@freedomofpress/sigstore-browser 0.1.14 → 0.1.16

package/dist/sigstore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sigstore.js","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAQL,aAAa,GAEd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D;;;GAGG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;QACf,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;QACf,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,eAAe,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,SAAS;aACtB,OAAO,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;aACnC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,6DAA6D;QAC7D,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAA0D;IAE1D,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAQD,MAAM,OAAO,gBAAgB;IAK3B,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,eAAqB,EAAE,IAAa;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,4DAA4D;QAE5D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,sFAAsF;YACtF,IACE,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;oBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,EACzD,CAAC;gBACD,OAAO;oBACL,SAAS,EAAE,MAAM,SAAS,CACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB;oBACD,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC3C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6CAA6C;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,eAAqB,EAAE,MAAe;QACrD,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC;YAE5D,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC1C,SAAS;oBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gHAAgH;IAChH,iGAAiG;IACjG,gCAAgC;IAChC,sFAAsF;IACtF,wFAAwF;IACxF,8DAA8D;IAC9D,KAAK,CAAC,sBAAsB,CAC1B,SAAe,EACf,IAAqB,EACrB,sBAAuC;QAEvC,IAAI,SAAc,CAAC;QAEnB,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;YACxC,oDAAoD;YACpD,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;oBAC5C,YAAY,EAAE,EAAE,CAAC,SAAS;oBAC1B,aAAa,EAAE,IAAI;oBACnB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,qEAAqE;IACrE,qGAAqG;IACrG,0GAA0G;IAC1G,OAAO,CACL,eAAqB,EACrB,IAA8B;QAE9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAEvF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oFAAoF;IACpF,mFAAmF;IACnF,2FAA2F;IAC3F,wFAAwF;IACxF,+DAA+D;IAC/D,MAAM,CAAC,eAAqB,EAAE,GAAW;QACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAErF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACrD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QACzC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7E,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,eAAe,EACf,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAC9C;YACD,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,oBAAoB,CAAC;SAClF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAiC;QAC7D,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,gGAAgG;IAChG,mBAAmB;IACnB,oDAAoD;IACpD,gGAAgG;IAChG,6FAA6F;IAC7F,KAAK,CAAC,SAAS,CACb,IAAqB,EACrB,MAAuB,EACvB,MAAe;QAEf,IAAI,MAAoC,CAAC;QAEzC,kEAAkE;QAClE,uEAAuE;QACvE,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAEnC,4CAA4C;gBAC5C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,gEAAgE;QAChE,IAAI,MAAM,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,kCAAkC;QAClC,qDAAqD;QACrD,MAAM,OAAO,GAAG,IAAI,UAAU,EAAE,CAAC;QAEjC,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAyB,CAAC,CACpF,CAAC;QACF,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7B,qEAAqE;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAExB,6DAA6D;QAC7D,iFAAiF;QACjF,+DAA+D;QAC/D,MAAM,YAAY,GAAiB,EAAE,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,mFAAmF;YACnF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,yBAAyB;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzD,kEAAkE;gBAClE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChF,CAAC,CAAC,CAAC;YAEH,iDAAiD;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;gBACjC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BACpD,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,6BAA6B;oBAC/B,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,EAAE,CAAC;YAEL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAAqB,EACrB,MAAsB,EACtB,KAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAExD,8DAA8D;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,gBAAgB,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,MAAM,MAAM,gBAAgB,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,cAAc,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAEzB,wCAAwC;QACxC,8FAA8F;QAC9F,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QAEtD,2CAA2C;QAC3C,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;YAClD,oEAAoE;YACpE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,+DAA+D;YAC/D,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACnC,0DAA0D;gBAC1D,6CAA6C;YAC/C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,CAAC;gBAED,uEAAuE;gBACvE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,sCAAsC,eAAe,CAAC,UAAU,CAAC,0BAA0B,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC1H,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,CAAC,oBAAoB,CAC5C,CAAC;gBAEF,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAEpD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,YAAY,CAAC;oBACX,IAAI,EAAE,KAAK,CAAC,iBAAiB;oBAC7B,cAAc,EAAE,cAAc;oBAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChC,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,sEAAsE;QACtE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,wEAAwE;YACxE,sBAAsB,CACpB,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,CACtD,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAE7F,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,iBAAqC,CAAC;YAE1C,kDAAkD;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACnE,IAAI,QAAQ,EAAE,eAAe,EAAE,CAAC;oBAC9B,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,yCAAyC;iBACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC5C,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;YAChE,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,mEAAmE;gBACnE,uEAAuE;gBACvE,IAAI,UAA2B,CAAC;gBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACnC,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAC5E,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpC,kFAAkF;YAClF,gFAAgF;YAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YAChE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,sGAAsG;YACtG,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;YACrF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC3E,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,6EAA6E;YAC7E,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,iEAAiE;QACjE,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,kEAAkE;YAClE,kFAAkF;YAClF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAEnC,IAAI,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;oBACpC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,MAA0B,EAC1B,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAE7B,8EAA8E;QAE9E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW;YAClD,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE7E,iFAAiF;QACjF,IAAI,SAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,kDAAkD;QAClD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE3B,wDAAwD;QACxD,iFAAiF;QACjF,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,WAAW,CAAC,SAAS,EACrB,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACjC,CAAC;QAEF,iGAAiG;QACjG,6EAA6E;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,CAAC,MAAM,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAExC,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,iCAAiC;QACjC,8CAA8C;QAC9C,yGAAyG;QACzG,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CACpD,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EACrD,SAAS,EACT,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CACzC,CAAC;QAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,uCAAuC,kBAAkB,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,oFAAoF;QACpF,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAEhE,6BAA6B;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,sDAAsD;YACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YAE7D,wEAAwE;YACxE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YAED,yCAAyC;YACzC,IAAI,cAAsB,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,mCAAmC;gBACnC,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,+CAA+C;gBAC/C,cAAc,GAAG,eAAe,CAC9B,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC,CACxF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,cAAc,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,aAAa,IAAI,cAAc,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpE,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,cAAc,6CAA6C,CAC/E,CAAC;YACJ,CAAC;YAED,sEAAsE;YACtE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YAEjD,IAAI,YAAY,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,kBAAkB,IAAI,CAAC,MAAM,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEI,KAAK,CAAC,cAAc,CACzB,QAAgB,EAChB,MAAc,EACd,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAG7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC;YACvB,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC;gBACR,IAAI,YAAY,CAAC,MAAM,CAAC;gBACxB,IAAI,UAAU,CAAC,MAAM,CAAC;aACvB,CAAC;SACH,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,oBAAoB,CAC9B,MAAM,EACN,MAAM,EACN,IAAI,EACJ,YAAY,CACb,CAAC;IACJ,CAAC;IAIC;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,UAAU,CACrB,MAAsB,EACtB,MAA0B;QAE1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW;YAClD,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE7E,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,WAAW,CAAC,SAAS,EACrB,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACjC,CAAC;QAEF,kBAAkB;QAClB,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,CAAC,MAAM,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE3B,qCAAqC;QACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,8DAA8D;QAC9D,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAExC,qFAAqF;QACrF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5E,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CACpD,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EACrD,SAAS,EACT,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CACzC,CAAC;QAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,uCAAuC,kBAAkB,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;gBACrE,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,sBAAsB,CACpB,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,kFAAkF;QAClF,yDAAyD;QACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,8BAA8B;QAC9B,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YAC5C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