fca-rqzax-remake 0.0.1-security → 8.19.2

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/asn1/tag.d.ts

@@ -0,0 +1,28 @@
+export declare const UNIVERSAL_TAG: {
+    BOOLEAN: number;
+    INTEGER: number;
+    BIT_STRING: number;
+    OCTET_STRING: number;
+    OBJECT_IDENTIFIER: number;
+    SEQUENCE: number;
+    SET: number;
+    PRINTABLE_STRING: number;
+    UTC_TIME: number;
+    GENERALIZED_TIME: number;
+};
+export declare class ASN1Tag {
+    readonly number: number;
+    readonly constructed: boolean;
+    readonly class: number;
+    constructor(enc: number);
+    isUniversal(): boolean;
+    isContextSpecific(num?: number): boolean;
+    isBoolean(): boolean;
+    isInteger(): boolean;
+    isBitString(): boolean;
+    isOctetString(): boolean;
+    isOID(): boolean;
+    isUTCTime(): boolean;
+    isGeneralizedTime(): boolean;
+    toDER(): number;
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/asn1/tag.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASN1Tag = exports.UNIVERSAL_TAG = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const error_1 = require("./error");
+exports.UNIVERSAL_TAG = {
+    BOOLEAN: 0x01,
+    INTEGER: 0x02,
+    BIT_STRING: 0x03,
+    OCTET_STRING: 0x04,
+    OBJECT_IDENTIFIER: 0x06,
+    SEQUENCE: 0x10,
+    SET: 0x11,
+    PRINTABLE_STRING: 0x13,
+    UTC_TIME: 0x17,
+    GENERALIZED_TIME: 0x18,
+};
+const TAG_CLASS = {
+    UNIVERSAL: 0x00,
+    APPLICATION: 0x01,
+    CONTEXT_SPECIFIC: 0x02,
+    PRIVATE: 0x03,
+};
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-tag-bytes
+class ASN1Tag {
+    constructor(enc) {
+        // Bits 0 through 4 are the tag number
+        this.number = enc & 0x1f;
+        // Bit 5 is the constructed bit
+        this.constructed = (enc & 0x20) === 0x20;
+        // Bit 6 & 7 are the class
+        this.class = enc >> 6;
+        if (this.number === 0x1f) {
+            throw new error_1.ASN1ParseError('long form tags not supported');
+        }
+        if (this.class === TAG_CLASS.UNIVERSAL && this.number === 0x00) {
+            throw new error_1.ASN1ParseError('unsupported tag 0x00');
+        }
+    }
+    isUniversal() {
+        return this.class === TAG_CLASS.UNIVERSAL;
+    }
+    isContextSpecific(num) {
+        const res = this.class === TAG_CLASS.CONTEXT_SPECIFIC;
+        return num !== undefined ? res && this.number === num : res;
+    }
+    isBoolean() {
+        return this.isUniversal() && this.number === exports.UNIVERSAL_TAG.BOOLEAN;
+    }
+    isInteger() {
+        return this.isUniversal() && this.number === exports.UNIVERSAL_TAG.INTEGER;
+    }
+    isBitString() {
+        return this.isUniversal() && this.number === exports.UNIVERSAL_TAG.BIT_STRING;
+    }
+    isOctetString() {
+        return this.isUniversal() && this.number === exports.UNIVERSAL_TAG.OCTET_STRING;
+    }
+    isOID() {
+        return (this.isUniversal() && this.number === exports.UNIVERSAL_TAG.OBJECT_IDENTIFIER);
+    }
+    isUTCTime() {
+        return this.isUniversal() && this.number === exports.UNIVERSAL_TAG.UTC_TIME;
+    }
+    isGeneralizedTime() {
+        return this.isUniversal() && this.number === exports.UNIVERSAL_TAG.GENERALIZED_TIME;
+    }
+    toDER() {
+        return this.number | (this.constructed ? 0x20 : 0x00) | (this.class << 6);
+    }
+}
+exports.ASN1Tag = ASN1Tag;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/cert.d.ts

@@ -0,0 +1,48 @@
+/// <reference types="node" />
+import * as sigstore from '../types/sigstore';
+import { ASN1Obj } from './asn1/obj';
+import { x509AuthorityKeyIDExtension, x509BasicConstraintsExtension, x509Extension, x509KeyUsageExtension, x509SCTExtension, x509SubjectAlternativeNameExtension, x509SubjectKeyIDExtension } from './ext';
+interface SCTVerificationResult {
+    verified: boolean;
+    logID: Buffer;
+}
+export declare class x509Certificate {
+    root: ASN1Obj;
+    constructor(asn1: ASN1Obj);
+    static parse(cert: Buffer | string): x509Certificate;
+    get tbsCertificate(): ASN1Obj;
+    get version(): string;
+    get notBefore(): Date;
+    get notAfter(): Date;
+    get issuer(): Buffer;
+    get subject(): Buffer;
+    get publicKey(): Buffer;
+    get signatureAlgorithm(): string;
+    get signatureValue(): Buffer;
+    get extensions(): ASN1Obj[];
+    get extKeyUsage(): x509KeyUsageExtension | undefined;
+    get extBasicConstraints(): x509BasicConstraintsExtension | undefined;
+    get extSubjectAltName(): x509SubjectAlternativeNameExtension | undefined;
+    get extAuthorityKeyID(): x509AuthorityKeyIDExtension | undefined;
+    get extSubjectKeyID(): x509SubjectKeyIDExtension | undefined;
