@noz-ele/edgca 0.1.0 → 0.3.0

package/dist/csr.js

@@ -0,0 +1,266 @@
+import { cloneBytes } from "./bytes.js";
+import { importPublicKeySpki, verifyDer } from "./crypto.js";
+import { decodeInteger, decodeOid, readChildren, readElement, readSequenceChildren, TAG } from "./der.js";
+import { OID, SUBJECT_ATTRIBUTE_OIDS } from "./oids.js";
+import { pemToDerWithLabel, splitPemBlocks } from "./pem.js";
+const SHORT_NAME_BY_OID = Object.fromEntries(Object.entries(SUBJECT_ATTRIBUTE_OIDS).map(([shortName, oid]) => [oid, shortName]));
+const VALUE_DECODERS = new Map([
+    [TAG.UTF8_STRING, (b) => new TextDecoder("utf-8", { fatal: true }).decode(b)],
+    [TAG.PRINTABLE_STRING, (b) => decodeAscii(b, "PrintableString")],
+    [TAG.IA5_STRING, (b) => decodeAscii(b, "IA5String")]
+]);
+const SUPPORTED_SIGNATURE_OIDS = new Set([
+    OID.ecdsaWithSha256,
+    OID.ecdsaWithSha384,
+    OID.ecdsaWithSha512
+]);
+export async function parseCertificateSigningRequest(input) {
+    const der = typeof input === "string" ? csrPemToDer(input) : input;
+    const root = readElement(der);
+    if (root.tag !== TAG.SEQUENCE || root.end !== der.length) {
+        throw new Error("Invalid CSR DER");
+    }
+    const [requestInfo, signatureAlgorithm, signatureValue] = readSequenceChildren(root);
+    if (!requestInfo || !signatureAlgorithm || !signatureValue) {
+        throw new Error("Invalid CSR structure");
+    }
+    if (requestInfo.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid CSR certificationRequestInfo");
+    }
+    if (signatureAlgorithm.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid CSR signatureAlgorithm");
+    }
+    if (signatureValue.tag !== TAG.BIT_STRING || signatureValue.value[0] !== 0) {
+        throw new Error("Invalid CSR signature value");
+    }
+    const signatureAlgorithmOid = readAlgorithmOid(signatureAlgorithm);
+    if (!SUPPORTED_SIGNATURE_OIDS.has(signatureAlgorithmOid)) {
+        throw new Error(`Unsupported CSR signatureAlgorithm: ${signatureAlgorithmOid}`);
+    }
+    const infoChildren = readSequenceChildren(requestInfo);
+    const versionElement = infoChildren[0];
+    const subjectElement = infoChildren[1];
+    const spkiElement = infoChildren[2];
+    const attributesElement = infoChildren[3];
+    if (!versionElement || !subjectElement || !spkiElement) {
+        throw new Error("Invalid CSR certificationRequestInfo structure");
+    }
+    if (versionElement.tag !== TAG.INTEGER || decodeInteger(versionElement.value) !== 0n) {
+        throw new Error("Unsupported CSR version (only v1 / INTEGER 0 is supported)");
+    }
+    if (spkiElement.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid CSR subjectPublicKeyInfo");
+    }
+    if (attributesElement && attributesElement.tag !== 0xa0) {
+        throw new Error("Invalid CSR attributes tag (must be IMPLICIT [0])");
+    }
+    const subject = decodeName(subjectElement);
+    const publicKey = await importPublicKeySpki(spkiElement.raw);
+    const allAttributes = attributesElement ? decodeAttributes(attributesElement.value) : [];
+    const extensionRequest = allAttributes.find((attribute) => attribute.oid === OID.extensionRequest);
+    const otherAttributes = allAttributes.filter((attribute) => attribute.oid !== OID.extensionRequest);
+    const requestedExtensions = extensionRequest
+        ? decodeRequestedExtensions(extensionRequest.valuesDer)
+        : [];
+    const sanExtension = requestedExtensions.find((extension) => extension.oid === OID.subjectAltName);
+    const { dnsNames, ipAddresses } = sanExtension
+        ? decodeSubjectAltName(sanExtension.valueDer)
+        : { dnsNames: [], ipAddresses: [] };
+    return {
+        subject,
+        publicKey,
+        subjectPublicKeyInfoDer: cloneBytes(spkiElement.raw),
+        requestedDnsNames: dnsNames,
+        requestedIpAddresses: ipAddresses,
+        requestedExtensions,
+        otherAttributes,
+        signatureAlgorithmOid,
+        signatureDer: cloneBytes(signatureValue.value.subarray(1)),
+        certificationRequestInfoDer: cloneBytes(requestInfo.raw)
+    };
+}
+export async function verifyCertificateSigningRequestSignature(csr) {
+    return verifyDer(csr.publicKey, csr.signatureDer, csr.certificationRequestInfoDer);
+}
+function csrPemToDer(pem) {
+    // RFC 7468 §7 uses "CERTIFICATE REQUEST"; some legacy tools emit "NEW CERTIFICATE REQUEST".
+    const blocks = splitPemBlocks(pem);
+    for (const block of blocks) {
+        const labelMatch = /-----BEGIN (.+?)-----/.exec(block);
+        const label = labelMatch?.[1];
+        if (label === "CERTIFICATE REQUEST" || label === "NEW CERTIFICATE REQUEST") {
+            return pemToDerWithLabel(block, label);
+        }
+    }
+    throw new Error("Invalid CSR PEM: expected CERTIFICATE REQUEST or NEW CERTIFICATE REQUEST block");
+}
+function readAlgorithmOid(algorithm) {
+    const children = readSequenceChildren(algorithm);
+    const oidElement = children[0];
+    if (!oidElement || oidElement.tag !== TAG.OBJECT_IDENTIFIER) {
+        throw new Error("Invalid AlgorithmIdentifier OID");
+    }
+    return decodeOid(oidElement.value);
+}
+function decodeName(nameElement) {
+    if (nameElement.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid Name structure");
+    }
+    const subject = [];
+    for (const rdn of readSequenceChildren(nameElement)) {
+        if (rdn.tag !== TAG.SET) {
+            throw new Error("Invalid RDN (expected SET)");
+        }
+        const attributes = readChildren(rdn.value);
