@freedomofpress/sigstore-browser 0.1.0

package/dist/sigstore.d.ts

@@ -0,0 +1,33 @@
+import { SigstoreBundle } from "./bundle.js";
+import { CertAuthority, CTLog, RawCAs, RawLogs, RawTimestampAuthorities, RekorKeyInfo, TrustedRoot } from "./interfaces.js";
+import { X509Certificate } from "./x509/index.js";
+import { TrustedRootProvider } from "./trust/tuf.js";
+export interface SigstoreVerifierOptions {
+    tlogThreshold?: number;
+    ctlogThreshold?: number;
+    tsaThreshold?: number;
+}
+export declare class SigstoreVerifier {
+    private root;
+    private rawRoot;
+    private options;
+    constructor(options?: SigstoreVerifierOptions);
+    loadLog(frozenTimestamp: Date, logs: RawLogs): Promise<RekorKeyInfo | undefined>;
+    loadCTLogs(frozenTimestamp: Date, ctlogs: RawLogs): Promise<CTLog[]>;
+    verifyCertificateChain(timestamp: Date, leaf: X509Certificate, certificateAuthorities: CertAuthority[]): Promise<X509Certificate[]>;
+    loadTSA(frozenTimestamp: Date, tsas?: RawTimestampAuthorities): CertAuthority[];
+    loadCA(frozenTimestamp: Date, cas: RawCAs): CertAuthority[];
+    loadSigstoreRoot(rawRoot: TrustedRoot): Promise<void>;
+    /**
+     * Load Sigstore trusted root via TUF
+     * Uses The Update Framework for secure, verified updates of trusted root metadata
+     *
+     * @param tufProvider Optional TrustedRootProvider instance. If not provided, uses default Sigstore TUF repository
+     */
+    loadSigstoreRootWithTUF(tufProvider?: TrustedRootProvider): Promise<void>;
+    verifySCT(cert: X509Certificate, issuer: X509Certificate, ctlogs: CTLog[]): Promise<Uint8Array[]>;
+    verifyInclusionPromise(cert: X509Certificate, bundle: SigstoreBundle, rekor: RekorKeyInfo | undefined): Promise<boolean>;
+    verifyInclusionProof(bundle: SigstoreBundle): Promise<void>;
+    verifyArtifact(identity: string, issuer: string, bundle: SigstoreBundle, data: Uint8Array, isDigestOnly?: boolean): Promise<boolean>;
+}
+//# sourceMappingURL=sigstore.d.ts.map

package/dist/sigstore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigstore.d.ts","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAY7C,OAAO,EACL,aAAa,EACb,KAAK,EAEL,MAAM,EACN,OAAO,EACP,uBAAuB,EACvB,YAAY,EAGZ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAGL,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAoC;gBAEvC,OAAO,GAAE,uBAA4B;IAU3C,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA4BhF,UAAU,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAuCpE,sBAAsB,CAC1B,SAAS,EAAE,IAAI,EACf,IAAI,EAAE,eAAe,EACrB,sBAAsB,EAAE,aAAa,EAAE,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B7B,OAAO,CACL,eAAe,EAAE,IAAI,EACrB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,aAAa,EAAE;IAiClB,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE;IAwBrD,gBAAgB,CAAC,OAAO,EAAE,WAAW;IAe3C;;;;;OAKG;IACG,uBAAuB,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYzE,SAAS,CACb,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,UAAU,EAAE,CAAC;IAqGlB,sBAAsB,CAC1B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,YAAY,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC;IA2Kb,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBpD,cAAc,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;CA0KpB"}

package/dist/sigstore.js

@@ -0,0 +1,531 @@
+import { canonicalize } from "./canonicalize.js";
+import { importKey, verifySignature, verifySignatureOverDigest } from "./crypto.js";
+import { preAuthEncoding } from "./dsse.js";
+import { base64ToUint8Array, stringToUint8Array, toArrayBuffer, uint8ArrayEqual, Uint8ArrayToHex, Uint8ArrayToString, } from "./encoding.js";
+import { HashAlgorithms, SigstoreRoots, } from "./interfaces.js";
+import { ByteStream } from "./stream.js";
+import { CertificateChainVerifier, EXTENSION_OID_SCT, X509Certificate, X509SCTExtension, } from "./x509/index.js";
+import { verifyMerkleInclusion } from "./tlog/merkle.js";
+import { verifyCheckpoint } from "./tlog/checkpoint.js";
+import { verifyTLogBody } from "./tlog/body.js";
+import { verifyBundleTimestamp } from "./timestamp/tsa.js";
+import { TrustedRootProvider } from "./trust/tuf.js";
+export class SigstoreVerifier {
+    root;
+    rawRoot;
+    options;
+    constructor(options = {}) {
+        this.root = undefined;
+        this.rawRoot = undefined;
+        this.options = {
+            tlogThreshold: options.tlogThreshold ?? 1,
+            ctlogThreshold: options.ctlogThreshold ?? 1,
+            tsaThreshold: options.tsaThreshold ?? 0,
+        };
+    }
+    async loadLog(frozenTimestamp, logs) {
+        // Load the first Rekor transparency log key that's valid at the frozen timestamp
+        // and store its log ID for verification. This matches sigstore-go's approach of
+        // looking up the verifier by log ID (verify/tlog.go:80-83).
