@freedomofpress/sigstore-browser 0.1.13 → 0.1.15

package/.github/workflows/conformance.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Install Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
 
       - run: npm ci
       - run: npm run build

package/.github/workflows/publish.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           registry-url: "https://registry.npmjs.org"
 
       - name: Update npm

package/README.md

@@ -50,8 +50,7 @@ const verified = await verifier.verifyArtifact(
   'https://accounts.google.com',    // Expected OIDC issuer
   bundle,
   artifactData,
-  false,
-  policy // Optional VerificationPolicy
+  false
 );
 ```
 
@@ -59,27 +58,32 @@ const verified = await verifier.verifyArtifact(
 
 ```typescript
 const verifier = new SigstoreVerifier({
-  tlogThreshold: 1,   // Minimum transparency log entries required (default: 1)
-  ctlogThreshold: 1,  // Minimum SCTs required (default: 1)
-  tsaThreshold: 0,    // Minimum TSA timestamps required (default: 0)
+  tlogThreshold: 1,   // Minimum distinct log operators with a fully verified entry (default: 1)
+  ctlogThreshold: 1,  // Minimum distinct CT log operators with a verified SCT (default: 1)
+  tsaThreshold: 0,    // Minimum distinct TSA operators with a verified timestamp (default: 0)
 });
 ```
 
+Thresholds must be non-negative safe integers. Authorities without `operator` metadata can satisfy a threshold of one, but never add to the count of named operators. Thresholds above one require that many distinct, explicitly named operators.
+
+When `isDigestOnly` is `true`, supply exactly 32 bytes containing the artifact's SHA-256 digest.
+
 ## What Gets Verified
 
 The `verifyArtifact` method performs the following checks:
 
-1. **Identity Verification**: Certificate SAN matches the expected identity
-2. **Issuer Verification**: Certificate OIDC issuer matches the expected issuer
-3. **Certificate Chain**: Leaf certificate chains to a trusted Fulcio CA
-4. **SCT Verification**: Signed Certificate Timestamps from CT logs
-5. **Inclusion Promise/Proof**: Rekor transparency log inclusion
-6. **Merkle Tree Verification**: Inclusion proof validation (for v0.2+ bundles)
-7. **TLog Body Verification**: Entry body matches bundle content
-8. **TSA Timestamp Verification**: RFC 3161 timestamp verification (if configured)
-9. **Signature Verification**: Artifact signature using certificate's public key
-
-`verifyArtifact` accepts an optional `VerificationPolicy` as the last argument to enforce custom certificate claim checks.
+1. **Bundle Validation**: Structure, a 16 MiB aggregate encoded-data limit, bounded certificate chains and a supported media type
+2. **Identity Verification**: Certificate SAN matches the expected identity
+3. **Issuer Verification**: Certificate OIDC issuer matches the expected issuer
+4. **Transparency Log**: Every entry from a trusted Rekor log is verified (inclusion promise, Merkle proof, checkpoint, body and logged certificate); the threshold counts distinct log operators
+5. **TSA Timestamp Verification**: RFC 3161 timestamps (if present); the threshold counts distinct operators
+6. **Observer Timestamps**: At least one verified integrated time or TSA timestamp must anchor the signature
+7. **Certificate Chain**: Leaf certificate chains to a Fulcio CA that was trusted at every observer timestamp
+8. **SCT Verification**: Signed Certificate Timestamps from CT logs; the threshold counts distinct operators
+9. **Signature Verification**: Artifact signature using the certificate's public key
+
+Use `verifyArtifactPolicy(policy, bundle, artifactData, isDigestOnly)` to enforce a custom `VerificationPolicy`, including the required identity and issuer checks.
+Policies may be synchronous or asynchronous; asynchronous policies are awaited before verification continues.
