@int-loop/core 0.1.0 → 0.2.0

package/dist/evidence-pack.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type AnchorReport } from "./anchor.ts";
 import { LedgerEntry } from "./schema/ledger.ts";
 import { type VerificationFailure } from "./verify.ts";
 export declare const EVIDENCE_PACK_FORMAT = "int-loop-evidence-pack";
@@ -33,7 +34,7 @@ export declare const PackKeys: z.ZodObject<{
 export type PackKeys = z.infer<typeof PackKeys>;
 /** The hashes of free text a ledger entry references, which the pack should carry. */
 export declare function referencedTextHashes(entry: LedgerEntry): string[];
-export declare const PACK_README = "# int-loop evidence pack\n\nThis archive is a complete, signed record of decisions made through int-loop for one\ntenant. You can check it without trusting int-loop.\n\nRun:\n\n    npx @int-loop/verify pack.zip\n\nor, to confirm the service keys are really int-loop's, download\nhttps://int-loop.com/.well-known/int-loop-keys.json and run:\n\n    npx @int-loop/verify pack.zip --keys int-loop-keys.json\n\nThe verifier checks that:\n\n1. Every ledger entry links to the one before it (a SHA-256 hash chain from a zero genesis hash).\n2. Every entry carries a valid Ed25519 signature from an int-loop service key.\n3. Every passkey decision (L2 and above) carries a WebAuthn assertion from a passkey enrolled\n   earlier in this ledger, by the person the decision names, over a challenge that commits to\n   exactly what was displayed, the option chosen, and any reason, conditions or question typed.\n4. Every text in texts.jsonl matches the hash the ledger records for it.\n\nTexts marked \"erased\" were removed under the tenant's retention policy. Their hashes stay in\nthe ledger, so the chain still verifies.\n\nThe verifier is open source (Apache-2.0). This pack is evidence for your own assessment. It is\nnot legal advice and does not on its own show that any regulation is met.\n";
+export declare const PACK_README = "# int-loop evidence pack\n\nThis archive is a complete, signed record of decisions made through int-loop for one\ntenant. You can check it without trusting int-loop.\n\nRun:\n\n    npx @int-loop/verify pack.zip\n\nor, to confirm the service keys are really int-loop's, download\nhttps://int-loop.com/.well-known/int-loop-keys.json and run:\n\n    npx @int-loop/verify pack.zip --keys int-loop-keys.json\n\nThe verifier checks that:\n\n1. Every ledger entry links to the one before it (a SHA-256 hash chain from a zero genesis hash).\n2. Every entry carries a valid Ed25519 signature from an int-loop service key.\n3. Every passkey decision (L2 and above) carries a WebAuthn assertion from a passkey enrolled\n   earlier in this ledger, by the person the decision names, over a challenge that commits to\n   exactly what was displayed, the option chosen, and any reason, conditions or question typed.\n4. Every text in texts.jsonl matches the hash the ledger records for it.\n5. Every anchor (an anchor.created entry) holds RFC 3161 timestamps from independent\n   timestamp authorities, over a Merkle root that includes the anchored entry. Each\n   timestamp must verify against a trusted timestamp authority root. This shows the\n   ledger up to that entry existed, unchanged, no later than the stamped time.\n   The verifier trusts a short built-in list of roots; pass --tsa-roots roots.pem to\n   use your own.\n\nTexts marked \"erased\" were removed under the tenant's retention policy. Their hashes stay in\nthe ledger, so the chain still verifies.\n\nThe verifier is open source (Apache-2.0). This pack is evidence for your own assessment. It is\nnot legal advice and does not on its own show that any regulation is met.\n";
 export declare function crc32(data: Uint8Array): number;
 export declare function buildZip(files: {
     name: string;
@@ -49,11 +50,19 @@ export type PackReport = {
     texts_checked: number;
     texts_erased: number;
     keys_source: "pack" | "trusted";
+    anchors_checked: number;
+    /** The newest anchored entry, and the earliest time an independent TSA vouches for it. */
+    anchored_through: AnchorReport["anchored_through"];
+    tsa_roots_source: "default" | "supplied";
     failures: VerificationFailure[];
 };
+export type PackVerifyOptions = {
+    /** Trusted timestamp authority roots, as DER certificates. Default: KNOWN_TSA_ROOTS. */
+    tsaRoots?: readonly Uint8Array[];
+};
 /**
  * Verifies an evidence pack. With `trustedKeys` (from int-loop's published key list),
  * the pack's own keys.json must agree with them; without, the report says the keys came
  * only from the pack.
  */
-export declare function verifyEvidencePack(zip: Uint8Array, trustedKeys?: PackKeys): Promise<PackReport>;
+export declare function verifyEvidencePack(zip: Uint8Array, trustedKeys?: PackKeys, options?: PackVerifyOptions): Promise<PackReport>;