+        for (const log of logs) {
+            // if start date is not in the future, and if an end doesn't exist or is in the future
+            if (frozenTimestamp > new Date(log.publicKey.validFor.start) &&
+                (!log.publicKey.validFor.end ||
+                    new Date(log.publicKey.validFor.end) > frozenTimestamp)) {
+                return {
+                    publicKey: await importKey(log.publicKey.keyDetails, log.publicKey.keyDetails, log.publicKey.rawBytes),
+                    logId: base64ToUint8Array(log.logId.keyId),
+                };
+            }
+        }
+        // Return undefined instead of throwing - some bundles don't need Rekor keys
+        // (e.g., v0.3 bundles with inclusion proofs)
+        return undefined;
+    }
+    async loadCTLogs(frozenTimestamp, ctlogs) {
+        const result = [];
+        for (const log of ctlogs) {
+            const start = new Date(log.publicKey.validFor.start);
+            const end = log.publicKey.validFor.end
+                ? new Date(log.publicKey.validFor.end)
+                : new Date('9999-12-31'); // No expiry means valid forever
+            // Include logs that are valid (started before frozen timestamp)
+            // We keep all logs, even expired ones, for historical verification
+            if (start <= frozenTimestamp) {
+                const publicKey = await importKey(log.publicKey.keyDetails, log.publicKey.keyDetails, log.publicKey.rawBytes);
+                result.push({
+                    logID: base64ToUint8Array(log.logId.keyId),
+                    publicKey,
+                    validFor: { start, end },
+                });
+            }
+        }
+        if (result.length === 0) {
+            throw new Error("Could not find any valid CT logs in sigstore root.");
+        }
+        return result;
+    }
+    // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts#L22-L53
+    // Verifies that the leaf certificate chains to a trusted CA and is valid at the given timestamp.
+    // Differences from sigstore-js:
+    // - This is async (uses await) because our CertificateChainVerifier.verify() is async
+    // - sigstore-js filters CAs using filterCertAuthorities() before calling this function,
+    //   we do the timestamp filtering inline within this function
+    async verifyCertificateChain(timestamp, leaf, certificateAuthorities) {
+        let lastError;
+        for (const ca of certificateAuthorities) {
+            // Check if this CA is valid for the given timestamp
+            if (timestamp < ca.validFor.start || timestamp > ca.validFor.end) {
+                continue;
+            }
+            try {
+                const verifier = new CertificateChainVerifier({
+                    trustedCerts: ca.certChain,
+                    untrustedCert: leaf,
+                    timestamp,
+                });
+                return await verifier.verify();
+            }
+            catch (err) {
+                lastError = err;
+            }
+        }
+        throw new Error(`Failed to verify certificate chain: ${lastError?.message || 'No valid CAs found'}`);
+    }
+    // Load timestamp authorities that are valid at the frozen timestamp.
+    // Unlike sigstore-js which doesn't pre-load TSAs (it passes raw TSA data to timestamp verification),
+    // we parse and filter them at initialization time for consistency with how we handle CAs and other roots.
+    loadTSA(frozenTimestamp, tsas) {
+        if (!tsas || tsas.length === 0) {
+            return [];
+        }
+        const result = [];
+        for (const tsa of tsas) {
+            const start = new Date(tsa.validFor.start);
+            const end = tsa.validFor.end ? new Date(tsa.validFor.end) : new Date(8640000000000000);
+            if (frozenTimestamp > start && frozenTimestamp < end) {
+                const certChain = tsa.certChain.certificates.map(cert => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+                if (certChain.length > 0) {
+                    result.push({
+                        certChain,
+                        validFor: { start, end },
+                    });
+                }
+            }
+        }
+        return result;
+    }
+    // Load certificate authorities (Fulcio CAs) that are valid at the frozen timestamp.
+    // Similar to sigstore-js's filterCertAuthorities() in trust/filter.ts, but we also
+    // parse the certificates at load time whereas sigstore-js keeps them in the trust material
+    // and parses them during verification. This pre-loading approach is consistent with our
+    // architecture of loading all trusted roots at initialization.
