        }
+      }
+      // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+      get messageImprintObj() {
+        return this.root.subs[2];
+      }
+    };
+    exports.TSTInfo = TSTInfo;
+  }
+});
+
+// node_modules/@sigstore/core/dist/rfc3161/timestamp.js
+var require_timestamp = __commonJS({
+  "node_modules/@sigstore/core/dist/rfc3161/timestamp.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.RFC3161Timestamp = void 0;
+    var asn1_1 = require_asn1();
+    var crypto = __importStar(require_crypto());
+    var oid_1 = require_oid();
+    var error_1 = require_error2();
+    var tstinfo_1 = require_tstinfo();
+    var OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = "1.2.840.113549.1.7.2";
+    var OID_PKCS9_CONTENT_TYPE_TSTINFO = "1.2.840.113549.1.9.16.1.4";
+    var OID_PKCS9_MESSAGE_DIGEST_KEY = "1.2.840.113549.1.9.4";
+    var RFC3161Timestamp = class _RFC3161Timestamp {
+      root;
+      constructor(asn1) {
+        this.root = asn1;
+      }
+      static parse(der) {
+        const asn1 = asn1_1.ASN1Obj.parseBuffer(der);
+        return new _RFC3161Timestamp(asn1);
+      }
+      get status() {
+        return this.pkiStatusInfoObj.subs[0].toInteger();
+      }
+      get contentType() {
+        return this.contentTypeObj.toOID();
+      }
+      get eContentType() {
+        return this.eContentTypeObj.toOID();
+      }
+      get signingTime() {
+        return this.tstInfo.genTime;
+      }
+      get signerIssuer() {
+        return this.signerSidObj.subs[0].value;
+      }
+      get signerSerialNumber() {
+        return this.signerSidObj.subs[1].value;
+      }
+      get signerDigestAlgorithm() {
+        const oid = this.signerDigestAlgorithmObj.subs[0].toOID();
+        return oid_1.SHA2_HASH_ALGOS[oid];
+      }
+      get signatureAlgorithm() {
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        return oid_1.ECDSA_SIGNATURE_ALGOS[oid];
+      }
+      get signatureValue() {
+        return this.signatureValueObj.value;
+      }
+      get tstInfo() {
+        return new tstinfo_1.TSTInfo(this.eContentObj.subs[0].subs[0]);
+      }
+      verify(data, publicKey) {
+        if (!this.timeStampTokenObj) {
+          throw new error_1.RFC3161TimestampVerificationError("timeStampToken is missing");
+        }
+        if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) {
+          throw new error_1.RFC3161TimestampVerificationError(`incorrect content type: ${this.contentType}`);
+        }
+        if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) {
+          throw new error_1.RFC3161TimestampVerificationError(`incorrect encapsulated content type: ${this.eContentType}`);
+        }
+        this.tstInfo.verify(data);
+        this.verifyMessageDigest();
+        this.verifySignature(publicKey);
+      }
+      verifyMessageDigest() {
+        const tstInfoDigest = crypto.digest(this.signerDigestAlgorithm, this.tstInfo.raw);
+        const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;
+        if (!crypto.bufferEqual(tstInfoDigest, expectedDigest)) {
+          throw new error_1.RFC3161TimestampVerificationError("signed data does not match tstInfo");
+        }
+      }
+      verifySignature(key) {
+        const signedAttrs = this.signedAttrsObj.toDER();
+        signedAttrs[0] = 49;
+        const verified = crypto.verify(signedAttrs, key, this.signatureValue, this.signatureAlgorithm);
+        if (!verified) {
+          throw new error_1.RFC3161TimestampVerificationError("signature verification failed");
+        }
+      }
+      // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+      get pkiStatusInfoObj() {
+        return this.root.subs[0];
+      }
+      // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+      get timeStampTokenObj() {
+        return this.root.subs[1];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-3
+      get contentTypeObj() {
+        return this.timeStampTokenObj.subs[0];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5652#section-3
+      get signedDataObj() {
+        const obj = this.timeStampTokenObj.subs.find((sub) => sub.tag.isContextSpecific(0));
+        return obj.subs[0];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
+      get encapContentInfoObj() {
+        return this.signedDataObj.subs[2];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
+      get signerInfosObj() {
+        const sd = this.signedDataObj;
+        return sd.subs[sd.subs.length - 1];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5652#section-5.1
+      get signerInfoObj() {
+        return this.signerInfosObj.subs[0];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
+      get eContentTypeObj() {
+        return this.encapContentInfoObj.subs[0];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
+      get eContentObj() {
+        return this.encapContentInfoObj.subs[1];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+      get signedAttrsObj() {
+        const signedAttrs = this.signerInfoObj.subs.find((sub) => sub.tag.isContextSpecific(0));
+        return signedAttrs;
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+      get messageDigestAttributeObj() {
+        const messageDigest = this.signedAttrsObj.subs.find((sub) => sub.subs[0].tag.isOID() && sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY);
+        return messageDigest;
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+      get signerSidObj() {
+        return this.signerInfoObj.subs[1];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+      get signerDigestAlgorithmObj() {
+        return this.signerInfoObj.subs[2];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+      get signatureAlgorithmObj() {
+        return this.signerInfoObj.subs[4];
+      }
+      // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+      get signatureValueObj() {
+        return this.signerInfoObj.subs[5];
+      }
+    };
+    exports.RFC3161Timestamp = RFC3161Timestamp;
+  }
+});
+
+// node_modules/@sigstore/core/dist/rfc3161/index.js
+var require_rfc3161 = __commonJS({
+  "node_modules/@sigstore/core/dist/rfc3161/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.RFC3161Timestamp = void 0;
+    var timestamp_1 = require_timestamp();
+    Object.defineProperty(exports, "RFC3161Timestamp", { enumerable: true, get: function() {
+      return timestamp_1.RFC3161Timestamp;
+    } });
+  }
+});
+
+// node_modules/@sigstore/core/dist/x509/sct.js
+var require_sct = __commonJS({
+  "node_modules/@sigstore/core/dist/x509/sct.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SignedCertificateTimestamp = void 0;
+    var crypto = __importStar(require_crypto());
+    var stream_1 = require_stream();
+    var SignedCertificateTimestamp = class _SignedCertificateTimestamp {
+      version;
+      logID;
+      timestamp;
+      extensions;
+      hashAlgorithm;
+      signatureAlgorithm;
+      signature;
+      constructor(options) {
+        this.version = options.version;
+        this.logID = options.logID;
+        this.timestamp = options.timestamp;
+        this.extensions = options.extensions;
+        this.hashAlgorithm = options.hashAlgorithm;
+        this.signatureAlgorithm = options.signatureAlgorithm;
+        this.signature = options.signature;
+      }
+      get datetime() {
+        return new Date(Number(this.timestamp.readBigInt64BE()));
+      }
+      // Returns the hash algorithm used to generate the SCT's signature.
+      // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
+      get algorithm() {
+        switch (this.hashAlgorithm) {
+          /* istanbul ignore next */
+          case 0:
+            return "none";
+          /* istanbul ignore next */
+          case 1:
+            return "md5";
+          /* istanbul ignore next */
+          case 2:
+            return "sha1";
+          /* istanbul ignore next */
+          case 3:
+            return "sha224";
+          case 4:
+            return "sha256";
+          /* istanbul ignore next */
+          case 5:
+            return "sha384";
+          /* istanbul ignore next */
+          case 6:
+            return "sha512";
+          /* istanbul ignore next */
+          default:
+            return "unknown";
+        }
+      }
+      verify(preCert, key) {
+        const stream = new stream_1.ByteStream();
+        stream.appendChar(this.version);
+        stream.appendChar(0);
+        stream.appendView(this.timestamp);
+        stream.appendUint16(1);
+        stream.appendView(preCert);
+        stream.appendUint16(this.extensions.byteLength);
+        if (this.extensions.byteLength > 0) {
+          stream.appendView(this.extensions);
+        }
+        return crypto.verify(stream.buffer, key, this.signature, this.algorithm);
+      }
+      // Parses a SignedCertificateTimestamp from a buffer. SCTs are encoded using
+      // TLS encoding which means the fields and lengths of most fields are
+      // specified as part of the SCT and TLS specs.
+      // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+      // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
+      static parse(buf) {
+        const stream = new stream_1.ByteStream(buf);
+        const version = stream.getUint8();
+        const logID = stream.getBlock(32);
+        const timestamp = stream.getBlock(8);
+        const extenstionLength = stream.getUint16();
+        const extensions = stream.getBlock(extenstionLength);
+        const hashAlgorithm = stream.getUint8();
+        const signatureAlgorithm = stream.getUint8();
+        const sigLength = stream.getUint16();
+        const signature = stream.getBlock(sigLength);
+        if (stream.position !== buf.length) {
+          throw new Error("SCT buffer length mismatch");
+        }
+        return new _SignedCertificateTimestamp({
+          version,
+          logID,
+          timestamp,
+          extensions,
+          hashAlgorithm,
+          signatureAlgorithm,
+          signature
+        });
+      }
+    };
+    exports.SignedCertificateTimestamp = SignedCertificateTimestamp;
+  }
+});
+
+// node_modules/@sigstore/core/dist/x509/ext.js
+var require_ext = __commonJS({
+  "node_modules/@sigstore/core/dist/x509/ext.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.X509SCTExtension = exports.X509SubjectKeyIDExtension = exports.X509AuthorityKeyIDExtension = exports.X509SubjectAlternativeNameExtension = exports.X509KeyUsageExtension = exports.X509BasicConstraintsExtension = exports.X509Extension = void 0;
+    var stream_1 = require_stream();
+    var sct_1 = require_sct();
+    var X509Extension = class {
+      root;
+      constructor(asn1) {
+        this.root = asn1;
+      }
+      get oid() {
+        return this.root.subs[0].toOID();
+      }
+      get critical() {
+        return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
+      }
+      get value() {
+        return this.extnValueObj.value;
+      }
+      get valueObj() {
+        return this.extnValueObj;
+      }
+      get extnValueObj() {
+        return this.root.subs[this.root.subs.length - 1];
+      }
+    };
+    exports.X509Extension = X509Extension;
+    var X509BasicConstraintsExtension = class extends X509Extension {
+      get isCA() {
+        return this.sequence.subs[0]?.toBoolean() ?? false;
+      }
+      get pathLenConstraint() {
+        return this.sequence.subs.length > 1 ? this.sequence.subs[1].toInteger() : void 0;
+      }
+      // The extnValue field contains a single sequence wrapping the isCA and
+      // pathLenConstraint.
