@freedomofpress/sigstore-browser 0.1.3 → 0.1.5

package/.github/workflows/publish.yml

@@ -29,17 +29,19 @@ jobs:
           node-version: 20
           registry-url: "https://registry.npmjs.org"
 
-      - run: npm ci
-      - run: npm run build
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Build
+        run: npm run build
 
       - name: Dry-run publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --dry-run
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public
 
 

package/dist/interfaces.d.ts

@@ -87,4 +87,5 @@ export interface RawCA {
 }
 export type RawCAs = RawCA[];
 export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+export declare function getHashAlgorithm(algorithm: string): string;
 //# sourceMappingURL=interfaces.d.ts.map

package/dist/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,oBAAY,aAAa;IACvB,sBAAsB,2BAA2B;IACjD,MAAM,WAAW;IACjB,oBAAoB,yBAAyB;IAC7C,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,EAAE,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,sBAAsB,EAAE,aAAa,EAAE,CAAC;IACxC,oBAAoB,EAAE,aAAa,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE;YACR,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;AAE/B,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;AAG7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,oBAAY,aAAa;IACvB,sBAAsB,2BAA2B;IACjD,MAAM,WAAW;IACjB,oBAAoB,yBAAyB;IAC7C,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,EAAE,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,sBAAsB,EAAE,aAAa,EAAE,CAAC;IACxC,oBAAoB,EAAE,aAAa,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE;YACR,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;AAE/B,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;AAG7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AActF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM1D"}

package/dist/interfaces.js

@@ -7,4 +7,22 @@ export var SigstoreRoots;
 })(SigstoreRoots || (SigstoreRoots = {}));
 // Re-export crypto enums from crypto-browser (shared with tuf-browser)
 export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+import { HashAlgorithms } from "@freedomofpress/crypto-browser";
+// Supported hash algorithms for payload hash validation
+// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)
+const SUPPORTED_HASH_ALGORITHMS = {
+    "sha256": HashAlgorithms.SHA256,
+    "sha384": HashAlgorithms.SHA384,
+    "sha512": HashAlgorithms.SHA512,
+    "SHA2_256": HashAlgorithms.SHA256,
+    "SHA2_384": HashAlgorithms.SHA384,
+    "SHA2_512": HashAlgorithms.SHA512,
+};
+export function getHashAlgorithm(algorithm) {
+    const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];
+    if (!hashAlg) {
+        throw new Error(`Unsupported hash algorithm: ${algorithm}`);
+    }
+    return hashAlg;
+}
 //# sourceMappingURL=interfaces.js.map

package/dist/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AA8FD,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AA8FD,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/sigstore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sigstore.d.ts","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EACL,aAAa,EACb,KAAK,EACL,MAAM,EACN,OAAO,EACP,uBAAuB,EACvB,YAAY,EAGZ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAoC;gBAEvC,OAAO,GAAE,uBAA4B;IAU3C,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA4BhF,UAAU,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAuCpE,sBAAsB,CAC1B,SAAS,EAAE,IAAI,EACf,IAAI,EAAE,eAAe,EACrB,sBAAsB,EAAE,aAAa,EAAE,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B7B,OAAO,CACL,eAAe,EAAE,IAAI,EACrB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,aAAa,EAAE;IAiClB,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE;IAwBrD,gBAAgB,CAAC,OAAO,EAAE,WAAW;IAe3C;;;;;OAKG;IACG,uBAAuB,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYzE,SAAS,CACb,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,UAAU,EAAE,CAAC;IAqGlB,sBAAsB,CAC1B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,YAAY,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC;IA2Kb,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBpD,cAAc,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;CA0KpB"}
+{"version":3,"file":"sigstore.d.ts","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EACL,aAAa,EACb,KAAK,EACL,MAAM,EACN,OAAO,EACP,uBAAuB,EACvB,YAAY,EAGZ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAiCrD,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAoC;gBAEvC,OAAO,GAAE,uBAA4B;IAU3C,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA4BhF,UAAU,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAuCpE,sBAAsB,CAC1B,SAAS,EAAE,IAAI,EACf,IAAI,EAAE,eAAe,EACrB,sBAAsB,EAAE,aAAa,EAAE,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B7B,OAAO,CACL,eAAe,EAAE,IAAI,EACrB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,aAAa,EAAE;IAiClB,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE;IAwBrD,gBAAgB,CAAC,OAAO,EAAE,WAAW;IAe3C;;;;;OAKG;IACG,uBAAuB,CAAC,WAAW,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,SAAS,CACb,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,UAAU,EAAE,CAAC;IAkGlB,sBAAsB,CAC1B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,YAAY,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC;IA4Lb,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBpD,cAAc,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,OAAO,CAAC;CA6KpB"}

