@freedomofpress/sigstore-browser 0.1.0

package/dist/tlog/dsse.js

@@ -0,0 +1,85 @@
+/*
+ * DSSE transparency log entry verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/dsse.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle field comparison instead of SignatureContent abstraction
+ * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
+ * - Adds verifyDSSE002Body() - new functionality (reference only supports v0.0.1)
+ */
+import { base64ToUint8Array, hexToUint8Array, toArrayBuffer, uint8ArrayEqual } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+export async function verifyDSSEBody(entry, bundle) {
+    const dsseEntry = entry;
+    switch (dsseEntry.apiVersion) {
+        case "0.0.1":
+            return verifyDSSE001Body(dsseEntry, bundle);
+        case "0.0.2":
+            return verifyDSSE002Body(dsseEntry, bundle);
+        default:
+            throw new Error(`Unsupported dsse version: ${dsseEntry.apiVersion}`);
+    }
+}
+async function verifyDSSE001Body(entry, bundle) {
+    if (!bundle.dsseEnvelope) {
+        throw new Error("Bundle missing dsseEnvelope for DSSE entry");
+    }
+    if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {
+        throw new Error("DSSE entry must have exactly one signature");
+    }
+    const tlogSig = entry.spec.signatures[0].signature;
+    const tlogSigBytes = base64ToUint8Array(tlogSig);
+    if (bundle.dsseEnvelope.signatures.length === 0) {
+        throw new Error("Bundle DSSE envelope missing signatures");
+    }
+    const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+    if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+        throw new Error("DSSE signature mismatch between TLog entry and bundle");
+    }
+    const tlogHash = entry.spec.payloadHash?.value || "";
+    if (!tlogHash) {
+        throw new Error("DSSE entry missing payloadHash");
+    }
+    const tlogHashBytes = hexToUint8Array(tlogHash);
+    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(payloadBytes)));
+    if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+        throw new Error("DSSE payload hash mismatch between TLog entry and bundle");
+    }
+}
+// New functionality for DSSE v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
+async function verifyDSSE002Body(entry, bundle) {
+    if (!bundle.dsseEnvelope) {
+        throw new Error("Bundle missing dsseEnvelope for DSSE v0.0.2 entry");
+    }
+    const spec = entry.spec.dsseV002;
+    if (!spec) {
+        throw new Error("DSSE v0.0.2 entry missing dsseV002 spec");
+    }
+    if (!spec.signatures || spec.signatures.length !== 1) {
+        throw new Error("DSSE v0.0.2 entry must have exactly one signature");
+    }
+    const tlogSig = spec.signatures[0].content;
+    const tlogSigBytes = base64ToUint8Array(tlogSig);
+    if (bundle.dsseEnvelope.signatures.length === 0) {
+        throw new Error("Bundle DSSE envelope missing signatures");
+    }
+    const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+    if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+        throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
+    }
+    const tlogHash = spec.payloadHash?.digest || "";
+    if (!tlogHash) {
+        throw new Error("DSSE v0.0.2 entry missing payloadHash");
+    }
+    const tlogHashBytes = base64ToUint8Array(tlogHash);
+    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(payloadBytes)));
+    if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+        throw new Error("DSSE payload hash mismatch between TLog entry and bundle (v0.0.2)");
+    }
+}
+//# sourceMappingURL=dsse.js.map

package/dist/tlog/dsse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,SAAS,GAAG,KAAkB,CAAC;IAErC,QAAQ,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C;YACE,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,CAAC,UAAU,EAAE,CACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAC/E,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAI,KAAK,CAAC,IAAY,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAC/E,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/tlog/hashedrekord.d.ts

@@ -0,0 +1,4 @@
+import type { SigstoreBundle } from "../bundle.js";
+import type { RekorEntry } from "./body.js";
+export declare function verifyHashedRekordBody(entry: RekorEntry, bundle: SigstoreBundle): Promise<void>;
+//# sourceMappingURL=hashedrekord.d.ts.map

package/dist/tlog/hashedrekord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashedrekord.d.ts","sourceRoot":"","sources":["../../src/tlog/hashedrekord.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAwC5C,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/tlog/hashedrekord.js