+      get sequence() {
+        return this.extnValueObj.subs[0];
+      }
+    };
+    exports.X509BasicConstraintsExtension = X509BasicConstraintsExtension;
+    var X509KeyUsageExtension = class extends X509Extension {
+      get digitalSignature() {
+        return this.bitString[0] === 1;
+      }
+      get keyCertSign() {
+        return this.bitString[5] === 1;
+      }
+      get crlSign() {
+        return this.bitString[6] === 1;
+      }
+      // The extnValue field contains a single bit string which is a bit mask
+      // indicating which key usages are enabled.
+      get bitString() {
+        return this.extnValueObj.subs[0].toBitString();
+      }
+    };
+    exports.X509KeyUsageExtension = X509KeyUsageExtension;
+    var X509SubjectAlternativeNameExtension = class extends X509Extension {
+      get rfc822Name() {
+        return this.findGeneralName(1)?.value.toString("ascii");
+      }
+      get uri() {
+        return this.findGeneralName(6)?.value.toString("ascii");
+      }
+      // Retrieve the value of an otherName with the given OID.
+      otherName(oid) {
+        const otherName = this.findGeneralName(0);
+        if (otherName === void 0) {
+          return void 0;
+        }
+        const otherNameOID = otherName.subs[0].toOID();
+        if (otherNameOID !== oid) {
+          return void 0;
+        }
+        const otherNameValue = otherName.subs[1];
+        return otherNameValue.subs[0].value.toString("ascii");
+      }
+      findGeneralName(tag) {
+        return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));
+      }
+      // The extnValue field contains a sequence of GeneralNames.
+      get generalNames() {
+        return this.extnValueObj.subs[0].subs;
+      }
+    };
+    exports.X509SubjectAlternativeNameExtension = X509SubjectAlternativeNameExtension;
+    var X509AuthorityKeyIDExtension = class extends X509Extension {
+      get keyIdentifier() {
+        return this.findSequenceMember(0)?.value;
+      }
+      findSequenceMember(tag) {
+        return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));
+      }
+      // The extnValue field contains a single sequence wrapping the keyIdentifier
+      get sequence() {
+        return this.extnValueObj.subs[0];
+      }
+    };
+    exports.X509AuthorityKeyIDExtension = X509AuthorityKeyIDExtension;
+    var X509SubjectKeyIDExtension = class extends X509Extension {
+      get keyIdentifier() {
+        return this.extnValueObj.subs[0].value;
+      }
+    };
+    exports.X509SubjectKeyIDExtension = X509SubjectKeyIDExtension;
+    var X509SCTExtension = class extends X509Extension {
+      constructor(asn1) {
+        super(asn1);
+      }
+      get signedCertificateTimestamps() {
+        const buf = this.extnValueObj.subs[0].value;
+        const stream = new stream_1.ByteStream(buf);
+        const end = stream.getUint16() + 2;
+        const sctList = [];
+        while (stream.position < end) {
+          const sctLength = stream.getUint16();
+          const sct = stream.getBlock(sctLength);
+          sctList.push(sct_1.SignedCertificateTimestamp.parse(sct));
+        }
+        if (stream.position !== end) {
+          throw new Error("SCT list length does not match actual length");
+        }
+        return sctList;
+      }
+    };
+    exports.X509SCTExtension = X509SCTExtension;
+  }
+});
+
+// node_modules/@sigstore/core/dist/x509/cert.js
+var require_cert = __commonJS({
+  "node_modules/@sigstore/core/dist/x509/cert.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.X509Certificate = exports.EXTENSION_OID_SCT = void 0;
+    var asn1_1 = require_asn1();
+    var crypto = __importStar(require_crypto());
+    var oid_1 = require_oid();
+    var pem = __importStar(require_pem());
+    var ext_1 = require_ext();
+    var EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
+    var EXTENSION_OID_KEY_USAGE = "2.5.29.15";
+    var EXTENSION_OID_SUBJECT_ALT_NAME = "2.5.29.17";
+    var EXTENSION_OID_BASIC_CONSTRAINTS = "2.5.29.19";
+    var EXTENSION_OID_AUTHORITY_KEY_ID = "2.5.29.35";
+    exports.EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+    var X509Certificate = class _X509Certificate {
+      root;
+      constructor(asn1) {
+        this.root = asn1;
+      }
+      static parse(cert) {
+        const der = typeof cert === "string" ? pem.toDER(cert) : cert;
+        const asn1 = asn1_1.ASN1Obj.parseBuffer(der);
+        return new _X509Certificate(asn1);
+      }
+      get tbsCertificate() {
+        return this.tbsCertificateObj;
+      }
+      get version() {
+        const ver = this.versionObj.subs[0].toInteger();
+        return `v${(ver + BigInt(1)).toString()}`;
+      }
+      get serialNumber() {
+        return this.serialNumberObj.value;
+      }
+      get notBefore() {
+        return this.validityObj.subs[0].toDate();
+      }
+      get notAfter() {
+        return this.validityObj.subs[1].toDate();
+      }
+      get issuer() {
+        return this.issuerObj.value;
+      }
+      get subject() {
+        return this.subjectObj.value;
+      }
+      get publicKey() {
+        return this.subjectPublicKeyInfoObj.toDER();
+      }
+      get signatureAlgorithm() {
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        if (oid_1.RSA_SIGNATURE_ALGOS[oid]) {
+          return oid_1.RSA_SIGNATURE_ALGOS[oid];
+        }
+        return oid_1.ECDSA_SIGNATURE_ALGOS[oid];
+      }
+      get signatureValue() {
+        return this.signatureValueObj.value.subarray(1);
+      }
+      get subjectAltName() {
+        const ext = this.extSubjectAltName;
+        return ext?.uri || /* istanbul ignore next */
+        ext?.rfc822Name;
+      }
+      get extensions() {
+        const extSeq = this.extensionsObj?.subs[0];
+        return extSeq?.subs || [];
+      }
+      get extKeyUsage() {
+        const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);
+        return ext ? new ext_1.X509KeyUsageExtension(ext) : void 0;
+      }
+      get extBasicConstraints() {
+        const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);
+        return ext ? new ext_1.X509BasicConstraintsExtension(ext) : void 0;
+      }
+      get extSubjectAltName() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);
+        return ext ? new ext_1.X509SubjectAlternativeNameExtension(ext) : void 0;
+      }
+      get extAuthorityKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);
+        return ext ? new ext_1.X509AuthorityKeyIDExtension(ext) : void 0;
+      }
+      get extSubjectKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);
+        return ext ? new ext_1.X509SubjectKeyIDExtension(ext) : (
+          /* istanbul ignore next */
+          void 0
+        );
+      }
+      get extSCT() {
+        const ext = this.findExtension(exports.EXTENSION_OID_SCT);
+        return ext ? new ext_1.X509SCTExtension(ext) : void 0;
+      }
+      get isCA() {
+        const ca = this.extBasicConstraints?.isCA || false;
+        if (this.extKeyUsage) {
+          return ca && this.extKeyUsage.keyCertSign;
+        }
+        return ca;
+      }
+      extension(oid) {
+        const ext = this.findExtension(oid);
+        return ext ? new ext_1.X509Extension(ext) : void 0;
+      }
+      verify(issuerCertificate) {
+        const publicKey = issuerCertificate?.publicKey || this.publicKey;
+        const key = crypto.createPublicKey(publicKey);
+        return crypto.verify(this.tbsCertificate.toDER(), key, this.signatureValue, this.signatureAlgorithm);
+      }
+      validForDate(date) {
+        return this.notBefore <= date && date <= this.notAfter;
+      }
+      equals(other) {
+        return this.root.toDER().equals(other.root.toDER());
+      }
+      // Creates a copy of the certificate with a new buffer
+      clone() {
+        const der = this.root.toDER();
+        const clone = Buffer.alloc(der.length);
+        der.copy(clone);
+        return _X509Certificate.parse(clone);
+      }
+      findExtension(oid) {
+        return this.extensions.find((ext) => ext.subs[0].toOID() === oid);
+      }
+      /////////////////////////////////////////////////////////////////////////////
+      // The following properties use the documented x509 structure to locate the
+      // desired ASN.1 object
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1
+      get tbsCertificateObj() {
+        return this.root.subs[0];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2
+      get signatureAlgorithmObj() {
+        return this.root.subs[1];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3
+      get signatureValueObj() {
+        return this.root.subs[2];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1
+      get versionObj() {
+        return this.tbsCertificateObj.subs[0];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.2
+      get serialNumberObj() {
+        return this.tbsCertificateObj.subs[1];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4
+      get issuerObj() {
+        return this.tbsCertificateObj.subs[3];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5
+      get validityObj() {
+        return this.tbsCertificateObj.subs[4];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6
+      get subjectObj() {
+        return this.tbsCertificateObj.subs[5];
+      }
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7
+      get subjectPublicKeyInfoObj() {
+        return this.tbsCertificateObj.subs[6];
+      }
+      // Extensions can't be located by index because their position varies. Instead,
+      // we need to find the extensions context specific tag
+      // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9
+      get extensionsObj() {
+        return this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(3));
+      }
+    };
+    exports.X509Certificate = X509Certificate;
+  }
+});
+
+// node_modules/@sigstore/core/dist/x509/index.js
+var require_x509 = __commonJS({
+  "node_modules/@sigstore/core/dist/x509/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.X509SCTExtension = exports.X509Certificate = exports.EXTENSION_OID_SCT = void 0;
+    var cert_1 = require_cert();
+    Object.defineProperty(exports, "EXTENSION_OID_SCT", { enumerable: true, get: function() {
+      return cert_1.EXTENSION_OID_SCT;
+    } });
+    Object.defineProperty(exports, "X509Certificate", { enumerable: true, get: function() {
+      return cert_1.X509Certificate;
+    } });
+    var ext_1 = require_ext();
+    Object.defineProperty(exports, "X509SCTExtension", { enumerable: true, get: function() {
+      return ext_1.X509SCTExtension;
+    } });
+  }
+});
+
+// node_modules/@sigstore/core/dist/index.js
+var require_dist2 = __commonJS({
+  "node_modules/@sigstore/core/dist/index.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.X509SCTExtension = exports.X509Certificate = exports.EXTENSION_OID_SCT = exports.ByteStream = exports.RFC3161Timestamp = exports.pem = exports.json = exports.encoding = exports.dsse = exports.crypto = exports.ASN1Obj = void 0;
+    var asn1_1 = require_asn1();
+    Object.defineProperty(exports, "ASN1Obj", { enumerable: true, get: function() {
+      return asn1_1.ASN1Obj;
+    } });
+    exports.crypto = __importStar(require_crypto());
+    exports.dsse = __importStar(require_dsse());
+    exports.encoding = __importStar(require_encoding());
+    exports.json = __importStar(require_json());
+    exports.pem = __importStar(require_pem());
+    var rfc3161_1 = require_rfc3161();
+    Object.defineProperty(exports, "RFC3161Timestamp", { enumerable: true, get: function() {
+      return rfc3161_1.RFC3161Timestamp;
+    } });
+    var stream_1 = require_stream();
+    Object.defineProperty(exports, "ByteStream", { enumerable: true, get: function() {
+      return stream_1.ByteStream;
+    } });
+    var x509_1 = require_x509();
+    Object.defineProperty(exports, "EXTENSION_OID_SCT", { enumerable: true, get: function() {
+      return x509_1.EXTENSION_OID_SCT;
+    } });
+    Object.defineProperty(exports, "X509Certificate", { enumerable: true, get: function() {
+      return x509_1.X509Certificate;
+    } });
+    Object.defineProperty(exports, "X509SCTExtension", { enumerable: true, get: function() {
+      return x509_1.X509SCTExtension;
+    } });
+  }
+});
+
+// node_modules/@sigstore/verify/dist/bundle/dsse.js
+var require_dsse2 = __commonJS({
+  "node_modules/@sigstore/verify/dist/bundle/dsse.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DSSESignatureContent = void 0;
+    var core_1 = require_dist2();
+    var DSSESignatureContent = class {
+      env;
+      constructor(env) {
+        this.env = env;
+      }
+      compareDigest(digest) {
+        return core_1.crypto.bufferEqual(digest, core_1.crypto.digest("sha256", this.env.payload));
+      }
+      // For a DSSE envelope the signature is computed over the pre-authentication
+      // encoding (PAE), so the digest of the signed bytes is the digest of the PAE.
