@freedomofpress/webcat 0.0.0-stage → 3.0.1

package/dist/lib/webcat/utils.d.ts

@@ -0,0 +1,8 @@
+export declare function getFQDN(url: string): string;
+export declare function getFQDNSafe(url: string): string;
+export declare function isSameOriginURL(target: string, base: string): boolean;
+export declare function isExtensionRequest(details: browser.webRequest._OnBeforeRequestDetails): boolean;
+export declare function SHA256(data: ArrayBuffer | Uint8Array | string): Promise<ArrayBuffer>;
+export declare function arraysEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function isNewerSemver(a: string, b: string): boolean;
+export declare function clearBrowserCaches(fqdns: string[]): Promise<void>;

package/dist/lib/webcat/utils.js

@@ -0,0 +1,74 @@
+import permissions from "../browser/permissions.js";
+function getFQDN(url) {
+  const urlobj = new URL(url);
+  return urlobj.hostname;
+}
+function getFQDNSafe(url) {
+  if (!/^https?:\/\//i.test(url)) {
+    url = `https://${url}`;
+  }
+  return getFQDN(url);
+}
+function isSameOriginURL(target, base) {
+  try {
+    const baseURL = new URL(base);
+    const targetURL = new URL(target, baseURL);
+    return targetURL.origin === baseURL.origin;
+  } catch {
+    return false;
+  }
+}
+function isExtensionRequest(details) {
+  return details.originUrl !== void 0 && details.documentUrl !== void 0 && details.originUrl.substring(0, 16) === "moz-extension://" && details.documentUrl.substring(0, 16) === "moz-extension://" && details.tabId === -1;
+}
+async function SHA256(data) {
+  let input;
+  if (typeof data === "string") {
+    input = new TextEncoder().encode(data).buffer;
+  } else if (data instanceof Uint8Array) {
+    input = data.slice().buffer;
+  } else {
+    input = data;
+  }
+  return crypto.subtle.digest("SHA-256", input);
+}
+function arraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function isNewerSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const na = pa[i] ?? 0;
+    const nb = pb[i] ?? 0;
+    if (na > nb) return true;
+    if (na < nb) return false;
+  }
+  return false;
+}
+permissions.require("browsingData")(clearBrowserCaches);
+async function clearBrowserCaches(fqdns) {
+  if (fqdns.length === 0) {
+    return;
+  }
+  await browser.browsingData.remove(
+    { hostnames: fqdns },
+    { serviceWorkers: true }
+  );
+  await browser.browsingData.remove({}, { cache: true });
+}
+export {
+  SHA256,
+  arraysEqual,
+  clearBrowserCaches,
+  getFQDN,
+  getFQDNSafe,
+  isExtensionRequest,
+  isNewerSemver,
+  isSameOriginURL
+};

package/dist/lib/webcat/validators.d.ts

@@ -0,0 +1,16 @@
+import { Manifest, SigstoreEnrollment, SigstoreSignatures, SigsumEnrollment, SigsumSignatures } from "./interfaces/bundle";
+import { WebcatError } from "./interfaces/errors";
+/**
+ * Validates a Content Security Policy. Enforces the restrictions outlined in
+ * {@link https://docs.webcat.tech/webapp-developers/CSP.html | the CSP docs}.
+ * Host sources are never allowed, so no enrollment lookup is needed.
+ *
+ * @param csp The policy string to validate.
