@ohos-ports/react-native-quick-crypto 0.0.0-stage → 1.1.8-beta.0

package/lib/module/utils/hashnames.js

@@ -0,0 +1,120 @@
+"use strict";
+
+export let HashContext = /*#__PURE__*/function (HashContext) {
+  HashContext[HashContext["Node"] = 0] = "Node";
+  HashContext[HashContext["WebCrypto"] = 1] = "WebCrypto";
+  HashContext[HashContext["JwkRsa"] = 2] = "JwkRsa";
+  HashContext[HashContext["JwkRsaPss"] = 3] = "JwkRsaPss";
+  HashContext[HashContext["JwkRsaOaep"] = 4] = "JwkRsaOaep";
+  HashContext[HashContext["JwkHmac"] = 5] = "JwkHmac";
+  return HashContext;
+}({});
+
+// WebCrypto and JWK use a bunch of different names for the
+// standard set of SHA-* digest algorithms... which is ... fun.
+// Here we provide a utility for mapping between them in order
+// make it easier in the code.
+
+const kHashNames = {
+  sha1: {
+    [HashContext.Node]: 'sha1',
+    [HashContext.WebCrypto]: 'SHA-1',
+    [HashContext.JwkRsa]: 'RS1',
+    [HashContext.JwkRsaPss]: 'PS1',
+    [HashContext.JwkRsaOaep]: 'RSA-OAEP',
+    [HashContext.JwkHmac]: 'HS1'
+  },
+  sha224: {
+    [HashContext.Node]: 'sha224',
+    [HashContext.WebCrypto]: 'SHA-224',
+    [HashContext.JwkRsa]: 'RS224',
+    [HashContext.JwkRsaPss]: 'PS224',
+    [HashContext.JwkRsaOaep]: 'RSA-OAEP-224',
+    [HashContext.JwkHmac]: 'HS224'
+  },
+  sha256: {
+    [HashContext.Node]: 'sha256',
+    [HashContext.WebCrypto]: 'SHA-256',
+    [HashContext.JwkRsa]: 'RS256',
+    [HashContext.JwkRsaPss]: 'PS256',
+    [HashContext.JwkRsaOaep]: 'RSA-OAEP-256',
+    [HashContext.JwkHmac]: 'HS256'
+  },
+  sha384: {
+    [HashContext.Node]: 'sha384',
+    [HashContext.WebCrypto]: 'SHA-384',
+    [HashContext.JwkRsa]: 'RS384',
+    [HashContext.JwkRsaPss]: 'PS384',
+    [HashContext.JwkRsaOaep]: 'RSA-OAEP-384',
+    [HashContext.JwkHmac]: 'HS384'
+  },
+  sha512: {
+    [HashContext.Node]: 'sha512',
+    [HashContext.WebCrypto]: 'SHA-512',
+    [HashContext.JwkRsa]: 'RS512',
+    [HashContext.JwkRsaPss]: 'PS512',
+    [HashContext.JwkRsaOaep]: 'RSA-OAEP-512',
+    [HashContext.JwkHmac]: 'HS512'
+  },
+  ripemd160: {
+    [HashContext.Node]: 'ripemd160',
+    [HashContext.WebCrypto]: 'RIPEMD-160'
+  },
+  'sha3-256': {
+    [HashContext.Node]: 'sha3-256',
+    [HashContext.WebCrypto]: 'SHA3-256'
+  },
+  'sha3-384': {
+    [HashContext.Node]: 'sha3-384',
+    [HashContext.WebCrypto]: 'SHA3-384'
+  },
+  'sha3-512': {
+    [HashContext.Node]: 'sha3-512',
+    [HashContext.WebCrypto]: 'SHA3-512'
+  },
+  shake128: {
+    [HashContext.Node]: 'shake128',
+    [HashContext.WebCrypto]: 'cSHAKE128'
+  },
+  shake256: {
+    [HashContext.Node]: 'shake256',
+    [HashContext.WebCrypto]: 'cSHAKE256'
+  }
+};
+{
+  // Index the aliases
+  const keys = Object.keys(kHashNames);
+  for (let n = 0; n < keys.length; n++) {
+    const contexts = Object.keys(kHashNames[keys[n]]);
+    for (let i = 0; i < contexts.length; i++) {
+      const alias = kHashNames[keys[n]][contexts[i]].toLowerCase();
+      if (kHashNames[alias] === undefined) kHashNames[alias] = kHashNames[keys[n]];
+    }
+  }
+
+  // Add OpenSSL legacy RSA-* aliases (e.g. RSA-SHA256 -> sha256)
+  for (let n = 0; n < keys.length; n++) {
+    const key = keys[n];
+    if (key.startsWith('sha') || key === 'ripemd160') {
+      const rsaAlias = 'rsa-' + key;
+      if (kHashNames[rsaAlias] === undefined) {
+        kHashNames[rsaAlias] = kHashNames[key];
+      }
+    }
+  }
+}
+export function normalizeHashName(algo, context = HashContext.Node) {
+  if (typeof algo !== 'undefined') {
+    const hashName = typeof algo === 'string' ? algo : algo.name || algo.toString();
+    const normAlgo = hashName.toLowerCase();
+    try {
+      const alias = kHashNames[normAlgo][context];
+      if (alias) return alias;
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    } catch (_e) {
+      // ignore
+    }
+  }
+  throw new Error(`Invalid Hash Algorithm: ${algo}`);
+}
+//# sourceMappingURL=hashnames.js.map

