privateer-agent 0.15.4 → 0.15.6

package/dist-boot/c-65UZIZC7.mjs

@@ -0,0 +1,2897 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  ASN1Obj,
+  ByteStream,
+  HashAlgorithms,
+  KeyTypes,
+  Uint8ArrayToBase64,
+  Uint8ArrayToHex,
+  Uint8ArrayToString,
+  base64Decode,
+  base64ToUint8Array,
+  canonicalize,
+  hexToUint8Array,
+  importKey,
+  readBigInt64BE,
+  stringToUint8Array,
+  toDER,
+  uint8ArrayEqual,
+  verifySignature,
+  verifySignatureOverDigest
+} from "./c-U4ITOXAN.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/@freedomofpress/sigstore-browser/dist/interfaces.js
+var SigstoreRoots;
+(function(SigstoreRoots2) {
+  SigstoreRoots2["certificateAuthorities"] = "certificateAuthorities";
+  SigstoreRoots2["ctlogs"] = "ctlogs";
+  SigstoreRoots2["timestampAuthorities"] = "timestampAuthorities";
+  SigstoreRoots2["tlogs"] = "tlogs";
+})(SigstoreRoots || (SigstoreRoots = {}));
+var SUPPORTED_HASH_ALGORITHMS = {
+  "sha256": HashAlgorithms.SHA256,
+  "sha384": HashAlgorithms.SHA384,
+  "sha512": HashAlgorithms.SHA512,
+  "SHA2_256": HashAlgorithms.SHA256,
+  "SHA2_384": HashAlgorithms.SHA384,
+  "SHA2_512": HashAlgorithms.SHA512
+};
+function getHashAlgorithm(algorithm) {
+  const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];
+  if (!hashAlg) {
+    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
+  }
+  return hashAlg;
+}
+__name(getHashAlgorithm, "getHashAlgorithm");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/oid.js
+var ECDSA_SIGNATURE_ALGOS = {
+  "1.2.840.10045.4.3.1": "sha224",
+  "1.2.840.10045.4.3.2": "sha256",
+  "1.2.840.10045.4.3.3": "sha384",
+  "1.2.840.10045.4.3.4": "sha512"
+};
+var RSA_SIGNATURE_ALGOS = {
+  "1.2.840.113549.1.1.11": "sha256",
+  // sha256WithRSAEncryption
+  "1.2.840.113549.1.1.12": "sha384",
+  // sha384WithRSAEncryption
+  "1.2.840.113549.1.1.13": "sha512",
+  // sha512WithRSAEncryption
+  "1.2.840.113549.1.1.5": "sha1"
+  // sha1WithRSAEncryption
+};
+var OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
+var SHA2_HASH_ALGOS = {
+  "2.16.840.1.101.3.4.2.1": "sha256",
+  "2.16.840.1.101.3.4.2.2": "sha384",
+  "2.16.840.1.101.3.4.2.3": "sha512"
+};
+var DEFAULT_HASH_ALGORITHM = "sha256";
+var ECDSA_CURVE_NAMES = {
+  "1.2.840.10045.3.1.7": "secp256r1",
+  "1.3.132.0.34": "secp384r1",
+  "1.3.132.0.35": "secp521r1"
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/x509/sct.js
+var SignedCertificateTimestamp = class _SignedCertificateTimestamp {
+  static {
+    __name(this, "SignedCertificateTimestamp");
+  }
+  constructor(options) {
+    this.version = options.version;
+    this.logID = options.logID;
+    this.timestamp = options.timestamp;
+    this.extensions = options.extensions;
+    this.hashAlgorithm = options.hashAlgorithm;
+    this.signatureAlgorithm = options.signatureAlgorithm;
+    this.signature = options.signature;
+  }
+  get datetime() {
+    return new Date(Number(readBigInt64BE(this.timestamp)));
+  }
+  // Returns the hash algorithm used to generate the SCT's signature.
+  // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
+  get algorithm() {
+    switch (this.hashAlgorithm) {
+      /* istanbul ignore next */
+      case 0:
+        return "none";
+      /* istanbul ignore next */
+      case 1:
+        return "md5";
+      /* istanbul ignore next */
+      case 2:
+        return "sha1";
+      /* istanbul ignore next */
+      case 3:
+        return "sha224";
+      case 4:
+        return "sha256";
+      /* istanbul ignore next */
+      case 5:
+        return "sha384";
+      /* istanbul ignore next */
+      case 6:
+        return "sha512";
+      /* istanbul ignore next */
+      default:
+        return "unknown";
+    }
+  }
+  async verify(preCert, key) {
+    const stream = new ByteStream();
+    stream.appendChar(this.version);
+    stream.appendChar(0);
+    stream.appendView(this.timestamp);
+    stream.appendUint16(1);
+    stream.appendView(preCert);
+    stream.appendUint16(this.extensions.byteLength);
+    if (this.extensions.byteLength > 0) {
+      stream.appendView(this.extensions);
+    }
+    return await verifySignature(key, stream.buffer, this.signature, this.algorithm);
+  }
+  // Parses a SignedCertificateTimestamp from a buffer. SCTs are encoded using
+  // TLS encoding which means the fields and lengths of most fields are
+  // specified as part of the SCT and TLS specs.
+  // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+  // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
+  static parse(buf) {
+    const stream = new ByteStream(buf);
+    const version = stream.getUint8();
+    if (version !== 0) {
+      throw new Error(`Unsupported SCT version: ${version} (expected 0 for v1)`);
+    }
+    const logID = stream.getBlock(32);
+    const timestamp = stream.getBlock(8);
+    const extenstionLength = stream.getUint16();
+    const extensions = stream.getBlock(extenstionLength);
+    const hashAlgorithm = stream.getUint8();
+    const signatureAlgorithm = stream.getUint8();
+    const sigLength = stream.getUint16();
+    const signature = stream.getBlock(sigLength);
+    if (stream.position !== buf.length) {
+      throw new Error("SCT buffer length mismatch");
+    }
+    return new _SignedCertificateTimestamp({
+      version,
+      logID,
+      timestamp,
+      extensions,
+      hashAlgorithm,
+      signatureAlgorithm,
+      signature
+    });
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/x509/ext.js
+var X509Extension = class {
+  static {
+    __name(this, "X509Extension");
+  }
+  constructor(asn1) {
+    this.root = asn1;
+  }
+  get oid() {
+    return this.root.subs[0].toOID();
+  }
+  get critical() {
+    return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
+  }
+  get value() {
+    return this.extnValueObj.value;
+  }
+  get valueObj() {
+    return this.extnValueObj;
+  }
+  get extnValueObj() {
+    return this.root.subs[this.root.subs.length - 1];
+  }
+};
+var X509BasicConstraintsExtension = class extends X509Extension {
+  static {
+    __name(this, "X509BasicConstraintsExtension");
+  }
+  get isCA() {
+    return this.sequence.subs[0]?.toBoolean() ?? false;
+  }
+  get pathLenConstraint() {
+    return this.sequence.subs.length > 1 ? this.sequence.subs[1].toInteger() : void 0;
+  }
+  // The extnValue field contains a single sequence wrapping the isCA and
+  // pathLenConstraint.
+  get sequence() {
+    return this.extnValueObj.subs[0];
+  }
+};
+var X509KeyUsageExtension = class extends X509Extension {
+  static {
+    __name(this, "X509KeyUsageExtension");
+  }
+  get digitalSignature() {
+    return this.bitString[0] === 1;
+  }
+  get keyCertSign() {
+    return this.bitString[5] === 1;
+  }
+  get crlSign() {
+    return this.bitString[6] === 1;
+  }
+  // The extnValue field contains a single bit string which is a bit mask
+  // indicating which key usages are enabled.
+  get bitString() {
+    return this.extnValueObj.subs[0].toBitString();
+  }
+};
+var X509SubjectAlternativeNameExtension = class extends X509Extension {
+  static {
+    __name(this, "X509SubjectAlternativeNameExtension");
+  }
+  get rfc822Name() {
+    const rfc822Name = this.findGeneralName(1)?.value;
+    if (rfc822Name === void 0) {
+      return void 0;
+    } else {
+      return Uint8ArrayToString(rfc822Name);
+    }
+  }
+  get uri() {
+    const uri = this.findGeneralName(6)?.value;
+    if (uri === void 0) {
+      return void 0;
+    } else {
+      return Uint8ArrayToString(uri);
+    }
+  }
+  // Retrieve the value of an otherName with the given OID.
+  otherName(oid) {
+    const otherName = this.findGeneralName(0);
+    if (otherName === void 0) {
+      return void 0;
+    }
+    const otherNameOID = otherName.subs[0].toOID();
+    if (otherNameOID !== oid) {
+      return void 0;
+    }
+    const otherNameValue = otherName.subs[1];
+    return Uint8ArrayToString(otherNameValue.subs[0].value);
+  }
+  findGeneralName(tag) {
+    return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));
+  }
+  // The extnValue field contains a sequence of GeneralNames.
+  get generalNames() {
+    return this.extnValueObj.subs[0].subs;
+  }
+};
+var X509AuthorityKeyIDExtension = class extends X509Extension {
+  static {
+    __name(this, "X509AuthorityKeyIDExtension");
+  }
+  get keyIdentifier() {
+    return this.findSequenceMember(0)?.value;
+  }
+  findSequenceMember(tag) {
+    return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));
+  }
+  // The extnValue field contains a single sequence wrapping the keyIdentifier
+  get sequence() {
+    return this.extnValueObj.subs[0];
+  }
+};
+var X509SubjectKeyIDExtension = class extends X509Extension {
+  static {
+    __name(this, "X509SubjectKeyIDExtension");
+  }
+  get keyIdentifier() {
+    return this.extnValueObj.subs[0].value;
+  }
+};
+var X509FulcioExtensionV1 = class extends X509Extension {
+  static {
+    __name(this, "X509FulcioExtensionV1");
+  }
+  get stringValue() {
+    return Uint8ArrayToString(this.extnValueObj.value);
+  }
+};
+var X509FulcioExtensionV2 = class extends X509Extension {
+  static {
+    __name(this, "X509FulcioExtensionV2");
+  }
+  get stringValue() {
+    return Uint8ArrayToString(this.extnValueObj.subs[0].value);
+  }
+};
+var X509FulcioIssuerV1 = class extends X509FulcioExtensionV1 {
+  static {
+    __name(this, "X509FulcioIssuerV1");
+  }
+  get issuer() {
+    return this.stringValue;
+  }
+};
+var X509GitHubWorkflowTriggerExtension = class extends X509FulcioExtensionV1 {
+  static {
+    __name(this, "X509GitHubWorkflowTriggerExtension");
+  }
+  get workflowTrigger() {
+    return this.stringValue;
+  }
+};
+var X509GitHubWorkflowSHAExtension = class extends X509FulcioExtensionV1 {
+  static {
+    __name(this, "X509GitHubWorkflowSHAExtension");
+  }
+  get workflowSHA() {
+    return this.stringValue;
+  }
+};
+var X509GitHubWorkflowNameExtension = class extends X509FulcioExtensionV1 {
+  static {
+    __name(this, "X509GitHubWorkflowNameExtension");
+  }
+  get workflowName() {
+    return this.stringValue;
+  }
+};
+var X509GitHubWorkflowRepositoryExtension = class extends X509FulcioExtensionV1 {
+  static {
+    __name(this, "X509GitHubWorkflowRepositoryExtension");
+  }
+  get workflowRepository() {
+    return this.stringValue;
+  }
+};
+var X509GitHubWorkflowRefExtension = class extends X509FulcioExtensionV1 {
+  static {
+    __name(this, "X509GitHubWorkflowRefExtension");
+  }
+  get workflowRef() {
+    return this.stringValue;
+  }
+};
+var X509FulcioIssuerV2 = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509FulcioIssuerV2");
+  }
+  get issuer() {
+    return this.stringValue;
+  }
+};
+var X509BuildSignerURIExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509BuildSignerURIExtension");
+  }
+  get buildSignerURI() {
+    return this.stringValue;
+  }
+};
+var X509BuildSignerDigestExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509BuildSignerDigestExtension");
+  }
+  get buildSignerDigest() {
+    return this.stringValue;
+  }
+};
+var X509RunnerEnvironmentExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509RunnerEnvironmentExtension");
+  }
+  get runnerEnvironment() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryURIExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryURIExtension");
+  }
+  get sourceRepositoryURI() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryDigestExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryDigestExtension");
+  }
+  get sourceRepositoryDigest() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryRefExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryRefExtension");
+  }
+  get sourceRepositoryRef() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryIdentifierExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryIdentifierExtension");
+  }
+  get sourceRepositoryIdentifier() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryOwnerURIExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryOwnerURIExtension");
+  }
+  get sourceRepositoryOwnerURI() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryOwnerIdentifierExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryOwnerIdentifierExtension");
+  }
+  get sourceRepositoryOwnerIdentifier() {
+    return this.stringValue;
+  }
+};
+var X509BuildConfigURIExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509BuildConfigURIExtension");
+  }
+  get buildConfigURI() {
+    return this.stringValue;
+  }
+};
+var X509BuildConfigDigestExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509BuildConfigDigestExtension");
+  }
+  get buildConfigDigest() {
+    return this.stringValue;
+  }
+};
+var X509BuildTriggerExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509BuildTriggerExtension");
+  }
+  get buildTrigger() {
+    return this.stringValue;
+  }
+};
+var X509RunInvocationURIExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509RunInvocationURIExtension");
+  }
+  get runInvocationURI() {
+    return this.stringValue;
+  }
+};
+var X509SourceRepositoryVisibilityExtension = class extends X509FulcioExtensionV2 {
+  static {
+    __name(this, "X509SourceRepositoryVisibilityExtension");
+  }
+  get sourceRepositoryVisibility() {
