@credo-ts/core 0.6.1-pr-2091-20241119140918 → 0.6.1

package/build/modules/x509/X509Certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Certificate.mjs","names":["extensions: Array<x509.Extension | undefined>","certificate","certificateInstance","publicCryptoKey: CredoWebCryptoKey | undefined"],"sources":["../../../src/modules/x509/X509Certificate.ts"],"sourcesContent":["import { AsnParser } from '@peculiar/asn1-schema'\nimport {\n  id_ce_authorityKeyIdentifier,\n  id_ce_extKeyUsage,\n  id_ce_issuerAltName,\n  id_ce_keyUsage,\n  id_ce_subjectAltName,\n  id_ce_subjectKeyIdentifier,\n  SubjectPublicKeyInfo,\n} from '@peculiar/asn1-x509'\nimport * as x509 from '@peculiar/x509'\nimport type { AgentContext } from '../../agent'\nimport { CredoWebCrypto, CredoWebCryptoKey } from '../../crypto/webcrypto'\nimport { publicJwkToCryptoKeyAlgorithm, spkiToPublicJwk } from '../../crypto/webcrypto/utils'\nimport type { AnyUint8Array } from '../../types'\nimport { TypedArrayEncoder } from '../../utils'\nimport { asymmetricPublicJwkMatches, PublicJwk } from '../kms'\nimport {\n  convertName,\n  createAuthorityKeyIdentifierExtension,\n  createBasicConstraintsExtension,\n  createCrlDistributionPointsExtension,\n  createExtendedKeyUsagesExtension,\n  createIssuerAlternativeNameExtension,\n  createKeyUsagesExtension,\n  createSubjectAlternativeNameExtension,\n  createSubjectKeyIdentifierExtension,\n} from './utils'\nimport { X509Error } from './X509Error'\nimport type { X509CreateCertificateOptions } from './X509ServiceOptions'\n\nexport enum X509KeyUsage {\n  DigitalSignature = 1,\n  NonRepudiation = 2,\n  KeyEncipherment = 4,\n  DataEncipherment = 8,\n  KeyAgreement = 16,\n  KeyCertSign = 32,\n  CrlSign = 64,\n  EncipherOnly = 128,\n  DecipherOnly = 256,\n}\n\nexport enum X509ExtendedKeyUsage {\n  ServerAuth = '1.3.6.1.5.5.7.3.1',\n  ClientAuth = '1.3.6.1.5.5.7.3.2',\n  CodeSigning = '1.3.6.1.5.5.7.3.3',\n  EmailProtection = '1.3.6.1.5.5.7.3.4',\n  TimeStamping = '1.3.6.1.5.5.7.3.8',\n  OcspSigning = '1.3.6.1.5.5.7.3.9',\n  MdlDs = '1.0.18013.5.1.2',\n}\n\nexport type X509CertificateOptions = {\n  publicJwk: PublicJwk\n  privateKey?: AnyUint8Array\n  x509Certificate: x509.X509Certificate\n}\n\nexport class X509Certificate {\n  public publicJwk: PublicJwk\n  public privateKey?: AnyUint8Array\n  private x509Certificate: x509.X509Certificate\n\n  private constructor(options: X509CertificateOptions) {\n    this.publicJwk = options.publicJwk\n    this.privateKey = options.privateKey\n    this.x509Certificate = options.x509Certificate\n  }\n\n  public set keyId(keyId: string) {\n    this.publicJwk.keyId = keyId\n  }\n\n  public get keyId(): string {\n    return this.publicJwk.keyId\n  }\n\n  public get hasKeyId(): boolean {\n    return this.publicJwk.hasKeyId\n  }\n\n  public static fromRawCertificate(rawCertificate: AnyUint8Array): X509Certificate {\n    const certificate = new x509.X509Certificate(rawCertificate)\n    return X509Certificate.parseCertificate(certificate)\n  }\n\n  public static fromEncodedCertificate(encodedCertificate: string): X509Certificate {\n    const certificate = new x509.X509Certificate(encodedCertificate)\n    return X509Certificate.parseCertificate(certificate)\n  }\n\n  private static parseCertificate(certificate: x509.X509Certificate): X509Certificate {\n    const spki = AsnParser.parse(certificate.publicKey.rawData, SubjectPublicKeyInfo)\n    const privateKey = certificate.privateKey ? new Uint8Array(certificate.privateKey.rawData) : undefined\n\n    const publicJwk = spkiToPublicJwk(spki)\n\n    return new X509Certificate({\n      publicJwk,\n      privateKey,\n      x509Certificate: certificate,\n    })\n  }\n\n  private getMatchingExtensions<T = { critical: boolean }>(objectIdentifier: string): Array<T> | undefined {\n    return this.x509Certificate.extensions.filter((e) => e.type === objectIdentifier) as Array<T> | undefined\n  }\n\n  public get rawCertificate() {\n    return new Uint8Array(this.x509Certificate.rawData)\n  }\n\n  public get subjectAlternativeNames() {\n    const san = this.getMatchingExtensions<x509.SubjectAlternativeNameExtension>(id_ce_subjectAltName)\n    return san?.flatMap((s) => s.names.items).map((i) => ({ type: i.type, value: i.value })) ?? []\n  }\n\n  public get issuerAlternativeNames() {\n    const ian = this.getMatchingExtensions<x509.IssuerAlternativeNameExtension>(id_ce_issuerAltName)\n    return ian?.flatMap((i) => i.names.items).map((i) => ({ type: i.type, value: i.value })) ?? []\n  }\n\n  public get sanDnsNames() {\n    return this.subjectAlternativeNames.filter((san) => san.type === 'dns').map((san) => san.value)\n  }\n\n  public get sanUriNames() {\n    return this.subjectAlternativeNames.filter((ian) => ian.type === 'url').map((ian) => ian.value)\n  }\n\n  public get ianDnsNames() {\n    return this.issuerAlternativeNames.filter((san) => san.type === 'dns').map((san) => san.value)\n  }\n\n  public get ianUriNames() {\n    return this.issuerAlternativeNames.filter((ian) => ian.type === 'url').map((ian) => ian.value)\n  }\n\n  public get authorityKeyIdentifier() {\n    const keyIds = this.getMatchingExtensions<x509.AuthorityKeyIdentifierExtension>(id_ce_authorityKeyIdentifier)?.map(\n      (e) => e.keyId\n    )\n\n    if (keyIds && keyIds.length > 1) {\n      throw new X509Error('Multiple Authority Key Identifiers are not allowed')\n    }\n\n    return keyIds?.[0]\n  }\n\n  public get subjectKeyIdentifier() {\n    const keyIds = this.getMatchingExtensions<x509.SubjectKeyIdentifierExtension>(id_ce_subjectKeyIdentifier)?.map(\n      (e) => e.keyId\n    )\n\n    if (keyIds && keyIds.length > 1) {\n      throw new X509Error('Multiple Subject Key Identifiers are not allowed')\n    }\n\n    return keyIds?.[0]\n  }\n\n  // biome-ignore lint/suspicious/useGetterReturn: no explanation\n  public get keyUsage() {\n    const keyUsages = this.getMatchingExtensions<x509.KeyUsagesExtension>(id_ce_keyUsage)?.map((e) => e.usages)\n\n    if (keyUsages && keyUsages.length > 1) {\n      throw new X509Error('Multiple Key Usages are not allowed')\n    }\n\n    if (keyUsages) {\n      return Object.values(X509KeyUsage)\n        .filter((key): key is number => typeof key === 'number')\n        .filter((flagValue) => (keyUsages[0] & flagValue) === flagValue)\n        .map((flagValue) => flagValue as X509KeyUsage)\n    }\n  }\n\n  public get extendedKeyUsage() {\n    const extendedKeyUsages = this.getMatchingExtensions<x509.ExtendedKeyUsageExtension>(id_ce_extKeyUsage)?.map(\n      (e) => e.usages\n    )\n\n    if (extendedKeyUsages && extendedKeyUsages.length > 1) {\n      throw new X509Error('Multiple Key Usages are not allowed')\n    }\n\n    return extendedKeyUsages?.[0] as X509ExtendedKeyUsage | undefined\n  }\n\n  public isExtensionCritical(id: string): boolean {\n    const extension = this.getMatchingExtensions(id)\n    if (!extension) {\n      throw new X509Error(`extension with id '${id}' is not found`)\n    }\n\n    return !!extension[0].critical\n  }\n\n  public static async create(options: X509CreateCertificateOptions, webCrypto: CredoWebCrypto) {\n    const subjectPublicKey = options.subjectPublicKey ?? options.authorityKey\n    const isSelfSignedCertificate = asymmetricPublicJwkMatches(options.authorityKey.toJson(), subjectPublicKey.toJson())\n\n    const signingKey = new CredoWebCryptoKey(\n      options.authorityKey,\n      publicJwkToCryptoKeyAlgorithm(options.authorityKey),\n      false,\n      'private',\n      ['sign']\n    )\n    const publicKey = new CredoWebCryptoKey(\n      subjectPublicKey,\n      publicJwkToCryptoKeyAlgorithm(options.authorityKey),\n      true,\n      'public',\n      ['verify']\n    )\n\n    const issuerName = convertName(options.issuer)\n\n    const extensions: Array<x509.Extension | undefined> = []\n    extensions.push(\n      createSubjectKeyIdentifierExtension(options.extensions?.subjectKeyIdentifier, { publicJwk: subjectPublicKey })\n    )\n    extensions.push(createKeyUsagesExtension(options.extensions?.keyUsage))\n    extensions.push(createExtendedKeyUsagesExtension(options.extensions?.extendedKeyUsage))\n    extensions.push(\n      createAuthorityKeyIdentifierExtension(options.extensions?.authorityKeyIdentifier, {\n        publicJwk: options.authorityKey,\n      })\n    )\n    extensions.push(createIssuerAlternativeNameExtension(options.extensions?.issuerAlternativeName))\n    extensions.push(createSubjectAlternativeNameExtension(options.extensions?.subjectAlternativeName))\n    extensions.push(createBasicConstraintsExtension(options.extensions?.basicConstraints))\n    extensions.push(createCrlDistributionPointsExtension(options.extensions?.crlDistributionPoints))\n\n    if (isSelfSignedCertificate) {\n      if (options.subject) {\n        throw new X509Error('Do not provide a subject name when the certificate is supposed to be self signed')\n      }\n\n      const certificate = await x509.X509CertificateGenerator.createSelfSigned(\n        {\n          keys: { publicKey, privateKey: signingKey },\n          name: issuerName,\n          notBefore: options.validity?.notBefore,\n          notAfter: options.validity?.notAfter,\n          extensions: extensions.filter((e) => e !