+      // This is what a Rekor v2 hashedrekord entry records for a DSSE envelope.
+      compareSignedDigest(digest) {
+        return core_1.crypto.bufferEqual(digest, core_1.crypto.digest("sha256", this.preAuthEncoding));
+      }
+      compareSignature(signature) {
+        return core_1.crypto.bufferEqual(signature, this.signature);
+      }
+      verifySignature(key) {
+        return core_1.crypto.verify(this.preAuthEncoding, key, this.signature);
+      }
+      get signature() {
+        return this.env.signatures.length > 0 ? this.env.signatures[0].sig : Buffer.from("");
+      }
+      // DSSE Pre-Authentication Encoding
+      get preAuthEncoding() {
+        return core_1.dsse.preAuthEncoding(this.env.payloadType, this.env.payload);
+      }
+    };
+    exports.DSSESignatureContent = DSSESignatureContent;
+  }
+});
+
+// node_modules/@sigstore/verify/dist/bundle/message.js
+var require_message = __commonJS({
+  "node_modules/@sigstore/verify/dist/bundle/message.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.MessageSignatureContent = void 0;
+    var core_1 = require_dist2();
+    var protobuf_specs_1 = require_dist();
+    var HASH_ALGORITHM_MAP = {
+      [protobuf_specs_1.HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED]: "sha256",
+      [protobuf_specs_1.HashAlgorithm.SHA2_256]: "sha256",
+      [protobuf_specs_1.HashAlgorithm.SHA2_384]: "sha384",
+      [protobuf_specs_1.HashAlgorithm.SHA2_512]: "sha512",
+      [protobuf_specs_1.HashAlgorithm.SHA3_256]: "sha3-256",
+      [protobuf_specs_1.HashAlgorithm.SHA3_384]: "sha3-384"
+    };
+    var MessageSignatureContent = class {
+      signature;
+      messageDigest;
+      artifact;
+      hashAlgorithm;
+      constructor(messageSignature, artifact) {
+        this.signature = messageSignature.signature;
+        this.messageDigest = messageSignature.messageDigest.digest;
+        this.artifact = artifact;
+        this.hashAlgorithm = HASH_ALGORITHM_MAP[messageSignature.messageDigest.algorithm] ?? /* istanbul ignore next */
+        "sha256";
+      }
+      compareSignature(signature) {
+        return core_1.crypto.bufferEqual(signature, this.signature);
+      }
+      compareDigest(digest) {
+        return core_1.crypto.bufferEqual(digest, this.messageDigest);
+      }
+      // For a message signature the signature is computed over the artifact, so the
+      // digest of the signed bytes is the artifact's message digest.
+      compareSignedDigest(digest) {
+        return this.compareDigest(digest);
+      }
+      verifySignature(key) {
+        return core_1.crypto.verify(this.artifact, key, this.signature, this.hashAlgorithm);
+      }
+    };
+    exports.MessageSignatureContent = MessageSignatureContent;
+  }
+});
+
+// node_modules/@sigstore/verify/dist/bundle/index.js
+var require_bundle = __commonJS({
+  "node_modules/@sigstore/verify/dist/bundle/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.toSignedEntity = toSignedEntity;
+    exports.signatureContent = signatureContent;
+    var core_1 = require_dist2();
+    var dsse_1 = require_dsse2();
+    var message_1 = require_message();
+    function toSignedEntity(bundle, artifact) {
+      const { tlogEntries, timestampVerificationData } = bundle.verificationMaterial;
+      const timestamps = [];
+      for (const entry of tlogEntries) {
+        if (entry.integratedTime && entry.integratedTime !== "0") {
+          timestamps.push({
+            $case: "transparency-log",
+            tlogEntry: entry
+          });
+        }
+      }
+      for (const ts of timestampVerificationData?.rfc3161Timestamps ?? []) {
+        timestamps.push({
+          $case: "timestamp-authority",
+          timestamp: core_1.RFC3161Timestamp.parse(Buffer.from(ts.signedTimestamp))
+        });
+      }
+      return {
+        signature: signatureContent(bundle, artifact),
+        key: key(bundle),
+        tlogEntries,
+        timestamps
+      };
+    }
+    function signatureContent(bundle, artifact) {
+      switch (bundle.content.$case) {
+        case "dsseEnvelope":
+          return new dsse_1.DSSESignatureContent(bundle.content.dsseEnvelope);
+        case "messageSignature":
+          return new message_1.MessageSignatureContent(bundle.content.messageSignature, artifact);
+      }
+    }
+    function key(bundle) {
+      switch (bundle.verificationMaterial.content.$case) {
+        case "publicKey":
+          return {
+            $case: "public-key",
+            hint: bundle.verificationMaterial.content.publicKey.hint
+          };
+        case "x509CertificateChain":
+          return {
+            $case: "certificate",
+            certificate: core_1.X509Certificate.parse(Buffer.from(bundle.verificationMaterial.content.x509CertificateChain.certificates[0].rawBytes))
+          };
+        case "certificate":
+          return {
+            $case: "certificate",
+            certificate: core_1.X509Certificate.parse(Buffer.from(bundle.verificationMaterial.content.certificate.rawBytes))
+          };
+      }
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/error.js
+var require_error3 = __commonJS({
+  "node_modules/@sigstore/verify/dist/error.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PolicyError = exports.VerificationError = void 0;
+    var BaseError = class extends Error {
+      code;
+      cause;
+      /* eslint-disable-line @typescript-eslint/no-explicit-any */
+      constructor({ code, message, cause }) {
+        super(message);
+        this.code = code;
+        this.cause = cause;
+        this.name = this.constructor.name;
+      }
+    };
+    var VerificationError = class extends BaseError {
+    };
+    exports.VerificationError = VerificationError;
+    var PolicyError = class extends BaseError {
+    };
+    exports.PolicyError = PolicyError;
+  }
+});
+
+// node_modules/@sigstore/verify/dist/trust/filter.js
+var require_filter = __commonJS({
+  "node_modules/@sigstore/verify/dist/trust/filter.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.filterCertAuthorities = filterCertAuthorities;
+    exports.filterTLogAuthorities = filterTLogAuthorities;
+    function filterCertAuthorities(certAuthorities, timestamp) {
+      return certAuthorities.filter((ca) => {
+        return ca.validFor.start <= timestamp && ca.validFor.end >= timestamp;
+      });
+    }
+    function filterTLogAuthorities(tlogAuthorities, criteria) {
+      return tlogAuthorities.filter((tlog) => {
+        if (criteria.logID && !tlog.logID.equals(criteria.logID)) {
+          return false;
+        }
+        return tlog.validFor.start <= criteria.targetDate && criteria.targetDate <= tlog.validFor.end;
+      });
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/trust/index.js
+var require_trust = __commonJS({
+  "node_modules/@sigstore/verify/dist/trust/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.filterTLogAuthorities = exports.filterCertAuthorities = void 0;
+    exports.toTrustMaterial = toTrustMaterial;
+    var core_1 = require_dist2();
+    var protobuf_specs_1 = require_dist();
+    var error_1 = require_error3();
+    var BEGINNING_OF_TIME = /* @__PURE__ */ new Date(0);
+    var END_OF_TIME = /* @__PURE__ */ new Date(864e13);
+    var filter_1 = require_filter();
+    Object.defineProperty(exports, "filterCertAuthorities", { enumerable: true, get: function() {
+      return filter_1.filterCertAuthorities;
+    } });
+    Object.defineProperty(exports, "filterTLogAuthorities", { enumerable: true, get: function() {
+      return filter_1.filterTLogAuthorities;
+    } });
+    function toTrustMaterial(root, keys) {
+      const keyFinder = typeof keys === "function" ? keys : keyLocator(keys);
+      return {
+        certificateAuthorities: root.certificateAuthorities.map(createCertAuthority),
+        timestampAuthorities: root.timestampAuthorities.map(createCertAuthority),
+        tlogs: root.tlogs.map(createTLogAuthority),
+        ctlogs: root.ctlogs.map(createTLogAuthority),
+        publicKey: keyFinder
+      };
+    }
+    function createTLogAuthority(tlogInstance) {
+      const keyDetails = tlogInstance.publicKey.keyDetails;
+      const keyType = keyDetails === protobuf_specs_1.PublicKeyDetails.PKCS1_RSA_PKCS1V5 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V5 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256 ? "pkcs1" : "spki";
+      return {
+        baseURL: tlogInstance.baseUrl,
+        logID: tlogInstance.checkpointKeyId ? tlogInstance.checkpointKeyId.keyId : tlogInstance.logId.keyId,
+        publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes, keyType),
+        validFor: {
+          start: tlogInstance.publicKey.validFor?.start || BEGINNING_OF_TIME,
+          end: tlogInstance.publicKey.validFor?.end || END_OF_TIME
+        }
+      };
+    }
+    function createCertAuthority(ca) {
+      return {
+        certChain: ca.certChain.certificates.map((cert) => {
+          return core_1.X509Certificate.parse(Buffer.from(cert.rawBytes));
+        }),
+        validFor: {
+          start: ca.validFor?.start || BEGINNING_OF_TIME,
+          end: ca.validFor?.end || END_OF_TIME
+        }
+      };
+    }
+    function keyLocator(keys) {
+      return (hint) => {
+        const key = (keys || {})[hint];
+        if (!key) {
+          throw new error_1.VerificationError({
+            code: "PUBLIC_KEY_ERROR",
+            message: `key not found: ${hint}`
+          });
+        }
+        return {
+          publicKey: core_1.crypto.createPublicKey(key.rawBytes),
+          validFor: (date) => {
+            return (key.validFor?.start || BEGINNING_OF_TIME) <= date && (key.validFor?.end || END_OF_TIME) >= date;
+          }
+        };
+      };
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/key/certificate.js
+var require_certificate = __commonJS({
+  "node_modules/@sigstore/verify/dist/key/certificate.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.CertificateChainVerifier = void 0;
+    exports.verifyCertificateChain = verifyCertificateChain;