package/dist/sigstore.js

@@ -8,6 +8,33 @@ import { verifyCheckpoint } from "./tlog/checkpoint.js";
 import { verifyTLogBody } from "./tlog/body.js";
 import { verifyBundleTimestamp } from "./timestamp/tsa.js";
 import { TrustedRootProvider } from "./trust/tuf.js";
+const MEDIA_TYPE_BASE = "application/vnd.dev.sigstore.bundle";
+/**
+ * Extract bundle version from mediaType string
+ * Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177
+ */
+function getBundleVersion(mediaType) {
+    switch (mediaType) {
+        case `${MEDIA_TYPE_BASE}+json;version=0.1`:
+            return "0.1";
+        case `${MEDIA_TYPE_BASE}+json;version=0.2`:
+            return "0.2";
+        case `${MEDIA_TYPE_BASE}+json;version=0.3`:
+            return "0.3";
+    }
+    // New format: "application/vnd.dev.sigstore.bundle.v0.3+json"
+    if (mediaType.startsWith(`${MEDIA_TYPE_BASE}.v`) && mediaType.endsWith("+json")) {
+        const version = mediaType
+            .replace(`${MEDIA_TYPE_BASE}.v`, "")
+            .replace("+json", "");
+        // Basic semver validation (major.minor or major.minor.patch)
+        if (/^\d+\.\d+(\.\d+)?$/.test(version)) {
+            return version;
+        }
+    }
+    // Default to 0.1 for unknown formats
+    return "0.1";
+}
 export class SigstoreVerifier {
     root;
     rawRoot;
@@ -158,8 +185,7 @@ export class SigstoreVerifier {
     }
     // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/sct.ts
     // Key differences:
-    // - Adds duplicate SCT detection
-    // - Adds SCT timestamp validity checking
+    // - Adds duplicate SCT detection (not in reference)
     // - Inline CT log filtering by logID and validity period (reference uses filterTLogAuthorities)
     // - Returns array of verified SCT logIDs for threshold checking (matches reference behavior)
     async verifySCT(cert, issuer, ctlogs) {
@@ -209,48 +235,45 @@ export class SigstoreVerifier {
         const tbs = clone.tbsCertificate.toDER();
         preCert.appendUint24(tbs.length);
         preCert.appendView(tbs);
-        // Collect all verified SCTs to check against threshold
+        // Calculate and return the verification results for each SCT
+        // Unlike sigstore-go which counts verified SCTs and checks threshold at the end,
+        // sigstore-js throws immediately if any SCT fails verification
         const verifiedSCTs = [];
         for (const sct of extSCT.signedCertificateTimestamps) {
-            // SCT should be within certificate validity period
-            if (sct.datetime < cert.notBefore || sct.datetime > cert.notAfter) {
-                continue; // Skip invalid SCT timestamp, don't fail yet
-            }
             // Find the CT log that matches this SCT's log ID and is valid for the SCT datetime
             const validCTLogs = ctlogs.filter((log) => {
                 // Check if log IDs match
-                if (log.logID.length !== sct.logID.length)
+                if (!uint8ArrayEqual(log.logID, sct.logID))
                     return false;
-                for (let i = 0; i < log.logID.length; i++) {
-                    if (log.logID[i] !== sct.logID[i])
-                        return false;
-                }
                 // Check that the SCT datetime is within the log's validity period
                 return log.validFor.start <= sct.datetime && sct.datetime <= log.validFor.end;
             });
-            // Try to verify with any valid CT log
-            let verified = false;
-            for (const log of validCTLogs) {
-                try {
-                    if (await sct.verify(preCert.buffer, log.publicKey)) {
-                        verified = true;
-                        break; // Found a valid log for this SCT
+            // See if the SCT is valid for any of the CT logs
+            const verified = await (async () => {
+                for (const log of validCTLogs) {
+                    try {
+                        if (await sct.verify(preCert.buffer, log.publicKey)) {
+                            return true;
+                        }
+                    }
+                    catch {
+                        // Continue trying other logs
                     }
                 }
-                catch (e) {
-                    // Continue trying other logs
-                }
-            }
-            if (verified) {
-                verifiedSCTs.push(sct.logID);
+                return false;
+            })();
+            if (!verified) {
+                throw new Error("SCT verification failed");
             }
+            verifiedSCTs.push(sct.logID);
         }
         return verifiedSCTs;
     }
     async verifyInclusionPromise(cert, bundle, rekor) {
         const entries = bundle.verificationMaterial.tlogEntries;
-        if (entries.length < 1) {
-            throw new Error("Failed to find a transparency log entry in the provided bundle.");
+        // Check that bundle has enough tlog entries to meet threshold
+        if (entries.length < this.options.tlogThreshold) {
+            throw new Error(`Not enough tlog entries: ${entries.length} < ${this.options.tlogThreshold}`);
         }
         // Prevent DoS via excessive entries and threshold bypass via duplicates
         // Matches sigstore-go limits (verify/tlog.go:46-57)
@@ -269,9 +292,8 @@ export class SigstoreVerifier {
         }
         const entry = entries[0];
         // Extract bundle version from mediaType
-        // e.g., "application/vnd.dev.sigstore.bundle+json;version=0.2"
-        const versionMatch = bundle.mediaType.match(/version=(\d+\.\d+)/);
-        const bundleVersion = versionMatch ? versionMatch[1] : "0.1";
+        // Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177
+        const bundleVersion = getBundleVersion(bundle.mediaType);
         const isV02OrLater = parseFloat(bundleVersion) >= 0.2;
         // Bundle v0.2+ requires an inclusion proof
         if (isV02OrLater && !entry.inclusionProof) {
@@ -364,15 +386,28 @@ export class SigstoreVerifier {
             }
         }
         else if (bodyJson.kind === "dsse") {
-            // DSSE entries store signatures differently
-            // The certificate is verified through the bundle's verification material
-            // No additional check needed here
+            // DSSE v0.0.1: certificate is in spec.signatures[0].verifier (base64-encoded PEM)
+            // https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go#L356-L357
+            const verifierContent = bodyJson.spec.signatures?.[0]?.verifier;
+            if (verifierContent) {
+                const pemString = Uint8ArrayToString(base64ToUint8Array(verifierContent));
+                const loggedCert = X509Certificate.parse(pemString);
+                if (!cert.equals(loggedCert)) {
+                    throw new Error("Certificate in DSSE tlog entry does not match the signing certificate.");
+                }
+            }
         }
         else if (bodyJson.kind === "intoto") {
-            // Intoto entries are DSSE-based and don't store certificates in the tlog entry
-            // The certificate is part of the bundle's verification material which has already
-            // been verified against the CA root. The intoto verification in tlog/intoto.ts
-            // verifies the signature and payload hash match between the tlog and bundle.
+            // intoto v0.0.2: certificate is in spec.content.envelope.signatures[0].publicKey (base64-encoded PEM)
+            // https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go#L360-L361
+            const publicKeyContent = bodyJson.spec.content?.envelope?.signatures?.[0]?.publicKey;
+            if (publicKeyContent) {
+                const pemString = Uint8ArrayToString(base64ToUint8Array(publicKeyContent));
+                const loggedCert = X509Certificate.parse(pemString);
+                if (!cert.equals(loggedCert)) {
+                    throw new Error("Certificate in intoto tlog entry does not match the signing certificate.");
+                }
+            }
         }
         else {
             // Unknown entry type - this should not happen with standard Sigstore bundles
@@ -387,13 +422,16 @@ export class SigstoreVerifier {
         if (bundle.verificationMaterial.tlogEntries.length < 1) {
             throw new Error("No transparency log entries found in bundle");
         }
-        const entry = bundle.verificationMaterial.tlogEntries[0];
-        // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
-        // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
-        if (entry.inclusionProof) {
-            await verifyMerkleInclusion(entry);
-            if (entry.inclusionProof.checkpoint) {
-                await verifyCheckpoint(entry, this.rawRoot.tlogs);
+        // Verify inclusion proof for ALL entries, not just the first one
+        // Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/verify/tlog.go#L74-L127
+        for (const entry of bundle.verificationMaterial.tlogEntries) {
+            // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
+            // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
+            if (entry.inclusionProof) {
+                await verifyMerkleInclusion(entry);
+                if (entry.inclusionProof.checkpoint) {
+                    await verifyCheckpoint(entry, this.rawRoot.tlogs);
+                }
             }
         }
     }
@@ -450,17 +488,20 @@ export class SigstoreVerifier {
         }
         // # 5 Rekor inclusion proof (Merkle tree verification)
         await this.verifyInclusionProof(bundle);
-        // # 5.1 Rekor body verification
-        if (bundle.verificationMaterial.tlogEntries.length > 0) {
-            await verifyTLogBody(bundle.verificationMaterial.tlogEntries[0], bundle);
-        }
-        // # 6 TSA Timestamp Verification (if present)
-        let verifiedTimestamp;
-        if (bundle.verificationMaterial.timestampVerificationData) {
-            // Verify TSA timestamps if present
-            verifiedTimestamp = await verifyBundleTimestamp(bundle.verificationMaterial.timestampVerificationData, signature, this.rawRoot?.timestampAuthorities || []);
-            // If we have a verified timestamp, check certificate validity at that time
-            if (verifiedTimestamp && !signingCert.validForDate(verifiedTimestamp)) {
+        // # 5.1 Rekor body verification - verify ALL entries (matches sigstore-js verifier.ts:147)
+        for (const entry of bundle.verificationMaterial.tlogEntries) {
+            await verifyTLogBody(entry, bundle);
+        }
+        // # 6 TSA Timestamp Verification
+        // Verify all timestamps and enforce threshold
+        // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L101-L106
+        const verifiedTimestamps = await verifyBundleTimestamp(bundle.verificationMaterial.timestampVerificationData, signature, this.rawRoot?.timestampAuthorities || []);
+        if (verifiedTimestamps.length < this.options.tsaThreshold) {
+            throw new Error(`Not enough verified TSA timestamps: ${verifiedTimestamps.length} < ${this.options.tsaThreshold}`);
+        }
+        // If we have verified timestamps, check certificate validity at each timestamp time
+        for (const verifiedTimestamp of verifiedTimestamps) {
+            if (!signingCert.validForDate(verifiedTimestamp)) {
                 throw new Error("Certificate was not valid at the time of timestamping");
             }
         }