+    get extSCT(): x509SCTExtension | undefined;
+    get isCA(): boolean;
+    extension(oid: string): x509Extension | undefined;
+    verify(issuerCertificate?: x509Certificate): boolean;
+    validForDate(date: Date): boolean;
+    equals(other: x509Certificate): boolean;
+    verifySCTs(issuer: x509Certificate, logs: sigstore.TransparencyLogInstance[]): SCTVerificationResult[];
+    private clone;
+    private findExtension;
+    private checkRecognizedExtensions;
+    private get tbsCertificateObj();
+    private get signatureAlgorithmObj();
+    private get signatureValueObj();
+    private get versionObj();
+    private get issuerObj();
+    private get validityObj();
+    private get subjectObj();
+    private get subjectPublicKeyInfoObj();
+    private get extensionsObj();
+}
+export {};

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/cert.js

@@ -0,0 +1,241 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.x509Certificate = void 0;
+const util_1 = require("../util");
+const stream_1 = require("../util/stream");
+const obj_1 = require("./asn1/obj");
+const ext_1 = require("./ext");
+const EXTENSION_OID_SUBJECT_KEY_ID = '2.5.29.14';
+const EXTENSION_OID_KEY_USAGE = '2.5.29.15';
+const EXTENSION_OID_SUBJECT_ALT_NAME = '2.5.29.17';
+const EXTENSION_OID_BASIC_CONSTRAINTS = '2.5.29.19';
+const EXTENSION_OID_AUTHORITY_KEY_ID = '2.5.29.35';
+const EXTENSION_OID_SCT = '1.3.6.1.4.1.11129.2.4.2';
+// List of recognized critical extensions
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2
+const RECOGNIZED_EXTENSIONS = [
+    EXTENSION_OID_KEY_USAGE,
+    EXTENSION_OID_BASIC_CONSTRAINTS,
+    EXTENSION_OID_SUBJECT_ALT_NAME,
+];
+const ECDSA_SIGNATURE_ALGOS = {
+    '1.2.840.10045.4.3.1': 'sha224',
+    '1.2.840.10045.4.3.2': 'sha256',
+    '1.2.840.10045.4.3.3': 'sha384',
+    '1.2.840.10045.4.3.4': 'sha512',
+};
+class x509Certificate {
+    constructor(asn1) {
+        this.root = asn1;
+        if (!this.checkRecognizedExtensions()) {
+            throw new Error('Certificate contains unrecognized critical extensions');
+        }
+    }
+    static parse(cert) {
+        const der = typeof cert === 'string' ? util_1.pem.toDER(cert) : cert;
+        const asn1 = obj_1.ASN1Obj.parseBuffer(der);
+        return new x509Certificate(asn1);
+    }
+    get tbsCertificate() {
+        return this.tbsCertificateObj;
+    }
+    get version() {
+        // version number is the first element of the version context specific tag
+        const ver = this.versionObj.subs[0].toInteger();
+        return `v${(ver + BigInt(1)).toString()}`;
+    }
+    get notBefore() {
+        // notBefore is the first element of the validity sequence
+        return this.validityObj.subs[0].toDate();
+    }
+    get notAfter() {
+        // notAfter is the second element of the validity sequence
+        return this.validityObj.subs[1].toDate();
+    }
+    get issuer() {
+        return this.issuerObj.value;
+    }
+    get subject() {
+        return this.subjectObj.value;
+    }
+    get publicKey() {
+        return this.subjectPublicKeyInfoObj.raw;
+    }
+    get signatureAlgorithm() {
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        return ECDSA_SIGNATURE_ALGOS[oid];
+    }
+    get signatureValue() {
+        // Signature value is a bit string, so we need to skip the first byte
+        return this.signatureValueObj.value.subarray(1);
+    }
+    get extensions() {
+        // The extension list is the first (and only) element of the extensions
+        // context specific tag
+        const extSeq = this.extensionsObj?.subs[0];
+        return extSeq?.subs || [];
+    }
+    get extKeyUsage() {
+        const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);
+        return ext ? new ext_1.x509KeyUsageExtension(ext) : undefined;
+    }
+    get extBasicConstraints() {
+        const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);
+        return ext ? new ext_1.x509BasicConstraintsExtension(ext) : undefined;
+    }
+    get extSubjectAltName() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);
+        return ext ? new ext_1.x509SubjectAlternativeNameExtension(ext) : undefined;
+    }
+    get extAuthorityKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);
+        return ext ? new ext_1.x509AuthorityKeyIDExtension(ext) : undefined;
+    }
+    get extSubjectKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);
+        return ext ? new ext_1.x509SubjectKeyIDExtension(ext) : undefined;
+    }
+    get extSCT() {
+        const ext = this.findExtension(EXTENSION_OID_SCT);
+        return ext ? new ext_1.x509SCTExtension(ext) : undefined;