sigstore.js","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,YAAY,EAA6B,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAGL,mBAAmB,EAKnB,aAAa,GAEd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAC9D,sEAAsE;AACtE,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,2FAA2F;AAC3F,SAAS,cAAc,CAAC,SAAsB;IAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;QACf,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;QACf,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,eAAe,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,SAAS;aACtB,OAAO,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;aACnC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,2DAA2D;QAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;AACjE,CAAC;AAQD,MAAM,OAAO,gBAAgB;IAK3B,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACxC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2GAA2G;IAC3G,KAAK,CAAC,OAAO,CAAC,IAAa;QACzB,OAAO,OAAO,CAAC,GAAG,CAChB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,SAAS,EAAE,MAAM,SAAS,CACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB;YACD,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1C,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,iFAAiF;YACjF,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;SACtD,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,MAAe;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1C,SAAS,EAAE,MAAM,SAAS,CACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB;YACD,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;SACtD,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,gHAAgH;IAChH,iGAAiG;IACjG,gCAAgC;IAChC,sFAAsF;IACtF,wFAAwF;IACxF,8DAA8D;IAC9D,KAAK,CAAC,sBAAsB,CAC1B,SAAe,EACf,IAAqB,EACrB,sBAAuC;QAEvC,IAAI,SAAkB,CAAC;QAEvB,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;YACxC,oDAAoD;YACpD,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;oBAC5C,YAAY,EAAE,EAAE,CAAC,SAAS;oBAC1B,aAAa,EAAE,IAAI;oBACnB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAClI,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,GAAW;QAChB,OAAO,GAAG;aACP,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACZ,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD;YACD,QAAQ,EAAE,mBAAmB,CAAC,EAAE,CAAC,QAAQ,CAAC;SAC3C,CAAC,CAAC,CAAC;IACR,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QACzC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAClD,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CACxC,CAAC;QACF,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC5D,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;SACnF,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAiC;QAC7D,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,gGAAgG;IAChG,mBAAmB;IACnB,oDAAoD;IACpD,gGAAgG;IAChG,2FAA2F;IAC3F,KAAK,CAAC,SAAS,CACb,IAAqB,EACrB,MAAuB,EACvB,MAAe;QAEf,IAAI,MAAoC,CAAC;QAEzC,kEAAkE;QAClE,uEAAuE;QACvE,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAEnC,4CAA4C;gBAC5C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,gEAAgE;QAChE,IAAI,MAAM,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,kCAAkC;QAClC,qDAAqD;QACrD,MAAM,OAAO,GAAG,IAAI,UAAU,EAAE,CAAC;QAEjC,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAyB,CAAC,CACpF,CAAC;QACF,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7B,qEAAqE;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAExB,6DAA6D;QAC7D,iFAAiF;QACjF,+DAA+D;QAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,mFAAmF;YACnF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,yBAAyB;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzD,kEAAkE;gBAClE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChF,CAAC,CAAC,CAAC;YAEH,iDAAiD;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;gBACjC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BACpD,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,6BAA6B;oBAC/B,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,EAAE,CAAC;YAEL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,SAAS,CAAC,KAAgB,EAAE,OAAe,EAAE,GAAiB;QAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QACvD,IAAI,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,eAAe,CAAC;YACd,IAAI,EAAE,KAAK,CAAC,iBAAiB;YAC7B,cAAc;YACd,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAChC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;SAClC,CAAC,CACH,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,4FAA4F;IAC5F,oGAAoG;IAC5F,KAAK,CAAC,iBAAiB,CAC7B,IAAqB,EACrB,MAAsB,EACtB,KAAqB;QAErB,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC;QACxD,4DAA4D;QAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,eAAe,GAAW,EAAE,CAAC;QAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,eAAe,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC9F,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1C,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,iBAAiB,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,2FAA2F;IAC3F,8DAA8D;IACtD,KAAK,CAAC,YAAY,CACxB,MAAsB,EACtB,MAA0B;QAE1B,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW;YAClD,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,kBAAkB,CAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CACpG,CAAC;QAEF,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEjC,6FAA6F;QAC7F,iGAAiG;QACjG,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAC5C,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EACrD,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CACxC,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,YAAY,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,aAAa,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACpF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,2GAA2G;QAC3G,IAAI,QAAQ,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpG,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,WAAW,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,MAA0B,EAC1B,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAE7B,IAAI,YAAY,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE3E,gEAAgE;QAEhE,6BAA6B;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,uFAAuF;YACvF,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,8BAA8B,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YAE7D,wEAAwE;YACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;gBAC9G,MAAM,IAAI,KAAK,CAAC,wCAAwC,YAAY,WAAW,CAAC,CAAC;YACnF,CAAC;YACD,yCAAyC;YACzC,IAAI,cAAsB,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,mCAAmC;gBACnC,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,+CAA+C;gBAC/C,cAAc,GAAG,eAAe,CAC9B,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC,CACxF,CAAC;YACJ,CAAC;YAED,yFAAyF;YACzF,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,OAAO,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;oBAC3H,MAAM,IAAI,KAAK,CAAC,4CAA4C,mBAAmB,WAAW,CAAC,CAAC;gBAC9F,CAAC;gBACD,cAAc,KAAd,cAAc,GAAK,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAC;YAC3G,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,cAAc,6CAA6C,CAC/E,CAAC;YACJ,CAAC;YAED,sEAAsE;YACtE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iFAAiF;YACjF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAClD,MAAM,MAAM,GAAG,YAAY;gBACzB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC,CAAC;YAC5F,IAAI,aAAa,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACjH,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YAEjD,IAAI,YAAY,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,kBAAkB,IAAI,CAAC,MAAM,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEI,KAAK,CAAC,cAAc,CACzB,QAAgB,EAChB,MAAc,EACd,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAG7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC;YACvB,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC;gBACR,IAAI,YAAY,CAAC,MAAM,CAAC;gBACxB,IAAI,UAAU,CAAC,MAAM,CAAC;aACvB,CAAC;SACH,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,oBAAoB,CAC9B,MAAM,EACN,MAAM,EACN,IAAI,EACJ,YAAY,CACb,CAAC;IACJ,CAAC;IAIC;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,UAAU,CACrB,MAAsB,EACtB,MAA0B;QAE1B,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,+DAA+D;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;YAC5C,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;CACF","sourcesContent":["import {\n  base64ToUint8Array,\n  ByteStream,\n  canonicalizeJCS,\n  importKey,\n  stringToUint8Array,\n  uint8ArrayEqual,\n  Uint8ArrayToHex,\n  Uint8ArrayToString,\n  verifySignature,\n  verifySignatureOverDigest,\n} from \"@freedomofpress/crypto-browser\";\n\nimport { assertBundle, SigstoreBundle, TLogEntry } from \"./bundle.js\";\nimport { preAuthEncoding } from \"./dsse.js\";\nimport { HashAlgorithms } from \"./interfaces.js\";\nimport {\n  CertAuthority,\n  CTLog,\n  parseValidityPeriod,\n  RawCAs,\n  RawLogs,\n  RekorKeyInfo,\n  Sigstore,\n  SigstoreRoots,\n  TrustedRoot,\n} from \"./interfaces.js\";\nimport type { VerificationPolicy } from \"./policy.js\";\nimport { AllOf, AnyOf, Identity, OIDCIssuer, OIDCIssuerV2 } from \"./policy.js\";\nimport { verifyBundleTimestamp } from \"./timestamp/tsa.js\";\nimport { verifyTLogBody } from \"./tlog/body.js\";\nimport { verifyCheckpoint } from \"./tlog/checkpoint.js\";\nimport { verifyMerkleInclusion } from \"./tlog/merkle.js\";\nimport { TrustedRootProvider } from \"./trust/tuf.js\";\nimport {\n  CertificateChainVerifier,\n  EXTENSION_OID_SCT,\n  X509Certificate,\n  X509SCTExtension,\n} from \"./x509/index.js\";\n\nconst MEDIA_TYPE_BASE = \"application/vnd.dev.sigstore.bundle\";\n// Upper bounds on in-toto subjects and digests, matching sigstore-go.\nconst MAX_SUBJECTS = 1024;\nconst MAX_SUBJECT_DIGESTS = 32;\n\n// Unknown operators can satisfy threshold one, but add no independence to named operators.\nfunction countOperators(operators: Set<string>): number {\n  if (operators.size === 0) return 0;\n  return Math.max(1, operators.size - (operators.has(\"\") ? 1 : 0));\n}\n\n/**\n * Extract bundle version from mediaType string\n * Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177\n */\nfunction getBundleVersion(mediaType: string): string {\n  switch (mediaType) {\n    case `${MEDIA_TYPE_BASE}+json;version=0.1`:\n      return \"0.1\";\n    case `${MEDIA_TYPE_BASE}+json;version=0.2`:\n      return \"0.2\";\n    case `${MEDIA_TYPE_BASE}+json;version=0.3`:\n      return \"0.3\";\n  }\n\n  // New format: \"application/vnd.dev.sigstore.bundle.v0.3+json\"\n  if (mediaType.startsWith(`${MEDIA_TYPE_BASE}.v`) && mediaType.endsWith(\"+json\")) {\n    const version = mediaType\n      .replace(`${MEDIA_TYPE_BASE}.v`, \"\")\n      .replace(\"+json\", \"\");\n    // Only the versions this verifier implements are accepted.\n    if (/^0\\.