+ */
+export declare function validateCSP(csp: string): void;
+export declare function witnessTimestampsFromCosignedTreeHead(compiledPolicy: Uint8Array, treeHead: string): Promise<number[]>;
+export declare function validateSigsumEnrollment(enrollment: SigsumEnrollment): WebcatError | null;
+export declare function validateSigstoreEnrollment(enrollment: SigstoreEnrollment): WebcatError | null;
+export declare function validateManifest(manifest: Manifest): WebcatError | null;
+export declare function verifySigsumManifest(enrollment: SigsumEnrollment, manifest: Manifest, signatures: SigsumSignatures): Promise<WebcatError | number>;
+export declare function verifySigstoreManifest(enrollment: SigstoreEnrollment, manifest: Manifest, signatures: SigstoreSignatures): Promise<WebcatError | number>;

package/dist/lib/webcat/validators.js

@@ -0,0 +1,457 @@
+import { SigstoreVerifier, AllOf, PolicyError, EXTENSION_OID_OTHERNAME } from "@freedomofpress/sigstore-browser";
+import { verifyMessageWithCompiledPolicy } from "@freedomofpress/sigsum";
+import { parseCompiledPolicy, importAndHashAll, evalQuorumBytecode } from "@freedomofpress/sigsum/dist/compiledPolicy";
+import { verifySignedTreeHead, verifyCosignedTreeHead } from "@freedomofpress/sigsum/dist/crypto";
+import { parseCosignedTreeHead } from "@freedomofpress/sigsum/dist/proof";
+import { RawPublicKey, Base64KeyHash } from "@freedomofpress/sigsum/dist/types";
+import { canonicalize } from "./canonicalize.js";
+import { stringToUint8Array, base64UrlToUint8Array } from "./encoding.js";
+import { WebcatError, WebcatErrorCode } from "./interfaces/errors.js";
+import { parseContentSecurityPolicy } from "./parsers.js";
+function validateCSP(csp) {
+  let directives;
+  ((directives2) => {
+    directives2["DefaultSrc"] = "default-src";
+    directives2["ScriptSrc"] = "script-src";
+    directives2["ScriptSrcElem"] = "script-src-elem";
+    directives2["ScriptSrcAttr"] = "script-src-attr";
+    directives2["StyleSrc"] = "style-src";
+    directives2["StyleSrcElem"] = "style-src-elem";
+    directives2["StyleSrcAttr"] = "style-src-attr";
+    directives2["ObjectSrc"] = "object-src";
+    directives2["ChildSrc"] = "child-src";
+    directives2["FrameSrc"] = "frame-src";
+    directives2["WorkerSrc"] = "worker-src";
+  })(directives || (directives = {}));
+  let source_keywords;
+  ((source_keywords2) => {
+    source_keywords2["None"] = "'none'";
+    source_keywords2["Self"] = "'self'";
+    source_keywords2["WasmUnsafeEval"] = "'wasm-unsafe-eval'";
+    source_keywords2["UnsafeInline"] = "'unsafe-inline'";
+    source_keywords2["UnsafeEval"] = "'unsafe-eval'";
+    source_keywords2["UnsafeHashes"] = "'unsafe-hashes'";
+    source_keywords2["StrictDynamic"] = "'strict-dynamic'";
+  })(source_keywords || (source_keywords = {}));
+  const script_keywords = [
+    "'none'",
+    "'self'",
+    "'wasm-unsafe-eval'"
+    /* WasmUnsafeEval */
+  ];
+  const style_keywords = [
+    "'none'",
+    "'self'",
+    "'unsafe-inline'",
+    "'unsafe-hashes'"
+    /* UnsafeHashes */
+  ];
+  if (csp.includes(",")) {
+    throw new Error(`CSP contains a comma: ${csp}`);
+  }
+  const parsedCSP = parseContentSecurityPolicy(csp);
+  const default_src = parsedCSP.get(
+    "default-src"
+    /* DefaultSrc */
+  ) ?? [];
+  for (const src of default_src) {
+    if (src !== "'none'" && src !== "'self'") {