+    }
+    get isCA() {
+        const ca = this.extBasicConstraints?.isCA || false;
+        // If the KeyUsage extension is present, keyCertSign must be set
+        if (this.extKeyUsage) {
+            ca && this.extKeyUsage.keyCertSign;
+        }
+        return ca;
+    }
+    extension(oid) {
+        const ext = this.findExtension(oid);
+        return ext ? new ext_1.x509Extension(ext) : undefined;
+    }
+    verify(issuerCertificate) {
+        // Use the issuer's public key if provided, otherwise use the subject's
+        const publicKey = issuerCertificate?.publicKey || this.publicKey;
+        const key = util_1.crypto.createPublicKey(publicKey);
+        return util_1.crypto.verifyBlob(this.tbsCertificate.raw, key, this.signatureValue, this.signatureAlgorithm);
+    }
+    validForDate(date) {
+        return this.notBefore <= date && date <= this.notAfter;
+    }
+    equals(other) {
+        return this.root.raw.equals(other.root.raw);
+    }
+    verifySCTs(issuer, logs) {
+        let extSCT;
+        // Verifying the SCT requires that we remove the SCT extension and
+        // re-encode the TBS structure to DER -- this value is part of the data
+        // over which the signature is calculated. Since this is a destructive action
+        // we create a copy of the certificate so we can remove the SCT extension
+        // without affecting the original certificate.
+        const clone = this.clone();
+        // Intentionally not using the findExtension method here because we want to
+        // remove the the SCT extension from the certificate before calculating the
+        // PreCert structure
+        for (let i = 0; i < clone.extensions.length; i++) {
+            const ext = clone.extensions[i];
+            if (ext.subs[0].toOID() === EXTENSION_OID_SCT) {
+                extSCT = new ext_1.x509SCTExtension(ext);
+                // Remove the extension from the certificate
+                clone.extensions.splice(i, 1);
+                break;
+            }
+        }
+        if (!extSCT) {
+            throw new Error('Certificate does not contain SCT extension');
+        }
+        if (extSCT?.signedCertificateTimestamps?.length === 0) {
+            throw new Error('Certificate does not contain any SCTs');
+        }
+        // Construct the PreCert structure
+        // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+        const preCert = new stream_1.ByteStream();
+        // Calculate hash of the issuer's public key
+        const issuerId = util_1.crypto.hash(issuer.publicKey);
+        preCert.appendView(issuerId);
+        // Re-encodes the certificate to DER after removing the SCT extension
+        const tbs = clone.tbsCertificate.toDER();
+        preCert.appendUint24(tbs.length);
+        preCert.appendView(tbs);
+        // Calculate and return the verification results for each SCT
+        return extSCT.signedCertificateTimestamps.map((sct) => ({
+            logID: sct.logID,
+            verified: sct.verify(preCert.buffer, logs),
+        }));
+    }
+    // Creates a copy of the certificate with a new buffer
+    clone() {
+        const clone = Buffer.alloc(this.root.raw.length);
+        this.root.raw.copy(clone);
+        return x509Certificate.parse(clone);
+    }
+    findExtension(oid) {
+        // Find the extension with the given OID. The OID will always be the first
+        // element of the extension sequence
+        return this.extensions.find((ext) => ext.subs[0].toOID() === oid);
+    }
+    // A certificate should be considered invalid if it contains critical
+    // extensions that are not recognized
+    checkRecognizedExtensions() {
+        // The extension list is the first (and only) element of the extensions
+        // context specific tag
+        const extSeq = this.extensionsObj?.subs[0];
+        const exts = extSeq?.subs.map((ext) => new ext_1.x509Extension(ext));
+        // Check for unrecognized critical extensions
+        return (!exts ||
+            exts.every((ext) => !ext.critical || RECOGNIZED_EXTENSIONS.includes(ext.oid)));
+    }
+    /////////////////////////////////////////////////////////////////////////////
+    // The following properties use the documented x509 structure to locate the
+    // desired ASN.1 object
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1
+    get tbsCertificateObj() {
+        // tbsCertificate is the first element of the certificate sequence
+        return this.root.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2
+    get signatureAlgorithmObj() {
+        // signatureAlgorithm is the second element of the certificate sequence
