@freedomofpress/sigstore-browser 0.1.4 → 0.1.6

package/dist/trust/tuf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,cAAc,CAAC,CAAS;gBAEpB,OAAO,GAAE,0BAA+B;IAUpD;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;YACW,cAAc;IAY5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAsC5C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAShD;;;OAGG;IACH,UAAU,IAAI,IAAI;CAInB"}
+{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,cAAc,CAAC,CAAS;gBAEpB,OAAO,GAAE,0BAA+B;IAWpD;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;YACW,cAAc;IAY5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAsC5C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAShD;;;OAGG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/dist/trust/tuf.js

@@ -12,6 +12,7 @@ import { Uint8ArrayToString } from "@freedomofpress/crypto-browser";
  */
 const DEFAULT_CONFIG = {
     metadataUrl: 'https://tuf-repo-cdn.sigstore.dev/',
+    targetBaseUrl: 'https://tuf-repo-cdn.sigstore.dev/targets/',
     namespace: 'sigstore-browser',
     trustedRootTarget: 'trusted_root.json',
     cacheTTL: 3600000, // 1 hour
@@ -41,7 +42,8 @@ export class TrustedRootProvider {
     constructor(options = {}) {
         const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;
         this.metadataUrl = metadataUrl.endsWith('/') ? metadataUrl : `${metadataUrl}/`;
-        this.targetBaseUrl = options.targetBaseUrl || this.metadataUrl;
+        const targetBaseUrl = options.targetBaseUrl || DEFAULT_CONFIG.targetBaseUrl;
+        this.targetBaseUrl = targetBaseUrl.endsWith('/') ? targetBaseUrl : `${targetBaseUrl}/`;
         this.initialRoot = options.initialRoot;
         this.namespace = options.namespace || DEFAULT_CONFIG.namespace;
         this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;

package/dist/trust/tuf.js.map

@@ -1 +1 @@
-{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA6CpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACtB,WAAW,CAAS;IACpB,aAAa,CAAU;IACvB,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,QAAQ,CAAS;IAEjB,SAAS,CAAa;IACtB,UAAU,CAAe;IACzB,cAAc,CAAU;IAEhC,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,oFAAoF;QACpF,uFAAuF;QACvF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAiB,CAAC;QAEtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA6CpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,aAAa,EAAE,4CAA4C;IAC3D,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACtB,WAAW,CAAS;IACpB,aAAa,CAAU;IACvB,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,QAAQ,CAAS;IAEjB,SAAS,CAAa;IACtB,UAAU,CAAe;IACzB,cAAc,CAAU;IAEhC,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,oFAAoF;QACpF,uFAAuF;QACvF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAiB,CAAC;QAEtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}

package/dist/tuf-D48cBq5i.js

@@ -0,0 +1,377 @@
+import { s as u, c as m, U as v, H as w, i as $, h as E, v as S, b as _, a as R, d as f } from "./index-CRFtwdjM.js";
+function p(c, e) {
+  const t = new Map(c);
+  for (const s of c.keys())
+    e.includes(s) || t.delete(s);
+  return t;
+}
+async function y(c) {
+  const e = /* @__PURE__ */ new Map();
+  for (const t in c) {
+    const s = c[t], r = u(m(s)), i = v(new Uint8Array(await crypto.subtle.digest(w.SHA256, r)));
+    if (e.has(i))
+      throw new Error("Duplicate keyId found!");
+    i !== t && console.warn(`KeyId ${t} does not match the expected ${i}, importing anyway the provided one for proper referencing.`), e.set(t, await $(s.keytype, s.scheme, s.keyval.public));
+  }
+  return e;
+}
+async function l(c, e, t, s, r) {
+  if (r < 1)
+    throw new Error("Threshold must be at least 1");
+  if (r > c.size)
+    throw new Error("Threshold is bigger than the number of keys provided, something is wrong.");
+  const i = new Set(e), a = m(t);
+  let h = 0;
+  for (const o of s) {
+    if (!i.has(o.keyid))
+      continue;
+    i.delete(o.keyid);
+    const d = c.get(o.keyid), g = E(o.sig);
+    if (!d)
+      throw new Error("Keyid was empty.");
+    await S(d, u(a), g) === !0 && h++;
+  }
+  return h >= r;
+}
+function k(c) {
+  return c != null && typeof c == "object" && "__raw_bytes__" in c && // eslint-disable-next-line
+  typeof c.__raw_bytes__ == "string";
+}
+function b(c) {
+  const e = _(c.__raw_bytes__);
+  return JSON.parse(new TextDecoder().decode(e));
+}
+function T(c) {
+  return { __raw_bytes__: R(c) };
+}
+class N {
+  async read(e) {
+    const s = (await browser.storage.local.get(e))[e];
+    return k(s) ? b(s) : s;
+  }
+  async write(e, t) {
+    await browser.storage.local.set({ [e]: t });
+  }
+  async writeRaw(e, t) {
+    await browser.storage.local.set({ [e]: T(t) });
+  }
+  async delete(e) {
+    await browser.storage.local.remove(e);
+  }
+}
+class U {
+  async read(e) {
+    try {
+      const t = await (void 0)(e, "utf8");
+      return JSON.parse(t);
+    } catch {
+      return;
+    }
+  }
+  async write(e, t) {
+    await this.ensureParentDir(e), await (void 0)(e, JSON.stringify(t), "utf8");
+  }
+  async writeRaw(e, t) {
+    await this.ensureParentDir(e), await (void 0)(e, t);
+  }
+  async ensureParentDir(e) {
+    await (void 0)((void 0)(e), { recursive: !0 });
+  }
+  async delete(e) {
+    try {
+      await (void 0)(e);
+    } catch (t) {
+      if (t.code !== "ENOENT")
+        throw t;
+    }
+  }
+}
+class C {
+  async read(e) {
+    const t = localStorage.getItem(e);
+    if (t) {
+      const s = JSON.parse(t);
+      return k(s) ? b(s) : s;
+    }
+  }
+  async write(e, t) {
+    localStorage.setItem(e, JSON.stringify(t));
+  }
+  async writeRaw(e, t) {
+    localStorage.setItem(e, JSON.stringify(T(t)));
+  }
+  async delete(e) {
+    localStorage.removeItem(e);
+  }
+}
+var n;
+(function(c) {
+  c.Root = "root", c.Timestamp = "timestamp", c.Snapshot = "snapshot", c.Targets = "targets";
+})(n || (n = {}));
+const K = [
+  n.Root,
+  n.Targets,
+  n.Snapshot,
+  n.Timestamp
+];
+class x {
+  repositoryUrl;
+  targetBaseUrl;
+  startingRoot;
+  namespace;
+  backend;
+  constructor(e, t, s, r) {
+    if (this.repositoryUrl = e, this.targetBaseUrl = r || e, this.startingRoot = t, this.namespace = s, typeof process < "u" && process.versions?.node)
+      this.backend = new U();
+    else if (typeof browser < "u" && browser.storage?.local)
+      this.backend = new N();
+    else if (typeof localStorage < "u")
+      this.backend = new C();
+    else
+      throw new Error("No cache backend available");
+  }
+  getCacheKey(e) {
+    if (e.startsWith("/") || e.startsWith("./") || e.includes("..") || e.includes("\\"))
+      throw new Error(`key contains an invalid pattern (${e})`);
+    return `${this.namespace}/${e}.json`;
+  }
+  async getFromCache(e) {
+    const t = this.getCacheKey(e);
+    return await this.backend.read(t);
+  }
+  async setInCache(e, t) {
+    const s = this.getCacheKey(e);
+    await this.backend.write(s, t);
+  }
+  async fetchMetafileBase(e, t, s = !1) {
+    let r;
+    e = encodeURIComponent(e), s ? r = `${this.repositoryUrl}${t}.${e}` : r = t !== -1 ? `${this.repositoryUrl}${t}.${e}.json` : `${this.repositoryUrl}${e}.json`;
+    const i = await fetch(r);
+    if (!i.ok)
+      throw new Error(`Failed to fetch file: ${i.status} ${i.statusText}`);
+    return i;
+  }
+  validateMetadata(e) {
+    const t = /* @__PURE__ */ new Set();
+    for (const i of e.signatures) {
+      if (t.has(i.keyid))
+        throw new Error(`Duplicate signature found for keyid: ${i.keyid}`);
+      t.add(i.keyid);
+    }
+    const s = e.signed.spec_version;
+    if (!s)
+      throw new Error("spec_version is required");
+    const r = s.split(".");
+    if (r.length < 2 || r.length > 3)
+      throw new Error(`Invalid spec_version format: ${s}`);
+    if (!r.every((i) => /^\d+$/.test(i)))
+      throw new Error(`spec_version parts must be numeric: ${s}`);
+    if (r[0] !== "1")
+      throw new Error(`Unsupported spec_version major version: ${r[0]} (expected 1)`);
+  }
+  async fetchMetafileJson(e, t = -1) {
+    const r = await (await this.fetchMetafileBase(e, t)).json();
+    return this.validateMetadata(r), r;
+  }
+  async fetchMetafileBinary(e, t = -1, s = !1) {
+    const r = await this.fetchMetafileBase(e, t, s);
+    return new Uint8Array(await r.arrayBuffer());
+  }
+  bootstrapRoot(e) {
+    try {
+      const t = JSON.parse(e);
+      return this.validateMetadata(t), t;
+    } catch (t) {
+      throw new Error(`Failed to load the JSON file:  ${t}`);
+    }
+  }
+  async verifyHashes(e, t, s) {
+    if (!t)
+      return;
+    const r = {
+      sha256: w.SHA256,
+      sha384: w.SHA384,
+      sha512: w.SHA512
+    };
+    for (const [i, a] of Object.entries(t)) {
+      const h = r[i];
+      if (!h)
+        throw new Error(`${s}: unsupported hash algorithm '${i}'`);
+      const o = v(new Uint8Array(await crypto.subtle.digest(h, e)));
+      if (a !== o)
+        throw new Error(`${s}: ${i} hash mismatch`);
+    }
+  }
+  // This function supports ECDSA (256, 385, 521), Ed25519 in Hex or PEM format