package/dist/sigstore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sigstore.js","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAQL,aAAa,GAEd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAQrD,MAAM,OAAO,gBAAgB;IACnB,IAAI,CAAuB;IAC3B,OAAO,CAA0B;IACjC,OAAO,CAAoC;IAEnD,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,eAAqB,EAAE,IAAa;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,4DAA4D;QAE5D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,sFAAsF;YACtF,IACE,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;oBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,EACzD,CAAC;gBACD,OAAO;oBACL,SAAS,EAAE,MAAM,SAAS,CACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB;oBACD,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC3C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6CAA6C;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,eAAqB,EAAE,MAAe;QACrD,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC;YAE5D,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC1C,SAAS;oBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gHAAgH;IAChH,iGAAiG;IACjG,gCAAgC;IAChC,sFAAsF;IACtF,wFAAwF;IACxF,8DAA8D;IAC9D,KAAK,CAAC,sBAAsB,CAC1B,SAAe,EACf,IAAqB,EACrB,sBAAuC;QAEvC,IAAI,SAAc,CAAC;QAEnB,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;YACxC,oDAAoD;YACpD,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;oBAC5C,YAAY,EAAE,EAAE,CAAC,SAAS;oBAC1B,aAAa,EAAE,IAAI;oBACnB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,qEAAqE;IACrE,qGAAqG;IACrG,0GAA0G;IAC1G,OAAO,CACL,eAAqB,EACrB,IAA8B;QAE9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAEvF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oFAAoF;IACpF,mFAAmF;IACnF,2FAA2F;IAC3F,wFAAwF;IACxF,+DAA+D;IAC/D,MAAM,CAAC,eAAqB,EAAE,GAAW;QACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAErF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACrD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QACzC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7E,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,eAAe,EACf,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAC9C;YACD,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,oBAAoB,CAAC;SAClF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAiC;QAC7D,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,gGAAgG;IAChG,mBAAmB;IACnB,iCAAiC;IACjC,yCAAyC;IACzC,gGAAgG;IAChG,6FAA6F;IAC7F,KAAK,CAAC,SAAS,CACb,IAAqB,EACrB,MAAuB,EACvB,MAAe;QAEf,IAAI,MAAoC,CAAC;QAEzC,kEAAkE;QAClE,uEAAuE;QACvE,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAEnC,4CAA4C;gBAC5C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,gEAAgE;QAChE,IAAI,MAAM,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,kCAAkC;QAClC,qDAAqD;QACrD,MAAM,OAAO,GAAG,IAAI,UAAU,EAAE,CAAC;QAEjC,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAoC,CAAC,CAC/F,CAAC;QACF,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7B,qEAAqE;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAExB,uDAAuD;QACvD,MAAM,YAAY,GAAiB,EAAE,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,mDAAmD;YACnD,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClE,SAAS,CAAC,6CAA6C;YACzD,CAAC;YAED,mFAAmF;YACnF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,yBAAyB;gBACzB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAClD,CAAC;gBACD,kEAAkE;gBAClE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChF,CAAC,CAAC,CAAC;YAEH,sCAAsC;YACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpD,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM,CAAC,iCAAiC;oBAC1C,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,6BAA6B;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAAqB,EACrB,MAAsB,EACtB,KAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAExD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,gBAAgB,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,MAAM,MAAM,gBAAgB,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,cAAc,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAEzB,wCAAwC;QACxC,+DAA+D;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7D,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QAEtD,2CAA2C;QAC3C,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;YAClD,oEAAoE;YACpE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,+DAA+D;YAC/D,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACnC,0DAA0D;gBAC1D,6CAA6C;YAC/C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,CAAC;gBAED,uEAAuE;gBACvE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,sCAAsC,eAAe,CAAC,UAAU,CAAC,0BAA0B,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC1H,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,CAAC,oBAAoB,CAC5C,CAAC;gBAEF,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAEpD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,YAAY,CAAC;oBACX,IAAI,EAAE,KAAK,CAAC,iBAAiB;oBAC7B,cAAc,EAAE,cAAc;oBAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChC,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,sEAAsE;QACtE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAE7F,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,iBAAqC,CAAC;YAE1C,kDAAkD;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACnE,IAAI,QAAQ,EAAE,eAAe,EAAE,CAAC;oBAC9B,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,yCAAyC;iBACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC5C,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;YAChE,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,mEAAmE;gBACnE,uEAAuE;gBACvE,IAAI,UAA2B,CAAC;gBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACnC,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAC5E,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpC,4CAA4C;YAC5C,yEAAyE;YACzE,kCAAkC;QACpC,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,+EAA+E;YAC/E,kFAAkF;YAClF,+EAA+E;YAC/E,6EAA6E;QAC/E,CAAC;aAAM,CAAC;YACN,6EAA6E;YAC7E,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAEzD,kEAAkE;QAClE,kFAAkF;QAClF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAEnC,IAAI,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;gBACpC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAgB,EAChB,MAAc,EACd,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAE7B,8EAA8E;QAE9E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW;YAClD,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE7E,iFAAiF;QACjF,IAAI,SAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,kBAAkB;QAClB,IAAI,WAAW,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,EAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC;QAClG,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,wDAAwD;QACxD,iFAAiF;QACjF,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,WAAW,CAAC,SAAS,EACrB,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACjC,CAAC;QAEF,iGAAiG;QACjG,6EAA6E;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,CAAC,MAAM,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAExC,gCAAgC;QAChC,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,cAAc,CAClB,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,EAC1C,MAAM,CACP,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,iBAAmC,CAAC;QACxC,IAAI,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EAAE,CAAC;YAC1D,mCAAmC;YACnC,iBAAiB,GAAG,MAAM,qBAAqB,CAC7C,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EACrD,SAAS,EACT,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CACzC,CAAC;YAEF,2EAA2E;YAC3E,IAAI,iBAAiB,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAEhE,6BAA6B;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,sDAAsD;YACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YAE7D,wEAAwE;YACxE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YAED,yCAAyC;YACzC,IAAI,cAAsB,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,mCAAmC;gBACnC,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,+CAA+C;gBAC/C,cAAc,GAAG,eAAe,CAC9B,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAA+B,CAAC,CAAC,CACnG,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,cAAc,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,aAAa,IAAI,cAAc,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpE,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,cAAc,6CAA6C,CAC/E,CAAC;YACJ,CAAC;YAED,sEAAsE;YACtE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YAEjD,IAAI,YAAY,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,kBAAkB,IAAI,CAAC,MAAM,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sigstore.js","sourceRoot":"","sources":["../src/sigstore.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAQL,aAAa,GAEd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D;;;GAGG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;QACf,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;QACf,KAAK,GAAG,eAAe,mBAAmB;YACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,eAAe,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,SAAS;aACtB,OAAO,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;aACnC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,6DAA6D;QAC7D,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,MAAM,OAAO,gBAAgB;IACnB,IAAI,CAAuB;IAC3B,OAAO,CAA0B;IACjC,OAAO,CAAoC;IAEnD,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG;YACb,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,eAAqB,EAAE,IAAa;QAChD,iFAAiF;QACjF,gFAAgF;QAChF,4DAA4D;QAE5D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,sFAAsF;YACtF,IACE,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;oBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,EACzD,CAAC;gBACD,OAAO;oBACL,SAAS,EAAE,MAAM,SAAS,CACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB;oBACD,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC3C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6CAA6C;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,eAAqB,EAAE,MAAe;QACrD,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC;YAE5D,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,UAAU,EACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CACvB,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC1C,SAAS;oBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gHAAgH;IAChH,iGAAiG;IACjG,gCAAgC;IAChC,sFAAsF;IACtF,wFAAwF;IACxF,8DAA8D;IAC9D,KAAK,CAAC,sBAAsB,CAC1B,SAAe,EACf,IAAqB,EACrB,sBAAuC;QAEvC,IAAI,SAAc,CAAC;QAEnB,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;YACxC,oDAAoD;YACpD,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;oBAC5C,YAAY,EAAE,EAAE,CAAC,SAAS;oBAC1B,aAAa,EAAE,IAAI;oBACnB,SAAS;iBACV,CAAC,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,qEAAqE;IACrE,qGAAqG;IACrG,0GAA0G;IAC1G,OAAO,CACL,eAAqB,EACrB,IAA8B;QAE9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAEvF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oFAAoF;IACpF,mFAAmF;IACnF,2FAA2F;IAC3F,wFAAwF;IACxF,+DAA+D;IAC/D,MAAM,CAAC,eAAqB,EAAE,GAAW;QACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAErF,IAAI,eAAe,GAAG,KAAK,IAAI,eAAe,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACrD,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;gBAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS;wBACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAoB;QACzC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7E,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,eAAe,EACf,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAC9C;YACD,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,oBAAoB,CAAC;SAClF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAiC;QAC7D,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,gGAAgG;IAChG,mBAAmB;IACnB,oDAAoD;IACpD,gGAAgG;IAChG,6FAA6F;IAC7F,KAAK,CAAC,SAAS,CACb,IAAqB,EACrB,MAAuB,EACvB,MAAe;QAEf,IAAI,MAAoC,CAAC;QAEzC,kEAAkE;QAClE,uEAAuE;QACvE,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEhC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAEnC,4CAA4C;gBAC5C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,gEAAgE;QAChE,IAAI,MAAM,CAAC,2BAA2B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,kCAAkC;QAClC,qDAAqD;QACrD,MAAM,OAAO,GAAG,IAAI,UAAU,EAAE,CAAC;QAEjC,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAoC,CAAC,CAC/F,CAAC;QACF,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7B,qEAAqE;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAExB,6DAA6D;QAC7D,iFAAiF;QACjF,+DAA+D;QAC/D,MAAM,YAAY,GAAiB,EAAE,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrD,mFAAmF;YACnF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,yBAAyB;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzD,kEAAkE;gBAClE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChF,CAAC,CAAC,CAAC;YAEH,iDAAiD;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;gBACjC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BACpD,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,6BAA6B;oBAC/B,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,EAAE,CAAC;YAEL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAAqB,EACrB,MAAsB,EACtB,KAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAExD,8DAA8D;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,gBAAgB,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,MAAM,MAAM,gBAAgB,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,cAAc,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAEzB,wCAAwC;QACxC,8FAA8F;QAC9F,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;QAEtD,2CAA2C;QAC3C,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;YAClD,oEAAoE;YACpE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,+DAA+D;YAC/D,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACnC,0DAA0D;gBAC1D,6CAA6C;YAC/C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,CAAC;gBAED,uEAAuE;gBACvE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,sCAAsC,eAAe,CAAC,UAAU,CAAC,0BAA0B,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC1H,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,CAAC,oBAAoB,CAC5C,CAAC;gBAEF,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAEpD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,YAAY,CAAC;oBACX,IAAI,EAAE,KAAK,CAAC,iBAAiB;oBAC7B,cAAc,EAAE,cAAc;oBAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChC,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,sEAAsE;QACtE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAE7F,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,iBAAqC,CAAC;YAE1C,kDAAkD;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACnE,IAAI,QAAQ,EAAE,eAAe,EAAE,CAAC;oBAC9B,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,yCAAyC;iBACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC5C,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;YAChE,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,mEAAmE;gBACnE,uEAAuE;gBACvE,IAAI,UAA2B,CAAC;gBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACnC,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAC5E,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpC,kFAAkF;YAClF,gFAAgF;YAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YAChE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,sGAAsG;YACtG,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;YACrF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC3E,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,6EAA6E;YAC7E,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,iEAAiE;QACjE,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,kEAAkE;YAClE,kFAAkF;YAClF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAEnC,IAAI,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;oBACpC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAgB,EAChB,MAAc,EACd,MAAsB,EACtB,IAAgB,EAChB,eAAwB,KAAK;QAE7B,8EAA8E;QAE9E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW;YAClD,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE7E,iFAAiF;QACjF,IAAI,SAAqB,CAAC;QAC1B,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,kBAAkB;QAClB,IAAI,WAAW,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,EAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC;QAClG,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,wDAAwD;QACxD,iFAAiF;QACjF,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAChD,WAAW,CAAC,SAAS,EACrB,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACjC,CAAC;QAEF,iGAAiG;QACjG,6EAA6E;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gCAAgC,YAAY,CAAC,MAAM,cAAc,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAExC,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,iCAAiC;QACjC,8CAA8C;QAC9C,yGAAyG;QACzG,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CACpD,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,EACrD,SAAS,EACT,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CACzC,CAAC;QAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,uCAAuC,kBAAkB,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,oFAAoF;QACpF,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAEhE,6BAA6B;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,sDAAsD;YACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YAE7D,wEAAwE;YACxE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YAED,yCAAyC;YACzC,IAAI,cAAsB,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,mCAAmC;gBACnC,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,+CAA+C;gBAC/C,cAAc,GAAG,eAAe,CAC9B,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAA+B,CAAC,CAAC,CACnG,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,cAAc,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,aAAa,IAAI,cAAc,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpE,cAAc,GAAG,OAAO,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,cAAc,6CAA6C,CAC/E,CAAC;YACJ,CAAC;YAED,sEAAsE;YACtE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAE3E,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YAEjD,IAAI,YAAY,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,kBAAkB,IAAI,CAAC,MAAM,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/timestamp/tsa.d.ts