+        return this.root.subs[1];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3
+    get signatureValueObj() {
+        // signatureValue is the third element of the certificate sequence
+        return this.root.subs[2];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1
+    get versionObj() {
+        // version is the first element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4
+    get issuerObj() {
+        // issuer is the fourth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[3];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5
+    get validityObj() {
+        // version is the fifth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[4];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6
+    get subjectObj() {
+        // subject is the sixth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[5];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7
+    get subjectPublicKeyInfoObj() {
+        // subjectPublicKeyInfo is the seventh element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[6];
+    }
+    // Extensions can't be located by index because their position varies. Instead,
+    // we need to find the extensions context specific tag
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9
+    get extensionsObj() {
+        return this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(0x03));
+    }
+}
+exports.x509Certificate = x509Certificate;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/ext.d.ts

@@ -0,0 +1,41 @@
+/// <reference types="node" />
+import { ASN1Obj } from './asn1/obj';
+import { SignedCertificateTimestamp } from './sct';
+export declare class x509Extension {
+    protected root: ASN1Obj;
+    constructor(asn1: ASN1Obj);
+    get oid(): string;
+    get critical(): boolean;
+    get value(): Buffer;
+    protected get extnValueObj(): ASN1Obj;
+}
+export declare class x509BasicConstraintsExtension extends x509Extension {
+    get isCA(): boolean;
+    get pathLenConstraint(): bigint | undefined;
+    private get sequence();
+}
+export declare class x509KeyUsageExtension extends x509Extension {
+    get digitalSignature(): boolean;
+    get keyCertSign(): boolean;
+    get crlSign(): boolean;
+    private get bitString();
+}
+export declare class x509SubjectAlternativeNameExtension extends x509Extension {
+    get rfc822Name(): string | undefined;
+    get uri(): string | undefined;
+    otherName(oid: string): string | undefined;
+    private findGeneralName;
+    private get generalNames();
+}
+export declare class x509AuthorityKeyIDExtension extends x509Extension {
+    get keyIdentifier(): Buffer | undefined;
+    private findSequenceMember;
+    private get sequence();
+}
+export declare class x509SubjectKeyIDExtension extends x509Extension {
+    get keyIdentifier(): Buffer;
+}
+export declare class x509SCTExtension extends x509Extension {
+    constructor(asn1: ASN1Obj);
+    get signedCertificateTimestamps(): SignedCertificateTimestamp[];
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/ext.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.x509SCTExtension = exports.x509SubjectKeyIDExtension = exports.x509AuthorityKeyIDExtension = exports.x509SubjectAlternativeNameExtension = exports.x509KeyUsageExtension = exports.x509BasicConstraintsExtension = exports.x509Extension = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const stream_1 = require("../util/stream");
+const sct_1 = require("./sct");
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+class x509Extension {
+    constructor(asn1) {
+        this.root = asn1;
+    }
+    get oid() {
+        return this.root.subs[0].toOID();
+    }
+    get critical() {
+        // The critical field is optional and will be the second element of the
+        // extension sequence if present. Default to false if not present.
+        return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
+    }
+    get value() {
+        return this.extnValueObj.value;
+    }
+    get extnValueObj() {
+        // The extnValue field will be the last element of the extension sequence
+        return this.root.subs[this.root.subs.length - 1];
+    }
+}
+exports.x509Extension = x509Extension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
+class x509BasicConstraintsExtension extends x509Extension {
+    get isCA() {
+        return this.sequence.subs[0].toBoolean();
+    }
+    get pathLenConstraint() {
+        return this.sequence.subs.length > 1
+            ? this.sequence.subs[1].toInteger()
+            : undefined;
+    }
+    // The extnValue field contains a single sequence wrapping the isCA and
+    // pathLenConstraint.