+  // it is possible to support certain cases of RSA, but it is not really useful for now
+  // Returns a mapping keyid (hexstring) -> CryptoKey object
+  async loadRoot(e, t) {
+    if (e.signed._type !== n.Root)
+      throw new Error("Loading the wrong metafile as root.");
+    let s, r, i;
+    if (t == null ? (s = await y(e.signed.keys), i = e.signed.roles.root.keyids, r = e.signed.roles.root.threshold) : (s = t.keys, i = t.roles.root.keyids, r = t.threshold), await l(s, i, e.signed, e.signatures, r) !== !0)
+      throw new Error("Failed to verify metafile.");
+    if (s = await y(e.signed.keys), !Number.isSafeInteger(e.signed.version) || e.signed.version < 1)
+      throw new Error("There is something wrong with the root version number.");
+    for (const a of K)
+      if (!e.signed.roles[a])
+        throw new Error(`Missing required top-level role: ${a}`);
+    for (const [a, h] of Object.entries(e.signed.roles))
+      if (new Set(h.keyids).size !== h.keyids.length)
+        throw new Error(`Duplicate key IDs found in role: ${a}`);
+    return {
+      keys: s,
+      version: e.signed.version,
+      expires: new Date(e.signed.expires),
+      threshold: e.signed.roles.root.threshold,
+      consistent_snapshot: e.signed.consistent_snapshot,
+      roles: e.signed.roles
+    };
+  }
+  async updateRoot(e) {
+    let t = await this.getFromCache(n.Root);
+    t || (t = await this.bootstrapRoot(this.startingRoot));
+    let s = await this.loadRoot(t);
+    const r = s;
+    let i, a;
+    for (let h = s.version + 1; h < Number.MAX_SAFE_INTEGER; h++) {
+      try {
+        a = await this.fetchMetafileJson(n.Root, h);
+      } catch (o) {
+        if (o instanceof Error && o.message.includes("Failed to fetch"))
+          break;
+        throw o;
+      }
+      if (a.signed.version !== h)
+        throw new Error(`Version mismatch: URL version ${h} but file contains version ${a.signed.version}`);
+      if (a.signed?._type !== n.Root)
+        throw new Error("Incorrect metadata type for root.");
+      if (i = await this.loadRoot(a, s), i.version !== s.version + 1)
+        throw new Error(`Root version must be exactly ${s.version + 1}, got ${i.version}. Probable rollback attack.`);
+      i = await this.loadRoot(a), s = i, await this.setInCache(n.Root, a);
+    }
+    if (s.expires <= e)
+      throw new Error("Freeze attack on the root metafile.");
+    if (s.version > r.version) {
+      const h = JSON.stringify(s.roles.timestamp.keyids.sort()) !== JSON.stringify(r.roles.timestamp.keyids.sort()), o = JSON.stringify(s.roles.snapshot.keyids.sort()) !== JSON.stringify(r.roles.snapshot.keyids.sort()), d = JSON.stringify(s.roles.targets.keyids.sort()) !== JSON.stringify(r.roles.targets.keyids.sort());
+      h && (await this.backend.delete(this.getCacheKey(n.Timestamp)), await this.backend.delete(this.getCacheKey(n.Snapshot)), await this.backend.delete(this.getCacheKey(n.Targets))), o && (await this.backend.delete(this.getCacheKey(n.Snapshot)), await this.backend.delete(this.getCacheKey(n.Targets))), d && await this.backend.delete(this.getCacheKey(n.Targets));
+    }
+    return s;
+  }
+  async updateTimestamp(e, t) {
+    const s = p(e.keys, e.roles.timestamp.keyids);
+    if (s.size < 1)
+      throw new Error("No valid keys found for the timestamp role.");
+    const r = await this.getFromCache(n.Timestamp), i = await this.fetchMetafileBinary(n.Timestamp, -1), a = JSON.parse(f(i));
+    if (this.validateMetadata(a), a.signed._type !== n.Timestamp)
+      throw new Error(`Invalid metadata type: expected ${n.Timestamp}, got ${a.signed._type}`);
+    if (!a.signed.meta || !a.signed.meta["snapshot.json"])
+      throw new Error("Timestamp metadata missing required meta['snapshot.json']");
+    if (await l(s, e.roles.timestamp.keyids, a.signed, a.signatures, e.roles.timestamp.threshold) !== !0)
+      throw new Error("Failed verifying timestamp role signature(s).");
+    if (r !== void 0) {
+      if (a.signed.version < r.signed.version)
+        throw new Error("New timestamp file has a lower version that the currently cached one.");
+      if (a.signed.version == r.signed.version)
+        return null;
+      if (a.signed.meta["snapshot.json"].version < r.signed.meta["snapshot.json"].version)
+        throw new Error("Timestamp has been updated, but snapshot version has been rolled back.");
+    }
+    if (new Date(a.signed.expires) <= t)
+      throw new Error("Freeze attack on the timestamp metafile.");
+    return await this.backend.writeRaw(this.getCacheKey(n.Timestamp), i), a;
+  }
+  async updateSnapshot(e, t, s) {
+    const r = s.signed.meta["snapshot.json"].version, i = p(e.keys, e.roles.snapshot.keyids), a = await this.getFromCache(n.Snapshot);
+    let h;
+    e.consistent_snapshot ? h = await this.fetchMetafileBinary(n.Snapshot, r) : h = await this.fetchMetafileBinary(n.Snapshot, -1);
+    const o = s.signed.meta["snapshot.json"];
+    if (o.length !== void 0 && h.length !== o.length)
+      throw new Error(`Snapshot length mismatch: expected ${o.length}, got ${h.length}`);
+    await this.verifyHashes(h, o.hashes, "Snapshot");
+    const d = JSON.parse(f(h));
+    if (this.validateMetadata(d), d.signed._type !== n.Snapshot)
+      throw new Error(`Invalid metadata type: expected ${n.Snapshot}, got ${d.signed._type}`);
+    if (!d.signed.meta || !d.signed.meta["targets.json"])
+      throw new Error("Snapshot metadata missing required meta['targets.json']");
+    if (await l(i, e.roles.snapshot.keyids, d.signed, d.signatures, e.roles.snapshot.threshold) !== !0)
+      throw new Error("Failed verifying snapshot role signature(s).");
+    if (d.signed.version !== r)
+      throw new Error(`Snapshot version mismatch: URL version ${r} but file contains version ${d.signed.version}`);
+    if (a !== void 0)
+      for (const [g] of Object.entries(a.signed.meta)) {
+        if (!(g in d.signed.meta))
+          throw new Error("Target that was listed in an older snapshot was dropped in a newer one.");
+        if (d.signed.meta[g].version < a.signed.meta[g].version)
+          throw new Error("Target version in newer snapshot is lower than the cached one. Probable rollback attack.");
+      }
+    if (new Date(d.signed.expires) <= t)
+      throw new Error("Freeze attack on the snapshot metafile.");
+    return await this.backend.writeRaw(this.getCacheKey(n.Snapshot), h), d.signed.meta;
+  }
+  async updateTargets(e, t, s) {
+    const r = p(e.keys, e.roles.targets.keyids), i = await this.getFromCache(n.Targets);
+    let a;
+    e.consistent_snapshot ? a = await this.fetchMetafileBinary(n.Targets, s[`${n.Targets}.json`].version) : a = await this.fetchMetafileBinary(n.Targets, -1);
+    const h = s[`${n.Targets}.json`];
+    if (h.length !== void 0 && a.length !== h.length)
+      throw new Error(`Targets length mismatch: expected ${h.length}, got ${a.length}`);
+    await this.verifyHashes(a, h.hashes, "Targets");
+    const o = JSON.parse(f(a));
+    if (this.validateMetadata(o), o.signed._type !== n.Targets)
+      throw new Error(`Invalid metadata type: expected ${n.Targets}, got ${o.signed._type}`);
+    if (await l(r, e.roles.targets.keyids, o.signed, o.signatures, e.roles.targets.threshold) !== !0)
+      throw new Error("Failed verifying targets role.");
+    const d = s[`${n.Targets}.json`].version;
+    if (o.signed.version !== d)
+      throw new Error(`Targets version mismatch: URL version ${d} but file contains version ${o.signed.version}`);
+    if (i !== void 0 && o.signed.version < i.signed.version)
+      throw new Error("Targets version is lower than the cached one. Probable rollback attack.");
+    if (new Date(o.signed.expires) <= t)
+      throw new Error("Freeze attack on the targets metafile.");
+    await this.backend.writeRaw(this.getCacheKey(n.Targets), a);
+  }
+  async listSignedTargets() {
+    const e = await this.getFromCache(n.Targets), t = [];
+    if (e)
+      for (const s of Object.keys(e.signed.targets))
+        t.push(s);
+    return t;
+  }
+  async fetchTarget(e) {
+    const t = await this.getFromCache(n.Targets);
+    if (t === void 0)
+      throw new Error("Failed to find the targets metafile when it should have existed.");
+    if (!(e in t.signed.targets))
+      throw new Error(`${e} not present in the targets role.`);
+    const s = t.signed.targets[e], r = s.hashes;
+    let i;
+    if (r.sha256)
+      i = r.sha256;
+    else if (r.sha512)
+      i = r.sha512;
+    else
+      throw new Error(`No supported hash algorithm found for ${e}. Available: ${Object.keys(r).join(", ")}`);
+    const a = e.lastIndexOf("/"), h = a === -1 ? `${this.targetBaseUrl}${i}.${e}` : `${this.targetBaseUrl}${e.substring(0, a + 1)}${i}.${e.substring(a + 1)}`, o = await fetch(h);
+    if (!o.ok)
+      throw new Error(`Failed to fetch target: ${o.status} ${o.statusText}`);
+    const d = new Uint8Array(await o.arrayBuffer());
+    if (d.byteLength !== s.length)
+      throw new Error(`${e} length mismatch: expected ${s.length}, got ${d.byteLength}`);
+    return await this.verifyHashes(d, r, `Target '${e}'`), d.buffer;