+        if (attributes.length !== 1) {
+            throw new Error("Multi-valued RDNs are not supported");
+        }
+        const attribute = attributes[0];
+        if (attribute.tag !== TAG.SEQUENCE) {
+            throw new Error("Invalid AttributeTypeAndValue");
+        }
+        const [oidElement, valueElement] = readSequenceChildren(attribute);
+        if (!oidElement || !valueElement || oidElement.tag !== TAG.OBJECT_IDENTIFIER) {
+            throw new Error("Invalid AttributeTypeAndValue contents");
+        }
+        const attributeOid = decodeOid(oidElement.value);
+        const decoder = VALUE_DECODERS.get(valueElement.tag);
+        if (!decoder) {
+            throw new Error(`Unsupported AttributeValue string type: tag 0x${valueElement.tag.toString(16)}`);
+        }
+        const value = decoder(valueElement.value);
+        const shortName = SHORT_NAME_BY_OID[attributeOid];
+        subject.push({
+            type: shortName ?? attributeOid,
+            value
+        });
+    }
+    return subject;
+}
+function decodeAttributes(value) {
+    const attributes = [];
+    for (const attribute of readChildren(value)) {
+        if (attribute.tag !== TAG.SEQUENCE) {
+            throw new Error("Invalid CSR attribute");
+        }
+        const children = readSequenceChildren(attribute);
+        const oidElement = children[0];
+        const valuesElement = children[1];
+        if (!oidElement || oidElement.tag !== TAG.OBJECT_IDENTIFIER) {
+            throw new Error("Invalid CSR attribute OID");
+        }
+        if (!valuesElement || valuesElement.tag !== TAG.SET) {
+            throw new Error("Invalid CSR attribute values (expected SET)");
+        }
+        const valuesDer = readChildren(valuesElement.value).map((value) => cloneBytes(value.raw));
+        attributes.push({
+            oid: decodeOid(oidElement.value),
+            valuesDer
+        });
+    }
+    return attributes;
+}
+function decodeRequestedExtensions(valuesDer) {
+    if (valuesDer.length !== 1) {
+        throw new Error("extensionRequest attribute must contain exactly one SEQUENCE OF Extension");
+    }
+    const outer = readElement(valuesDer[0]);
+    if (outer.tag !== TAG.SEQUENCE) {
+        throw new Error("extensionRequest value must be a SEQUENCE OF Extension");
+    }
+    const extensions = [];
+    for (const extension of readSequenceChildren(outer)) {
+        if (extension.tag !== TAG.SEQUENCE) {
+            throw new Error("Invalid Extension");
+        }
+        const children = readSequenceChildren(extension);
+        const oidElement = children[0];
+        if (!oidElement || oidElement.tag !== TAG.OBJECT_IDENTIFIER) {
+            throw new Error("Invalid Extension OID");
+        }
+        let cursor = 1;
+        let critical = false;
+        if (children[cursor]?.tag === TAG.BOOLEAN) {
+            critical = children[cursor].value[0] !== 0;
+            cursor += 1;
+        }
+        const valueElement = children[cursor];
+        if (!valueElement || valueElement.tag !== TAG.OCTET_STRING) {
+            throw new Error("Invalid Extension value");
+        }
+        extensions.push({
+            oid: decodeOid(oidElement.value),
+            critical,
+            valueDer: cloneBytes(valueElement.value)
+        });
+    }
+    return extensions;
+}
+function decodeSubjectAltName(value) {
+    const root = readElement(value);
+    if (root.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid SubjectAltName extension");
+    }
+    const dnsNames = [];
+    const ipAddresses = [];
+    for (const generalName of readChildren(root.value)) {
+        if (generalName.tag === 0x82) {
+            dnsNames.push(decodeAscii(generalName.value, "SAN dNSName"));
+        }
+        else if (generalName.tag === 0x87) {
+            ipAddresses.push(formatIpAddress(generalName.value));
+        }
+    }
+    return { dnsNames, ipAddresses };
+}
+function decodeAscii(bytes, label) {
+    for (const byte of bytes) {
+        if (byte > 0x7f) {
+            throw new Error(`${label} contains a non-ASCII byte`);
+        }
+    }
+    return new TextDecoder("ascii").decode(bytes);
+}
+function formatIpAddress(bytes) {
+    if (bytes.length === 4) {
+        return Array.from(bytes).join(".");
+    }
+    if (bytes.length === 16) {
+        const groups = [];
+        for (let i = 0; i < 16; i += 2) {
+            groups.push(((bytes[i] << 8) | bytes[i + 1]).toString(16));
+        }
+        return compressIpv6(groups);
+    }
+    throw new Error(`Invalid SAN iPAddress length: ${bytes.length}`);
+}
+// RFC 5952: collapse the longest run of consecutive "0" groups (length ≥ 2) into "::".
+function compressIpv6(groups) {
+    let bestStart = -1;
+    let bestLength = 0;
+    let currentStart = -1;
+    let currentLength = 0;
+    for (let i = 0; i < groups.length; i += 1) {
+        if (groups[i] === "0") {
+            if (currentStart === -1) {
+                currentStart = i;
+                currentLength = 0;
+            }
+            currentLength += 1;
+            if (currentLength > bestLength) {
+                bestStart = currentStart;
+                bestLength = currentLength;
+            }
+        }
+        else {
+            currentStart = -1;
+            currentLength = 0;
+        }
+    }
+    if (bestLength < 2) {
+        return groups.join(":");
+    }
+    const head = groups.slice(0, bestStart).join(":");
+    const tail = groups.slice(bestStart + bestLength).join(":");
+    return `${head}::${tail}`;
+}