+      throw new Error(
+        `Unexpected or non-allowed default-src directive: ${src}`
+      );
+    }
+  }
+  const default_src_is_none = default_src.length === 1 && default_src[0] === "'none'";
+  const hash_source = /^'sha(256|384|512)-[A-Za-z0-9+/_-]+={0,2}'$/i;
+  function validateDirective(directive, allowed_keywords, hashes = false, optional = default_src_is_none) {
+    const list = parsedCSP.get(directive);
+    if (!list?.length && !optional) {
+      throw new Error(
+        `${"default-src"} is not none, and ${directive} is not defined.`
+      );
+    }
+    for (const src of list ?? []) {
+      const lower = src.toLowerCase();
+      if (!allowed_keywords.includes(lower) && !(hashes && hash_source.test(src))) {
+        throw new Error(
+          `${directive} cannot contain ${src} which is unsupported.`
+        );
+      }
+    }
+  }
+  validateDirective("object-src", [
+    "'none'"
+    /* None */
+  ]);
+  validateDirective("script-src", script_keywords, true);
+  validateDirective(
+    "script-src-attr",
+    [
+      "'none'"
+      /* None */
+    ],
+    false,
+    true
+  );
+  validateDirective(
+    "script-src-elem",
+    script_keywords,
+    true,
+    default_src_is_none || parsedCSP.has(
+      "script-src"
+      /* ScriptSrc */
+    )
+  );
+  validateDirective("style-src", style_keywords, true);
+  validateDirective(
+    "style-src-elem",
+    style_keywords,
+    true,
+    default_src_is_none || parsedCSP.has(
+      "style-src"
+      /* StyleSrc */
+    )
+  );
+  validateDirective("style-src-attr", style_keywords, true, true);
+  validateDirective(
+    "worker-src",
+    [
+      "'none'",
+      "'self'"
+      /* Self */
+    ],
+    false,
+    default_src_is_none && !parsedCSP.has(
+      "child-src"
+      /* ChildSrc */
+    )
+  );
+}
+async function witnessTimestampsFromCosignedTreeHead(compiledPolicy, treeHead) {
+  const compiled = parseCompiledPolicy(compiledPolicy);
+  const logs = await importAndHashAll(compiled.logsRaw);
+  const witnesses = await importAndHashAll(compiled.witnessesRaw);
+  const cosignedTreeHead = await parseCosignedTreeHead(
+    treeHead.split("\n")
+  );
+  let logKeyHash = null;
+  for (const log of logs) {
+    if (await verifySignedTreeHead(
+      cosignedTreeHead.SignedTreeHead,
+      log.pub,
+      log.hash
+    )) {
+      logKeyHash = log.hash;
+      break;
+    }
+  }
+  if (!logKeyHash) {
+    throw new Error("no log key in policy verified the tree head");
+  }
+  const present = new Uint8Array(witnesses.length);
+  const timestamps = [];
+  for (const [i, witness] of witnesses.entries()) {
+    const cosignature = Base64KeyHash.lookup(
+      cosignedTreeHead.Cosignatures,
+      witness.b64
+    );
+    if (!cosignature) continue;
+    if (await verifyCosignedTreeHead(
+      cosignedTreeHead.SignedTreeHead.TreeHead,
+      witness.pub,
+      logKeyHash,
+      cosignature
+    )) {
+      present[i] = 1;
+      timestamps.push(cosignature.Timestamp);
+    }
+  }
+  if (!evalQuorumBytecode(compiled.quorum, witnesses.length, present)) {
+    throw new Error("cosignature quorum not satisfied");
+  }
+  return timestamps;
+}
+function validateSigsumEnrollment(enrollment) {
+  if (typeof enrollment.policy !== "string") {
+    return new WebcatError(WebcatErrorCode.Enrollment.POLICY_MALFORMED);
+  }
+  if (enrollment.policy.length === 0 || enrollment.policy.length > 8192) {