[123]$/.test(version)) {\n      return version;\n    }\n  }\n\n  throw new Error(`Unsupported bundle media type: ${mediaType}`);\n}\n\nexport interface SigstoreVerifierOptions {\n  tlogThreshold?: number;\n  ctlogThreshold?: number;\n  tsaThreshold?: number;\n}\n\nexport class SigstoreVerifier {\n  private root: Sigstore | undefined;\n  private rawRoot: TrustedRoot | undefined;\n  private options: Required<SigstoreVerifierOptions>;\n\n  constructor(options: SigstoreVerifierOptions = {}) {\n    this.root = undefined;\n    this.rawRoot = undefined;\n    this.options = {\n      tlogThreshold: options.tlogThreshold ?? 1,\n      ctlogThreshold: options.ctlogThreshold ?? 1,\n      tsaThreshold: options.tsaThreshold ?? 0,\n    };\n    for (const [name, threshold] of Object.entries(this.options)) {\n      if (!Number.isSafeInteger(threshold) || threshold < 0) {\n        throw new Error(`${name} must be a non-negative safe integer`);\n      }\n    }\n  }\n\n  // Loads every Rekor key; entries select theirs by log ID and SETs are checked against its validity window.\n  async loadLog(logs: RawLogs): Promise<RekorKeyInfo[]> {\n    return Promise.all(\n      logs.map(async (log) => ({\n        publicKey: await importKey(\n          log.publicKey.keyDetails,\n          log.publicKey.keyDetails,\n          log.publicKey.rawBytes,\n        ),\n        logId: base64ToUint8Array(log.logId.keyId),\n        hashAlgorithm: log.hashAlgorithm,\n        // Empty means unknown; countOperators never adds it to the named operator count.\n        operator: log.operator || \"\",\n        validFor: parseValidityPeriod(log.publicKey.validFor),\n      })),\n    );\n  }\n\n  // Loads every CT log; SCTs select their log by ID and are checked against its validity window.\n  async loadCTLogs(ctlogs: RawLogs): Promise<CTLog[]> {\n    if (ctlogs.length === 0) {\n      throw new Error(\"Could not find any CT logs in sigstore root.\");\n    }\n    return Promise.all(\n      ctlogs.map(async (log) => ({\n        logID: base64ToUint8Array(log.logId.keyId),\n        publicKey: await importKey(\n          log.publicKey.keyDetails,\n          log.publicKey.keyDetails,\n          log.publicKey.rawBytes,\n        ),\n        operator: log.operator || \"\",\n        validFor: parseValidityPeriod(log.publicKey.validFor),\n      })),\n    );\n  }\n\n  // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts#L22-L53\n  // Verifies that the leaf certificate chains to a trusted CA and is valid at the given timestamp.\n  // Differences from sigstore-js:\n  // - This is async (uses await) because our CertificateChainVerifier.verify() is async\n  // - sigstore-js filters CAs using filterCertAuthorities() before calling this function,\n  //   we do the timestamp filtering inline within this function\n  async verifyCertificateChain(\n    timestamp: Date,\n    leaf: X509Certificate,\n    certificateAuthorities: CertAuthority[]\n  ): Promise<X509Certificate[]> {\n    let lastError: unknown;\n\n    for (const ca of certificateAuthorities) {\n      // Check if this CA is valid for the given timestamp\n      if (timestamp < ca.validFor.start || timestamp > ca.validFor.end) {\n        continue;\n      }\n\n      try {\n        const verifier = new CertificateChainVerifier({\n          trustedCerts: ca.certChain,\n          untrustedCert: leaf,\n          timestamp,\n        });\n        return await verifier.verify();\n      } catch (err) {\n        lastError = err;\n      }\n    }\n\n    throw new Error(`Failed to verify certificate chain: ${lastError instanceof Error ? lastError.message : 'No valid CAs found'}`);\n  }\n\n  // Loads every Fulcio CA; verifyCertificateChain() selects CAs by the observer timestamp.\n  loadCA(cas: RawCAs): CertAuthority[] {\n    return cas\n      .filter((ca) => ca.certChain.certificates.length > 0)\n      .map((ca) => ({\n        certChain: ca.certChain.certificates.map((cert) =>\n          X509Certificate.parse(base64ToUint8Array(cert.rawBytes)),\n        ),\n        validFor: parseValidityPeriod(ca.validFor),\n      }));\n  }\n\n  async loadSigstoreRoot(rawRoot: TrustedRoot) {\n    rawRoot.timestampAuthorities?.forEach((authority) =>\n      parseValidityPeriod(authority.validFor),\n    );\n    const root = {\n      rekor: await this.loadLog(rawRoot[SigstoreRoots.tlogs]),\n      ctlogs: await this.loadCTLogs(rawRoot[SigstoreRoots.ctlogs]),\n      certificateAuthorities: this.loadCA(rawRoot[SigstoreRoots.certificateAuthorities]),\n    };\n    this.rawRoot = rawRoot;\n    this.root = root;\n  }\n\n  /**\n   * Load Sigstore trusted root via TUF\n   * Uses The Update Framework for secure, verified updates of trusted root metadata\n   *\n   * @param tufProvider Optional TrustedRootProvider instance. If not provided, uses default Sigstore TUF repository\n   */\n  async loadSigstoreRootWithTUF(tufProvider?: TrustedRootProvider): Promise<void> {\n    const provider = tufProvider || new TrustedRootProvider();\n    const trustedRoot = await provider.getTrustedRoot();\n    await this.loadSigstoreRoot(trustedRoot);\n  }\n\n  // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/sct.ts\n  // Key differences:\n  // - Adds duplicate SCT detection (not in reference)\n  // - Inline CT log filtering by logID and validity period (reference uses filterTLogAuthorities)\n  // - Returns the distinct operators of the logs whose SCTs verified, for threshold checking\n  async verifySCT(\n    cert: X509Certificate,\n    issuer: X509Certificate,\n    ctlogs: CTLog[],\n  ): Promise<Set<string>> {\n    let extSCT: X509SCTExtension | undefined;\n\n    // Verifying the SCT requires that we remove the SCT extension and\n    // re-encode the TBS structure to DER -- this value is part of the data\n    // over which the signature is calculated. Since this is a destructive action\n    // we create a copy of the certificate so we can remove the SCT extension\n    // without affecting the original certificate.\n    const clone = cert.clone();\n\n    // Intentionally not using the findExtension method here because we want to\n    // remove the the SCT extension from the certificate before calculating the\n    // PreCert structure\n    for (let i = 0; i < clone.extensions.length; i++) {\n      const ext = clone.extensions[i];\n\n      if (ext.subs[0].toOID() === EXTENSION_OID_SCT) {\n        extSCT = new X509SCTExtension(ext);\n\n        // Remove the extension from the certificate\n        clone.extensions.splice(i, 1);\n        break;\n      }\n    }\n\n    // No SCT extension found - fail verification\n    if (!extSCT) {\n      throw new Error(\"Certificate is missing required SCT extension\");\n    }\n\n    // Found an SCT extension but it has no SCTs - fail verification\n    if (extSCT.signedCertificateTimestamps.length === 0) {\n      throw new Error(\"SCT extension is present but contains no SCTs\");\n    }\n\n    // Check for duplicate SCTs (same log ID)\n    const seenLogIds = new Set<string>();\n    for (const sct of extSCT.signedCertificateTimestamps) {\n      const logIdHex = Uint8ArrayToHex(sct.logID);\n      if (seenLogIds.has(logIdHex)) {\n        throw new Error(`Duplicate SCT found for log ID: ${logIdHex}`);\n      }\n      seenLogIds.add(logIdHex);\n    }\n\n    // Construct the PreCert structure\n    // https://www.rfc-editor.org/rfc/rfc6962#section-3.2\n    const preCert = new ByteStream();\n\n    // Calculate hash of the issuer's public key\n    const issuerId = new Uint8Array(\n      await crypto.subtle.digest(HashAlgorithms.SHA256, issuer.publicKey as BufferSource),\n    );\n    preCert.appendView(issuerId);\n\n    // Re-encodes the certificate to DER after removing the SCT extension\n    const tbs = clone.tbsCertificate.toDER();\n    preCert.appendUint24(tbs.length);\n    preCert.appendView(tbs);\n\n    // Calculate and return the verification results for each SCT\n    // Unlike sigstore-go which counts verified SCTs and checks threshold at the end,\n    // sigstore-js throws immediately if any SCT fails verification\n    const operators = new Set<string>();\n\n    for (const sct of extSCT.signedCertificateTimestamps) {\n      // Find the CT log that matches this SCT's log ID and is valid for the SCT datetime\n      const validCTLogs = ctlogs.filter((log) => {\n        // Check if log IDs match\n        if (!uint8ArrayEqual(log.logID, sct.logID)) return false;\n        // Check that the SCT datetime is within the log's validity period\n        return log.validFor.start <= sct.datetime && sct.datetime <= log.validFor.end;\n      });\n\n      // See if the SCT is valid for any of the CT logs\n      const verified = await (async () => {\n        for (const log of validCTLogs) {\n          try {\n            if (await sct.verify(preCert.buffer, log.publicKey)) {\n              return log;\n            }\n          } catch {\n            // Continue trying other logs\n          }\n        }\n        return undefined;\n      })();\n\n      if (!verified) {\n        throw new Error(\"SCT verification failed\");\n      }\n\n      operators.add(verified.operator);\n    }\n\n    return operators;\n  }\n\n  // Verifies the signed entry timestamp and returns the integrated time it binds.\n  private async verifySET(entry: TLogEntry, promise: string, log: RekorKeyInfo): Promise<Date> {\n    const integratedTime = Number(entry.integratedTime);\n    const integratedDate = new Date(integratedTime * 1000);\n    if (integratedDate < log.validFor.start || integratedDate > log.validFor.end) {\n      throw new Error(\"Rekor key was not valid at the integrated time.\");\n    }\n    const signed = stringToUint8Array(\n      canonicalizeJCS({\n        body: entry.canonicalizedBody,\n        integratedTime,\n        logIndex: Number(entry.logIndex),\n        logID: Uint8ArrayToHex(log.logId),\n      }),\n    );\n    if (!(await verifySignature(log.publicKey, signed, base64ToUint8Array(promise), log.hashAlgorithm))) {\n      throw new Error(\"Failed to verify the inclusion promise in the provided bundle.\");\n    }\n    return integratedDate;\n  }\n\n  // Fully verifies every entry from a trusted log and returns the SET-bound integrated times.\n  // Entries from unknown logs are ignored; the threshold counts distinct log operators that verified.\n  private async verifyTlogEntries(\n    cert: X509Certificate,\n    bundle: SigstoreBundle,\n    rekor: RekorKeyInfo[],\n  ): Promise<Date[]> {\n    const entries = bundle.verificationMaterial.tlogEntries;\n    // Only v0.1 bundles may rely on an inclusion promise alone.\n    const requireProof = getBundleVersion(bundle.mediaType) !