package/dist/der.d.ts

@@ -31,6 +31,7 @@ export declare function boolean(value: boolean): Uint8Array;
 export declare function integer(value: bigint | number | Uint8Array): Uint8Array;
 export declare function bitString(bytes: Uint8Array, unusedBits?: number): Uint8Array;
 export declare function octetString(bytes: Uint8Array): Uint8Array;
+export declare function nullValue(): Uint8Array;
 export declare function utf8String(value: string): Uint8Array;
 export declare function printableString(value: string): Uint8Array;
 export declare function ia5String(value: string): Uint8Array;

package/dist/der.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"der.d.ts","sourceRoot":"","sources":["../src/der.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,GAAG;;;;;;;;;;;;;;CAcN,CAAC;AAEX,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAE9D;AAED,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,UAAU,EAAE,GAAG,UAAU,CAE9D;AAED,wBAAgB,GAAG,CAAC,GAAG,QAAQ,EAAE,UAAU,EAAE,GAAG,UAAU,CAEzD;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAEzE;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAmB7C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAElD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CA4BvE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,SAAI,GAAG,UAAU,CAMvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAEzD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEpD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAMzD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEnD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAEjF;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAO9C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAMtD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,SAAI,GAAG,UAAU,CAuBrE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,EAAE,CAMtE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE,CAW5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CA4CnD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAevD"}
+{"version":3,"file":"der.d.ts","sourceRoot":"","sources":["../src/der.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,GAAG;;;;;;;;;;;;;;CAcN,CAAC;AAEX,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAE9D;AAED,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,UAAU,EAAE,GAAG,UAAU,CAE9D;AAED,wBAAgB,GAAG,CAAC,GAAG,QAAQ,EAAE,UAAU,EAAE,GAAG,UAAU,CAEzD;AAED,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAEzE;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAmB7C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAElD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CA4BvE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,SAAI,GAAG,UAAU,CAMvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAEzD;AAED,wBAAgB,SAAS,IAAI,UAAU,CAEtC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEpD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAMzD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEnD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAEjF;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAO9C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAMtD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,SAAI,GAAG,UAAU,CAuBrE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,EAAE,CAMtE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE,CAW5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CA4CnD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAevD"}

package/dist/der.js

@@ -79,6 +79,9 @@ export function bitString(bytes, unusedBits = 0) {
 export function octetString(bytes) {
     return der(TAG.OCTET_STRING, bytes);
 }
+export function nullValue() {
+    return new Uint8Array([TAG.NULL, 0x00]);
+}
 export function utf8String(value) {
     return der(TAG.UTF8_STRING, utf8Bytes(value));
 }