+  }
+  async updateTUF() {
+    const e = /* @__PURE__ */ new Date(), t = await this.updateRoot(e), s = await this.updateTimestamp(t, e);
+    if (s === null)
+      return;
+    const r = await this.updateSnapshot(t, e, s);
+    await this.updateTargets(t, e, r);
+  }
+  async getTarget(e) {
+    return await this.fetchTarget(e);
+  }
+}
+export {
+  x as TUFClient
+};
+//# sourceMappingURL=tuf-D48cBq5i.js.map

package/dist/tuf-D48cBq5i.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuf-D48cBq5i.js","sources":["../node_modules/@freedomofpress/tuf-browser/dist/crypto.js","../node_modules/@freedomofpress/tuf-browser/dist/storage/encoding.js","../node_modules/@freedomofpress/tuf-browser/dist/storage/browser.js","../node_modules/@freedomofpress/tuf-browser/dist/storage/filesystem.js","../node_modules/@freedomofpress/tuf-browser/dist/storage/localstorage.js","../node_modules/@freedomofpress/tuf-browser/dist/types.js","../node_modules/@freedomofpress/tuf-browser/dist/tuf.js"],"sourcesContent":["import { canonicalize, HashAlgorithms, hexToUint8Array, importKey, stringToUint8Array, Uint8ArrayToHex, verifySignature, } from \"@freedomofpress/crypto-browser\";\n// We use this to remove to select from the root keys only the ones allowed for a specific role\nexport function getRoleKeys(keys, keyids) {\n    const roleKeys = new Map(keys);\n    for (const key of keys.keys()) {\n        if (!keyids.includes(key)) {\n            roleKeys.delete(key);\n        }\n    }\n    return roleKeys;\n}\nexport async function loadKeys(keys) {\n    const importedKeys = new Map();\n    for (const keyId in keys) {\n        /* Two mandatory ordered logic steps:\n                Compute id manually\n                And then check for duplicates\n            */\n        /* A KEYID, which MUST be correct for the specified KEY. Clients MUST calculate each KEYID to verify this is correct for the associated key. Clients MUST ensure that for any KEYID represented in this key list and in other files, only one unique key has that KEYID. */\n        /* https://github.com/sigstore/root-signing/issues/1387 */\n        const key = keys[keyId];\n        const canonicalBytes = stringToUint8Array(canonicalize(key));\n        const verified_keyId = Uint8ArrayToHex(new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, canonicalBytes)));\n        // Check for key duplicates\n        if (importedKeys.has(verified_keyId)) {\n            throw new Error(\"Duplicate keyId found!\");\n        }\n        // Per TUF spec, keyId should match the computed hash of the canonical key representation.\n        // However, tuf-js doesn't enforce this either, and sigstore introduced mismatched keyIds\n        // during their root v11 signing (Feb 2025) that are now permanently in their TUF chain.\n        // KeyId verification has no real security purpose (signature verification uses the actual key).\n        // See: https://github.com/sigstore/root-signing/issues/1431\n        //      https://github.com/sigstore/root-signing/issues/1387\n        if (verified_keyId !== keyId) {\n            console.warn(`KeyId ${keyId} does not match the expected ${verified_keyId}, importing anyway the provided one for proper referencing.`);\n        }\n        importedKeys.set(keyId, await importKey(key.keytype, key.scheme, key.keyval.public));\n    }\n    return importedKeys;\n}\nexport async function checkSignatures(keys, roleKeys, signed, signatures, threshold) {\n    if (threshold < 1) {\n        throw new Error(\"Threshold must be at least 1\");\n    }\n    if (threshold > keys.size) {\n        throw new Error(\"Threshold is bigger than the number of keys provided, something is wrong.\");\n    }\n    // Let's keep this set as a reference to verify that there are no duplicate keys used\n    const keyIds = new Set(roleKeys);\n    // Let's canonicalize first the body\n    const signed_canon = canonicalize(signed);\n    let valid_signatures = 0;\n    for (const signature of signatures) {\n        // Step 1, check if keyid is in the keyIds array\n        if (!keyIds.has(signature.keyid)) {\n            continue;\n            // Originally we would throw an error: but it make sense for a new signer to sign the new manifest\n            // we just have to be sure not to count it and hit the threshold\n            //throw new Error(\"Signature has an unknown keyId\");\n        }\n        // Step 2, remove the keyid from the available ones\n        // We are attempting verification with that keyid, if it fails we should\n        // something is wrong anyway, let's pop the keyid to be safe anyway\n        keyIds.delete(signature.keyid);\n        // Step 3, grab the correct CryptoKey\n        const key = keys.get(signature.keyid);\n        const sig = hexToUint8Array(signature.sig);\n        if (!key) {\n            throw new Error(\"Keyid was empty.\");\n        }\n        // We checked before that the key exists\n        if ((await verifySignature(key, stringToUint8Array(signed_canon), sig)) === true) {\n            // We used to halt on error, but... https://github.com/sigstore/root-signing/issues/1448\n            valid_signatures++;\n        }\n    }\n    if (valid_signatures >= threshold) {\n        return true;\n    }\n    else {\n        return false;\n    }\n}\n//# sourceMappingURL=crypto.js.map","// Shared utilities for encoding/decoding raw bytes in browser storage\nimport { base64ToUint8Array, Uint8ArrayToBase64 } from \"@freedomofpress/crypto-browser\";\nexport function isRawBytesWrapper(value) {\n    return (value != null &&\n        typeof value === \"object\" &&\n        \"__raw_bytes__\" in value &&\n        // eslint-disable-next-line\n        typeof value.__raw_bytes__ === \"string\");\n}\nexport function decodeRawBytesWrapper(wrapper) {\n    const bytes = base64ToUint8Array(wrapper.__raw_bytes__);\n    return JSON.parse(new TextDecoder().decode(bytes));\n}\nexport function createRawBytesWrapper(value) {\n    return { __raw_bytes__: Uint8ArrayToBase64(value) };\n}\n//# sourceMappingURL=encoding.js.map","import { createRawBytesWrapper, decodeRawBytesWrapper, isRawBytesWrapper, } from \"./encoding.js\";\nexport class ExtensionStorageBackend {\n    async read(key) {\n        const result = await browser.storage.local.get(key);\n        const value = result[key];\n        if (isRawBytesWrapper(value)) {\n            return decodeRawBytesWrapper(value);\n        }\n        return value;\n    }\n    async write(key, value) {\n        await browser.storage.local.set({ [key]: value });\n    }\n    async writeRaw(key, value) {\n        await browser.storage.local.set({ [key]: createRawBytesWrapper(value) });\n    }\n    async delete(key) {\n        await browser.storage.local.remove(key);\n    }\n}\n//# sourceMappingURL=browser.js.map","import * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nexport class FSBackend {\n    async read(key) {\n        try {\n            const value = await fs.readFile(key, \"utf8\");\n            return JSON.parse(value);\n        }\n        catch {\n            return undefined;\n        }\n    }\n    async write(key, value) {\n        await this.ensureParentDir(key);\n        await fs.writeFile(key, JSON.stringify(value), \"utf8\");\n    }\n    async writeRaw(key, value) {\n        await this.ensureParentDir(key);\n        await fs.writeFile(key, value);\n    }\n    async ensureParentDir(filepath) {\n        const dir = path.dirname(filepath);\n        await fs.mkdir(dir, { recursive: true });\n    }\n    async delete(key) {\n        try {\n            await fs.unlink(key);\n            // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        }\n        catch (error) {\n            if (error.code !== \"ENOENT\") {\n                throw error;\n            }\n        }\n    }\n}\n//# sourceMappingURL=filesystem.js.map","import { createRawBytesWrapper, decodeRawBytesWrapper, isRawBytesWrapper, } from \"./encoding.js\";\nexport class LocalStorageBackend {\n    async read(key) {\n        const value = localStorage.getItem(key);\n        if (value) {\n            const parsed = JSON.parse(value);\n            if (isRawBytesWrapper(parsed)) {\n                return decodeRawBytesWrapper(parsed);\n            }\n            return parsed;\n        }\n    }\n    async write(key, value) {\n        localStorage.setItem(key, JSON.stringify(value));\n    }\n    async writeRaw(key, value) {\n        localStorage.setItem(key, JSON.stringify(createRawBytesWrapper(value)));\n    }\n    async delete(key) {\n        localStorage.removeItem(key);\n    }\n}\n//# sourceMappingURL=localstorage.js.map","// Re-export crypto enums from crypto-browser\nexport { EcdsaTypes, HashAlgorithms, KeyTypes } from \"@freedomofpress/crypto-browser\";\nexport var Roles;\n(function (Roles) {\n    Roles[\"Root\"] = \"root\";\n    Roles[\"Timestamp\"] = \"timestamp\";\n    Roles[\"Snapshot\"] = \"snapshot\";\n    Roles[\"Targets\"] = \"targets\";\n})(Roles || (Roles = {}));\nexport const TOP_LEVEL_ROLE_NAMES = [\n    Roles.Root,\n    Roles.Targets,\n    Roles.Snapshot,\n    Roles.Timestamp,\n];\n//# sourceMappingURL=types.js.map","import { Uint8ArrayToHex, Uint8ArrayToString } from \"@freedomofpress/crypto-browser\";\nimport { checkSignatures, getRoleKeys, loadKeys, } from \"./crypto.js\";\nimport { ExtensionStorageBackend } from \"./storage/browser.js\";\nimport { FSBackend } from \"./storage/filesystem.js\";\nimport { LocalStorageBackend } from \"./storage/localstorage.js\";\nimport { HashAlgorithms, Roles, TOP_LEVEL_ROLE_NAMES, } from \"./types.js\";\nexport class TUFClient {\n    repositoryUrl;\n    targetBaseUrl;\n    startingRoot;\n    namespace;\n    backend;\n    constructor(repositoryUrl, startingRoot, namespace, targetBaseUrl) {\n        this.repositoryUrl = repositoryUrl;\n        this.targetBaseUrl = targetBaseUrl || repositoryUrl;\n        this.startingRoot = startingRoot;\n        this.namespace = namespace;\n        if (typeof process !