+    loadCA(frozenTimestamp, cas) {
+        const result = [];
+        for (const ca of cas) {
+            const start = new Date(ca.validFor.start);
+            const end = ca.validFor.end ? new Date(ca.validFor.end) : new Date(8640000000000000);
+            if (frozenTimestamp > start && frozenTimestamp < end) {
+                const certChain = ca.certChain.certificates.map(cert => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+                if (certChain.length > 0) {
+                    result.push({
+                        certChain,
+                        validFor: { start, end },
+                    });
+                }
+            }
+        }
+        return result;
+    }
+    async loadSigstoreRoot(rawRoot) {
+        const frozenTimestamp = new Date();
+        this.rawRoot = rawRoot;
+        this.root = {
+            rekor: await this.loadLog(frozenTimestamp, rawRoot[SigstoreRoots.tlogs]),
+            ctlogs: await this.loadCTLogs(frozenTimestamp, rawRoot[SigstoreRoots.ctlogs]),
+            certificateAuthorities: this.loadCA(frozenTimestamp, rawRoot[SigstoreRoots.certificateAuthorities]),
+            timestampAuthorities: this.loadTSA(frozenTimestamp, rawRoot.timestampAuthorities),
+        };
+    }
+    /**
+     * Load Sigstore trusted root via TUF
+     * Uses The Update Framework for secure, verified updates of trusted root metadata
+     *
+     * @param tufProvider Optional TrustedRootProvider instance. If not provided, uses default Sigstore TUF repository
+     */
+    async loadSigstoreRootWithTUF(tufProvider) {
+        const provider = tufProvider || new TrustedRootProvider();
+        const trustedRoot = await provider.getTrustedRoot();
+        await this.loadSigstoreRoot(trustedRoot);
+    }
+    // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/sct.ts
+    // Key differences:
+    // - Adds duplicate SCT detection
+    // - Adds SCT timestamp validity checking
+    // - Inline CT log filtering by logID and validity period (reference uses filterTLogAuthorities)
+    // - Returns array of verified SCT logIDs for threshold checking (matches reference behavior)
+    async verifySCT(cert, issuer, ctlogs) {
+        let extSCT;
+        // Verifying the SCT requires that we remove the SCT extension and
+        // re-encode the TBS structure to DER -- this value is part of the data
+        // over which the signature is calculated. Since this is a destructive action
+        // we create a copy of the certificate so we can remove the SCT extension
+        // without affecting the original certificate.
+        const clone = cert.clone();
+        // Intentionally not using the findExtension method here because we want to
+        // remove the the SCT extension from the certificate before calculating the
+        // PreCert structure
+        for (let i = 0; i < clone.extensions.length; i++) {
+            const ext = clone.extensions[i];
+            if (ext.subs[0].toOID() === EXTENSION_OID_SCT) {
+                extSCT = new X509SCTExtension(ext);
+                // Remove the extension from the certificate
+                clone.extensions.splice(i, 1);
+                break;
+            }
+        }
+        // No SCT extension found - fail verification
+        if (!extSCT) {
+            throw new Error("Certificate is missing required SCT extension");
+        }
+        // Found an SCT extension but it has no SCTs - fail verification
+        if (extSCT.signedCertificateTimestamps.length === 0) {
+            throw new Error("SCT extension is present but contains no SCTs");
+        }
+        // Check for duplicate SCTs (same log ID)
+        const seenLogIds = new Set();
+        for (const sct of extSCT.signedCertificateTimestamps) {
+            const logIdHex = Uint8ArrayToHex(sct.logID);
+            if (seenLogIds.has(logIdHex)) {
+                throw new Error(`Duplicate SCT found for log ID: ${logIdHex}`);
+            }
+            seenLogIds.add(logIdHex);
+        }
+        // Construct the PreCert structure
+        // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+        const preCert = new ByteStream();
+        // Calculate hash of the issuer's public key
+        const issuerId = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(issuer.publicKey)));
+        preCert.appendView(issuerId);
+        // Re-encodes the certificate to DER after removing the SCT extension
+        const tbs = clone.tbsCertificate.toDER();
+        preCert.appendUint24(tbs.length);
+        preCert.appendView(tbs);
+        // Collect all verified SCTs to check against threshold
+        const verifiedSCTs = [];
+        for (const sct of extSCT.signedCertificateTimestamps) {
+            // SCT should be within certificate validity period
+            if (sct.datetime < cert.notBefore || sct.datetime > cert.notAfter) {