== undefined),\n          serialNumber: options.serialNumber,\n        },\n        webCrypto\n      )\n\n      const certificateInstance = X509Certificate.parseCertificate(certificate)\n      if (subjectPublicKey.hasKeyId) certificateInstance.publicJwk.keyId = subjectPublicKey.keyId\n      return certificateInstance\n    }\n\n    if (!options.subject) {\n      throw new X509Error('Provide a subject name when the certificate is not supposed to be self signed')\n    }\n\n    const subjectName = convertName(options.subject)\n\n    const certificate = await x509.X509CertificateGenerator.create(\n      {\n        signingKey,\n        publicKey,\n        issuer: issuerName,\n        subject: subjectName,\n        notBefore: options.validity?.notBefore,\n        notAfter: options.validity?.notAfter,\n        extensions: extensions.filter((e) => e !== undefined),\n      },\n      webCrypto\n    )\n\n    const certificateInstance = X509Certificate.parseCertificate(certificate)\n    if (subjectPublicKey.hasKeyId) certificateInstance.publicJwk.keyId = subjectPublicKey.keyId\n    return certificateInstance\n  }\n\n  public get subject() {\n    return this.x509Certificate.subject\n  }\n\n  public get issuer() {\n    return this.x509Certificate.issuer\n  }\n\n  public async verify(\n    {\n      verificationDate = new Date(),\n      publicJwk,\n      skipSignatureVerification = false,\n    }: {\n      verificationDate: Date\n      publicJwk?: PublicJwk\n\n      /**\n       * Whether to skip the verification of the signature and only perform other checks (such\n       * as whether the certificate is not expired).\n       *\n       * This can be useful when an non-self-signed certificate is directly trusted, and it may\n       * not be possible to verify the certifcate as the root/intermediate certificate containing\n       * the key of the signer/intermediate is not present.\n       *\n       * @default false\n       */\n      skipSignatureVerification?: boolean\n    },\n    webCrypto: CredoWebCrypto\n  ) {\n    let publicCryptoKey: CredoWebCryptoKey | undefined\n    if (publicJwk) {\n      const cryptoKeyAlgorithm = publicJwkToCryptoKeyAlgorithm(publicJwk)\n      publicCryptoKey = new CredoWebCryptoKey(publicJwk, cryptoKeyAlgorithm, true, 'public', ['verify'])\n    }\n\n    // We use the library to validate the signature, but the date is manually verified\n    const isSignatureValid = skipSignatureVerification\n      ? true\n      : await this.x509Certificate.verify({ signatureOnly: true, publicKey: publicCryptoKey }, webCrypto)\n    const time = verificationDate.getTime()\n\n    const isNotBeforeValid = this.x509Certificate.notBefore.getTime() <= time\n    const isNotAfterValid = time <= this.x509Certificate.notAfter.getTime()\n\n    if (!isSignatureValid) {\n      throw new X509Error(`Certificate: '${this.x509Certificate.subject}' has an invalid signature`)\n    }\n\n    if (!isNotBeforeValid) {\n      throw new X509Error(`Certificate: '${this.x509Certificate.subject}' used before it is allowed`)\n    }\n\n    if (!isNotAfterValid) {\n      throw new X509Error(`Certificate: '${this.x509Certificate.subject}' used after it is allowed`)\n    }\n  }\n\n  /**\n   * Get the thumprint of the X509 certificate in hex format.\n   */\n  public async getThumprintInHex(agentContext: AgentContext) {\n    const thumbprint = await this.x509Certificate.getThumbprint(new CredoWebCrypto(agentContext))\n    const thumbprintHex = TypedArrayEncoder.toHex(new Uint8Array(thumbprint))\n\n    return thumbprintHex\n  }\n\n  /**\n   * Get the data elements of the x509 certificate\n   */\n  public get data() {\n    return {\n      issuerName: this.x509Certificate.issuerName.toString(),\n      issuer: this.x509Certificate.issuer,\n      subjectName: this.x509Certificate.subjectName.toString(),\n      subject: this.x509Certificate.subject,\n      serialNumber: this.x509Certificate.serialNumber,\n      pem: this.x509Certificate.toString(),\n      notBefore: this.x509Certificate.notBefore,\n      notAfter: this.x509Certificate.notAfter,\n    }\n  }\n\n  public getIssuerNameField(field: string) {\n    return this.x509Certificate.issuerName.getField(field)\n  }\n\n  /**\n   * @param format the format to export to, defaults to `pem`\n   */\n  public toString(format?: 'asn' | 'pem' | 'hex' | 'base64' | 'text' | 'base64url') {\n    return this.x509Certificate.toString(format ?? 'pem')\n  }\n\n  public equal(certificate: X509Certificate) {\n    const parsedOther = new x509.X509Certificate(certificate.rawCertificate)\n\n    return this.x509Certificate.equal(parsedOther)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA+BA,IAAY,wDAAL;AACL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AAGF,IAAY,wEAAL;AACL;AACA;AACA;AACA;AACA;AACA;AACA;;;AASF,IAAa,kBAAb,MAAa,gBAAgB;CAK3B,AAAQ,YAAY,SAAiC;AACnD,OAAK,YAAY,QAAQ;AACzB,OAAK,aAAa,QAAQ;AAC1B,OAAK,kBAAkB,QAAQ;;CAGjC,IAAW,MAAM,OAAe;AAC9B,OAAK,UAAU,QAAQ;;CAGzB,IAAW,QAAgB;AACzB,SAAO,KAAK,UAAU;;CAGxB,IAAW,WAAoB;AAC7B,SAAO,KAAK,UAAU;;CAGxB,OAAc,mBAAmB,gBAAgD;EAC/E,MAAM,cAAc,IAAI,KAAK,gBAAgB,eAAe;AAC5D,SAAO,gBAAgB,iBAAiB,YAAY;;CAGtD,OAAc,uBAAuB,oBAA6C;EAChF,MAAM,cAAc,IAAI,KAAK,gBAAgB,mBAAmB;AAChE,SAAO,gBAAgB,iBAAiB,YAAY;;CAGtD,OAAe,iBAAiB,aAAoD;EAClF,MAAM,OAAO,UAAU,MAAM,YAAY,UAAU,SAAS,qBAAqB;EACjF,MAAM,aAAa,YAAY,aAAa,IAAI,WAAW,YAAY,WAAW,QAAQ,GAAG;AAI7F,SAAO,IAAI,gBAAgB;GACzB,WAHgB,gBAAgB,KAAK;GAIrC;GACA,iBAAiB;GAClB,CAAC;;CAGJ,AAAQ,sBAAiD,kBAAgD;AACvG,SAAO,KAAK,gBAAgB,WAAW,QAAQ,MAAM,EAAE,SAAS,iBAAiB;;CAGnF,IAAW,iBAAiB;AAC1B,SAAO,IAAI,WAAW,KAAK,gBAAgB,QAAQ;;CAGrD,IAAW,0BAA0B;AAEnC,SADY,KAAK,sBAA4D,qBAAqB,EACtF,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC,KAAK,OAAO;GAAE,MAAM,EAAE;GAAM,OAAO,EAAE;GAAO,EAAE,IAAI,EAAE;;CAGhG,IAAW,yBAAyB;AAElC,SADY,KAAK,sBAA2D,oBAAoB,EACpF,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC,KAAK,OAAO;GAAE,MAAM,EAAE;GAAM,OAAO,EAAE;GAAO,EAAE,IAAI,EAAE;;CAGhG,IAAW,cAAc;AACvB,SAAO,KAAK,wBAAwB,QAAQ,QAAQ,IAAI,SAAS,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM;;CAGjG,IAAW,cAAc;AACvB,SAAO,KAAK,wBAAwB,QAAQ,QAAQ,IAAI,SAAS,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM;;CAGjG,IAAW,cAAc;AACvB,SAAO,KAAK,uBAAuB,QAAQ,QAAQ,IAAI,SAAS,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM;;CAGhG,IAAW,cAAc;AACvB,SAAO,KAAK,uBAAuB,QAAQ,QAAQ,IAAI,SAAS,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM;;CAGhG,IAAW,yBAAyB;EAClC,MAAM,SAAS,KAAK,sBAA4D,6BAA6B,EAAE,KAC5G,MAAM,EAAE,MACV;AAED,MAAI,UAAU,OAAO,SAAS,EAC5B,OAAM,IAAI,UAAU,qDAAqD;AAG3E,SAAO,SAAS;;CAGlB,IAAW,uBAAuB;EAChC,MAAM,SAAS,KAAK,sBAA0D,2BAA2B,EAAE,KACxG,MAAM,EAAE,MACV;AAED,MAAI,UAAU,OAAO,SAAS,EAC5B,OAAM,IAAI,UAAU,mDAAmD;AAGzE,SAAO,SAAS;;CAIlB,IAAW,WAAW;EACpB,MAAM,YAAY,KAAK,sBAA+C,eAAe,EAAE,KAAK,MAAM,EAAE,OAAO;AAE3G,MAAI,aAAa,UAAU,SAAS,EAClC,OAAM,IAAI,UAAU,sCAAsC;AAG5D,MAAI,UACF,QAAO,OAAO,OAAO,aAAa,CAC/B,QAAQ,QAAuB,OAAO,QAAQ,SAAS,CACvD,QAAQ,eAAe,UAAU,KAAK,eAAe,UAAU,CAC/D,KAAK,cAAc,UAA0B;;CAIpD,IAAW,mBAAmB;EAC5B,MAAM,oBAAoB,KAAK,sBAAsD,kBAAkB,EAAE,KACtG,MAAM,EAAE,OACV;AAED,MAAI,qBAAqB,kBAAkB,SAAS,EAClD,OAAM,IAAI,UAAU,sCAAsC;AAG5D,SAAO,oBAAoB;;CAG7B,AAAO,oBAAoB,IAAqB;EAC9C,MAAM,YAAY,KAAK,sBAAsB,GAAG;AAChD,MAAI,CAAC,UACH,OAAM,IAAI,UAAU,sBAAsB,GAAG,gBAAgB;AAG/D,SAAO,CAAC,CAAC,UAAU,GAAG;;CAGxB,aAAoB,OAAO,SAAuC,WAA2B;EAC3F,MAAM,mBAAmB,QAAQ,oBAAoB,QAAQ;EAC7D,MAAM,0BAA0B,2BAA2B,QAAQ,aAAa,QAAQ,EAAE,iBAAiB,QAAQ,CAAC;EAEpH,MAAM,aAAa,IAAI,kBACrB,QAAQ,cACR,8BAA8B,QAAQ,aAAa,EACnD,OACA,WACA,CAAC,OAAO,CACT;EACD,MAAM,YAAY,IAAI,kBACpB,kBACA,8BAA8B,QAAQ,aAAa,EACnD,MACA,UACA,CAAC,SAAS,CACX;EAED,MAAM,aAAa,YAAY,QAAQ,OAAO;EAE9C,MAAMA,aAAgD,EAAE;AACxD,aAAW,KACT,oCAAoC,QAAQ,YAAY,sBAAsB,EAAE,WAAW,kBAAkB,CAAC,CAC/G;AACD,aAAW,KAAK,yBAAyB,QAAQ,YAAY,SAAS,CAAC;AACvE,aAAW,KAAK,iCAAiC,QAAQ,YAAY,iBAAiB,CAAC;AACvF,aAAW,KACT,sCAAsC,QAAQ,YAAY,wBAAwB,EAChF,WAAW,QAAQ,cACpB,CAAC,CACH;AACD,aAAW,KAAK,qCAAqC,QAAQ,YAAY,sBAAsB,CAAC;AAChG,aAAW,KAAK,sCAAsC,QAAQ,YAAY,uBAAuB,CAAC;AAClG,aAAW,KAAK,gCAAgC,QAAQ,YAAY,iBAAiB,CAAC;AACtF,aAAW,KAAK,qCAAqC,QAAQ,YAAY,sBAAsB,CAAC;AAEhG,MAAI,yBAAyB;AAC3B,OAAI,QAAQ,QACV,OAAM,IAAI,UAAU,mFAAmF;GAGzG,MAAMC,gBAAc,MAAM,KAAK,yBAAyB,iBACtD;IACE,MAAM;KAAE;KAAW,YAAY;KAAY;IAC3C,MAAM;IACN,WAAW,QAAQ,UAAU;IAC7B,UAAU,QAAQ,UAAU;IAC5B,YAAY,WAAW,QAAQ,MAAM,MAAM,OAAU;IACrD,cAAc,QAAQ;IACvB,EACD,UACD;GAED,MAAMC,wBAAsB,gBAAgB,iBAAiBD,cAAY;AACzE,OAAI,iBAAiB,SAAU,uBAAoB,UAAU,QAAQ,iBAAiB;AACtF,UAAOC;;AAGT,MAAI,CAAC,QAAQ,QACX,OAAM,IAAI,UAAU,gFAAgF;EAGtG,MAAM,cAAc,YAAY,QAAQ,QAAQ;EAEhD,MAAM,cAAc,MAAM,KAAK,yBAAyB,OACtD;GACE;GACA;GACA,QAAQ;GACR,SAAS;GACT,WAAW,QAAQ,UAAU;GAC7B,UAAU,QAAQ,UAAU;GAC5B,YAAY,WAAW,QAAQ,MAAM,MAAM,OAAU;GACtD,EACD,UACD;EAED,MAAM,sBAAsB,gBAAgB,iBAAiB,YAAY;AACzE,MAAI,iBAAiB,SAAU,qBAAoB,UAAU,QAAQ,iBAAiB;AACtF,SAAO;;CAGT,IAAW,UAAU;AACnB,SAAO,KAAK,gBAAgB;;CAG9B,IAAW,SAAS;AAClB,SAAO,KAAK,gBAAgB;;CAG9B,MAAa,OACX,EACE,mCAAmB,IAAI,MAAM,EAC7B,WACA,4BAA4B,SAiB9B,WACA;EACA,IAAIC;AACJ,MAAI,UAEF,mBAAkB,IAAI,kBAAkB,WADb,8BAA8B,UAAU,EACI,MAAM,UAAU,CAAC,SAAS,CAAC;EAIpG,MAAM,mBAAmB,4BACrB,OACA,MAAM,KAAK,gBAAgB,OAAO;GAAE,eAAe;GAAM,WAAW;GAAiB,EAAE,UAAU;EACrG,MAAM,OAAO,iBAAiB,SAAS;EAEvC,MAAM,mBAAmB,KAAK,gBAAgB,UAAU,SAAS,IAAI;EACrE,MAAM,kBAAkB,QAAQ,KAAK,gBAAgB,SAAS,SAAS;AAEvE,MAAI,CAAC,iBACH,OAAM,IAAI,UAAU,iBAAiB,KAAK,gBAAgB,QAAQ,4BAA4B;AAGhG,MAAI,CAAC,iBACH,OAAM,IAAI,UAAU,iBAAiB,KAAK,gBAAgB,QAAQ,6BAA6B;AAGjG,MAAI,CAAC,gBACH,OAAM,IAAI,UAAU,iBAAiB,KAAK,gBAAgB,QAAQ,4BAA4B;;;;;CAOlG,MAAa,kBAAkB,cAA4B;EACzD,MAAM,aAAa,MAAM,KAAK,gBAAgB,cAAc,IAAI,eAAe,aAAa,CAAC;AAG7F,SAFsB,kBAAkB,MAAM,IAAI,WAAW,WAAW,CAAC;;;;;CAQ3E,IAAW,OAAO;AAChB,SAAO;GACL,YAAY,KAAK,gBAAgB,WAAW,UAAU;GACtD,QAAQ,KAAK,gBAAgB;GAC7B,aAAa,KAAK,gBAAgB,YAAY,UAAU;GACxD,SAAS,KAAK,gBAAgB;GAC9B,cAAc,KAAK,gBAAgB;GACnC,KAAK,KAAK,gBAAgB,UAAU;GACpC,WAAW,KAAK,gBAAgB;GAChC,UAAU,KAAK,gBAAgB;GAChC;;CAGH,AAAO,mBAAmB,OAAe;AACvC,SAAO,KAAK,gBAAgB,WAAW,SAAS,MAAM;;;;;CAMxD,AAAO,SAAS,QAAkE;AAChF,SAAO,KAAK,gBAAgB,SAAS,UAAU,MAAM;;CAGvD,AAAO,MAAM,aAA8B;EACzC,MAAM,cAAc,IAAI,KAAK,gBAAgB,YAAY,eAAe;AAExE,SAAO,KAAK,gBAAgB,MAAM,YAAY"}

