@naylence/runtime 0.3.3 → 0.3.5-test.0

package/dist/cjs/src/naylence/fame/security/crypto/providers/default-crypto-provider.js

@@ -0,0 +1,718 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultCryptoProvider = void 0;
+const asn1_schema_1 = require("@peculiar/asn1-schema");
+const asn1_x509_1 = require("@peculiar/asn1-x509");
+const asn1_csr_1 = require("@peculiar/asn1-csr");
+const core_1 = require("@naylence/core");
+const logging_js_1 = require("../../../util/logging.js");
+const util_js_1 = require("../../../util/util.js");
+const jwt_token_issuer_js_1 = require("../../auth/jwt-token-issuer.js");
+const jwt_token_verifier_js_1 = require("../../auth/jwt-token-verifier.js");
+const jose_loader_js_1 = require("../../auth/jose-loader.js");
+const index_js_1 = require("../key-factories/index.js");
+const logger = (0, logging_js_1.getLogger)('naylence.fame.security.crypto.providers.default_crypto_provider');
+const ENV_VAR_CRYPTO_ALGORITHM = 'FAME_CRYPTO_ALGORITHM';
+const DEFAULT_CRYPTO_ALGORITHM = 'EdDSA';
+const DEFAULT_ISSUER = 'dev.naylence.ai';
+const DEFAULT_AUDIENCE = 'router-dev';
+const DEFAULT_TTL_SEC = 3600;
+const DEFAULT_HMAC_SECRET_BYTES = 32;
+const ENCRYPTION_ALG = 'ECDH-ES';
+const EXTENSION_REQUEST_OID = '1.2.840.113549.1.9.14';
+const COMMON_NAME_OID = '2.5.4.3';
+const ED25519_OID = '1.3.101.112';
+const CSR_PEM_TAG = 'CERTIFICATE REQUEST';
+const LOGICAL_URI_PREFIX = 'naylence://';
+function normalizeDefaultCryptoProviderOptions(options) {
+    if (!options) {
+        return {};
+    }
+    const source = options;
+    const normalized = {};
+    const readNullableString = (...keys) => {
+        for (const key of keys) {
+            if (!Object.prototype.hasOwnProperty.call(source, key)) {
+                continue;
+            }
+            const value = source[key];
+            if (value === undefined) {
+                return undefined;
+            }
+            if (value === null) {
+                return null;
+            }
+            if (typeof value === 'string') {
+                return value;
+            }
+            return String(value);
+        }
+        return undefined;
+    };
+    const readNullableNumber = (...keys) => {
+        for (const key of keys) {
+            if (!Object.prototype.hasOwnProperty.call(source, key)) {
+                continue;
+            }
+            const value = source[key];
+            if (value === undefined) {
+                return undefined;
+            }
+            if (value === null) {
+                return null;
+            }
+            if (typeof value === 'number') {
+                return Number.isFinite(value) ? value : undefined;
+            }
+            if (typeof value === 'string') {
+                const trimmed = value.trim();
+                if (!trimmed) {
+                    return undefined;
+                }
+                const parsed = Number(trimmed);
+                return Number.isFinite(parsed) ? parsed : undefined;
+            }
+        }
+        return undefined;
+    };
+    const assignStringOption = (targetKey, ...keys) => {
+        const value = readNullableString(...keys);
+        if (value !== undefined) {
+            normalized[targetKey] = value;
+        }
+    };
+    assignStringOption('signaturePrivatePem', 'signaturePrivatePem', 'signature_private_pem');
+    assignStringOption('signaturePublicPem', 'signaturePublicPem', 'signature_public_pem');
+    assignStringOption('signatureKeyId', 'signatureKeyId', 'signature_key_id');
+    assignStringOption('encryptionPrivatePem', 'encryptionPrivatePem', 'encryption_private_pem');
+    assignStringOption('encryptionPublicPem', 'encryptionPublicPem', 'encryption_public_pem');
+    assignStringOption('encryptionKeyId', 'encryptionKeyId', 'encryption_key_id');
+    assignStringOption('hmacSecret', 'hmacSecret', 'hmac_secret');
+    assignStringOption('issuer', 'issuer', 'iss');
+    assignStringOption('audience', 'audience', 'aud');
+    assignStringOption('algorithm', 'algorithm', 'alg');
+    const ttlSec = readNullableNumber('ttlSec', 'ttl_sec');
+    if (ttlSec !== undefined) {
+        normalized.ttlSec = ttlSec;
+    }
+    return normalized;
+}
+class DefaultCryptoProvider {