@@ -11,14 +11,16 @@ import { RFC3161Timestamp } from "../rfc3161/index.js";
  */
 export declare function verifyRFC3161Timestamp(timestamp: RFC3161Timestamp, data: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date>;
 /**
- * Extracts the verified timestamp from a bundle's timestamp verification data
+ * Verifies all timestamps in a bundle's timestamp verification data
  *
- * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ * Matches sigstore-js behavior: all timestamps must successfully verify.
+ * Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L64-L108
  *
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns The verified signing time, or undefined if no timestamp
+ * @returns Array of verified signing times (empty if no timestamps present)
+ * @throws Error if any timestamp fails verification or duplicates are found
  */
-export declare function verifyBundleTimestamp(timestampData: any, signature: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date | undefined>;
+export declare function verifyBundleTimestamp(timestampData: any, signature: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date[]>;
 //# sourceMappingURL=tsa.d.ts.map

package/dist/timestamp/tsa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tsa.d.ts","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,UAAU,EAChB,oBAAoB,EAAE,qBAAqB,EAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAgCf;AAwFD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,GAAG,EAClB,SAAS,EAAE,UAAU,EACrB,oBAAoB,EAAE,qBAAqB,EAAE,GAC5C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAoC3B"}
+{"version":3,"file":"tsa.d.ts","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,UAAU,EAChB,oBAAoB,EAAE,qBAAqB,EAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAgCf;AAwFD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,GAAG,EAClB,SAAS,EAAE,UAAU,EACrB,oBAAoB,EAAE,qBAAqB,EAAE,GAC5C,OAAO,CAAC,IAAI,EAAE,CAAC,CAyCjB"}