+    var error_1 = require_error3();
+    var trust_1 = require_trust();
+    function verifyCertificateChain(timestamp, leaf, certificateAuthorities) {
+      const cas = (0, trust_1.filterCertAuthorities)(certificateAuthorities, timestamp);
+      let error;
+      for (const ca of cas) {
+        try {
+          const verifier = new CertificateChainVerifier({
+            trustedCerts: ca.certChain,
+            untrustedCert: leaf,
+            timestamp
+          });
+          return verifier.verify();
+        } catch (err) {
+          error = err;
+        }
+      }
+      throw new error_1.VerificationError({
+        code: "CERTIFICATE_ERROR",
+        message: "Failed to verify certificate chain",
+        cause: error
+      });
+    }
+    var CertificateChainVerifier = class {
+      untrustedCert;
+      trustedCerts;
+      localCerts;
+      timestamp;
+      constructor(opts) {
+        this.untrustedCert = opts.untrustedCert;
+        this.trustedCerts = opts.trustedCerts;
+        this.localCerts = dedupeCertificates([
+          ...opts.trustedCerts,
+          opts.untrustedCert
+        ]);
+        this.timestamp = opts.timestamp;
+      }
+      verify() {
+        const certificatePath = this.sort();
+        this.checkPath(certificatePath);
+        const validForDate = certificatePath.every((cert) => cert.validForDate(this.timestamp));
+        if (!validForDate) {
+          throw new error_1.VerificationError({
+            code: "CERTIFICATE_ERROR",
+            message: "certificate is not valid or expired at the specified date"
+          });
+        }
+        return certificatePath;
+      }
+      sort() {
+        const leafCert = this.untrustedCert;
+        let paths = this.buildPaths(leafCert);
+        paths = paths.filter((path2) => path2.some((cert) => this.trustedCerts.includes(cert)));
+        if (paths.length === 0) {
+          throw new error_1.VerificationError({
+            code: "CERTIFICATE_ERROR",
+            message: "no trusted certificate path found"
+          });
+        }
+        const path = paths.reduce((prev, curr) => prev.length < curr.length ? prev : curr);
+        return [leafCert, ...path].slice(0, -1);
+      }
+      // Recursively build all possible paths from the leaf to the root
+      buildPaths(certificate) {
+        const paths = [];
+        const issuers = this.findIssuer(certificate);
+        if (issuers.length === 0) {
+          throw new error_1.VerificationError({
+            code: "CERTIFICATE_ERROR",
+            message: "no valid certificate path found"
+          });
+        }
+        for (let i = 0; i < issuers.length; i++) {
+          const issuer = issuers[i];
+          if (issuer.equals(certificate)) {
+            paths.push([certificate]);
+            continue;
+          }
+          const subPaths = this.buildPaths(issuer);
+          for (let j = 0; j < subPaths.length; j++) {
+            paths.push([issuer, ...subPaths[j]]);
+          }
+        }
+        return paths;
+      }
+      // Return all possible issuers for the given certificate
+      findIssuer(certificate) {
+        let issuers = [];
+        let keyIdentifier;
+        if (certificate.subject.equals(certificate.issuer)) {
+          if (certificate.verify()) {
+            return [certificate];
+          }
+        }
+        if (certificate.extAuthorityKeyID) {
+          keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;
+        }
+        this.localCerts.forEach((possibleIssuer) => {
+          if (keyIdentifier) {
+            if (possibleIssuer.extSubjectKeyID) {
+              if (possibleIssuer.extSubjectKeyID.keyIdentifier.equals(keyIdentifier)) {
+                issuers.push(possibleIssuer);
+              }
+              return;
+            }
+          }
+          if (possibleIssuer.subject.equals(certificate.issuer)) {
+            issuers.push(possibleIssuer);
+          }
+        });
+        issuers = issuers.filter((issuer) => {
+          try {
+            return certificate.verify(issuer);
+          } catch (ex) {
+            return false;
+          }
+        });
+        return issuers;
+      }
+      checkPath(path) {
+        if (path.length < 1) {
+          throw new error_1.VerificationError({
+            code: "CERTIFICATE_ERROR",
+            message: "certificate chain must contain at least one certificate"
+          });
+        }
+        const validCAs = path.slice(1).every((cert) => cert.isCA);
+        if (!validCAs) {
+          throw new error_1.VerificationError({
+            code: "CERTIFICATE_ERROR",
+            message: "intermediate certificate is not a CA"
+          });
+        }
+        for (let i = path.length - 2; i >= 0; i--) {
+          if (!path[i].issuer.equals(path[i + 1].subject)) {
+            throw new error_1.VerificationError({
+              code: "CERTIFICATE_ERROR",
+              message: "incorrect certificate name chaining"
+            });
+          }
+        }
+        for (let i = 0; i < path.length; i++) {
+          const cert = path[i];
+          if (cert.extBasicConstraints?.isCA) {
+            const pathLength = cert.extBasicConstraints.pathLenConstraint;
+            if (pathLength !== void 0 && pathLength < i - 1) {
+              throw new error_1.VerificationError({
+                code: "CERTIFICATE_ERROR",
+                message: "path length constraint exceeded"
+              });
+            }
+          }
+        }
+      }
+    };
+    exports.CertificateChainVerifier = CertificateChainVerifier;
+    function dedupeCertificates(certs) {
+      for (let i = 0; i < certs.length; i++) {
+        for (let j = i + 1; j < certs.length; j++) {
+          if (certs[i].equals(certs[j])) {
+            certs.splice(j, 1);
+            j--;
+          }
+        }
+      }
+      return certs;
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/key/sct.js
+var require_sct2 = __commonJS({
+  "node_modules/@sigstore/verify/dist/key/sct.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifySCTs = verifySCTs;
+    var core_1 = require_dist2();
+    var error_1 = require_error3();
+    var trust_1 = require_trust();
+    function verifySCTs(cert, issuer, ctlogs) {
+      let extSCT;
+      const clone = cert.clone();
+      for (let i = 0; i < clone.extensions.length; i++) {
+        const ext = clone.extensions[i];
+        if (ext.subs[0].toOID() === core_1.EXTENSION_OID_SCT) {
+          extSCT = new core_1.X509SCTExtension(ext);
+          clone.extensions.splice(i, 1);
+          break;
+        }
+      }
+      if (!extSCT) {
+        return [];
+      }
+      if (extSCT.signedCertificateTimestamps.length === 0) {
+        return [];
+      }
+      const preCert = new core_1.ByteStream();
+      const issuerId = core_1.crypto.digest("sha256", issuer.publicKey);
+      preCert.appendView(issuerId);
+      const tbs = clone.tbsCertificate.toDER();
+      preCert.appendUint24(tbs.length);
+      preCert.appendView(tbs);
+      return extSCT.signedCertificateTimestamps.map((sct) => {
+        const validCTLogs = (0, trust_1.filterTLogAuthorities)(ctlogs, {
+          logID: sct.logID,
+          targetDate: sct.datetime
+        });
+        const verified = validCTLogs.some((log) => sct.verify(preCert.buffer, log.publicKey));
+        if (!verified) {
+          throw new error_1.VerificationError({
+            code: "CERTIFICATE_ERROR",
+            message: "SCT verification failed"
+          });
+        }
+        return sct.logID;
+      });
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/key/index.js
+var require_key = __commonJS({
+  "node_modules/@sigstore/verify/dist/key/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifyPublicKey = verifyPublicKey;
+    exports.verifyCertificate = verifyCertificate;
+    var core_1 = require_dist2();
+    var error_1 = require_error3();
+    var certificate_1 = require_certificate();
+    var sct_1 = require_sct2();
+    var OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+    var OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+    function verifyPublicKey(hint, timestamps, trustMaterial) {
+      const key = trustMaterial.publicKey(hint);
+      timestamps.forEach((timestamp) => {
+        if (!key.validFor(timestamp)) {
+          throw new error_1.VerificationError({
+            code: "PUBLIC_KEY_ERROR",
+            message: `Public key is not valid for timestamp: ${timestamp.toISOString()}`
+          });
+        }
+      });
+      return { key: key.publicKey };
+    }
+    function verifyCertificate(leaf, timestamps, trustMaterial) {
+      let path = [];
+      timestamps.forEach((timestamp) => {
+        path = (0, certificate_1.verifyCertificateChain)(timestamp, leaf, trustMaterial.certificateAuthorities);
+      });
+      return {
+        scts: (0, sct_1.verifySCTs)(path[0], path[1], trustMaterial.ctlogs),
+        signer: getSigner(path[0])
+      };
+    }
+    function getSigner(cert) {
+      let issuer;
+      const issuerExtension = cert.extension(OID_FULCIO_ISSUER_V2);
+      if (issuerExtension) {
+        issuer = issuerExtension.valueObj.subs?.[0]?.value.toString("ascii");
+      } else {
+        issuer = cert.extension(OID_FULCIO_ISSUER_V1)?.value.toString("ascii");
+      }
+      const oids = cert.extensions.map((ext) => {
+        const oid = ext.subs[0].toOID();
+        return {
+          oid: { id: oid.split(".").map(Number) },
+          value: ext.subs[ext.subs.length - 1].value
+        };
+      });
+      const identity = {
+        extensions: { issuer },
+        subjectAlternativeName: cert.subjectAltName,
+        oids
+      };
+      return {
+        key: core_1.crypto.createPublicKey(cert.publicKey),
+        identity
+      };
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/policy.js
+var require_policy = __commonJS({
+  "node_modules/@sigstore/verify/dist/policy.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifySubjectAlternativeName = verifySubjectAlternativeName;