+    static async create(options = {}) {
+        const normalized = normalizeDefaultCryptoProviderOptions(options);
+        const artifacts = await buildProviderArtifacts(normalized);
+        return new DefaultCryptoProvider(artifacts);
+    }
+    constructor(artifacts) {
+        this.artifacts = artifacts;
+        this.tokenIssuerInstance = null;
+        this.tokenVerifierInstance = null;
+        this.nodeCertPem = null;
+        this.nodeCertChainPem = null;
+        this.certContext = null;
+        logger.debug('default_crypto_provider_initialized', {
+            signature_key_id: artifacts.signing.keyId,
+            encryption_key_id: artifacts.encryption.keyId,
+            issuer: artifacts.issuer,
+            audience: artifacts.audience,
+            algorithm: artifacts.signing.algorithm,
+        });
+    }
+    get signingPrivatePem() {
+        return this.artifacts.signing.privatePem;
+    }
+    get signingPublicPem() {
+        return this.artifacts.signing.publicPem;
+    }
+    get signatureKeyId() {
+        return this.artifacts.signing.keyId;
+    }
+    get encryptionPrivatePem() {
+        return this.artifacts.encryption.privatePem;
+    }
+    get encryptionPublicPem() {
+        return this.artifacts.encryption.publicPem;
+    }
+    get encryptionKeyId() {
+        return this.artifacts.encryption.keyId;
+    }
+    get hmacSecret() {
+        return this.artifacts.hmacSecret;
+    }
+    get issuer() {
+        return this.artifacts.issuer;
+    }
+    get audience() {
+        return this.artifacts.audience;
+    }
+    get ttlSec() {
+        return this.artifacts.ttlSec;
+    }
+    getTokenIssuer() {
+        if (this.tokenIssuerInstance) {
+            return this.tokenIssuerInstance;
+        }
+        const algorithm = this.artifacts.signing.algorithm;
+        if (algorithm.startsWith('HS')) {
+            this.tokenIssuerInstance = new jwt_token_issuer_js_1.JWTTokenIssuer({
+                signingKeyPem: this.hmacSecret,
+                kid: this.signatureKeyId,
+                issuer: this.issuer,
+                algorithm,
+                ttlSec: this.ttlSec,
+                audience: this.audience,
+            });
+            return this.tokenIssuerInstance;
+        }
+        this.tokenIssuerInstance = new jwt_token_issuer_js_1.JWTTokenIssuer({
+            signingKeyPem: this.signingPrivatePem,
+            kid: this.signatureKeyId,
+            issuer: this.issuer,
+            algorithm,
+            ttlSec: this.ttlSec,
+            audience: this.audience,
+        });
+        return this.tokenIssuerInstance;
+    }
+    getTokenVerifier() {
+        if (this.tokenVerifierInstance) {
+            return this.tokenVerifierInstance;
+        }
+        const algorithm = this.artifacts.signing.algorithm;
+        const verificationKey = algorithm.startsWith('HS')
+            ? this.hmacSecret
+            : this.signingPublicPem;
+        this.tokenVerifierInstance = new jwt_token_verifier_js_1.JWTTokenVerifier({
+            verificationKey,
+            issuer: this.issuer,
+            ttlSec: this.ttlSec,
+            algorithms: [algorithm],
+        });
+        return this.tokenVerifierInstance;
+    }
+    getJwks() {
+        const { signing, encryption } = this.artifacts;
+        const keys = [cloneJson(signing.jwk)];
+        if (encryption.jwk) {
+            keys.push(cloneJson(encryption.jwk));
+        }
+        return { keys };
+    }
+    nodeJwk() {
+        const signing = cloneJson(this.artifacts.signing.jwk);
+        if (this.nodeCertPem) {
+            signing.x5c = buildX5cChain(this.nodeCertPem, this.nodeCertChainPem);
+        }
+        return signing;
+    }
+    nodeCertificatePem() {
+        return this.nodeCertPem;
+    }
+    certificateChainPem() {
+        return this.nodeCertChainPem;
+    }
+    hasCertificate() {
+        return Boolean(this.nodeCertPem);
+    }
+    getCertificateContext() {
+        return this.certContext ? cloneJson(this.certContext) : null;
+    }
+    hasNodeContext() {
+        return this.certContext !== null;
+    }
+    setNodeContext(nodeId, physicalPath, logicals, _parentPath) {
+        const nodeSid = (0, util_js_1.secureDigest)(physicalPath);