== \"undefined\" && process.versions?.node) {\n            this.backend = new FSBackend();\n        }\n        else if (typeof browser !== \"undefined\" && browser.storage?.local) {\n            this.backend = new ExtensionStorageBackend();\n        }\n        else if (typeof localStorage !== \"undefined\") {\n            this.backend = new LocalStorageBackend();\n        }\n        else {\n            throw new Error(\"No cache backend available\");\n        }\n    }\n    getCacheKey(key) {\n        if (key.startsWith(\"/\") ||\n            key.startsWith(\"./\") ||\n            key.includes(\"..\") ||\n            key.includes(\"\\\\\")) {\n            throw new Error(`key contains an invalid pattern (${key})`);\n        }\n        return `${this.namespace}/${key}.json`;\n    }\n    async getFromCache(key) {\n        const namespacedKey = this.getCacheKey(key);\n        return await this.backend.read(namespacedKey);\n    }\n    async setInCache(key, value) {\n        const namespacedKey = this.getCacheKey(key);\n        await this.backend.write(namespacedKey, value);\n    }\n    async fetchMetafileBase(role, version, target = false) {\n        let url;\n        role = encodeURIComponent(role);\n        if (!target) {\n            url =\n                version !== -1\n                    ? `${this.repositoryUrl}${version}.${role}.json`\n                    : `${this.repositoryUrl}${role}.json`;\n        }\n        else {\n            url = `${this.repositoryUrl}${version}.${role}`;\n        }\n        // console.log(\"[TUF]\", \"Fetching\", url);\n        const response = await fetch(url);\n        if (!response.ok) {\n            throw new Error(`Failed to fetch file: ${response.status} ${response.statusText}`);\n        }\n        return response;\n    }\n    validateMetadata(metadata) {\n        const seenKeyIds = new Set();\n        for (const sig of metadata.signatures) {\n            if (seenKeyIds.has(sig.keyid)) {\n                throw new Error(`Duplicate signature found for keyid: ${sig.keyid}`);\n            }\n            seenKeyIds.add(sig.keyid);\n        }\n        const specVersion = metadata.signed.spec_version;\n        if (!specVersion) {\n            throw new Error(\"spec_version is required\");\n        }\n        const parts = specVersion.split(\".\");\n        if (parts.length < 2 || parts.length > 3) {\n            throw new Error(`Invalid spec_version format: ${specVersion}`);\n        }\n        if (!parts.every((p) => /^\\d+$/.test(p))) {\n            throw new Error(`spec_version parts must be numeric: ${specVersion}`);\n        }\n        if (parts[0] !== \"1\") {\n            throw new Error(`Unsupported spec_version major version: ${parts[0]} (expected 1)`);\n        }\n    }\n    async fetchMetafileJson(role, version = -1) {\n        const response = await this.fetchMetafileBase(role, version);\n        const metadata = (await response.json());\n        this.validateMetadata(metadata);\n        return metadata;\n    }\n    async fetchMetafileBinary(role, version = -1, target = false) {\n        const response = await this.fetchMetafileBase(role, version, target);\n        return new Uint8Array(await response.arrayBuffer());\n    }\n    bootstrapRoot(file) {\n        try {\n            const metadata = JSON.parse(file);\n            this.validateMetadata(metadata);\n            return metadata;\n        }\n        catch (error) {\n            throw new Error(`Failed to load the JSON file:  ${error}`);\n        }\n    }\n    async verifyHashes(data, hashes, context) {\n        if (!hashes)\n            return;\n        const hashAlgoMap = {\n            sha256: HashAlgorithms.SHA256,\n            sha384: HashAlgorithms.SHA384,\n            sha512: HashAlgorithms.SHA512,\n        };\n        for (const [algo, expectedHash] of Object.entries(hashes)) {\n            const cryptoAlgo = hashAlgoMap[algo];\n            if (!cryptoAlgo) {\n                throw new Error(`${context}: unsupported hash algorithm '${algo}'`);\n            }\n            const computedHash = Uint8ArrayToHex(new Uint8Array(await crypto.subtle.digest(cryptoAlgo, data)));\n            if (expectedHash !== computedHash) {\n                throw new Error(`${context}: ${algo} hash mismatch`);\n            }\n        }\n    }\n    // This function supports ECDSA (256, 385, 521), Ed25519 in Hex or PEM format\n    // it is possible to support certain cases of RSA, but it is not really useful for now\n    // Returns a mapping keyid (hexstring) -> CryptoKey object\n    async loadRoot(json, oldroot) {\n        if (json.signed._type !== Roles.Root) {\n            throw new Error(\"Loading the wrong metafile as root.\");\n        }\n        let keys;\n        let threshold;\n        let roleKeys;\n        // If no oldroot, this is a fresh start from a trusted file, so it's self signed\n        if (oldroot == undefined) {\n            keys = await loadKeys(json.signed.keys);\n            roleKeys = json.signed.roles.root.keyids;\n            threshold = json.signed.roles.root.threshold;\n        }\n        else {\n            keys = oldroot.keys;\n            roleKeys = oldroot.roles[\"root\"].keyids;\n            // We should respect the previous threshold, otherwise it does not make sense\n            threshold = oldroot.threshold;\n        }\n        if ((await checkSignatures(keys, roleKeys, json.signed, json.signatures, threshold)) !== true) {\n            throw new Error(\"Failed to verify metafile.\");\n        }\n        // If we are loading a new root, let's load the new keys since we have verified them\n        keys = await loadKeys(json.signed.keys);\n        if (!Number.isSafeInteger(json.signed.version) || json.signed.version < 1) {\n            throw new Error(\"There is something wrong with the root version number.\");\n        }\n        // Validate required top-level roles exist\n        for (const role of TOP_LEVEL_ROLE_NAMES) {\n            if (!json.signed.roles[role]) {\n                throw new Error(`Missing required top-level role: ${role}`);\n            }\n        }\n        // Validate no duplicate keyids within each role\n        for (const [roleName, role] of Object.entries(json.signed.roles)) {\n            const keyidSet = new Set(role.keyids);\n            if (keyidSet.size !== role.keyids.length) {\n                throw new Error(`Duplicate key IDs found in role: ${roleName}`);\n            }\n        }\n        return {\n            keys: keys,\n            version: json.signed.version,\n            expires: new Date(json.signed.expires),\n            threshold: json.signed.roles.root.threshold,\n            consistent_snapshot: json.signed.consistent_snapshot,\n            roles: json.signed.roles,\n        };\n    }\n    async updateRoot(frozenTimestamp) {\n        let rootJson = await this.getFromCache(Roles.Root);\n        // Is this the first time we are running the update meaning we have no cached file?\n        if (!rootJson) {\n            // Then load the hardcoded startup root\n            // console.log(\"[TUF]\", \"Starting from hardcoded root\");\n            // Spec 5.2\n            rootJson = await this.bootstrapRoot(this.startingRoot);\n        }\n        let root = await this.loadRoot(rootJson);\n        const oldRoot = root;\n        let newroot;\n        let newrootJson;\n        // In theory max version is the maximum integer size, probably 2^32 per the spec, in practice this should be safe for a century\n        for (let new_version = root.version + 1; new_version < Number.MAX_SAFE_INTEGER; new_version++) {\n            try {\n                newrootJson = await this.fetchMetafileJson(Roles.Root, new_version);\n            }\n            catch (e) {\n                if (e instanceof Error && e.message.includes(\"Failed to fetch\")) {\n                    break;\n                }\n                throw e;\n            }\n            if (newrootJson.signed.version !== new_version) {\n                throw new Error(`Version mismatch: URL version ${new_version} but file contains version ${newrootJson.signed.version}`);\n            }\n            if (newrootJson.signed?._type !