+                continue; // Skip invalid SCT timestamp, don't fail yet
+            }
+            // Find the CT log that matches this SCT's log ID and is valid for the SCT datetime
+            const validCTLogs = ctlogs.filter((log) => {
+                // Check if log IDs match
+                if (log.logID.length !== sct.logID.length)
+                    return false;
+                for (let i = 0; i < log.logID.length; i++) {
+                    if (log.logID[i] !== sct.logID[i])
+                        return false;
+                }
+                // Check that the SCT datetime is within the log's validity period
+                return log.validFor.start <= sct.datetime && sct.datetime <= log.validFor.end;
+            });
+            // Try to verify with any valid CT log
+            let verified = false;
+            for (const log of validCTLogs) {
+                try {
+                    if (await sct.verify(preCert.buffer, log.publicKey)) {
+                        verified = true;
+                        break; // Found a valid log for this SCT
+                    }
+                }
+                catch (e) {
+                    // Continue trying other logs
+                }
+            }
+            if (verified) {
+                verifiedSCTs.push(sct.logID);
+            }
+        }
+        return verifiedSCTs;
+    }
+    async verifyInclusionPromise(cert, bundle, rekor) {
+        const entries = bundle.verificationMaterial.tlogEntries;
+        if (entries.length < 1) {
+            throw new Error("Failed to find a transparency log entry in the provided bundle.");
+        }
+        // Prevent DoS via excessive entries and threshold bypass via duplicates
+        // Matches sigstore-go limits (verify/tlog.go:46-57)
+        const MAX_TLOG_ENTRIES = 32;
+        if (entries.length > MAX_TLOG_ENTRIES) {
+            throw new Error(`Too many tlog entries: ${entries.length} > ${MAX_TLOG_ENTRIES}`);
+        }
+        for (let i = 0; i < entries.length; i++) {
+            for (let j = i + 1; j < entries.length; j++) {
+                const iLogId = Uint8ArrayToHex(base64ToUint8Array(entries[i].logId.keyId));
+                const jLogId = Uint8ArrayToHex(base64ToUint8Array(entries[j].logId.keyId));
+                if (iLogId === jLogId && entries[i].logIndex === entries[j].logIndex) {
+                    throw new Error(`Duplicate tlog entry found: logID=${iLogId}, logIndex=${entries[i].logIndex}`);
+                }
+            }
+        }
+        const entry = entries[0];
+        // Extract bundle version from mediaType
+        // e.g., "application/vnd.dev.sigstore.bundle+json;version=0.2"
+        const versionMatch = bundle.mediaType.match(/version=(\d+\.\d+)/);
+        const bundleVersion = versionMatch ? versionMatch[1] : "0.1";
+        const isV02OrLater = parseFloat(bundleVersion) >= 0.2;
+        // Bundle v0.2+ requires an inclusion proof
+        if (isV02OrLater && !entry.inclusionProof) {
+            throw new Error("Bundle v0.2+ requires an inclusion proof.");
+        }
+        // For rekor2/v0.3 bundles with inclusion proofs, the inclusion promise is optional
+        if (!entry.inclusionPromise?.signedEntryTimestamp) {
+            // If there's no inclusion promise, there must be an inclusion proof
+            if (!entry.inclusionProof) {
+                throw new Error("Bundle must have either an inclusion promise or an inclusion proof.");
+            }
+        }
+        else {
+            // Verify the inclusion promise signature if present
+            // For v0.3 bundles that have both inclusion promise and proof,
+            // we can skip the promise verification if we don't have a Rekor key
+            // and there's a valid inclusion proof
+            if (!rekor && entry.inclusionProof) {
+                // Skip promise verification if we have an inclusion proof
+                // The inclusion proof will be verified later
+            }
+            else {
+                if (!rekor) {
+                    throw new Error("Rekor public key not found in trusted root");
+                }
+                // Verify the log ID matches (matches sigstore-go verify/tlog.go:80-83)
+                const entryLogId = base64ToUint8Array(entry.logId.keyId);
+                if (!uint8ArrayEqual(rekor.logId, entryLogId)) {
+                    throw new Error(`Rekor log ID mismatch: bundle uses ${Uint8ArrayToHex(entryLogId)} but loaded key is for ${Uint8ArrayToHex(rekor.logId)}`);
+                }
+                const signature = base64ToUint8Array(entry.inclusionPromise.signedEntryTimestamp);
+                const keyId = Uint8ArrayToHex(entryLogId);
+                const integratedTime = Number(entry.integratedTime);