== \"0.1\";\n    const operators = new Set<string>();\n    const integratedTimes: Date[] = [];\n\n    for (const entry of entries) {\n      const logId = base64ToUint8Array(entry.logId.keyId);\n      const log = rekor.find((l) => uint8ArrayEqual(l.logId, logId));\n      if (!log) continue;\n\n      const promise = entry.inclusionPromise?.signedEntryTimestamp;\n      if (!entry.inclusionProof && (requireProof || !promise)) {\n        throw new Error(\"Transparency log entry requires an inclusion proof.\");\n      }\n      if (promise) {\n        integratedTimes.push(await this.verifySET(entry, promise, log));\n      }\n      if (entry.inclusionProof) {\n        await verifyMerkleInclusion(entry);\n        await verifyCheckpoint(entry, log);\n      }\n      if (entry.integratedTime && !cert.validForDate(new Date(Number(entry.integratedTime) * 1000))) {\n        throw new Error(\"Artifact signing was logged outside of the certificate validity.\");\n      }\n      await verifyTLogBody(entry, bundle, cert);\n      operators.add(log.operator);\n    }\n\n    const verifiedOperators = countOperators(operators);\n    if (verifiedOperators < this.options.tlogThreshold) {\n      throw new Error(`Not enough verified transparency logs: ${verifiedOperators} < ${this.options.tlogThreshold}`);\n    }\n    return integratedTimes;\n  }\n\n  // Shared checks: policy, transparency log, timestamps, chain at every observer time, SCTs.\n  // Returns the signing certificate and the bundle's signature.\n  private async verifyBundle(\n    bundle: SigstoreBundle,\n    policy: VerificationPolicy,\n  ): Promise<{ signingCert: X509Certificate; signature: Uint8Array }> {\n    assertBundle(bundle);\n    if (!this.root || !this.rawRoot) {\n      throw new Error(\"Sigstore root is undefined\");\n    }\n\n    const cert = bundle.verificationMaterial.certificate ||\n      bundle.verificationMaterial.x509CertificateChain?.certificates[0];\n    if (!cert) {\n      throw new Error(\"No certificate found in bundle\");\n    }\n    const signingCert = X509Certificate.parse(base64ToUint8Array(cert.rawBytes));\n    const signature = base64ToUint8Array(\n      bundle.messageSignature ? bundle.messageSignature.signature : bundle.dsseEnvelope.signatures[0].sig,\n    );\n\n    await policy.verify(signingCert);\n\n    // Observer timestamps come from SET-bound integrated times and verified RFC 3161 timestamps.\n    // Rekor v2 entries carry no integrated time, so they need a TSA timestamp to be anchored at all.\n    const integratedTimes = await this.verifyTlogEntries(signingCert, bundle, this.root.rekor);\n    const timestamps = await verifyBundleTimestamp(\n      bundle.verificationMaterial.timestampVerificationData,\n      signature,\n      this.rawRoot.timestampAuthorities || [],\n    );\n    const tsaOperators = countOperators(new Set(timestamps.map((t) => t.operator)));\n    if (tsaOperators < this.options.tsaThreshold) {\n      throw new Error(`Not enough verified TSA operators: ${tsaOperators} < ${this.options.tsaThreshold}`);\n    }\n    const observerTimes = [...integratedTimes, ...timestamps.map((t) => t.signingTime)];\n    if (observerTimes.length === 0) {\n      throw new Error(\"No verified observer timestamp anchors the signature in time.\");\n    }\n\n    // The CA window and the whole chain are checked at every observer time, never at the leaf's own notBefore.\n    let certPath: X509Certificate[] = [];\n    for (const ts of observerTimes) {\n      certPath = await this.verifyCertificateChain(ts, signingCert, this.root.certificateAuthorities);\n    }\n    const issuerCert = certPath.length > 1 ? certPath[1] : certPath[0];\n    const ctOperators = countOperators(await this.verifySCT(signingCert, issuerCert, this.root.ctlogs));\n    if (ctOperators < this.options.ctlogThreshold) {\n      throw new Error(`Not enough verified CT log operators: ${ctOperators} < ${this.options.ctlogThreshold}`);\n    }\n\n    return { signingCert, signature };\n  }\n\n  public async verifyArtifactPolicy(\n    policy: VerificationPolicy,\n    bundle: SigstoreBundle,\n    data: Uint8Array,\n    isDigestOnly: boolean = false,\n  ): Promise<boolean> {\n    if (isDigestOnly && data.byteLength !== 32) {\n      throw new Error(\"SHA-256 digest must be exactly 32 bytes\");\n    }\n    const { signingCert, signature } = await this.verifyBundle(bundle, policy);\n\n    // # 7 Revocation *skipping* not really a thing (unsurprisingly)\n\n    // # 8 verify the signed data\n    if (bundle.dsseEnvelope) {\n      // Only in-toto statements are understood; other payload types must not be read as one.\n      if (bundle.dsseEnvelope.payloadType !== \"application/vnd.in-toto+json\") {\n        throw new Error(`Unsupported DSSE payload type: ${bundle.dsseEnvelope.payloadType}`);\n      }\n      const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n      const payload = JSON.parse(Uint8ArrayToString(payloadBytes));\n\n      // Verify the artifact digest matches a subject in the in-toto statement\n      if (!Array.isArray(payload?.subject) || payload.subject.length === 0 || payload.subject.length > MAX_SUBJECTS) {\n        throw new Error(`DSSE payload must have between 1 and ${MAX_SUBJECTS} subjects`);\n      }\n      // Compute or extract the artifact digest\n      let artifactDigest: string;\n      if (isDigestOnly) {\n        // data is already the digest bytes\n        artifactDigest = Uint8ArrayToHex(data);\n      } else {\n        // data is the file content, compute the digest\n        artifactDigest = Uint8ArrayToHex(\n          new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, data as BufferSource))\n        );\n      }\n\n      // Every subject must carry a bounded digest map; any one of them may match the artifact.\n      let matchedSubject = false;\n      for (const subject of payload.subject) {\n        const digests = subject?.digest;\n        if (!digests || typeof digests !== \"object\" || Array.isArray(digests) || Object.keys(digests).length > MAX_SUBJECT_DIGESTS) {\n          throw new Error(`Invalid DSSE subject digest map (maximum ${MAX_SUBJECT_DIGESTS} digests)`);\n        }\n        matchedSubject ||= typeof digests.sha256 === \"string\" && artifactDigest === digests.sha256.toLowerCase();\n      }\n\n      if (!matchedSubject) {\n        throw new Error(\n          `Artifact digest ${artifactDigest} does not match any subject in DSSE payload`\n        );\n      }\n\n      // Create PAE (Pre-Authentication Encoding) for signature verification\n      const pae = preAuthEncoding(bundle.dsseEnvelope.payloadType, payloadBytes);\n\n      const publicKey = await signingCert.publicKeyObj;\n      const verified = await verifySignature(publicKey, pae, signature);\n      if (!verified) {\n        throw new Error(\"DSSE signature verification failed\");\n      }\n    } else {\n      // The bundle's message digest must be the digest of the artifact being verified.\n      const { messageDigest } = bundle.messageSignature;\n      const digest = isDigestOnly\n        ? data\n        : new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, data as BufferSource));\n      if (messageDigest.algorithm !== \"SHA2_256\" || !uint8ArrayEqual(digest, base64ToUint8Array(messageDigest.digest))) {\n        throw new Error(\"Artifact digest does not match the bundle message digest\");\n      }\n      const publicKey = await signingCert.publicKeyObj;\n\n      if (isDigestOnly) {\n        // For hashedrekord bundles, verify signature over the digest directly.\n        // Uses the same elliptic.js workaround as sigstore-js conformance CLI.\n        const verified = await verifySignatureOverDigest(publicKey, data, signature);\n        if (!verified) {\n          throw new Error(\"Error verifying signature over digest\");\n        }\n      } else {\n        // For regular bundles, verify the signature over the artifact data\n        const verified = await verifySignature(publicKey, data, signature);\n        if (!verified) {\n          const keyAlg = publicKey.algorithm.name || 'unknown';\n          throw new Error(`Error verifying artifact signature. Key algorithm: ${keyAlg}, Data length: ${data.length}, Signature length: ${signature.length}`);\n        }\n      }\n    }\n\n    return true;\n  }\n\npublic async verifyArtifact(\n  identity: string,\n  issuer: string,\n  bundle: SigstoreBundle,\n  data: Uint8Array,\n  isDigestOnly: boolean = false,\n): Promise<boolean> {\n\n  const policy = new AllOf([\n    new Identity({ identity }),\n    new AnyOf([\n      new OIDCIssuerV2(issuer),\n      new OIDCIssuer(issuer),\n    ]),\n  ]);\n\n  return this.verifyArtifactPolicy(\n    policy,\n    bundle,\n    data,\n    isDigestOnly,\n  );\n}\n\n    \n\n  /**\n   * Verify a DSSE bundle using a verification policy.\n   * This matches sigstore-python's verify_dsse API.\n   *\n   * Reference: https://github.com/sigstore/sigstore-python/blob/main/sigstore/verify/verifier.py#L388\n   *\n   * Unlike verify_artifact which verifies an artifact against a bundle,\n   * this method verifies the DSSE envelope itself and returns the payload.\n   * The caller is responsible for checking that the payload matches their\n   * expected artifact (e.g., by checking subjects in an in-toto statement).\n   *\n   * @param bundle - The Sigstore bundle containing the DSSE envelope\n   * @param policy - A verification policy to apply to the signing certificate\n   * @returns The payload type and payload bytes from the verified envelope\n   */\n  public async verifyDsse(\n    bundle: SigstoreBundle,\n    policy: VerificationPolicy,\n  ): Promise<{ payloadType: string; payload: Uint8Array }> {\n    const { signingCert, signature } = await this.verifyBundle(bundle, policy);\n    if (!bundle.dsseEnvelope) {\n      throw new Error(\"Bundle does not contain a DSSE envelope\");\n    }\n\n    // (7) Verify the DSSE envelope signature\n    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n    const pae = preAuthEncoding(bundle.dsseEnvelope.payloadType, payloadBytes);\n\n    const publicKey = await signingCert.publicKeyObj;\n    const verified = await verifySignature(publicKey, pae, signature);\n    if (!verified) {\n      throw new Error(\"DSSE signature verification failed\");\n    }\n\n    // (8) Every entry MUST be of type \"dsse\" for DSSE verification\n    for (const entry of bundle.verificationMaterial.tlogEntries) {\n      if (entry.kindVersion.kind !== \"dsse\") {\n        throw new Error(`Expected entry type dsse, got ${entry.kindVersion.kind}`);\n      }\n    }\n\n    // Return the verified payload\n    return {\n      payloadType: bundle.dsseEnvelope.payloadType,\n      payload: payloadBytes,\n    };\n  }\n}\n"]}