+    return this.stringValue;
+  }
+};
+var X509SCTExtension = class extends X509Extension {
+  static {
+    __name(this, "X509SCTExtension");
+  }
+  constructor(asn1) {
+    super(asn1);
+  }
+  get signedCertificateTimestamps() {
+    const buf = this.extnValueObj.subs[0].value;
+    const stream = new ByteStream(buf);
+    const end = stream.getUint16() + 2;
+    const sctList = [];
+    while (stream.position < end) {
+      const sctLength = stream.getUint16();
+      const sct = stream.getBlock(sctLength);
+      sctList.push(SignedCertificateTimestamp.parse(sct));
+    }
+    if (stream.position !== end) {
+      throw new Error("SCT list length does not match actual length");
+    }
+    return sctList;
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/x509/cert.js
+var EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
+var EXTENSION_OID_KEY_USAGE = "2.5.29.15";
+var EXTENSION_OID_SUBJECT_ALT_NAME = "2.5.29.17";
+var EXTENSION_OID_BASIC_CONSTRAINTS = "2.5.29.19";
+var EXTENSION_OID_AUTHORITY_KEY_ID = "2.5.29.35";
+var EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+var DN_OID_COMMON_NAME = "2.5.4.3";
+var DN_OID_COUNTRY = "2.5.4.6";
+var DN_OID_LOCALITY = "2.5.4.7";
+var DN_OID_STATE = "2.5.4.8";
+var DN_OID_ORGANIZATION = "2.5.4.10";
+var DN_OID_ORGANIZATIONAL_UNIT = "2.5.4.11";
+var DN_OID_TO_NAME = {
+  [DN_OID_COMMON_NAME]: "CN",
+  [DN_OID_COUNTRY]: "C",
+  [DN_OID_LOCALITY]: "L",
+  [DN_OID_STATE]: "ST",
+  [DN_OID_ORGANIZATION]: "O",
+  [DN_OID_ORGANIZATIONAL_UNIT]: "OU"
+};
+var EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+var EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = "1.3.6.1.4.1.57264.1.2";
+var EXTENSION_OID_GITHUB_WORKFLOW_SHA = "1.3.6.1.4.1.57264.1.3";
+var EXTENSION_OID_GITHUB_WORKFLOW_NAME = "1.3.6.1.4.1.57264.1.4";
+var EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = "1.3.6.1.4.1.57264.1.5";
+var EXTENSION_OID_GITHUB_WORKFLOW_REF = "1.3.6.1.4.1.57264.1.6";
+var EXTENSION_OID_OTHERNAME = "1.3.6.1.4.1.57264.1.7";
+var EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+var EXTENSION_OID_BUILD_SIGNER_URI = "1.3.6.1.4.1.57264.1.9";
+var EXTENSION_OID_BUILD_SIGNER_DIGEST = "1.3.6.1.4.1.57264.1.10";
+var EXTENSION_OID_RUNNER_ENVIRONMENT = "1.3.6.1.4.1.57264.1.11";
+var EXTENSION_OID_SOURCE_REPOSITORY_URI = "1.3.6.1.4.1.57264.1.12";
+var EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = "1.3.6.1.4.1.57264.1.13";
+var EXTENSION_OID_SOURCE_REPOSITORY_REF = "1.3.6.1.4.1.57264.1.14";
+var EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = "1.3.6.1.4.1.57264.1.15";
+var EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = "1.3.6.1.4.1.57264.1.16";
+var EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = "1.3.6.1.4.1.57264.1.17";
+var EXTENSION_OID_BUILD_CONFIG_URI = "1.3.6.1.4.1.57264.1.18";
+var EXTENSION_OID_BUILD_CONFIG_DIGEST = "1.3.6.1.4.1.57264.1.19";
+var EXTENSION_OID_BUILD_TRIGGER = "1.3.6.1.4.1.57264.1.20";
+var EXTENSION_OID_RUN_INVOCATION_URI = "1.3.6.1.4.1.57264.1.21";
+var EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = "1.3.6.1.4.1.57264.1.22";
+var X509Certificate = class _X509Certificate {
+  static {
+    __name(this, "X509Certificate");
+  }
+  constructor(asn1) {
+    this.root = asn1;
+  }
+  static parse(cert) {
+    const der = typeof cert === "string" ? toDER(cert) : cert;
+    const asn1 = ASN1Obj.parseBuffer(der);
+    return new _X509Certificate(asn1);
+  }
+  get tbsCertificate() {
+    return this.tbsCertificateObj;
+  }
+  get version() {
+    const ver = this.versionObj.subs[0].toInteger();
+    return `v${(ver + BigInt(1)).toString()}`;
+  }
+  get serialNumber() {
+    return this.serialNumberObj.value;
+  }
+  get notBefore() {
+    return this.validityObj.subs[0].toDate();
+  }
+  get notAfter() {
+    return this.validityObj.subs[1].toDate();
+  }
+  get issuer() {
+    return this.issuerObj.value;
+  }
+  get subject() {
+    return this.subjectObj.value;
+  }
+  /**
+   * Returns the issuer distinguished name as a Map of attribute names to values.
+   * Common attributes: CN (Common Name), O (Organization), L (Locality),
+   * ST (State), C (Country), OU (Organizational Unit)
+   */
+  get issuerDN() {
+    return this.parseDistinguishedName(this.issuerObj);
+  }
+  /**
+   * Returns the subject distinguished name as a Map of attribute names to values.
+   * Common attributes: CN (Common Name), O (Organization), L (Locality),
+   * ST (State), C (Country), OU (Organizational Unit)
+   */
+  get subjectDN() {
+    return this.parseDistinguishedName(this.subjectObj);
+  }
+  get publicKey() {
+    return this.subjectPublicKeyInfoObj.toDER();
+  }
+  /**
+   * Import the public key with a specific hash algorithm and signature scheme for RSA keys.
+   * For ECDSA keys, both parameters are ignored.
+   * @param hashAlg - Hash algorithm (e.g., "sha384") for RSA keys
+   * @param usePss - If true, import as RSA-PSS key; if false, import as PKCS#1 v1.5
+   */
+  async getPublicKeyObj(hashAlg, usePss) {
+    const publicKey = this.subjectPublicKeyInfoObj.toDER();
+    const spki = ASN1Obj.parseBuffer(publicKey);
+    const algorithmOID = spki.subs[0].subs[0].toOID();
+    const isRsaKey = algorithmOID === "1.2.840.113549.1.1.1";
+    const isRsaPssKey = algorithmOID === OID_RSASSA_PSS;
+    if (isRsaPssKey) {
+      throw new Error("RSA-PSS public keys (id-RSASSA-PSS OID) are not supported by WebCrypto. Only certificates with standard RSA keys (rsaEncryption OID) signed using RSA-PSS are supported.");
+    }
+    if (isRsaKey) {
+      const hash = hashAlg || DEFAULT_HASH_ALGORITHM;
+      const scheme = usePss ? hash : `PKCS1_${hash}`;
+      return importKey(KeyTypes.RSA, scheme, Uint8ArrayToBase64(publicKey));
+    } else {
+      const curveOID = spki.subs[0].subs[1]?.toOID();
+      const curve = ECDSA_CURVE_NAMES[curveOID];
+      if (!curve) {
+        throw new Error(`Unknown ECDSA curve OID: ${curveOID}`);
+      }
+      return importKey(KeyTypes.Ecdsa, curve, Uint8ArrayToBase64(publicKey));
+    }
+  }
+  get publicKeyObj() {
+    return this.getPublicKeyObj();
+  }
+  get signatureAlgorithm() {
+    const oid = this.signatureAlgorithmObj.subs[0].toOID();
+    return ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid] || this.parseRsaPssHashAlgorithm();
+  }
+  get signatureAlgorithmOid() {
+    return this.signatureAlgorithmObj.subs[0].toOID();
+  }
+  /**
+   * Parse hash algorithm from RSA-PSS signature algorithm parameters.
+   * RSA-PSS parameters are: SEQUENCE { hashAlgorithm, maskGenAlgorithm, saltLength, trailerField }
+   */
+  parseRsaPssHashAlgorithm() {
+    const sigAlgOid = this.signatureAlgorithmObj.subs[0].toOID();
+    if (sigAlgOid !== OID_RSASSA_PSS) {
+      return "";
+    }
+    const params = this.signatureAlgorithmObj.subs[1];
+    if (!params || params.subs.length === 0) {
+      return DEFAULT_HASH_ALGORITHM;
+    }
+    const hashAlgWrapper = params.subs[0];
+    if (hashAlgWrapper && hashAlgWrapper.subs.length > 0) {
+      const hashAlgSeq = hashAlgWrapper.subs[0];
+      if (hashAlgSeq && hashAlgSeq.subs.length > 0) {
+        const hashOid = hashAlgSeq.subs[0].toOID();
+        return SHA2_HASH_ALGOS[hashOid] || DEFAULT_HASH_ALGORITHM;
+      }
+    }
+    return DEFAULT_HASH_ALGORITHM;
+  }
+  get signatureValue() {
+    return this.signatureValueObj.value.subarray(1);
+  }
+  get subjectAltName() {
+    const ext = this.extSubjectAltName;
+    return ext?.uri || ext?.rfc822Name;
+  }
+  get extensions() {
+    const extSeq = this.extensionsObj?.subs[0];
+    return extSeq?.subs || /* istanbul ignore next */
+    [];
+  }
+  get extKeyUsage() {
+    const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);
+    return ext ? new X509KeyUsageExtension(ext) : void 0;
+  }
+  get extBasicConstraints() {
+    const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);
+    return ext ? new X509BasicConstraintsExtension(ext) : void 0;
+  }
+  get extSubjectAltName() {
+    const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);
+    return ext ? new X509SubjectAlternativeNameExtension(ext) : void 0;
+  }
+  get extAuthorityKeyID() {
+    const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);
+    return ext ? new X509AuthorityKeyIDExtension(ext) : void 0;
+  }
+  get extSubjectKeyID() {
+    const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);
+    return ext ? new X509SubjectKeyIDExtension(ext) : (
+      /* istanbul ignore next */
+      void 0
+    );
+  }
+  get extSCT() {
+    const ext = this.findExtension(EXTENSION_OID_SCT);
+    return ext ? new X509SCTExtension(ext) : void 0;
+  }
+  get extFulcioIssuerV1() {
+    const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V1);
+    return ext ? new X509FulcioIssuerV1(ext) : void 0;
+  }
+  get extFulcioIssuerV2() {
+    const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V2);
+    return ext ? new X509FulcioIssuerV2(ext) : void 0;
+  }
+  get extGitHubWorkflowTrigger() {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER);
+    return ext ? new X509GitHubWorkflowTriggerExtension(ext) : void 0;
+  }
+  get extGitHubWorkflowSHA() {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_SHA);
+    return ext ? new X509GitHubWorkflowSHAExtension(ext) : void 0;
+  }
+  get extGitHubWorkflowName() {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_NAME);
+    return ext ? new X509GitHubWorkflowNameExtension(ext) : void 0;
+  }
+  get extGitHubWorkflowRepository() {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY);
+    return ext ? new X509GitHubWorkflowRepositoryExtension(ext) : void 0;
+  }
+  get extGitHubWorkflowRef() {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REF);
+    return ext ? new X509GitHubWorkflowRefExtension(ext) : void 0;
+  }
+  get extBuildSignerURI() {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_URI);
+    return ext ? new X509BuildSignerURIExtension(ext) : void 0;
+  }
+  get extBuildSignerDigest() {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_DIGEST);
+    return ext ? new X509BuildSignerDigestExtension(ext) : void 0;
+  }
+  get extRunnerEnvironment() {
+    const ext = this.findExtension(EXTENSION_OID_RUNNER_ENVIRONMENT);
+    return ext ? new X509RunnerEnvironmentExtension(ext) : void 0;
+  }
+  get extSourceRepositoryURI() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_URI);
+    return ext ? new X509SourceRepositoryURIExtension(ext) : void 0;
+  }
+  get extSourceRepositoryDigest() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_DIGEST);
+    return ext ? new X509SourceRepositoryDigestExtension(ext) : void 0;
+  }
+  get extSourceRepositoryRef() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_REF);
+    return ext ? new X509SourceRepositoryRefExtension(ext) : void 0;
+  }
+  get extSourceRepositoryIdentifier() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER);
+    return ext ? new X509SourceRepositoryIdentifierExtension(ext) : void 0;
+  }
+  get extSourceRepositoryOwnerURI() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI);
+    return ext ? new X509SourceRepositoryOwnerURIExtension(ext) : void 0;
+  }
+  get extSourceRepositoryOwnerIdentifier() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER);
+    return ext ? new X509SourceRepositoryOwnerIdentifierExtension(ext) : void 0;
+  }
+  get extBuildConfigURI() {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_URI);
+    return ext ? new X509BuildConfigURIExtension(ext) : void 0;
+  }
+  get extBuildConfigDigest() {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_DIGEST);
+    return ext ? new X509BuildConfigDigestExtension(ext) : void 0;
+  }
+  get extBuildTrigger() {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_TRIGGER);
+    return ext ? new X509BuildTriggerExtension(ext) : void 0;
+  }
+  get extRunInvocationURI() {
+    const ext = this.findExtension(EXTENSION_OID_RUN_INVOCATION_URI);
+    return ext ? new X509RunInvocationURIExtension(ext) : void 0;
+  }
+  get extSourceRepositoryVisibility() {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY);
+    return ext ? new X509SourceRepositoryVisibilityExtension(ext) : void 0;
+  }
+  get isCA() {
+    const ca = this.extBasicConstraints?.isCA || false;
+    if (this.extKeyUsage) {
+      return ca && this.extKeyUsage.keyCertSign;
+    }
+    return ca;
+  }
+  extension(oid) {
+    const ext = this.findExtension(oid);
+    return ext ? new X509Extension(ext) : void 0;
+  }
+  async verify(issuerCertificate) {
+    const sigAlgOID = this.signatureAlgorithmOid;
+    const isRsaPss = sigAlgOID === OID_RSASSA_PSS;
+    const hashAlg = isRsaPss ? this.parseRsaPssHashAlgorithm() : RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID];
+    const publicKeyObj = issuerCertificate ? await issuerCertificate.getPublicKeyObj(hashAlg, isRsaPss) : await this.getPublicKeyObj(hashAlg, isRsaPss);
+    return await verifySignature(publicKeyObj, this.tbsCertificate.toDER(), this.signatureValue, this.signatureAlgorithm);
+  }
+  validForDate(date) {
+    return this.notBefore <= date && date <= this.notAfter;
+  }
+  equals(other) {
+    return uint8ArrayEqual(this.root.toDER(), other.root.toDER());
+  }
+  // Creates a copy of the certificate with a new buffer