@@ -0,0 +1,63 @@
+/*
+ * HashedRekord transparency log entry verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/hashedrekord.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle field comparison instead of SignatureContent abstraction
+ * - Adds verifyHashedRekordV002Body() - new functionality (reference only supports v0.0.1)
+ */
+import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "../encoding.js";
+export async function verifyHashedRekordBody(entry, bundle) {
+    const hashedRekordEntry = entry;
+    switch (hashedRekordEntry.apiVersion) {
+        case "0.0.1":
+            return verifyHashedRekordV001Body(hashedRekordEntry, bundle);
+        case "0.0.2":
+            return verifyHashedRekordV002Body(hashedRekordEntry, bundle);
+        default:
+            throw new Error(`Unsupported hashedrekord version: ${hashedRekordEntry.apiVersion}`);
+    }
+}
+function verifyHashedRekordV001Body(entry, bundle) {
+    const spec = entry.spec;
+    if (!bundle.messageSignature) {
+        throw new Error("Bundle missing messageSignature for hashedrekord entry");
+    }
+    const tlogSig = spec.signature.content || "";
+    const tlogSigBytes = base64ToUint8Array(tlogSig);
+    const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
+    if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+        throw new Error("Signature mismatch between TLog entry and bundle");
+    }
+    const tlogDigest = spec.data.hash?.value || "";
+    const tlogDigestBytes = hexToUint8Array(tlogDigest);
+    const bundleDigestBytes = base64ToUint8Array(bundle.messageSignature.messageDigest.digest);
+    if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {
+        throw new Error("Digest mismatch between TLog entry and bundle");
+    }
+}
+// New functionality for HashedRekord v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
+function verifyHashedRekordV002Body(entry, bundle) {
+    const spec = entry.spec.hashedRekordV002;
+    if (!bundle.messageSignature) {
+        throw new Error("Bundle missing messageSignature for hashedrekord v0.0.2 entry");
+    }
+    // NOTE: HashedRekord v0.0.2 uses single base64 encoding (unlike intoto which is double-encoded)
+    // Verified against Sigstore conformance test suite bundles
+    const tlogSig = spec.signature.content || "";
+    const tlogSigBytes = base64ToUint8Array(tlogSig);
+    const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
+    if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+        throw new Error("Signature mismatch between TLog entry and bundle (v0.0.2)");
+    }
+    const tlogDigest = spec.data.digest || "";
+    const tlogDigestBytes = base64ToUint8Array(tlogDigest);
+    const bundleDigestBytes = base64ToUint8Array(bundle.messageSignature.messageDigest.digest);
+    if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {
+        throw new Error("Digest mismatch between TLog entry and bundle (v0.0.2)");
+    }
+}
+//# sourceMappingURL=hashedrekord.js.map

package/dist/tlog/hashedrekord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashedrekord.js","sourceRoot":"","sources":["../../src/tlog/hashedrekord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA0CtF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,MAAsB;IAEtB,MAAM,iBAAiB,GAAG,KAA0B,CAAC;IAErD,QAAQ,iBAAiB,CAAC,UAAU,EAAE,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC/D,KAAK,OAAO;YACV,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC/D;YACE,MAAM,IAAI,KAAK,CACb,qCAAqC,iBAAiB,CAAC,UAAU,EAAE,CACpE,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAwB,EACxB,MAAsB;IAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwB,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAS,0BAA0B,CACjC,KAAwB,EACxB,MAAsB;IAEtB,MAAM,IAAI,GAAI,KAAK,CAAC,IAA6B,CAAC,gBAAgB,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,gGAAgG;IAChG,2DAA2D;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/tlog/intoto.d.ts

@@ -0,0 +1,4 @@
+import type { SigstoreBundle } from "../bundle.js";
+import type { RekorEntry } from "./body.js";
+export declare function verifyIntotoBody(entry: RekorEntry, bundle: SigstoreBundle): Promise<void>;
+//# sourceMappingURL=intoto.d.ts.map

package/dist/tlog/intoto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intoto.d.ts","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiC5C,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAkDf"}