package/dist/timestamp/tsa.js

@@ -107,43 +107,45 @@ async function verifyTimestampForCA(timestamp, data, ca) {
     await timestamp.verify(data, publicKey);
 }
 /**
- * Extracts the verified timestamp from a bundle's timestamp verification data
+ * Verifies all timestamps in a bundle's timestamp verification data
  *
- * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ * Matches sigstore-js behavior: all timestamps must successfully verify.
+ * Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L64-L108
  *
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns The verified signing time, or undefined if no timestamp
+ * @returns Array of verified signing times (empty if no timestamps present)
+ * @throws Error if any timestamp fails verification or duplicates are found
  */
 export async function verifyBundleTimestamp(timestampData, signature, timestampAuthorities) {
     if (!timestampData?.rfc3161Timestamps?.length) {
-        return undefined;
+        return [];
     }
-    // Check for duplicate timestamps
-    const seenTimestamps = new Set();
+    // Verify ALL timestamps - each must succeed (matches sigstore-js behavior)
+    // Collect verification results for duplicate checking after verification
+    // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L86-L92
+    const verifiedResults = [];
     for (const tsData of timestampData.rfc3161Timestamps) {
-        if (seenTimestamps.has(tsData.signedTimestamp)) {
-            throw new Error("Duplicate TSA timestamp detected");
-        }
-        seenTimestamps.add(tsData.signedTimestamp);
+        // Decode the base64-encoded timestamp
+        const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
+        const timestamp = RFC3161Timestamp.parse(timestampBytes);
+        const signingTime = await verifyRFC3161Timestamp(timestamp, signature, timestampAuthorities);
+        verifiedResults.push({
+            signingTime,
+            signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),
+        });
     }
-    // Process each RFC3161 timestamp
-    const errors = [];
-    for (const tsData of timestampData.rfc3161Timestamps) {
-        try {
-            // Decode the base64-encoded timestamp
-            const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
-            const timestamp = RFC3161Timestamp.parse(timestampBytes);
-            const signingTime = await verifyRFC3161Timestamp(timestamp, signature, timestampAuthorities);
-            return signingTime;
-        }
-        catch (e) {
-            // Continue to next timestamp if this one fails
-            errors.push(e instanceof Error ? e.message : String(e));
-            continue;
+    // Check for duplicate timestamps using deep equality on parsed values
+    // sigstore-js uses isDeepStrictEqual on {type, logID, timestamp} objects
+    for (let i = 0; i < verifiedResults.length; i++) {
+        for (let j = i + 1; j < verifiedResults.length; j++) {
+            if (verifiedResults[i].signingTime.getTime() === verifiedResults[j].signingTime.getTime() &&
+                verifiedResults[i].signerSerialNumber === verifiedResults[j].signerSerialNumber) {
+                throw new Error("Duplicate TSA timestamp detected");
+            }
         }
     }
-    throw new Error(`No valid RFC3161 timestamps found. Errors: ${errors.join(', ')}`);
+    return verifiedResults.map(r => r.signingTime);
 }
 //# sourceMappingURL=tsa.js.map

package/dist/timestamp/tsa.js.map

@@ -1 +1 @@
-{"version":3,"file":"tsa.js","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,IAAgB,EAChB,oBAA6C;IAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,yDAAyD;IACzD,IAAI,gBAAgB,GAAG,qBAAqB,CAC1C,oBAAoB,EACpB,WAAW,CACZ,CAAC;IAEF,yEAAyE;IACzE,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,EAAE;QAC9D,YAAY,EAAE,SAAS,CAAC,kBAAkB;QAC1C,MAAM,EAAE,SAAS,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,UAAU,CAClD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CACxC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,mBAAmB;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAA2B,CAAC,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0EAA0E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,OAAa;IAEb,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE/D,IAAI,KAAK,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,oBAA6C,EAC7C,QAA0D;IAE1D,OAAO,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,OAAO,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC7D,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAA2B,EAC3B,IAAgB,EAChB,EAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY;SAC3C,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;YAC5C,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;IAE9C,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAkB,EAClB,SAAqB,EACrB,oBAA6C;IAE7C,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEzD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,SAAS,EACT,SAAS,EACT,oBAAoB,CACrB,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"tsa.js","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,IAAgB,EAChB,oBAA6C;IAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,yDAAyD;IACzD,IAAI,gBAAgB,GAAG,qBAAqB,CAC1C,oBAAoB,EACpB,WAAW,CACZ,CAAC;IAEF,yEAAyE;IACzE,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,EAAE;QAC9D,YAAY,EAAE,SAAS,CAAC,kBAAkB;QAC1C,MAAM,EAAE,SAAS,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,UAAU,CAClD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CACxC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,mBAAmB;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAA2B,CAAC,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0EAA0E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,OAAa;IAEb,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE/D,IAAI,KAAK,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,oBAA6C,EAC7C,QAA0D;IAE1D,OAAO,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,OAAO,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC7D,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAA2B,EAC3B,IAAgB,EAChB,EAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY;SAC3C,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;YAC5C,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;IAE9C,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAkB,EAClB,SAAqB,EACrB,oBAA6C;IAE7C,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,uGAAuG;IACvG,MAAM,eAAe,GAA6D,EAAE,CAAC;IAErF,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,sCAAsC;QACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,SAAS,EACT,SAAS,EACT,oBAAoB,CACrB,CAAC;QAEF,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW;YACX,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IACE,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE;gBACrF,eAAe,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAC/E,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC"}

package/dist/tlog/dsse.js

@@ -11,7 +11,7 @@
  * - Adds verifyDSSE002Body() - new functionality (reference only supports v0.0.1)
  */
 import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
+import { getHashAlgorithm } from "../interfaces.js";
 export async function verifyDSSEBody(entry, bundle) {
     const dsseEntry = entry;
     switch (dsseEntry.apiVersion) {
@@ -39,13 +39,13 @@ async function verifyDSSE001Body(entry, bundle) {
     if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
         throw new Error("DSSE signature mismatch between TLog entry and bundle");
     }
-    const tlogHash = entry.spec.payloadHash?.value || "";
-    if (!tlogHash) {
-        throw new Error("DSSE entry missing payloadHash");
+    if (!entry.spec.payloadHash?.value || !entry.spec.payloadHash?.algorithm) {
+        throw new Error("DSSE entry missing payloadHash or algorithm");
     }
-    const tlogHashBytes = hexToUint8Array(tlogHash);
+    const hashAlg = getHashAlgorithm(entry.spec.payloadHash.algorithm);
+    const tlogHashBytes = hexToUint8Array(entry.spec.payloadHash.value);
     const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
-    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes));
+    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
     if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
         throw new Error("DSSE payload hash mismatch between TLog entry and bundle");
     }
@@ -71,13 +71,13 @@ async function verifyDSSE002Body(entry, bundle) {
     if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
         throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
     }
-    const tlogHash = spec.payloadHash?.digest || "";
-    if (!tlogHash) {
-        throw new Error("DSSE v0.0.2 entry missing payloadHash");
+    if (!spec.payloadHash?.digest || !spec.payloadHash?.algorithm) {
+        throw new Error("DSSE v0.0.2 entry missing payloadHash or algorithm");
     }
-    const tlogHashBytes = base64ToUint8Array(tlogHash);
+    const hashAlg = getHashAlgorithm(spec.payloadHash.algorithm);
+    const tlogHashBytes = base64ToUint8Array(spec.payloadHash.digest);
     const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
-    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes));
+    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
     if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
         throw new Error("DSSE payload hash mismatch between TLog entry and bundle (v0.0.2)");
     }

package/dist/tlog/dsse.js.map

@@ -1 +1 @@
-{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,SAAS,GAAG,KAAkB,CAAC;IAErC,QAAQ,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C;YACE,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,CAAC,UAAU,EAAE,CACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,YAAuC,CAAC,CAC3F,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAI,KAAK,CAAC,IAAY,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,YAAuC,CAAC,CAC3F,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA0BpD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,SAAS,GAAG,KAAkB,CAAC;IAErC,QAAQ,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C;YACE,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,CAAC,UAAU,EAAE,CACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAuC,CAAC,CAC7E,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAI,KAAK,CAAC,IAAY,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAuC,CAAC,CAC7E,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/tlog/intoto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intoto.d.ts","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiC5C,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAkDf"}
+{"version":3,"file":"intoto.d.ts","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiC5C,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAsDf"}