package/lib/module/utils/hashnames.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["HashContext","kHashNames","sha1","Node","WebCrypto","JwkRsa","JwkRsaPss","JwkRsaOaep","JwkHmac","sha224","sha256","sha384","sha512","ripemd160","shake128","shake256","keys","Object","n","length","contexts","i","alias","toLowerCase","undefined","key","startsWith","rsaAlias","normalizeHashName","algo","context","hashName","name","toString","normAlgo","_e","Error"],"sourceRoot":"../../../src","sources":["utils/hashnames.ts"],"mappings":";;AAEA,WAAYA,WAAW,0BAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAA,OAAXA,WAAW;AAAA;;AASvB;AACA;AACA;AACA;;AAMA,MAAMC,UAAqB,GAAG;EAC5BC,IAAI,EAAE;IACJ,CAACF,WAAW,CAACG,IAAI,GAAG,MAAM;IAC1B,CAACH,WAAW,CAACI,SAAS,GAAG,OAAO;IAChC,CAACJ,WAAW,CAACK,MAAM,GAAG,KAAK;IAC3B,CAACL,WAAW,CAACM,SAAS,GAAG,KAAK;IAC9B,CAACN,WAAW,CAACO,UAAU,GAAG,UAAU;IACpC,CAACP,WAAW,CAACQ,OAAO,GAAG;EACzB,CAAC;EACDC,MAAM,EAAE;IACN,CAACT,WAAW,CAACG,IAAI,GAAG,QAAQ;IAC5B,CAACH,WAAW,CAACI,SAAS,GAAG,SAAS;IAClC,CAACJ,WAAW,CAACK,MAAM,GAAG,OAAO;IAC7B,CAACL,WAAW,CAACM,SAAS,GAAG,OAAO;IAChC,CAACN,WAAW,CAACO,UAAU,GAAG,cAAc;IACxC,CAACP,WAAW,CAACQ,OAAO,GAAG;EACzB,CAAC;EACDE,MAAM,EAAE;IACN,CAACV,WAAW,CAACG,IAAI,GAAG,QAAQ;IAC5B,CAACH,WAAW,CAACI,SAAS,GAAG,SAAS;IAClC,CAACJ,WAAW,CAACK,MAAM,GAAG,OAAO;IAC7B,CAACL,WAAW,CAACM,SAAS,GAAG,OAAO;IAChC,CAACN,WAAW,CAACO,UAAU,GAAG,cAAc;IACxC,CAACP,WAAW,CAACQ,OAAO,GAAG;EACzB,CAAC;EACDG,MAAM,EAAE;IACN,CAACX,WAAW,CAACG,IAAI,GAAG,QAAQ;IAC5B,CAACH,WAAW,CAACI,SAAS,GAAG,SAAS;IAClC,CAACJ,WAAW,CAACK,MAAM,GAAG,OAAO;IAC7B,CAACL,WAAW,CAACM,SAAS,GAAG,OAAO;IAChC,CAACN,WAAW,CAACO,UAAU,GAAG,cAAc;IACxC,CAACP,WAAW,CAACQ,OAAO,GAAG;EACzB,CAAC;EACDI,MAAM,EAAE;IACN,CAACZ,WAAW,CAACG,IAAI,GAAG,QAAQ;IAC5B,CAACH,WAAW,CAACI,SAAS,GAAG,SAAS;IAClC,CAACJ,WAAW,CAACK,MAAM,GAAG,OAAO;IAC7B,CAACL,WAAW,CAACM,SAAS,GAAG,OAAO;IAChC,CAACN,WAAW,CAACO,UAAU,GAAG,cAAc;IACxC,CAACP,WAAW,CAACQ,OAAO,GAAG;EACzB,CAAC;EACDK,SAAS,EAAE;IACT,CAACb,WAAW,CAACG,IAAI,GAAG,WAAW;IAC/B,CAACH,WAAW,CAACI,SAAS,GAAG;EAC3B,CAAC;EACD,UAAU,EAAE;IACV,CAACJ,WAAW,CAACG,IAAI,GAAG,UAAU;IAC9B,CAACH,WAAW,CAACI,SAAS,GAAG;EAC3B,CAAC;EACD,UAAU,EAAE;IACV,CAACJ,WAAW,CAACG,IAAI,GAAG,UAAU;IAC9B,CAACH,WAAW,CAACI,SAAS,GAAG;EAC3B,CAAC;EACD,UAAU,EAAE;IACV,CAACJ,WAAW,CAACG,IAAI,GAAG,UAAU;IAC9B,CAACH,WAAW,CAACI,SAAS,GAAG;EAC3B,CAAC;EACDU,QAAQ,EAAE;IACR,CAACd,WAAW,CAACG,IAAI,GAAG,UAAU;IAC9B,CAACH,WAAW,CAACI,SAAS,GAAG;EAC3B,CAAC;EACDW,QAAQ,EAAE;IACR,CAACf,WAAW,CAACG,IAAI,GAAG,UAAU;IAC9B,CAACH,WAAW,CAACI,SAAS,GAAG;EAC3B;AACF,CAAC;AAED;EACE;EACA,MAAMY,IAAc,GAAGC,MAAM,CAACD,IAAI,CAACf,UAAU,CAAC;EAC9C,KAAK,IAAIiB,CAAS,GAAG,CAAC,EAAEA,CAAC,GAAGF,IAAI,CAACG,MAAM,EAAED,CAAC,EAAE,EAAE;IAC5C,MAAME,QAAkB,GAAGH,MAAM,CAACD,IAAI,CAACf,UAAU,CAACe,IAAI,CAACE,CAAC,CAAC,CAAG,CAAC;IAC7D,KAAK,IAAIG,CAAS,GAAG,CAAC,EAAEA,CAAC,GAAGD,QAAQ,CAACD,MAAM,EAAEE,CAAC,EAAE,EAAE;MAChD,MAAMC,KAAa,GAAGrB,UAAU,CAACe,IAAI,CAACE,CAAC,CAAC,CAAE,CAAEE,QAAQ,CAACC,CAAC,CAAC,CAAE,CAAEE,WAAW,CAAC,CAAC;MACxE,IAAItB,UAAU,CAACqB,KAAK,CAAC,KAAKE,SAAS,EACjCvB,UAAU,CAACqB,KAAK,CAAC,GAAGrB,UAAU,CAACe,IAAI,CAACE,CAAC,CAAC,CAAG;IAC7C;EACF;;EAEA;EACA,KAAK,IAAIA,CAAS,GAAG,CAAC,EAAEA,CAAC,GAAGF,IAAI,CAACG,MAAM,EAAED,CAAC,EAAE,EAAE;IAC5C,MAAMO,GAAG,GAAGT,IAAI,CAACE,CAAC,CAAE;IACpB,IAAIO,GAAG,CAACC,UAAU,CAAC,KAAK,CAAC,IAAID,GAAG,KAAK,WAAW,EAAE;MAChD,MAAME,QAAQ,GAAG,MAAM,GAAGF,GAAG;MAC7B,IAAIxB,UAAU,CAAC0B,QAAQ,CAAC,KAAKH,SAAS,EAAE;QACtCvB,UAAU,CAAC0B,QAAQ,CAAC,GAAG1B,UAAU,CAACwB,GAAG,CAAE;MACzC;IACF;EACF;AACF;AAEA,OAAO,SAASG,iBAAiBA,CAC/BC,IAA2D,EAC3DC,OAAoB,GAAG9B,WAAW,CAACG,IAAI,EAC/B;EACR,IAAI,OAAO0B,IAAI,KAAK,WAAW,EAAE;IAC/B,MAAME,QAAQ,GACZ,OAAOF,IAAI,KAAK,QAAQ,GAAGA,IAAI,GAAGA,IAAI,CAACG,IAAI,IAAIH,IAAI,CAACI,QAAQ,CAAC,CAAC;IAChE,MAAMC,QAAQ,GAAGH,QAAQ,CAACR,WAAW,CAAC,CAAC;IACvC,IAAI;MACF,MAAMD,KAAK,GAAGrB,UAAU,CAACiC,QAAQ,CAAC,CAAEJ,OAAO,CAAC;MAC5C,IAAIR,KAAK,EAAE,OAAOA,KAAK;MACvB;IACF,CAAC,CAAC,OAAOa,EAAE,EAAE;MACX;IAAA;EAEJ;EACA,MAAM,IAAIC,KAAK,CAAC,2BAA2BP,IAAI,EAAE,CAAC;AACpD","ignoreList":[]}