+        this.certContext = {
+            nodeId,
+            nodeSid,
+            physicalPath,
+            logicals: [...logicals],
+        };
+        logger.debug('node_context_set', {
+            node_id: nodeId,
+            physical_path: physicalPath,
+            logicals,
+            message: 'Certificate generation via external CA service required',
+        });
+    }
+    setNodeContextFromNodeLike(nodeLike) {
+        this.setNodeContext(nodeLike.id, nodeLike.physicalPath, Array.from(nodeLike.acceptedLogicals));
+        if (this.certContext &&
+            nodeLike.sid &&
+            nodeLike.sid !== this.certContext.nodeSid) {
+            this.certContext = {
+                ...this.certContext,
+                nodeSid: nodeLike.sid,
+            };
+            logger.debug('node_context_updated_with_nodelike_sid', {
+                node_id: nodeLike.id,
+                provided_sid: nodeLike.sid,
+                message: 'Certificate generation via external CA service required',
+            });
+        }
+    }
+    prepareForAttach(nodeId, physicalPath, logicals) {
+        const nodeSid = (0, util_js_1.secureDigest)(physicalPath);
+        this.certContext = {
+            nodeId,
+            nodeSid,
+            physicalPath,
+            logicals: [...logicals],
+        };
+        logger.debug('prepared_context_for_attach', {
+            node_id: nodeId,
+            physical_path: physicalPath,
+            node_sid: nodeSid,
+            logicals,
+            message: 'Certificate generation via external CA service required',
+        });
+    }
+    setLogicals(logicals) {
+        if (!this.certContext) {
+            return;
+        }
+        this.certContext = {
+            ...this.certContext,
+            logicals: [...logicals],
+        };
+        logger.debug('logicals_updated', {
+            node_id: this.certContext.nodeId,
+            logicals,
+            message: 'Certificate regeneration via external CA service required',
+        });
+    }
+    storeSignedCertificate(certificatePem, certificateChainPem) {
+        this.nodeCertPem = certificatePem;
+        this.nodeCertChainPem = certificateChainPem ?? null;
+        logger.debug('certificate_stored', {
+            has_certificate: Boolean(certificatePem),
+            has_chain: Boolean(certificateChainPem),
+        });
+    }
+    async createCsr(nodeId, physicalPath, logicals, subjectName) {
+        const trimmedNodeId = assertNonEmptyString(nodeId, 'nodeId');
+        const trimmedPhysicalPath = assertNonEmptyString(physicalPath, 'physicalPath');
+        try {
+            if (this.artifacts.signing.algorithm !== 'EdDSA') {
+                throw new Error('CSR creation only supported for Ed25519 signing keys in the default crypto provider');
+            }
+            const cryptoImpl = await ensureWebCrypto();
+            const privateKey = await cryptoImpl.subtle.importKey('pkcs8', pemToArrayBuffer(this.signingPrivatePem), {
+                name: 'Ed25519',
+            }, false, ['sign']);
+            const publicKeyDer = pemToArrayBuffer(this.signingPublicPem);
+            const subjectPkInfo = asn1_schema_1.AsnConvert.parse(publicKeyDer, asn1_x509_1.SubjectPublicKeyInfo);
+            const sanitizedLogicals = Array.isArray(logicals)
+                ? logicals.filter((value) => typeof value === 'string' && value.trim().length > 0)
+                : [];
+            const commonName = typeof subjectName === 'string' && subjectName.trim().length > 0
+                ? subjectName.trim()
+                : trimmedNodeId;
+            const subject = buildSubjectName(commonName);
+            const attributes = new asn1_csr_1.Attributes();
+            if (sanitizedLogicals.length > 0) {
+                const san = new asn1_x509_1.SubjectAlternativeName(sanitizedLogicals.map((logical) => new asn1_x509_1.GeneralName({
+                    uniformResourceIdentifier: `${LOGICAL_URI_PREFIX}${logical}`,
+                })));
+                const extensions = new asn1_x509_1.Extensions([
+                    new asn1_x509_1.Extension({
+                        extnID: asn1_x509_1.id_ce_subjectAltName,
+                        critical: false,