package/dist/timestamp/tsa.d.ts

@@ -10,6 +10,10 @@ import { RFC3161Timestamp } from "../rfc3161/index.js";
  * @throws Error if timestamp cannot be verified
  */
 export declare function verifyRFC3161Timestamp(timestamp: RFC3161Timestamp, data: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date>;
+export interface VerifiedTimestamp {
+    signingTime: Date;
+    operator: string;
+}
 /**
  * Verifies all timestamps in a bundle's timestamp verification data
  *
@@ -19,8 +23,7 @@ export declare function verifyRFC3161Timestamp(timestamp: RFC3161Timestamp, data
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns Array of verified signing times (empty if no timestamps present)
+ * @returns The verified signing times and their operators (empty if no timestamps present)
  * @throws Error if any timestamp fails verification or duplicates are found
  */
-export declare function verifyBundleTimestamp(timestampData: any, signature: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date[]>;
-//# sourceMappingURL=tsa.d.ts.map
+export declare function verifyBundleTimestamp(timestampData: unknown, signature: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<VerifiedTimestamp[]>;

package/dist/timestamp/tsa.js

@@ -13,8 +13,10 @@
  * - Adds verifyBundleTimestamp for Sigstore bundle integration (new functionality)
  */
 import { base64ToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { CertificateChainVerifier, X509Certificate } from "../x509/index.js";
+import { assertTimestampVerificationData } from "../bundle.js";
+import { parseValidityPeriod } from "../interfaces.js";
 import { RFC3161Timestamp } from "../rfc3161/index.js";
+import { CertificateChainVerifier, X509Certificate } from "../x509/index.js";
 /**
  * Verifies an RFC3161 timestamp against a set of timestamp authorities
  *
@@ -25,6 +27,9 @@ import { RFC3161Timestamp } from "../rfc3161/index.js";
  * @throws Error if timestamp cannot be verified
  */
 export async function verifyRFC3161Timestamp(timestamp, data, timestampAuthorities) {
+    return (await verifyTimestamp(timestamp, data, timestampAuthorities)).signingTime;
+}
+async function verifyTimestamp(timestamp, data, timestampAuthorities) {
     const signingTime = timestamp.signingTime;
     // Filter for CAs which were valid at the time of signing
     let validAuthorities = filterCertAuthorities(timestampAuthorities, signingTime);
@@ -35,14 +40,15 @@ export async function verifyRFC3161Timestamp(timestamp, data, timestampAuthoriti
     });
     // Check that we can verify the timestamp with AT LEAST ONE of the remaining CAs
     const verificationResults = await Promise.allSettled(validAuthorities.map(ca => verifyTimestampForCA(timestamp, data, ca)));
-    const verified = verificationResults.some(result => result.status === "fulfilled");
-    if (!verified) {
+    const verified = verificationResults.findIndex(result => result.status === "fulfilled");
+    if (verified < 0) {
         const errors = verificationResults
             .filter(r => r.status === "rejected")
             .map(r => r.reason?.message || 'Unknown error');
         throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(', ')}`);
     }
-    return signingTime;
+    const ca = validAuthorities[verified];
+    return { signingTime, operator: ca.operator || "" };
 }
 /**
  * Filters certificate authorities to those valid at a specific time
@@ -51,17 +57,8 @@ export async function verifyRFC3161Timestamp(timestamp, data, timestampAuthoriti
  */
 function filterCertAuthorities(authorities, validAt) {
     return authorities.filter(ca => {
-        if (ca.validFor) {
-            const start = ca.validFor.start ? new Date(ca.validFor.start) : null;
-            const end = ca.validFor.end ? new Date(ca.validFor.end) : null;
-            if (start && validAt < start) {
-                return false;
-            }
-            if (end && validAt > end) {
-                return false;
-            }
-        }
-        return true;
+        const { start, end } = parseValidityPeriod(ca.validFor);
+        return start <= validAt && validAt <= end;
     });
 }
 /**
@@ -115,10 +112,11 @@ async function verifyTimestampForCA(timestamp, data, ca) {
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns Array of verified signing times (empty if no timestamps present)
+ * @returns The verified signing times and their operators (empty if no timestamps present)
  * @throws Error if any timestamp fails verification or duplicates are found
  */
 export async function verifyBundleTimestamp(timestampData, signature, timestampAuthorities) {
+    assertTimestampVerificationData(timestampData);
     if (!timestampData?.rfc3161Timestamps?.length) {
         return [];
     }
@@ -130,9 +128,8 @@ export async function verifyBundleTimestamp(timestampData, signature, timestampA
         // Decode the base64-encoded timestamp
         const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
         const timestamp = RFC3161Timestamp.parse(timestampBytes);
-        const signingTime = await verifyRFC3161Timestamp(timestamp, signature, timestampAuthorities);
         verifiedResults.push({
-            signingTime,
+            ...(await verifyTimestamp(timestamp, signature, timestampAuthorities)),
             signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),
         });
     }
@@ -146,6 +143,6 @@ export async function verifyBundleTimestamp(timestampData, signature, timestampA
             }
         }
     }
-    return verifiedResults.map(r => r.signingTime);
+    return verifiedResults;
 }
 //# sourceMappingURL=tsa.js.map