+    return new WebcatError(WebcatErrorCode.Enrollment.POLICY_LENGTH);
+  }
+  if (!Array.isArray(enrollment.signers)) {
+    return new WebcatError(WebcatErrorCode.Enrollment.SIGNERS_MALFORMED);
+  }
+  if (enrollment.signers.length === 0) {
+    return new WebcatError(WebcatErrorCode.Enrollment.SIGNERS_EMPTY);
+  }
+  for (const key of enrollment.signers) {
+    if (typeof key !== "string") {
+      return new WebcatError(WebcatErrorCode.Enrollment.SIGNERS_KEY_MALFORMED, [
+        String(key)
+      ]);
+    }
+  }
+  if (typeof enrollment.threshold !== "number" || !Number.isInteger(enrollment.threshold) || enrollment.threshold < 1) {
+    return new WebcatError(WebcatErrorCode.Enrollment.THRESHOLD_MALFORMED);
+  }
+  if (enrollment.threshold > enrollment.signers.length) {
+    return new WebcatError(WebcatErrorCode.Enrollment.THRESHOLD_IMPOSSIBLE);
+  }
+  if (typeof enrollment.max_age !== "number" || !Number.isFinite(enrollment.max_age)) {
+    return new WebcatError(WebcatErrorCode.Enrollment.MAX_AGE_MALFORMED);
+  }
+  if (typeof enrollment.logs !== "object" || enrollment.logs === null || Object.keys(enrollment.logs).length === 0) {
+    return new WebcatError(WebcatErrorCode.Enrollment.LOGS_MALFORMED);
+  }
+  for (const [pubkey, url] of Object.entries(enrollment.logs)) {
+    if (typeof pubkey !== "string" || typeof url !== "string") {
+      return new WebcatError(WebcatErrorCode.Enrollment.LOGS_MALFORMED);
+    }
+  }
+  return null;
+}
+function validateSigstoreEnrollment(enrollment) {
+  if (!enrollment.trusted_root) {
+    return new WebcatError(WebcatErrorCode.Enrollment.TRUSTED_ROOT_MISSING);
+  }
+  if (typeof enrollment.claims !== "object" || enrollment.claims === null || Array.isArray(enrollment.claims)) {
+    return new WebcatError(WebcatErrorCode.Enrollment.CLAIMS_MISSING);
+  }
+  if (Object.keys(enrollment.claims).length < 1) {
+    return new WebcatError(WebcatErrorCode.Enrollment.CLAIMS_EMPTY);
+  }
+  for (const [oid, value] of Object.entries(enrollment.claims)) {
+    if (typeof oid !== "string" || oid.length < 1) {
+      return new WebcatError(WebcatErrorCode.Enrollment.CLAIMS_MALFORMED);
+    }
+    if (typeof value !== "string" || value.length < 1) {
+      return new WebcatError(WebcatErrorCode.Enrollment.CLAIMS_MALFORMED, [
+        String(oid)
+      ]);
+    }
+  }
+  if (typeof enrollment.max_age !== "number" || !Number.isFinite(enrollment.max_age)) {
+    return new WebcatError(WebcatErrorCode.Enrollment.MAX_AGE_MALFORMED);
+  }
+  return null;
+}
+const SHA256_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+function validateManifest(manifest) {
+  if (!manifest.files || Object.keys(manifest.files).length < 1) {
+    return new WebcatError(WebcatErrorCode.Manifest.FILES_MISSING);
+  }
+  for (const [path, hash] of Object.entries(manifest.files)) {
+    if (!SHA256_BASE64URL.test(hash)) {
+      return new WebcatError(WebcatErrorCode.Manifest.FILES_MALFORMED, [path]);
+    }
+  }
+  if (!manifest.default_csp) {
+    return new WebcatError(WebcatErrorCode.Manifest.DEFAULT_CSP_MISSING);
+  }
+  if (!manifest.default_index) {
+    return new WebcatError(WebcatErrorCode.Manifest.DEFAULT_INDEX_MISSING);
+  }
+  if (!manifest.default_fallback) {
+    return new WebcatError(WebcatErrorCode.Manifest.DEFAULT_FALLBACK_MISSING);
+  }
+  if (!manifest.files["/" + manifest.default_index]) {