+                        extnValue: new asn1_schema_1.OctetString(asn1_schema_1.AsnConvert.serialize(san)),
+                    }),
+                ]);
+                attributes.push(new asn1_x509_1.Attribute({
+                    type: EXTENSION_REQUEST_OID,
+                    values: [asn1_schema_1.AsnConvert.serialize(extensions)],
+                }));
+            }
+            const requestInfo = new asn1_csr_1.CertificationRequestInfo({
+                subject,
+                subjectPKInfo: subjectPkInfo,
+                attributes,
+            });
+            const requestInfoDer = asn1_schema_1.AsnConvert.serialize(requestInfo);
+            const signature = await cryptoImpl.subtle.sign('Ed25519', privateKey, requestInfoDer);
+            const certificationRequest = new asn1_csr_1.CertificationRequest({
+                certificationRequestInfo: requestInfo,
+                signatureAlgorithm: new asn1_x509_1.AlgorithmIdentifier({
+                    algorithm: ED25519_OID,
+                }),
+                signature: encodeBitString(signature),
+            });
+            certificationRequest.certificationRequestInfoRaw = requestInfoDer;
+            const csrDer = asn1_schema_1.AsnConvert.serialize(certificationRequest);
+            const csrPem = arrayBufferToPem(csrDer, CSR_PEM_TAG);
+            logger.debug('csr_created', {
+                node_id: trimmedNodeId,
+                physical_path: trimmedPhysicalPath,
+                logical_count: sanitizedLogicals.length,
+            });
+            return csrPem;
+        }
+        catch (error) {
+            logger.error('csr_creation_failed', {
+                node_id: trimmedNodeId,
+                physical_path: trimmedPhysicalPath,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+}
+exports.DefaultCryptoProvider = DefaultCryptoProvider;
+async function buildProviderArtifacts(options) {
+    const algorithm = normalizeAlgorithm(options.algorithm ?? readEnvAlgorithm());
+    const signatureKeyId = options.signatureKeyId?.trim() || (0, core_1.generateId)();
+    const encryptionKeyId = options.encryptionKeyId?.trim() || (0, core_1.generateId)();
+    const issuer = options.issuer?.trim() || DEFAULT_ISSUER;
+    const audience = options.audience?.trim() || DEFAULT_AUDIENCE;
+    const ttlSec = typeof options.ttlSec === 'number' && options.ttlSec > 0
+        ? options.ttlSec
+        : DEFAULT_TTL_SEC;
+    const signingParams = {
+        algorithm,
+        keyId: signatureKeyId,
+    };
+    if (options.signaturePrivatePem) {
+        signingParams.privatePem = options.signaturePrivatePem;
+    }
+    if (options.signaturePublicPem) {
+        signingParams.publicPem = options.signaturePublicPem;
+    }
+    const signing = await resolveSigningArtifacts(signingParams);
+    const encryptionParams = {
+        keyId: encryptionKeyId,
+    };
+    if (options.encryptionPrivatePem) {
+        encryptionParams.privatePem = options.encryptionPrivatePem;
+    }
+    if (options.encryptionPublicPem) {
+        encryptionParams.publicPem = options.encryptionPublicPem;
+    }
+    const encryption = await resolveEncryptionArtifacts(encryptionParams);
+    const hmacSecret = options.hmacSecret?.trim() ||
+        (await generateRandomSecretBase64(DEFAULT_HMAC_SECRET_BYTES));
+    return {
+        signing,
+        encryption,
+        hmacSecret,
+        issuer,
+        audience,
+        ttlSec,
+    };
+}
+async function resolveSigningArtifacts(params) {
+    const normalizedAlg = mapAlgorithmToJwt(params.algorithm);
+    if (params.privatePem && params.publicPem) {
+        const jwk = await buildSigningJwkFromPem(params.publicPem, params.keyId, normalizedAlg);
+        return {
+            privatePem: params.privatePem,
+            publicPem: params.publicPem,
+            keyId: params.keyId,
+            jwk,
+            algorithm: normalizedAlg,
+        };
+    }
+    let keyPair;
+    if (normalizedAlg === 'EdDSA') {
+        keyPair = await (0, index_js_1.createEd25519Keypair)(params.keyId);
+    }
+    else if (normalizedAlg.startsWith('RS')) {
+        keyPair = await (0, index_js_1.createRsaKeypair)(params.keyId);
+    }
+    else {