+                const signed = stringToUint8Array(canonicalize({
+                    body: entry.canonicalizedBody,
+                    integratedTime: integratedTime,
+                    logIndex: Number(entry.logIndex),
+                    logID: keyId,
+                }));
+                if (!(await verifySignature(rekor.publicKey, signed, signature))) {
+                    throw new Error("Failed to verify the inclusion promise in the provided bundle.");
+                }
+            }
+        }
+        // Validate integrated time and logged certificate
+        // Note: Rekor v2 bundles don't have integrated time in the tlog entry
+        if (entry.integratedTime) {
+            const integratedTime = Number(entry.integratedTime);
+            const integratedDate = new Date(integratedTime * 1000);
+            if (!cert.validForDate(integratedDate)) {
+                throw new Error("Artifact signing was logged outside of the certificate validity.");
+            }
+        }
+        else {
+            // Rekor v2 bundles (no integratedTime) require a timestamp for verification
+            if (!bundle.verificationMaterial.timestampVerificationData) {
+                throw new Error("Rekor v2 bundles require a timestamp for verification.");
+            }
+        }
+        // Verify that the certificate in the log matches the signing certificate
+        // The format depends on the entry type (hashedrekord vs dsse) and version
+        const bodyJson = JSON.parse(Uint8ArrayToString(base64ToUint8Array(entry.canonicalizedBody)));
+        if (bodyJson.kind === "hashedrekord") {
+            let loggedCertContent;
+            // Check for hashedRekordV002 structure (Rekor v2)
+            if (bodyJson.spec.hashedRekordV002) {
+                const verifier = bodyJson.spec.hashedRekordV002.signature.verifier;
+                if (verifier?.x509Certificate) {
+                    loggedCertContent = verifier.x509Certificate.rawBytes;
+                }
+            }
+            // Check for older hashedrekord structure
+            else if (bodyJson.spec.signature?.publicKey) {
+                loggedCertContent = bodyJson.spec.signature.publicKey.content;
+            }
+            if (loggedCertContent) {
+                // For hashedrekord v0.0.1, publicKey.content is base64-encoded PEM
+                // For hashedRekordV002, x509Certificate.rawBytes is base64-encoded DER
+                let loggedCert;
+                if (bodyJson.spec.hashedRekordV002) {
+                    loggedCert = X509Certificate.parse(base64ToUint8Array(loggedCertContent));
+                }
+                else {
+                    const pemString = Uint8ArrayToString(base64ToUint8Array(loggedCertContent));
+                    loggedCert = X509Certificate.parse(pemString);
+                }
+                if (!cert.equals(loggedCert)) {
+                    throw new Error("Certificate in Rekor log does not match the signing certificate.");
+                }
+            }
+        }
+        else if (bodyJson.kind === "dsse") {
+            // DSSE entries store signatures differently
+            // The certificate is verified through the bundle's verification material
+            // No additional check needed here
+        }
+        else if (bodyJson.kind === "intoto") {
+            // Intoto entries are DSSE-based and don't store certificates in the tlog entry
+            // The certificate is part of the bundle's verification material which has already
+            // been verified against the CA root. The intoto verification in tlog/intoto.ts
+            // verifies the signature and payload hash match between the tlog and bundle.
+        }
+        else {
+            // Unknown entry type - this should not happen with standard Sigstore bundles
+            throw new Error(`Unsupported tlog entry kind: ${bodyJson.kind}`);
+        }
+        return true;
+    }
+    async verifyInclusionProof(bundle) {
+        if (!this.rawRoot) {
+            throw new Error("Sigstore root is undefined");
+        }
+        if (bundle.verificationMaterial.tlogEntries.length < 1) {
+            throw new Error("No transparency log entries found in bundle");
+        }
+        const entry = bundle.verificationMaterial.tlogEntries[0];
+        // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
+        // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
+        if (entry.inclusionProof) {
+            await verifyMerkleInclusion(entry);
+            if (entry.inclusionProof.checkpoint) {
+                await verifyCheckpoint(entry, this.rawRoot.tlogs);
+            }
+        }
+    }
+    async verifyArtifact(identity, issuer, bundle, data, isDigestOnly = false) {
+        // Quick checks first: does the signing certificate have the correct identity?