package/lib/module/utils/index.js

@@ -0,0 +1,10 @@
+"use strict";
+
+export * from './conversion';
+export * from './errors';
+export * from './hashnames';
+export * from './timingSafeEqual';
+export * from './types';
+export * from './validation';
+export * from './cipher';
+//# sourceMappingURL=index.js.map

package/lib/module/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../src","sources":["utils/index.ts"],"mappings":";;AAAA,cAAc,cAAc;AAC5B,cAAc,UAAU;AACxB,cAAc,aAAa;AAC3B,cAAc,mBAAmB;AACjC,cAAc,SAAS;AACvB,cAAc,cAAc;AAC5B,cAAc,UAAU","ignoreList":[]}

package/lib/module/utils/noble.js

@@ -0,0 +1,76 @@
+"use strict";
+
+/**
+ * Takes hex string or Uint8Array, converts to Uint8Array.
+ * Validates output length.
+ * Will throw error for other types.
+ * @param title descriptive title for an error e.g. 'private key'
+ * @param hex hex string or Uint8Array
+ * @param expectedLength optional, will compare to result array's length
+ * @returns
+ */
+export function ensureBytes(title, hex, expectedLength) {
+  let res;
+  if (typeof hex === 'string') {
+    try {
+      res = hexToBytes(hex);
+    } catch (e) {
+      throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);
+    }
+  } else if (isBytes(hex)) {
+    // Uint8Array.from() instead of hash.slice() because node.js Buffer
+    // is instance of Uint8Array, and its slice() creates **mutable** copy
+    res = Uint8Array.from(hex);
+  } else {
+    throw new Error(title + ' must be hex string or Uint8Array');
+  }
+  const len = res.length;
+  if (typeof expectedLength === 'number' && len !== expectedLength) throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);
+  return res;
+}
+
+/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+export function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array';
+}
+
+// We use optimized technique to convert hex string to byte array
+const asciis = {
+  _0: 48,
+  _9: 57,
+  A: 65,
+  F: 70,
+  a: 97,
+  f: 102
+};
+function asciiToBase16(ch) {
+  if (ch >= asciis._0 && ch <= asciis._9) return ch - asciis._0; // '2' => 50-48
+  if (ch >= asciis.A && ch <= asciis.F) return ch - (asciis.A - 10); // 'B' => 66-(65-10)
+  if (ch >= asciis.a && ch <= asciis.f) return ch - (asciis.a - 10); // 'b' => 98-(97-10)
+  return;
+}
+
+/**
+ * Convert hex string to byte array. Uses built-in function, when available.
+ * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])
+ */
+export function hexToBytes(hex) {
+  if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex);
+  // @ts-expect-error Uint8Array.fromHex
+  if (hasHexBuiltin) return Uint8Array.fromHex(hex);
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2) throw new Error('hex string expected, got unpadded hex of length ' + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === undefined || n2 === undefined) {
+      const char = hex.substring(hi, hi + 2);
+      throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163
+  }
+  return array;
+}
+//# sourceMappingURL=noble.js.map