package/dist/evidence-pack.js

@@ -10,9 +10,11 @@
 // The zip is stored, not compressed, with fixed timestamps: the same records always
 // produce the same bytes, and the reader needs no decompressor.
 import { z } from "zod";
+import { verifyAnchors } from "./anchor.js";
 import { bytesEqual, fromBase64Url, sha256Hex, utf8 } from "./hash.js";
 import { Base64Url, Sha256Hex, TenantId, Timestamp } from "./schema/common.js";
 import { LedgerEntry, ServiceKeyId } from "./schema/ledger.js";
+import { knownTsaRootsDer } from "./tsa-roots.js";
 import { verifyLedger } from "./verify.js";
 export const EVIDENCE_PACK_FORMAT = "int-loop-evidence-pack";
 export const PackManifest = z.strictObject({
@@ -75,6 +77,12 @@ The verifier checks that:
    earlier in this ledger, by the person the decision names, over a challenge that commits to
    exactly what was displayed, the option chosen, and any reason, conditions or question typed.
 4. Every text in texts.jsonl matches the hash the ledger records for it.
+5. Every anchor (an anchor.created entry) holds RFC 3161 timestamps from independent
+   timestamp authorities, over a Merkle root that includes the anchored entry. Each
+   timestamp must verify against a trusted timestamp authority root. This shows the
+   ledger up to that entry existed, unchanged, no later than the stamped time.
+   The verifier trusts a short built-in list of roots; pass --tsa-roots roots.pem to
+   use your own.
 
 Texts marked "erased" were removed under the tenant's retention policy. Their hashes stay in
 the ledger, so the chain still verifies.
@@ -201,7 +209,7 @@ export function readZip(zip) {
  * the pack's own keys.json must agree with them; without, the report says the keys came
  * only from the pack.
  */
-export async function verifyEvidencePack(zip, trustedKeys) {
+export async function verifyEvidencePack(zip, trustedKeys, options = {}) {
     const failures = [];
     const report = (extra) => ({
         ok: false,
@@ -211,6 +219,9 @@ export async function verifyEvidencePack(zip, trustedKeys) {
         texts_checked: 0,
         texts_erased: 0,
         keys_source: trustedKeys ? "trusted" : "pack",
+        anchors_checked: 0,
+        anchored_through: null,
+        tsa_roots_source: options.tsaRoots ? "supplied" : "default",
         failures,
         ...extra,
     });
@@ -329,5 +340,16 @@ export async function verifyEvidencePack(zip, trustedKeys) {
             if (!present.has(h))
                 fail("texts", `entry ${e.seq} references text ${h}, which is not in the pack`, e.seq);
     }
-    return report({ ok: failures.length === 0, manifest, entries_checked: ledger.entries_checked, decisions_checked: ledger.decisions_checked, texts_checked, texts_erased });
+    const anchors = await verifyAnchors(parsed, options.tsaRoots ?? knownTsaRootsDer());
+    failures.push(...anchors.failures);
+    return report({
+        ok: failures.length === 0,
+        manifest,
+        entries_checked: ledger.entries_checked,
+        decisions_checked: ledger.decisions_checked,
+        texts_checked,
+        texts_erased,
+        anchors_checked: anchors.anchors_checked,
+        anchored_through: anchors.anchored_through,
+    });
 }