+        throw new Error(`Unsupported signing algorithm: ${params.algorithm}`);
+    }
+    const baseJwk = Array.isArray(keyPair.jwks.keys)
+        ? keyPair.jwks.keys[0]
+        : undefined;
+    const jwk = cloneJson(baseJwk ?? {});
+    jwk.kid = params.keyId;
+    jwk.alg = normalizedAlg;
+    jwk.use = 'sig';
+    return {
+        privatePem: keyPair.privatePem,
+        publicPem: keyPair.publicPem,
+        keyId: params.keyId,
+        jwk,
+        algorithm: normalizedAlg,
+    };
+}
+async function resolveEncryptionArtifacts(params) {
+    if (params.privatePem && params.publicPem) {
+        const jwk = await buildEncryptionJwkFromPem(params.publicPem, params.keyId);
+        return {
+            privatePem: params.privatePem,
+            publicPem: params.publicPem,
+            keyId: params.keyId,
+            jwk,
+        };
+    }
+    const keyPair = await (0, index_js_1.createX25519Keypair)(params.keyId);
+    const jwk = await buildEncryptionJwkFromPem(keyPair.publicPem, params.keyId);
+    return {
+        privatePem: keyPair.privatePem,
+        publicPem: keyPair.publicPem,
+        keyId: params.keyId,
+        jwk,
+    };
+}
+function normalizeAlgorithm(value) {
+    if (!value) {
+        return DEFAULT_CRYPTO_ALGORITHM;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return DEFAULT_CRYPTO_ALGORITHM;
+    }
+    const upper = trimmed.toUpperCase();
+    if (upper === 'EDDSA' || upper === 'ED25519') {
+        return 'EdDSA';
+    }
+    if (upper === 'RSA') {
+        return 'RSA';
+    }
+    if (upper.startsWith('RS') ||
+        upper.startsWith('PS') ||
+        upper.startsWith('ES') ||
+        upper.startsWith('HS')) {
+        return upper;
+    }
+    return trimmed;
+}
+function mapAlgorithmToJwt(value) {
+    const upper = value.toUpperCase();
+    if (upper === 'RSA') {
+        return 'RS256';
+    }
+    return value;
+}
+function readEnvAlgorithm() {
+    if (typeof process === 'undefined' || !process.env) {
+        return null;
+    }
+    const envValue = process.env[ENV_VAR_CRYPTO_ALGORITHM];
+    return envValue ?? null;
+}
+async function buildSigningJwkFromPem(publicPem, kid, preferredAlg) {
+    const jose = await (0, jose_loader_js_1.requireJose)();
+    const candidates = preferredAlg
+        ? [preferredAlg, 'EdDSA', 'RS256', 'ES256', 'ES384', 'ES512']
+        : ['EdDSA', 'RS256', 'ES256', 'ES384', 'ES512'];
+    for (const alg of candidates) {
+        try {
+            const key = await jose.importSPKI(publicPem, alg);
+            const jwk = await jose.exportJWK(key);
+            if (jwk && typeof jwk === 'object') {
+                const result = {
+                    ...jwk,
+                    kid,
+                    use: 'sig',
+                    alg,
+                };
+                return result;
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error('Unable to derive JWK from signing public key PEM');
+}
+async function buildEncryptionJwkFromPem(publicPem, kid) {
+    const jose = await (0, jose_loader_js_1.requireJose)();
+    try {
+        const key = await jose.importSPKI(publicPem, ENCRYPTION_ALG);
+        const jwk = await jose.exportJWK(key);
+        if (jwk && typeof jwk === 'object') {
+            return {
+                ...jwk,
+                kid,
+                use: 'enc',
+                alg: ENCRYPTION_ALG,
+            };
+        }
+    }
+    catch (error) {
+        logger.warning('x25519_jwk_from_pem_failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    throw new Error('Unable to derive JWK from X25519 public key PEM');
+}
+async function generateRandomSecretBase64(length) {
+    if (typeof globalThis !== 'undefined' &&
+        globalThis.crypto &&
+        typeof globalThis.crypto.getRandomValues === 'function') {
+        const bytes = new Uint8Array(length);
+        globalThis.crypto.getRandomValues(bytes);
+        return bytesToBase64(bytes);
+    }
+    if (typeof process !== 'undefined') {
+        const { randomBytes } = await Promise.resolve().then(() => __importStar(require('crypto')));
+        return randomBytes(length).toString('base64');
+    }
+    throw new Error('No cryptographic random source available to generate HMAC secret');
+}