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-export { createRootCA, importCertificateAuthority, issueClientCert, issueIntermediateCA } from "./ca.js";
+export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueIntermediateCA } from "./ca.js";
+export { parseCertificateSigningRequest, verifyCertificateSigningRequestSignature, type ParsedCertificateSigningRequest, type CertificateSigningRequestExtension, type CertificateSigningRequestAttribute } from "./csr.js";
 export { pemToDer, certificateToPem } from "./pem.js";
-export { privateKeyToPem, publicKeyToPem } from "./crypto.js";
+export { exportPkcs12, type ExportPkcs12Input } from "./pkcs12.js";
 export { verifyClientCertificateIssuedBy, type VerifyClientCertificateIssuedByOptions, type VerifyClientCertificateValidity } from "./verify.js";
-export type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, SerialNumber, ShortSubjectAttributeType, Subject, SubjectAttribute, SubjectAttributeType } from "./types.js";
+export type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey, SerialNumber, ShortSubjectAttributeType, Subject, SubjectAttribute, SubjectAttributeType } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,+BAA+B,EAC/B,KAAK,sCAAsC,EAC3C,KAAK,+BAA+B,EACrC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACxC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,+BAA+B,EAC/B,KAAK,sCAAsC,EAC3C,KAAK,+BAA+B,EACrC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
-export { createRootCA, importCertificateAuthority, issueClientCert, issueIntermediateCA } from "./ca.js";
+export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueIntermediateCA } from "./ca.js";
+export { parseCertificateSigningRequest, verifyCertificateSigningRequestSignature } from "./csr.js";
 export { pemToDer, certificateToPem } from "./pem.js";
-export { privateKeyToPem, publicKeyToPem } from "./crypto.js";
+export { exportPkcs12 } from "./pkcs12.js";
 export { verifyClientCertificateIssuedBy } from "./verify.js";

package/dist/oids.d.ts

@@ -1,6 +1,12 @@
 import type { ShortSubjectAttributeType } from "./types.js";
 export declare const OID: {
+    readonly ecPublicKey: "1.2.840.10045.2.1";
+    readonly secp256r1: "1.2.840.10045.3.1.7";
+    readonly secp384r1: "1.3.132.0.34";
+    readonly secp521r1: "1.3.132.0.35";
     readonly ecdsaWithSha256: "1.2.840.10045.4.3.2";
+    readonly ecdsaWithSha384: "1.2.840.10045.4.3.3";
+    readonly ecdsaWithSha512: "1.2.840.10045.4.3.4";
     readonly basicConstraints: "2.5.29.19";
     readonly keyUsage: "2.5.29.15";
     readonly extendedKeyUsage: "2.5.29.37";
@@ -8,6 +14,19 @@ export declare const OID: {
     readonly subjectKeyIdentifier: "2.5.29.14";
     readonly authorityKeyIdentifier: "2.5.29.35";
     readonly clientAuth: "1.3.6.1.5.5.7.3.2";
+    readonly extensionRequest: "1.2.840.113549.1.9.14";
+    readonly data: "1.2.840.113549.1.7.1";
+    readonly encryptedData: "1.2.840.113549.1.7.6";
+    readonly friendlyName: "1.2.840.113549.1.9.20";
+    readonly localKeyId: "1.2.840.113549.1.9.21";
+    readonly x509Certificate: "1.2.840.113549.1.9.22.1";
+    readonly certBag: "1.2.840.113549.1.12.10.1.3";
+    readonly pkcs8ShroudedKeyBag: "1.2.840.113549.1.12.10.1.2";
+    readonly pbes2: "1.2.840.113549.1.5.13";
+    readonly pbkdf2: "1.2.840.113549.1.5.12";
+    readonly hmacWithSha256: "1.2.840.113549.2.9";
+    readonly aes256Cbc: "2.16.840.1.101.3.4.1.42";
+    readonly sha256: "2.16.840.1.101.3.4.2.1";
 };
 export declare const SUBJECT_ATTRIBUTE_OIDS: Record<ShortSubjectAttributeType, string>;
 export declare const SUBJECT_VALUE_LENGTH_LIMITS: Record<ShortSubjectAttributeType, number>;