package/dist/timestamp/tsa.js.map

@@ -1 +1 @@
-{"version":3,"file":"tsa.js","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,IAAgB,EAChB,oBAA6C;IAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,yDAAyD;IACzD,IAAI,gBAAgB,GAAG,qBAAqB,CAC1C,oBAAoB,EACpB,WAAW,CACZ,CAAC;IAEF,yEAAyE;IACzE,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,EAAE;QAC9D,YAAY,EAAE,SAAS,CAAC,kBAAkB;QAC1C,MAAM,EAAE,SAAS,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,UAAU,CAClD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CACxC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,mBAAmB;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAA2B,CAAC,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0EAA0E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,OAAa;IAEb,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE/D,IAAI,KAAK,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,oBAA6C,EAC7C,QAA0D;IAE1D,OAAO,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,OAAO,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC7D,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAA2B,EAC3B,IAAgB,EAChB,EAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY;SAC3C,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;YAC5C,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;IAE9C,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAkB,EAClB,SAAqB,EACrB,oBAA6C;IAE7C,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,uGAAuG;IACvG,MAAM,eAAe,GAA6D,EAAE,CAAC;IAErF,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,sCAAsC;QACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,SAAS,EACT,SAAS,EACT,oBAAoB,CACrB,CAAC;QAEF,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW;YACX,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IACE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE;gBACrF,eAAe,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAC/E,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"tsa.js","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAyB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE7E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,IAAgB,EAChB,oBAA6C;IAE7C,OAAO,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC;AACpF,CAAC;AAQD,KAAK,UAAU,eAAe,CAC5B,SAA2B,EAC3B,IAAgB,EAChB,oBAA6C;IAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,yDAAyD;IACzD,IAAI,gBAAgB,GAAG,qBAAqB,CAC1C,oBAAoB,EACpB,WAAW,CACZ,CAAC;IAEF,yEAAyE;IACzE,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,EAAE;QAC9D,YAAY,EAAE,SAAS,CAAC,kBAAkB;QAC1C,MAAM,EAAE,SAAS,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,UAAU,CAClD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CACxC,CAAC;IAEF,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,mBAAmB;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAA2B,CAAC,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0EAA0E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,OAAa;IAEb,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,mBAAmB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,KAAK,IAAI,OAAO,IAAI,OAAO,IAAI,GAAG,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,oBAA6C,EAC7C,QAA0D;IAE1D,OAAO,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,OAAO,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC7D,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAA2B,EAC3B,IAAgB,EAChB,EAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY;SAC3C,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;YAC5C,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;IAE9C,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAsB,EACtB,SAAqB,EACrB,oBAA6C;IAE7C,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,uGAAuG;IACvG,MAAM,eAAe,GAA8D,EAAE,CAAC;IAEtF,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,sCAAsC;QACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEzD,eAAe,CAAC,IAAI,CAAC;YACnB,GAAG,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;YACtE,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IACE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE;gBACrF,eAAe,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAC/E,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC","sourcesContent":["/*\n * TSA (Time-Stamping Authority) timestamp verification\n *\n * Based on sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/tsa.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: uses Uint8Array instead of Buffer for binary data\n * - Uses Web Crypto API for all cryptographic operations\n * - Integrates with existing RFC3161 timestamp implementation\n * - Uses CertificateChainVerifier for full X.509 path validation\n * - Implements filterCertAuthorities inline (from sigstore-js/packages/verify/src/trust/filter.ts)\n * - Adds verifyBundleTimestamp for Sigstore bundle integration (new functionality)\n */\n\nimport { base64ToUint8Array, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport { assertTimestampVerificationData } from \"../bundle.js\";\nimport { parseValidityPeriod, RawTimestampAuthority } from \"../interfaces.js\";\nimport { RFC3161Timestamp } from \"../rfc3161/index.js\";\nimport { CertificateChainVerifier, X509Certificate } from \"../x509/index.js\";\n\n/**\n * Verifies an RFC3161 timestamp against a set of timestamp authorities\n *\n * @param timestamp - The RFC3161 timestamp to verify\n * @param data - The data that was timestamped\n * @param timestampAuthorities - List of trusted timestamp authorities\n * @returns The verified signing time\n * @throws Error if timestamp cannot be verified\n */\nexport async function verifyRFC3161Timestamp(\n  timestamp: RFC3161Timestamp,\n  data: Uint8Array,\n  timestampAuthorities: RawTimestampAuthority[]\n): Promise<Date> {\n  return (await verifyTimestamp(timestamp, data, timestampAuthorities)).signingTime;\n}\n\nexport interface VerifiedTimestamp {\n  signingTime: Date;\n  // Empty means unknown, which cannot add independence to named operators.\n  operator: string;\n}\n\nasync function verifyTimestamp(\n  timestamp: RFC3161Timestamp,\n  data: Uint8Array,\n  timestampAuthorities: RawTimestampAuthority[]\n): Promise<VerifiedTimestamp> {\n  const signingTime = timestamp.signingTime;\n\n  // Filter for CAs which were valid at the time of signing\n  let validAuthorities = filterCertAuthorities(\n    timestampAuthorities,\n    signingTime\n  );\n\n  // Filter for CAs which match serial and issuer embedded in the timestamp\n  validAuthorities = filterCAsBySerialAndIssuer(validAuthorities, {\n    serialNumber: timestamp.signerSerialNumber,\n    issuer: timestamp.signerIssuer,\n  });\n\n  // Check that we can verify the timestamp with AT LEAST ONE of the remaining CAs\n  const verificationResults = await Promise.allSettled(\n    validAuthorities.map(ca => verifyTimestampForCA(timestamp, data, ca))\n  );\n\n  const verified = verificationResults.findIndex(\n    result => result.status === \"fulfilled\"\n  );\n\n  if (verified < 0) {\n    const errors = verificationResults\n      .filter(r => r.status === \"rejected\")\n      .map(r => (r as PromiseRejectedResult).reason?.message || 'Unknown error');\n    throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(', ')}`);\n  }\n\n  const ca = validAuthorities[verified];\n  return { signingTime, operator: ca.operator || \"\" };\n}\n\n/**\n * Filters certificate authorities to those valid at a specific time\n *\n * Adapted from sigstore-js/packages/verify/src/trust/filter.ts\n */\nfunction filterCertAuthorities(\n  authorities: RawTimestampAuthority[],\n  validAt: Date\n): RawTimestampAuthority[] {\n  return authorities.filter(ca => {\n    const { start, end } = parseValidityPeriod(ca.validFor);\n    return start <= validAt && validAt <= end;\n  });\n}\n\n/**\n * Filters certificate authorities by serial number and issuer\n *\n * Only checks the LEAF certificate (TSA signing cert), not the entire chain.\n * This matches the sigstore-js reference implementation.\n */\nfunction filterCAsBySerialAndIssuer(\n  timestampAuthorities: RawTimestampAuthority[],\n  criteria: { serialNumber: Uint8Array; issuer: Uint8Array }\n): RawTimestampAuthority[] {\n  return timestampAuthorities.filter(ca => {\n    if (!ca.certChain || ca.certChain.certificates.length === 0) {\n      return false;\n    }\n\n    const leafCert = X509Certificate.parse(\n      base64ToUint8Array(ca.certChain.certificates[0].rawBytes)\n    );\n\n    return uint8ArrayEqual(leafCert.serialNumber, criteria.serialNumber) &&\n           uint8ArrayEqual(leafCert.issuer, criteria.issuer);\n  });\n}\n\n/**\n * Verifies a timestamp against a specific certificate authority\n */\nasync function verifyTimestampForCA(\n  timestamp: RFC3161Timestamp,\n  data: Uint8Array,\n  ca: RawTimestampAuthority\n): Promise<void> {\n  if (!ca.certChain || ca.certChain.certificates.length === 0) {\n    throw new Error(\"Certificate authority missing certificate chain\");\n  }\n\n  const leafCert = X509Certificate.parse(\n    base64ToUint8Array(ca.certChain.certificates[0].rawBytes)\n  );\n  const signingTime = timestamp.signingTime;\n\n  const trustedCerts = ca.certChain.certificates\n    .slice(1)\n    .map(cert => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));\n\n  try {\n    const verifier = new CertificateChainVerifier({\n      untrustedCert: leafCert,\n      trustedCerts: trustedCerts,\n      timestamp: signingTime,\n    });\n    await verifier.verify();\n  } catch (e) {\n    throw new Error(`TSA certificate chain verification failed: ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  const publicKey = await leafCert.publicKeyObj;\n\n  await timestamp.verify(data, publicKey);\n}\n\n/**\n * Verifies all timestamps in a bundle's timestamp verification data\n *\n * Matches sigstore-js behavior: all timestamps must successfully verify.\n * Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L64-L108\n *\n * @param timestampData - The timestamp verification data from the bundle\n * @param signature - The signature being verified\n * @param timestampAuthorities - List of trusted timestamp authorities\n * @returns The verified signing times and their operators (empty if no timestamps present)\n * @throws Error if any timestamp fails verification or duplicates are found\n */\nexport async function verifyBundleTimestamp(\n  timestampData: unknown,\n  signature: Uint8Array,\n  timestampAuthorities: RawTimestampAuthority[]\n): Promise<VerifiedTimestamp[]> {\n  assertTimestampVerificationData(timestampData);\n  if (!timestampData?.rfc3161Timestamps?.length) {\n    return [];\n  }\n\n  // Verify ALL timestamps - each must succeed (matches sigstore-js behavior)\n  // Collect verification results for duplicate checking after verification\n  // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L86-L92\n  const verifiedResults: Array<VerifiedTimestamp & { signerSerialNumber: string }> = [];\n\n  for (const tsData of timestampData.rfc3161Timestamps) {\n    // Decode the base64-encoded timestamp\n    const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);\n    const timestamp = RFC3161Timestamp.parse(timestampBytes);\n\n    verifiedResults.push({\n      ...(await verifyTimestamp(timestamp, signature, timestampAuthorities)),\n      signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),\n    });\n  }\n\n  // Check for duplicate timestamps using deep equality on parsed values\n  // sigstore-js uses isDeepStrictEqual on {type, logID, timestamp} objects\n  for (let i = 0; i < verifiedResults.length; i++) {\n    for (let j = i + 1; j < verifiedResults.length; j++) {\n      if (\n        verifiedResults[i].signingTime.getTime() === verifiedResults[j].signingTime.getTime() &&\n        verifiedResults[i].signerSerialNumber === verifiedResults[j].signerSerialNumber\n      ) {\n        throw new Error(\"Duplicate TSA timestamp detected\");\n      }\n    }\n  }\n\n  return verifiedResults;\n}\n"]}

package/dist/tlog/body.d.ts

@@ -1,8 +1,9 @@
 import type { SigstoreBundle, TLogEntry } from "../bundle.js";
+import { X509Certificate } from "../x509/cert.js";
 export interface RekorEntry {
     apiVersion: string;
     kind: string;
     spec: unknown;
 }
-export declare function verifyTLogBody(entry: TLogEntry, bundle: SigstoreBundle): Promise<void>;
-//# sourceMappingURL=body.d.ts.map
+export declare function verifyTLogBody(entry: TLogEntry, bundle: SigstoreBundle, cert: X509Certificate): Promise<void>;
+export declare function assertLoggedCertificate(cert: X509Certificate, encoded: unknown, pem: boolean): void;

package/dist/tlog/body.js

@@ -8,11 +8,13 @@
  * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
  * - Direct bundle comparison instead of SignatureContent abstraction
  */
-import { base64Decode } from "@freedomofpress/crypto-browser";
-import { verifyHashedRekordBody } from "./hashedrekord.js";
+import { base64Decode, base64ToUint8Array, Uint8ArrayToString } from "@freedomofpress/crypto-browser";
+import { X509Certificate } from "../x509/cert.js";
 import { verifyDSSEBody } from "./dsse.js";
+import { verifyHashedRekordBody } from "./hashedrekord.js";
 import { verifyIntotoBody } from "./intoto.js";
-export async function verifyTLogBody(entry, bundle) {
+// Checks that the entry body matches the bundle content and was logged under the signing certificate.
+export async function verifyTLogBody(entry, bundle, cert) {
     const rekorEntry = parseCanonicalBody(entry);
     const { kind, version } = entry.kindVersion;
     if (kind !== rekorEntry.kind || version !== rekorEntry.apiVersion) {
@@ -20,15 +22,26 @@ export async function verifyTLogBody(entry, bundle) {
     }
     switch (rekorEntry.kind) {
         case "hashedrekord":
-            return verifyHashedRekordBody(rekorEntry, bundle);
+            return verifyHashedRekordBody(rekorEntry, bundle, cert);
         case "dsse":
-            return verifyDSSEBody(rekorEntry, bundle);
+            return verifyDSSEBody(rekorEntry, bundle, cert);
         case "intoto":
-            return verifyIntotoBody(rekorEntry, bundle);
+            return verifyIntotoBody(rekorEntry, bundle, cert);
         default:
             throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);
     }
 }
+// Compares the certificate recorded in the entry (base64 DER, or base64 PEM for Rekor v1) with the signing certificate.
+export function assertLoggedCertificate(cert, encoded, pem) {
+    if (typeof encoded !== "string" || encoded === "") {
+        throw new Error("TLog entry does not record the signing certificate");
+    }
+    const bytes = base64ToUint8Array(encoded);
+    const logged = X509Certificate.parse(pem ? Uint8ArrayToString(bytes) : bytes);
+    if (!cert.equals(logged)) {
+        throw new Error("Certificate in TLog entry does not match the signing certificate");
+    }
+}
 function parseCanonicalBody(entry) {
     try {
         const decodedBody = base64Decode(entry.canonicalizedBody);