+        if (!this.root) {
+            throw new Error("Sigstore root is undefined");
+        }
+        const cert = bundle.verificationMaterial.certificate ||
+            bundle.verificationMaterial.x509CertificateChain?.certificates[0];
+        if (!cert) {
+            throw new Error("No certificate found in bundle");
+        }
+        const signingCert = X509Certificate.parse(base64ToUint8Array(cert.rawBytes));
+        // Handle both regular bundles (messageSignature) and DSSE bundles (dsseEnvelope)
+        let signature;
+        if (bundle.messageSignature) {
+            signature = base64ToUint8Array(bundle.messageSignature.signature);
+        }
+        else if (bundle.dsseEnvelope) {
+            if (!bundle.dsseEnvelope.signatures || bundle.dsseEnvelope.signatures.length === 0) {
+                throw new Error("DSSE envelope has no signatures");
+            }
+            signature = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+        }
+        else {
+            throw new Error("Bundle does not contain a message signature or DSSE envelope");
+        }
+        // # 1 Basic stuff
+        if (signingCert.subjectAltName !== identity) {
+            throw new Error("Certificate identity (subjectAltName) do not match the verifying one.");
+        }
+        // Check for issuer - try V2 first, fall back to V1 (like sigstore-js does)
+        const certIssuer = signingCert.extFulcioIssuerV2?.issuer || signingCert.extFulcioIssuerV1?.issuer;
+        if (certIssuer !== issuer) {
+            throw new Error("Identity issuer is not the verifying one.");
+        }
+        // # 2 Certificate validity - verify chain to trusted CA
+        // Similar to sigstore-js key/index.ts:59-64 which calls verifyCertificateChain()
+        // Returns the verified certificate path [leaf, intermediate(s), root]
+        const certPath = await this.verifyCertificateChain(signingCert.notBefore, signingCert, this.root.certificateAuthorities);
+        // # 3 To verify the SCT we need to build a preCert (because the cert was logged without the SCT)
+        // https://github.com/sigstore/sigstore-js/packages/verify/src/key/sct.ts#L45
+        // Similar to sigstore-js key/index.ts:67 which uses path[0] (leaf) and path[1] (issuer)
+        // for SCT verification. Handle edge case where path has only one cert (self-signed root).
+        const issuerCert = certPath.length > 1 ? certPath[1] : certPath[0];
+        const verifiedSCTs = await this.verifySCT(signingCert, issuerCert, this.root.ctlogs);
+        if (verifiedSCTs.length < this.options.ctlogThreshold) {
+            throw new Error(`Not enough valid SCTs: found ${verifiedSCTs.length}, required ${this.options.ctlogThreshold}`);
+        }
+        // # 4 Rekor inclusion promise
+        if (!(await this.verifyInclusionPromise(signingCert, bundle, this.root.rekor))) {
+            throw new Error("Inclusion promise validation failed.");
+        }
+        // # 5 Rekor inclusion proof (Merkle tree verification)
+        await this.verifyInclusionProof(bundle);
+        // # 5.1 Rekor body verification
+        if (bundle.verificationMaterial.tlogEntries.length > 0) {
+            await verifyTLogBody(bundle.verificationMaterial.tlogEntries[0], bundle);
+        }
+        // # 6 TSA Timestamp Verification (if present)
+        let verifiedTimestamp;
+        if (bundle.verificationMaterial.timestampVerificationData) {
+            // Verify TSA timestamps if present
+            verifiedTimestamp = await verifyBundleTimestamp(bundle.verificationMaterial.timestampVerificationData, signature, this.rawRoot?.timestampAuthorities || []);
+            // If we have a verified timestamp, check certificate validity at that time
+            if (verifiedTimestamp && !signingCert.validForDate(verifiedTimestamp)) {
+                throw new Error("Certificate was not valid at the time of timestamping");
+            }
+        }
+        // # 7 Revocation *skipping* not really a thing (unsurprisingly)
+        // # 8 verify the signed data
+        if (bundle.dsseEnvelope) {
+            // For DSSE bundles, verify the signature over the PAE
+            const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+            const payload = JSON.parse(Uint8ArrayToString(payloadBytes));
+            // Verify the artifact digest matches a subject in the in-toto statement
+            if (!payload.subject || payload.subject.length === 0) {
+                throw new Error("DSSE payload has no subject");
+            }
+            // Compute or extract the artifact digest
+            let artifactDigest;
+            if (isDigestOnly) {
+                // data is already the digest bytes
+                artifactDigest = Uint8ArrayToHex(data);
+            }
+            else {
+                // data is the file content, compute the digest
+                artifactDigest = Uint8ArrayToHex(new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(data))));
+            }
+            // Find matching subject by scanning all subjects (not just [0])
+            let matchedSubject = null;
+            for (const subject of payload.subject) {
+                const subjectDigest = subject.digest?.["sha256"];
+                if (subjectDigest && artifactDigest === subjectDigest.toLowerCase()) {
+                    matchedSubject = subject;
+                    break;
+                }
+            }
+            if (!matchedSubject) {
+                throw new Error(`Artifact digest ${artifactDigest} does not match any subject in DSSE payload`);
+            }
+            // Create PAE (Pre-Authentication Encoding) for signature verification
+            const pae = preAuthEncoding(bundle.dsseEnvelope.payloadType, payloadBytes);
+            const publicKey = await signingCert.publicKeyObj;
+            const verified = await verifySignature(publicKey, pae, signature);
+            if (!verified) {
+                throw new Error("DSSE signature verification failed");
+            }
+        }
+        else {
+            const publicKey = await signingCert.publicKeyObj;
+            if (isDigestOnly) {
+                // For hashedrekord bundles, verify signature over the digest directly.