+  clone() {
+    const der = this.root.toDER();
+    const clone = new Uint8Array(der);
+    return _X509Certificate.parse(clone);
+  }
+  findExtension(oid) {
+    return this.extensions.find((ext) => ext.subs[0].toOID() === oid);
+  }
+  /////////////////////////////////////////////////////////////////////////////
+  // The following properties use the documented x509 structure to locate the
+  // desired ASN.1 object
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1
+  get tbsCertificateObj() {
+    return this.root.subs[0];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2
+  get signatureAlgorithmObj() {
+    return this.root.subs[1];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3
+  get signatureValueObj() {
+    return this.root.subs[2];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1
+  get versionObj() {
+    return this.tbsCertificateObj.subs[0];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.2
+  get serialNumberObj() {
+    return this.tbsCertificateObj.subs[1];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4
+  get issuerObj() {
+    return this.tbsCertificateObj.subs[3];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5
+  get validityObj() {
+    return this.tbsCertificateObj.subs[4];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6
+  get subjectObj() {
+    return this.tbsCertificateObj.subs[5];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7
+  get subjectPublicKeyInfoObj() {
+    return this.tbsCertificateObj.subs[6];
+  }
+  // Extensions can't be located by index because their position varies. Instead,
+  // we need to find the extensions context specific tag
+  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9
+  get extensionsObj() {
+    return this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(3));
+  }
+  // Parse a Distinguished Name (issuer or subject) ASN1Obj into a Map
+  // DN structure: SEQUENCE of SET of SEQUENCE (AttributeTypeAndValue)
+  // Each AttributeTypeAndValue is [OID, value]
+  parseDistinguishedName(dnObj) {
+    const result = /* @__PURE__ */ new Map();
+    for (const rdn of dnObj.subs) {
+      for (const atv of rdn.subs) {
+        if (atv.subs.length >= 2) {
+          const oidObj = atv.subs[0];
+          const valueObj = atv.subs[1];
+          if (oidObj.tag.isOID()) {
+            const oid = oidObj.toOID();
+            const attrName = DN_OID_TO_NAME[oid];
+            if (attrName) {
+              const value = new TextDecoder().decode(valueObj.value);
+              result.set(attrName, value);
+            }
+          }
+        }
+      }
+    }
+    return result;
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/x509/chain.js
+var CertificateChainVerifier = class {
+  static {
+    __name(this, "CertificateChainVerifier");
+  }
+  constructor(opts) {
+    this.untrustedCert = opts.untrustedCert;
+    this.trustedCerts = opts.trustedCerts;
+    this.localCerts = dedupeCertificates([
+      ...opts.trustedCerts,
+      opts.untrustedCert
+    ]);
+    this.timestamp = opts.timestamp;
+  }
+  async verify() {
+    const certificatePath = await this.sort();
+    this.checkPath(certificatePath);
+    const validForDate = certificatePath.every((cert) => cert.validForDate(this.timestamp));
+    if (!validForDate) {
+      throw new Error("certificate is not valid or expired at the specified date");
+    }
+    return certificatePath;
+  }
+  async sort() {
+    const leafCert = this.untrustedCert;
+    let paths = await this.buildPaths(leafCert);
+    paths = paths.filter((path2) => path2.some((cert) => this.trustedCerts.includes(cert)));
+    if (paths.length === 0) {
+      throw new Error("no trusted certificate path found");
+    }
+    const path = paths.reduce((prev, curr) => prev.length < curr.length ? prev : curr);
+    return [leafCert, ...path].slice(0, -1);
+  }
+  async buildPaths(certificate) {
+    const paths = [];
+    const issuers = await this.findIssuer(certificate);
+    if (issuers.length === 0) {
+      throw new Error("no valid certificate path found");
+    }
+    for (let i = 0; i < issuers.length; i++) {
+      const issuer = issuers[i];
+      if (issuer.equals(certificate)) {
+        paths.push([certificate]);
+        continue;
+      }
+      const subPaths = await this.buildPaths(issuer);
+      for (let j = 0; j < subPaths.length; j++) {
+        paths.push([issuer, ...subPaths[j]]);
+      }
+    }
+    return paths;
+  }
+  async findIssuer(certificate) {
+    let issuers = [];
+    let keyIdentifier;
+    if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {
+      if (await certificate.verify()) {
+        return [certificate];
+      }
+    }
+    if (certificate.extAuthorityKeyID) {
+      keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;
+    }
+    this.localCerts.forEach((possibleIssuer) => {
+      if (keyIdentifier) {
+        if (possibleIssuer.extSubjectKeyID) {
+          if (uint8ArrayEqual(possibleIssuer.extSubjectKeyID.keyIdentifier, keyIdentifier)) {
+            issuers.push(possibleIssuer);
+          }
+          return;
+        }
+      }
+      if (uint8ArrayEqual(possibleIssuer.subject, certificate.issuer)) {
+        issuers.push(possibleIssuer);
+      }
+    });
+    const verifiedIssuers = [];
+    for (const issuer of issuers) {
+      try {
+        if (await certificate.verify(issuer)) {
+          verifiedIssuers.push(issuer);
+        }
+      } catch (ex) {
+      }
+    }
+    return verifiedIssuers;
+  }
+  checkPath(path) {
+    if (path.length < 1) {
+      throw new Error("certificate chain must contain at least one certificate");
+    }
+    const validCAs = path.slice(1).every((cert) => cert.isCA);
+    if (!validCAs) {
+      throw new Error("intermediate certificate is not a CA");
+    }
+    for (let i = path.length - 2; i >= 0; i--) {
+      if (!uint8ArrayEqual(path[i].issuer, path[i + 1].subject)) {
+        throw new Error("incorrect certificate name chaining");
+      }
+    }
+    for (let i = 0; i < path.length; i++) {
+      const cert = path[i];
+      if (cert.extBasicConstraints?.isCA) {
+        const pathLength = cert.extBasicConstraints.pathLenConstraint;
+        if (pathLength !== void 0 && pathLength < BigInt(i - 1)) {
+          throw new Error("path length constraint exceeded");
+        }
+      }
+    }
+  }
+};
+function dedupeCertificates(certs) {
+  for (let i = 0; i < certs.length; i++) {
+    for (let j = i + 1; j < certs.length; j++) {
+      if (certs[i].equals(certs[j])) {
+        certs.splice(j, 1);
+        j--;
+      }
+    }
+  }
+  return certs;
+}
+__name(dedupeCertificates, "dedupeCertificates");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/dsse.js
+var PAE_PREFIX = "DSSEv1";
+function preAuthEncoding(payloadType, payload) {
+  const prefix = [
+    PAE_PREFIX,
+    payloadType.length,
+    payloadType,
+    payload.length,
+    ""
+  ].join(" ");
+  const encoder = new TextEncoder();
+  const prefixBuffer = encoder.encode(prefix);
+  for (let i = 0; i < prefixBuffer.length; i++) {
+    if (prefixBuffer[i] > 127) {
+      throw new Error(`Invalid non-ASCII character in PAE prefix at position ${i}`);
+    }
+  }
+  const combinedArray = new Uint8Array(prefixBuffer.length + payload.length);
+  combinedArray.set(prefixBuffer, 0);
+  combinedArray.set(payload, prefixBuffer.length);
+  return combinedArray;
+}
+__name(preAuthEncoding, "preAuthEncoding");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/tlog/merkle.js
+var RFC6962_LEAF_HASH_PREFIX = new Uint8Array([0]);
+var RFC6962_NODE_HASH_PREFIX = new Uint8Array([1]);
+async function verifyMerkleInclusion(entry) {
+  if (!entry.inclusionProof) {
+    throw new Error("Missing inclusion proof");
+  }
+  const inclusionProof = entry.inclusionProof;
+  const logIndex = BigInt(inclusionProof.logIndex);
+  const treeSize = BigInt(inclusionProof.treeSize);
+  if (logIndex < 0n || logIndex >= treeSize) {
+    throw new Error(`Invalid log index: ${logIndex}`);
+  }
+  const { inner, border } = decompInclProof(logIndex, treeSize);
+  if (inclusionProof.hashes.length !== inner + border) {
+    throw new Error("Invalid hash count in inclusion proof");
+  }
+  const innerHashes = inclusionProof.hashes.slice(0, inner).map((h) => base64ToUint8Array(h));
+  const borderHashes = inclusionProof.hashes.slice(inner).map((h) => base64ToUint8Array(h));
+  const leafHash = await hashLeaf(base64ToUint8Array(entry.canonicalizedBody));
+  const calculatedHash = await chainBorderRight(await chainInner(leafHash, innerHashes, logIndex), borderHashes);
+  const rootHash = base64ToUint8Array(inclusionProof.rootHash);
+  if (!uint8ArrayEqual(calculatedHash, rootHash)) {
+    throw new Error("Calculated root hash does not match inclusion proof");
+  }
+}
+__name(verifyMerkleInclusion, "verifyMerkleInclusion");
+function decompInclProof(index, size) {
+  const inner = innerProofSize(index, size);
+  const border = onesCount(index >> BigInt(inner));
+  return { inner, border };
+}
+__name(decompInclProof, "decompInclProof");
+async function chainInner(seed, hashes, index) {
+  let acc = seed;
+  for (let i = 0; i < hashes.length; i++) {
+    const h = hashes[i];
+    if (index >> BigInt(i) & BigInt(1)) {
+      acc = await hashChildren(h, acc);
+    } else {
+      acc = await hashChildren(acc, h);
+    }
+  }
+  return acc;
+}
+__name(chainInner, "chainInner");
+async function chainBorderRight(seed, hashes) {
+  let acc = seed;
+  for (const h of hashes) {
+    acc = await hashChildren(h, acc);
+  }
+  return acc;
+}
+__name(chainBorderRight, "chainBorderRight");
+function innerProofSize(index, size) {
+  return bitLength(index ^ size - BigInt(1));
+}
+__name(innerProofSize, "innerProofSize");
+function onesCount(num) {
+  return num.toString(2).split("1").length - 1;
+}
+__name(onesCount, "onesCount");
+function bitLength(n) {
+  if (n === 0n) {
+    return 0;
+  }
+  return n.toString(2).length;
+}
+__name(bitLength, "bitLength");
+async function hashChildren(left, right) {
+  const data = new Uint8Array(RFC6962_NODE_HASH_PREFIX.length + left.length + right.length);
+  data.set(RFC6962_NODE_HASH_PREFIX, 0);
+  data.set(left, RFC6962_NODE_HASH_PREFIX.length);
+  data.set(right, RFC6962_NODE_HASH_PREFIX.length + left.length);
+  const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data);
+  return new Uint8Array(hash);
+}
+__name(hashChildren, "hashChildren");
+async function hashLeaf(leaf) {
+  const data = new Uint8Array(RFC6962_LEAF_HASH_PREFIX.length + leaf.length);
+  data.set(RFC6962_LEAF_HASH_PREFIX, 0);
+  data.set(leaf, RFC6962_LEAF_HASH_PREFIX.length);
+  const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data);
+  return new Uint8Array(hash);
+}
+__name(hashLeaf, "hashLeaf");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/tlog/checkpoint.js
+var CHECKPOINT_SEPARATOR = "\n\n";
+var SIGNATURE_REGEX = /\u2014 (\S+) (\S+)\n/g;
+var SignedNote = class _SignedNote {
+  static {
+    __name(this, "SignedNote");
+  }
+  constructor(note, signatures) {
+    this.note = note;
+    this.signatures = signatures;
+  }
+  static fromString(envelope) {
+    if (!envelope.includes(CHECKPOINT_SEPARATOR)) {
+      throw new Error("Missing checkpoint separator");
+    }
+    const split = envelope.indexOf(CHECKPOINT_SEPARATOR);
+    const header = envelope.slice(0, split + 1);
+    const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length);
+    const matches = data.matchAll(SIGNATURE_REGEX);
+    const signatures = [];
+    for (const match of matches) {
+      const [, name, signature] = match;
+      const sigBytes = base64ToUint8Array(signature);
+      if (sigBytes.length < 5) {
+        throw new Error("Malformed checkpoint signature");
+      }
+      signatures.push({
+        name,
+        keyHint: sigBytes.subarray(0, 4),
+        signature: sigBytes.subarray(4)
+      });
+    }
+    if (signatures.length === 0) {
+      throw new Error("No signatures found in checkpoint");
+    }
+    return new _SignedNote(header, signatures);
+  }
+};
+var LogCheckpoint = class _LogCheckpoint {
+  static {
+    __name(this, "LogCheckpoint");
+  }
+  constructor(origin, logSize, logHash, rest) {
+    this.origin = origin;
+    this.logSize = logSize;
+    this.logHash = logHash;
+    this.rest = rest;
+  }
+  static fromString(note) {
+    const lines = note.trimEnd().split("\n");
+    if (lines.length < 3) {
+      throw new Error("Too few lines in checkpoint header");
+    }
+    const origin = lines[0];
+    const logSize = BigInt(lines[1]);
+    const rootHash = base64ToUint8Array(lines[2]);
+    const rest = lines.slice(3);
+    return new _LogCheckpoint(origin, logSize, rootHash, rest);
+  }
+};
+async function verifyCheckpoint(entry, tlogs) {
+  if (!entry.inclusionProof?.checkpoint) {
+    throw new Error("Missing checkpoint in inclusion proof");
+  }
+  const entryLogId = base64ToUint8Array(entry.logId.keyId);
+  const matchingTLogs = tlogs.filter((tlog) => {
+    const tlogId = base64ToUint8Array(tlog.logId.keyId);
+    return uint8ArrayEqual(tlogId, entryLogId);
+  });
+  const validTLogs = entry.integratedTime ? filterTLogsByDate(matchingTLogs, new Date(Number(entry.integratedTime) * 1e3)) : matchingTLogs;