 
 ## Development
 

package/dist/bundle.d.ts

@@ -83,5 +83,7 @@ export interface InTotoSubject {
     name: string;
     digest: Record<string, string>;
 }
+export declare function assertTimestampVerificationData(data: unknown): void;
+export declare function assertBundle(b: unknown): asserts b is SigstoreBundle;
 export {};
 //# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,KAAK,kBAAkB,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB,CAAC,kBAAkB,GAAG;IAAE,gBAAgB,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GACnF,CAAC,kBAAkB,GAAG;IAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAEpF,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,KAAK,kBAAkB,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB,CAAC,kBAAkB,GAAG;IAAE,gBAAgB,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GACnF,CAAC,kBAAkB,GAAG;IAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAEpF,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAsCD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAEnE;AAID,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,cAAc,CA2CpE"}

package/dist/bundle.js

@@ -1,2 +1,67 @@
-export {};
+const isStr = (v) => typeof v === "string";
+// Bound the aggregate encoded data this verifier will decode, parse, or hash.
+const MAX_BUNDLE_STRING_CHARS = 16 * 1024 * 1024;
+function boundedStrings() {
+    let total = 0;
+    return (v) => {
+        if (!isStr(v))
+            return false;
+        total += v.length;
+        return total <= MAX_BUNDLE_STRING_CHARS;
+    };
+}
+// Protobuf log indices, tree sizes and times are non-negative int64 values.
+// Bound the string before BigInt conversion to avoid unbounded arithmetic.
+const isInt64 = (v) => isStr(v) && /^\d{1,19}$/.test(v) && BigInt(v) <= 9223372036854775807n;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const isObj = (v) => typeof v === "object" && v !== null;
+function check(cond, what) {
+    if (!cond)
+        throw new Error(`Invalid bundle: ${what}`);
+}
+function checkTimestampVerificationData(data, isBoundedStr) {
+    if (data == null)
+        return;
+    check(isObj(data), "timestampVerificationData");
+    const ts = data.rfc3161Timestamps;
+    check(ts === undefined || (Array.isArray(ts) && ts.length <= 32 && ts.every((t) => isObj(t) && isBoundedStr(t.signedTimestamp))), "rfc3161Timestamps");
+}
+// Lives in verifyBundleTimestamp(), which every caller routes through.
+export function assertTimestampVerificationData(data) {
+    checkTimestampVerificationData(data, boundedStrings());
+}
+// Structural validation of a parsed bundle, replacing the compile-time-only type with runtime checks.
+// Entry count is capped at 32 like sigstore-go does.
+export function assertBundle(b) {
+    const isBoundedStr = boundedStrings();
+    check(isObj(b) && isBoundedStr(b.mediaType) && isObj(b.verificationMaterial), "missing mediaType or verificationMaterial");
+    const vm = b.verificationMaterial;
+    const certs = vm.certificate ? [vm.certificate] : vm.x509CertificateChain?.certificates;
+    check(Array.isArray(certs) && certs.length > 0 && certs.length <= 32 && certs.every((c) => isObj(c) && isBoundedStr(c.rawBytes)), "certificate");
+    check(Array.isArray(vm.tlogEntries) && vm.tlogEntries.length > 0 && vm.tlogEntries.length <= 32, "tlogEntries");
+    for (const e of vm.tlogEntries) {
+        check(isObj(e) && isInt64(e.logIndex) && isBoundedStr(e.logId?.keyId) && isBoundedStr(e.canonicalizedBody), "tlog entry");
+        check(isBoundedStr(e.kindVersion?.kind) && isBoundedStr(e.kindVersion?.version), "tlog entry kindVersion");
+        check(e.integratedTime == null || (isInt64(e.integratedTime) && Number.isFinite(new Date(Number(e.integratedTime) * 1000).getTime())), "tlog entry integratedTime");
+        // A SET signs the integrated time, so a promise without one is malformed.
+        // SET canonicalization uses Number, which must not round the signed log index.
+        const set = e.inclusionPromise?.signedEntryTimestamp;
+        check(e.inclusionPromise === undefined || (isBoundedStr(set) && set !== "" && isInt64(e.integratedTime) && Number.isSafeInteger(Number(e.logIndex))), "inclusion promise");
+        const p = e.inclusionProof;
+        // An int64-sized tree requires at most 63 sibling hashes.