+function bytesToBase64(bytes) {
+    if (typeof Buffer !== 'undefined') {
+        return Buffer.from(bytes).toString('base64');
+    }
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+function buildX5cChain(certificatePem, chainPem) {
+    const chain = [];
+    const seen = new Set();
+    const appendIfNew = (pem) => {
+        const derBase64 = pemToDerBase64(pem);
+        if (seen.has(derBase64)) {
+            return;
+        }
+        seen.add(derBase64);
+        chain.push(derBase64);
+    };
+    appendIfNew(certificatePem);
+    if (chainPem) {
+        for (const cert of splitPemCertificates(chainPem)) {
+            appendIfNew(cert);
+        }
+    }
+    return chain;
+}
+function splitPemCertificates(pem) {
+    const matches = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g);
+    return matches ? matches : [];
+}
+function pemToDerBase64(pem) {
+    const lines = pem.replace(/\r/g, '').split('\n');
+    const base64Lines = lines.filter((line) => !line.startsWith('-----') && line.trim().length > 0);
+    const base64 = base64Lines.join('');
+    // Ensure the output is valid base64 without whitespace
+    return base64.replace(/\s+/g, '');
+}
+let cryptoPromise = null;
+async function ensureWebCrypto() {
+    if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto?.subtle) {
+        return globalThis.crypto;
+    }
+    if (!cryptoPromise) {
+        if (typeof process !== 'undefined' &&
+            typeof process.versions?.node === 'string') {
+            cryptoPromise = Promise.resolve().then(() => __importStar(require('node:crypto'))).then((module) => {
+                const webcrypto = module.webcrypto;
+                if (!webcrypto || !webcrypto.subtle) {
+                    throw new Error('WebCrypto API is not available in this Node.js runtime');
+                }
+                globalThis.crypto = webcrypto;
+                return webcrypto;
+            });
+        }
+        else {
+            cryptoPromise = Promise.reject(new Error('WebCrypto API is not available in this environment'));
+        }
+    }
+    return cryptoPromise;
+}
+function pemToArrayBuffer(pem) {
+    const normalized = pem
+        .replace(/-----BEGIN[^-]+-----/g, '')
+        .replace(/-----END[^-]+-----/g, '')
+        .replace(/\s+/g, '');
+    const bytes = base64ToBytes(normalized);
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function base64ToBytes(base64) {
+    if (typeof Buffer !== 'undefined') {
+        const buffer = Buffer.from(base64, 'base64');
+        const bytes = new Uint8Array(buffer.length);
+        for (let i = 0; i < buffer.length; i += 1) {
+            bytes[i] = buffer[i];
+        }
+        return bytes;
+    }
+    if (typeof atob === 'function') {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i += 1) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    throw new Error('No base64 decoder available in this environment');
+}
+function arrayBufferToPem(buffer, tag) {
+    const base64 = bytesToBase64(new Uint8Array(buffer));
+    return `-----BEGIN ${tag}-----\n${formatPem(base64)}\n-----END ${tag}-----\n`;
+}
+function formatPem(base64) {
+    const lines = [];
+    for (let i = 0; i < base64.length; i += 64) {
+        lines.push(base64.slice(i, i + 64));
+    }
+    return lines.join('\n');
+}
+function encodeBitString(signature) {
+    const bytes = new Uint8Array(signature);
+    const bitString = new Uint8Array(bytes.length + 1);
+    bitString.set(bytes, 1);
+    return bitString.buffer;
+}
+function buildSubjectName(commonName) {
+    const attribute = new asn1_x509_1.AttributeTypeAndValue({
+        type: COMMON_NAME_OID,
+        value: new asn1_x509_1.AttributeValue({ utf8String: commonName }),
+    });
+    return new asn1_x509_1.Name([new asn1_x509_1.RelativeDistinguishedName([attribute])]);
+}
+function assertNonEmptyString(value, name) {
+    if (typeof value !== 'string') {
+        throw new TypeError(`${name} must be a string`);
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        throw new TypeError(`${name} must be a non-empty string`);
+    }
+    return trimmed;
+}
+function cloneJson(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+//# sourceMappingURL=default-crypto-provider.js.map