package/build/modules/x509/X509Error.d.mts

@@ -0,0 +1,8 @@
+import { CredoError } from "../../error/CredoError.mjs";
+import "../../error/index.mjs";
+
+//#region src/modules/x509/X509Error.d.ts
+declare class X509Error extends CredoError {}
+//#endregion
+export { X509Error };
+//# sourceMappingURL=X509Error.d.mts.map

package/build/modules/x509/X509Error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Error.d.mts","names":[],"sources":["../../../src/modules/x509/X509Error.ts"],"sourcesContent":[],"mappings":";;;;cAEa,SAAA,SAAkB,UAAA"}

package/build/modules/x509/X509Error.mjs

@@ -0,0 +1,11 @@
+
+
+import { CredoError } from "../../error/CredoError.mjs";
+import "../../error/index.mjs";
+
+//#region src/modules/x509/X509Error.ts
+var X509Error = class extends CredoError {};
+
+//#endregion
+export { X509Error };
+//# sourceMappingURL=X509Error.mjs.map

package/build/modules/x509/X509Error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Error.mjs","names":[],"sources":["../../../src/modules/x509/X509Error.ts"],"sourcesContent":["import { CredoError } from '../../error'\n\nexport class X509Error extends CredoError {}\n"],"mappings":";;;;;;AAEA,IAAa,YAAb,cAA+B,WAAW"}