+        check(p === undefined ||
+            (isObj(p) && isInt64(p.logIndex) && isInt64(p.treeSize) && isBoundedStr(p.rootHash) &&
+                Array.isArray(p.hashes) && p.hashes.length <= 63 && p.hashes.every(isBoundedStr) && isBoundedStr(p.checkpoint?.envelope)), "inclusion proof");
+    }
+    checkTimestampVerificationData(vm.timestampVerificationData, isBoundedStr);
+    const { messageSignature: ms, dsseEnvelope: env } = b;
+    check((ms === undefined) !== (env === undefined), "exactly one of messageSignature or dsseEnvelope");
+    if (ms !== undefined) {
+        check(isObj(ms) && isBoundedStr(ms.signature) && isBoundedStr(ms.messageDigest?.algorithm) && isBoundedStr(ms.messageDigest?.digest), "messageSignature");
+    }
+    else {
+        check(isObj(env) && isBoundedStr(env.payload) && isBoundedStr(env.payloadType), "dsseEnvelope");
+        check(Array.isArray(env.signatures) && env.signatures.length === 1 && isBoundedStr(env.signatures[0]?.sig), "dsseEnvelope must have exactly one signature");
+    }
+}
 //# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":""}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAoGA,MAAM,KAAK,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AACjE,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,SAAS,cAAc;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,CAAU,EAAe,EAAE;QACjC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,OAAO,KAAK,IAAI,uBAAuB,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AACD,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAC1C,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;AACxE,8DAA8D;AAC9D,MAAM,KAAK,GAAG,CAAC,CAAU,EAA4B,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAE5F,SAAS,KAAK,CAAC,IAAa,EAAE,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa,EACb,YAAyC;IAEzC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO;IACzB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClC,KAAK,CACH,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EACnI,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,8BAA8B,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,sGAAsG;AACtG,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,2CAA2C,CAAC,CAAC;IAC3H,MAAM,EAAE,GAAG,CAAC,CAAC,oBAAoB,CAAC;IAElC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;IACxF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAE1J,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1H,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3G,KAAK,CACH,CAAC,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAC/H,2BAA2B,CAC5B,CAAC;QACF,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACrD,KAAK,CACH,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC9I,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;QAC3B,0DAA0D;QAC1D,KAAK,CACH,CAAC,KAAK,SAAS;YACb,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAC7H,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,8BAA8B,CAAC,EAAE,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IAE3E,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,iDAAiD,CAAC,CAAC;IACrG,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5J,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC"}

package/dist/interfaces.d.ts

@@ -1,4 +1,11 @@
 import { X509Certificate } from "./x509/index.js";
+export declare function parseValidityPeriod(validity: {
+    start?: unknown;
+    end?: unknown;
+} | undefined): {
+    start: Date;
+    end: Date;
+};
 export declare enum SigstoreRoots {
     certificateAuthorities = "certificateAuthorities",
     ctlogs = "ctlogs",
@@ -27,10 +34,12 @@ export interface RawTimestampAuthority {
         start: string;
         end?: string;
     };
+    operator?: string;
 }
 export interface CTLog {
     logID: Uint8Array;
     publicKey: CryptoKey;
+    operator: string;
     validFor: {
         start: Date;
         end: Date;
@@ -39,6 +48,12 @@ export interface CTLog {
 export interface RekorKeyInfo {
     publicKey: CryptoKey;
     logId: Uint8Array;
+    hashAlgorithm: string;
+    operator: string;
+    validFor: {
+        start: Date;
+        end: Date;
+    };
 }
 export interface CertAuthority {
     certChain: X509Certificate[];
@@ -48,10 +63,9 @@ export interface CertAuthority {
     };
 }
 export interface Sigstore {
-    rekor: RekorKeyInfo | undefined;
+    rekor: RekorKeyInfo[];
     ctlogs: CTLog[];
     certificateAuthorities: CertAuthority[];
-    timestampAuthorities: CertAuthority[];
 }