+  const inclusionProof = entry.inclusionProof;
+  const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);
+  const checkpoint = LogCheckpoint.fromString(signedNote.note);
+  if (!await verifySignedNote(signedNote, validTLogs)) {
+    throw new Error("Invalid checkpoint signature");
+  }
+  const rootHash = base64ToUint8Array(inclusionProof.rootHash);
+  if (!uint8ArrayEqual(checkpoint.logHash, rootHash)) {
+    throw new Error("Root hash mismatch between checkpoint and inclusion proof");
+  }
+}
+__name(verifyCheckpoint, "verifyCheckpoint");
+async function verifySignedNote(signedNote, tlogs) {
+  const data = stringToUint8Array(signedNote.note);
+  let hasValidSignature = false;
+  for (const signature of signedNote.signatures) {
+    const tlog = tlogs.find((tlog2) => {
+      const logId = base64ToUint8Array(tlog2.logId.keyId);
+      return uint8ArrayEqual(logId.subarray(0, 4), signature.keyHint);
+    });
+    if (!tlog) {
+      continue;
+    }
+    const publicKey = await importTLogKey(tlog);
+    const verified = await verifySignature(publicKey, data, signature.signature, tlog.hashAlgorithm);
+    if (verified) {
+      hasValidSignature = true;
+    }
+  }
+  return hasValidSignature;
+}
+__name(verifySignedNote, "verifySignedNote");
+function filterTLogsByDate(tlogs, targetDate) {
+  return tlogs.filter((tlog) => {
+    const start = new Date(tlog.publicKey.validFor.start);
+    const end = tlog.publicKey.validFor.end ? new Date(tlog.publicKey.validFor.end) : null;
+    return targetDate >= start && (!end || targetDate <= end);
+  });
+}
+__name(filterTLogsByDate, "filterTLogsByDate");
+async function importTLogKey(tlog) {
+  const keyDetails = tlog.publicKey.keyDetails;
+  let keyType;
+  let scheme;
+  if (keyDetails === "ecdsa-sha2-nistp256") {
+    keyType = KeyTypes.Ecdsa;
+    scheme = "P256-SHA256";
+  } else if (keyDetails.includes("ECDSA")) {
+    keyType = KeyTypes.Ecdsa;
+    scheme = keyDetails.replace("PKIX_ECDSA_", "").replace(/_/g, "-");
+  } else if (keyDetails.includes("ED25519")) {
+    keyType = KeyTypes.Ed25519;
+    scheme = KeyTypes.Ed25519;
+  } else if (keyDetails.includes("RSA")) {
+    keyType = KeyTypes.RSA;
+    scheme = keyDetails.replace("PKIX_RSA_", "").replace(/_/g, "-");
+  } else {
+    throw new Error(`Unsupported key type in keyDetails: ${keyDetails}`);
+  }
+  return importKey(keyType, scheme, tlog.publicKey.rawBytes);
+}
+__name(importTLogKey, "importTLogKey");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/tlog/hashedrekord.js
+async function verifyHashedRekordBody(entry, bundle) {
+  const hashedRekordEntry = entry;
+  switch (hashedRekordEntry.apiVersion) {
+    case "0.0.1":
+      return verifyHashedRekordV001Body(hashedRekordEntry, bundle);
+    case "0.0.2":
+      return verifyHashedRekordV002Body(hashedRekordEntry, bundle);
+    default:
+      throw new Error(`Unsupported hashedrekord version: ${hashedRekordEntry.apiVersion}`);
+  }
+}
+__name(verifyHashedRekordBody, "verifyHashedRekordBody");
+function verifyHashedRekordV001Body(entry, bundle) {
+  const spec = entry.spec;
+  if (!bundle.messageSignature) {
+    throw new Error("Bundle missing messageSignature for hashedrekord entry");
+  }
+  const tlogSig = spec.signature.content || "";
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+  const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("Signature mismatch between TLog entry and bundle");
+  }
+  const tlogDigest = spec.data.hash?.value || "";
+  const tlogDigestBytes = hexToUint8Array(tlogDigest);
+  const bundleDigestBytes = base64ToUint8Array(bundle.messageSignature.messageDigest.digest);
+  if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {
+    throw new Error("Digest mismatch between TLog entry and bundle");
+  }
+}
+__name(verifyHashedRekordV001Body, "verifyHashedRekordV001Body");
+function verifyHashedRekordV002Body(entry, bundle) {
+  const spec = entry.spec.hashedRekordV002;
+  if (!bundle.messageSignature) {
+    throw new Error("Bundle missing messageSignature for hashedrekord v0.0.2 entry");
+  }
+  const tlogSig = spec.signature.content || "";
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+  const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("Signature mismatch between TLog entry and bundle (v0.0.2)");
+  }
+  const tlogDigest = spec.data.digest || "";
+  const tlogDigestBytes = base64ToUint8Array(tlogDigest);
+  const bundleDigestBytes = base64ToUint8Array(bundle.messageSignature.messageDigest.digest);
+  if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {
+    throw new Error("Digest mismatch between TLog entry and bundle (v0.0.2)");
+  }
+}
+__name(verifyHashedRekordV002Body, "verifyHashedRekordV002Body");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/tlog/dsse.js
+async function verifyDSSEBody(entry, bundle) {
+  const dsseEntry = entry;
+  switch (dsseEntry.apiVersion) {
+    case "0.0.1":
+      return verifyDSSE001Body(dsseEntry, bundle);
+    case "0.0.2":
+      return verifyDSSE002Body(dsseEntry, bundle);
+    default:
+      throw new Error(`Unsupported dsse version: ${dsseEntry.apiVersion}`);
+  }
+}
+__name(verifyDSSEBody, "verifyDSSEBody");
+async function verifyDSSE001Body(entry, bundle) {
+  if (!bundle.dsseEnvelope) {
+    throw new Error("Bundle missing dsseEnvelope for DSSE entry");
+  }
+  if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {
+    throw new Error("DSSE entry must have exactly one signature");
+  }
+  const tlogSig = entry.spec.signatures[0].signature;
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+  if (bundle.dsseEnvelope.signatures.length === 0) {
+    throw new Error("Bundle DSSE envelope missing signatures");
+  }
+  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("DSSE signature mismatch between TLog entry and bundle");
+  }
+  if (!entry.spec.payloadHash?.value || !entry.spec.payloadHash?.algorithm) {
+    throw new Error("DSSE entry missing payloadHash or algorithm");
+  }
+  const hashAlg = getHashAlgorithm(entry.spec.payloadHash.algorithm);
+  const tlogHashBytes = hexToUint8Array(entry.spec.payloadHash.value);
+  const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+  const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
+  if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+    throw new Error("DSSE payload hash mismatch between TLog entry and bundle");
+  }
+}
+__name(verifyDSSE001Body, "verifyDSSE001Body");
+async function verifyDSSE002Body(entry, bundle) {
+  if (!bundle.dsseEnvelope) {
+    throw new Error("Bundle missing dsseEnvelope for DSSE v0.0.2 entry");
+  }
+  const spec = entry.spec.dsseV002;
+  if (!spec) {
+    throw new Error("DSSE v0.0.2 entry missing dsseV002 spec");
+  }
+  if (!spec.signatures || spec.signatures.length !== 1) {
+    throw new Error("DSSE v0.0.2 entry must have exactly one signature");
+  }
+  const tlogSig = spec.signatures[0].content;
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+  if (bundle.dsseEnvelope.signatures.length === 0) {
+    throw new Error("Bundle DSSE envelope missing signatures");
+  }
+  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
+  }
+  if (!spec.payloadHash?.digest || !spec.payloadHash?.algorithm) {
+    throw new Error("DSSE v0.0.2 entry missing payloadHash or algorithm");
+  }
+  const hashAlg = getHashAlgorithm(spec.payloadHash.algorithm);
+  const tlogHashBytes = base64ToUint8Array(spec.payloadHash.digest);
+  const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+  const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
+  if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+    throw new Error("DSSE payload hash mismatch between TLog entry and bundle (v0.0.2)");
+  }
+}
+__name(verifyDSSE002Body, "verifyDSSE002Body");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/tlog/intoto.js
+async function verifyIntotoBody(entry, bundle) {
+  const intotoEntry = entry;
+  if (intotoEntry.apiVersion !== "0.0.2") {
+    throw new Error(`Unsupported intoto version: ${intotoEntry.apiVersion}`);
+  }
+  if (!bundle.dsseEnvelope) {
+    throw new Error("Bundle missing dsseEnvelope for intoto entry");
+  }
+  const tlogEnvelope = intotoEntry.spec.content.envelope;
+  if (!tlogEnvelope.signatures || tlogEnvelope.signatures.length !== 1) {
+    throw new Error("Intoto entry must have exactly one signature");
+  }
+  const tlogSigBase64 = tlogEnvelope.signatures[0].sig;
+  const tlogSigDecoded = base64Decode(tlogSigBase64);
+  const tlogSigBytes = base64ToUint8Array(tlogSigDecoded);
+  if (bundle.dsseEnvelope.signatures.length === 0) {
+    throw new Error("Bundle DSSE envelope missing signatures");
+  }
+  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("Intoto signature mismatch between TLog entry and bundle");
+  }
+  if (intotoEntry.spec.content.payloadHash) {
+    if (!intotoEntry.spec.content.payloadHash.algorithm) {
+      throw new Error("Intoto entry missing payloadHash algorithm");
+    }
+    const hashAlg = getHashAlgorithm(intotoEntry.spec.content.payloadHash.algorithm);
+    const tlogHashBytes = hexToUint8Array(intotoEntry.spec.content.payloadHash.value);
+    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+    const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
+    if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+      throw new Error("Intoto payload hash mismatch between TLog entry and bundle");
+    }
+  }
+}
+__name(verifyIntotoBody, "verifyIntotoBody");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/tlog/body.js
+async function verifyTLogBody(entry, bundle) {
+  const rekorEntry = parseCanonicalBody(entry);
+  const { kind, version } = entry.kindVersion;
+  if (kind !== rekorEntry.kind || version !== rekorEntry.apiVersion) {
+    throw new Error(`kind/version mismatch - expected: ${kind}/${version}, received: ${rekorEntry.kind}/${rekorEntry.apiVersion}`);
+  }
+  switch (rekorEntry.kind) {
+    case "hashedrekord":
+      return verifyHashedRekordBody(rekorEntry, bundle);
+    case "dsse":
+      return verifyDSSEBody(rekorEntry, bundle);
+    case "intoto":
+      return verifyIntotoBody(rekorEntry, bundle);
+    default:
+      throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);
+  }
+}
+__name(verifyTLogBody, "verifyTLogBody");
+function parseCanonicalBody(entry) {
+  try {
+    const decodedBody = base64Decode(entry.canonicalizedBody);
+    const rekorEntry = JSON.parse(decodedBody);
+    if (!rekorEntry.apiVersion || !rekorEntry.kind || !rekorEntry.spec) {
+      throw new Error("Invalid Rekor entry structure");
+    }
+    return rekorEntry;
+  } catch (error) {
+    throw new Error(`Failed to parse canonicalized body: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+__name(parseCanonicalBody, "parseCanonicalBody");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/rfc3161/error.js
+var RFC3161TimestampVerificationError = class extends Error {
+  static {
+    __name(this, "RFC3161TimestampVerificationError");
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/rfc3161/tstinfo.js
+var TSTInfo = class {
+  static {
+    __name(this, "TSTInfo");
+  }
+  constructor(asn1) {
+    this.root = asn1;
+  }
+  get version() {
+    return this.root.subs[0].toInteger();
+  }
+  get genTime() {
+    return this.root.subs[4].toDate();
+  }
+  get messageImprintHashAlgorithm() {
+    const oid = this.messageImprintObj.subs[0].subs[0].toOID();
+    const algo = SHA2_HASH_ALGOS[oid];
+    if (!algo) {
+      throw new Error(`Unknown message imprint hash algorithm OID: ${oid}`);
+    }
+    return algo;
+  }
+  get messageImprintHashedMessage() {
+    return this.messageImprintObj.subs[1].value;
+  }
+  get raw() {
+    return this.root.toDER();
+  }
+  async verify(data) {
+    const hashAlg = this.messageImprintHashAlgorithm;
+    const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 : hashAlg === "sha384" ? HashAlgorithms.SHA384 : hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
+    const digest = await crypto.subtle.digest(hashAlgName, data);
+    if (!uint8ArrayEqual(new Uint8Array(digest), this.messageImprintHashedMessage)) {
+      throw new RFC3161TimestampVerificationError("message imprint does not match artifact");
+    }
+  }
+  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+  get messageImprintObj() {
+    return this.root.subs[2];
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/rfc3161/timestamp.js
+var OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = "1.2.840.113549.1.7.2";
+var OID_PKCS9_CONTENT_TYPE_TSTINFO = "1.2.840.113549.1.9.16.1.4";
+var OID_PKCS9_MESSAGE_DIGEST_KEY = "1.2.840.113549.1.9.4";
+var RFC3161Timestamp = class _RFC3161Timestamp {
+  static {
+    __name(this, "RFC3161Timestamp");
+  }
+  constructor(asn1) {
+    this.root = asn1;
+  }
+  static parse(der) {
+    const asn1 = ASN1Obj.parseBuffer(der);
+    return new _RFC3161Timestamp(asn1);
+  }
+  get status() {
+    return this.pkiStatusInfoObj.subs[0].toInteger();
+  }
+  get contentType() {
+    return this.contentTypeObj.toOID();
+  }
+  get eContentType() {
+    return this.eContentTypeObj.toOID();
+  }
+  get signingTime() {
+    return this.tstInfo.genTime;
+  }
+  get signerIssuer() {