package/dist/tlog/body.js.map

@@ -1 +1 @@
-{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/tlog/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQ/C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAgB,EAChB,MAAsB;IAEtB,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;IAE5C,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,IAAI,OAAO,eAAe,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAC9G,CAAC;IACJ,CAAC;IAED,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,KAAK,MAAM;YACT,OAAO,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;QAEzD,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/tlog/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAGtG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQ/C,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAgB,EAChB,MAAsB,EACtB,IAAqB;IAErB,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;IAE5C,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,IAAI,OAAO,eAAe,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAC9G,CAAC;IACJ,CAAC;IAED,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM;YACT,OAAO,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,uBAAuB,CACrC,IAAqB,EACrB,OAAgB,EAChB,GAAY;IAEZ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;QAEzD,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/*\n * Transparency log body verification\n *\n * Based on sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/index.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: uses Uint8Array instead of Buffer for binary data\n * - Direct bundle comparison instead of SignatureContent abstraction\n */\n\nimport { base64Decode, base64ToUint8Array, Uint8ArrayToString } from \"@freedomofpress/crypto-browser\";\n\nimport type { SigstoreBundle, TLogEntry } from \"../bundle.js\";\nimport { X509Certificate } from \"../x509/cert.js\";\nimport { verifyDSSEBody } from \"./dsse.js\";\nimport { verifyHashedRekordBody } from \"./hashedrekord.js\";\nimport { verifyIntotoBody } from \"./intoto.js\";\n\nexport interface RekorEntry {\n  apiVersion: string;\n  kind: string;\n  spec: unknown;\n}\n\n// Checks that the entry body matches the bundle content and was logged under the signing certificate.\nexport async function verifyTLogBody(\n  entry: TLogEntry,\n  bundle: SigstoreBundle,\n  cert: X509Certificate,\n): Promise<void> {\n  const rekorEntry = parseCanonicalBody(entry);\n\n  const { kind, version } = entry.kindVersion;\n\n  if (kind !== rekorEntry.kind || version !== rekorEntry.apiVersion) {\n    throw new Error(\n      `kind/version mismatch - expected: ${kind}/${version}, received: ${rekorEntry.kind}/${rekorEntry.apiVersion}`\n    );\n  }\n\n  switch (rekorEntry.kind) {\n    case \"hashedrekord\":\n      return verifyHashedRekordBody(rekorEntry, bundle, cert);\n    case \"dsse\":\n      return verifyDSSEBody(rekorEntry, bundle, cert);\n    case \"intoto\":\n      return verifyIntotoBody(rekorEntry, bundle, cert);\n    default:\n      throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);\n  }\n}\n\n// Compares the certificate recorded in the entry (base64 DER, or base64 PEM for Rekor v1) with the signing certificate.\nexport function assertLoggedCertificate(\n  cert: X509Certificate,\n  encoded: unknown,\n  pem: boolean,\n): void {\n  if (typeof encoded !== \"string\" || encoded === \"\") {\n    throw new Error(\"TLog entry does not record the signing certificate\");\n  }\n  const bytes = base64ToUint8Array(encoded);\n  const logged = X509Certificate.parse(pem ? Uint8ArrayToString(bytes) : bytes);\n  if (!cert.equals(logged)) {\n    throw new Error(\"Certificate in TLog entry does not match the signing certificate\");\n  }\n}\n\nfunction parseCanonicalBody(entry: TLogEntry): RekorEntry {\n  try {\n    const decodedBody = base64Decode(entry.canonicalizedBody);\n    const rekorEntry = JSON.parse(decodedBody) as RekorEntry;\n\n    if (!rekorEntry.apiVersion || !rekorEntry.kind || !rekorEntry.spec) {\n      throw new Error(\"Invalid Rekor entry structure\");\n    }\n\n    return rekorEntry;\n  } catch (error) {\n    throw new Error(\n      `Failed to parse canonicalized body: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n"]}

package/dist/tlog/checkpoint.d.ts

@@ -1,5 +1,5 @@
 import type { TLogEntry } from "../bundle.js";
-import type { RawLogs } from "../interfaces.js";
+import type { RekorKeyInfo } from "../interfaces.js";
 export interface TLogSignature {
     name: string;
     keyHint: Uint8Array;
@@ -19,5 +19,4 @@ export declare class LogCheckpoint {
     constructor(origin: string, logSize: bigint, logHash: Uint8Array, rest: string[]);
     static fromString(note: string): LogCheckpoint;
 }
-export declare function verifyCheckpoint(entry: TLogEntry, tlogs: RawLogs): Promise<void>;
-//# sourceMappingURL=checkpoint.d.ts.map
+export declare function verifyCheckpoint(entry: TLogEntry, log: RekorKeyInfo): Promise<void>;

package/dist/tlog/checkpoint.js

@@ -7,18 +7,11 @@ https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/
 Key differences:
 - Uses Uint8Array instead of Buffer
 - Uses Web Crypto API instead of Node.js crypto module
-- Manual handling of ED25519 (raw) vs ECDSA (DER) signature formats
-- Inline key import from raw bytes
-
-Additional functionality not in reference:
-- filterTLogsByDate() - inlined from sigstore-js/packages/verify/src/trust/filter.ts
-- importTLogKey() - new browser-compatible key import with multiple format support
-- Special handling for Rekor v2 bundles without integratedTime
 
 Follows the signed note format specification:
 https://github.com/transparency-dev/formats/blob/main/log/README.md
 */
-import { base64ToUint8Array, importKey, KeyTypes, stringToUint8Array, uint8ArrayEqual, verifySignature, } from "@freedomofpress/crypto-browser";
+import { base64ToUint8Array, stringToUint8Array, uint8ArrayEqual, verifySignature, } from "@freedomofpress/crypto-browser";
 // Signed note format per https://github.com/transparency-dev/formats
 // Body is separated from signatures by a blank line
 const CHECKPOINT_SEPARATOR = "\n\n";
@@ -81,100 +74,29 @@ export class LogCheckpoint {
         return new LogCheckpoint(origin, logSize, rootHash, rest);
     }
 }
-// Verifies checkpoint signature and ensures root hash matches inclusion proof
-export async function verifyCheckpoint(entry, tlogs) {
-    if (!entry.inclusionProof?.checkpoint) {
+// Verifies that the checkpoint is signed by the entry's log and describes the same tree as the inclusion proof.
+export async function verifyCheckpoint(entry, log) {
+    const proof = entry.inclusionProof;
+    if (!proof?.checkpoint?.envelope) {
         throw new Error("Missing checkpoint in inclusion proof");
     }
-    // Filter by log ID first (matches entry's log ID)
-    const entryLogId = base64ToUint8Array(entry.logId.keyId);
-    const matchingTLogs = tlogs.filter((tlog) => {
-        const tlogId = base64ToUint8Array(tlog.logId.keyId);
-        return uint8ArrayEqual(tlogId, entryLogId);
-    });
-    // Then filter by date if integratedTime is available
-    // For Rekor v2 bundles, integratedTime may be null, so we skip date filtering
-    const validTLogs = entry.integratedTime
-        ? filterTLogsByDate(matchingTLogs, new Date(Number(entry.integratedTime) * 1000))
-        : matchingTLogs;
-    const inclusionProof = entry.inclusionProof;
-    const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);
+    const signedNote = SignedNote.fromString(proof.checkpoint.envelope);
     const checkpoint = LogCheckpoint.fromString(signedNote.note);
-    if (!(await verifySignedNote(signedNote, validTLogs))) {
-        throw new Error("Invalid checkpoint signature");
-    }
-    const rootHash = base64ToUint8Array(inclusionProof.rootHash);
-    if (!uint8ArrayEqual(checkpoint.logHash, rootHash)) {
-        throw new Error("Root hash mismatch between checkpoint and inclusion proof");
-    }
-}
-// Verifies checkpoint signatures using trusted TLog keys
-async function verifySignedNote(signedNote, tlogs) {
     const data = stringToUint8Array(signedNote.note);
-    // We need at least one valid signature from a known TLog
-    let hasValidSignature = false;
-    for (const signature of signedNote.signatures) {
-        // Match signature to TLog using key hint (first 4 bytes of key ID)
-        const tlog = tlogs.find((tlog) => {
-            const logId = base64ToUint8Array(tlog.logId.keyId);
-            return uint8ArrayEqual(logId.subarray(0, 4), signature.keyHint);
-        });
-        if (!tlog) {
-            // Skip unknown signatures (e.g., from witnesses we don't know about)
-            continue;
-        }
-        const publicKey = await importTLogKey(tlog);
-        // Both ED25519 and ECDSA verification are now handled by verifySignature
-        // ED25519 signatures are raw (64 bytes), ECDSA signatures are DER-encoded
-        const verified = await verifySignature(publicKey, data, signature.signature, tlog.hashAlgorithm);
-        if (verified) {
-            hasValidSignature = true;
+    // Signatures from other parties (e.g. witnesses) are ignored; the key hint is the first 4 bytes of the log ID.
+    let valid = false;
+    for (const sig of signedNote.signatures) {
+        if (uint8ArrayEqual(sig.keyHint, log.logId.subarray(0, 4)) &&
+            (await verifySignature(log.publicKey, data, sig.signature, log.hashAlgorithm))) {
+            valid = true;
         }
     }
-    return hasValidSignature;
-}
-// Inlined from sigstore-js/packages/verify/src/trust/filter.ts
-function filterTLogsByDate(tlogs, targetDate) {
-    return tlogs.filter((tlog) => {
-        const start = new Date(tlog.publicKey.validFor.start);
-        const end = tlog.publicKey.validFor.end
-            ? new Date(tlog.publicKey.validFor.end)
-            : null;
-        return targetDate >= start && (!end || targetDate <= end);
-    });
-}
-// Browser-compatible key import supporting multiple formats (not in sigstore-js reference)
-async function importTLogKey(tlog) {
-    // Parse keyDetails to extract key type and scheme
-    // Formats can be:
-    // - "PKIX_ECDSA_P256_SHA_256" (production format)
-    // - "PKIX_ED25519"
-    // - "ecdsa-sha2-nistp256" (SSH/test format)
-    const keyDetails = tlog.publicKey.keyDetails;
-    let keyType;
-    let scheme;
-    if (keyDetails === "ecdsa-sha2-nistp256") {
-        // SSH-style ECDSA P-256 format used in tests
-        keyType = KeyTypes.Ecdsa;
-        scheme = "P256-SHA256";
-    }
-    else if (keyDetails.includes("ECDSA")) {
-        keyType = KeyTypes.Ecdsa;
-        // Extract the curve and hash, e.g., "P256_SHA_256" from "PKIX_ECDSA_P256_SHA_256"
-        scheme = keyDetails.replace("PKIX_ECDSA_", "").replace(/_/g, "-");
-    }
-    else if (keyDetails.includes("ED25519")) {
-        keyType = KeyTypes.Ed25519;
-        scheme = KeyTypes.Ed25519;
-    }
-    else if (keyDetails.includes("RSA")) {
-        keyType = KeyTypes.RSA;
-        // Extract RSA details, e.g., "PSS_SHA_256" from "PKIX_RSA_PSS_SHA_256"
-        scheme = keyDetails.replace("PKIX_RSA_", "").replace(/_/g, "-");
+    if (!valid) {
+        throw new Error("Invalid checkpoint signature");
     }
-    else {
-        throw new Error(`Unsupported key type in keyDetails: ${keyDetails}`);
+    if (checkpoint.logSize !== BigInt(proof.treeSize) ||
+        !uint8ArrayEqual(checkpoint.logHash, base64ToUint8Array(proof.rootHash))) {
+        throw new Error("Checkpoint does not match inclusion proof");
     }
-    return importKey(keyType, scheme, tlog.publicKey.rawBytes);
 }
 //# sourceMappingURL=checkpoint.js.map