== Roles.Root) {\n                throw new Error(\"Incorrect metadata type for root.\");\n            }\n            // First check that is properly signed by the previous root\n            newroot = await this.loadRoot(newrootJson, root);\n            // Spec 5.3.5: Check for rollback attack - version must be exactly N+1\n            if (newroot.version !== root.version + 1) {\n                throw new Error(`Root version must be exactly ${root.version + 1}, got ${newroot.version}. Probable rollback attack.`);\n            }\n            // Then check it is properly signed by itself as per 5.3.4 of the SPEC\n            newroot = await this.loadRoot(newrootJson);\n            root = newroot;\n            // By spec 5.3.8, we should update the cache now\n            await this.setInCache(Roles.Root, newrootJson);\n        }\n        // We do not cast expires because it is done in loadRoot\n        if (root.expires <= frozenTimestamp) {\n            // By spec 5.3.10\n            throw new Error(\"Freeze attack on the root metafile.\");\n        }\n        // Fast-forward recovery: If timestamp or snapshot role keys changed, delete cached metadata.\n        // This allows recovery from fast-forward attacks after key rotation.\n        if (root.version > oldRoot.version) {\n            const timestampKeysChanged = JSON.stringify(root.roles.timestamp.keyids.sort()) !==\n                JSON.stringify(oldRoot.roles.timestamp.keyids.sort());\n            const snapshotKeysChanged = JSON.stringify(root.roles.snapshot.keyids.sort()) !==\n                JSON.stringify(oldRoot.roles.snapshot.keyids.sort());\n            const targetsKeysChanged = JSON.stringify(root.roles.targets.keyids.sort()) !==\n                JSON.stringify(oldRoot.roles.targets.keyids.sort());\n            if (timestampKeysChanged) {\n                await this.backend.delete(this.getCacheKey(Roles.Timestamp));\n                await this.backend.delete(this.getCacheKey(Roles.Snapshot));\n                await this.backend.delete(this.getCacheKey(Roles.Targets));\n            }\n            if (snapshotKeysChanged) {\n                await this.backend.delete(this.getCacheKey(Roles.Snapshot));\n                await this.backend.delete(this.getCacheKey(Roles.Targets));\n            }\n            if (targetsKeysChanged) {\n                await this.backend.delete(this.getCacheKey(Roles.Targets));\n            }\n        }\n        return root;\n    }\n    async updateTimestamp(root, frozenTimestamp) {\n        // Note: TUF spec 5.5.2 allows optional hashes in timestamp metadata.\n        // Sigstore omits them for simpler maintenance and smaller metadata.\n        // The \"consistent snapshot\" feature (version checking) provides sufficient protection against mix-and-match attacks.\n        // See: https://github.com/sigstore/root-signing/issues/1388\n        // Always remember to select only the keys delegated to a specific role\n        const keys = getRoleKeys(root.keys, root.roles.timestamp.keyids);\n        if (keys.size < 1) {\n            throw new Error(\"No valid keys found for the timestamp role.\");\n        }\n        const cachedTimestamp = await this.getFromCache(Roles.Timestamp);\n        // Spec 5.4.1 - Fetch raw bytes to preserve exact serialization\n        const newTimestampRaw = await this.fetchMetafileBinary(Roles.Timestamp, -1);\n        const newTimestamp = JSON.parse(Uint8ArrayToString(newTimestampRaw));\n        this.validateMetadata(newTimestamp);\n        if (newTimestamp.signed._type !== Roles.Timestamp) {\n            throw new Error(`Invalid metadata type: expected ${Roles.Timestamp}, got ${newTimestamp.signed._type}`);\n        }\n        // Validate required meta field\n        if (!newTimestamp.signed.meta ||\n            !newTimestamp.signed.meta[\"snapshot.json\"]) {\n            throw new Error(\"Timestamp metadata missing required meta['snapshot.json']\");\n        }\n        // Spec 5.4.2\n        if ((await checkSignatures(keys, root.roles[\"timestamp\"].keyids, newTimestamp.signed, newTimestamp.signatures, root.roles.timestamp.threshold)) !== true) {\n            throw new Error(\"Failed verifying timestamp role signature(s).\");\n        }\n        // Spec 5.4.3.x apply only if we already have a cached file supposedly\n        if (cachedTimestamp !== undefined) {\n            // 5.4.3.1 if lower, this is a rollback attack\n            if (newTimestamp.signed.version < cachedTimestamp.signed.version) {\n                throw new Error(\"New timestamp file has a lower version that the currently cached one.\");\n            }\n            if (newTimestamp.signed.version == cachedTimestamp.signed.version) {\n                // If equal, there is no update - return null to signal no update needed\n                return null;\n            }\n            // 5.4.3.2\n            if (newTimestamp.signed.meta[\"snapshot.json\"].version <\n                cachedTimestamp.signed.meta[\"snapshot.json\"].version) {\n                throw new Error(\"Timestamp has been updated, but snapshot version has been rolled back.\");\n            }\n        }\n        if (new Date(newTimestamp.signed.expires) <= frozenTimestamp) {\n            throw new Error(\"Freeze attack on the timestamp metafile.\");\n        }\n        await this.backend.writeRaw(this.getCacheKey(Roles.Timestamp), newTimestampRaw);\n        return newTimestamp;\n    }\n    async updateSnapshot(root, frozenTimestamp, timestampMeta) {\n        const version = timestampMeta.signed.meta[\"snapshot.json\"].version;\n        const keys = getRoleKeys(root.keys, root.roles.snapshot.keyids);\n        const cachedSnapshot = await this.getFromCache(Roles.Snapshot);\n        let newSnapshotRaw;\n        // Spec 5.5.1\n        if (root.consistent_snapshot) {\n            newSnapshotRaw = await this.fetchMetafileBinary(Roles.Snapshot, version);\n        }\n        else {\n            newSnapshotRaw = await this.fetchMetafileBinary(Roles.Snapshot, -1);\n        }\n        // Spec 5.5.2: Verify snapshot length and hash if present in timestamp\n        const snapshotMeta = timestampMeta.signed.meta[\"snapshot.json\"];\n        if (snapshotMeta.length !== undefined) {\n            if (newSnapshotRaw.length !== snapshotMeta.length) {\n                throw new Error(`Snapshot length mismatch: expected ${snapshotMeta.length}, got ${newSnapshotRaw.length}`);\n            }\n        }\n        await this.verifyHashes(newSnapshotRaw, snapshotMeta.hashes, \"Snapshot\");\n        const newSnapshot = JSON.parse(Uint8ArrayToString(newSnapshotRaw));\n        this.validateMetadata(newSnapshot);\n        if (newSnapshot.signed._type !== Roles.Snapshot) {\n            throw new Error(`Invalid metadata type: expected ${Roles.Snapshot}, got ${newSnapshot.signed._type}`);\n        }\n        // Validate required meta field\n        if (!newSnapshot.signed.meta || !newSnapshot.signed.meta[\"targets.json\"]) {\n            throw new Error(\"Snapshot metadata missing required meta['targets.json']\");\n        }\n        // Spec 5.5.3\n        if ((await checkSignatures(keys, root.roles[\"snapshot\"].keyids, newSnapshot.signed, newSnapshot.signatures, root.roles.snapshot.threshold)) !== true) {\n            throw new Error(\"Failed verifying snapshot role signature(s).\");\n        }\n        // 5.5.4 - Validate version matches (both timestamp and URL if consistent_snapshot)\n        if (newSnapshot.signed.version !== version) {\n            throw new Error(`Snapshot version mismatch: URL version ${version} but file contains version ${newSnapshot.signed.version}`);\n        }\n        // 5.5.5\n        if (cachedSnapshot !== undefined) {\n            for (const [target] of Object.entries(cachedSnapshot.signed.meta)) {\n                if (target in newSnapshot.signed.meta !== true) {\n                    throw new Error(\"Target that was listed in an older snapshot was dropped in a newer one.\");\n                }\n                if (newSnapshot.signed.meta[target].version <\n                    cachedSnapshot.signed.meta[target].version) {\n                    throw new Error(\"Target version in newer snapshot is lower than the cached one. Probable rollback attack.\");\n                }\n            }\n        }\n        // 5.5.6\n        if (new Date(newSnapshot.signed.expires) <= frozenTimestamp) {\n            throw new Error(\"Freeze attack on the snapshot metafile.\");\n        }\n        // 5.5.7 - Store raw bytes to preserve exact serialization\n        await this.backend.writeRaw(this.getCacheKey(Roles.Snapshot), newSnapshotRaw);\n        // If we reach here, we expect updates, otherwise we would have aborted in the timestamp phase.