+    return this.signerSidObj.subs[0].value;
+  }
+  get signerSerialNumber() {
+    return this.signerSidObj.subs[1].value;
+  }
+  get signerDigestAlgorithm() {
+    const oid = this.signerDigestAlgorithmObj.subs[0].toOID();
+    const algo = SHA2_HASH_ALGOS[oid];
+    if (!algo) {
+      throw new Error(`Unknown digest algorithm OID: ${oid}`);
+    }
+    return algo;
+  }
+  get signatureAlgorithm() {
+    const oid = this.signatureAlgorithmObj.subs[0].toOID();
+    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];
+    return algo;
+  }
+  get signatureValue() {
+    return this.signatureValueObj.value;
+  }
+  get tstInfo() {
+    return new TSTInfo(this.eContentObj.subs[0].subs[0]);
+  }
+  async verify(data, publicKey) {
+    if (!this.timeStampTokenObj) {
+      throw new RFC3161TimestampVerificationError("timeStampToken is missing");
+    }
+    if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) {
+      throw new RFC3161TimestampVerificationError(`incorrect content type: ${this.contentType}`);
+    }
+    if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) {
+      throw new RFC3161TimestampVerificationError(`incorrect encapsulated content type: ${this.eContentType}`);
+    }
+    await this.tstInfo.verify(data);
+    await this.verifyMessageDigest();
+    await this.verifySignature(publicKey);
+  }
+  async verifyMessageDigest() {
+    const hashAlg = this.signerDigestAlgorithm;
+    const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 : hashAlg === "sha384" ? HashAlgorithms.SHA384 : hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
+    const tstInfoDigest = await crypto.subtle.digest(hashAlgName, this.tstInfo.raw);
+    const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;
+    if (!uint8ArrayEqual(new Uint8Array(tstInfoDigest), expectedDigest)) {
+      throw new RFC3161TimestampVerificationError("signed data does not match tstInfo");
+    }
+  }
+  async verifySignature(key) {
+    const signedAttrs = this.signedAttrsObj.toDER();
+    signedAttrs[0] = 49;
+    const oid = this.signatureAlgorithmObj.subs[0].toOID();
+    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];
+    if (!algo) {
+      throw new RFC3161TimestampVerificationError(`Unsupported signature algorithm OID: ${oid}`);
+    }
+    const verified = await verifySignature(key, signedAttrs, this.signatureValue, algo);
+    if (!verified) {
+      throw new RFC3161TimestampVerificationError("signature verification failed");
+    }
+  }
+  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+  get pkiStatusInfoObj() {
+    return this.root.subs[0];
+  }
+  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+  get timeStampTokenObj() {
+    return this.root.subs[1];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-3
+  get contentTypeObj() {
+    return this.timeStampTokenObj.subs[0];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5652#section-3
+  get signedDataObj() {
+    const obj = this.timeStampTokenObj.subs.find((sub) => sub.tag.isContextSpecific(0));
+    if (!obj) {
+      throw new RFC3161TimestampVerificationError("Missing timeStampTokenObj sub.");
+    }
+    return obj.subs[0];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
+  get encapContentInfoObj() {
+    return this.signedDataObj.subs[2];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
+  get signerInfosObj() {
+    const sd = this.signedDataObj;
+    return sd.subs[sd.subs.length - 1];
+  }
+  // https://www.rfc-editor.org/rfc/rfc5652#section-5.1
+  get signerInfoObj() {
+    return this.signerInfosObj.subs[0];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
+  get eContentTypeObj() {
+    return this.encapContentInfoObj.subs[0];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
+  get eContentObj() {
+    return this.encapContentInfoObj.subs[1];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+  get signedAttrsObj() {
+    const signedAttrs = this.signerInfoObj.subs.find((sub) => sub.tag.isContextSpecific(0));
+    if (!signedAttrs) {
+      throw new RFC3161TimestampVerificationError("Missing signedAttrsObj.");
+    }
+    return signedAttrs;
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+  get messageDigestAttributeObj() {
+    const messageDigest = this.signedAttrsObj.subs.find((sub) => sub.subs[0].tag.isOID() && sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY);
+    if (!messageDigest) {
+      throw new RFC3161TimestampVerificationError("Missing messageDigest.");
+    }
+    return messageDigest;
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+  get signerSidObj() {
+    return this.signerInfoObj.subs[1];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+  get signerDigestAlgorithmObj() {
+    return this.signerInfoObj.subs[2];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+  get signatureAlgorithmObj() {
+    return this.signerInfoObj.subs[4];
+  }
+  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+  get signatureValueObj() {
+    return this.signerInfoObj.subs[5];
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/timestamp/tsa.js
+async function verifyRFC3161Timestamp(timestamp, data, timestampAuthorities) {
+  const signingTime = timestamp.signingTime;
+  let validAuthorities = filterCertAuthorities(timestampAuthorities, signingTime);
+  validAuthorities = filterCAsBySerialAndIssuer(validAuthorities, {
+    serialNumber: timestamp.signerSerialNumber,
+    issuer: timestamp.signerIssuer
+  });
+  const verificationResults = await Promise.allSettled(validAuthorities.map((ca) => verifyTimestampForCA(timestamp, data, ca)));
+  const verified = verificationResults.some((result) => result.status === "fulfilled");
+  if (!verified) {
+    const errors = verificationResults.filter((r) => r.status === "rejected").map((r) => r.reason?.message || "Unknown error");
+    throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(", ")}`);
+  }
+  return signingTime;
+}
+__name(verifyRFC3161Timestamp, "verifyRFC3161Timestamp");
+function filterCertAuthorities(authorities, validAt) {
+  return authorities.filter((ca) => {
+    if (ca.validFor) {
+      const start = ca.validFor.start ? new Date(ca.validFor.start) : null;
+      const end = ca.validFor.end ? new Date(ca.validFor.end) : null;
+      if (start && validAt < start) {
+        return false;
+      }
+      if (end && validAt > end) {
+        return false;
+      }
+    }
+    return true;
+  });
+}
+__name(filterCertAuthorities, "filterCertAuthorities");
+function filterCAsBySerialAndIssuer(timestampAuthorities, criteria) {
+  return timestampAuthorities.filter((ca) => {
+    if (!ca.certChain || ca.certChain.certificates.length === 0) {
+      return false;
+    }
+    const leafCert = X509Certificate.parse(base64ToUint8Array(ca.certChain.certificates[0].rawBytes));
+    return uint8ArrayEqual(leafCert.serialNumber, criteria.serialNumber) && uint8ArrayEqual(leafCert.issuer, criteria.issuer);
+  });
+}
+__name(filterCAsBySerialAndIssuer, "filterCAsBySerialAndIssuer");
+async function verifyTimestampForCA(timestamp, data, ca) {
+  if (!ca.certChain || ca.certChain.certificates.length === 0) {
+    throw new Error("Certificate authority missing certificate chain");
+  }
+  const leafCert = X509Certificate.parse(base64ToUint8Array(ca.certChain.certificates[0].rawBytes));
+  const signingTime = timestamp.signingTime;
+  const trustedCerts = ca.certChain.certificates.slice(1).map((cert) => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+  try {
+    const verifier = new CertificateChainVerifier({
+      untrustedCert: leafCert,
+      trustedCerts,
+      timestamp: signingTime
+    });
+    await verifier.verify();
+  } catch (e) {
+    throw new Error(`TSA certificate chain verification failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const publicKey = await leafCert.publicKeyObj;
+  await timestamp.verify(data, publicKey);
+}
+__name(verifyTimestampForCA, "verifyTimestampForCA");
+async function verifyBundleTimestamp(timestampData, signature, timestampAuthorities) {
+  if (!timestampData?.rfc3161Timestamps?.length) {
+    return [];
+  }
+  const verifiedResults = [];
+  for (const tsData of timestampData.rfc3161Timestamps) {
+    const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
+    const timestamp = RFC3161Timestamp.parse(timestampBytes);
+    const signingTime = await verifyRFC3161Timestamp(timestamp, signature, timestampAuthorities);
+    verifiedResults.push({
+      signingTime,
+      signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(",")
+    });
+  }
+  for (let i = 0; i < verifiedResults.length; i++) {
+    for (let j = i + 1; j < verifiedResults.length; j++) {
+      if (verifiedResults[i].signingTime.getTime() === verifiedResults[j].signingTime.getTime() && verifiedResults[i].signerSerialNumber === verifiedResults[j].signerSerialNumber) {
+        throw new Error("Duplicate TSA timestamp detected");
+      }
+    }
+  }
+  return verifiedResults.map((r) => r.signingTime);
+}
+__name(verifyBundleTimestamp, "verifyBundleTimestamp");
+
+// node_modules/@freedomofpress/sigstore-browser/dist/trust/tuf.js
+var DEFAULT_CONFIG = {
+  metadataUrl: "https://tuf-repo-cdn.sigstore.dev/",
+  targetBaseUrl: "https://tuf-repo-cdn.sigstore.dev/targets/",
+  namespace: "tuf-cache",
+  trustedRootTarget: "trusted_root.json",
+  cacheTTL: 36e5
+  // 1 hour
+};
+var TrustedRootProvider = class {
+  static {
+    __name(this, "TrustedRootProvider");
+  }
+  constructor(options = {}) {
+    const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;
+    this.metadataUrl = metadataUrl.endsWith("/") ? metadataUrl : `${metadataUrl}/`;
+    const targetBaseUrl = options.targetBaseUrl || DEFAULT_CONFIG.targetBaseUrl;
+    this.targetBaseUrl = targetBaseUrl.endsWith("/") ? targetBaseUrl : `${targetBaseUrl}/`;
+    this.initialRoot = options.initialRoot;
+    this.namespace = options.namespace || DEFAULT_CONFIG.namespace;
+    this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;
+    this.cacheTTL = options.cacheTTL ?? DEFAULT_CONFIG.cacheTTL;
+    this.disableCache = options.disableCache ?? false;
+  }
+  /**
+   * Initialize the TUF client
+   * Lazy initialization to avoid loading TUF client until needed
+   */
+  async initTUFClient() {
+    if (this.tufClient) {
+      return;
+    }
+    try {
+      const { TUFClient } = await import("./c-EUEPIW4S.mjs");
+      const rootMetadata = this.initialRoot || await this.getDefaultRoot();
+      this.tufClient = new TUFClient(this.metadataUrl, rootMetadata, this.namespace, this.targetBaseUrl, { disableCache: this.disableCache });
+    } catch (error) {
+      throw new Error(`Failed to initialize TUF client: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  /**
+   * Get the default embedded root metadata
+   * Returns the TUF root.json that bootstraps the TUF client
+   */
+  async getDefaultRoot() {
+    const { default: tufRootBase64 } = await import("./c-YUSTRATJ.mjs");
+    const decoder = new TextDecoder();
+    const rootBytes = Uint8Array.from(atob(tufRootBase64), (c) => c.charCodeAt(0));
+    return decoder.decode(rootBytes);
+  }
+  /**
+   * Check if cached trusted root is still valid
+   */
+  isCacheValid() {
+    if (!this.cachedRoot || !this.cacheTimestamp) {
+      return false;
+    }
+    const now = Date.now();
+    return now - this.cacheTimestamp < this.cacheTTL;
+  }
+  /**
+   * Get the Sigstore trusted root metadata
+   * Uses TUF to securely fetch and verify the trusted root
+   *
+   * @returns Promise<TrustedRoot> The verified trusted root metadata
+   * @throws Error if TUF verification fails or root cannot be fetched
+   */
+  async getTrustedRoot() {
+    if (this.isCacheValid() && this.cachedRoot) {
+      return this.cachedRoot;
+    }
+    await this.initTUFClient();
+    if (!this.tufClient) {
+      throw new Error("TUF client not initialized");
+    }
+    try {
+      await this.tufClient.updateTUF();
+      const trustedRootBuffer = await this.tufClient.getTarget(this.trustedRootTarget);
+      const trustedRootJson = Uint8ArrayToString(new Uint8Array(trustedRootBuffer));
+      const trustedRoot = JSON.parse(trustedRootJson);
+      this.cachedRoot = trustedRoot;
+      this.cacheTimestamp = Date.now();
+      return trustedRoot;
+    } catch (error) {
+      throw new Error(`Failed to fetch trusted root via TUF: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  /**
+   * Manually refresh the trusted root from TUF
+   * Bypasses cache and forces a fresh fetch
+   *
+   * @returns Promise<TrustedRoot> The updated trusted root metadata
+   */
+  async refreshTrustedRoot() {
+    this.cachedRoot = void 0;
+    this.cacheTimestamp = void 0;
+    return await this.getTrustedRoot();
+  }
+  /**
+   * Clear the cached trusted root
+   * Next call to getTrustedRoot() will fetch fresh data
+   */
+  clearCache() {
+    this.cachedRoot = void 0;
+    this.cacheTimestamp = void 0;
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/errors.js
+var VerificationError = class _VerificationError extends Error {
+  static {
+    __name(this, "VerificationError");
+  }
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "VerificationError";
+    Object.setPrototypeOf(this, _VerificationError.prototype);