+    return new WebcatError(WebcatErrorCode.Manifest.DEFAULT_INDEX_MISSING_FILE);
+  }
+  if (!manifest.files[manifest.default_fallback]) {
+    return new WebcatError(
+      WebcatErrorCode.Manifest.DEFAULT_FALLBACK_MISSING_FILE
+    );
+  }
+  if (!manifest.wasm) {
+    return new WebcatError(WebcatErrorCode.Manifest.WASM_MISSING);
+  }
+  return null;
+}
+async function verifySigsumManifest(enrollment, manifest, signatures) {
+  const untrusted = signatures;
+  if (typeof untrusted !== "object" || untrusted === null || Array.isArray(untrusted)) {
+    return new WebcatError(WebcatErrorCode.Bundle.SIGNATURES_MISSING);
+  }
+  const canonical = canonicalize(manifest);
+  if (canonical === null) {
+    return new WebcatError(WebcatErrorCode.Manifest.VERIFY_FAILED);
+  }
+  const canonicalized = stringToUint8Array(canonical);
+  const remainingSigners = new Set(enrollment.signers);
+  let validCount = 0;
+  for (const pubKey of Object.keys(signatures)) {
+    if (!remainingSigners.has(pubKey)) {
+      continue;
+    }
+    try {
+      await verifyMessageWithCompiledPolicy(
+        canonicalized,
+        new RawPublicKey(base64UrlToUint8Array(pubKey)),
+        base64UrlToUint8Array(enrollment.policy),
+        signatures[pubKey]
+      );
+    } catch (e) {
+      return new WebcatError(WebcatErrorCode.Manifest.VERIFY_FAILED, [
+        String(e)
+      ]);
+    }
+    remainingSigners.delete(pubKey);
+    validCount++;
+  }
+  if (validCount < enrollment.threshold) {
+    return new WebcatError(WebcatErrorCode.Manifest.THRESHOLD_UNSATISFIED, [
+      String(validCount),
+      String(enrollment.threshold)
+    ]);
+  }
+  if (!manifest.timestamp) {
+    return new WebcatError(WebcatErrorCode.Manifest.TIMESTAMP_MISSING);
+  }
+  let timestamps;
+  try {
+    timestamps = await witnessTimestampsFromCosignedTreeHead(
+      base64UrlToUint8Array(enrollment.policy),
+      manifest.timestamp
+    );
+  } catch (e) {
+    return new WebcatError(WebcatErrorCode.Manifest.TIMESTAMP_VERIFY_FAILED, [
+      String(e)
+    ]);
+  }
+  const timestamp = timestamps.sort((a, b) => a - b)[Math.floor(timestamps.length / 2)];
+  const now = Math.floor(Date.now() / 1e3);
+  if (now - timestamp > enrollment.max_age) {
+    return new WebcatError(WebcatErrorCode.Manifest.EXPIRED, [
+      String(enrollment.max_age),
+      String(timestamp)
+    ]);
+  }
+  return timestamp + enrollment.max_age;
+}
+class ClaimPolicy {
+  constructor(oid, expected) {
+    this.oid = oid;
+    this.expected = expected;
+  }
+  claimMatches(got) {
+    if (this.expected.startsWith("^")) {
+      const expectedPrefix = this.expected.slice(1);
+      return got.startsWith(expectedPrefix);
+    }
+    return got === this.expected;
+  }
+  verify(cert) {
+    if (this.oid === "2.5.29.17") {
+      const sanExt = cert.extSubjectAltName;
+      if (!sanExt) {
+        throw new PolicyError("Certificate missing SubjectAlternativeName");
+      }
+      const allSans = /* @__PURE__ */ new Set();
+      if (sanExt.rfc822Name) allSans.add(sanExt.rfc822Name);
+      if (sanExt.uri) allSans.add(sanExt.uri);
+      const other = sanExt.otherName(EXTENSION_OID_OTHERNAME);
+      if (other) allSans.add(other);
+      const sanMatches = [...allSans].some((san) => this.claimMatches(san));
+      if (!sanMatches) {
+        throw new PolicyError(