package/dist/tlog/intoto.js

@@ -0,0 +1,50 @@
+/*
+ * Intoto transparency log entry verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/intoto.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle field comparison instead of SignatureContent abstraction
+ * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
+ */
+import { base64Decode, base64ToUint8Array, hexToUint8Array, toArrayBuffer, uint8ArrayEqual } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+export async function verifyIntotoBody(entry, bundle) {
+    const intotoEntry = entry;
+    if (intotoEntry.apiVersion !== "0.0.2") {
+        throw new Error(`Unsupported intoto version: ${intotoEntry.apiVersion}`);
+    }
+    if (!bundle.dsseEnvelope) {
+        throw new Error("Bundle missing dsseEnvelope for intoto entry");
+    }
+    const tlogEnvelope = intotoEntry.spec.content.envelope;
+    if (!tlogEnvelope.signatures || tlogEnvelope.signatures.length !== 1) {
+        throw new Error("Intoto entry must have exactly one signature");
+    }
+    // The signature in the intoto tlog entry is double-base64-encoded:
+    // 1. Raw signature bytes are base64-encoded (normal)
+    // 2. That base64 string is base64-encoded again (for storage in JSON)
+    // So we decode twice: base64 -> string -> base64 -> bytes
+    const tlogSigBase64 = tlogEnvelope.signatures[0].sig;
+    const tlogSigDecoded = base64Decode(tlogSigBase64); // First decode: base64 -> UTF-8 string (which contains base64)
+    const tlogSigBytes = base64ToUint8Array(tlogSigDecoded); // Second decode: base64 string -> raw bytes
+    if (bundle.dsseEnvelope.signatures.length === 0) {
+        throw new Error("Bundle DSSE envelope missing signatures");
+    }
+    const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+    if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+        throw new Error("Intoto signature mismatch between TLog entry and bundle");
+    }
+    if (intotoEntry.spec.content.payloadHash) {
+        const tlogHash = intotoEntry.spec.content.payloadHash.value;
+        const tlogHashBytes = hexToUint8Array(tlogHash);
+        const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+        const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(payloadBytes)));
+        if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+            throw new Error("Intoto payload hash mismatch between TLog entry and bundle");
+        }
+    }
+}
+//# sourceMappingURL=intoto.js.map

package/dist/tlog/intoto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACnH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAmClD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,WAAW,GAAG,KAAoB,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,CAAC,UAAU,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,+DAA+D;IACnH,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,4CAA4C;IAErG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAC5D,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAC/E,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/tlog/merkle.d.ts

@@ -0,0 +1,3 @@
+import type { TLogEntry } from "../bundle.js";
+export declare function verifyMerkleInclusion(entry: TLogEntry): Promise<void>;
+//# sourceMappingURL=merkle.d.ts.map

package/dist/tlog/merkle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.d.ts","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/dist/tlog/merkle.js