+    exports.verifyExtensions = verifyExtensions;
+    exports.verifyOIDs = verifyOIDs;
+    var error_1 = require_error3();
+    function verifySubjectAlternativeName(policyIdentity, signerIdentity) {
+      if (signerIdentity === void 0 || !signerIdentity.match(policyIdentity)) {
+        throw new error_1.PolicyError({
+          code: "UNTRUSTED_SIGNER_ERROR",
+          message: `certificate identity error - expected ${policyIdentity}, got ${signerIdentity}`
+        });
+      }
+    }
+    function verifyExtensions(policyExtensions, signerExtensions = {}) {
+      let key;
+      for (key in policyExtensions) {
+        if (signerExtensions[key] !== policyExtensions[key]) {
+          throw new error_1.PolicyError({
+            code: "UNTRUSTED_SIGNER_ERROR",
+            message: `invalid certificate extension - expected ${key}=${policyExtensions[key]}, got ${key}=${signerExtensions[key]}`
+          });
+        }
+      }
+    }
+    function verifyOIDs(policyOIDs, signerOIDs = []) {
+      for (const policyOID of policyOIDs) {
+        const match = signerOIDs.find((signerOID) => oidEquals(policyOID.oid?.id, signerOID.oid?.id) && policyOID.value.equals(signerOID.value));
+        if (!match) {
+          const oid = policyOID.oid?.id.join(".") ?? "<unknown>";
+          throw new error_1.PolicyError({
+            code: "UNTRUSTED_SIGNER_ERROR",
+            message: `invalid certificate extension - missing OID ${oid}`
+          });
+        }
+      }
+    }
+    function oidEquals(a, b) {
+      if (a === void 0 || b === void 0) {
+        return false;
+      }
+      return a.length === b.length && a.every((v, i) => v === b[i]);
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/timestamp/tsa.js
+var require_tsa = __commonJS({
+  "node_modules/@sigstore/verify/dist/timestamp/tsa.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifyRFC3161Timestamp = verifyRFC3161Timestamp;
+    var core_1 = require_dist2();
+    var error_1 = require_error3();
+    var certificate_1 = require_certificate();
+    var trust_1 = require_trust();
+    function verifyRFC3161Timestamp(timestamp, data, timestampAuthorities) {
+      const signingTime = timestamp.signingTime;
+      timestampAuthorities = (0, trust_1.filterCertAuthorities)(timestampAuthorities, signingTime);
+      timestampAuthorities = filterCAsBySerialAndIssuer(timestampAuthorities, {
+        serialNumber: timestamp.signerSerialNumber,
+        issuer: timestamp.signerIssuer
+      });
+      const verified = timestampAuthorities.some((ca) => {
+        try {
+          verifyTimestampForCA(timestamp, data, ca);
+          return true;
+        } catch (e) {
+          return false;
+        }
+      });
+      if (!verified) {
+        throw new error_1.VerificationError({
+          code: "TIMESTAMP_ERROR",
+          message: "timestamp could not be verified"
+        });
+      }
+    }
+    function verifyTimestampForCA(timestamp, data, ca) {
+      const [leaf, ...cas] = ca.certChain;
+      const signingKey = core_1.crypto.createPublicKey(leaf.publicKey);
+      const signingTime = timestamp.signingTime;
+      try {
+        new certificate_1.CertificateChainVerifier({
+          untrustedCert: leaf,
+          trustedCerts: cas,
+          timestamp: signingTime
+        }).verify();
+      } catch (e) {
+        throw new error_1.VerificationError({
+          code: "TIMESTAMP_ERROR",
+          message: "invalid certificate chain"
+        });
+      }
+      timestamp.verify(data, signingKey);
+    }
+    function filterCAsBySerialAndIssuer(timestampAuthorities, criteria) {
+      return timestampAuthorities.filter((ca) => ca.certChain.length > 0 && core_1.crypto.bufferEqual(ca.certChain[0].serialNumber, criteria.serialNumber) && core_1.crypto.bufferEqual(ca.certChain[0].issuer, criteria.issuer));
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/timestamp/index.js
+var require_timestamp2 = __commonJS({
+  "node_modules/@sigstore/verify/dist/timestamp/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.getTSATimestamp = getTSATimestamp;
+    exports.getTLogTimestamp = getTLogTimestamp;
+    var tsa_1 = require_tsa();
+    function getTSATimestamp(timestamp, data, timestampAuthorities) {
+      (0, tsa_1.verifyRFC3161Timestamp)(timestamp, data, timestampAuthorities);
+      return {
+        type: "timestamp-authority",
+        logID: timestamp.signerSerialNumber,
+        timestamp: timestamp.signingTime
+      };
+    }
+    function getTLogTimestamp(entry) {
+      if (!entry.inclusionPromise) {
+        return void 0;
+      }
+      return {
+        type: "transparency-log",
+        logID: entry.logId.keyId,
+        timestamp: new Date(Number(entry.integratedTime) * 1e3)
+      };
+    }
+  }
+});
+
+// node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/verifier.js
+var require_verifier = __commonJS({
+  "node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/verifier.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.Signature = exports.Verifier = exports.PublicKey = void 0;
+    var sigstore_common_1 = require_sigstore_common();
+    exports.PublicKey = {
+      fromJSON(object) {
+        return { rawBytes: isSet(object.rawBytes) ? Buffer.from(bytesFromBase64(object.rawBytes)) : Buffer.alloc(0) };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.rawBytes.length !== 0) {
+          obj.rawBytes = base64FromBytes(message.rawBytes);
+        }
+        return obj;
+      }
+    };
+    exports.Verifier = {
+      fromJSON(object) {
+        return {
+          verifier: isSet(object.publicKey) ? { $case: "publicKey", publicKey: exports.PublicKey.fromJSON(object.publicKey) } : isSet(object.x509Certificate) ? { $case: "x509Certificate", x509Certificate: sigstore_common_1.X509Certificate.fromJSON(object.x509Certificate) } : void 0,
+          keyDetails: isSet(object.keyDetails) ? (0, sigstore_common_1.publicKeyDetailsFromJSON)(object.keyDetails) : 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.verifier?.$case === "publicKey") {
+          obj.publicKey = exports.PublicKey.toJSON(message.verifier.publicKey);
+        } else if (message.verifier?.$case === "x509Certificate") {
+          obj.x509Certificate = sigstore_common_1.X509Certificate.toJSON(message.verifier.x509Certificate);
+        }
+        if (message.keyDetails !== 0) {
+          obj.keyDetails = (0, sigstore_common_1.publicKeyDetailsToJSON)(message.keyDetails);
+        }
+        return obj;
+      }
+    };
+    exports.Signature = {
+      fromJSON(object) {
+        return {
+          content: isSet(object.content) ? Buffer.from(bytesFromBase64(object.content)) : Buffer.alloc(0),
+          verifier: isSet(object.verifier) ? exports.Verifier.fromJSON(object.verifier) : void 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.content.length !== 0) {
+          obj.content = base64FromBytes(message.content);
+        }
+        if (message.verifier !== void 0) {
+          obj.verifier = exports.Verifier.toJSON(message.verifier);
+        }
+        return obj;
+      }
+    };
+    function bytesFromBase64(b64) {
+      return Uint8Array.from(globalThis.Buffer.from(b64, "base64"));
+    }
+    function base64FromBytes(arr) {
+      return globalThis.Buffer.from(arr).toString("base64");
+    }
+    function isSet(value) {
+      return value !== null && value !== void 0;
+    }
+  }
+});
+
+// node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/dsse.js
+var require_dsse3 = __commonJS({
+  "node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/dsse.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DSSELogEntryV002 = exports.DSSERequestV002 = void 0;
+    var envelope_1 = require_envelope();
+    var sigstore_common_1 = require_sigstore_common();
+    var verifier_1 = require_verifier();
+    exports.DSSERequestV002 = {
+      fromJSON(object) {
+        return {
+          envelope: isSet(object.envelope) ? envelope_1.Envelope.fromJSON(object.envelope) : void 0,
+          verifiers: globalThis.Array.isArray(object?.verifiers) ? object.verifiers.map((e) => verifier_1.Verifier.fromJSON(e)) : []
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.envelope !== void 0) {
+          obj.envelope = envelope_1.Envelope.toJSON(message.envelope);
+        }
+        if (message.verifiers?.length) {
+          obj.verifiers = message.verifiers.map((e) => verifier_1.Verifier.toJSON(e));
+        }
+        return obj;
+      }
+    };
+    exports.DSSELogEntryV002 = {
+      fromJSON(object) {
+        return {
+          payloadHash: isSet(object.payloadHash) ? sigstore_common_1.HashOutput.fromJSON(object.payloadHash) : void 0,
+          signatures: globalThis.Array.isArray(object?.signatures) ? object.signatures.map((e) => verifier_1.Signature.fromJSON(e)) : []
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.payloadHash !== void 0) {
+          obj.payloadHash = sigstore_common_1.HashOutput.toJSON(message.payloadHash);
+        }
+        if (message.signatures?.length) {
+          obj.signatures = message.signatures.map((e) => verifier_1.Signature.toJSON(e));
+        }
+        return obj;
+      }
+    };
+    function isSet(value) {
+      return value !== null && value !== void 0;
+    }
+  }
+});
+
+// node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/hashedrekord.js
+var require_hashedrekord = __commonJS({
+  "node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/hashedrekord.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.HashedRekordLogEntryV002 = exports.HashedRekordRequestV002 = void 0;
+    var sigstore_common_1 = require_sigstore_common();
+    var verifier_1 = require_verifier();
+    exports.HashedRekordRequestV002 = {
+      fromJSON(object) {
+        return {
+          digest: isSet(object.digest) ? Buffer.from(bytesFromBase64(object.digest)) : Buffer.alloc(0),
+          signature: isSet(object.signature) ? verifier_1.Signature.fromJSON(object.signature) : void 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.digest.length !== 0) {