+          `SAN mismatch for 2.5.29.17: expected '${this.expected}'`
+        );
+      }
+      return;
+    }
+    const ext = cert.extension(this.oid);
+    if (!ext) {
+      throw new PolicyError(`Certificate missing extension ${this.oid}`);
+    }
+    let got;
+    try {
+      const valueObj = ext.valueObj;
+      if (valueObj.subs && valueObj.subs.length > 0) {
+        const inner = valueObj.subs[0];
+        if (inner?.value) {
+          got = new TextDecoder().decode(inner.value);
+        }
+      }
+      if (!got) {
+        got = new TextDecoder().decode(ext.value);
+      }
+    } catch {
+      throw new PolicyError(`Unable to decode extension ${this.oid}`);
+    }
+    if (!this.claimMatches(got)) {
+      throw new PolicyError(
+        `Extension ${this.oid} mismatch: got '${got}', expected '${this.expected}'`
+      );
+    }
+  }
+}
+class CertFreshnessPolicy {
+  constructor(maxAgeSeconds) {
+    this.maxAgeSeconds = maxAgeSeconds;
+    this.validUntil = 0;
+  }
+  verify(cert) {
+    const now = Math.floor(Date.now() / 1e3);
+    const issued = Math.floor(cert.notBefore.getTime() / 1e3);
+    const validUntil = issued + this.maxAgeSeconds;
+    if (now > validUntil) {
+      this.expired = new WebcatError(WebcatErrorCode.Manifest.EXPIRED, [
+        String(this.maxAgeSeconds),
+        String(issued)
+      ]);
+      throw new PolicyError(
+        `Signing certificate is too old: issued at ${issued}, max age ${this.maxAgeSeconds}s`
+      );
+    }
+    if (!this.validUntil || this.validUntil > validUntil) {
+      this.validUntil = validUntil;
+    }
+  }
+}
+async function verifySigstoreManifest(enrollment, manifest, signatures) {
+  const verifier = new SigstoreVerifier();
+  await verifier.loadSigstoreRoot(enrollment.trusted_root);
+  const claimPolicies = [];
+  for (const [oid, expected] of Object.entries(enrollment.claims)) {
+    claimPolicies.push(new ClaimPolicy(oid, expected));
+  }
+  const freshnessPolicy = new CertFreshnessPolicy(enrollment.max_age);
+  claimPolicies.push(freshnessPolicy);
+  const policy = new AllOf(claimPolicies);
+  if (!Array.isArray(signatures)) {
+    return new WebcatError(WebcatErrorCode.Bundle.SIGNATURES_MISSING);
+  }
+  const canonical = canonicalize(manifest);
+  if (canonical === null) {
+    return new WebcatError(WebcatErrorCode.Manifest.VERIFY_FAILED);
+  }
+  const canonicalized = stringToUint8Array(canonical);
+  let verified = false;
+  for (const bundle of signatures) {
+    try {
+      verified = await verifier.verifyArtifactPolicy(
+        policy,
+        bundle,
+        canonicalized
+      );
+      if (verified) {
+        break;
+      }
+    } catch (e) {
+      console.log(e);
+    }
+  }
+  if (!verified) {
+    return freshnessPolicy.expired ?? new WebcatError(WebcatErrorCode.Manifest.VERIFY_FAILED);
+  }
+  return freshnessPolicy.validUntil;
+}
+export {
+  validateCSP,
+  validateManifest,
+  validateSigstoreEnrollment,
+  validateSigsumEnrollment,
+  verifySigstoreManifest,
+  verifySigsumManifest,
+  witnessTimestampsFromCosignedTreeHead
+};

package/dist/lib/webcat.d.ts

@@ -0,0 +1,11 @@
+import { WebcatConfig } from "./config";
+declare const _default: {
+    /**
+     * Sets up the full unmodified WEBCAT experience as it is designed to operate
+     * in Firefox-based browsers.
+     *
+     * @param options Configuration options. Defaults to {@link defaults}.