 export interface RawLog {
     baseUrl: string;
@@ -67,6 +81,7 @@ export interface RawLog {
     logId: {
         keyId: string;
     };
+    operator?: string;
 }
 export type RawLogs = RawLog[];
 export interface RawCA {

package/dist/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,oBAAY,aAAa;IACvB,sBAAsB,2BAA2B;IACjD,MAAM,WAAW;IACjB,oBAAoB,yBAAyB;IAC7C,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,EAAE,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,sBAAsB,EAAE,aAAa,EAAE,CAAC;IACxC,oBAAoB,EAAE,aAAa,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE;YACR,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;AAE/B,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;AAG7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AActF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM1D"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GACvD;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,IAAI,CAAA;CAAE,CAe5B;AAED,oBAAY,aAAa;IACvB,sBAAsB,2BAA2B;IACjD,MAAM,WAAW;IACjB,oBAAoB,yBAAyB;IAC7C,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,EAAE,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,sBAAsB,EAAE,aAAa,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE;YACR,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;AAE/B,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;AAG7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AActF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM1D"}

package/dist/interfaces.js

@@ -1,3 +1,17 @@
+export function parseValidityPeriod(validity) {
+    if (typeof validity?.start !== "string" ||
+        (validity.end !== undefined && typeof validity.end !== "string")) {
+        throw new Error("Invalid authority validity period");
+    }
+    const start = new Date(validity.start);
+    const end = validity.end === undefined
+        ? new Date(8640000000000000)
+        : new Date(validity.end);
+    if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start > end) {
+        throw new Error("Invalid authority validity period");
+    }
+    return { start, end };
+}
 export var SigstoreRoots;
 (function (SigstoreRoots) {
     SigstoreRoots["certificateAuthorities"] = "certificateAuthorities";

package/dist/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AA8FD,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CACjC,QAAwD;IAExD,IACE,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ;QACnC,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,KAAK,SAAS;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAsGD,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/policy.d.ts

@@ -19,7 +19,7 @@ export declare const GITHUB_OIDC_ISSUER = "https://token.actions.githubuserconte
  * Interface that all verification policies conform to.
  */
 export interface VerificationPolicy {
-    verify(cert: X509Certificate): void;
+    verify(cert: X509Certificate): void | Promise<void>;
 }
 /**
  * Base class for V1 extension policies (raw OCTET STRING value).
@@ -234,7 +234,7 @@ export declare class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV
 export declare class AnyOf implements VerificationPolicy {
     private children;
     constructor(children: VerificationPolicy[]);
-    verify(cert: X509Certificate): void;
+    verify(cert: X509Certificate): Promise<void>;
 }
 /**
  * The "all of" policy, corresponding to a logical AND between child policies.
@@ -243,7 +243,7 @@ export declare class AnyOf implements VerificationPolicy {
 export declare class AllOf implements VerificationPolicy {
     private children;
     constructor(children: VerificationPolicy[]);
-    verify(cert: X509Certificate): void;
+    verify(cert: X509Certificate): Promise<void>;
 }
 /**
  * Verifies the certificate's "identity", corresponding to the X.509v3 SAN.

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,eAAe,EAuBhB,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,kBAAkB,gDAAgD,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,uBAAe,qBAAsB,YAAW,kBAAkB;IAChE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,MAAM;IAIzB,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAE/E,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAcpC;AAED;;;GAGG;AACH,uBAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAMrE;;;GAGG;AACH,qBAAa,UAAW,SAAQ,qBAAqB;IACnD,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,2BAAyC;IACrD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,2BAAqC;IACjD,QAAQ,CAAC,IAAI,uBAAuB;IAEpC