+          obj.digest = base64FromBytes(message.digest);
+        }
+        if (message.signature !== void 0) {
+          obj.signature = verifier_1.Signature.toJSON(message.signature);
+        }
+        return obj;
+      }
+    };
+    exports.HashedRekordLogEntryV002 = {
+      fromJSON(object) {
+        return {
+          data: isSet(object.data) ? sigstore_common_1.HashOutput.fromJSON(object.data) : void 0,
+          signature: isSet(object.signature) ? verifier_1.Signature.fromJSON(object.signature) : void 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.data !== void 0) {
+          obj.data = sigstore_common_1.HashOutput.toJSON(message.data);
+        }
+        if (message.signature !== void 0) {
+          obj.signature = verifier_1.Signature.toJSON(message.signature);
+        }
+        return obj;
+      }
+    };
+    function bytesFromBase64(b64) {
+      return Uint8Array.from(globalThis.Buffer.from(b64, "base64"));
+    }
+    function base64FromBytes(arr) {
+      return globalThis.Buffer.from(arr).toString("base64");
+    }
+    function isSet(value) {
+      return value !== null && value !== void 0;
+    }
+  }
+});
+
+// node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/entry.js
+var require_entry = __commonJS({
+  "node_modules/@sigstore/protobuf-specs/dist/__generated__/rekor/v2/entry.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.CreateEntryRequest = exports.Spec = exports.Entry = void 0;
+    var dsse_1 = require_dsse3();
+    var hashedrekord_1 = require_hashedrekord();
+    exports.Entry = {
+      fromJSON(object) {
+        return {
+          kind: isSet(object.kind) ? globalThis.String(object.kind) : "",
+          apiVersion: isSet(object.apiVersion) ? globalThis.String(object.apiVersion) : "",
+          spec: isSet(object.spec) ? exports.Spec.fromJSON(object.spec) : void 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.kind !== "") {
+          obj.kind = message.kind;
+        }
+        if (message.apiVersion !== "") {
+          obj.apiVersion = message.apiVersion;
+        }
+        if (message.spec !== void 0) {
+          obj.spec = exports.Spec.toJSON(message.spec);
+        }
+        return obj;
+      }
+    };
+    exports.Spec = {
+      fromJSON(object) {
+        return {
+          spec: isSet(object.hashedRekordV002) ? { $case: "hashedRekordV002", hashedRekordV002: hashedrekord_1.HashedRekordLogEntryV002.fromJSON(object.hashedRekordV002) } : isSet(object.dsseV002) ? { $case: "dsseV002", dsseV002: dsse_1.DSSELogEntryV002.fromJSON(object.dsseV002) } : void 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.spec?.$case === "hashedRekordV002") {
+          obj.hashedRekordV002 = hashedrekord_1.HashedRekordLogEntryV002.toJSON(message.spec.hashedRekordV002);
+        } else if (message.spec?.$case === "dsseV002") {
+          obj.dsseV002 = dsse_1.DSSELogEntryV002.toJSON(message.spec.dsseV002);
+        }
+        return obj;
+      }
+    };
+    exports.CreateEntryRequest = {
+      fromJSON(object) {
+        return {
+          spec: isSet(object.hashedRekordRequestV002) ? {
+            $case: "hashedRekordRequestV002",
+            hashedRekordRequestV002: hashedrekord_1.HashedRekordRequestV002.fromJSON(object.hashedRekordRequestV002)
+          } : isSet(object.dsseRequestV002) ? { $case: "dsseRequestV002", dsseRequestV002: dsse_1.DSSERequestV002.fromJSON(object.dsseRequestV002) } : void 0
+        };
+      },
+      toJSON(message) {
+        const obj = {};
+        if (message.spec?.$case === "hashedRekordRequestV002") {
+          obj.hashedRekordRequestV002 = hashedrekord_1.HashedRekordRequestV002.toJSON(message.spec.hashedRekordRequestV002);
+        } else if (message.spec?.$case === "dsseRequestV002") {
+          obj.dsseRequestV002 = dsse_1.DSSERequestV002.toJSON(message.spec.dsseRequestV002);
+        }
+        return obj;
+      }
+    };
+    function isSet(value) {
+      return value !== null && value !== void 0;
+    }
+  }
+});
+
+// node_modules/@sigstore/protobuf-specs/dist/rekor/v2/index.js
+var require_v2 = __commonJS({
+  "node_modules/@sigstore/protobuf-specs/dist/rekor/v2/index.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports && exports.__exportStar || function(m, exports2) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports2, p)) __createBinding(exports2, m, p);
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    __exportStar(require_dsse3(), exports);
+    __exportStar(require_entry(), exports);
+    __exportStar(require_hashedrekord(), exports);
+    __exportStar(require_verifier(), exports);
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/dsse.js
+var require_dsse4 = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/dsse.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DSSE_API_VERSION_V1 = void 0;
+    exports.verifyDSSETLogBody = verifyDSSETLogBody;
+    exports.verifyDSSETLogBodyV2 = verifyDSSETLogBodyV2;
+    var error_1 = require_error3();
+    exports.DSSE_API_VERSION_V1 = "0.0.1";
+    function verifyDSSETLogBody(tlogEntry, content) {
+      switch (tlogEntry.apiVersion) {
+        case exports.DSSE_API_VERSION_V1:
+          return verifyDSSE001TLogBody(tlogEntry, content);
+        default:
+          throw new error_1.VerificationError({
+            code: "TLOG_BODY_ERROR",
+            message: `unsupported dsse version: ${tlogEntry.apiVersion}`
+          });
+      }
+    }
+    function verifyDSSETLogBodyV2(tlogEntry, content) {
+      const spec = tlogEntry.spec?.spec;
+      if (!spec) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: `missing dsse spec`
+        });
+      }
+      switch (spec.$case) {
+        case "dsseV002":
+          return verifyDSSE002TLogBody(spec.dsseV002, content);
+        default:
+          throw new error_1.VerificationError({
+            code: "TLOG_BODY_ERROR",
+            message: `unsupported version: ${spec.$case}`
+          });
+      }
+    }
+    function verifyDSSE001TLogBody(tlogEntry, content) {
+      if (tlogEntry.spec.signatures?.length !== 1) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "signature count mismatch"
+        });
+      }
+      const tlogSig = tlogEntry.spec.signatures[0].signature;
+      if (!content.compareSignature(Buffer.from(tlogSig, "base64")))
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "tlog entry signature mismatch"
+        });
+      const tlogHash = tlogEntry.spec.payloadHash?.value || "";
+      if (!content.compareDigest(Buffer.from(tlogHash, "hex"))) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "DSSE payload hash mismatch"
+        });
+      }
+    }
+    function verifyDSSE002TLogBody(spec, content) {
+      if (spec.signatures?.length !== 1) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "signature count mismatch"
+        });
+      }
+      const tlogSig = spec.signatures[0].content;
+      if (!content.compareSignature(tlogSig))
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "tlog entry signature mismatch"
+        });
+      const tlogHash = spec.payloadHash?.digest || Buffer.from("");
+      if (!content.compareDigest(tlogHash)) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "DSSE payload hash mismatch"
+        });
+      }
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/hashedrekord.js
+var require_hashedrekord2 = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/hashedrekord.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.HASHEDREKORD_API_VERSION_V1 = void 0;
+    exports.verifyHashedRekordTLogBody = verifyHashedRekordTLogBody;
+    exports.verifyHashedRekordTLogBodyV2 = verifyHashedRekordTLogBodyV2;
+    var error_1 = require_error3();
+    exports.HASHEDREKORD_API_VERSION_V1 = "0.0.1";
+    function verifyHashedRekordTLogBody(tlogEntry, content) {
+      switch (tlogEntry.apiVersion) {
+        case exports.HASHEDREKORD_API_VERSION_V1:
+          return verifyHashedrekord001TLogBody(tlogEntry, content);
+        default:
+          throw new error_1.VerificationError({
+            code: "TLOG_BODY_ERROR",
+            message: `unsupported hashedrekord version: ${tlogEntry.apiVersion}`
+          });
+      }
+    }
+    function verifyHashedRekordTLogBodyV2(tlogEntry, content) {
+      const spec = tlogEntry.spec?.spec;
+      if (!spec) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: `missing dsse spec`
+        });
+      }
+      switch (spec.$case) {
+        case "hashedRekordV002":
+          return verifyHashedrekord002TLogBody(spec.hashedRekordV002, content);
+        default:
+          throw new error_1.VerificationError({
+            code: "TLOG_BODY_ERROR",
+            message: `unsupported version: ${spec.$case}`
+          });
+      }
+    }
+    function verifyHashedrekord001TLogBody(tlogEntry, content) {
+      const tlogSig = tlogEntry.spec.signature.content || "";
+      if (!content.compareSignature(Buffer.from(tlogSig, "base64"))) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "signature mismatch"
+        });
+      }
+      const tlogDigest = tlogEntry.spec.data.hash?.value || "";
+      if (!content.compareSignedDigest(Buffer.from(tlogDigest, "hex"))) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "digest mismatch"
+        });
+      }
+    }
+    function verifyHashedrekord002TLogBody(spec, content) {
+      const tlogSig = spec.signature?.content || Buffer.from("");
+      if (!content.compareSignature(tlogSig)) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "signature mismatch"
+        });
+      }
+      const tlogHash = spec.data?.digest || Buffer.from("");
+      if (!content.compareSignedDigest(tlogHash)) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "digest mismatch"
+        });
+      }
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/intoto.js
+var require_intoto = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/intoto.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifyIntotoTLogBody = verifyIntotoTLogBody;
+    var error_1 = require_error3();