+     */
+    start(options?: Partial<WebcatConfig>): void;
+};
+export default _default;

package/dist/lib/webcat.js

@@ -0,0 +1,130 @@
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __using = (stack, value, async) => {
+  if (value != null) {
+    if (typeof value !== "object" && typeof value !== "function") __typeError("Object expected");
+    var dispose, inner;
+    if (async) dispose = value[__knownSymbol("asyncDispose")];
+    if (dispose === void 0) {
+      dispose = value[__knownSymbol("dispose")];
+      if (async) inner = dispose;
+    }
+    if (typeof dispose !== "function") __typeError("Object not disposable");
+    if (inner) dispose = function() {
+      try {
+        inner.call(this);
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    };
+    stack.push([async, dispose, value]);
+  } else if (async) {
+    stack.push([async]);
+  }
+  return value;
+};
+var __callDispose = (stack, error, hasError) => {
+  var E = typeof SuppressedError === "function" ? SuppressedError : function(e, s, m, _) {
+    return _ = Error(m), _.name = "SuppressedError", _.error = e, _.suppressed = s, _;
+  };
+  var fail = (e) => error = hasError ? new E(e, error, "An error was suppressed during disposal") : (hasError = true, e);
+  var next = (it) => {
+    while (it = stack.pop()) {
+      try {
+        var result = it[1] && it[1].call(it[2]);
+        if (it[0]) return Promise.resolve(result).then(next, (e) => (fail(e), next()));
+      } catch (e) {
+        fail(e);
+      }
+    }
+    if (hasError) throw error;
+  };
+  return next();
+};
+import { defaults } from "./config.js";
+import { WebcatDatabase } from "./webcat/db.js";
+import { WebcatRequestHandler } from "./webcat/handler.js";
+import { WebcatUI } from "./webcat/ui.js";
+import { EnrollmentUpdater } from "./webcat/updater.js";
+import "./validator_set.js";
+import "./browser/kvstore.js";
+import "./browser/permissions.js";
+import "./browser/sync.js";
+import "./webcat/cache.js";
+import "./webcat/originstate.js";
+import "./webcat/canonicalize.js";
+import "./webcat/encoding.js";
+import "./webcat/interfaces/bundle.js";
+import "./webcat/interfaces/errors.js";
+import "./webcat/utils.js";
+import "./webcat/validators.js";
+import "@freedomofpress/sigstore-browser";
+import "@freedomofpress/sigsum";
+import "@freedomofpress/sigsum/dist/compiledPolicy";
+import "@freedomofpress/sigsum/dist/crypto";
+import "@freedomofpress/sigsum/dist/proof";
+import "@freedomofpress/sigsum/dist/types";
+import "./webcat/parsers.js";
+import "./browser/requests.js";
+import "./browser/utils.js";
+import "./browser/scripting.js";
+import "./webcat/hookbuilder.js";
+import "./webcat/logger.js";
+import "./webcat/request.js";
+import "./webcat/resources.js";
+import "./webcat/response.js";
+import "./browser/chrome.js";
+import "@freedomofpress/cometbft/dist/commit";
+import "@freedomofpress/cometbft/dist/lightclient";
+import "@freedomofpress/cometbft/dist/validators";
+import "@freedomofpress/ics23/dist/webcat";
+const webcat = {
+  /**
+   * Sets up the full unmodified WEBCAT experience as it is designed to operate
+   * in Firefox-based browsers.
+   *
+   * @param options Configuration options. Defaults to {@link defaults}.
+   */
+  start(options) {
+    const cfg = Object.assign(Object.assign({}, defaults), options);
+    const db = new WebcatDatabase(cfg);
+    const ui = new WebcatUI(db, db.namespace("ui"), cfg);
+    const requestHandler = new WebcatRequestHandler(db, ui, cfg);
+    const updater = new EnrollmentUpdater(Object.assign({ database: db }, cfg));
+    requestHandler.bindAll();
+    requestHandler.addEventListener(
+      "beforeframeload",
+      async (event) => {
+        var _stack = [];
+        try {
+          const blockingResponse = __using(_stack, event.createBlockingResponse());
+          await updater.retryIfFailed();
+          blockingResponse.cancel = false;
+        } catch (_) {
+          var _error = _, _hasError = true;
+        } finally {
+          __callDispose(_stack, _error, _hasError);
+        }
+      }
+    );
+    let firstUpdate = true;
+    updater.addEventListener("updated", async (event) => {
+      if (!event.success && !firstUpdate) {
+        return;
+      }
+      try {
+        const fqdns = await db.listAllFQDNs();
+        await requestHandler.bind(fqdns);
+        firstUpdate = false;
+      } catch (error) {
+        console.error("[webcat] Bundled list import failed:", error);
+      }
+    });
+    updater.start();
+  }
+};
+export {
+  webcat as default
+};