package/build/modules/x509/X509Module.d.mts

@@ -0,0 +1,22 @@
+import { X509ModuleConfig, X509ModuleConfigOptions } from "./X509ModuleConfig.mjs";
+import { X509Api } from "./X509Api.mjs";
+import { DependencyManager } from "../../plugins/DependencyManager.mjs";
+import { Module } from "../../plugins/Module.mjs";
+import "../../plugins/index.mjs";
+
+//#region src/modules/x509/X509Module.d.ts
+/**
+ * @public
+ */
+declare class X509Module implements Module {
+  readonly api: typeof X509Api;
+  readonly config: X509ModuleConfig;
+  constructor(options?: X509ModuleConfigOptions);
+  /**
+   * Registers the dependencies of the sd-jwt-vc module on the dependency manager.
+   */
+  register(dependencyManager: DependencyManager): void;
+}
+//#endregion
+export { X509Module };
+//# sourceMappingURL=X509Module.d.mts.map

package/build/modules/x509/X509Module.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Module.d.mts","names":[],"sources":["../../../src/modules/x509/X509Module.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;cASa,UAAA,YAAsB;uBACd;EADR,SAAA,MAAW,EAGE,gBAHF;EACH,WAAA,CAAA,OAAA,CAAA,EAIU,uBAJV;EAEK;;;EAHS,QAAA,CAAA,iBAAA,EAYE,iBAZF,CAAA,EAAA,IAAA"}

package/build/modules/x509/X509Module.mjs

@@ -0,0 +1,27 @@
+
+
+import { X509ModuleConfig } from "./X509ModuleConfig.mjs";
+import { X509Service } from "./X509Service.mjs";
+import { X509Api } from "./X509Api.mjs";
+
+//#region src/modules/x509/X509Module.ts
+/**
+* @public
+*/
+var X509Module = class {
+	constructor(options) {
+		this.api = X509Api;
+		this.config = new X509ModuleConfig(options);
+	}
+	/**
+	* Registers the dependencies of the sd-jwt-vc module on the dependency manager.
+	*/
+	register(dependencyManager) {
+		dependencyManager.registerInstance(X509ModuleConfig, this.config);
+		dependencyManager.registerSingleton(X509Service);
+	}
+};
+
+//#endregion
+export { X509Module };
+//# sourceMappingURL=X509Module.mjs.map

package/build/modules/x509/X509Module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Module.mjs","names":[],"sources":["../../../src/modules/x509/X509Module.ts"],"sourcesContent":["import type { DependencyManager, Module } from '../../plugins'\nimport { X509Api } from './X509Api'\nimport type { X509ModuleConfigOptions } from './X509ModuleConfig'\nimport { X509ModuleConfig } from './X509ModuleConfig'\nimport { X509Service } from './X509Service'\n\n/**\n * @public\n */\nexport class X509Module implements Module {\n  public readonly api = X509Api\n\n  public readonly config: X509ModuleConfig\n\n  public constructor(options?: X509ModuleConfigOptions) {\n    this.config = new X509ModuleConfig(options)\n  }\n\n  /**\n   * Registers the dependencies of the sd-jwt-vc module on the dependency manager.\n   */\n  public register(dependencyManager: DependencyManager) {\n    // Register config\n    dependencyManager.registerInstance(X509ModuleConfig, this.config)\n\n    // Services\n    dependencyManager.registerSingleton(X509Service)\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,aAAb,MAA0C;CAKxC,AAAO,YAAY,SAAmC;OAJtC,MAAM;AAKpB,OAAK,SAAS,IAAI,iBAAiB,QAAQ;;;;;CAM7C,AAAO,SAAS,mBAAsC;AAEpD,oBAAkB,iBAAiB,kBAAkB,KAAK,OAAO;AAGjE,oBAAkB,kBAAkB,YAAY"}

package/build/modules/x509/X509ModuleConfig.d.mts

@@ -0,0 +1,104 @@
+import { X509Certificate } from "./X509Certificate.mjs";
+import { SdJwtVc } from "../sd-jwt-vc/SdJwtVcService.mjs";
+import "../sd-jwt-vc/index.mjs";
+import { JwtPayload } from "../../crypto/jose/jwt/JwtPayload.mjs";
+import { W3cJwtVerifiableCredential } from "../vc/jwt-vc/W3cJwtVerifiableCredential.mjs";
+import { W3cJwtVerifiablePresentation } from "../vc/jwt-vc/W3cJwtVerifiablePresentation.mjs";
+import "../vc/index.mjs";
+import { Mdoc } from "../mdoc/Mdoc.mjs";
+import "../../crypto/index.mjs";
+import { AgentContext } from "../../agent/context/AgentContext.mjs";
+import "../../agent/index.mjs";
+
+//#region src/modules/x509/X509ModuleConfig.d.ts
+type X509VerificationTypeCredential = {
+  type: 'credential';
+  credential: SdJwtVc | Mdoc | W3cJwtVerifiableCredential | W3cJwtVerifiablePresentation;
+  /**
+   * The `id` of the `DidCommProofRecord` that this verification is bound to.
+   */
+  didcommProofRecordId?: string;
+  /**
+   * The `id` of the `OpenId4VcVerificationSessionRecord` that this verification is bound to.
+   */
+  openId4VcVerificationSessionId?: string;
+};
+type X509VerificationTypeOauth2SecuredAuthorizationRequest = {
+  type: 'oauth2SecuredAuthorizationRequest';
+  authorizationRequest: {
+    jwt: string;
+    payload: JwtPayload;
+  };
+};
+type X509VerificationTypeOpenId4VciKeyAttestation = {
+  type: 'openId4VciKeyAttestation';
+  /**
+   * The `id` of the `OpenId4VcIssuanceSessionRecord` that this key
+   * attestation verification is bound to.
+   */
+  openId4VcIssuanceSessionId: string;
+  keyAttestation: {
+    jwt: string;
+    payload: JwtPayload;
+  };
+};
+type X509VerificationTypeOpenId4VciCredentialIssuerMetadata = {
+  type: 'openId4VciCredentialIssuerMetadata';
+  credentialIssuerMetadata: {
+    jwt: string;
+    payload: JwtPayload;
+  };
+};
+type X509VerificationTypeOauth2ClientAttestation = {
+  type: 'oauth2ClientAttestation';
+  /**
+   * The `id` of the `OpenId4VcIssuanceSessionRecord` that this client
+   * attestation verification is bound to.
+   */
+  openId4VcIssuanceSessionId: string;
+  clientAttestation: {
+    jwt: string;
+    payload: JwtPayload;
+  };
+};
+interface X509VerificationContext {
+  /**
+   * The certificate chain provided with the data to be verified. The trusted certificates
+   * are determined before verification and thus it is not verified that the data was actually
+   * signed by the private key assocaited with the leaf certificate in the certificate chain, or
+   * whether the certificate chain is valid. However if the certificate
+   * does not match, or is not valid, verification will always fail at a later stage
+   */
+  certificateChain: X509Certificate[];
+  verification: X509VerificationTypeCredential | X509VerificationTypeOauth2SecuredAuthorizationRequest | X509VerificationTypeOauth2ClientAttestation | X509VerificationTypeOpenId4VciKeyAttestation | X509VerificationTypeOpenId4VciCredentialIssuerMetadata;
+}
+interface X509ModuleConfigOptions {
+  /**
+   *
+   * Array of trusted base64-encoded certificate strings in the DER-format.
+   */
+  trustedCertificates?: Array<string | X509Certificate>;
+  /**
+   * Optional callback method that will be called to dynamically get trusted certificates for a verification.
+   * It will provide the `agentContext` and `verificationContext` allowing to dynamically set the trusted certificates
+   * for a tenant or verificaiton context.
+   *
+   * If no certificaets should be trusted an empty array should be returned. If `undefined` is returned
+   * it will fallback to the globally registered trusted certificates
+   *
+   * @returns An array of base64-encoded certificate strings or PEM certificate strings.
+   */
+  getTrustedCertificatesForVerification?(agentContext: AgentContext, verificationContext: X509VerificationContext): Promise<string[] | undefined> | string[] | undefined;
+}
+declare class X509ModuleConfig {
+  #private;
+  constructor(options?: X509ModuleConfigOptions);
+  get trustedCertificates(): string[] | undefined;
+  get getTrustedCertificatesForVerification(): ((agentContext: AgentContext, verificationContext: X509VerificationContext) => Promise<string[] | undefined> | string[] | undefined) | undefined;
+  setTrustedCertificatesForVerification(fn: X509ModuleConfigOptions['getTrustedCertificatesForVerification']): void;
+  setTrustedCertificates(trustedCertificates?: Array<string | X509Certificate>): void;
+  addTrustedCertificate(trustedCertificate: string | X509Certificate): void;
+}
+//#endregion
+export { X509ModuleConfig, X509ModuleConfigOptions, X509VerificationContext, X509VerificationTypeCredential, X509VerificationTypeOauth2ClientAttestation, X509VerificationTypeOauth2SecuredAuthorizationRequest, X509VerificationTypeOpenId4VciCredentialIssuerMetadata, X509VerificationTypeOpenId4VciKeyAttestation };
+//# sourceMappingURL=X509ModuleConfig.d.mts.map