+    function verifyIntotoTLogBody(tlogEntry, content) {
+      switch (tlogEntry.apiVersion) {
+        case "0.0.2":
+          return verifyIntoto002TLogBody(tlogEntry, content);
+        default:
+          throw new error_1.VerificationError({
+            code: "TLOG_BODY_ERROR",
+            message: `unsupported intoto version: ${tlogEntry.apiVersion}`
+          });
+      }
+    }
+    function verifyIntoto002TLogBody(tlogEntry, content) {
+      if (tlogEntry.spec.content.envelope.signatures?.length !== 1) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "signature count mismatch"
+        });
+      }
+      const tlogSig = base64Decode(tlogEntry.spec.content.envelope.signatures[0].sig);
+      if (!content.compareSignature(Buffer.from(tlogSig, "base64"))) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "tlog entry signature mismatch"
+        });
+      }
+      const tlogHash = tlogEntry.spec.content.payloadHash?.value || "";
+      if (!content.compareDigest(Buffer.from(tlogHash, "hex"))) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "DSSE payload hash mismatch"
+        });
+      }
+    }
+    function base64Decode(str) {
+      return Buffer.from(str, "base64").toString("utf-8");
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/checkpoint.js
+var require_checkpoint = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/checkpoint.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.LogCheckpoint = void 0;
+    exports.verifyCheckpoint = verifyCheckpoint;
+    var core_1 = require_dist2();
+    var error_1 = require_error3();
+    var CHECKPOINT_SEPARATOR = "\n\n";
+    var SIGNATURE_REGEX = /\u2014 (\S+) (\S+)\n/g;
+    function verifyCheckpoint(entry, tlogs) {
+      const inclusionProof = entry.inclusionProof;
+      const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);
+      const checkpoint = LogCheckpoint.fromString(signedNote.note);
+      if (!verifySignedNote(signedNote, tlogs)) {
+        throw new error_1.VerificationError({
+          code: "TLOG_INCLUSION_PROOF_ERROR",
+          message: "invalid checkpoint signature"
+        });
+      }
+      return checkpoint;
+    }
+    function verifySignedNote(signedNote, tlogs) {
+      const data = Buffer.from(signedNote.note, "utf-8");
+      return signedNote.signatures.some((signature) => {
+        const tlog = tlogs.find((tlog2) => core_1.crypto.bufferEqual(tlog2.logID.subarray(0, 4), signature.keyHint) && // Match the signature name to the base URL of the tlog. The name is
+        // attacker-controlled, so it MUST be compared as a literal substring
+        // and never coerced into a RegExp (as String.prototype.match would).
+        tlog2.baseURL.includes(signature.name));
+        if (!tlog) {
+          return false;
+        }
+        return core_1.crypto.verify(data, tlog.publicKey, signature.signature);
+      });
+    }
+    var SignedNote = class _SignedNote {
+      note;
+      signatures;
+      constructor(note, signatures) {
+        this.note = note;
+        this.signatures = signatures;
+      }
+      // Deserialize a SignedNote from a string
+      static fromString(envelope) {
+        if (!envelope.includes(CHECKPOINT_SEPARATOR)) {
+          throw new error_1.VerificationError({
+            code: "TLOG_INCLUSION_PROOF_ERROR",
+            message: "missing checkpoint separator"
+          });
+        }
+        const split = envelope.indexOf(CHECKPOINT_SEPARATOR);
+        const header = envelope.slice(0, split + 1);
+        const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length);
+        const matches = data.matchAll(SIGNATURE_REGEX);
+        const signatures = Array.from(matches, (match) => {
+          const [, name, signature] = match;
+          const sigBytes = Buffer.from(signature, "base64");
+          if (sigBytes.length < 5) {
+            throw new error_1.VerificationError({
+              code: "TLOG_INCLUSION_PROOF_ERROR",
+              message: "malformed checkpoint signature"
+            });
+          }
+          return {
+            name,
+            keyHint: sigBytes.subarray(0, 4),
+            signature: sigBytes.subarray(4)
+          };
+        });
+        if (signatures.length === 0) {
+          throw new error_1.VerificationError({
+            code: "TLOG_INCLUSION_PROOF_ERROR",
+            message: "no signatures found in checkpoint"
+          });
+        }
+        return new _SignedNote(header, signatures);
+      }
+    };
+    var LogCheckpoint = class _LogCheckpoint {
+      origin;
+      logSize;
+      logHash;
+      rest;
+      constructor(origin, logSize, logHash, rest) {
+        this.origin = origin;
+        this.logSize = logSize;
+        this.logHash = logHash;
+        this.rest = rest;
+      }
+      static fromString(note) {
+        const lines = note.trimEnd().split("\n");
+        if (lines.length < 3) {
+          throw new error_1.VerificationError({
+            code: "TLOG_INCLUSION_PROOF_ERROR",
+            message: "too few lines in checkpoint header"
+          });
+        }
+        const origin = lines[0];
+        let logSize;
+        try {
+          logSize = BigInt(lines[1]);
+        } catch {
+          throw new error_1.VerificationError({
+            code: "TLOG_INCLUSION_PROOF_ERROR",
+            message: "invalid checkpoint log size"
+          });
+        }
+        const rootHash = Buffer.from(lines[2], "base64");
+        const rest = lines.slice(3);
+        return new _LogCheckpoint(origin, logSize, rootHash, rest);
+      }
+    };
+    exports.LogCheckpoint = LogCheckpoint;
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/merkle.js
+var require_merkle = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/merkle.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifyMerkleInclusion = verifyMerkleInclusion;
+    var core_1 = require_dist2();
+    var error_1 = require_error3();
+    var RFC6962_LEAF_HASH_PREFIX = Buffer.from([0]);
+    var RFC6962_NODE_HASH_PREFIX = Buffer.from([1]);
+    function verifyMerkleInclusion(entry, checkpoint) {
+      const inclusionProof = entry.inclusionProof;
+      let logIndex;
+      try {
+        logIndex = BigInt(inclusionProof.logIndex);
+      } catch {
+        throw new error_1.VerificationError({
+          code: "TLOG_INCLUSION_PROOF_ERROR",
+          message: "invalid inclusion proof log index"
+        });
+      }
+      const treeSize = BigInt(checkpoint.logSize);
+      if (logIndex < 0n || logIndex >= treeSize) {
+        throw new error_1.VerificationError({
+          code: "TLOG_INCLUSION_PROOF_ERROR",
+          message: `invalid index: ${logIndex}`
+        });
+      }
+      const { inner, border } = decompInclProof(logIndex, treeSize);
+      if (inclusionProof.hashes.length !== inner + border) {
+        throw new error_1.VerificationError({
+          code: "TLOG_INCLUSION_PROOF_ERROR",
+          message: "invalid hash count"
+        });
+      }
+      const innerHashes = inclusionProof.hashes.slice(0, inner);
+      const borderHashes = inclusionProof.hashes.slice(inner);
+      const leafHash = hashLeaf(entry.canonicalizedBody);
+      const calculatedHash = chainBorderRight(chainInner(leafHash, innerHashes, logIndex), borderHashes);
+      if (!core_1.crypto.bufferEqual(calculatedHash, checkpoint.logHash)) {
+        throw new error_1.VerificationError({
+          code: "TLOG_INCLUSION_PROOF_ERROR",
+          message: "calculated root hash does not match inclusion proof"
+        });
+      }
+    }
+    function decompInclProof(index, size) {
+      const inner = innerProofSize(index, size);
+      const border = onesCount(index >> BigInt(inner));
+      return { inner, border };
+    }
+    function chainInner(seed, hashes, index) {
+      return hashes.reduce((acc, h, i) => {
+        if (index >> BigInt(i) & BigInt(1)) {
+          return hashChildren(h, acc);
+        } else {
+          return hashChildren(acc, h);
+        }
+      }, seed);
+    }
+    function chainBorderRight(seed, hashes) {
+      return hashes.reduce((acc, h) => hashChildren(h, acc), seed);
+    }
+    function innerProofSize(index, size) {
+      return bitLength(index ^ size - BigInt(1));
+    }
+    function onesCount(num) {
+      return num.toString(2).split("1").length - 1;
+    }
+    function bitLength(n) {
+      if (n === 0n) {
+        return 0;
+      }
+      return n.toString(2).length;
+    }
+    function hashChildren(left, right) {
+      return core_1.crypto.digest("sha256", RFC6962_NODE_HASH_PREFIX, left, right);
+    }
+    function hashLeaf(leaf) {
+      return core_1.crypto.digest("sha256", RFC6962_LEAF_HASH_PREFIX, leaf);
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/set.js
+var require_set = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/set.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifyTLogSET = verifyTLogSET;
+    var core_1 = require_dist2();
+    var error_1 = require_error3();
+    var trust_1 = require_trust();
+    function verifyTLogSET(entry, tlogs) {
+      const validTLogs = (0, trust_1.filterTLogAuthorities)(tlogs, {
+        logID: entry.logId.keyId,
+        targetDate: new Date(Number(entry.integratedTime) * 1e3)
+      });
+      const verified = validTLogs.some((tlog) => {
+        const payload = toVerificationPayload(entry);
+        const data = Buffer.from(core_1.json.canonicalize(payload), "utf8");
+        const signature = entry.inclusionPromise.signedEntryTimestamp;
+        return core_1.crypto.verify(data, tlog.publicKey, signature);
+      });
+      if (!verified) {
+        throw new error_1.VerificationError({
+          code: "TLOG_INCLUSION_PROMISE_ERROR",
+          message: "inclusion promise could not be verified"
+        });
+      }
+    }
+    function toVerificationPayload(entry) {
+      const { integratedTime, logIndex, logId, canonicalizedBody } = entry;
+      return {
+        body: canonicalizedBody.toString("base64"),
+        integratedTime: Number(integratedTime),
+        logIndex: Number(logIndex),