package/lib/module/utils/noble.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ensureBytes","title","hex","expectedLength","res","hexToBytes","e","Error","isBytes","Uint8Array","from","len","length","a","ArrayBuffer","isView","constructor","name","asciis","_0","_9","A","F","f","asciiToBase16","ch","hasHexBuiltin","fromHex","hl","al","array","ai","hi","n1","charCodeAt","n2","undefined","char","substring"],"sourceRoot":"../../../src","sources":["utils/noble.ts"],"mappings":";;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,WAAWA,CACzBC,KAAa,EACbC,GAAQ,EACRC,cAAuB,EACX;EACZ,IAAIC,GAAe;EACnB,IAAI,OAAOF,GAAG,KAAK,QAAQ,EAAE;IAC3B,IAAI;MACFE,GAAG,GAAGC,UAAU,CAACH,GAAG,CAAC;IACvB,CAAC,CAAC,OAAOI,CAAC,EAAE;MACV,MAAM,IAAIC,KAAK,CAACN,KAAK,GAAG,4CAA4C,GAAGK,CAAC,CAAC;IAC3E;EACF,CAAC,MAAM,IAAIE,OAAO,CAACN,GAAG,CAAC,EAAE;IACvB;IACA;IACAE,GAAG,GAAGK,UAAU,CAACC,IAAI,CAACR,GAAG,CAAC;EAC5B,CAAC,MAAM;IACL,MAAM,IAAIK,KAAK,CAACN,KAAK,GAAG,mCAAmC,CAAC;EAC9D;EACA,MAAMU,GAAG,GAAGP,GAAG,CAACQ,MAAM;EACtB,IAAI,OAAOT,cAAc,KAAK,QAAQ,IAAIQ,GAAG,KAAKR,cAAc,EAC9D,MAAM,IAAII,KAAK,CACbN,KAAK,GAAG,aAAa,GAAGE,cAAc,GAAG,iBAAiB,GAAGQ,GAC/D,CAAC;EACH,OAAOP,GAAG;AACZ;;AAEA;AACA,OAAO,SAASI,OAAOA,CAACK,CAAU,EAAmB;EACnD,OACEA,CAAC,YAAYJ,UAAU,IACtBK,WAAW,CAACC,MAAM,CAACF,CAAC,CAAC,IAAIA,CAAC,CAACG,WAAW,CAACC,IAAI,KAAK,YAAa;AAElE;;AAEA;AACA,MAAMC,MAAM,GAAG;EAAEC,EAAE,EAAE,EAAE;EAAEC,EAAE,EAAE,EAAE;EAAEC,CAAC,EAAE,EAAE;EAAEC,CAAC,EAAE,EAAE;EAAET,CAAC,EAAE,EAAE;EAAEU,CAAC,EAAE;AAAI,CAAU;AACvE,SAASC,aAAaA,CAACC,EAAU,EAAsB;EACrD,IAAIA,EAAE,IAAIP,MAAM,CAACC,EAAE,IAAIM,EAAE,IAAIP,MAAM,CAACE,EAAE,EAAE,OAAOK,EAAE,GAAGP,MAAM,CAACC,EAAE,CAAC,CAAC;EAC/D,IAAIM,EAAE,IAAIP,MAAM,CAACG,CAAC,IAAII,EAAE,IAAIP,MAAM,CAACI,CAAC,EAAE,OAAOG,EAAE,IAAIP,MAAM,CAACG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;EACnE,IAAII,EAAE,IAAIP,MAAM,CAACL,CAAC,IAAIY,EAAE,IAAIP,MAAM,CAACK,CAAC,EAAE,OAAOE,EAAE,IAAIP,MAAM,CAACL,