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,2BAAsC;IAClD,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,GAAG,2BAA4C;IACxD,QAAQ,CAAC,IAAI,8BAA8B;IAE3C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,2BAAqC;IACjD,QAAQ,CAAC,IAAI,uBAAuB;IAEpC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAMD;;;GAGG;AACH,qBAAa,YAAa,SAAQ,qBAAqB;IACrD,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,kBAAkB;IAE/B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAqC;IACjD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAoC;IAChD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,GAAG,4BAAuC;IACnD,QAAQ,CAAC,IAAI,6BAA6B;IAE1C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,qBAAqB;IACnE,QAAQ,CAAC,GAAG,4BAA0C;IACtD,QAAQ,CAAC,IAAI,gCAAgC;IAE7C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,GAAG,4BAAuC;IACnD,QAAQ,CAAC,IAAI,6BAA6B;IAE1C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,GAAG,4BAA8C;IAC1D,QAAQ,CAAC,IAAI,oCAAoC;IAEjD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,qBAAqB;IACrE,QAAQ,CAAC,GAAG,4BAA6C;IACzD,QAAQ,CAAC,IAAI,kCAAkC;IAE/C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,mCAAoC,SAAQ,qBAAqB;IAC5E,QAAQ,CAAC,GAAG,4BAAoD;IAChE,QAAQ,CAAC,IAAI,yCAAyC;IAEtD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,4BAAkC;IAC9C,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAqC;IACjD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAAqB;IACzD,QAAQ,CAAC,GAAG,4BAA+B;IAC3C,QAAQ,CAAC,IAAI,sBAAsB;IAEnC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,qBAAqB;IAC7D,QAAQ,CAAC,GAAG,4BAAoC;IAChD,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,GAAG,4BAA8C;IAC1D,QAAQ,CAAC,IAAI,oCAAoC;IAEjD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAMD;;;GAGG;AACH,qBAAa,KAAM,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE;IAI1C,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAWpC;AAED;;;GAGG;AACH,qBAAa,KAAM,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE;IAI1C,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAQpC;AAMD;;;;;;;GAOG;AACH,qBAAa,QAAS,YAAW,kBAAkB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAoB;gBAE5B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAK1D,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAkCpC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,eAAe,EAuBhB,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,kBAAkB,gDAAgD,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,uBAAe,qBAAsB,YAAW,kBAAkB;IAChE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,MAAM;IAIzB,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAE/E,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAcpC;AAED;;;GAGG;AACH,uBAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAMrE;;;GAGG;AACH,qBAAa,UAAW,SAAQ,qBAAqB;IACnD,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,2BAAyC;IACrD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,2BAAqC;IACjD,QAAQ,CAAC,IAAI,uBAAuB;IAEpC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,2BAAsC;IAClD,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,GAAG,2BAA4C;IACxD,QAAQ,CAAC,IAAI,8BAA8B;IAE3C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,2BAAqC;IACjD,QAAQ,CAAC,IAAI,uBAAuB;IAEpC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAMD;;;GAGG;AACH,qBAAa,YAAa,SAAQ,qBAAqB;IACrD,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,kBAAkB;IAE/B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAqC;IACjD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAoC;IAChD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,GAAG,4BAAuC;IACnD,QAAQ,CAAC,IAAI,6BAA6B;IAE1C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,qBAAqB;IACnE,QAAQ,CAAC,GAAG,4BAA0C;IACtD,QAAQ,CAAC,IAAI,gCAAgC;IAE7C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,GAAG,4BAAuC;IACnD,QAAQ,CAAC,IAAI,6BAA6B;IAE1C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,GAAG,4BAA8C;IAC1D,QAAQ,CAAC,IAAI,oCAAoC;IAEjD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,qBAAqB;IACrE,QAAQ,CAAC,GAAG,4BAA6C;IACzD,QAAQ,CAAC,IAAI,kCAAkC;IAE/C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,mCAAoC,SAAQ,qBAAqB;IAC5E,QAAQ,CAAC,GAAG,4BAAoD;IAChE,QAAQ,CAAC,IAAI,yCAAyC;IAEtD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,4BAAkC;IAC9C,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAqC;IACjD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAAqB;IACzD,QAAQ,CAAC,GAAG,4BAA+B;IAC3C,QAAQ,CAAC,IAAI,sBAAsB;IAEnC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,qBAAqB;IAC7D,QAAQ,CAAC,GAAG,4BAAoC;IAChD,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,GAAG,4BAA8C;IAC1D,QAAQ,CAAC,IAAI,oCAAoC;IAEjD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAMD;;;GAGG;AACH,qBAAa,KAAM,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE;IAIpC,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAWnD;AAED;;;GAGG;AACH,qBAAa,KAAM,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE;IAIpC,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAQnD;AAMD;;;;;;;GAOG;AACH,qBAAa,QAAS,YAAW,kBAAkB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAoB;gBAE5B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAK1D,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAkCpC"}

package/dist/policy.js

@@ -353,10 +353,10 @@ export class AnyOf {
     constructor(children) {
         this.children = children;
     }
-    verify(cert) {
+    async verify(cert) {
         for (const child of this.children) {
             try {
-                child.verify(cert);
+                await child.verify(cert);
                 return;
             }
             catch {
@@ -374,12 +374,12 @@ export class AllOf {
     constructor(children) {
         this.children = children;
     }
-    verify(cert) {
+    async verify(cert) {
         if (this.children.length < 1) {
             throw new PolicyError("no child policies to verify");
         }
         for (const child of this.children) {
-            child.verify(cert);
+            await child.verify(cert);
         }
     }
 }

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAKlC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAArD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,YAAY,CAAC;IAK/B,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,qCAAqC,CAAC;QAC5C,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,kCAAkC,CAAC;QACzC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IAAnE;;QACW,QAAG,GAAG,wCAAwC,CAAC;QAC/C,SAAI,GAAG,0BAA0B,CAAC;IAK7C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAAvD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,cAAc,CAAC;IAKjC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAArE;;QACW,QAAG,GAAG,sCAAsC,CAAC;QAC7C,SAAI,GAAG,4BAA4B,CAAC;IAK/C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAAvE;;QACW,QAAG,GAAG,yCAAyC,CAAC;QAChD,SAAI,GAAG,8BAA8B,CAAC;IAKjD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAA9E;;QACW,QAAG,GAAG,gDAAgD,CAAC;QACvD,SAAI,GAAG,qCAAqC,CAAC;IAKxD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAA3D;;QACW,QAAG,GAAG,2BAA2B,CAAC;QAClC,SAAI,GAAG,kBAAkB,CAAC;IAKrC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IAA/D;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,sBAAsB,CAAC;IAKzC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAInB,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAKlC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAArD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,YAAY,CAAC;IAK/B,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,qCAAqC,CAAC;QAC5C,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,kCAAkC,CAAC;QACzC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IAAnE;;QACW,QAAG,GAAG,wCAAwC,CAAC;QAC/C,SAAI,GAAG,0BAA0B,CAAC;IAK7C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAAvD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,cAAc,CAAC;IAKjC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAArE;;QACW,QAAG,GAAG,sCAAsC,CAAC;QAC7C,SAAI,GAAG,4BAA4B,CAAC;IAK/C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAAvE;;QACW,QAAG,GAAG,yCAAyC,CAAC;QAChD,SAAI,GAAG,8BAA8B,CAAC;IAKjD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAA9E;;QACW,QAAG,GAAG,gDAAgD,CAAC;QACvD,SAAI,GAAG,qCAAqC,CAAC;IAKxD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAA3D;;QACW,QAAG,GAAG,2BAA2B,CAAC;QAClC,SAAI,GAAG,kBAAkB,CAAC;IAKrC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IAA/D;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,sBAAsB,CAAC;IAKzC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAInB,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/sigstore.d.ts

@@ -1,6 +1,6 @@
 import { X509Certificate } from "./x509/index.js";
 import { SigstoreBundle } from "./bundle.js";
-import { CertAuthority, CTLog, RawCAs, RawLogs, RawTimestampAuthorities, RekorKeyInfo, TrustedRoot } from "./interfaces.js";
+import { CertAuthority, CTLog, RawCAs, RawLogs, RekorKeyInfo, TrustedRoot } from "./interfaces.js";
 import { TrustedRootProvider } from "./trust/tuf.js";