@@ -0,0 +1,112 @@
+/*
+Adapted from sigstore-js for browser compatibility:
+https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/merkle.ts
+
+Key differences:
+- Uses Uint8Array instead of Buffer
+- Uses async Web Crypto API (crypto.subtle.digest) instead of sync Node.js crypto
+- Base64 decoding via custom base64ToUint8Array instead of Buffer.from
+- Custom uint8ArrayEqual instead of crypto.bufferEqual
+*/
+import { base64ToUint8Array, toArrayBuffer, uint8ArrayEqual } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+const RFC6962_LEAF_HASH_PREFIX = new Uint8Array([0x00]);
+const RFC6962_NODE_HASH_PREFIX = new Uint8Array([0x01]);
+export async function verifyMerkleInclusion(entry) {
+    if (!entry.inclusionProof) {
+        throw new Error("Missing inclusion proof");
+    }
+    const inclusionProof = entry.inclusionProof;
+    const logIndex = BigInt(inclusionProof.logIndex);
+    const treeSize = BigInt(inclusionProof.treeSize);
+    if (logIndex < 0n || logIndex >= treeSize) {
+        throw new Error(`Invalid log index: ${logIndex}`);
+    }
+    // Figure out which subset of hashes corresponds to the inner and border
+    // nodes
+    const { inner, border } = decompInclProof(logIndex, treeSize);
+    if (inclusionProof.hashes.length !== inner + border) {
+        throw new Error("Invalid hash count in inclusion proof");
+    }
+    const innerHashes = inclusionProof.hashes
+        .slice(0, inner)
+        .map((h) => base64ToUint8Array(h));
+    const borderHashes = inclusionProof.hashes
+        .slice(inner)
+        .map((h) => base64ToUint8Array(h));
+    // The entry's hash is the leaf hash
+    const leafHash = await hashLeaf(base64ToUint8Array(entry.canonicalizedBody));
+    // Chain the hashes belonging to the inner and border portions
+    const calculatedHash = await chainBorderRight(await chainInner(leafHash, innerHashes, logIndex), borderHashes);
+    const rootHash = base64ToUint8Array(inclusionProof.rootHash);
+    // Calculated hash should match the root hash in the inclusion proof
+    if (!uint8ArrayEqual(calculatedHash, rootHash)) {
+        throw new Error("Calculated root hash does not match inclusion proof");
+    }
+}
+// Breaks down inclusion proof for a leaf at the specified index in a tree of
+// the specified size. The split point is where paths to the index leaf and
+// the (size - 1) leaf diverge. Returns lengths of the bottom and upper proof
+// parts.
+function decompInclProof(index, size) {
+    const inner = innerProofSize(index, size);
+    const border = onesCount(index >> BigInt(inner));
+    return { inner, border };
+}
+// Computes a subtree hash for a node on or below the tree's right border.
+// Assumes the provided proof hashes are ordered from lower to higher levels
+// and seed is the initial hash of the node specified by the index.
+async function chainInner(seed, hashes, index) {
+    let acc = seed;
+    for (let i = 0; i < hashes.length; i++) {
+        const h = hashes[i];
+        if ((index >> BigInt(i)) & BigInt(1)) {
+            acc = await hashChildren(h, acc);
+        }
+        else {
+            acc = await hashChildren(acc, h);
+        }
+    }
+    return acc;
+}
+// Computes a subtree hash for nodes along the tree's right border.
+async function chainBorderRight(seed, hashes) {
+    let acc = seed;
+    for (const h of hashes) {
+        acc = await hashChildren(h, acc);
+    }
+    return acc;
+}
+function innerProofSize(index, size) {
+    return bitLength(index ^ (size - BigInt(1)));
+}
+// Counts the number of ones in the binary representation of the given number.
+// https://en.wikipedia.org/wiki/Hamming_weight
+function onesCount(num) {
+    return num.toString(2).split("1").length - 1;
+}
+// Returns the number of bits necessary to represent an integer in binary.
+function bitLength(n) {
+    if (n === 0n) {
+        return 0;
+    }
+    return n.toString(2).length;
+}
+// Hashing logic according to RFC6962.
+// https://datatracker.ietf.org/doc/html/rfc6962#section-2
+async function hashChildren(left, right) {
+    const data = new Uint8Array(RFC6962_NODE_HASH_PREFIX.length + left.length + right.length);
+    data.set(RFC6962_NODE_HASH_PREFIX, 0);
+    data.set(left, RFC6962_NODE_HASH_PREFIX.length);
+    data.set(right, RFC6962_NODE_HASH_PREFIX.length + left.length);
+    const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(data));
+    return new Uint8Array(hash);
+}
+async function hashLeaf(leaf) {
+    const data = new Uint8Array(RFC6962_LEAF_HASH_PREFIX.length + leaf.length);
+    data.set(RFC6962_LEAF_HASH_PREFIX, 0);
+    data.set(leaf, RFC6962_LEAF_HASH_PREFIX.length);
+    const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(data));
+    return new Uint8Array(hash);
+}
+//# sourceMappingURL=merkle.js.map

package/dist/tlog/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;EASE;AACF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB;IAEhB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAG,EAAE,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,wEAAwE;IACxE,QAAQ;IACR,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,GAAG,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM;SACtC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM;SACvC,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE7E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAC3C,MAAM,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EACjD,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7D,oEAAoE;IACpE,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAS;AACT,SAAS,eAAe,CACtB,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,KAAK,UAAU,UAAU,CACvB,IAAgB,EAChB,MAAoB,EACpB,KAAa;IAEb,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,gBAAgB,CAC7B,IAAgB,EAChB,MAAoB;IAEpB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,OAAO,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED,sCAAsC;AACtC,0DAA0D;AAC1D,KAAK,UAAU,YAAY,CACzB,IAAgB,EAChB,KAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAC7D,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/trust/tuf-root.json

@@ -0,0 +1 @@
+"ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9"