+  }
+};
+var TimestampError = class _TimestampError extends VerificationError {
+  static {
+    __name(this, "TimestampError");
+  }
+  constructor(message) {
+    super("TIMESTAMP_ERROR", message);
+    this.name = "TimestampError";
+    Object.setPrototypeOf(this, _TimestampError.prototype);
+  }
+};
+var CertificateError = class _CertificateError extends VerificationError {
+  static {
+    __name(this, "CertificateError");
+  }
+  constructor(message) {
+    super("CERTIFICATE_ERROR", message);
+    this.name = "CertificateError";
+    Object.setPrototypeOf(this, _CertificateError.prototype);
+  }
+};
+var TLogError = class _TLogError extends VerificationError {
+  static {
+    __name(this, "TLogError");
+  }
+  constructor(message) {
+    super("TLOG_ERROR", message);
+    this.name = "TLogError";
+    Object.setPrototypeOf(this, _TLogError.prototype);
+  }
+};
+var SignatureError = class _SignatureError extends VerificationError {
+  static {
+    __name(this, "SignatureError");
+  }
+  constructor(message) {
+    super("SIGNATURE_ERROR", message);
+    this.name = "SignatureError";
+    Object.setPrototypeOf(this, _SignatureError.prototype);
+  }
+};
+var PolicyError = class _PolicyError extends VerificationError {
+  static {
+    __name(this, "PolicyError");
+  }
+  constructor(message) {
+    super("POLICY_ERROR", message);
+    this.name = "PolicyError";
+    Object.setPrototypeOf(this, _PolicyError.prototype);
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/policy.js
+var GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+var SingleX509ExtPolicyV1 = class {
+  static {
+    __name(this, "SingleX509ExtPolicyV1");
+  }
+  constructor(value) {
+    this.expectedValue = value;
+  }
+  verify(cert) {
+    const extValue = this.getExtensionValue(cert);
+    if (extValue === void 0) {
+      throw new PolicyError(`Certificate does not contain ${this.name} (${this.oid}) extension`);
+    }
+    if (extValue !== this.expectedValue) {
+      throw new PolicyError(`Certificate's ${this.name} does not match (got '${extValue}', expected '${this.expectedValue}')`);
+    }
+  }
+};
+var SingleX509ExtPolicyV2 = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "SingleX509ExtPolicyV2");
+  }
+};
+var OIDCIssuer = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "OIDCIssuer");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_FULCIO_ISSUER_V1;
+    this.name = "OIDCIssuer";
+  }
+  getExtensionValue(cert) {
+    return cert.extFulcioIssuerV1?.issuer;
+  }
+};
+var GitHubWorkflowTrigger = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "GitHubWorkflowTrigger");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER;
+    this.name = "GitHubWorkflowTrigger";
+  }
+  getExtensionValue(cert) {
+    return cert.extGitHubWorkflowTrigger?.workflowTrigger;
+  }
+};
+var GitHubWorkflowSHA = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "GitHubWorkflowSHA");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_GITHUB_WORKFLOW_SHA;
+    this.name = "GitHubWorkflowSHA";
+  }
+  getExtensionValue(cert) {
+    return cert.extGitHubWorkflowSHA?.workflowSHA;
+  }
+};
+var GitHubWorkflowName = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "GitHubWorkflowName");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_GITHUB_WORKFLOW_NAME;
+    this.name = "GitHubWorkflowName";
+  }
+  getExtensionValue(cert) {
+    return cert.extGitHubWorkflowName?.workflowName;
+  }
+};
+var GitHubWorkflowRepository = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "GitHubWorkflowRepository");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY;
+    this.name = "GitHubWorkflowRepository";
+  }
+  getExtensionValue(cert) {
+    return cert.extGitHubWorkflowRepository?.workflowRepository;
+  }
+};
+var GitHubWorkflowRef = class extends SingleX509ExtPolicyV1 {
+  static {
+    __name(this, "GitHubWorkflowRef");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_GITHUB_WORKFLOW_REF;
+    this.name = "GitHubWorkflowRef";
+  }
+  getExtensionValue(cert) {
+    return cert.extGitHubWorkflowRef?.workflowRef;
+  }
+};
+var OIDCIssuerV2 = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCIssuerV2");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_FULCIO_ISSUER_V2;
+    this.name = "OIDCIssuerV2";
+  }
+  getExtensionValue(cert) {
+    return cert.extFulcioIssuerV2?.issuer;
+  }
+};
+var OIDCBuildSignerURI = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCBuildSignerURI");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_BUILD_SIGNER_URI;
+    this.name = "OIDCBuildSignerURI";
+  }
+  getExtensionValue(cert) {
+    return cert.extBuildSignerURI?.buildSignerURI;
+  }
+};
+var OIDCBuildSignerDigest = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCBuildSignerDigest");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_BUILD_SIGNER_DIGEST;
+    this.name = "OIDCBuildSignerDigest";
+  }
+  getExtensionValue(cert) {
+    return cert.extBuildSignerDigest?.buildSignerDigest;
+  }
+};
+var OIDCRunnerEnvironment = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCRunnerEnvironment");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_RUNNER_ENVIRONMENT;
+    this.name = "OIDCRunnerEnvironment";
+  }
+  getExtensionValue(cert) {
+    return cert.extRunnerEnvironment?.runnerEnvironment;
+  }
+};
+var OIDCSourceRepositoryURI = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryURI");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_URI;
+    this.name = "OIDCSourceRepositoryURI";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryURI?.sourceRepositoryURI;
+  }
+};
+var OIDCSourceRepositoryDigest = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryDigest");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_DIGEST;
+    this.name = "OIDCSourceRepositoryDigest";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryDigest?.sourceRepositoryDigest;
+  }
+};
+var OIDCSourceRepositoryRef = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryRef");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_REF;
+    this.name = "OIDCSourceRepositoryRef";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryRef?.sourceRepositoryRef;
+  }
+};
+var OIDCSourceRepositoryIdentifier = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryIdentifier");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER;
+    this.name = "OIDCSourceRepositoryIdentifier";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryIdentifier?.sourceRepositoryIdentifier;
+  }
+};
+var OIDCSourceRepositoryOwnerURI = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryOwnerURI");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI;
+    this.name = "OIDCSourceRepositoryOwnerURI";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryOwnerURI?.sourceRepositoryOwnerURI;
+  }
+};
+var OIDCSourceRepositoryOwnerIdentifier = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryOwnerIdentifier");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER;
+    this.name = "OIDCSourceRepositoryOwnerIdentifier";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryOwnerIdentifier?.sourceRepositoryOwnerIdentifier;
+  }
+};
+var OIDCBuildConfigURI = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCBuildConfigURI");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_BUILD_CONFIG_URI;
+    this.name = "OIDCBuildConfigURI";
+  }
+  getExtensionValue(cert) {
+    return cert.extBuildConfigURI?.buildConfigURI;
+  }
+};
+var OIDCBuildConfigDigest = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCBuildConfigDigest");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_BUILD_CONFIG_DIGEST;
+    this.name = "OIDCBuildConfigDigest";
+  }
+  getExtensionValue(cert) {
+    return cert.extBuildConfigDigest?.buildConfigDigest;
+  }
+};
+var OIDCBuildTrigger = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCBuildTrigger");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_BUILD_TRIGGER;
+    this.name = "OIDCBuildTrigger";
+  }
+  getExtensionValue(cert) {
+    return cert.extBuildTrigger?.buildTrigger;
+  }
+};
+var OIDCRunInvocationURI = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCRunInvocationURI");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_RUN_INVOCATION_URI;
+    this.name = "OIDCRunInvocationURI";
+  }
+  getExtensionValue(cert) {
+    return cert.extRunInvocationURI?.runInvocationURI;
+  }
+};
+var OIDCSourceRepositoryVisibility = class extends SingleX509ExtPolicyV2 {
+  static {
+    __name(this, "OIDCSourceRepositoryVisibility");
+  }
+  constructor() {
+    super(...arguments);
+    this.oid = EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY;
+    this.name = "OIDCSourceRepositoryVisibility";
+  }
+  getExtensionValue(cert) {
+    return cert.extSourceRepositoryVisibility?.sourceRepositoryVisibility;
+  }
+};
+var AnyOf = class {
+  static {
+    __name(this, "AnyOf");
+  }
+  constructor(children) {
+    this.children = children;
+  }
+  verify(cert) {
+    for (const child of this.children) {
+      try {
+        child.verify(cert);
+        return;
+      } catch {
+      }
+    }
+    throw new PolicyError(`0 of ${this.children.length} policies succeeded`);
+  }
+};
+var AllOf = class {
+  static {
+    __name(this, "AllOf");
+  }
+  constructor(children) {
+    this.children = children;
+  }
+  verify(cert) {
+    if (this.children.length < 1) {
+      throw new PolicyError("no child policies to verify");
+    }
+    for (const child of this.children) {
+      child.verify(cert);
+    }
+  }
+};
+var Identity = class {
+  static {
+    __name(this, "Identity");
+  }
+  constructor(options) {
+    this.identity = options.identity;
+    this.issuerPolicy = options.issuer ? new OIDCIssuer(options.issuer) : null;
+  }
+  verify(cert) {
+    if (this.issuerPolicy) {
+      this.issuerPolicy.verify(cert);
+    }
+    const sanExt = cert.extSubjectAltName;
+    if (!sanExt) {
+      throw new PolicyError("Certificate does not contain SubjectAlternativeName extension");
+    }
+    const allSans = /* @__PURE__ */ new Set();
+    if (sanExt.rfc822Name) {
+      allSans.add(sanExt.rfc822Name);
+    }
+    if (sanExt.uri) {
+      allSans.add(sanExt.uri);
+    }
+    const otherName = sanExt.otherName(EXTENSION_OID_OTHERNAME);
+    if (otherName) {
+      allSans.add(otherName);
+    }
+    if (!allSans.has(this.identity)) {
+      throw new PolicyError(`Certificate's SANs do not match ${this.identity}; actual SANs: ${Array.from(allSans).join(", ")}`);
+    }
+  }
+};
+
+// node_modules/@freedomofpress/sigstore-browser/dist/sigstore.js
+var MEDIA_TYPE_BASE = "application/vnd.dev.sigstore.bundle";
+function getBundleVersion(mediaType) {
+  switch (mediaType) {
+    case `${MEDIA_TYPE_BASE}+json;version=0.1`:
+      return "0.1";
+    case `${MEDIA_TYPE_BASE}+json;version=0.2`:
+      return "0.2";
+    case `${MEDIA_TYPE_BASE}+json;version=0.3`:
+      return "0.3";
+  }
+  if (mediaType.startsWith(`${MEDIA_TYPE_BASE}.v`) && mediaType.endsWith("+json")) {
+    const version = mediaType.replace(`${MEDIA_TYPE_BASE}.v`, "").replace("+json", "");
+    if (/^\d+\.\d+(\.\d+)?$/.test(version)) {
+      return version;
+    }
+  }
+  return "0.1";
+}
+__name(getBundleVersion, "getBundleVersion");
+function assertRekorV2Timestamp(timestampData) {
+  if (!timestampData?.rfc3161Timestamps?.length) {
+    throw new Error("Rekor v2 bundles require a timestamp for verification.");
+  }
+}
+__name(assertRekorV2Timestamp, "assertRekorV2Timestamp");
+var SigstoreVerifier = class {
+  static {
+    __name(this, "SigstoreVerifier");
+  }
+  constructor(options = {}) {
+    this.root = void 0;
+    this.rawRoot = void 0;
+    this.options = {
+      tlogThreshold: options.tlogThreshold ?? 1,
+      ctlogThreshold: options.ctlogThreshold ?? 1,
+      tsaThreshold: options.tsaThreshold ?? 0
+    };
+  }
+  async loadLog(frozenTimestamp, logs) {
+    for (const log of logs) {
+      if (frozenTimestamp > new Date(log.publicKey.validFor.start) && (!log.publicKey.validFor.end || new Date(log.publicKey.validFor.end) > frozenTimestamp)) {
+        return {
+          publicKey: await importKey(log.publicKey.keyDetails, log.publicKey.keyDetails, log.publicKey.rawBytes),
+          logId: base64ToUint8Array(log.logId.keyId)
+        };
+      }
+    }
+    return void 0;
+  }
+  async loadCTLogs(frozenTimestamp, ctlogs) {
+    const result = [];
+    for (const log of ctlogs) {
+      const start = new Date(log.publicKey.validFor.start);
+      const end = log.publicKey.validFor.end ? new Date(log.publicKey.validFor.end) : /* @__PURE__ */ new Date("9999-12-31");
+      if (start <= frozenTimestamp) {
+        const publicKey = await importKey(log.publicKey.keyDetails, log.publicKey.keyDetails, log.publicKey.rawBytes);
+        result.push({
+          logID: base64ToUint8Array(log.logId.keyId),
+          publicKey,
+          validFor: { start, end }
+        });
+      }
+    }
+    if (result.length === 0) {
+      throw new Error("Could not find any valid CT logs in sigstore root.");
+    }
+    return result;
+  }
+  // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts#L22-L53
+  // Verifies that the leaf certificate chains to a trusted CA and is valid at the given timestamp.