\n        return newSnapshot.signed.meta;\n    }\n    async updateTargets(root, frozenTimestamp, snapshot) {\n        const keys = getRoleKeys(root.keys, root.roles.targets.keyids);\n        const cachedTargets = await this.getFromCache(Roles.Targets);\n        let newTargetsRaw;\n        // Spec 5.6.1, sigstore targets.json does not even have hashes for now\n        if (root.consistent_snapshot) {\n            newTargetsRaw = await this.fetchMetafileBinary(Roles.Targets, snapshot[`${Roles.Targets}.json`].version);\n        }\n        else {\n            newTargetsRaw = await this.fetchMetafileBinary(Roles.Targets, -1);\n        }\n        // Spec 5.6.2: Verify targets length and hash if present in snapshot\n        const targetsMeta = snapshot[`${Roles.Targets}.json`];\n        if (targetsMeta.length !== undefined) {\n            if (newTargetsRaw.length !== targetsMeta.length) {\n                throw new Error(`Targets length mismatch: expected ${targetsMeta.length}, got ${newTargetsRaw.length}`);\n            }\n        }\n        await this.verifyHashes(newTargetsRaw, targetsMeta.hashes, \"Targets\");\n        const newTargets = JSON.parse(Uint8ArrayToString(newTargetsRaw));\n        this.validateMetadata(newTargets);\n        if (newTargets.signed._type !== Roles.Targets) {\n            throw new Error(`Invalid metadata type: expected ${Roles.Targets}, got ${newTargets.signed._type}`);\n        }\n        // Spec 5.6.3\n        if ((await checkSignatures(keys, root.roles[\"targets\"].keyids, newTargets.signed, newTargets.signatures, root.roles.targets.threshold)) !== true) {\n            throw new Error(`Failed verifying targets role.`);\n        }\n        // 5.6.4 - Check version matches snapshot (and URL if consistent_snapshot)\n        const expectedVersion = snapshot[`${Roles.Targets}.json`].version;\n        if (newTargets.signed.version !== expectedVersion) {\n            throw new Error(`Targets version mismatch: URL version ${expectedVersion} but file contains version ${newTargets.signed.version}`);\n        }\n        // 5.6.5 - Check for rollback attack\n        if (cachedTargets !== undefined &&\n            newTargets.signed.version < cachedTargets.signed.version) {\n            throw new Error(\"Targets version is lower than the cached one. Probable rollback attack.\");\n        }\n        // 5.6.6\n        if (new Date(newTargets.signed.expires) <= frozenTimestamp) {\n            throw new Error(\"Freeze attack on the targets metafile.\");\n        }\n        // 5.6.7 - Store raw bytes to preserve exact serialization\n        await this.backend.writeRaw(this.getCacheKey(Roles.Targets), newTargetsRaw);\n    }\n    async listSignedTargets() {\n        const cachedTargets = await this.getFromCache(Roles.Targets);\n        const filenames = [];\n        if (cachedTargets) {\n            for (const filename of Object.keys(cachedTargets.signed.targets)) {\n                filenames.push(filename);\n            }\n        }\n        return filenames;\n    }\n    async fetchTarget(name) {\n        const cachedTargets = await this.getFromCache(Roles.Targets);\n        if (cachedTargets === undefined) {\n            throw new Error(\"Failed to find the targets metafile when it should have existed.\");\n        }\n        if (!(name in cachedTargets.signed.targets)) {\n            throw new Error(`${name} not present in the targets role.`);\n        }\n        const targetInfo = cachedTargets.signed.targets[name];\n        const targetHashes = targetInfo.hashes;\n        let hashForUrl;\n        if (targetHashes.sha256) {\n            hashForUrl = targetHashes.sha256;\n        }\n        else if (targetHashes.sha512) {\n            hashForUrl = targetHashes.sha512;\n        }\n        else {\n            throw new Error(`No supported hash algorithm found for ${name}. Available: ${Object.keys(targetHashes).join(\", \")}`);\n        }\n        // For consistent snapshots, construct URL preserving directory structure: targets/dir/subdir/HASH.filename\n        const lastSlash = name.lastIndexOf(\"/\");\n        const targetUrl = lastSlash === -1\n            ? `${this.targetBaseUrl}${hashForUrl}.${name}` // No directory: HASH.filename\n            : `${this.targetBaseUrl}${name.substring(0, lastSlash + 1)}${hashForUrl}.${name.substring(lastSlash + 1)}`; // dir/HASH.filename\n        const response = await fetch(targetUrl);\n        if (!response.ok) {\n            throw new Error(`Failed to fetch target: ${response.status} ${response.statusText}`);\n        }\n        const raw_file = new Uint8Array(await response.arrayBuffer());\n        // Verify target file length\n        if (raw_file.byteLength !== targetInfo.length) {\n            throw new Error(`${name} length mismatch: expected ${targetInfo.length}, got ${raw_file.byteLength}`);\n        }\n        // Verify all target file hashes\n        await this.verifyHashes(raw_file, targetHashes, `Target '${name}'`);\n        return raw_file.buffer;\n    }\n    async updateTUF() {\n        // Spec 5.1\n        const frozenTimestamp = new Date();\n        const root = await this.updateRoot(frozenTimestamp);\n        const timestampMeta = await this.updateTimestamp(root, frozenTimestamp);\n        // If timestamp hasn't changed, no need to update snapshot/targets\n        if (timestampMeta === null) {\n            return;\n        }\n        const snapshot = await this.updateSnapshot(root, frozenTimestamp, timestampMeta);\n        await this.updateTargets(root, frozenTimestamp, snapshot);\n    }\n    async getTarget(name) {\n        return await this.fetchTarget(name);\n    }\n}\n//# sourceMappingURL=tuf.js.map"],"names":["getRoleKeys","keys","keyids","roleKeys","key","loadKeys","importedKeys","keyId","canonicalBytes","stringToUint8Array","canonicalize","verified_keyId","Uint8ArrayToHex","HashAlgorithms","importKey","checkSignatures","signed","signatures","threshold","keyIds","signed_canon","valid_signatures","signature","sig","hexToUint8Array","verifySignature","isRawBytesWrapper","value","decodeRawBytesWrapper","wrapper","bytes","base64ToUint8Array","createRawBytesWrapper","Uint8ArrayToBase64","ExtensionStorageBackend","FSBackend","fs.readFile","fs.writeFile","filepath","fs.mkdir","path.dirname","fs.unlink","error","LocalStorageBackend","parsed","Roles","TOP_LEVEL_ROLE_NAMES","TUFClient","repositoryUrl","startingRoot","namespace","targetBaseUrl","namespacedKey","role","version","target","url","response","metadata","seenKeyIds","specVersion","parts","p","file","data","hashes","context","hashAlgoMap","algo","expectedHash","cryptoAlgo","computedHash","json","oldroot","roleName","frozenTimestamp","rootJson","root","oldRoot","newroot","newrootJson","new_version","e","timestampKeysChanged","snapshotKeysChanged","targetsKeysChanged","cachedTimestamp","newTimestampRaw","newTimestamp","Uint8ArrayToString","timestampMeta","cachedSnapshot","newSnapshotRaw","snapshotMeta","newSnapshot","snapshot","cachedTargets","newTargetsRaw","targetsMeta","newTargets","expectedVersion","filenames","filename","name","targetInfo","targetHashes","hashForUrl","lastSlash","targetUrl","raw_file"],"mappings":";AAEO,SAASA,EAAYC,GAAMC,GAAQ;AACtC,QAAMC,IAAW,IAAI,IAAIF,CAAI;AAC7B,aAAWG,KAAOH,EAAK;AACnB,IAAKC,EAAO,SAASE,CAAG,KACpBD,EAAS,OAAOC,CAAG;AAG3B,SAAOD;AACX;AACO,eAAeE,EAASJ,GAAM;AACjC,QAAMK,IAAe,oBAAI,IAAG;AAC5B,aAAWC,KAASN,GAAM;AAOtB,UAAMG,IAAMH,EAAKM,CAAK,GAChBC,IAAiBC,EAAmBC,EAAaN,CAAG,CAAC,GACrDO,IAAiBC,EAAgB,IAAI,WAAW,MAAM,OAAO,OAAO,OAAOC,EAAe,QAAQL,CAAc,CAAC,CAAC;AAExH,QAAIF,EAAa,IAAIK,CAAc;AAC/B,YAAM,IAAI,MAAM,wBAAwB;AAQ5C,IAAIA,MAAmBJ,KACnB,QAAQ,KAAK,SAASA,CAAK,gCAAgCI,CAAc,6DAA6D,GAE1IL,EAAa,IAAIC,GAAO,MAAMO,EAAUV,EAAI,SAASA,EAAI,QAAQA,EAAI,OAAO,MAAM,CAAC;AAAA,EACvF;AACA,SAAOE;AACX;AACO,eAAeS,EAAgBd,GAAME,GAAUa,GAAQC,GAAYC,GAAW;AACjF,MAAIA,IAAY;AACZ,UAAM,IAAI,MAAM,8BAA8B;AAElD,MAAIA,IAAYjB,EAAK;AACjB,UAAM,IAAI,MAAM,2EAA2E;AAG/F,QAAMkB,IAAS,IAAI,IAAIhB,CAAQ,GAEzBiB,IAAeV,EAAaM,CAAM;AACxC,MAAIK,IAAmB;AACvB,aAAWC,KAAaL,GAAY;AAEhC,QAAI,CAACE,EAAO,IAAIG,EAAU,KAAK;AAC3B;AAQJ,IAAAH,EAAO,OAAOG,EAAU,KAAK;AAE7B,UAAMlB,IAAMH,EAAK,IAAIqB,EAAU,KAAK,GAC9BC,IAAMC,EAAgBF,EAAU,GAAG;AACzC,QAAI,CAAClB;AACD,YAAM,IAAI,MAAM,kBAAkB;AAGtC,IAAK,MAAMqB,EAAgBrB,GAAKK,EAAmBW,CAAY,GAAGG,CAAG,MAAO,MAExEF;AAAA,EAER;AACA,SAAIA,KAAoBH;AAM5B;AChFO,SAASQ,EAAkBC,GAAO;AACrC,SAAQA,KAAS,QACb,OAAOA,KAAU,YACjB,mBAAmBA;AAAA,EAEnB,OAAOA,EAAM,iBAAkB;AACvC;AACO,SAASC,EAAsBC,GAAS;AAC3C,QAAMC,IAAQC,EAAmBF,EAAQ,aAAa;AACtD,SAAO,KAAK,MAAM,IAAI,YAAW,EAAG,OAAOC,CAAK,CAAC;AACrD;AACO,SAASE,EAAsBL,GAAO;AACzC,SAAO,EAAE,eAAeM,EAAmBN,CAAK,EAAC;AACrD;ACdO,MAAMO,EAAwB;AAAA,EACjC,MAAM,KAAK9B,GAAK;AAEZ,UAAMuB,KADS,MAAM,QAAQ,QAAQ,MAAM,IAAIvB,CAAG,GAC7BA,CAAG;AACxB,WAAIsB,EAAkBC,CAAK,IAChBC,EAAsBD,CAAK,IAE/BA;AAAA,EACX;AAAA,EACA,MAAM,MAAMvB,GAAKuB,GAAO;AACpB,UAAM,QAAQ,QAAQ,MAAM,IAAI,EAAE,CAACvB,CAAG,GAAGuB,GAAO;AAAA,EACpD;AAAA,EACA,MAAM,SAASvB,GAAKuB,GAAO;AACvB,UAAM,QAAQ,QAAQ,MAAM,IAAI,EAAE,CAACvB,CAAG,GAAG4B,EAAsBL,CAAK,GAAG;AAAA,EAC3E;AAAA,EACA,MAAM,OAAOvB,GAAK;AACd,UAAM,QAAQ,QAAQ,MAAM,OAAOA,CAAG;AAAA,EAC1C;AACJ;ACjBO,MAAM+B,EAAU;AAAA,EACnB,MAAM,KAAK/B,GAAK;AACZ,QAAI;AACA,YAAMuB,IAAQ,MAAMS,SAAYhC,GAAK,MAAM;AAC3C,aAAO,KAAK,MAAMuB,CAAK;AAAA,IAC3B,QACM;AACF;AAAA,IACJ;AAAA,EACJ;AAAA,EACA,MAAM,MAAMvB,GAAKuB,GAAO;AACpB,UAAM,KAAK,gBAAgBvB,CAAG,GAC9B,MAAMiC,SAAajC,GAAK,KAAK,UAAUuB,CAAK,GAAG,MAAM;AAAA,EACzD;AAAA,EACA,MAAM,SAASvB,GAAKuB,GAAO;AACvB,UAAM,KAAK,gBAAgBvB,CAAG