+                // Uses the same elliptic.js workaround as sigstore-js conformance CLI.
+                const verified = await verifySignatureOverDigest(publicKey, data, signature);
+                if (!verified) {
+                    throw new Error("Error verifying signature over digest");
+                }
+            }
+            else {
+                // For regular bundles, verify the signature over the artifact data
+                const verified = await verifySignature(publicKey, data, signature);
+                if (!verified) {
+                    const keyAlg = publicKey.algorithm.name || 'unknown';
+                    throw new Error(`Error verifying artifact signature. Key algorithm: ${keyAlg}, Data length: ${data.length}, Signature length: ${signature.length}`);
+                }
+            }
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=sigstore.js.map

package/dist/sigstore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigstore.js","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,cAAc,EAMd,aAAa,GAEd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAQrD,MAAM,OAAO,gBAAgB;IACnB,IAAI,CAAuB;IAC3B,OAAO,CAA0B;IACjC,OAAO,CAAoC;IAEnD,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,eAAqB,EAAE,IAAa;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,4DAA4D;QAE5D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,sFAAsF;YACtF,IACE,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;oBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,EACzD,CAAC;gBACD,OAAO;oBACL,SAAS,EAAE,MAAM,SAAS,CACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB;oBACD,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC3C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6CAA6C;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,eAAqB,EAAE,MAAe;QACrD,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC;YAE5D,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC1C,SAAS;oBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gHAAgH;IAChH,iGAAiG;IACjG,gCAAgC;IAChC,sFAAsF;IACtF,wFAAwF;IACxF,8DAA8D;IAC9D,KAAK,CAAC,sBAAsB,CAC1B,SAAe,EACf,IAAqB,EACrB,sBAAuC;QAEvC,IAAI,SAAc,CAAC;QAEnB,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;YACxC,oDAAoD;YACpD,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;oBAC5C,YAAY,EAAE,EAAE,CAAC,SAAS;oBAC1B,aAAa,EAAE,IAAI;oBACnB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,qEAAqE;IACrE,qGAAqG;IACrG,0GAA0G;IAC1G,OAAO,CACL,eAAqB,EACrB,IAA8B;QAE9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAEvF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oFAAoF;IACpF,mFAAmF;IACnF,2FAA2F;IAC3F,wFAAwF;IACxF,+DAA+D;IAC/D,MAAM,CAAC,eAAqB,EAAE,GAAW;QACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAErF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACrD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QACzC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7E,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,eAAe,EACf,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAC9C;YACD,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,oBAAoB,CAAC;SAClF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAiC;QAC7D,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,gGAAgG;IAChG,mBAAmB;IACnB,iCAAiC;IACjC,yCAAyC;IACzC,gGAAgG;IAChG,6FAA6F;IAC7F,KAAK,CAAC,SAAS,CACb,IAAqB,EACrB,MAAuB,EACvB,MAAe;QAEf,IAAI,MAAoC,CAAC;QAEzC,kEAAkE;QAClE,uEAAuE;QACvE,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAEnC,4CAA4C;gBAC5C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,gEAAgE;QAChE,IAAI,MAAM,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,kCAAkC;QAClC,qDAAqD;QACrD,MAAM,OAAO,GAAG,IAAI,UAAU,EAAE,CAAC;QAEjC,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACnF,CAAC;QACF,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7B,qEAAqE;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAExB,uDAAuD;QACvD,MAAM,YAAY,GAAiB,EAAE,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,mDAAmD;YACnD,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClE,SAAS,CAAC,6CAA6C;YACzD,CAAC;YAED,mFAAmF;YACnF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,yBAAyB;gBACzB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAClD,CAAC;gBACD,kEAAkE;gBAClE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChF,CAAC,CAAC,CAAC;YAEH,sCAAsC;YACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpD,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM,CAAC,iCAAiC;oBAC1C,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,6BAA6B;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAAqB,EACrB,MAAsB,EACtB,KAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAExD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,gBAAgB,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,MAAM,MAAM,gBAAgB,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,cAAc,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAEzB,wCAAwC;QACxC,+DAA+D;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7D,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QAEtD,2CAA2C;QAC3C,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;YAClD,oEAAoE;YACpE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,+DAA+D;YAC/D,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACnC,0DAA0D;gBAC1D,6CAA6C;YAC/C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,CAAC;gBAED,uEAAuE;gBACvE