package/dist/index.d.ts

@@ -2,11 +2,17 @@ export * from "./jcs.ts";
 export * from "./hash.ts";
 export * from "./cbor.ts";
 export * from "./binding.ts";
+export * from "./comprehension.ts";
 export * from "./webauthn.ts";
 export * from "./ledger.ts";
 export * from "./verify.ts";
 export * from "./evidence-pack.ts";
 export * from "./receipt.ts";
+export * from "./der.ts";
+export * from "./x509.ts";
+export * from "./tsp.ts";
+export * from "./tsa-roots.ts";
+export * from "./anchor.ts";
 export * from "./schema/common.ts";
 export * from "./schema/request.ts";
 export * from "./schema/directory.ts";

package/dist/index.js

@@ -2,11 +2,17 @@ export * from "./jcs.js";
 export * from "./hash.js";
 export * from "./cbor.js";
 export * from "./binding.js";
+export * from "./comprehension.js";
 export * from "./webauthn.js";
 export * from "./ledger.js";
 export * from "./verify.js";
 export * from "./evidence-pack.js";
 export * from "./receipt.js";
+export * from "./der.js";
+export * from "./x509.js";
+export * from "./tsp.js";
+export * from "./tsa-roots.js";
+export * from "./anchor.js";
 export * from "./schema/common.js";
 export * from "./schema/request.js";
 export * from "./schema/directory.js";

package/dist/schema/ledger.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const LEDGER_ENTRY_TYPES: readonly ["request.created", "request.routed", "notification.sent", "notification.failed", "request.viewed", "decision.cast", "decision.invalidated", "request.info_requested", "request.resolved", "request.expired", "request.cancelled", "policy.loaded", "directory.changed", "passkey.enrolled", "passkey.revoked", "export.created", "pack.activated", "pack.deactivated", "anchor.created"];
+export declare const LEDGER_ENTRY_TYPES: readonly ["request.created", "request.routed", "notification.sent", "notification.failed", "request.viewed", "decision.cast", "decision.invalidated", "request.info_requested", "request.resolved", "request.expired", "request.cancelled", "receipt.redeemed", "policy.loaded", "directory.changed", "passkey.enrolled", "passkey.revoked", "export.created", "pack.activated", "pack.deactivated", "anchor.created"];
 export declare const LedgerEntryType: z.ZodEnum<{
     "anchor.created": "anchor.created";
     "decision.cast": "decision.cast";
@@ -13,6 +13,7 @@ export declare const LedgerEntryType: z.ZodEnum<{
     "passkey.enrolled": "passkey.enrolled";
     "passkey.revoked": "passkey.revoked";
     "policy.loaded": "policy.loaded";
+    "receipt.redeemed": "receipt.redeemed";
     "request.cancelled": "request.cancelled";
     "request.created": "request.created";
     "request.expired": "request.expired";
@@ -39,6 +40,7 @@ export declare const LedgerEntry: z.ZodObject<{
         "passkey.enrolled": "passkey.enrolled";
         "passkey.revoked": "passkey.revoked";
         "policy.loaded": "policy.loaded";
+        "receipt.redeemed": "receipt.redeemed";
         "request.cancelled": "request.cancelled";
         "request.created": "request.created";
         "request.expired": "request.expired";

package/dist/schema/ledger.js

@@ -13,6 +13,8 @@ export const LEDGER_ENTRY_TYPES = [
     "request.resolved",
     "request.expired",
     "request.cancelled",
+    // The executor used the request's receipt. A receipt is redeemed at most once.
+    "receipt.redeemed",
     "policy.loaded",
     "directory.changed",
     "passkey.enrolled",

package/dist/schema/policy.d.ts

@@ -136,6 +136,7 @@ export declare const Rule: z.ZodObject<{
         L4: "L4";
     }>>;
     respond_within: z.ZodOptional<z.ZodString>;
+    remind_after: z.ZodOptional<z.ZodString>;
     separation_of_duties: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type Rule = z.infer<typeof Rule>;
@@ -150,6 +151,7 @@ export declare const Policy: z.ZodObject<{
             L4: "L4";
         }>>;
         respond_within: z.ZodDefault<z.ZodString>;
+        remind_after: z.ZodOptional<z.ZodString>;
         on_timeout: z.ZodDefault<z.ZodLiteral<"expired">>;
         deny_is_veto: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>;
@@ -206,6 +208,7 @@ export declare const Policy: z.ZodObject<{
             L4: "L4";
         }>>;
         respond_within: z.ZodOptional<z.ZodString>;
+        remind_after: z.ZodOptional<z.ZodString>;
         separation_of_duties: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/schema/policy.js