package/build/modules/x509/X509ModuleConfig.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509ModuleConfig.d.mts","names":[],"sources":["../../../src/modules/x509/X509ModuleConfig.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;KAQY,8BAAA;;cAEE,UAAU,OAAO,6BAA6B;;;;;;;AAF5D;EAEc,8BAAA,CAAA,EAAA,MAAA;CAAU;AAAO,KAgBnB,qDAAA,GAhBmB;EAA6B,IAAA,EAAA,mCAAA;EAA4B,oBAAA,EAAA;IAgB5E,GAAA,EAAA,MAAA;IAQA,OAAA,EAJC,UAID;EAiBA,CAAA;AAUZ,CAAA;AAiBiB,KA5CL,4CAAA,GA4C4B;EAQpB,IAAA,EAAA,0BAAA;EAGd;;;;EAIA,0BAAA,EAAA,MAAA;EAAsD,cAAA,EAAA;IAG3C,GAAA,EAAA,MAAA;IAKsB,OAAA,EAtD1B,UAsD0B;EAAf,CAAA;CAaN;AACO,KAhEb,sDAAA,GAgEa;EACpB,IAAA,EAAA,oCAAA;EAAO,wBAAA,EAAA;IAGC,GAAA,EAAA,MAAA;IAIkB,OAAA,EAlElB,UAkEkB;EATb,CAAA;CACO;AACpB,KAvDO,2CAAA,GAuDP;EAwB8C,IAAA,EAAA,yBAAA;EAIkB;;;;;;;aAtExD;;;UAII,uBAAA;;;;;;;;oBAQG;gBAGd,iCACA,wDACA,8CACA,+CACA;;UAGW,uBAAA;;;;;wBAKO,eAAe;;;;;;;;;;;uDAarB,mCACO,0BACpB;;cAGQ,gBAAA;;wBAIkB;;+DATb,mCACO,4BACpB;4CAwB8C;+CAIG,eAAe;qDAST"}

package/build/modules/x509/X509ModuleConfig.mjs

@@ -0,0 +1,40 @@
+
+
+import { _classPrivateFieldInitSpec } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/classPrivateFieldInitSpec.mjs";
+import { _classPrivateFieldSet2 } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/classPrivateFieldSet2.mjs";
+import { _classPrivateFieldGet2 } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/classPrivateFieldGet2.mjs";
+import { X509Certificate } from "./X509Certificate.mjs";
+
+//#region src/modules/x509/X509ModuleConfig.ts
+var _trustedCertificates = /* @__PURE__ */ new WeakMap();
+var _getTrustedCertificatesForVerification = /* @__PURE__ */ new WeakMap();
+var X509ModuleConfig = class {
+	constructor(options) {
+		_classPrivateFieldInitSpec(this, _trustedCertificates, void 0);
+		_classPrivateFieldInitSpec(this, _getTrustedCertificatesForVerification, void 0);
+		this.setTrustedCertificates(options?.trustedCertificates);
+		if (options?.getTrustedCertificatesForVerification) this.setTrustedCertificatesForVerification(options.getTrustedCertificatesForVerification);
+	}
+	get trustedCertificates() {
+		return _classPrivateFieldGet2(_trustedCertificates, this)?.map((cert) => cert.toString("pem"));
+	}
+	get getTrustedCertificatesForVerification() {
+		return _classPrivateFieldGet2(_getTrustedCertificatesForVerification, this);
+	}
+	setTrustedCertificatesForVerification(fn) {
+		_classPrivateFieldSet2(_getTrustedCertificatesForVerification, this, fn);
+	}
+	setTrustedCertificates(trustedCertificates) {
+		const certificateInstances = trustedCertificates?.map((trustedCertificate) => typeof trustedCertificate === "string" ? X509Certificate.fromEncodedCertificate(trustedCertificate) : trustedCertificate);
+		_classPrivateFieldSet2(_trustedCertificates, this, trustedCertificates?.length ? certificateInstances : void 0);
+	}
+	addTrustedCertificate(trustedCertificate) {
+		const certificateInstance = typeof trustedCertificate === "string" ? X509Certificate.fromEncodedCertificate(trustedCertificate) : trustedCertificate;
+		if (!_classPrivateFieldGet2(_trustedCertificates, this)) _classPrivateFieldSet2(_trustedCertificates, this, []);
+		_classPrivateFieldGet2(_trustedCertificates, this).push(certificateInstance);
+	}
+};
+
+//#endregion
+export { X509ModuleConfig };
+//# sourceMappingURL=X509ModuleConfig.mjs.map

package/build/modules/x509/X509ModuleConfig.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509ModuleConfig.mjs","names":[],"sources":["../../../src/modules/x509/X509ModuleConfig.ts"],"sourcesContent":["import type { AgentContext } from '../../agent'\nimport type { JwtPayload } from '../../crypto'\nimport type { Mdoc } from '../mdoc/Mdoc'\nimport type { SdJwtVc } from '../sd-jwt-vc'\nimport type { W3cJwtVerifiableCredential, W3cJwtVerifiablePresentation } from '../vc'\n\nimport { X509Certificate } from './X509Certificate'\n\nexport type X509VerificationTypeCredential = {\n  type: 'credential'\n  credential: SdJwtVc | Mdoc | W3cJwtVerifiableCredential | W3cJwtVerifiablePresentation\n\n  /**\n   * The `id` of the `DidCommProofRecord` that this verification is bound to.\n   */\n  didcommProofRecordId?: string\n\n  /**\n   * The `id` of the `OpenId4VcVerificationSessionRecord` that this verification is bound to.\n   */\n  openId4VcVerificationSessionId?: string\n}\n\n// NOTE: we should probably move these to the OpenID4VC module\n// but have to think about the typing. Probably the base interface should just contain\n// the `verification` with a `type`. And extension modules can extend the verification\nexport type X509VerificationTypeOauth2SecuredAuthorizationRequest = {\n  type: 'oauth2SecuredAuthorizationRequest'\n  authorizationRequest: {\n    jwt: string\n    payload: JwtPayload\n  }\n}\n\nexport type X509VerificationTypeOpenId4VciKeyAttestation = {\n  type: 'openId4VciKeyAttestation'\n\n  /**\n   * The `id` of the `OpenId4VcIssuanceSessionRecord` that this key\n   * attestation verification is bound to.\n   */\n  // TODO: should be the record, but we don't have access to the record type here.\n  openId4VcIssuanceSessionId: string\n\n  // NOTE: it would be more helpful to have the typed JWT payload from openid4vc here?\n  keyAttestation: {\n    jwt: string\n    payload: JwtPayload\n  }\n}\n\nexport type X509VerificationTypeOpenId4VciCredentialIssuerMetadata = {\n  type: 'openId4VciCredentialIssuerMetadata'\n\n  // NOTE: it would be more helpful to have the typed JWT payload from openid4vc here?\n  credentialIssuerMetadata: {\n    jwt: string\n    payload: JwtPayload\n  }\n}\n\nexport type X509VerificationTypeOauth2ClientAttestation = {\n  type: 'oauth2ClientAttestation'\n\n  /**\n   * The `id` of the `OpenId4VcIssuanceSessionRecord` that this client\n   * attestation verification is bound to.\n   */\n  // TODO: should be the record, but we don't have access to the record type here.\n  openId4VcIssuanceSessionId: string\n\n  // NOTE: it would be more helpful to have the typed JWT payload from openid4vc here?\n  clientAttestation: {\n    jwt: string\n    payload: JwtPayload\n  }\n}\n\nexport interface X509VerificationContext {\n  /**\n   * The certificate chain provided with the data to be verified. The trusted certificates\n   * are determined before verification and thus it is not verified that the data was actually\n   * signed by the private key assocaited with the leaf certificate in the certificate chain, or\n   * whether the certificate chain is valid. However if the certificate\n   * does not match, or is not valid, verification will always fail at a later stage\n   */\n  certificateChain: X509Certificate[]\n\n  verification:\n    | X509VerificationTypeCredential\n    | X509VerificationTypeOauth2SecuredAuthorizationRequest\n    | X509VerificationTypeOauth2ClientAttestation\n    | X509VerificationTypeOpenId4VciKeyAttestation\n    | X509VerificationTypeOpenId4VciCredentialIssuerMetadata\n}\n\nexport interface X509ModuleConfigOptions {\n  /**\n   *\n   * Array of trusted base64-encoded certificate strings in the DER-format.\n   */\n  trustedCertificates?: Array<string | X509Certificate>\n\n  /**\n   * Optional callback method that will be called to dynamically get trusted certificates for a verification.\n   * It will provide the `agentContext` and `verificationContext` allowing to dynamically set the trusted certificates\n   * for a tenant or verificaiton context.\n   *\n   * If no certificaets should be trusted an empty array should be returned. If `undefined` is returned\n   * it will fallback to the globally registered trusted certificates\n   *\n   * @returns An array of base64-encoded certificate strings or PEM certificate strings.\n   */\n  getTrustedCertificatesForVerification?(\n    agentContext: AgentContext,\n    verificationContext: X509VerificationContext\n  ): Promise<string[] | undefined> | string[] | undefined\n}\n\nexport class X509ModuleConfig {\n  #trustedCertificates?: X509Certificate[]\n  #getTrustedCertificatesForVerification?: X509ModuleConfigOptions['getTrustedCertificatesForVerification']\n\n  public constructor(options?: X509ModuleConfigOptions) {\n    this.setTrustedCertificates(options?.trustedCertificates)\n    if (options?.getTrustedCertificatesForVerification) {\n      this.setTrustedCertificatesForVerification(options.getTrustedCertificatesForVerification)\n    }\n  }\n\n  public get trustedCertificates() {\n    // TODO: we should probably update this API to return the instances, but don't want to\n    // break too much now\n    return this.#trustedCertificates?.map((cert) => cert.toString('pem'))\n  }\n\n  public get getTrustedCertificatesForVerification() {\n    return this.#getTrustedCertificatesForVerification\n  }\n\n  public setTrustedCertificatesForVerification(fn: X509ModuleConfigOptions['getTrustedCertificatesForVerification']) {\n    this.#getTrustedCertificatesForVerification = fn\n  }\n\n  public setTrustedCertificates(trustedCertificates?: Array<string | X509Certificate>) {\n    const certificateInstances = trustedCertificates?.map((trustedCertificate) =>\n      typeof trustedCertificate === 'string'\n        ? X509Certificate.fromEncodedCertificate(trustedCertificate)\n        : trustedCertificate\n    )\n    this.#trustedCertificates = trustedCertificates?.length ? certificateInstances : undefined\n  }\n\n  public addTrustedCertificate(trustedCertificate: string | X509Certificate) {\n    const certificateInstance =\n      typeof trustedCertificate === 'string'\n        ? X509Certificate.fromEncodedCertificate(trustedCertificate)\n        : trustedCertificate\n\n    if (!this.#trustedCertificates) {\n      this.#trustedCertificates = []\n    }\n\n    this.#trustedCertificates.push(certificateInstance)\n  }\n}\n"],"mappings":";;;;;;;;;;AAuHA,IAAa,mBAAb,MAA8B;CAI5B,AAAO,YAAY,SAAmC;;;AACpD,OAAK,uBAAuB,SAAS,oBAAoB;AACzD,MAAI,SAAS,sCACX,MAAK,sCAAsC,QAAQ,sCAAsC;;CAI7F,IAAW,sBAAsB;AAG/B,sDAAO,KAAyB,EAAE,KAAK,SAAS,KAAK,SAAS,MAAM,CAAC;;CAGvE,IAAW,wCAAwC;AACjD,wEAAO,KAA2C;;CAGpD,AAAO,sCAAsC,IAAsE;AACjH,uEAA8C,GAAE;;CAGlD,AAAO,uBAAuB,qBAAuD;EACnF,MAAM,uBAAuB,qBAAqB,KAAK,uBACrD,OAAO,uBAAuB,WAC1B,gBAAgB,uBAAuB,mBAAmB,GAC1D,mBACL;AACD,qDAA4B,qBAAqB,SAAS,uBAAuB,OAAS;;CAG5F,AAAO,sBAAsB,oBAA8C;EACzE,MAAM,sBACJ,OAAO,uBAAuB,WAC1B,gBAAgB,uBAAuB,mBAAmB,GAC1D;AAEN,MAAI,8CAAC,KAAyB,CAC5B,oDAA4B,EAAE;AAGhC,oDAAyB,CAAC,KAAK,oBAAoB"}