+  // Differences from sigstore-js:
+  // - This is async (uses await) because our CertificateChainVerifier.verify() is async
+  // - sigstore-js filters CAs using filterCertAuthorities() before calling this function,
+  //   we do the timestamp filtering inline within this function
+  async verifyCertificateChain(timestamp, leaf, certificateAuthorities) {
+    let lastError;
+    for (const ca of certificateAuthorities) {
+      if (timestamp < ca.validFor.start || timestamp > ca.validFor.end) {
+        continue;
+      }
+      try {
+        const verifier = new CertificateChainVerifier({
+          trustedCerts: ca.certChain,
+          untrustedCert: leaf,
+          timestamp
+        });
+        return await verifier.verify();
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw new Error(`Failed to verify certificate chain: ${lastError?.message || "No valid CAs found"}`);
+  }
+  // Load timestamp authorities that are valid at the frozen timestamp.
+  // Unlike sigstore-js which doesn't pre-load TSAs (it passes raw TSA data to timestamp verification),
+  // we parse and filter them at initialization time for consistency with how we handle CAs and other roots.
+  loadTSA(frozenTimestamp, tsas) {
+    if (!tsas || tsas.length === 0) {
+      return [];
+    }
+    const result = [];
+    for (const tsa of tsas) {
+      const start = new Date(tsa.validFor.start);
+      const end = tsa.validFor.end ? new Date(tsa.validFor.end) : /* @__PURE__ */ new Date(864e13);
+      if (frozenTimestamp > start && frozenTimestamp < end) {
+        const certChain = tsa.certChain.certificates.map((cert) => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+        if (certChain.length > 0) {
+          result.push({
+            certChain,
+            validFor: { start, end }
+          });
+        }
+      }
+    }
+    return result;
+  }
+  // Load certificate authorities (Fulcio CAs) that are valid at the frozen timestamp.
+  // Similar to sigstore-js's filterCertAuthorities() in trust/filter.ts, but we also
+  // parse the certificates at load time whereas sigstore-js keeps them in the trust material
+  // and parses them during verification. This pre-loading approach is consistent with our
+  // architecture of loading all trusted roots at initialization.
+  loadCA(frozenTimestamp, cas) {
+    const result = [];
+    for (const ca of cas) {
+      const start = new Date(ca.validFor.start);
+      const end = ca.validFor.end ? new Date(ca.validFor.end) : /* @__PURE__ */ new Date(864e13);
+      if (frozenTimestamp > start && frozenTimestamp < end) {
+        const certChain = ca.certChain.certificates.map((cert) => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+        if (certChain.length > 0) {
+          result.push({
+            certChain,
+            validFor: { start, end }
+          });
+        }
+      }
+    }
+    return result;
+  }
+  async loadSigstoreRoot(rawRoot) {
+    const frozenTimestamp = /* @__PURE__ */ new Date();
+    this.rawRoot = rawRoot;
+    this.root = {
+      rekor: await this.loadLog(frozenTimestamp, rawRoot[SigstoreRoots.tlogs]),
+      ctlogs: await this.loadCTLogs(frozenTimestamp, rawRoot[SigstoreRoots.ctlogs]),
+      certificateAuthorities: this.loadCA(frozenTimestamp, rawRoot[SigstoreRoots.certificateAuthorities]),
+      timestampAuthorities: this.loadTSA(frozenTimestamp, rawRoot.timestampAuthorities)
+    };
+  }
+  /**
+   * Load Sigstore trusted root via TUF
+   * Uses The Update Framework for secure, verified updates of trusted root metadata
+   *
+   * @param tufProvider Optional TrustedRootProvider instance. If not provided, uses default Sigstore TUF repository
+   */
+  async loadSigstoreRootWithTUF(tufProvider) {
+    const provider = tufProvider || new TrustedRootProvider();
+    const trustedRoot = await provider.getTrustedRoot();
+    await this.loadSigstoreRoot(trustedRoot);
+  }
+  // Adapted from https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/sct.ts
+  // Key differences:
+  // - Adds duplicate SCT detection (not in reference)
+  // - Inline CT log filtering by logID and validity period (reference uses filterTLogAuthorities)
+  // - Returns array of verified SCT logIDs for threshold checking (matches reference behavior)
+  async verifySCT(cert, issuer, ctlogs) {
+    let extSCT;
+    const clone = cert.clone();
+    for (let i = 0; i < clone.extensions.length; i++) {
+      const ext = clone.extensions[i];
+      if (ext.subs[0].toOID() === EXTENSION_OID_SCT) {
+        extSCT = new X509SCTExtension(ext);
+        clone.extensions.splice(i, 1);
+        break;
+      }
+    }
+    if (!extSCT) {
+      throw new Error("Certificate is missing required SCT extension");
+    }
+    if (extSCT.signedCertificateTimestamps.length === 0) {
+      throw new Error("SCT extension is present but contains no SCTs");
+    }
+    const seenLogIds = /* @__PURE__ */ new Set();
+    for (const sct of extSCT.signedCertificateTimestamps) {
+      const logIdHex = Uint8ArrayToHex(sct.logID);
+      if (seenLogIds.has(logIdHex)) {
+        throw new Error(`Duplicate SCT found for log ID: ${logIdHex}`);
+      }
+      seenLogIds.add(logIdHex);
+    }
+    const preCert = new ByteStream();
+    const issuerId = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, issuer.publicKey));
+    preCert.appendView(issuerId);
+    const tbs = clone.tbsCertificate.toDER();
+    preCert.appendUint24(tbs.length);
+    preCert.appendView(tbs);
+    const verifiedSCTs = [];
+    for (const sct of extSCT.signedCertificateTimestamps) {
+      const validCTLogs = ctlogs.filter((log) => {
+        if (!uint8ArrayEqual(log.logID, sct.logID))
+          return false;
+        return log.validFor.start <= sct.datetime && sct.datetime <= log.validFor.end;
+      });
+      const verified = await (async () => {
+        for (const log of validCTLogs) {
+          try {
+            if (await sct.verify(preCert.buffer, log.publicKey)) {
+              return true;
+            }
+          } catch {
+          }
+        }
+        return false;
+      })();
+      if (!verified) {
+        throw new Error("SCT verification failed");
+      }
+      verifiedSCTs.push(sct.logID);
+    }
+    return verifiedSCTs;
+  }
+  async verifyInclusionPromise(cert, bundle, rekor) {
+    const entries = bundle.verificationMaterial.tlogEntries;
+    if (entries.length < this.options.tlogThreshold) {
+      throw new Error(`Not enough tlog entries: ${entries.length} < ${this.options.tlogThreshold}`);
+    }
+    const MAX_TLOG_ENTRIES = 32;
+    if (entries.length > MAX_TLOG_ENTRIES) {
+      throw new Error(`Too many tlog entries: ${entries.length} > ${MAX_TLOG_ENTRIES}`);
+    }
+    for (let i = 0; i < entries.length; i++) {
+      for (let j = i + 1; j < entries.length; j++) {
+        const iLogId = Uint8ArrayToHex(base64ToUint8Array(entries[i].logId.keyId));
+        const jLogId = Uint8ArrayToHex(base64ToUint8Array(entries[j].logId.keyId));
+        if (iLogId === jLogId && entries[i].logIndex === entries[j].logIndex) {
+          throw new Error(`Duplicate tlog entry found: logID=${iLogId}, logIndex=${entries[i].logIndex}`);
+        }
+      }
+    }
+    const entry = entries[0];
+    const bundleVersion = getBundleVersion(bundle.mediaType);
+    const isV02OrLater = parseFloat(bundleVersion) >= 0.2;
+    if (isV02OrLater && !entry.inclusionProof) {
+      throw new Error("Bundle v0.2+ requires an inclusion proof.");
+    }
+    if (!entry.inclusionPromise?.signedEntryTimestamp) {
+      if (!entry.inclusionProof) {
+        throw new Error("Bundle must have either an inclusion promise or an inclusion proof.");
+      }
+    } else {
+      if (!rekor && entry.inclusionProof) {
+      } else {
+        if (!rekor) {
+          throw new Error("Rekor public key not found in trusted root");
+        }
+        const entryLogId = base64ToUint8Array(entry.logId.keyId);
+        if (!uint8ArrayEqual(rekor.logId, entryLogId)) {
+          throw new Error(`Rekor log ID mismatch: bundle uses ${Uint8ArrayToHex(entryLogId)} but loaded key is for ${Uint8ArrayToHex(rekor.logId)}`);
+        }
+        const signature = base64ToUint8Array(entry.inclusionPromise.signedEntryTimestamp);
+        const keyId = Uint8ArrayToHex(entryLogId);
+        const integratedTime = Number(entry.integratedTime);
+        const signed = stringToUint8Array(canonicalize({
+          body: entry.canonicalizedBody,
+          integratedTime,
+          logIndex: Number(entry.logIndex),
+          logID: keyId
+        }));
+        if (!await verifySignature(rekor.publicKey, signed, signature)) {
+          throw new Error("Failed to verify the inclusion promise in the provided bundle.");
+        }
+      }
+    }
+    if (entry.integratedTime) {
+      const integratedTime = Number(entry.integratedTime);
+      const integratedDate = new Date(integratedTime * 1e3);
+      if (!cert.validForDate(integratedDate)) {
+        throw new Error("Artifact signing was logged outside of the certificate validity.");
+      }
+    } else {
+      assertRekorV2Timestamp(bundle.verificationMaterial.timestampVerificationData);
+    }
+    const bodyJson = JSON.parse(Uint8ArrayToString(base64ToUint8Array(entry.canonicalizedBody)));
+    if (bodyJson.kind === "hashedrekord") {
+      let loggedCertContent;
+      if (bodyJson.spec.hashedRekordV002) {
+        const verifier = bodyJson.spec.hashedRekordV002.signature.verifier;
+        if (verifier?.x509Certificate) {
+          loggedCertContent = verifier.x509Certificate.rawBytes;
+        }
+      } else if (bodyJson.spec.signature?.publicKey) {
+        loggedCertContent = bodyJson.spec.signature.publicKey.content;
+      }
+      if (loggedCertContent) {
+        let loggedCert;
+        if (bodyJson.spec.hashedRekordV002) {
+          loggedCert = X509Certificate.parse(base64ToUint8Array(loggedCertContent));
+        } else {
+          const pemString = Uint8ArrayToString(base64ToUint8Array(loggedCertContent));
+          loggedCert = X509Certificate.parse(pemString);
+        }
+        if (!cert.equals(loggedCert)) {
+          throw new Error("Certificate in Rekor log does not match the signing certificate.");
+        }
+      }
+    } else if (bodyJson.kind === "dsse") {
+      const verifierContent = bodyJson.spec.signatures?.[0]?.verifier;
+      if (verifierContent) {
+        const pemString = Uint8ArrayToString(base64ToUint8Array(verifierContent));
+        const loggedCert = X509Certificate.parse(pemString);
+        if (!cert.equals(loggedCert)) {
+          throw new Error("Certificate in DSSE tlog entry does not match the signing certificate.");
+        }
+      }
+    } else if (bodyJson.kind === "intoto") {
+      const publicKeyContent = bodyJson.spec.content?.envelope?.signatures?.[0]?.publicKey;
+      if (publicKeyContent) {
+        const pemString = Uint8ArrayToString(base64ToUint8Array(publicKeyContent));
+        const loggedCert = X509Certificate.parse(pemString);
+        if (!cert.equals(loggedCert)) {
+          throw new Error("Certificate in intoto tlog entry does not match the signing certificate.");
+        }
+      }
+    } else {
+      throw new Error(`Unsupported tlog entry kind: ${bodyJson.kind}`);
+    }
+    return true;
+  }
+  async verifyInclusionProof(bundle) {
+    if (!this.rawRoot) {
+      throw new Error("Sigstore root is undefined");
+    }
+    if (bundle.verificationMaterial.tlogEntries.length < 1) {
+      throw new Error("No transparency log entries found in bundle");
+    }