package/dist/tlog/checkpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../src/tlog/checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;EAmBE;AAEF,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AAIxC,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,wEAAwE;AACxE,sCAAsC;AACtC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAQhD,uDAAuD;AACvD,MAAM,OAAO,UAAU;IAIrB,YAAY,IAAY,EAAE,UAA2B;QACnD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,QAAgB;QAChC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAEjE,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;YAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAE/C,qEAAqE;YACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,aAAa;IAMxB,YACE,MAAc,EACd,OAAe,EACf,OAAmB,EACnB,IAAc;QAEd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,IAAY;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAgB,EAChB,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,kDAAkD;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,8EAA8E;IAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc;QACrC,CAAC,CAAC,iBAAiB,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC,CAAC,aAAa,CAAC;IAElB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,gBAAgB,CAC7B,UAAsB,EACtB,KAAc;IAEd,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjD,yDAAyD;IACzD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,mEAAmE;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,qEAAqE;YACrE,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAE5C,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,SAAS,EACT,IAAI,EACJ,SAAS,CAAC,SAAS,EACnB,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAGD,+DAA+D;AAC/D,SAAS,iBAAiB,CAAC,KAAc,EAAE,UAAgB;IACzD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;YACrC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC;QAET,OAAO,UAAU,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,IAAI,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,aAAa,CAAC,IAAgB;IAC3C,kDAAkD;IAClD,kBAAkB;IAClB,kDAAkD;IAClD,mBAAmB;IACnB,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IAC7C,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IAEnB,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;QACzC,6CAA6C;QAC7C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QACzB,MAAM,GAAG,aAAa,CAAC;IACzB,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QACzB,kFAAkF;QAClF,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACnE,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3B,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC;QACvB,uEAAuE;QACvE,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,SAAS,CACd,OAAO,EACP,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,QAAQ,CACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../src/tlog/checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;EAYE;AAEF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AAKxC,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,wEAAwE;AACxE,sCAAsC;AACtC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAQhD,uDAAuD;AACvD,MAAM,OAAO,UAAU;IAIrB,YAAY,IAAY,EAAE,UAA2B;QACnD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,QAAgB;QAChC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAEjE,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;YAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAE/C,qEAAqE;YACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,aAAa;IAMxB,YACE,MAAc,EACd,OAAe,EACf,OAAmB,EACnB,IAAc;QAEd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,IAAY;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAgB,EAChB,GAAiB;IAEjB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjD,+GAA+G;IAC/G,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACxC,IACE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAC9E,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7C,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC","sourcesContent":["/*\nCheckpoint verification for transparency log entries.\n\nAdapted from sigstore-js for browser compatibility:\nhttps://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/checkpoint.ts\n\nKey differences:\n- Uses Uint8Array instead of Buffer\n- Uses Web Crypto API instead of Node.js crypto module\n\nFollows the signed note format specification:\nhttps://github.com/transparency-dev/formats/blob/main/log/README.md\n*/\n\nimport {\n  base64ToUint8Array,\n  stringToUint8Array,\n  uint8ArrayEqual,\n  verifySignature,\n} from \"@freedomofpress/crypto-browser\";\n\nimport type { TLogEntry } from \"../bundle.js\";\nimport type { RekorKeyInfo } from \"../interfaces.js\";\n\n// Signed note format per https://github.com/transparency-dev/formats\n// Body is separated from signatures by a blank line\nconst CHECKPOINT_SEPARATOR = \"\\n\\n\";\n// Signature lines format: \"— <identity> <base64(key_hint+signature)>\\n\"\n// \\u2014 is the em-dash character (—)\nconst SIGNATURE_REGEX = /\\u2014 (\\S+) (\\S+)\\n/g;\n\nexport interface TLogSignature {\n  name: string;\n  keyHint: Uint8Array;\n  signature: Uint8Array;\n}\n\n// Signed checkpoint note with cryptographic signatures\nexport class SignedNote {\n  readonly note: string;\n  readonly signatures: TLogSignature[];\n\n  constructor(note: string, signatures: TLogSignature[]) {\n    this.note = note;\n    this.signatures = signatures;\n  }\n\n  static fromString(envelope: string): SignedNote {\n    if (!envelope.includes(CHECKPOINT_SEPARATOR)) {\n      throw new Error(\"Missing checkpoint separator\");\n    }\n\n    // Split body from signature lines at blank line\n    const split = envelope.indexOf(CHECKPOINT_SEPARATOR);\n    const header = envelope.slice(0, split + 1);\n    const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length);\n\n    // Parse signature lines: \"— <identity> <base64(key_hint+signature)>\\n\"\n    const matches = data.matchAll(SIGNATURE_REGEX);\n\n    const signatures: TLogSignature[] = [];\n    for (const match of matches) {\n      const [, name, signature] = match;\n      const sigBytes = base64ToUint8Array(signature);\n\n      // First 4 bytes are key hint (SHA256 hash prefix), rest is signature\n      if (sigBytes.length < 5) {\n        throw new Error(\"Malformed checkpoint signature\");\n      }\n\n      signatures.push({\n        name,\n        keyHint: sigBytes.subarray(0, 4),\n        signature: sigBytes.subarray(4),\n      });\n    }\n\n    if (signatures.length === 0) {\n      throw new Error(\"No signatures found in checkpoint\");\n    }\n\n    return new SignedNote(header, signatures);\n  }\n}\n\n// Parsed checkpoint containing tree state (origin, size, root hash)\nexport class LogCheckpoint {\n  readonly origin: string;\n  readonly logSize: bigint;\n  readonly logHash: Uint8Array;\n  readonly rest: string[];\n\n  constructor(\n    origin: string,\n    logSize: bigint,\n    logHash: Uint8Array,\n    rest: string[]\n  ) {\n    this.origin = origin;\n    this.logSize = logSize;\n    this.logHash = logHash;\n    this.rest = rest;\n  }\n\n  static fromString(note: string): LogCheckpoint {\n    const lines = note.trimEnd().split(\"\\n\");\n\n    if (lines.length < 3) {\n      throw new Error(\"Too few lines in checkpoint header\");\n    }\n\n    const origin = lines[0];\n    const logSize = BigInt(lines[1]);\n    const rootHash = base64ToUint8Array(lines[2]);\n    const rest = lines.slice(3);\n\n    return new LogCheckpoint(origin, logSize, rootHash, rest);\n  }\n}\n\n// Verifies that the checkpoint is signed by the entry's log and describes the same tree as the inclusion proof.\nexport async function verifyCheckpoint(\n  entry: TLogEntry,\n  log: RekorKeyInfo\n): Promise<void> {\n  const proof = entry.inclusionProof;\n  if (!proof?.checkpoint?.envelope) {\n    throw new Error(\"Missing checkpoint in inclusion proof\");\n  }\n\n  const signedNote = SignedNote.fromString(proof.checkpoint.envelope);\n  const checkpoint = LogCheckpoint.fromString(signedNote.note);\n  const data = stringToUint8Array(signedNote.note);\n\n  // Signatures from other parties (e.g. witnesses) are ignored; the key hint is the first 4 bytes of the log ID.\n  let valid = false;\n  for (const sig of signedNote.signatures) {\n    if (\n      uint8ArrayEqual(sig.keyHint, log.logId.subarray(0, 4)) &&\n      (await verifySignature(log.publicKey, data, sig.signature, log.hashAlgorithm))\n    ) {\n      valid = true;\n    }\n  }\n  if (!valid) {\n    throw new Error(\"Invalid checkpoint signature\");\n  }\n\n  if (\n    checkpoint.logSize !== BigInt(proof.treeSize) ||\n    !uint8ArrayEqual(checkpoint.logHash, base64ToUint8Array(proof.rootHash))\n  ) {\n    throw new Error(\"Checkpoint does not match inclusion proof\");\n  }\n}\n"]}

package/dist/tlog/dsse.d.ts

@@ -1,4 +1,4 @@
 import type { SigstoreBundle } from "../bundle.js";
-import type { RekorEntry } from "./body.js";
-export declare function verifyDSSEBody(entry: RekorEntry, bundle: SigstoreBundle): Promise<void>;
-//# sourceMappingURL=dsse.d.ts.map
+import type { X509Certificate } from "../x509/cert.js";
+import { type RekorEntry } from "./body.js";
+export declare function verifyDSSEBody(entry: RekorEntry, bundle: SigstoreBundle, cert: X509Certificate): Promise<void>;