package/dist/tlog/intoto.js

@@ -10,7 +10,7 @@
  * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
  */
 import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
+import { getHashAlgorithm } from "../interfaces.js";
 export async function verifyIntotoBody(entry, bundle) {
     const intotoEntry = entry;
     if (intotoEntry.apiVersion !== "0.0.2") {
@@ -38,10 +38,13 @@ export async function verifyIntotoBody(entry, bundle) {
         throw new Error("Intoto signature mismatch between TLog entry and bundle");
     }
     if (intotoEntry.spec.content.payloadHash) {
-        const tlogHash = intotoEntry.spec.content.payloadHash.value;
-        const tlogHashBytes = hexToUint8Array(tlogHash);
+        if (!intotoEntry.spec.content.payloadHash.algorithm) {
+            throw new Error("Intoto entry missing payloadHash algorithm");
+        }
+        const hashAlg = getHashAlgorithm(intotoEntry.spec.content.payloadHash.algorithm);
+        const tlogHashBytes = hexToUint8Array(intotoEntry.spec.content.payloadHash.value);
         const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
-        const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes));
+        const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
         if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
             throw new Error("Intoto payload hash mismatch between TLog entry and bundle");
         }

package/dist/tlog/intoto.js.map

@@ -1 +1 @@
-{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAmClD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,WAAW,GAAG,KAAoB,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,CAAC,UAAU,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,+DAA+D;IACnH,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,4CAA4C;IAErG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAC5D,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,YAAuC,CAAC,CAC3F,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAmCpD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,WAAW,GAAG,KAAoB,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,CAAC,UAAU,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,+DAA+D;IACnH,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,4CAA4C;IAErG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAuC,CAAC,CAC7E,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/x509/sct.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sct.d.ts","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAiBA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEnB,OAAO,EAAE,UAAU;IAU/B,IAAI,QAAQ,IAAI,IAAI,CAEnB;IAID,IAAI,SAAS,IAAI,MAAM,CA0BtB;IAEY,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;WA8B5D,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B;CAyCjE"}
+{"version":3,"file":"sct.d.ts","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAiBA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEnB,OAAO,EAAE,UAAU;IAU/B,IAAI,QAAQ,IAAI,IAAI,CAEnB;IAID,IAAI,SAAS,IAAI,MAAM,CA0BtB;IAEY,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;WA8B5D,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B;CA6CjE"}

package/dist/x509/sct.js

@@ -88,7 +88,11 @@ export class SignedCertificateTimestamp {
     static parse(buf) {
         const stream = new ByteStream(buf);
         // Version - enum { v1(0), (255) }
+        // RFC 6962 specifies only v1(0) is valid (for now)
         const version = stream.getUint8();
+        if (version !== 0) {
+            throw new Error(`Unsupported SCT version: ${version} (expected 0 for v1)`);
+        }
         // Log ID  - struct { opaque key_id[32]; }
         const logID = stream.getBlock(32);
         // Timestamp - uint64

package/dist/x509/sct.js.map

@@ -1 +1 @@
-{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IAC5B,OAAO,CAAS;IAChB,KAAK,CAAa;IAClB,SAAS,CAAa;IACtB,UAAU,CAAa;IACvB,aAAa,CAAS;IACtB,kBAAkB,CAAS;IAC3B,SAAS,CAAa;IAE/B,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElC,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAElC,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErC,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAErD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExC,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE7C,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IAC5B,OAAO,CAAS;IAChB,KAAK,CAAa;IAClB,SAAS,CAAa;IACtB,UAAU,CAAa;IACvB,aAAa,CAAS;IACtB,kBAAkB,CAAS;IAC3B,SAAS,CAAa;IAE/B,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,sBAAsB,CAAC,CAAC;QAC7E,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAElC,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErC,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAErD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExC,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE7C,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF"}

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@freedomofpress/sigstore-browser",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "A minimal browser-only Sigstore verification library.",
+  "repository": {
+      "type": "git",
+      "url": "https://github.com/freedomofpress/sigstore-browser"
+  },
   "main": "dist/index.js",
   "type": "module",
   "exports": {

package/src/interfaces.ts

@@ -101,3 +101,23 @@ export type RawCAs = RawCA[];
 
 // Re-export crypto enums from crypto-browser (shared with tuf-browser)
 export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+import { HashAlgorithms } from "@freedomofpress/crypto-browser";
+
+// Supported hash algorithms for payload hash validation
+// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)
+const SUPPORTED_HASH_ALGORITHMS: Record<string, string> = {
+  "sha256": HashAlgorithms.SHA256,
+  "sha384": HashAlgorithms.SHA384,
+  "sha512": HashAlgorithms.SHA512,
+  "SHA2_256": HashAlgorithms.SHA256,
+  "SHA2_384": HashAlgorithms.SHA384,
+  "SHA2_512": HashAlgorithms.SHA512,
+};
+
+export function getHashAlgorithm(algorithm: string): string {
+  const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];
+  if (!hashAlg) {
+    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
+  }
+  return hashAlg;
+}

package/src/sigstore.ts

@@ -36,6 +36,37 @@ import { verifyTLogBody } from "./tlog/body.js";
 import { verifyBundleTimestamp } from "./timestamp/tsa.js";
 import { TrustedRootProvider } from "./trust/tuf.js";
 
+const MEDIA_TYPE_BASE = "application/vnd.dev.sigstore.bundle";
+
+/**
+ * Extract bundle version from mediaType string
+ * Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177
+ */
+function getBundleVersion(mediaType: string): string {
+  switch (mediaType) {
+    case `${MEDIA_TYPE_BASE}+json;version=0.1`:
+      return "0.1";
+    case `${MEDIA_TYPE_BASE}+json;version=0.2`:
+      return "0.2";
+    case `${MEDIA_TYPE_BASE}+json;version=0.3`:
+      return "0.3";
+  }
+
+  // New format: "application/vnd.dev.sigstore.bundle.v0.3+json"
+  if (mediaType.startsWith(`${MEDIA_TYPE_BASE}.v`) && mediaType.endsWith("+json")) {
+    const version = mediaType
+      .replace(`${MEDIA_TYPE_BASE}.v`, "")
+      .replace("+json", "");
+    // Basic semver validation (major.minor or major.minor.patch)
+    if (/^\d+\.\d+(\.\d+)?$/.test(version)) {
+      return version;
+    }
+  }
+
+  // Default to 0.1 for unknown formats
+  return "0.1";
+}
+
 export interface SigstoreVerifierOptions {
   tlogThreshold?: number;
   ctlogThreshold?: number;
@@ -244,8 +275,7 @@ export class SigstoreVerifier {
 
   // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/sct.ts
   // Key differences:
-  // - Adds duplicate SCT detection
-  // - Adds SCT timestamp validity checking
+  // - Adds duplicate SCT detection (not in reference)
   // - Inline CT log filtering by logID and validity period (reference uses filterTLogAuthorities)
   // - Returns array of verified SCT logIDs for threshold checking (matches reference behavior)
   async verifySCT(
@@ -312,42 +342,39 @@ export class SigstoreVerifier {
     preCert.appendUint24(tbs.length);
     preCert.appendView(tbs);
 