@@ -45,6 +45,8 @@ export const Rule = z.strictObject({
     stages: z.array(Stage).min(1),
     assurance: AssuranceLevel.optional(),
     respond_within: Duration.optional(),
+    // Remind approvers who have not decided once this long after the request is sent. The shortest applicable wins.
+    remind_after: Duration.optional(),
     separation_of_duties: z.boolean().optional(),
 });
 export const Policy = z
@@ -54,6 +56,8 @@ export const Policy = z
     defaults: z.strictObject({
         assurance: AssuranceLevel.default("L2"),
         respond_within: Duration.default("24h"),
+        // Optional: with no remind_after anywhere, nobody is reminded.
+        remind_after: Duration.optional(),
         // Timeouts resolve to expired, never to approval. There is no other value.
         on_timeout: z.literal("expired").default("expired"),
         deny_is_veto: z.boolean().default(true),

package/dist/schema/request.d.ts

@@ -247,5 +247,6 @@ export declare const DecisionStatus: z.ZodObject<{
         }, z.core.$strict>;
         sig: z.ZodString;
     }, z.core.$strict>>;
+    receipt_redeemed_at: z.ZodNullable<z.ZodISODateTime>;
 }, z.core.$strict>;
 export type DecisionStatus = z.infer<typeof DecisionStatus>;

package/dist/schema/request.js

@@ -97,4 +97,6 @@ export const DecisionStatus = z.strictObject({
     evidence_url: z.url(),
     // Signed proof of what was approved, for the system that carries out the action. Null unless approved or chosen.
     receipt: Receipt.nullable(),
+    // When the receipt was redeemed, if it has been. A redeemed receipt cannot be used again.
+    receipt_redeemed_at: Timestamp.nullable(),
 });

package/dist/tsa-roots.d.ts

@@ -0,0 +1,9 @@
+export type TsaRoot = {
+    id: string;
+    name: string;
+    sha256: string;
+    pem: string;
+};
+export declare const KNOWN_TSA_ROOTS: readonly TsaRoot[];
+/** The default roots, as DER. */
+export declare function knownTsaRootsDer(): Uint8Array<ArrayBuffer>[];