 import type { VerificationPolicy } from "./policy.js";
 export interface SigstoreVerifierOptions {
@@ -13,11 +13,10 @@ export declare class SigstoreVerifier {
     private rawRoot;
     private options;
     constructor(options?: SigstoreVerifierOptions);
-    loadLog(frozenTimestamp: Date, logs: RawLogs): Promise<RekorKeyInfo | undefined>;
-    loadCTLogs(frozenTimestamp: Date, ctlogs: RawLogs): Promise<CTLog[]>;
+    loadLog(logs: RawLogs): Promise<RekorKeyInfo[]>;
+    loadCTLogs(ctlogs: RawLogs): Promise<CTLog[]>;
     verifyCertificateChain(timestamp: Date, leaf: X509Certificate, certificateAuthorities: CertAuthority[]): Promise<X509Certificate[]>;
-    loadTSA(frozenTimestamp: Date, tsas?: RawTimestampAuthorities): CertAuthority[];
-    loadCA(frozenTimestamp: Date, cas: RawCAs): CertAuthority[];
+    loadCA(cas: RawCAs): CertAuthority[];
     loadSigstoreRoot(rawRoot: TrustedRoot): Promise<void>;
     /**
      * Load Sigstore trusted root via TUF
@@ -26,9 +25,10 @@ export declare class SigstoreVerifier {
      * @param tufProvider Optional TrustedRootProvider instance. If not provided, uses default Sigstore TUF repository
      */
     loadSigstoreRootWithTUF(tufProvider?: TrustedRootProvider): Promise<void>;
-    verifySCT(cert: X509Certificate, issuer: X509Certificate, ctlogs: CTLog[]): Promise<Uint8Array[]>;
-    verifyInclusionPromise(cert: X509Certificate, bundle: SigstoreBundle, rekor: RekorKeyInfo | undefined): Promise<boolean>;
-    verifyInclusionProof(bundle: SigstoreBundle): Promise<void>;
+    verifySCT(cert: X509Certificate, issuer: X509Certificate, ctlogs: CTLog[]): Promise<Set<string>>;
+    private verifySET;
+    private verifyTlogEntries;
+    private verifyBundle;
     verifyArtifactPolicy(policy: VerificationPolicy, bundle: SigstoreBundle, data: Uint8Array, isDigestOnly?: boolean): Promise<boolean>;
     verifyArtifact(identity: string, issuer: string, bundle: SigstoreBundle, data: Uint8Array, isDigestOnly?: boolean): Promise<boolean>;
     /**

package/dist/sigstore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sigstore.d.ts","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EACL,aAAa,EACb,KAAK,EACL,MAAM,EACN,OAAO,EACP,uBAAuB,EACvB,YAAY,EAGZ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAkCtD,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAoC;gBAEvC,OAAO,GAAE,uBAA4B;IAU3C,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA4BhF,UAAU,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAuCpE,sBAAsB,CAC1B,SAAS,EAAE,IAAI,EACf,IAAI,EAAE,eAAe,EACrB,sBAAsB,EAAE,aAAa,EAAE,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B7B,OAAO,CACL,eAAe,EAAE,IAAI,EACrB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,aAAa,EAAE;IAiClB,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE;IAwBrD,gBAAgB,CAAC,OAAO,EAAE,WAAW;IAe3C;;;;;OAKG;IACG,uBAAuB,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,SAAS,CACb,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,UAAU,EAAE,CAAC;IAkGlB,sBAAsB,CAC1B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,YAAY,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC;IA4Lb,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBpD,oBAAoB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;IAmKR,cAAc,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;IAoBjB;;;;;;;;;;;;;;OAcG;IACU,UAAU,CACrB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC;CAkGzD"}
+{"version":3,"file":"sigstore.d.ts","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAgB,cAAc,EAAa,MAAM,aAAa,CAAC;AAEtE,OAAO,EACL,aAAa,EACb,KAAK,EAEL,MAAM,EACN,OAAO,EACP,YAAY,EAGZ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA0CtD,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAoC;gBAEvC,OAAO,GAAE,uBAA4B;IAgB3C,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAkB/C,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAwB7C,sBAAsB,CAC1B,SAAS,EAAE,IAAI,EACf,IAAI,EAAE,eAAe,EACrB,sBAAsB,EAAE,aAAa,EAAE,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC;IAyB7B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE;IAW9B,gBAAgB,CAAC,OAAO,EAAE,WAAW;IAa3C;;;;;OAKG;IACG,uBAAuB,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,SAAS,CACb,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAmGT,SAAS;YAsBT,iBAAiB;YA2CjB,YAAY;IAoDb,oBAAoB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;IAwFR,cAAc,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;IAoBjB;;;;;;;;;;;;;;OAcG;IACU,UAAU,CACrB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC;CA6BzD"}