-    // Collect all verified SCTs to check against threshold
+    // Calculate and return the verification results for each SCT
+    // Unlike sigstore-go which counts verified SCTs and checks threshold at the end,
+    // sigstore-js throws immediately if any SCT fails verification
     const verifiedSCTs: Uint8Array[] = [];
 
     for (const sct of extSCT.signedCertificateTimestamps) {
-      // SCT should be within certificate validity period
-      if (sct.datetime < cert.notBefore || sct.datetime > cert.notAfter) {
-        continue; // Skip invalid SCT timestamp, don't fail yet
-      }
-
       // Find the CT log that matches this SCT's log ID and is valid for the SCT datetime
       const validCTLogs = ctlogs.filter((log) => {
         // Check if log IDs match
-        if (log.logID.length !== sct.logID.length) return false;
-        for (let i = 0; i < log.logID.length; i++) {
-          if (log.logID[i] !== sct.logID[i]) return false;
-        }
+        if (!uint8ArrayEqual(log.logID, sct.logID)) return false;
         // Check that the SCT datetime is within the log's validity period
         return log.validFor.start <= sct.datetime && sct.datetime <= log.validFor.end;
       });
 
-      // Try to verify with any valid CT log
-      let verified = false;
-      for (const log of validCTLogs) {
-        try {
-          if (await sct.verify(preCert.buffer, log.publicKey)) {
-            verified = true;
-            break; // Found a valid log for this SCT
+      // See if the SCT is valid for any of the CT logs
+      const verified = await (async () => {
+        for (const log of validCTLogs) {
+          try {
+            if (await sct.verify(preCert.buffer, log.publicKey)) {
+              return true;
+            }
+          } catch {
+            // Continue trying other logs
           }
-        } catch (e) {
-          // Continue trying other logs
         }
-      }
+        return false;
+      })();
 
-      if (verified) {
-        verifiedSCTs.push(sct.logID);
+      if (!verified) {
+        throw new Error("SCT verification failed");
       }
+
+      verifiedSCTs.push(sct.logID);
     }
 
     return verifiedSCTs;
@@ -360,9 +387,10 @@ export class SigstoreVerifier {
   ): Promise<boolean> {
     const entries = bundle.verificationMaterial.tlogEntries;
 
-    if (entries.length < 1) {
+    // Check that bundle has enough tlog entries to meet threshold
+    if (entries.length < this.options.tlogThreshold) {
       throw new Error(
-        "Failed to find a transparency log entry in the provided bundle.",
+        `Not enough tlog entries: ${entries.length} < ${this.options.tlogThreshold}`,
       );
     }
 
@@ -390,9 +418,8 @@ export class SigstoreVerifier {
     const entry = entries[0];
 
     // Extract bundle version from mediaType
-    // e.g., "application/vnd.dev.sigstore.bundle+json;version=0.2"
-    const versionMatch = bundle.mediaType.match(/version=(\d+\.\d+)/);
-    const bundleVersion = versionMatch ? versionMatch[1] : "0.1";
+    // Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/bundle/bundle.go#L159-L177
+    const bundleVersion = getBundleVersion(bundle.mediaType);
     const isV02OrLater = parseFloat(bundleVersion) >= 0.2;
 
     // Bundle v0.2+ requires an inclusion proof
@@ -512,14 +539,31 @@ export class SigstoreVerifier {
         }
       }
     } else if (bodyJson.kind === "dsse") {
-      // DSSE entries store signatures differently
-      // The certificate is verified through the bundle's verification material
-      // No additional check needed here
+      // DSSE v0.0.1: certificate is in spec.signatures[0].verifier (base64-encoded PEM)
+      // https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go#L356-L357
+      const verifierContent = bodyJson.spec.signatures?.[0]?.verifier;
+      if (verifierContent) {
+        const pemString = Uint8ArrayToString(base64ToUint8Array(verifierContent));
+        const loggedCert = X509Certificate.parse(pemString);
+        if (!cert.equals(loggedCert)) {
+          throw new Error(
+            "Certificate in DSSE tlog entry does not match the signing certificate.",
+          );
+        }
+      }
     } else if (bodyJson.kind === "intoto") {
-      // Intoto entries are DSSE-based and don't store certificates in the tlog entry
-      // The certificate is part of the bundle's verification material which has already
-      // been verified against the CA root. The intoto verification in tlog/intoto.ts
-      // verifies the signature and payload hash match between the tlog and bundle.
+      // intoto v0.0.2: certificate is in spec.content.envelope.signatures[0].publicKey (base64-encoded PEM)
+      // https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go#L360-L361
+      const publicKeyContent = bodyJson.spec.content?.envelope?.signatures?.[0]?.publicKey;
+      if (publicKeyContent) {
+        const pemString = Uint8ArrayToString(base64ToUint8Array(publicKeyContent));
+        const loggedCert = X509Certificate.parse(pemString);
+        if (!cert.equals(loggedCert)) {
+          throw new Error(
+            "Certificate in intoto tlog entry does not match the signing certificate.",
+          );
+        }
+      }
     } else {
       // Unknown entry type - this should not happen with standard Sigstore bundles
       throw new Error(`Unsupported tlog entry kind: ${bodyJson.kind}`);
@@ -537,15 +581,17 @@ export class SigstoreVerifier {
       throw new Error("No transparency log entries found in bundle");
     }
 
-    const entry = bundle.verificationMaterial.tlogEntries[0];
+    // Verify inclusion proof for ALL entries, not just the first one
+    // Reference: https://github.com/sigstore/sigstore-go/blob/main/pkg/verify/tlog.go#L74-L127
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
+      // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
+      if (entry.inclusionProof) {
+        await verifyMerkleInclusion(entry);
 
-    // Only verify if there's an inclusion proof (v0.3/rekor2 bundles)
-    // v0.1 bundles use inclusion promises instead, verified in verifyInclusionPromise
-    if (entry.inclusionProof) {
-      await verifyMerkleInclusion(entry);
-
-      if (entry.inclusionProof.checkpoint) {
-        await verifyCheckpoint(entry, this.rawRoot.tlogs);
+        if (entry.inclusionProof.checkpoint) {
+          await verifyCheckpoint(entry, this.rawRoot.tlogs);
+        }
       }
     }
   }
@@ -629,26 +675,29 @@ export class SigstoreVerifier {
     // # 5 Rekor inclusion proof (Merkle tree verification)
     await this.verifyInclusionProof(bundle);
 
-    // # 5.1 Rekor body verification
-    if (bundle.verificationMaterial.tlogEntries.length > 0) {
-      await verifyTLogBody(
-        bundle.verificationMaterial.tlogEntries[0],
-        bundle
-      );
+    // # 5.1 Rekor body verification - verify ALL entries (matches sigstore-js verifier.ts:147)
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      await verifyTLogBody(entry, bundle);
     }
 
-    // # 6 TSA Timestamp Verification (if present)
-    let verifiedTimestamp: Date | undefined;
-    if (bundle.verificationMaterial.timestampVerificationData) {
-      // Verify TSA timestamps if present
-      verifiedTimestamp = await verifyBundleTimestamp(
-        bundle.verificationMaterial.timestampVerificationData,
-        signature,
-        this.rawRoot?.timestampAuthorities || []
+    // # 6 TSA Timestamp Verification
+    // Verify all timestamps and enforce threshold
+    // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L101-L106
+    const verifiedTimestamps = await verifyBundleTimestamp(
+      bundle.verificationMaterial.timestampVerificationData,
+      signature,
+      this.rawRoot?.timestampAuthorities || []
+    );
+
+    if (verifiedTimestamps.length < this.options.tsaThreshold) {
+      throw new Error(
+        `Not enough verified TSA timestamps: ${verifiedTimestamps.length} < ${this.options.tsaThreshold}`
       );
+    }
 