package/dist/tsa-roots.js

@@ -0,0 +1,150 @@
+// Timestamp authority roots that int-loop and int-loop-verify trust by default. An auditor
+// can replace this list with their own (int-loop-verify --tsa-roots roots.pem).
+//
+// Provenance, checked 2026-11-09 (SHA-256 fingerprints):
+//   FreeTSA Root CA          a6379e7cecc05faa3cbf076013d745e327bbbaa38c0b9af22469d4701d18aabc
+//                            from https://freetsa.org/files/cacert.pem, identical to the root FreeTSA sends
+//   DigiCert Trusted Root G4 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
+//                            from the macOS system root store
+//   Sectigo Public Time Stamping Root R46
+//                            4941b001b8a97e961b7817c9d9e960ec4b056bfc915a8c1aabf6ef6b3ac046a5
+//                            from the macOS system root store
+//
+// tests/core/tsp.test.ts checks each fingerprint, so a change here cannot go unnoticed.
+import { fromPem } from "./der.js";
+export const KNOWN_TSA_ROOTS = [
+    {
+        id: "freetsa",
+        name: "FreeTSA Root CA",
+        sha256: "a6379e7cecc05faa3cbf076013d745e327bbbaa38c0b9af22469d4701d18aabc",
+        pem: `
+      -----BEGIN CERTIFICATE-----
+      MIIH/zCCBeegAwIBAgIJAMHphhYNqOmAMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYD
+      VQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZy
+      ZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIw
+      EAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUw
+      HhcNMTYwMzEzMDE1MjEzWhcNNDEwMzA3MDE1MjEzWjCBlTERMA8GA1UEChMIRnJl
+      ZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9y
+      ZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJ
+      V3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMIICIjANBgkq
+      hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtgKODjAy8REQ2WTNqUudAnjhlCrpE6ql
+      mQfNppeTmVvZrH4zutn+NwTaHAGpjSGv4/WRpZ1wZ3BRZ5mPUBZyLgq0YrIfQ5Fx
+      0s/MRZPzc1r3lKWrMR9sAQx4mN4z11xFEO529L0dFJjPF9MD8Gpd2feWzGyptlel
+      b+PqT+++fOa2oY0+NaMM7l/xcNHPOaMz0/2olk0i22hbKeVhvokPCqhFhzsuhKsm
+      q4Of/o+t6dI7sx5h0nPMm4gGSRhfq+z6BTRgCrqQG2FOLoVFgt6iIm/BnNffUr7V
+      DYd3zZmIwFOj/H3DKHoGik/xK3E82YA2ZulVOFRW/zj4ApjPa5OFbpIkd0pmzxzd
+      EcL479hSA9dFiyVmSxPtY5ze1P+BE9bMU1PScpRzw8MHFXxyKqW13Qv7LWw4sbk3
+      SciB7GACbQiVGzgkvXG6y85HOuvWNvC5GLSiyP9GlPB0V68tbxz4JVTRdw/Xn/XT
+      FNzRBM3cq8lBOAVt/PAX5+uFcv1S9wFE8YjaBfWCP1jdBil+c4e+0tdywT2oJmYB
+      BF/kEt1wmGwMmHunNEuQNzh1FtJY54hbUfiWi38mASE7xMtMhfj/C4SvapiDN837
+      gYaPfs8x3KZxbX7C3YAsFnJinlwAUss1fdKar8Q/YVs7H/nU4c4Ixxxz4f67fcVq
+      M2ITKentbCMCAwEAAaOCAk4wggJKMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQD
+      AgHGMB0GA1UdDgQWBBT6VQ2MNGZRQ0z357OnbJWveuaklzCBygYDVR0jBIHCMIG/
+      gBT6VQ2MNGZRQ0z357OnbJWveuakl6GBm6SBmDCBlTERMA8GA1UEChMIRnJlZSBU
+      U0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEi
+      MCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vl
+      cnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFggkAwemGFg2o6YAw
+      MwYDVR0fBCwwKjAooCagJIYiaHR0cDovL3d3dy5mcmVldHNhLm9yZy9yb290X2Nh
+      LmNybDCBzwYDVR0gBIHHMIHEMIHBBgorBgEEAYHyJAEBMIGyMDMGCCsGAQUFBwIB
+      FidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLmh0bWwwMgYIKwYB
+      BQUHAgEWJmh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMucGRmMEcG
+      CCsGAQUFBwICMDsaOUZyZWVUU0EgdHJ1c3RlZCB0aW1lc3RhbXBpbmcgU29mdHdh
+      cmUgYXMgYSBTZXJ2aWNlIChTYWFTKTA3BggrBgEFBQcBAQQrMCkwJwYIKwYBBQUH
+      MAGGG2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDANBgkqhkiG9w0BAQ0FAAOC
+      AgEAaK9+v5OFYu9M6ztYC+L69sw1omdyli89lZAfpWMMh9CRmJhM6KBqM/ipwoLt
+      nxyxGsbCPhcQjuTvzm+ylN6VwTMmIlVyVSLKYZcdSjt/eCUN+41K7sD7GVmxZBAF
+      ILnBDmTGJmLkrU0KuuIpj8lI/E6Z6NnmuP2+RAQSHsfBQi6sssnXMo4HOW5gtPO7
+      gDrUpVXID++1P4XndkoKn7Svw5n0zS9fv1hxBcYIHPPQUze2u30bAQt0n0iIyRLz
+      aWuhtpAtd7ffwEbASgzB7E+NGF4tpV37e8KiA2xiGSRqT5ndu28fgpOY87gD3ArZ
+      DctZvvTCfHdAS5kEO3gnGGeZEVLDmfEsv8TGJa3AljVa5E40IQDsUXpQLi8G+UC4
+      1DWZu8EVT4rnYaCw1VX7ShOR1PNCCvjb8S8tfdudd9zhU3gEB0rxdeTy1tVbNLXW
+      99y90xcwr1ZIDUwM/xQ/noO8FRhm0LoPC73Ef+J4ZBdrvWwauF3zJe33d4ibxEcb
+      8/pz5WzFkeixYM2nsHhqHsBKw7JPouKNXRnl5IAE1eFmqDyC7G/VT7OF669xM6hb
+      Ut5G21JE4cNK6NNucS+fzg1JPX0+3VhsYZjj7D5uljRvQXrJ8iHgr/M6j2oLHvTA
+      I2MLdq2qjZFDOCXsxBxJpbmLGBx9ow6ZerlUxzws2AWv2pk=
+      -----END CERTIFICATE-----
+    `,
+    },
+    {
+        id: "digicert-g4",
+        name: "DigiCert Trusted Root G4",
+        sha256: "552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988",