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,sCAAsC,eAAe,CAAC,UAAU,CAAC,0BAA0B,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC1H,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,CAAC,oBAAoB,CAC5C,CAAC;gBAEF,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAEpD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,YAAY,CAAC;oBACX,IAAI,EAAE,KAAK,CAAC,iBAAiB;oBAC7B,cAAc,EAAE,cAAc;oBAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChC,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,sEAAsE;QACtE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAE7F,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,iBAAqC,CAAC;YAE1C,kDAAkD;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACnE,IAAI,QAAQ,EAAE,eAAe,EAAE,CAAC;oBAC9B,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,yCAAyC;iBACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC5C,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;YAChE,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,mEAAmE;gBACnE,uEAAuE;gBACvE,IAAI,UAA2B,CAAC;gBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACnC,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAC5E,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpC,4CAA4C;YAC5C,yEAAyE;YACzE,kCAAkC;QACpC,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,+EAA+E;YAC/E,kFAAkF;YAClF,+EAA+E;YAC/E,6EAA6E;QAC/E,CAAC;aAAM,CAAC;YACN,6EAA6E;YAC7E,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAEzD,kEAAkE;QAClE,kFAAkF;QAClF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAEnC,IAAI,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;gBACpC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAgB,EAChB,MAAc,EACd,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAE7B,8EAA8E;QAE9E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW;YAClD,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE7E,iFAAiF;QACjF,IAAI,SAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,kBAAkB;QAClB,IAAI,WAAW,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,EAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC;QAClG,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,wDAAwD;QACxD,iFAAiF;QACjF,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,WAAW,CAAC,SAAS,EACrB,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACjC,CAAC;QAEF,iGAAiG;QACjG,6EAA6E;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,CAAC,MAAM,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAExC,gCAAgC;QAChC,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,cAAc,CAClB,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,EAC1C,MAAM,CACP,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,iBAAmC,CAAC;QACxC,IAAI,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EAAE,CAAC;YAC1D,mCAAmC;YACnC,iBAAiB,GAAG,MAAM,qBAAqB,CAC7C,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EACrD,SAAS,EACT,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CACzC,CAAC;YAEF,2EAA2E;YAC3E,IAAI,iBAAiB,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAEhE,6BAA6B;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,sDAAsD;YACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YAE7D,wEAAwE;YACxE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YAED,yCAAyC;YACzC,IAAI,cAAsB,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,mCAAmC;gBACnC,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,+CAA+C;gBAC/C,cAAc,GAAG,eAAe,CAC9B,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CACvF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,cAAc,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,aAAa,IAAI,cAAc,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpE,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,cAAc,6CAA6C,CAC/E,CAAC;YACJ,CAAC;YAED,sEAAsE;YACtE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YAEjD,IAAI,YAAY,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,kBAAkB,IAAI,CAAC,MAAM,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/stream.d.ts

@@ -0,0 +1,22 @@
+export declare class ByteStream {
+    private static BLOCK_SIZE;
+    private buf;
+    private view;
+    private start;
+    constructor(buffer?: ArrayBuffer);
+    get buffer(): Uint8Array;
+    get length(): number;
+    get position(): number;
+    seek(position: number): void;
+    slice(start: number, len: number): Uint8Array;
+    appendChar(char: number): void;
+    appendUint16(num: number): void;
+    appendUint24(num: number): void;
+    appendView(view: Uint8Array): void;
+    getBlock(size: number): Uint8Array;
+    getUint8(): number;
+    getUint16(): number;
+    private ensureCapacity;
+    private realloc;
+}
+//# sourceMappingURL=stream.d.ts.map

package/dist/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../src/stream.ts"],"names":[],"mappings":"AAiBA,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAQ;IAEjC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,IAAI,CAAa;IACzB,OAAO,CAAC,KAAK,CAAK;gBAEN,MAAM,CAAC,EAAE,WAAW;IAUhC,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAEM,IAAI,CAAC,QAAQ,EAAE,MAAM;IAMrB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU;IAU7C,UAAU,CAAC,IAAI,EAAE,MAAM;IAMvB,YAAY,CAAC,GAAG,EAAE,MAAM;IAWxB,YAAY,CAAC,GAAG,EAAE,MAAM;IAYxB,UAAU,CAAC,IAAI,EAAE,UAAU;IAM3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;IAelC,QAAQ,IAAI,MAAM;IAIlB,SAAS,IAAI,MAAM;IAM1B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,OAAO;CAUhB"}