-      // If we have a verified timestamp, check certificate validity at that time
-      if (verifiedTimestamp && !signingCert.validForDate(verifiedTimestamp)) {
+    // If we have verified timestamps, check certificate validity at each timestamp time
+    for (const verifiedTimestamp of verifiedTimestamps) {
+      if (!signingCert.validForDate(verifiedTimestamp)) {
         throw new Error(
           "Certificate was not valid at the time of timestamping"
         );

package/src/timestamp/tsa.ts

@@ -152,53 +152,60 @@ async function verifyTimestampForCA(
 }
 
 /**
- * Extracts the verified timestamp from a bundle's timestamp verification data
+ * Verifies all timestamps in a bundle's timestamp verification data
  *
- * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ * Matches sigstore-js behavior: all timestamps must successfully verify.
+ * Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L64-L108
  *
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns The verified signing time, or undefined if no timestamp
+ * @returns Array of verified signing times (empty if no timestamps present)
+ * @throws Error if any timestamp fails verification or duplicates are found
  */
 export async function verifyBundleTimestamp(
   timestampData: any,
   signature: Uint8Array,
   timestampAuthorities: RawTimestampAuthority[]
-): Promise<Date | undefined> {
+): Promise<Date[]> {
   if (!timestampData?.rfc3161Timestamps?.length) {
-    return undefined;
+    return [];
   }
 
-  // Check for duplicate timestamps
-  const seenTimestamps = new Set<string>();
+  // Verify ALL timestamps - each must succeed (matches sigstore-js behavior)
+  // Collect verification results for duplicate checking after verification
+  // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L86-L92
+  const verifiedResults: Array<{ signingTime: Date; signerSerialNumber: string }> = [];
+
   for (const tsData of timestampData.rfc3161Timestamps) {
-    if (seenTimestamps.has(tsData.signedTimestamp)) {
-      throw new Error("Duplicate TSA timestamp detected");
-    }
-    seenTimestamps.add(tsData.signedTimestamp);
+    // Decode the base64-encoded timestamp
+    const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
+    const timestamp = RFC3161Timestamp.parse(timestampBytes);
+
+    const signingTime = await verifyRFC3161Timestamp(
+      timestamp,
+      signature,
+      timestampAuthorities
+    );
+
+    verifiedResults.push({
+      signingTime,
+      signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),
+    });
   }
 
-  // Process each RFC3161 timestamp
-  const errors: string[] = [];
-  for (const tsData of timestampData.rfc3161Timestamps) {
-    try {
-      // Decode the base64-encoded timestamp
-      const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
-      const timestamp = RFC3161Timestamp.parse(timestampBytes);
-
-      const signingTime = await verifyRFC3161Timestamp(
-        timestamp,
-        signature,
-        timestampAuthorities
-      );
-      return signingTime;
-    } catch (e) {
-      // Continue to next timestamp if this one fails
-      errors.push(e instanceof Error ? e.message : String(e));
-      continue;
+  // Check for duplicate timestamps using deep equality on parsed values
+  // sigstore-js uses isDeepStrictEqual on {type, logID, timestamp} objects
+  for (let i = 0; i < verifiedResults.length; i++) {
+    for (let j = i + 1; j < verifiedResults.length; j++) {
+      if (
+        verifiedResults[i].signingTime.getTime() === verifiedResults[j].signingTime.getTime() &&
+        verifiedResults[i].signerSerialNumber === verifiedResults[j].signerSerialNumber
+      ) {
+        throw new Error("Duplicate TSA timestamp detected");
+      }
     }
   }
 
-  throw new Error(`No valid RFC3161 timestamps found. Errors: ${errors.join(', ')}`);
+  return verifiedResults.map(r => r.signingTime);
 }

package/src/tlog/dsse.ts

@@ -12,7 +12,7 @@
  */
 
 import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
+import { getHashAlgorithm } from "../interfaces.js";
 import type { SigstoreBundle } from "../bundle.js";
 import type { RekorEntry } from "./body.js";
 
@@ -81,16 +81,16 @@ async function verifyDSSE001Body(
     throw new Error("DSSE signature mismatch between TLog entry and bundle");
   }
 
-  const tlogHash = entry.spec.payloadHash?.value || "";
-  if (!tlogHash) {
-    throw new Error("DSSE entry missing payloadHash");
+  if (!entry.spec.payloadHash?.value || !entry.spec.payloadHash?.algorithm) {
+    throw new Error("DSSE entry missing payloadHash or algorithm");
   }
 
-  const tlogHashBytes = hexToUint8Array(tlogHash);
+  const hashAlg = getHashAlgorithm(entry.spec.payloadHash.algorithm);
+  const tlogHashBytes = hexToUint8Array(entry.spec.payloadHash.value);
 
   const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
   const bundleHashBytes = new Uint8Array(
-    await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes as Uint8Array<ArrayBuffer>)
+    await crypto.subtle.digest(hashAlg, payloadBytes as Uint8Array<ArrayBuffer>)
   );
 
   if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
@@ -129,16 +129,16 @@ async function verifyDSSE002Body(
     throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
   }
 
-  const tlogHash = spec.payloadHash?.digest || "";
-  if (!tlogHash) {
-    throw new Error("DSSE v0.0.2 entry missing payloadHash");
+  if (!spec.payloadHash?.digest || !spec.payloadHash?.algorithm) {
+    throw new Error("DSSE v0.0.2 entry missing payloadHash or algorithm");
   }
 
-  const tlogHashBytes = base64ToUint8Array(tlogHash);
+  const hashAlg = getHashAlgorithm(spec.payloadHash.algorithm);
+  const tlogHashBytes = base64ToUint8Array(spec.payloadHash.digest);
 
   const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
   const bundleHashBytes = new Uint8Array(
-    await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes as Uint8Array<ArrayBuffer>)
+    await crypto.subtle.digest(hashAlg, payloadBytes as Uint8Array<ArrayBuffer>)
   );
 
   if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {

package/src/tlog/intoto.ts

@@ -11,7 +11,7 @@
  */
 
 import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
+import { getHashAlgorithm } from "../interfaces.js";
 import type { SigstoreBundle } from "../bundle.js";
 import type { RekorEntry } from "./body.js";
 
@@ -87,12 +87,16 @@ export async function verifyIntotoBody(
   }
 
   if (intotoEntry.spec.content.payloadHash) {
-    const tlogHash = intotoEntry.spec.content.payloadHash.value;
-    const tlogHashBytes = hexToUint8Array(tlogHash);
+    if (!intotoEntry.spec.content.payloadHash.algorithm) {
+      throw new Error("Intoto entry missing payloadHash algorithm");
+    }
+
+    const hashAlg = getHashAlgorithm(intotoEntry.spec.content.payloadHash.algorithm);
+    const tlogHashBytes = hexToUint8Array(intotoEntry.spec.content.payloadHash.value);
 
     const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
     const bundleHashBytes = new Uint8Array(
-      await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes as Uint8Array<ArrayBuffer>)
+      await crypto.subtle.digest(hashAlg, payloadBytes as Uint8Array<ArrayBuffer>)
     );
 
     if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {

package/src/x509/sct.ts

@@ -112,7 +112,11 @@ export class SignedCertificateTimestamp {
     const stream = new ByteStream(buf);
 
     // Version - enum { v1(0), (255) }
+    // RFC 6962 specifies only v1(0) is valid (for now)
     const version = stream.getUint8();
+    if (version !== 0) {
+      throw new Error(`Unsupported SCT version: ${version} (expected 0 for v1)`);
+    }
 
     // Log ID  - struct { opaque key_id[32]; }
     const logID = stream.getBlock(32);