+        pem: `
+      -----BEGIN CERTIFICATE-----
+      MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
+      MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+      d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
+      RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
+      UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
+      Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
+      SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
+      ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
+      xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
+      ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
+      DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
+      jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
+      CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
+      EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
+      fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
+      uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
+      chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
+      9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+      hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
+      ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
+      SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
+      +SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
+      fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
+      sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
+      cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
+      0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
+      4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
+      r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
+      /YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
+      gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
+      -----END CERTIFICATE-----
+    `,
+    },
+    {
+        id: "sectigo-r46",
+        name: "Sectigo Public Time Stamping Root R46",
+        sha256: "4941b001b8a97e961b7817c9d9e960ec4b056bfc915a8c1aabf6ef6b3ac046a5",
+        pem: `
+      -----BEGIN CERTIFICATE-----
+      MIIFejCCA2KgAwIBAgIQeD0FbPqDLn5p+FYidp8CuTANBgkqhkiG9w0BAQwFADBX
+      MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMS4wLAYDVQQD
+      EyVTZWN0aWdvIFB1YmxpYyBUaW1lIFN0YW1waW5nIFJvb3QgUjQ2MB4XDTIxMDMy
+      MjAwMDAwMFoXDTQ2MDMyMTIzNTk1OVowVzELMAkGA1UEBhMCR0IxGDAWBgNVBAoT
+      D1NlY3RpZ28gTGltaXRlZDEuMCwGA1UEAxMlU2VjdGlnbyBQdWJsaWMgVGltZSBT
+      dGFtcGluZyBSb290IFI0NjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+      AIid2LlFZ50d3ei5JoGaVFTAfEkFm8xaFQ/ZlBBEtEFAgXcUmanU5HYsyAhTXiDQ
+      kiUvpVdYqZ1uYoZEMgtHES1l1Cc6HaqZzEbOOp6YiTx63ywTon434aXVydmhx7Dx
+      4IBrAou7hNGsKioIBPy5GMN7KmgYmuu4f92sKKjbxqohUSfjk1mJlAjthgF7Hjx4
+      vvyVDQGsd5KarLW5d73E3ThobSkob2SL48LpUR/O627pDchxll+bTSv1gASn/hp6
+      IuHJorEu6EopoB1CNFp/+HpTXeNARXUmdRMKbnXWflq+/g36NJXB35ZvxQw6zid6
+      1qmrlD/IbKJA6COw/8lFSPQwBP1ityZdwuCysCKZ9ZjczMqbUcLFyq6KdOpuzVDR
+      3ZUwxDKL1wCAxgL2Mpz7eZbrb/JWXiOcNzDpQsmwGQ6Stw8tTCqPumhLRPb7YkzM
+      8/6NnWH3T9ClmcGSF22LEyJYNWCHrQqYubNeKolzqUbCqhSqmr/UdUeb49zYHr7A
+      LL8bAJyPDmubNqMtuaobKASBqP84uhqcRY/pjnYd+V5/dcu9ieERjiRKKsxCG1t6
+      tG9oj7liwPddXEcYGOUiWLm742st50jGwTzxbMpepmOP1mLnJskvZaN5e45NuzAH
+      teORlsSuDt5t4BBRCJL+5EZnnw0ezntk9R8QJyAkL6/bAgMBAAGjQjBAMB0GA1Ud
+      DgQWBBT2d2rdP/0BE/8WoWyCAi/QCj0UJTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0T
+      AQH/BAUwAwEB/zANBgkqhkiG9w0BAQwFAAOCAgEACv68sZqZvmHk7JoU7AfTEZ7b
+      X45u40OrLX/6vzHQAwDg1TB00bWbiwj+7+we60BP8AMsw1h5NCXWxeyvrEVC54Mi
+      rwVrcF6SFGjRwRoelRuiaZ5FDO4oWhaePjZx3/jkQ7j653CA5WscYqlneLXBEZiY
+      o6rRNqnsZHZTQ606mlkNpsy3TFMADv5whZmilVEZ83OvydfH2DNL3FTkpZG7+lHS
+      1DFHMSUB5UtSSeSRg2UWTXwU5oObGjFk/35fC/dlF+nJIXdqsw0TZSS86bi5GRCJ
+      VjqjnkpZ0Jut7ucEv4PNOIU8ijkMRj17QPjHMtdy+WxBDDSdas/UFTVB/GF+Fofn
+      OD3iZ4tXxFjPU3EWRcMWx8fcGyzlBfcjeoPNbNC7wfyV9Qkzfk2Bd48jGxG7OThY
+      Wolc56vmBHqDEfguDwYc9AeWirMVRDi+WYlsktzAEObiFoPqs+LWU5q7+Q1+nEcs
+      tNuDIedeBRcHmtjL2hV3luuEWwDSnRhSjhPLPXzqpJ1rG3r4yqm1NjKg5A5QO9Az
+      veHqRQldluTSKuu96oPEPusL2oF+4MxkJ+SQMGFWTw/PNCblUN8GXeL5+mR20diP
+      5LiJMq8U3IpM/0Q7OFFQ+lXuYFIuDvUprWBPsp5La2WhL2+iLVVXItSl7up5yQqX
+      XftzTXTX48FRiJ6PA9o=
+      -----END CERTIFICATE-----
+    `,
+    },
+];
+/** The default roots, as DER. */
+export function knownTsaRootsDer() {
+    return KNOWN_TSA_ROOTS.flatMap((r) => fromPem(r.pem));
+}