package/build/modules/x509/X509Service.d.mts

@@ -0,0 +1,47 @@
+import { X509CreateCertificateOptions, X509GetLeafCertificateOptions, X509ParseCertificateOptions, X509ValidateCertificateChainOptions } from "./X509ServiceOptions.mjs";
+import { X509Certificate } from "./X509Certificate.mjs";
+import { AgentContext } from "../../agent/context/AgentContext.mjs";
+import "../../agent/index.mjs";
+
+//#region src/modules/x509/X509Service.d.ts
+declare class X509Service {
+  /**
+   *
+   * Validate a chain of X.509 certificates according to RFC 5280
+   *
+   * This function requires a list of base64 encoded certificates and, optionally, a certificate that should be found in the chain.
+   * If no certificate is provided, it will just assume the leaf certificate
+   *
+   * The leaf certificate should be the 0th index and the root the last
+   *
+   * The Issuer of the certificate is found with the following algorithm:
+   * - Check if there is an AuthorityKeyIdentifierExtension
+   * - Go through all the other certificates and see if the SubjectKeyIdentifier is equal to thje AuthorityKeyIdentifier
+   * - If they are equal, the certificate is verified and returned as the issuer
+   *
+   * Additional validation:
+   *   - Make sure atleast a single certificate is in the chain
+   *   - Check whether a certificate in the chain matches with a trusted certificate
+   */
+  static validateCertificateChain(agentContext: AgentContext, {
+    certificateChain,
+    certificate,
+    verificationDate,
+    trustedCertificates
+  }: X509ValidateCertificateChainOptions): Promise<X509Certificate[]>;
+  /**
+   *
+   * Parses a base64-encoded X.509 certificate into a {@link X509Certificate}
+   *
+   */
+  static parseCertificate(_agentContext: AgentContext, {
+    encodedCertificate
+  }: X509ParseCertificateOptions): X509Certificate;
+  static getLeafCertificate(_agentContext: AgentContext, {
+    certificateChain
+  }: X509GetLeafCertificateOptions): X509Certificate;
+  static createCertificate(agentContext: AgentContext, options: X509CreateCertificateOptions): Promise<X509Certificate>;
+}
+//#endregion
+export { X509Service };
+//# sourceMappingURL=X509Service.d.mts.map

package/build/modules/x509/X509Service.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Service.d.mts","names":[],"sources":["../../../src/modules/x509/X509Service.ts"],"sourcesContent":[],"mappings":";;;;;;cAea,WAAA;;;;;AAFb;;;;;;;;;;;;;;EA4IM,OAAA,wBAAA,CAAA,YAAA,EAtHY,YAsHZ,EAAA;IAAA,gBAAA;IAAA,WAAA;IAAA,gBAAA;IAAA;EAAA,CAAA,EAhHC,mCAgHD,CAAA,EAhHoC,OAgHpC,CAhHoC,eAgHpC,EAAA,CAAA;EAAoB;;;;;EAS+E,OAAA,gBAAA,CAAA,aAAA,EAnBtF,YAmBsF,EAAA;IAAA;EAAA,CAAA,EAlB7E,2BAkB6E,CAAA,EAjBpG,eAiBoG;EAAA,OAAA,kBAAA,CAAA,aAAA,EAVtF,YAUsF,EAAA;IAAA;EAAA,CAAA,EAT/E,6BAS+E,CAAA,EARpG,eAQoG;yCAAnD,uBAAuB,+BAA4B,QAAA"}

package/build/modules/x509/X509Service.mjs

@@ -0,0 +1,89 @@
+
+
+import { __decorate } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import "../../agent/index.mjs";
+import { CredoWebCrypto } from "../../crypto/webcrypto/CredoWebCrypto.mjs";
+import "../../crypto/webcrypto/index.mjs";
+import { X509Error } from "./X509Error.mjs";
+import { X509Certificate } from "./X509Certificate.mjs";
+import { injectable } from "tsyringe";
+import * as x509 from "@peculiar/x509";
+
+//#region src/modules/x509/X509Service.ts
+let X509Service = class X509Service$1 {
+	/**
+	*
+	* Validate a chain of X.509 certificates according to RFC 5280
+	*
+	* This function requires a list of base64 encoded certificates and, optionally, a certificate that should be found in the chain.
+	* If no certificate is provided, it will just assume the leaf certificate
+	*
+	* The leaf certificate should be the 0th index and the root the last
+	*
+	* The Issuer of the certificate is found with the following algorithm:
+	* - Check if there is an AuthorityKeyIdentifierExtension
+	* - Go through all the other certificates and see if the SubjectKeyIdentifier is equal to thje AuthorityKeyIdentifier
+	* - If they are equal, the certificate is verified and returned as the issuer
+	*
+	* Additional validation:
+	*   - Make sure atleast a single certificate is in the chain
+	*   - Check whether a certificate in the chain matches with a trusted certificate
+	*/
+	static async validateCertificateChain(agentContext, { certificateChain, certificate = certificateChain[0], verificationDate = /* @__PURE__ */ new Date(), trustedCertificates }) {
+		if (certificateChain.length === 0) throw new X509Error("Certificate chain is empty");
+		const webCrypto = new CredoWebCrypto(agentContext);
+		let parsedLeafCertificate;
+		let certificatesToBuildChain;
+		try {
+			parsedLeafCertificate = new x509.X509Certificate(certificate);
+			certificatesToBuildChain = [...certificateChain, ...trustedCertificates ?? []].map((c) => new x509.X509Certificate(c));
+		} catch (error) {
+			throw new X509Error("Error during parsing of x509 certificate", { cause: error });
+		}
+		let parsedChain = (await new x509.X509ChainBuilder({ certificates: certificatesToBuildChain }).build(parsedLeafCertificate, webCrypto)).map((c) => X509Certificate.fromRawCertificate(new Uint8Array(c.rawData))).reverse();
+		if (parsedChain.length < certificateChain.length) throw new X509Error("Could not parse the full chain. Likely due to incorrect ordering");
+		let previousCertificate;
+		if (trustedCertificates) {
+			const parsedTrustedCertificates = trustedCertificates.map((trustedCertificate) => X509Certificate.fromEncodedCertificate(trustedCertificate));
+			const trustedCertificateIndex = parsedChain.findIndex((cert) => parsedTrustedCertificates.some((tCert) => cert.equal(tCert)));
+			if (trustedCertificateIndex === -1) throw new X509Error("No trusted certificate was found while validating the X.509 chain");
+			if (trustedCertificateIndex > 0) {
+				previousCertificate = parsedChain[trustedCertificateIndex - 1];
+				parsedChain = parsedChain.slice(trustedCertificateIndex);
+			}
+		}
+		for (let i = 0; i < parsedChain.length; i++) {
+			const cert = parsedChain[i];
+			const publicJwk = previousCertificate ? previousCertificate.publicJwk : void 0;
+			const skipSignatureVerification = i === 0 && trustedCertificates && !publicJwk;
+			await cert.verify({
+				publicJwk,
+				verificationDate,
+				skipSignatureVerification
+			}, webCrypto);
+			previousCertificate = cert;
+		}
+		return parsedChain;
+	}
+	/**
+	*
+	* Parses a base64-encoded X.509 certificate into a {@link X509Certificate}
+	*
+	*/
+	static parseCertificate(_agentContext, { encodedCertificate }) {
+		return X509Certificate.fromEncodedCertificate(encodedCertificate);
+	}
+	static getLeafCertificate(_agentContext, { certificateChain }) {
+		if (certificateChain.length === 0) throw new X509Error("Certificate chain is empty");
+		return X509Certificate.fromEncodedCertificate(certificateChain[0]);
+	}
+	static async createCertificate(agentContext, options) {
+		const webCrypto = new CredoWebCrypto(agentContext);
+		return await X509Certificate.create(options, webCrypto);
+	}
+};
+X509Service = __decorate([injectable()], X509Service);
+
+//#endregion
+export { X509Service };
+//# sourceMappingURL=X509Service.mjs.map