package/dist/trust/tuf.d.ts

@@ -0,0 +1,95 @@
+import type { TrustedRoot } from "../interfaces.js";
+/**
+ * Options for TrustedRootProvider configuration
+ */
+export interface TrustedRootProviderOptions {
+    /**
+     * TUF repository URL for metadata
+     * Default: Sigstore production TUF repository
+     */
+    metadataUrl?: string;
+    /**
+     * Target base URL for fetching target files
+     * If not specified, uses the same as metadataUrl
+     */
+    targetBaseUrl?: string;
+    /**
+     * Initial root metadata (1.root.json content)
+     * If not provided, will use embedded default
+     */
+    initialRoot?: string;
+    /**
+     * Namespace for TUF cache storage
+     * Default: 'sigstore-browser'
+     */
+    namespace?: string;
+    /**
+     * Name of the trusted root target file
+     * Default: 'trusted_root.json'
+     */
+    trustedRootTarget?: string;
+    /**
+     * Cache TTL in milliseconds
+     * Default: 1 hour (3600000 ms)
+     */
+    cacheTTL?: number;
+}
+/**
+ * Provides Sigstore trusted root via TUF for secure updates
+ *
+ * This class manages fetching and caching of Sigstore trusted root metadata
+ * using The Update Framework (TUF) for secure, verified updates.
+ *
+ * Example usage:
+ * ```typescript
+ * const provider = new TrustedRootProvider();
+ * const trustedRoot = await provider.getTrustedRoot();
+ * ```
+ */
+export declare class TrustedRootProvider {
+    private metadataUrl;
+    private targetBaseUrl?;
+    private initialRoot?;
+    private namespace;
+    private trustedRootTarget;
+    private cacheTTL;
+    private tufClient?;
+    private cachedRoot?;
+    private cacheTimestamp?;
+    constructor(options?: TrustedRootProviderOptions);
+    /**
+     * Initialize the TUF client
+     * Lazy initialization to avoid loading TUF client until needed
+     */
+    private initTUFClient;
+    /**
+     * Get the default embedded root metadata
+     * Returns the TUF root.json that bootstraps the TUF client
+     */
+    private getDefaultRoot;
+    /**
+     * Check if cached trusted root is still valid
+     */
+    private isCacheValid;
+    /**
+     * Get the Sigstore trusted root metadata
+     * Uses TUF to securely fetch and verify the trusted root
+     *
+     * @returns Promise<TrustedRoot> The verified trusted root metadata
+     * @throws Error if TUF verification fails or root cannot be fetched
+     */
+    getTrustedRoot(): Promise<TrustedRoot>;
+    /**
+     * Manually refresh the trusted root from TUF
+     * Bypasses cache and forces a fresh fetch
+     *
+     * @returns Promise<TrustedRoot> The updated trusted root metadata
+     */
+    refreshTrustedRoot(): Promise<TrustedRoot>;
+    /**
+     * Clear the cached trusted root
+     * Next call to getTrustedRoot() will fetch fresh data
+     */
+    clearCache(): void;
+}
+//# sourceMappingURL=tuf.d.ts.map

package/dist/trust/tuf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,cAAc,CAAC,CAAS;gBAEpB,OAAO,GAAE,0BAA+B;IAUpD;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;YACW,cAAc;IAY5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAsC5C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAShD;;;OAGG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/dist/trust/tuf.js