,GAC9B,MAAMiC,SAAajC,GAAKuB,CAAK;AAAA,EACjC;AAAA,EACA,MAAM,gBAAgBW,GAAU;AAE5B,UAAMC,SADMC,SAAaF,CAAQ,GACb,EAAE,WAAW,GAAI,CAAE;AAAA,EAC3C;AAAA,EACA,MAAM,OAAOlC,GAAK;AACd,QAAI;AACA,YAAMqC,SAAUrC,CAAG;AAAA,IAEvB,SACOsC,GAAO;AACV,UAAIA,EAAM,SAAS;AACf,cAAMA;AAAA,IAEd;AAAA,EACJ;AACJ;AClCO,MAAMC,EAAoB;AAAA,EAC7B,MAAM,KAAKvC,GAAK;AACZ,UAAMuB,IAAQ,aAAa,QAAQvB,CAAG;AACtC,QAAIuB,GAAO;AACP,YAAMiB,IAAS,KAAK,MAAMjB,CAAK;AAC/B,aAAID,EAAkBkB,CAAM,IACjBhB,EAAsBgB,CAAM,IAEhCA;AAAA,IACX;AAAA,EACJ;AAAA,EACA,MAAM,MAAMxC,GAAKuB,GAAO;AACpB,iBAAa,QAAQvB,GAAK,KAAK,UAAUuB,CAAK,CAAC;AAAA,EACnD;AAAA,EACA,MAAM,SAASvB,GAAKuB,GAAO;AACvB,iBAAa,QAAQvB,GAAK,KAAK,UAAU4B,EAAsBL,CAAK,CAAC,CAAC;AAAA,EAC1E;AAAA,EACA,MAAM,OAAOvB,GAAK;AACd,iBAAa,WAAWA,CAAG;AAAA,EAC/B;AACJ;ACnBO,IAAIyC;AAAA,CACV,SAAUA,GAAO;AACd,EAAAA,EAAM,OAAU,QAChBA,EAAM,YAAe,aACrBA,EAAM,WAAc,YACpBA,EAAM,UAAa;AACvB,GAAGA,MAAUA,IAAQ,CAAA,EAAG;AACjB,MAAMC,IAAuB;AAAA,EAChCD,EAAM;AAAA,EACNA,EAAM;AAAA,EACNA,EAAM;AAAA,EACNA,EAAM;AACV;ACRO,MAAME,EAAU;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAYC,GAAeC,GAAcC,GAAWC,GAAe;AAK/D,QAJA,KAAK,gBAAgBH,GACrB,KAAK,gBAAgBG,KAAiBH,GACtC,KAAK,eAAeC,GACpB,KAAK,YAAYC,GACb,OAAO,UAAY,OAAe,QAAQ,UAAU;AACpD,WAAK,UAAU,IAAIf,EAAS;AAAA,aAEvB,OAAO,UAAY,OAAe,QAAQ,SAAS;AACxD,WAAK,UAAU,IAAID,EAAuB;AAAA,aAErC,OAAO,eAAiB;AAC7B,WAAK,UAAU,IAAIS,EAAmB;AAAA;AAGtC,YAAM,IAAI,MAAM,4BAA4B;AAAA,EAEpD;AAAA,EACA,YAAYvC,GAAK;AACb,QAAIA,EAAI,WAAW,GAAG,KAClBA,EAAI,WAAW,IAAI,KACnBA,EAAI,SAAS,IAAI,KACjBA,EAAI,SAAS,IAAI;AACjB,YAAM,IAAI,MAAM,oCAAoCA,CAAG,GAAG;AAE9D,WAAO,GAAG,KAAK,SAAS,IAAIA,CAAG;AAAA,EACnC;AAAA,EACA,MAAM,aAAaA,GAAK;AACpB,UAAMgD,IAAgB,KAAK,YAAYhD,CAAG;AAC1C,WAAO,MAAM,KAAK,QAAQ,KAAKgD,CAAa;AAAA,EAChD;AAAA,EACA,MAAM,WAAWhD,GAAKuB,GAAO;AACzB,UAAMyB,IAAgB,KAAK,YAAYhD,CAAG;AAC1C,UAAM,KAAK,QAAQ,MAAMgD,GAAezB,CAAK;AAAA,EACjD;AAAA,EACA,MAAM,kBAAkB0B,GAAMC,GAASC,IAAS,IAAO;AACnD,QAAIC;AACJ,IAAAH,IAAO,mBAAmBA,CAAI,GACzBE,IAODC,IAAM,GAAG,KAAK,aAAa,GAAGF,CAAO,IAAID,CAAI,KAN7CG,IACIF,MAAY,KACN,GAAG,KAAK,aAAa,GAAGA,CAAO,IAAID,CAAI,UACvC,GAAG,KAAK,aAAa,GAAGA,CAAI;AAM1C,UAAMI,IAAW,MAAM,MAAMD,CAAG;AAChC,QAAI,CAACC,EAAS;AACV,YAAM,IAAI,MAAM,yBAAyBA,EAAS,MAAM,IAAIA,EAAS,UAAU,EAAE;AAErF,WAAOA;AAAA,EACX;AAAA,EACA,iBAAiBC,GAAU;AACvB,UAAMC,IAAa,oBAAI,IAAG;AAC1B,eAAWpC,KAAOmC,EAAS,YAAY;AACnC,UAAIC,EAAW,IAAIpC,EAAI,KAAK;AACxB,cAAM,IAAI,MAAM,wCAAwCA,EAAI,KAAK,EAAE;AAEvE,MAAAoC,EAAW,IAAIpC,EAAI,KAAK;AAAA,IAC5B;AACA,UAAMqC,IAAcF,EAAS,OAAO;AACpC,QAAI,CAACE;AACD,YAAM,IAAI,MAAM,0BAA0B;AAE9C,UAAMC,IAAQD,EAAY,MAAM,GAAG;AACnC,QAAIC,EAAM,SAAS,KAAKA,EAAM,SAAS;AACnC,YAAM,IAAI,MAAM,gCAAgCD,CAAW,EAAE;AAEjE,QAAI,CAACC,EAAM,MAAM,CAACC,MAAM,QAAQ,KAAKA,CAAC,CAAC;AACnC,YAAM,IAAI,MAAM,uCAAuCF,CAAW,EAAE;AAExE,QAAIC,EAAM,CAAC,MAAM;AACb,YAAM,IAAI,MAAM,2CAA2CA,EAAM,CAAC,CAAC,eAAe;AAAA,EAE1F;AAAA,EACA,MAAM,kBAAkBR,GAAMC,IAAU,IAAI;AAExC,UAAMI,IAAY,OADD,MAAM,KAAK,kBAAkBL,GAAMC,CAAO,GAC1B;AACjC,gBAAK,iBAAiBI,CAAQ,GACvBA;AAAA,EACX;AAAA,EACA,MAAM,oBAAoBL,GAAMC,IAAU,IAAIC,IAAS,IAAO;AAC1D,UAAME,IAAW,MAAM,KAAK,kBAAkBJ,GAAMC,GAASC,CAAM;AACnE,WAAO,IAAI,WAAW,MAAME,EAAS,YAAW,CAAE;AAAA,EACtD;AAAA,EACA,cAAcM,GAAM;AAChB,QAAI;AACA,YAAML,IAAW,KAAK,MAAMK,CAAI;AAChC,kBAAK,iBAAiBL,CAAQ,GACvBA;AAAA,IACX,SACOhB,GAAO;AACV,YAAM,IAAI,MAAM,kCAAkCA,CAAK,EAAE;AAAA,IAC7D;AAAA,EACJ;AAAA,EACA,MAAM,aAAasB,GAAMC,GAAQC,GAAS;AACtC,QAAI,CAACD;AACD;AACJ,UAAME,IAAc;AAAA,MAChB,QAAQtD,EAAe;AAAA,MACvB,QAAQA,EAAe;AAAA,MACvB,QAAQA,EAAe;AAAA,IACnC;AACQ,eAAW,CAACuD,GAAMC,CAAY,KAAK,OAAO,QAAQJ,CAAM,GAAG;AACvD,YAAMK,IAAaH,EAAYC,CAAI;AACnC,UAAI,CAACE;AACD,cAAM,IAAI,MAAM,GAAGJ,CAAO,iCAAiCE,CAAI,GAAG;AAEtE,YAAMG,IAAe3D,EAAgB,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO0D,GAAYN,CAAI,CAAC,CAAC;AACjG,UAAIK,MAAiBE;AACjB,cAAM,IAAI,MAAM,GAAGL,CAAO,KAAKE,CAAI,gBAAgB;AAAA,IAE3D;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAASI,GAAMC,GAAS;AAC1B,QAAID,EAAK,OAAO,UAAU3B,EAAM;AAC5B,YAAM,IAAI,MAAM,qCAAqC;AAEzD,QAAI5C,GACAiB,GACAf;AAaJ,QAXIsE,KAAW,QACXxE,IAAO,MAAMI,EAASmE,EAAK,OAAO,IAAI,GACtCrE,IAAWqE,EAAK,OAAO,MAAM,KAAK,QAClCtD,IAAYsD,EAAK,OAAO,MAAM,KAAK,cAGnCvE,IAAOwE,EAAQ,MACftE,IAAWsE,EAAQ,MAAM,KAAQ,QAEjCvD,IAAYuD,EAAQ,YAEnB,MAAM1D,EAAgBd,GAAME,GAAUqE,EAAK,QAAQA,EAAK,YAAYtD,CAAS,MAAO;AACrF,YAAM,IAAI,MAAM,4BAA4B;AAIhD,QADAjB,IAAO,MAAMI,EAASmE,EAAK,OAAO,IAAI,GAClC,CAAC,OAAO,cAAcA,EAAK,OAAO,OAAO,KAAKA,EAAK,OAAO,UAAU;AACpE,YAAM,IAAI,MAAM,wDAAwD;AAG5E,eAAWnB,KAAQP;AACf,UAAI,CAAC0B,EAAK,OAAO,MAAMnB,CAAI;AACvB,cAAM,IAAI,MAAM,oCAAoCA,CAAI,EAAE;AAIlE,eAAW,CAACqB,GAAUrB,CAAI,KAAK,OAAO,QAAQmB,EAAK,OAAO,KAAK;AAE3D,UADiB,IAAI,IAAInB,EAAK,MAAM,EACvB,SAASA,EAAK,OAAO;AAC9B,cAAM,IAAI,MAAM,oCAAoCqB,CAAQ,EAAE;AAGtE,WAAO;AAAA,MACH,MAAMzE;AAAA,MACN,SAASuE,EAAK,OAAO;AAAA,MACrB,SAAS,IAAI,KAAKA,EAAK,OAAO,OAAO;AAAA,MACrC,WAAWA,EAAK,OAAO,MAAM,KAAK;AAAA,MAClC,qBAAqBA,EAAK,OAAO;AAAA,MACjC,OAAOA,EAAK,OAAO;AAAA,IAC/B;AAAA,EACI;AAAA,EACA,MAAM,WAAWG,GAAiB;AAC9B,QAAIC,IAAW,MAAM,KAAK,aAAa/B,EAAM,IAAI;AAEjD,IAAK+B,MAIDA,IAAW,MAAM,KAAK,cAAc,KAAK,YAAY;AAEzD,QAAIC,IAAO,MAAM,KAAK,SAASD,CAAQ;AACvC,UAAME,IAAUD;AAChB,QAAIE,GACAC;AAEJ,aAASC,IAAcJ,EAAK,UAAU,GAAGI,IAAc,OAAO,kBAAkBA,KAAe;AAC3F,UAAI;AACA,QAAAD,IAAc,MAAM,KAAK,kBAAkBnC,EAAM,MAAMoC,CAAW;AAAA,MACtE,SACOC,GAAG;AACN,YAAIA,aAAa,SAASA,EAAE,QAAQ,SAAS,iBAAiB;AAC1D;AAEJ,cAAMA;AAAA,MACV;AACA,UAAIF,EAAY,OAAO,YAAYC;AAC/B,cAAM,IAAI,MAAM,iCAAiCA,CAAW,8BAA8BD,EAAY,OAAO,OAAO,EAAE;AAE1H,UAAIA,EAAY,QAAQ,UAAUnC,EAAM;AACpC,cAAM,IAAI,MAAM,mCAAmC;AAKvD,UAFAkC,IAAU,MAAM,KAAK,SAASC,GAAaH,CAAI,GAE3CE,EAAQ,YAAYF,EAAK,UAAU;AACnC,cAAM,IAAI,MAAM,gCAAgCA,EAAK,UAAU,CAAC,SAASE,EAAQ,OAAO,6BAA6B;AAGzH,MAAAA,IAAU,MAAM,KAAK,SAASC,CAAW,GACzCH,IAAOE,GAEP,MAAM,KAAK,WAAWlC,EAAM,MAAMmC,CAAW;AAAA,IACjD;AAEA,QAAIH,EAAK,WAAWF;AAEhB,YAAM,IAAI,MAAM,qCAAqC;AAIzD,QAAIE,EAAK,UAAUC,EAAQ,SAAS;AAChC,YAAMK,IAAuB,KAAK,UAAUN,EAAK,MAAM,UAAU,OAAO,MAAM,MAC1E,KAAK,UAAUC,EAAQ,MAAM,UAAU,OAAO,MAAM,GAClDM,IAAsB,KAAK,UAAUP,EAAK,MAAM,SAAS,OAAO,MAAM,MACxE,KAAK,UAAUC,EAAQ,MAAM,SAAS,OAAO,MAAM,GACjDO,IAAqB,KAAK,UAAUR,EAAK,MAAM,QAAQ,OAAO,MAAM,MACtE,KAAK,UAAUC,EAAQ,MAAM,QAAQ,OAAO,MAAM;AACtD,MAAIK,MACA,MAAM,KAAK,QAAQ,OAAO,KAAK,YAAYtC,EAAM,SAAS,CAAC,GAC3D,MAAM,KAAK,QAAQ,OAAO,KAAK,YAAYA,EAAM,QAAQ,CAAC,GAC1D,MAAM,KAAK,QAAQ,OAAO,KAAK,YAAYA,EAAM,OAAO,CAAC,IAEzDuC,MACA,MAAM,KAAK,QAAQ,OAAO,KAAK,YAAYvC,EAAM,QAAQ,CAAC,GAC1D,MAAM,KAAK,QAAQ,OAAO,KAAK,YAAYA,EAAM,OAAO,CAAC,IAEzDwC,KACA,MAAM,KAAK,QAAQ,OAAO,KAAK,YAAYxC,EAAM,OAAO,CAAC;AAAA,IAEjE;AACA,WAAOgC;AAAA,EACX;AAAA,EACA,MAAM,gBAAgBA,GAAMF,GAAiB;AAMzC,UAAM1E,IAAOD,EAAY6E,EAAK,MAAMA,EAAK,MAAM,UAAU,MAAM;AAC/D,QAAI5E,EAAK,OAAO;AACZ,YAAM,IAAI,MAAM,6CAA6C;AAEjE,UAAMqF,IAAkB,MAAM,KAAK,aAAazC,EAAM,SAAS,GAEzD0C,IAAkB,MAAM,KAAK,oBAAoB1C,EAAM,WAAW,EAAE,GACpE2C,IAAe,KAAK,MAAMC,EAAmBF,CAAe,CAAC;AAEnE,QADA,KAAK,iBAAiBC,CAAY,GAC9BA,EAAa,OAAO,UAAU3C,EAAM;AACpC,YAAM,IAAI,MAAM,mCAAmCA,EAAM,SAAS,SAAS2C,EAAa,OAAO,KAAK,EAAE;AAG1G,QAAI,CAACA,EAAa,OAAO,QACrB,CAACA,EAAa,OAAO,KAAK,eAAe;AACzC,YAAM,IAAI,MAAM,2DAA2D;AAG/E,QAAK,MAAMzE,EAAgBd,GAAM4E,EAAK,MAAM,UAAa,QAAQW,EAAa,QAAQA,EAAa,YAAYX,EAAK,MAAM,UAAU,SAAS,MAAO;AAChJ,YAAM,IAAI,MAAM,+CAA+C;AAGnE,QAAIS,MAAoB,QAAW;AAE/B,UAAIE,EAAa,OAAO,UAAUF,EAAgB,OAAO;AACrD,cAAM,IAAI,MAAM,uEAAuE;AAE3F,UAAIE,EAAa,OAAO,WAAWF,EAAgB,OAAO;AAEtD,eAAO;AAGX,UAAIE,EAAa,OAAO,KAAK,eAAe,EAAE,UAC1CF,EAAgB,OAAO,KAAK,eAAe,EAAE;AAC7C,cAAM,IAAI,MAAM,wEAAwE;AAAA,IAEhG;AACA,QAAI,IAAI,KAAKE,EAAa,OAAO,OAAO,KAAKb;AACzC,YAAM,IAAI,MAAM,0CAA0C;AAE9D,iBAAM,KAAK,QAAQ,SAAS,KAAK,YAAY9B,EAAM,SAAS,GAAG0C,CAAe,GACvEC;AAAA,EACX;AAAA,EACA,MAAM,eAAeX,GAAMF,GAAiBe,GAAe;AACvD,UAAMpC,IAAUoC,EAAc,OAAO,KAAK,eAAe,EAAE,SACrDzF,IAAOD,EAAY6E,EAAK,MAAMA,EAAK,MAAM,SAAS,MAAM,GACxDc,IAAiB,MAAM,KAAK,aAAa9C,EAAM,QAAQ;AAC7D,QAAI+C;AAEJ,IAAIf,EAAK,sBACLe,IAAiB,MAAM,KAAK,oBAAoB/C,EAAM,UAAUS,CAAO,IAGvEsC,IAAiB,MAAM,KAAK,oBAAoB/C,EAAM,UAAU,EAAE;AAGtE,UAAMgD,IAAeH,EAAc,OAAO,KAAK,eAAe;AAC9D,QAAIG,EAAa,WAAW,UACpBD,EAAe,WAAWC,EAAa;AACvC,YAAM,IAAI,MAAM,sCAAsCA,EAAa,MAAM,SAASD,EAAe,MAAM,EAAE;AAGjH,UAAM,KAAK,aAAaA,GAAgBC,EAAa,QAAQ,UAAU;AACvE,UAAMC,IAAc,KAAK,MAAML,EAAmBG,CAAc,CAAC;AAEjE,QADA,KAAK,iBAAiBE,CAAW,GAC7BA,EAAY,OAAO,UAAUjD,EAAM;AACnC,YAAM,IAAI,MAAM,mCAAmCA,EAAM,QAAQ,SAASiD,EAAY,OAAO,KAAK,EAAE;AAGxG,QAAI,CAACA,EAAY,OAAO,QAAQ,CAACA,EAAY,OAAO,KAAK,cAAc;AACnE,YAAM,IAAI,MAAM,yDAAyD;AAG7E,QAAK,MAAM/E,EAAgBd,GAAM4E,EAAK,MAAM,SAAY,QAAQiB,EAAY,QAAQA,EAAY,YAAYjB,EAAK,MAAM,SAAS,SAAS,MAAO;AAC5I,YAAM,IAAI,MAAM,8CAA8C;AAGlE,QAAIiB,EAAY,OAAO,YAAYxC;AAC/B,YAAM,IAAI,MAAM,0CAA0CA,CAAO,8BAA8BwC,EAAY,OAAO,OAAO,EAAE;AAG/H,QAAIH,MAAmB;AACnB,iBAAW,CAACpC,CAAM,KAAK,OAAO,QAAQoC,EAAe,OAAO,IAAI,GAAG;AAC/D,YAAI,EAAApC,KAAUuC,EAAY,OAAO;AAC7B,gBAAM,IAAI,MAAM,yEAAyE;AAE7F,YAAIA,EAAY,OAAO,KAAKvC,CAAM,EAAE,UAChCoC,EAAe,OAAO,KAAKpC,CAAM,EAAE;AACnC,gBAAM,IAAI,MAAM,0FAA0F;AAAA,MAElH;AAGJ,QAAI,IAAI,KAAKuC,EAAY,OAAO,OAAO,KAAKnB;AACxC,YAAM,IAAI,MAAM,yCAAyC;AAG7D,iBAAM,KAAK,QAAQ,SAAS,KAAK,YAAY9B,EAAM,QAAQ,GAAG+C,CAAc,GAErEE,EAAY,OAAO;AAAA,EAC9B;AAAA,EACA,MAAM,cAAcjB,GAAMF,GAAiBoB,GAAU;AACjD,UAAM9F,IAAOD,EAAY6E,EAAK,MAAMA,EAAK,MAAM,QAAQ,MAAM,GACvDmB,IAAgB,MAAM,KAAK,aAAanD,EAAM,OAAO;AAC3D,QAAIoD;AAEJ,IAAIpB,EAAK,sBACLoB,IAAgB,MAAM,KAAK,oBAAoBpD,EAAM,SAASkD,EAAS,GAAGlD,EAAM,OAAO,OAAO,EAAE,OAAO,IAGvGoD,IAAgB,MAAM,KAAK,oBAAoBpD,EAAM,SAAS,EAAE;AAGpE,UAAMqD,IAAcH,EAAS,GAAGlD,EAAM,OAAO,OAAO;AACpD,QAAIqD,EAAY,WAAW,UACnBD,EAAc,WAAWC,EAAY;AACrC,YAAM,IAAI,MAAM,qCAAqCA,EAAY,MAAM,SAASD,EAAc,MAAM,EAAE;AAG9G,UAAM,KAAK,aAAaA,GAAeC,EAAY,QAAQ,SAAS;AACpE,UAAMC,IAAa,KAAK,MAAMV,EAAmBQ,CAAa,CAAC;AAE/D,QADA,KAAK,iBAAiBE,CAAU,GAC5BA,EAAW,OAAO,UAAUtD,EAAM;AAClC,YAAM,IAAI,MAAM,mCAAmCA,EAAM,OAAO,SAASsD,EAAW,OAAO,KAAK,EAAE;AAGtG,QAAK,MAAMpF,EAAgBd,GAAM4E,EAAK,MAAM,QAAW,QAAQsB,EAAW,QAAQA,EAAW,YAAYtB,EAAK,MAAM,QAAQ,SAAS,MAAO;AACxI,YAAM,IAAI,MAAM,gCAAgC;AAGpD,UAAMuB,IAAkBL,EAAS,GAAGlD,EAAM,OAAO,OAAO,EAAE;AAC1D,QAAIsD,EAAW,OAAO,YAAYC;AAC9B,YAAM,IAAI,MAAM,yCAAyCA,CAAe,8BAA8BD,EAAW,OAAO,OAAO,EAAE;AAGrI,QAAIH,MAAkB,UAClBG,EAAW,OAAO,UAAUH,EAAc,OAAO;AACjD,YAAM,IAAI,MAAM,yEAAyE;AAG7F,QAAI,IAAI,KAAKG,EAAW,OAAO,OAAO,KAAKxB;AACvC,YAAM,IAAI,MAAM,wCAAwC;AAG5D,UAAM,KAAK,QAAQ,SAAS,KAAK,YAAY9B,EAAM,OAAO,GAAGoD,CAAa;AAAA,EAC9E;AAAA,EACA,MAAM,oBAAoB;AACtB,UAAMD,IAAgB,MAAM,KAAK,aAAanD,EAAM,OAAO,GACrDwD,IAAY,CAAA;AAClB,QAAIL;AACA,iBAAWM,KAAY,OAAO,KAAKN,EAAc,OAAO,OAAO;AAC3D,QAAAK,EAAU,KAAKC,CAAQ;AAG/B,WAAOD;AAAA,EACX;AAAA,EACA,MAAM,YAAYE,GAAM;AACpB,UAAMP,IAAgB,MAAM,KAAK,aAAanD,EAAM,OAAO;AAC3D,QAAImD,MAAkB;AAClB,YAAM,IAAI,MAAM,kEAAkE;AAEtF,QAAI,EAAEO,KAAQP,EAAc,OAAO;AAC/B,YAAM,IAAI,MAAM,GAAGO,CAAI,mCAAmC;AAE9D,UAAMC,IAAaR,EAAc,OAAO,QAAQO,CAAI,GAC9CE,IAAeD,EAAW;AAChC,QAAIE;AACJ,QAAID,EAAa;AACb,MAAAC,IAAaD,EAAa;AAAA,aAErBA,EAAa;AAClB,MAAAC,IAAaD,EAAa;AAAA;AAG1B,YAAM,IAAI,MAAM,yCAAyCF,CAAI,gBAAgB,OAAO,KAAKE,CAAY,EAAE,KAAK,IAAI,CAAC,EAAE;AAGvH,UAAME,IAAYJ,EAAK,YAAY,GAAG,GAChCK,IAAYD,MAAc,KAC1B,GAAG,KAAK,aAAa,GAAGD,CAAU,IAAIH,CAAI,KAC1C,GAAG,KAAK,aAAa,GAAGA,EAAK,UAAU,GAAGI,IAAY,CAAC,CAAC,GAAGD,CAAU,IAAIH,EAAK,UAAUI,IAAY,CAAC,CAAC,IACtGlD,IAAW,MAAM,MAAMmD,CAAS;AACtC,QAAI,CAACnD,EAAS;AACV,YAAM,IAAI,MAAM,2BAA2BA,EAAS,MAAM,IAAIA,EAAS,UAAU,EAAE;AAEvF,UAAMoD,IAAW,IAAI,WAAW,MAAMpD,EAAS,YAAW,CAAE;AAE5D,QAAIoD,EAAS,eAAeL,EAAW;AACnC,YAAM,IAAI,MAAM,GAAGD,CAAI,8BAA8BC,EAAW,MAAM,SAASK,EAAS,UAAU,EAAE;AAGxG,iBAAM,KAAK,aAAaA,GAAUJ,GAAc,WAAWF,CAAI,GAAG,GAC3DM,EAAS;AAAA,EACpB;AAAA,EACA,MAAM,YAAY;AAEd,UAAMlC,IAAkB,oBAAI,KAAI,GAC1BE,IAAO,MAAM,KAAK,WAAWF,CAAe,GAC5Ce,IAAgB,MAAM,KAAK,gBAAgBb,GAAMF,CAAe;AAEtE,QAAIe,MAAkB;AAClB;AAEJ,UAAMK,IAAW,MAAM,KAAK,eAAelB,GAAMF,GAAiBe,CAAa;AAC/E,UAAM,KAAK,cAAcb,GAAMF,GAAiBoB,CAAQ;AAAA,EAC5D;AAAA,EACA,MAAM,UAAUQ,GAAM;AAClB,WAAO,MAAM,KAAK,YAAYA,CAAI;AAAA,EACtC;AACJ;","x_google_ignoreList":[0,1,2,3,4,5,6]}

package/dist/tuf-root-D8m0y2I4.js

@@ -0,0 +1,5 @@
+const I = "ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9";
+export {
+  I as default
+};
+//# sourceMappingURL=tuf-root-D8m0y2I4.js.map

package/dist/tuf-root-D8m0y2I4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuf-root-D8m0y2I4.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}

package/dist/x509/cert.d.ts

@@ -1,6 +1,28 @@
 import { ASN1Obj } from "@freedomofpress/crypto-browser";
-import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension } from "./ext.js";
+import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509KeyUsageExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SCTExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension } from "./ext.js";
 export declare const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+export declare const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = "1.3.6.1.4.1.57264.1.2";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_SHA = "1.3.6.1.4.1.57264.1.3";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_NAME = "1.3.6.1.4.1.57264.1.4";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = "1.3.6.1.4.1.57264.1.5";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_REF = "1.3.6.1.4.1.57264.1.6";
+export declare const EXTENSION_OID_OTHERNAME = "1.3.6.1.4.1.57264.1.7";
+export declare const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+export declare const EXTENSION_OID_BUILD_SIGNER_URI = "1.3.6.1.4.1.57264.1.9";
+export declare const EXTENSION_OID_BUILD_SIGNER_DIGEST = "1.3.6.1.4.1.57264.1.10";
+export declare const EXTENSION_OID_RUNNER_ENVIRONMENT = "1.3.6.1.4.1.57264.1.11";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_URI = "1.3.6.1.4.1.57264.1.12";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = "1.3.6.1.4.1.57264.1.13";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_REF = "1.3.6.1.4.1.57264.1.14";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = "1.3.6.1.4.1.57264.1.15";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = "1.3.6.1.4.1.57264.1.16";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = "1.3.6.1.4.1.57264.1.17";
+export declare const EXTENSION_OID_BUILD_CONFIG_URI = "1.3.6.1.4.1.57264.1.18";
+export declare const EXTENSION_OID_BUILD_CONFIG_DIGEST = "1.3.6.1.4.1.57264.1.19";
+export declare const EXTENSION_OID_BUILD_TRIGGER = "1.3.6.1.4.1.57264.1.20";
+export declare const EXTENSION_OID_RUN_INVOCATION_URI = "1.3.6.1.4.1.57264.1.21";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = "1.3.6.1.4.1.57264.1.22";
 export declare class X509Certificate {
     root: ASN1Obj;
     constructor(asn1: ASN1Obj);
@@ -39,6 +61,25 @@ export declare class X509Certificate {
     get extSCT(): X509SCTExtension | undefined;
     get extFulcioIssuerV1(): X509FulcioIssuerV1 | undefined;
     get extFulcioIssuerV2(): X509FulcioIssuerV2 | undefined;
+    get extGitHubWorkflowTrigger(): X509GitHubWorkflowTriggerExtension | undefined;
+    get extGitHubWorkflowSHA(): X509GitHubWorkflowSHAExtension | undefined;
+    get extGitHubWorkflowName(): X509GitHubWorkflowNameExtension | undefined;
+    get extGitHubWorkflowRepository(): X509GitHubWorkflowRepositoryExtension | undefined;
+    get extGitHubWorkflowRef(): X509GitHubWorkflowRefExtension | undefined;
+    get extBuildSignerURI(): X509BuildSignerURIExtension | undefined;
+    get extBuildSignerDigest(): X509BuildSignerDigestExtension | undefined;
+    get extRunnerEnvironment(): X509RunnerEnvironmentExtension | undefined;
+    get extSourceRepositoryURI(): X509SourceRepositoryURIExtension | undefined;
+    get extSourceRepositoryDigest(): X509SourceRepositoryDigestExtension | undefined;
+    get extSourceRepositoryRef(): X509SourceRepositoryRefExtension | undefined;
+    get extSourceRepositoryIdentifier(): X509SourceRepositoryIdentifierExtension | undefined;
+    get extSourceRepositoryOwnerURI(): X509SourceRepositoryOwnerURIExtension | undefined;
+    get extSourceRepositoryOwnerIdentifier(): X509SourceRepositoryOwnerIdentifierExtension | undefined;
+    get extBuildConfigURI(): X509BuildConfigURIExtension | undefined;
+    get extBuildConfigDigest(): X509BuildConfigDigestExtension | undefined;
+    get extBuildTrigger(): X509BuildTriggerExtension | undefined;
+    get extRunInvocationURI(): X509RunInvocationURIExtension | undefined;
+    get extSourceRepositoryVisibility(): X509SourceRepositoryVisibilityExtension | undefined;
     get isCA(): boolean;
     extension(oid: string): X509Extension | undefined;
     verify(issuerCertificate?: X509Certificate): Promise<boolean>;

package/dist/x509/cert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAWlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;;;OAKG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAiCpF,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0BhC,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}
+{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,EACvC,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAUlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAI3D,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AACtE,eAAO,MAAM,qCAAqC,0BAA0B,CAAC;AAC7E,eAAO,MAAM,iCAAiC,0BAA0B,CAAC;AACzE,eAAO,MAAM,kCAAkC,0BAA0B,CAAC;AAC1E,eAAO,MAAM,wCAAwC,0BAA0B,CAAC;AAChF,eAAO,MAAM,iCAAiC,0BAA0B,CAAC;AACzE,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAC/D,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AACtE,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AACtE,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AACzE,eAAO,MAAM,mCAAmC,2BAA2B,CAAC;AAC5E,eAAO,MAAM,sCAAsC,2BAA2B,CAAC;AAC/E,eAAO,MAAM,mCAAmC,2BAA2B,CAAC;AAC5E,eAAO,MAAM,0CAA0C,2BAA2B,CAAC;AACnF,eAAO,MAAM,yCAAyC,2BAA2B,CAAC;AAClF,eAAO,MAAM,gDAAgD,2BAA2B,CAAC;AACzF,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AACvE,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AACzE,eAAO,MAAM,0CAA0C,2BAA2B,CAAC;AAEnF,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;;;OAKG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAiCpF,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0BhC,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,wBAAwB,IAAI,kCAAkC,GAAG,SAAS,CAG7E;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,qBAAqB,IAAI,+BAA+B,GAAG,SAAS,CAGvE;IAED,IAAI,2BAA2B,IAAI,qCAAqC,GAAG,SAAS,CAGnF;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,sBAAsB,IAAI,gCAAgC,GAAG,SAAS,CAGzE;IAED,IAAI,yBAAyB,IAAI,mCAAmC,GAAG,SAAS,CAG/E;IAED,IAAI,sBAAsB,IAAI,gCAAgC,GAAG,SAAS,CAGzE;IAED,IAAI,6BAA6B,IAAI,uCAAuC,GAAG,SAAS,CAGvF;IAED,IAAI,2BAA2B,IAAI,qCAAqC,GAAG,SAAS,CAGnF;IAED,IAAI,kCAAkC,IAAI,4CAA4C,GAAG,SAAS,CAGjG;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAG3D;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,6BAA6B,IAAI,uCAAuC,GAAG,SAAS,CAGvF;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}