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      if (entry.inclusionProof) {
+        await verifyMerkleInclusion(entry);
+        if (entry.inclusionProof.checkpoint) {
+          await verifyCheckpoint(entry, this.rawRoot.tlogs);
+        }
+      }
+    }
+  }
+  async verifyArtifactPolicy(policy, bundle, data, isDigestOnly = false) {
+    if (!this.root) {
+      throw new Error("Sigstore root is undefined");
+    }
+    const cert = bundle.verificationMaterial.certificate || bundle.verificationMaterial.x509CertificateChain?.certificates[0];
+    if (!cert) {
+      throw new Error("No certificate found in bundle");
+    }
+    const signingCert = X509Certificate.parse(base64ToUint8Array(cert.rawBytes));
+    let signature;
+    if (bundle.messageSignature) {
+      signature = base64ToUint8Array(bundle.messageSignature.signature);
+    } else if (bundle.dsseEnvelope) {
+      if (!bundle.dsseEnvelope.signatures || bundle.dsseEnvelope.signatures.length === 0) {
+        throw new Error("DSSE envelope has no signatures");
+      }
+      signature = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+    } else {
+      throw new Error("Bundle does not contain a message signature or DSSE envelope");
+    }
+    policy.verify(signingCert);
+    const certPath = await this.verifyCertificateChain(signingCert.notBefore, signingCert, this.root.certificateAuthorities);
+    const issuerCert = certPath.length > 1 ? certPath[1] : certPath[0];
+    const verifiedSCTs = await this.verifySCT(signingCert, issuerCert, this.root.ctlogs);
+    if (verifiedSCTs.length < this.options.ctlogThreshold) {
+      throw new Error(`Not enough valid SCTs: found ${verifiedSCTs.length}, required ${this.options.ctlogThreshold}`);
+    }
+    if (!await this.verifyInclusionPromise(signingCert, bundle, this.root.rekor)) {
+      throw new Error("Inclusion promise validation failed.");
+    }
+    await this.verifyInclusionProof(bundle);
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      await verifyTLogBody(entry, bundle);
+    }
+    const verifiedTimestamps = await verifyBundleTimestamp(bundle.verificationMaterial.timestampVerificationData, signature, this.rawRoot?.timestampAuthorities || []);
+    if (verifiedTimestamps.length < this.options.tsaThreshold) {
+      throw new Error(`Not enough verified TSA timestamps: ${verifiedTimestamps.length} < ${this.options.tsaThreshold}`);
+    }
+    for (const verifiedTimestamp of verifiedTimestamps) {
+      if (!signingCert.validForDate(verifiedTimestamp)) {
+        throw new Error("Certificate was not valid at the time of timestamping");
+      }
+    }
+    if (bundle.dsseEnvelope) {
+      const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+      const payload = JSON.parse(Uint8ArrayToString(payloadBytes));
+      if (!payload.subject || payload.subject.length === 0) {
+        throw new Error("DSSE payload has no subject");
+      }
+      let artifactDigest;
+      if (isDigestOnly) {
+        artifactDigest = Uint8ArrayToHex(data);
+      } else {
+        artifactDigest = Uint8ArrayToHex(new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, data)));
+      }
+      let matchedSubject = null;
+      for (const subject of payload.subject) {
+        const subjectDigest = subject.digest?.["sha256"];
+        if (subjectDigest && artifactDigest === subjectDigest.toLowerCase()) {
+          matchedSubject = subject;
+          break;
+        }
+      }
+      if (!matchedSubject) {
+        throw new Error(`Artifact digest ${artifactDigest} does not match any subject in DSSE payload`);
+      }
+      const pae = preAuthEncoding(bundle.dsseEnvelope.payloadType, payloadBytes);
+      const publicKey = await signingCert.publicKeyObj;
+      const verified = await verifySignature(publicKey, pae, signature);
+      if (!verified) {
+        throw new Error("DSSE signature verification failed");
+      }
+    } else {
+      const publicKey = await signingCert.publicKeyObj;
+      if (isDigestOnly) {
+        const verified = await verifySignatureOverDigest(publicKey, data, signature);
+        if (!verified) {
+          throw new Error("Error verifying signature over digest");
+        }
+      } else {
+        const verified = await verifySignature(publicKey, data, signature);
+        if (!verified) {
+          const keyAlg = publicKey.algorithm.name || "unknown";
+          throw new Error(`Error verifying artifact signature. Key algorithm: ${keyAlg}, Data length: ${data.length}, Signature length: ${signature.length}`);
+        }
+      }
+    }
+    return true;
+  }
+  async verifyArtifact(identity, issuer, bundle, data, isDigestOnly = false) {
+    const policy = new AllOf([
+      new Identity({ identity }),
+      new AnyOf([
+        new OIDCIssuerV2(issuer),
+        new OIDCIssuer(issuer)
+      ])
+    ]);
+    return this.verifyArtifactPolicy(policy, bundle, data, isDigestOnly);
+  }
+  /**
+   * Verify a DSSE bundle using a verification policy.
+   * This matches sigstore-python's verify_dsse API.
+   *
+   * Reference: https://github.com/sigstore/sigstore-python/blob/main/sigstore/verify/verifier.py#L388
+   *
+   * Unlike verify_artifact which verifies an artifact against a bundle,
+   * this method verifies the DSSE envelope itself and returns the payload.
+   * The caller is responsible for checking that the payload matches their
+   * expected artifact (e.g., by checking subjects in an in-toto statement).
+   *
+   * @param bundle - The Sigstore bundle containing the DSSE envelope
+   * @param policy - A verification policy to apply to the signing certificate
+   * @returns The payload type and payload bytes from the verified envelope
+   */
+  async verifyDsse(bundle, policy) {
+    if (!this.root) {
+      throw new Error("Sigstore root is undefined");
+    }
+    if (!bundle.dsseEnvelope) {
+      throw new Error("Bundle does not contain a DSSE envelope");
+    }
+    const cert = bundle.verificationMaterial.certificate || bundle.verificationMaterial.x509CertificateChain?.certificates[0];
+    if (!cert) {
+      throw new Error("No certificate found in bundle");
+    }
+    const signingCert = X509Certificate.parse(base64ToUint8Array(cert.rawBytes));
+    const certPath = await this.verifyCertificateChain(signingCert.notBefore, signingCert, this.root.certificateAuthorities);
+    const issuerCert = certPath.length > 1 ? certPath[1] : certPath[0];
+    const verifiedSCTs = await this.verifySCT(signingCert, issuerCert, this.root.ctlogs);
+    if (verifiedSCTs.length < this.options.ctlogThreshold) {
+      throw new Error(`Not enough valid SCTs: found ${verifiedSCTs.length}, required ${this.options.ctlogThreshold}`);
+    }
+    policy.verify(signingCert);
+    if (!await this.verifyInclusionPromise(signingCert, bundle, this.root.rekor)) {
+      throw new Error("Inclusion promise validation failed");
+    }
+    await this.verifyInclusionProof(bundle);
+    if (!bundle.dsseEnvelope.signatures || bundle.dsseEnvelope.signatures.length !== 1) {
+      throw new Error(`DSSE envelope must have exactly 1 signature, got ${bundle.dsseEnvelope.signatures?.length ?? 0}`);
+    }
+    const signature = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+    const verifiedTimestamps = await verifyBundleTimestamp(bundle.verificationMaterial.timestampVerificationData, signature, this.rawRoot?.timestampAuthorities || []);
+    if (verifiedTimestamps.length < this.options.tsaThreshold) {
+      throw new Error(`Not enough verified TSA timestamps: ${verifiedTimestamps.length} < ${this.options.tsaThreshold}`);
+    }
+    for (const verifiedTimestamp of verifiedTimestamps) {
+      if (!signingCert.validForDate(verifiedTimestamp)) {
+        throw new Error("Certificate was not valid at the time of timestamping");
+      }
+    }
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      if (entry.integratedTime) {
+        const integratedDate = new Date(Number(entry.integratedTime) * 1e3);
+        if (!signingCert.validForDate(integratedDate)) {
+          throw new Error("Artifact signing was logged outside of the certificate validity.");
+        }
+      } else {
+        assertRekorV2Timestamp(bundle.verificationMaterial.timestampVerificationData);
+      }
+    }
+    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+    const pae = preAuthEncoding(bundle.dsseEnvelope.payloadType, payloadBytes);
+    const publicKey = await signingCert.publicKeyObj;
+    const verified = await verifySignature(publicKey, pae, signature);
+    if (!verified) {
+      throw new Error("DSSE signature verification failed");
+    }
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      if (entry.kindVersion.kind !== "dsse") {
+        throw new Error(`Expected entry type dsse, got ${entry.kindVersion.kind}`);
+      }
+      await verifyTLogBody(entry, bundle);
+    }
+    return {
+      payloadType: bundle.dsseEnvelope.payloadType,
+      payload: payloadBytes
+    };
+  }
+};
+
+export {
+  X509Extension,
+  X509FulcioIssuerV1,
+  X509GitHubWorkflowTriggerExtension,
+  X509GitHubWorkflowSHAExtension,
+  X509GitHubWorkflowNameExtension,
+  X509GitHubWorkflowRepositoryExtension,
+  X509GitHubWorkflowRefExtension,
+  X509FulcioIssuerV2,
+  X509BuildSignerURIExtension,
+  X509BuildSignerDigestExtension,
+  X509RunnerEnvironmentExtension,
+  X509SourceRepositoryURIExtension,
+  X509SourceRepositoryDigestExtension,
+  X509SourceRepositoryRefExtension,
+  X509SourceRepositoryIdentifierExtension,
+  X509SourceRepositoryOwnerURIExtension,
+  X509SourceRepositoryOwnerIdentifierExtension,
+  X509BuildConfigURIExtension,
+  X509BuildConfigDigestExtension,
+  X509BuildTriggerExtension,
+  X509RunInvocationURIExtension,
+  X509SourceRepositoryVisibilityExtension,
+  EXTENSION_OID_SCT,
+  EXTENSION_OID_FULCIO_ISSUER_V1,
+  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,
+  EXTENSION_OID_GITHUB_WORKFLOW_SHA,
+  EXTENSION_OID_GITHUB_WORKFLOW_NAME,
+  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,
+  EXTENSION_OID_GITHUB_WORKFLOW_REF,
+  EXTENSION_OID_OTHERNAME,
+  EXTENSION_OID_FULCIO_ISSUER_V2,
+  EXTENSION_OID_BUILD_SIGNER_URI,
+  EXTENSION_OID_BUILD_SIGNER_DIGEST,
+  EXTENSION_OID_RUNNER_ENVIRONMENT,
+  EXTENSION_OID_SOURCE_REPOSITORY_URI,
+  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,
+  EXTENSION_OID_SOURCE_REPOSITORY_REF,
+  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,
+  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,
+  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,
+  EXTENSION_OID_BUILD_CONFIG_URI,
+  EXTENSION_OID_BUILD_CONFIG_DIGEST,
+  EXTENSION_OID_BUILD_TRIGGER,
+  EXTENSION_OID_RUN_INVOCATION_URI,
+  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,
+  X509Certificate,
+  CertificateChainVerifier,
+  verifyRFC3161Timestamp,
+  verifyBundleTimestamp,
+  TrustedRootProvider,
+  VerificationError,
+  TimestampError,
+  CertificateError,
+  TLogError,
+  SignatureError,
+  PolicyError,
+  GITHUB_OIDC_ISSUER,
+  OIDCIssuer,
+  GitHubWorkflowTrigger,
+  GitHubWorkflowSHA,
+  GitHubWorkflowName,
+  GitHubWorkflowRepository,
+  GitHubWorkflowRef,
+  OIDCIssuerV2,
+  OIDCBuildSignerURI,
+  OIDCBuildSignerDigest,
+  OIDCRunnerEnvironment,
+  OIDCSourceRepositoryURI,
+  OIDCSourceRepositoryDigest,
+  OIDCSourceRepositoryRef,
+  OIDCSourceRepositoryIdentifier,
+  OIDCSourceRepositoryOwnerURI,
+  OIDCSourceRepositoryOwnerIdentifier,
+  OIDCBuildConfigURI,
+  OIDCBuildConfigDigest,
+  OIDCBuildTrigger,
+  OIDCRunInvocationURI,
+  OIDCSourceRepositoryVisibility,
+  AnyOf,
+  AllOf,
+  Identity,
+  SigstoreVerifier
+};