package/build/modules/x509/X509Service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509Service.mjs","names":["X509Service","parsedLeafCertificate: x509.X509Certificate","certificatesToBuildChain: x509.X509Certificate[]","previousCertificate: X509Certificate | undefined"],"sources":["../../../src/modules/x509/X509Service.ts"],"sourcesContent":["import * as x509 from '@peculiar/x509'\nimport { injectable } from 'tsyringe'\nimport { AgentContext } from '../../agent'\nimport { CredoWebCrypto } from '../../crypto/webcrypto'\nimport { X509Certificate } from './X509Certificate'\nimport { X509Error } from './X509Error'\nimport type {\n  X509CreateCertificateOptions,\n  X509GetLeafCertificateOptions,\n  X509ParseCertificateOptions,\n  X509ValidateCertificateChainOptions,\n} from './X509ServiceOptions'\n\n@injectable()\n// biome-ignore lint/complexity/noStaticOnlyClass: no explanation\nexport class X509Service {\n  /**\n   *\n   * Validate a chain of X.509 certificates according to RFC 5280\n   *\n   * This function requires a list of base64 encoded certificates and, optionally, a certificate that should be found in the chain.\n   * If no certificate is provided, it will just assume the leaf certificate\n   *\n   * The leaf certificate should be the 0th index and the root the last\n   *\n   * The Issuer of the certificate is found with the following algorithm:\n   * - Check if there is an AuthorityKeyIdentifierExtension\n   * - Go through all the other certificates and see if the SubjectKeyIdentifier is equal to thje AuthorityKeyIdentifier\n   * - If they are equal, the certificate is verified and returned as the issuer\n   *\n   * Additional validation:\n   *   - Make sure atleast a single certificate is in the chain\n   *   - Check whether a certificate in the chain matches with a trusted certificate\n   */\n  public static async validateCertificateChain(\n    agentContext: AgentContext,\n    {\n      certificateChain,\n      certificate = certificateChain[0],\n      verificationDate = new Date(),\n      trustedCertificates,\n    }: X509ValidateCertificateChainOptions\n  ) {\n    if (certificateChain.length === 0) throw new X509Error('Certificate chain is empty')\n    const webCrypto = new CredoWebCrypto(agentContext)\n\n    let parsedLeafCertificate: x509.X509Certificate\n    let certificatesToBuildChain: x509.X509Certificate[]\n    try {\n      parsedLeafCertificate = new x509.X509Certificate(certificate)\n      certificatesToBuildChain = [...certificateChain, ...(trustedCertificates ?? [])].map(\n        (c) => new x509.X509Certificate(c)\n      )\n    } catch (error) {\n      throw new X509Error('Error during parsing of x509 certificate', { cause: error })\n    }\n\n    const certificateChainBuilder = new x509.X509ChainBuilder({\n      certificates: certificatesToBuildChain,\n    })\n\n    const chain = await certificateChainBuilder.build(parsedLeafCertificate, webCrypto)\n\n    // The chain is reversed here as the `x5c` header (the expected input),\n    // has the leaf certificate as the first entry, while the `x509` library expects this as the last\n    let parsedChain = chain.map((c) => X509Certificate.fromRawCertificate(new Uint8Array(c.rawData))).reverse()\n\n    // We allow longer parsed chain, in case the root cert was not part of the chain, but in the\n    // list of trusted certificates\n    if (parsedChain.length < certificateChain.length) {\n      throw new X509Error('Could not parse the full chain. Likely due to incorrect ordering')\n    }\n\n    let previousCertificate: X509Certificate | undefined\n\n    if (trustedCertificates) {\n      const parsedTrustedCertificates = trustedCertificates.map((trustedCertificate) =>\n        X509Certificate.fromEncodedCertificate(trustedCertificate)\n      )\n\n      const trustedCertificateIndex = parsedChain.findIndex((cert) =>\n        parsedTrustedCertificates.some((tCert) => cert.equal(tCert))\n      )\n\n      if (trustedCertificateIndex === -1) {\n        throw new X509Error('No trusted certificate was found while validating the X.509 chain')\n      }\n\n      if (trustedCertificateIndex > 0) {\n        // When we trust a certificate other than the first certificate in the provided chain we keep a reference to the\n        // previous certificate as we need the key of this certificate to verify the first certificate in the chain as\n        // it's not self-sigend.\n        previousCertificate = parsedChain[trustedCertificateIndex - 1]\n\n        // Pop everything off before the index of the trusted certificate (those are more root) as it is not relevant for validation\n        parsedChain = parsedChain.slice(trustedCertificateIndex)\n      }\n    }\n\n    // Verify the certificate with the publicKey of the certificate above\n    for (let i = 0; i < parsedChain.length; i++) {\n      const cert = parsedChain[i]\n      const publicJwk = previousCertificate ? previousCertificate.publicJwk : undefined\n\n      // The only scenario where this will trigger is if the trusted certificates and the x509 chain both do not contain the\n      // intermediate/root certificate needed. E.g. for ISO 18013-5 mDL the root cert MUST NOT be in the chain. If the signer\n      // certificate is then trusted, it will fail, as we can't verify the signer certifciate without having access to the signer\n      // key of the root certificate.\n      // See also https://github.com/openid/OpenID4VCI/issues/62\n      //\n      // In this case we could skip the signature verification (not other verifications), as we already trust the signer certificate,\n      // but i think the purpose of ISO 18013-5 mDL is that you trust the root certificate. If we can't verify the whole chain e.g.\n      // when we receive a credential we have the chance it will fail later on.\n      const skipSignatureVerification = i === 0 && trustedCertificates && !publicJwk\n      // NOTE: at some point we might want to change this to throw an error instead of skipping the signature verification of the trusted\n      // but it would basically prevent mDOCs from unknown issuers to be verified in the wallet. Verifiers should only trust the root certificate\n      // anyway.\n      // if (i === 0 && trustedCertificates && cert.issuer !== cert.subject && !publicKey) {\n      //   throw new X509Error(\n      //     'Unable to verify the certificate chain. A non-self-signed certificate is the first certificate in the chain, and no parent certificate was found in the trusted certificates, meaning the first certificate in the chain cannot be verified. Ensure the certificate is added '\n      //   )\n      // }\n\n      await cert.verify(\n        {\n          publicJwk,\n          verificationDate,\n          skipSignatureVerification,\n        },\n        webCrypto\n      )\n      previousCertificate = cert\n    }\n\n    return parsedChain\n  }\n\n  /**\n   *\n   * Parses a base64-encoded X.509 certificate into a {@link X509Certificate}\n   *\n   */\n  public static parseCertificate(\n    _agentContext: AgentContext,\n    { encodedCertificate }: X509ParseCertificateOptions\n  ): X509Certificate {\n    const certificate = X509Certificate.fromEncodedCertificate(encodedCertificate)\n\n    return certificate\n  }\n\n  public static getLeafCertificate(\n    _agentContext: AgentContext,\n    { certificateChain }: X509GetLeafCertificateOptions\n  ): X509Certificate {\n    if (certificateChain.length === 0) throw new X509Error('Certificate chain is empty')\n\n    const certificate = X509Certificate.fromEncodedCertificate(certificateChain[0])\n\n    return certificate\n  }\n\n  public static async createCertificate(agentContext: AgentContext, options: X509CreateCertificateOptions) {\n    const webCrypto = new CredoWebCrypto(agentContext)\n\n    const certificate = await X509Certificate.create(options, webCrypto)\n\n    return certificate\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAeO,wBAAMA,cAAY;;;;;;;;;;;;;;;;;;;CAmBvB,aAAoB,yBAClB,cACA,EACE,kBACA,cAAc,iBAAiB,IAC/B,mCAAmB,IAAI,MAAM,EAC7B,uBAEF;AACA,MAAI,iBAAiB,WAAW,EAAG,OAAM,IAAI,UAAU,6BAA6B;EACpF,MAAM,YAAY,IAAI,eAAe,aAAa;EAElD,IAAIC;EACJ,IAAIC;AACJ,MAAI;AACF,2BAAwB,IAAI,KAAK,gBAAgB,YAAY;AAC7D,8BAA2B,CAAC,GAAG,kBAAkB,GAAI,uBAAuB,EAAE,CAAE,CAAC,KAC9E,MAAM,IAAI,KAAK,gBAAgB,EAAE,CACnC;WACM,OAAO;AACd,SAAM,IAAI,UAAU,4CAA4C,EAAE,OAAO,OAAO,CAAC;;EAWnF,IAAI,eAJU,MAJkB,IAAI,KAAK,iBAAiB,EACxD,cAAc,0BACf,CAAC,CAE0C,MAAM,uBAAuB,UAAU,EAI3D,KAAK,MAAM,gBAAgB,mBAAmB,IAAI,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;AAI3G,MAAI,YAAY,SAAS,iBAAiB,OACxC,OAAM,IAAI,UAAU,mEAAmE;EAGzF,IAAIC;AAEJ,MAAI,qBAAqB;GACvB,MAAM,4BAA4B,oBAAoB,KAAK,uBACzD,gBAAgB,uBAAuB,mBAAmB,CAC3D;GAED,MAAM,0BAA0B,YAAY,WAAW,SACrD,0BAA0B,MAAM,UAAU,KAAK,MAAM,MAAM,CAAC,CAC7D;AAED,OAAI,4BAA4B,GAC9B,OAAM,IAAI,UAAU,oEAAoE;AAG1F,OAAI,0BAA0B,GAAG;AAI/B,0BAAsB,YAAY,0BAA0B;AAG5D,kBAAc,YAAY,MAAM,wBAAwB;;;AAK5D,OAAK,IAAI,IAAI,GAAG,IAAI,YAAY,QAAQ,KAAK;GAC3C,MAAM,OAAO,YAAY;GACzB,MAAM,YAAY,sBAAsB,oBAAoB,YAAY;GAWxE,MAAM,4BAA4B,MAAM,KAAK,uBAAuB,CAAC;AAUrE,SAAM,KAAK,OACT;IACE;IACA;IACA;IACD,EACD,UACD;AACD,yBAAsB;;AAGxB,SAAO;;;;;;;CAQT,OAAc,iBACZ,eACA,EAAE,sBACe;AAGjB,SAFoB,gBAAgB,uBAAuB,mBAAmB;;CAKhF,OAAc,mBACZ,eACA,EAAE,oBACe;AACjB,MAAI,iBAAiB,WAAW,EAAG,OAAM,IAAI,UAAU,6BAA6B;AAIpF,SAFoB,gBAAgB,uBAAuB,iBAAiB,GAAG;;CAKjF,aAAoB,kBAAkB,cAA4B,SAAuC;EACvG,MAAM,YAAY,IAAI,eAAe,aAAa;AAIlD,SAFoB,MAAM,gBAAgB,OAAO,SAAS,UAAU;;;0BAxJvE,YAAY"}