package/dist/tsp.d.ts

@@ -0,0 +1,37 @@
+/** A TimeStampReq for a SHA-256 digest, asking for the signing certificate to be included. */
+export declare function buildTimestampRequest(digest: Uint8Array, nonce: Uint8Array): Uint8Array<ArrayBuffer>;
+export type TimestampReply = {
+    granted: true;
+    token: Uint8Array<ArrayBuffer>;
+} | {
+    granted: false;
+    reason: string;
+};
+/** Reads a TimeStampResp. A refusal is a result, not an error; malformed bytes throw. */
+export declare function parseTimestampReply(bytes: Uint8Array): TimestampReply;
+export type TimestampExpectation = {
+    /** The SHA-256 digest that should have been stamped. */
+    digest: Uint8Array;
+    /** The nonce sent with the request, when checking a fresh reply. */
+    nonce?: Uint8Array;
+    /** Trusted TSA roots, as DER certificates. */
+    roots: readonly Uint8Array[];
+};
+export type TimestampInfo = {
+    /** The stamped time, as the TSA states it. */
+    gen_time: string;
+    serial: string;
+    policy: string;
+    /** Signing certificate first, trusted root last. */
+    chain: string[];
+    /** SHA-256 (hex) of the trusted root the chain ends at: which authority vouches for the time. */
+    root_sha256: string;
+};
+export type TimestampResult = ({
+    ok: true;
+} & TimestampInfo) | {
+    ok: false;
+    reason: string;
+};
+/** Verifies a TimeStampToken. Never throws: anything malformed is a failure. */
+export declare function verifyTimestampToken(token: Uint8Array, expect: TimestampExpectation): Promise<TimestampResult>;