+        logID: logId.keyId.toString("hex")
+      };
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/tlog/index.js
+var require_tlog = __commonJS({
+  "node_modules/@sigstore/verify/dist/tlog/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.verifyTLogBody = verifyTLogBody;
+    exports.verifyTLogInclusion = verifyTLogInclusion;
+    var v2_1 = require_v2();
+    var error_1 = require_error3();
+    var dsse_1 = require_dsse4();
+    var hashedrekord_1 = require_hashedrekord2();
+    var intoto_1 = require_intoto();
+    var checkpoint_1 = require_checkpoint();
+    var merkle_1 = require_merkle();
+    var set_1 = require_set();
+    function verifyTLogBody(entry, sigContent) {
+      const { kind, version } = entry.kindVersion;
+      let body;
+      try {
+        body = JSON.parse(entry.canonicalizedBody.toString("utf8"));
+      } catch {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: "invalid canonicalized body"
+        });
+      }
+      if (kind !== body.kind || version !== body.apiVersion) {
+        throw new error_1.VerificationError({
+          code: "TLOG_BODY_ERROR",
+          message: `kind/version mismatch - expected: ${kind}/${version}, received: ${body.kind}/${body.apiVersion}`
+        });
+      }
+      switch (kind) {
+        case "dsse":
+          if (version == dsse_1.DSSE_API_VERSION_V1) {
+            return (0, dsse_1.verifyDSSETLogBody)(body, sigContent);
+          } else {
+            const entryRekorV2 = v2_1.Entry.fromJSON(body);
+            return (0, dsse_1.verifyDSSETLogBodyV2)(entryRekorV2, sigContent);
+          }
+        case "intoto":
+          return (0, intoto_1.verifyIntotoTLogBody)(body, sigContent);
+        case "hashedrekord":
+          if (version == hashedrekord_1.HASHEDREKORD_API_VERSION_V1) {
+            return (0, hashedrekord_1.verifyHashedRekordTLogBody)(body, sigContent);
+          } else {
+            const entryRekorV2 = v2_1.Entry.fromJSON(body);
+            return (0, hashedrekord_1.verifyHashedRekordTLogBodyV2)(entryRekorV2, sigContent);
+          }
+        /* istanbul ignore next */
+        default:
+          throw new error_1.VerificationError({
+            code: "TLOG_BODY_ERROR",
+            message: `unsupported kind: ${kind}`
+          });
+      }
+    }
+    function verifyTLogInclusion(entry, tlogAuthorities) {
+      let inclusionVerified = false;
+      if (isTLogEntryWithInclusionPromise(entry)) {
+        (0, set_1.verifyTLogSET)(entry, tlogAuthorities);
+        inclusionVerified = true;
+      }
+      if (isTLogEntryWithInclusionProof(entry)) {
+        const checkpoint = (0, checkpoint_1.verifyCheckpoint)(entry, tlogAuthorities);
+        (0, merkle_1.verifyMerkleInclusion)(entry, checkpoint);
+        inclusionVerified = true;
+      }
+      if (!inclusionVerified) {
+        throw new error_1.VerificationError({
+          code: "TLOG_MISSING_INCLUSION_ERROR",
+          message: "inclusion could not be verified"
+        });
+      }
+      return;
+    }
+    function isTLogEntryWithInclusionPromise(entry) {
+      return entry.inclusionPromise !== void 0;
+    }
+    function isTLogEntryWithInclusionProof(entry) {
+      return entry.inclusionProof !== void 0;
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/verifier.js
+var require_verifier2 = __commonJS({
+  "node_modules/@sigstore/verify/dist/verifier.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.Verifier = void 0;
+    var util_1 = __require("util");
+    var error_1 = require_error3();
+    var key_1 = require_key();
+    var policy_1 = require_policy();
+    var timestamp_1 = require_timestamp2();
+    var tlog_1 = require_tlog();
+    var Verifier = class {
+      trustMaterial;
+      options;
+      constructor(trustMaterial, options = {}) {
+        this.trustMaterial = trustMaterial;
+        this.options = {
+          ctlogThreshold: options.ctlogThreshold ?? 1,
+          tlogThreshold: options.tlogThreshold ?? 1,
+          timestampThreshold: options.timestampThreshold ?? options.tsaThreshold ?? 1,
+          tsaThreshold: 0
+        };
+      }
+      verify(entity, policy) {
+        const timestamps = this.verifyTimestamps(entity);
+        const signer = this.verifySigningKey(entity, timestamps);
+        this.verifyTLogs(entity);
+        this.verifySignature(entity, signer);
+        if (policy) {
+          this.verifyPolicy(policy, signer.identity || {});
+        }
+        return signer;
+      }
+      // Checks that all of the timestamps in the entity are valid and returns them
+      verifyTimestamps(entity) {
+        const timestamps = [];
+        for (const timestamp of entity.timestamps) {
+          switch (timestamp.$case) {
+            case "timestamp-authority":
+              timestamps.push((0, timestamp_1.getTSATimestamp)(timestamp.timestamp, entity.signature.signature, this.trustMaterial.timestampAuthorities));
+              break;
+            case "transparency-log": {
+              const result = (0, timestamp_1.getTLogTimestamp)(timestamp.tlogEntry);
+              if (result) {
+                timestamps.push(result);
+              }
+              break;
+            }
+          }
+        }
+        if (containsDupes(timestamps)) {
+          throw new error_1.VerificationError({
+            code: "TIMESTAMP_ERROR",
+            message: "duplicate timestamp"
+          });
+        }
+        if (timestamps.length < this.options.timestampThreshold) {
+          throw new error_1.VerificationError({
+            code: "TIMESTAMP_ERROR",
+            message: `expected ${this.options.timestampThreshold} timestamps, got ${timestamps.length}`
+          });
+        }
+        return timestamps.map((t) => t.timestamp);
+      }
+      // Checks that the signing key is valid for all of the the supplied timestamps
+      // and returns the signer.
+      verifySigningKey({ key }, timestamps) {
+        switch (key.$case) {
+          case "public-key": {
+            return (0, key_1.verifyPublicKey)(key.hint, timestamps, this.trustMaterial);
+          }
+          case "certificate": {
+            const result = (0, key_1.verifyCertificate)(key.certificate, timestamps, this.trustMaterial);
+            if (containsDupes(result.scts)) {
+              throw new error_1.VerificationError({
+                code: "CERTIFICATE_ERROR",
+                message: "duplicate SCT"
+              });
+            }
+            if (result.scts.length < this.options.ctlogThreshold) {
+              throw new error_1.VerificationError({
+                code: "CERTIFICATE_ERROR",
+                message: `expected ${this.options.ctlogThreshold} SCTs, got ${result.scts.length}`
+              });
+            }
+            return result.signer;
+          }
+        }
+      }
+      // Checks that the tlog entries are valid for the supplied content
+      verifyTLogs({ signature: content, tlogEntries }) {
+        const entryIDs = [];
+        tlogEntries.forEach((entry) => {
+          (0, tlog_1.verifyTLogInclusion)(entry, this.trustMaterial.tlogs);
+          (0, tlog_1.verifyTLogBody)(entry, content);
+          entryIDs.push({ logID: entry.logId.keyId, logIndex: entry.logIndex });
+        });
+        if (containsDupes(entryIDs)) {
+          throw new error_1.VerificationError({
+            code: "TLOG_ERROR",
+            message: "duplicate tlog entry"
+          });
+        }
+        if (entryIDs.length < this.options.tlogThreshold) {
+          throw new error_1.VerificationError({
+            code: "TLOG_ERROR",
+            message: `expected ${this.options.tlogThreshold} tlog entries, got ${entryIDs.length}`
+          });
+        }
+      }
+      // Checks that the signature is valid for the supplied content
+      verifySignature(entity, signer) {
+        if (!entity.signature.verifySignature(signer.key)) {
+          throw new error_1.VerificationError({
+            code: "SIGNATURE_ERROR",
+            message: "signature verification failed"
+          });
+        }
+      }
+      verifyPolicy(policy, identity) {
+        if (policy.subjectAlternativeName) {
+          (0, policy_1.verifySubjectAlternativeName)(policy.subjectAlternativeName, identity.subjectAlternativeName);
+        }
+        if (policy.extensions) {
+          (0, policy_1.verifyExtensions)(policy.extensions, identity.extensions);
+        }
+        if (policy.oids) {
+          (0, policy_1.verifyOIDs)(policy.oids, identity.oids);
+        }
+      }
+    };
+    exports.Verifier = Verifier;
+    function containsDupes(arr) {
+      for (let i = 0; i < arr.length; i++) {
+        for (let j = i + 1; j < arr.length; j++) {
+          if ((0, util_1.isDeepStrictEqual)(arr[i], arr[j])) {
+            return true;
+          }
+        }
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/@sigstore/verify/dist/index.js
+var require_dist3 = __commonJS({
+  "node_modules/@sigstore/verify/dist/index.js"(exports) {
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.Verifier = exports.toTrustMaterial = exports.VerificationError = exports.PolicyError = exports.toSignedEntity = void 0;
+    var bundle_1 = require_bundle();
+    Object.defineProperty(exports, "toSignedEntity", { enumerable: true, get: function() {
+      return bundle_1.toSignedEntity;
+    } });
+    var error_1 = require_error3();
+    Object.defineProperty(exports, "PolicyError", { enumerable: true, get: function() {
+      return error_1.PolicyError;
+    } });
+    Object.defineProperty(exports, "VerificationError", { enumerable: true, get: function() {
+      return error_1.VerificationError;
+    } });
+    var trust_1 = require_trust();
+    Object.defineProperty(exports, "toTrustMaterial", { enumerable: true, get: function() {
+      return trust_1.toTrustMaterial;
+    } });
+    var verifier_1 = require_verifier2();
+    Object.defineProperty(exports, "Verifier", { enumerable: true, get: function() {
+      return verifier_1.Verifier;
+    } });
+  }
+});
+export default require_dist3();