package/build/modules/x509/X509ServiceOptions.d.mts

@@ -0,0 +1,142 @@
+import { X509Certificate, X509ExtendedKeyUsage, X509KeyUsage } from "./X509Certificate.mjs";
+import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
+import "../kms/index.mjs";
+import { GeneralNameType } from "@peculiar/x509";
+
+//#region src/modules/x509/X509ServiceOptions.d.ts
+type AddMarkAsCritical<T extends Record<string, Record<string, unknown>>> = T & { [K in keyof T]: T[K] & {
+  markAsCritical?: boolean;
+} };
+/**
+ * Base64 or PEM
+ */
+type EncodedX509Certificate = string;
+interface X509ValidateCertificateChainOptions {
+  certificateChain: Array<EncodedX509Certificate>;
+  certificate?: EncodedX509Certificate;
+  /**
+   * The date for which the certificate chain should be valid
+   * @default new Date()
+   *
+   * The certificates must be valid on this date
+   * according to the certificates certificate.notBefore and certificate.notAfter
+   * otherwise, the validation will fail
+   */
+  verificationDate?: Date;
+  trustedCertificates?: Array<EncodedX509Certificate>;
+}
+interface X509GetLeafCertificateOptions {
+  certificateChain: Array<string>;
+}
+interface X509ParseCertificateOptions {
+  encodedCertificate: string;
+}
+interface X509CreateCertificateChainOptions {
+  certificates: Array<X509Certificate | string>;
+  outputFormat?: 'pem' | 'base64';
+}
+type X509CertificateExtensionsOptions = AddMarkAsCritical<{
+  subjectKeyIdentifier?: {
+    include: boolean;
+  };
+  keyUsage?: {
+    usages: Array<X509KeyUsage>;
+  };
+  extendedKeyUsage?: {
+    usages: Array<X509ExtendedKeyUsage>;
+  };
+  authorityKeyIdentifier?: {
+    include: boolean;
+  };
+  issuerAlternativeName?: {
+    name: Array<{
+      type: GeneralNameType;
+      value: string;
+    }>;
+  };
+  subjectAlternativeName?: {
+    name: Array<{
+      type: GeneralNameType;
+      value: string;
+    }>;
+  };
+  basicConstraints?: {
+    ca: boolean;
+    pathLenConstraint?: number;
+  };
+  crlDistributionPoints?: {
+    urls: Array<string>;
+  };
+}>;
+interface X509CertificateIssuerAndSubjectOptions {
+  countryName?: string;
+  stateOrProvinceName?: string;
+  organizationalUnit?: string;
+  commonName?: string;
+}
+interface X509CreateCertificateOptions {
+  /**
+   *
+   * Serial number of the X.509 certificate
+   *
+   */
+  serialNumber?: string;
+  /**
+   *
+   * The Key that will be used to sign the X.509 Certificate
+   *
+   */
+  authorityKey: PublicJwk;
+  /**
+   *
+   * The key that is the subject of the X.509 Certificate
+   *
+   * If the `subjectPublicKey` is not included, the `authorityKey` will be used.
+   * This means that the certificate is self-signed
+   *
+   */
+  subjectPublicKey?: PublicJwk;
+  /**
+   *
+   * The issuer information of the X.509 Certificate
+   *
+   */
+  issuer: string | X509CertificateIssuerAndSubjectOptions;
+  /**
+   *
+   * The subject information of the X.509 Certificate
+   *
+   * If the `subject` is not included, the `issuer` will be used
+   *
+   *
+   */
+  subject?: string | X509CertificateIssuerAndSubjectOptions;
+  /**
+   *
+   * Date range for when the X.509 Certificate is valid
+   *
+   */
+  validity?: {
+    /**
+     *
+     * Certificate is not valid before this date
+     *
+     */
+    notBefore?: Date;
+    /**
+     *
+     * Certificate is not valid after this date
+     *
+     */
+    notAfter?: Date;
+  };
+  /**
+   *
+   * X.509 v3 Extensions to be added to the certificate
+   *
+   */
+  extensions?: X509CertificateExtensionsOptions;
+}
+//#endregion
+export { EncodedX509Certificate, X509CertificateExtensionsOptions, X509CertificateIssuerAndSubjectOptions, X509CreateCertificateChainOptions, X509CreateCertificateOptions, X509GetLeafCertificateOptions, X509ParseCertificateOptions, X509ValidateCertificateChainOptions };
+//# sourceMappingURL=X509ServiceOptions.d.mts.map

package/build/modules/x509/X509ServiceOptions.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509ServiceOptions.d.mts","names":[],"sources":["../../../src/modules/x509/X509ServiceOptions.ts"],"sourcesContent":[],"mappings":";;;;;;KAIK,4BAA4B,eAAe,4BAA4B,kBAC9D,IAAI,EAAE;;;AAHwE;;;AAEhB,KAShE,sBAAA,GATgE,MAAA;AAC9D,UAUG,mCAAA,CAVH;EAAI,gBAAA,EAWE,KAXF,CAWQ,sBAXR,CAAA;EAAE,WAAA,CAAA,EAaJ,sBAbI;EAAC;AAQrB;AAEA;;;;;;EAewB,gBAAA,CAAA,EAFH,IAEG;EAAK,mBAAA,CAAA,EAAL,KAAK,CAAC,sBAAD,CAAA;AAG7B;AAIiB,UAJA,6BAAA,CAI2B;EAI3B,gBAAA,EAPG,KAOH,CAAA,MAAA,CAAA;AAKjB;AAKkB,UAdD,2BAAA,CAcC;EAAN,kBAAA,EAAA,MAAA;;AAGA,UAbK,iCAAA,CAaL;EAMY,YAAA,EAlBR,KAkBQ,CAlBF,eAkBE,GAAA,MAAA,CAAA;EAAd,YAAA,CAAA,EAAA,KAAA,GAAA,QAAA;;AAGA,KAjBE,gCAAA,GAAmC,iBAiBrC,CAAA;EAOA,oBAAA,CAAA,EAAA;IAxBqC,OAAA,EAAA,OAAA;EAAiB,CAAA;EA4B/C,QAAA,CAAA,EAAA;IAOA,MAAA,EA9BL,KA8BK,CA9BC,YA8BD,CAA4B;EAa7B,CAAA;EAUK,gBAAA,CAAA,EAAA;IAOF,MAAA,EAzDP,KAyDO,CAzDD,oBAyDC,CAAA;EAUE,CAAA;EAaL,sBAAA,CAAA,EAAA;IAOD,OAAA,EAAA,OAAA;EAQA,CAAA;EAAgC,qBAAA,CAAA,EAAA;UAzFrC;YAAc;;;;;UAGd;YAAc;;;;;;;;;UAOd;;;UAIO,sCAAA;;;;;;UAOA,4BAAA;;;;;;;;;;;;gBAaD;;;;;;;;;qBAUK;;;;;;mBAOF;;;;;;;;;qBAUE;;;;;;;;;;;;gBAaL;;;;;;eAOD;;;;;;;eAQA"}

package/build/modules/x509/X509ServiceOptions.mjs

@@ -0,0 +1,3 @@
+
+
+import "../kms/index.mjs";

package/build/modules/x509/extraction.d.mts

@@ -0,0 +1,9 @@
+import { X509Certificate } from "./X509Certificate.mjs";
+import { Jwt } from "../../crypto/jose/jwt/Jwt.mjs";
+import "../../crypto/index.mjs";
+
+//#region src/modules/x509/extraction.d.ts
+declare function extractX509CertificatesFromJwt(jwt: Jwt): X509Certificate[] | undefined;
+//#endregion
+export { extractX509CertificatesFromJwt };
+//# sourceMappingURL=extraction.d.mts.map

package/build/modules/x509/extraction.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extraction.d.mts","names":[],"sources":["../../../src/modules/x509/extraction.ts"],"sourcesContent":[],"mappings":";;;;;iBAIgB,8BAAA,MAAoC,MAAG"}