+    get sequence() {
+        return this.extnValueObj.subs[0];
+    }
+}
+exports.x509BasicConstraintsExtension = x509BasicConstraintsExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
+class x509KeyUsageExtension extends x509Extension {
+    get digitalSignature() {
+        return this.bitString[0] === 1;
+    }
+    get keyCertSign() {
+        return this.bitString[5] === 1;
+    }
+    get crlSign() {
+        return this.bitString[6] === 1;
+    }
+    // The extnValue field contains a single bit string which is a bit mask
+    // indicating which key usages are enabled.
+    get bitString() {
+        return this.extnValueObj.subs[0].toBitString();
+    }
+}
+exports.x509KeyUsageExtension = x509KeyUsageExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6
+class x509SubjectAlternativeNameExtension extends x509Extension {
+    get rfc822Name() {
+        return this.findGeneralName(0x01)?.value.toString('ascii');
+    }
+    get uri() {
+        return this.findGeneralName(0x06)?.value.toString('ascii');
+    }
+    // Retrieve the value of an otherName with the given OID.
+    otherName(oid) {
+        const otherName = this.findGeneralName(0x00);
+        if (otherName === undefined) {
+            return undefined;
+        }
+        // The otherName is a sequence containing an OID and a value.
+        // Need to check that the OID matches the one we're looking for.
+        const otherNameOID = otherName.subs[0].toOID();
+        if (otherNameOID !== oid) {
+            return undefined;
+        }
+        // The otherNameValue is a sequence containing the actual value.
+        const otherNameValue = otherName.subs[1];
+        return otherNameValue.subs[0].value.toString('ascii');
+    }
+    findGeneralName(tag) {
+        return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));
+    }
+    // The extnValue field contains a sequence of GeneralNames.
+    get generalNames() {
+        return this.extnValueObj.subs[0].subs;
+    }
+}
+exports.x509SubjectAlternativeNameExtension = x509SubjectAlternativeNameExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1
+class x509AuthorityKeyIDExtension extends x509Extension {
+    get keyIdentifier() {
+        return this.findSequenceMember(0x00)?.value;
+    }
+    findSequenceMember(tag) {
+        return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));
+    }
+    // The extnValue field contains a single sequence wrapping the keyIdentifier
+    get sequence() {
+        return this.extnValueObj.subs[0];
+    }
+}
+exports.x509AuthorityKeyIDExtension = x509AuthorityKeyIDExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2
+class x509SubjectKeyIDExtension extends x509Extension {
+    get keyIdentifier() {
+        return this.extnValueObj.subs[0].value;
+    }
+}
+exports.x509SubjectKeyIDExtension = x509SubjectKeyIDExtension;
+// https://www.rfc-editor.org/rfc/rfc6962#section-3.3
+class x509SCTExtension extends x509Extension {
+    constructor(asn1) {
+        super(asn1);
+    }
+    get signedCertificateTimestamps() {
+        const buf = this.extnValueObj.subs[0].value;
+        const stream = new stream_1.ByteStream(buf);
+        // The overall list length is encoded in the first two bytes -- note this
+        // is the length of the list in bytes, NOT the number of SCTs in the list
+        const end = stream.getUint16() + 2;
+        const sctList = [];
+        while (stream.position < end) {
+            // Read the length of the next SCT
+            const sctLength = stream.getUint16();
+            // Slice out the bytes for the next SCT and parse it
+            const sct = stream.getBlock(sctLength);
+            sctList.push(sct_1.SignedCertificateTimestamp.parse(sct));
+        }
+        if (stream.position !== end) {
+            throw new Error('SCT list length does not match actual length');
+        }
+        return sctList;
+    }
+}
+exports.x509SCTExtension = x509SCTExtension;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/x509/sct.d.ts

@@ -0,0 +1,26 @@
+/// <reference types="node" />
+import * as sigstore from '../types/sigstore';
+interface SCTOptions {
+    version: number;
+    logID: Buffer;
+    timestamp: Buffer;
+    extensions: Buffer;
+    hashAlgorithm: number;
+    signatureAlgorithm: number;
+    signature: Buffer;
+}
+export declare class SignedCertificateTimestamp {
+    readonly version: number;
+    readonly logID: Buffer;
+    readonly timestamp: Buffer;
+    readonly extensions: Buffer;
+    readonly hashAlgorithm: number;
+    readonly signatureAlgorithm: number;
+    readonly signature: Buffer;
+    constructor(options: SCTOptions);
+    get datetime(): Date;
+    get algorithm(): string;
+    verify(preCert: Buffer, logs: sigstore.TransparencyLogInstance[]): boolean;
+    static parse(buf: Buffer): SignedCertificateTimestamp;
+}
+export {};