package/dist/oids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oids.d.ts","sourceRoot":"","sources":["../src/oids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,GAAG;;;;;;;;;CASN,CAAC;AAEX,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgB5E,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgBjF,CAAC;AAIF,eAAO,MAAM,wBAAwB,MAAM,CAAC"}
+{"version":3,"file":"oids.d.ts","sourceRoot":"","sources":["../src/oids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BN,CAAC;AAEX,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgB5E,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgBjF,CAAC;AAIF,eAAO,MAAM,wBAAwB,MAAM,CAAC"}

package/dist/oids.js

@@ -1,12 +1,31 @@
 export const OID = {
+    ecPublicKey: "1.2.840.10045.2.1",
+    secp256r1: "1.2.840.10045.3.1.7",
+    secp384r1: "1.3.132.0.34",
+    secp521r1: "1.3.132.0.35",
     ecdsaWithSha256: "1.2.840.10045.4.3.2",
+    ecdsaWithSha384: "1.2.840.10045.4.3.3",
+    ecdsaWithSha512: "1.2.840.10045.4.3.4",
     basicConstraints: "2.5.29.19",
     keyUsage: "2.5.29.15",
     extendedKeyUsage: "2.5.29.37",
     subjectAltName: "2.5.29.17",
     subjectKeyIdentifier: "2.5.29.14",
     authorityKeyIdentifier: "2.5.29.35",
-    clientAuth: "1.3.6.1.5.5.7.3.2"
+    clientAuth: "1.3.6.1.5.5.7.3.2",
+    extensionRequest: "1.2.840.113549.1.9.14",
+    data: "1.2.840.113549.1.7.1",
+    encryptedData: "1.2.840.113549.1.7.6",
+    friendlyName: "1.2.840.113549.1.9.20",
+    localKeyId: "1.2.840.113549.1.9.21",
+    x509Certificate: "1.2.840.113549.1.9.22.1",
+    certBag: "1.2.840.113549.1.12.10.1.3",
+    pkcs8ShroudedKeyBag: "1.2.840.113549.1.12.10.1.2",
+    pbes2: "1.2.840.113549.1.5.13",
+    pbkdf2: "1.2.840.113549.1.5.12",
+    hmacWithSha256: "1.2.840.113549.2.9",
+    aes256Cbc: "2.16.840.1.101.3.4.1.42",
+    sha256: "2.16.840.1.101.3.4.2.1"
 };
 export const SUBJECT_ATTRIBUTE_OIDS = {
     CN: "2.5.4.3",

package/dist/pem.d.ts

@@ -1,6 +1,4 @@
 export declare function certificateToPem(der: Uint8Array): string;
-export declare function privateKeyDerToPem(der: Uint8Array): string;
-export declare function publicKeyDerToPem(der: Uint8Array): string;
 export declare function pemToDer(pem: string): Uint8Array;
 export declare function pemToDerWithLabel(pem: string, label: string): Uint8Array;
 export declare function splitPemBlocks(pem: string): string[];

package/dist/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../src/pem.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAExD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAEzD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAWhD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAaxE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../src/pem.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAExD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAWhD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAaxE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD"}

package/dist/pem.js

@@ -3,12 +3,6 @@ const PEM_LINE_LENGTH = 64;
 export function certificateToPem(der) {
     return encodePem("CERTIFICATE", der);
 }
-export function privateKeyDerToPem(der) {
-    return encodePem("PRIVATE KEY", der);
-}
-export function publicKeyDerToPem(der) {
-    return encodePem("PUBLIC KEY", der);
-}
 export function pemToDer(pem) {
     const match = /-----BEGIN (.+?)-----([\s\S]*?)-----END \1-----/.exec(pem);
     if (!match || !match[2]) {

package/dist/pkcs12.d.ts

@@ -0,0 +1,11 @@
+export interface ExportPkcs12Input {
+    certDer: Uint8Array;
+    chainDer?: Uint8Array[];
+    privateKey: CryptoKey;
+    password: Uint8Array;
+    friendlyName?: Uint8Array;
+    iterations?: number;
+    macIterations?: number;
+}
+export declare function exportPkcs12(input: ExportPkcs12Input): Promise<Uint8Array>;
+//# sourceMappingURL=pkcs12.d.ts.map

package/dist/pkcs12.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkcs12.d.ts","sourceRoot":"","sources":["../src/pkcs12.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,UAAU,CAAC;IACrB,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA8FhF"}