@@ -0,0 +1,150 @@
+/*
+ * TUF (The Update Framework) integration for trusted root management
+ *
+ * Provides secure updates for Sigstore trusted root metadata using TUF.
+ * Uses tuf-browser for browser-compatible TUF client functionality.
+ *
+ * Reference: https://github.com/freedomofpress/tuf-browser
+ */
+import { Uint8ArrayToString } from "../encoding.js";
+/**
+ * Default configuration for Sigstore production TUF repository
+ */
+const DEFAULT_CONFIG = {
+    metadataUrl: 'https://tuf-repo-cdn.sigstore.dev/',
+    namespace: 'sigstore-browser',
+    trustedRootTarget: 'trusted_root.json',
+    cacheTTL: 3600000, // 1 hour
+};
+/**
+ * Provides Sigstore trusted root via TUF for secure updates
+ *
+ * This class manages fetching and caching of Sigstore trusted root metadata
+ * using The Update Framework (TUF) for secure, verified updates.
+ *
+ * Example usage:
+ * ```typescript
+ * const provider = new TrustedRootProvider();
+ * const trustedRoot = await provider.getTrustedRoot();
+ * ```
+ */
+export class TrustedRootProvider {
+    metadataUrl;
+    targetBaseUrl;
+    initialRoot;
+    namespace;
+    trustedRootTarget;
+    cacheTTL;
+    tufClient;
+    cachedRoot;
+    cacheTimestamp;
+    constructor(options = {}) {
+        const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;
+        this.metadataUrl = metadataUrl.endsWith('/') ? metadataUrl : `${metadataUrl}/`;
+        this.targetBaseUrl = options.targetBaseUrl || this.metadataUrl;
+        this.initialRoot = options.initialRoot;
+        this.namespace = options.namespace || DEFAULT_CONFIG.namespace;
+        this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;
+        this.cacheTTL = options.cacheTTL ?? DEFAULT_CONFIG.cacheTTL;
+    }
+    /**
+     * Initialize the TUF client
+     * Lazy initialization to avoid loading TUF client until needed
+     */
+    async initTUFClient() {
+        if (this.tufClient) {
+            return;
+        }
+        try {
+            const { TUFClient } = await import('tuf-browser/dist/tuf.js');
+            // Get initial root metadata
+            const rootMetadata = this.initialRoot || await this.getDefaultRoot();
+            this.tufClient = new TUFClient(this.metadataUrl, rootMetadata, this.namespace, this.targetBaseUrl);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize TUF client: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Get the default embedded root metadata
+     * Returns the TUF root.json that bootstraps the TUF client
+     */
+    async getDefaultRoot() {
+        // Import the embedded TUF root metadata (base64-encoded 1.root.json as JSON string)
+        // This is the root of trust for TUF, not to be confused with the Sigstore trusted root
+        const tufRootModule = await import('./tuf-root.json', { with: { type: 'json' } });
+        const tufRootBase64 = tufRootModule.default;
+        // Decode from base64 to get the actual root.json content
+        const decoder = new TextDecoder();
+        const rootBytes = Uint8Array.from(atob(tufRootBase64), c => c.charCodeAt(0));
+        return decoder.decode(rootBytes);
+    }
+    /**
+     * Check if cached trusted root is still valid
+     */
+    isCacheValid() {
+        if (!this.cachedRoot || !this.cacheTimestamp) {
+            return false;
+        }
+        const now = Date.now();
+        return (now - this.cacheTimestamp) < this.cacheTTL;
+    }
+    /**
+     * Get the Sigstore trusted root metadata
+     * Uses TUF to securely fetch and verify the trusted root
+     *
+     * @returns Promise<TrustedRoot> The verified trusted root metadata
+     * @throws Error if TUF verification fails or root cannot be fetched
+     */
+    async getTrustedRoot() {
+        // Return cached root if still valid
+        if (this.isCacheValid() && this.cachedRoot) {
+            return this.cachedRoot;
+        }
+        // Initialize TUF client if needed
+        await this.initTUFClient();
+        if (!this.tufClient) {
+            throw new Error('TUF client not initialized');
+        }
+        try {
+            // Update TUF metadata (root, timestamp, snapshot, targets)
+            // This must be called before getTarget() to populate the metadata cache
+            await this.tufClient.updateTUF();
+            // Fetch the trusted root target via TUF
+            // TUF will handle all verification (signatures, rollback protection, etc.)
+            const trustedRootBytes = await this.tufClient.getTarget(this.trustedRootTarget);
+            // Parse the trusted root JSON
+            const trustedRootJson = Uint8ArrayToString(trustedRootBytes);
+            const trustedRoot = JSON.parse(trustedRootJson);
+            // Cache the result
+            this.cachedRoot = trustedRoot;
+            this.cacheTimestamp = Date.now();
+            return trustedRoot;
+        }
+        catch (error) {
+            throw new Error(`Failed to fetch trusted root via TUF: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Manually refresh the trusted root from TUF
+     * Bypasses cache and forces a fresh fetch
+     *
+     * @returns Promise<TrustedRoot> The updated trusted root metadata
+     */
+    async refreshTrustedRoot() {
+        // Clear cache
+        this.cachedRoot = undefined;
+        this.cacheTimestamp = undefined;
+        // Fetch fresh root
+        return await this.getTrustedRoot();
+    }
+    /**
+     * Clear the cached trusted root
+     * Next call to getTrustedRoot() will fetch fresh data
+     */
+    clearCache() {
+        this.cachedRoot = undefined;
+        this.cacheTimestamp = undefined;
+    }
+}
+//# sourceMappingURL=tuf.js.map

package/dist/trust/tuf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AA4CpD;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACtB,WAAW,CAAS;IACpB,aAAa,CAAU;IACvB,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,QAAQ,CAAS;IAEjB,SAAS,CAAa;IACtB,UAAU,CAAe;IACzB,cAAc,CAAU;IAEhC,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAE9D,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,oFAAoF;QACpF,uFAAuF;QACvF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAiB,CAAC;QAEtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEhF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}