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;EACnE;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASR,UAAUA,CAACH,GAAW,EAAc;EAClD,IAAI,OAAOA,GAAG,KAAK,QAAQ,EACzB,MAAM,IAAIK,KAAK,CAAC,2BAA2B,GAAG,OAAOL,GAAG,CAAC;EAC3D;EACA,IAAIwB,aAAa,EAAE,OAAOjB,UAAU,CAACkB,OAAO,CAACzB,GAAG,CAAC;EACjD,MAAM0B,EAAE,GAAG1B,GAAG,CAACU,MAAM;EACrB,MAAMiB,EAAE,GAAGD,EAAE,GAAG,CAAC;EACjB,IAAIA,EAAE,GAAG,CAAC,EACR,MAAM,IAAIrB,KAAK,CAAC,kDAAkD,GAAGqB,EAAE,CAAC;EAC1E,MAAME,KAAK,GAAG,IAAIrB,UAAU,CAACoB,EAAE,CAAC;EAChC,KAAK,IAAIE,EAAE,GAAG,CAAC,EAAEC,EAAE,GAAG,CAAC,EAAED,EAAE,GAAGF,EAAE,EAAEE,EAAE,EAAE,EAAEC,EAAE,IAAI,CAAC,EAAE;IAC/C,MAAMC,EAAE,GAAGT,aAAa,CAACtB,GAAG,CAACgC,UAAU,CAACF,EAAE,CAAC,CAAC;IAC5C,MAAMG,EAAE,GAAGX,aAAa,CAACtB,GAAG,CAACgC,UAAU,CAACF,EAAE,GAAG,CAAC,CAAC,CAAC;IAChD,IAAIC,EAAE,KAAKG,SAAS,IAAID,EAAE,KAAKC,SAAS,EAAE;MACxC,MAAMC,IAAI,GAAGnC,GAAG,CAACoC,SAAS,CAACN,EAAE,EAAEA,EAAE,GAAG,CAAC,CAAC;MACtC,MAAM,IAAIzB,KAAK,CACb,8CAA8C,GAC5C8B,IAAI,GACJ,aAAa,GACbL,EACJ,CAAC;IACH;IACAF,KAAK,CAACC,EAAE,CAAC,GAAGE,EAAE,GAAG,EAAE,GAAGE,EAAE,CAAC,CAAC;EAC5B;EACA,OAAOL,KAAK;AACd","ignoreList":[]}

package/lib/module/utils/timingSafeEqual.js

@@ -0,0 +1,25 @@
+"use strict";
+
+import { NitroModules } from 'react-native-nitro-modules';
+import { binaryLikeToArrayBuffer } from './conversion';
+let utils;
+function getNative() {
+  if (utils == null) {
+    utils = NitroModules.createHybridObject('Utils');
+  }
+  return utils;
+}
+export function timingSafeEqual(a, b) {
+  // Use binaryLikeToArrayBuffer (not abvToArrayBuffer) so that TypedArray /
+  // Buffer views are sliced to their `byteOffset`/`byteLength` window. The
+  // zero-copy `abvToArrayBuffer` returns the entire backing buffer, which
+  // would (a) compare unrelated bytes and (b) silently fail the byte-length
+  // check for any view smaller than its backing.
+  const bufA = binaryLikeToArrayBuffer(a);
+  const bufB = binaryLikeToArrayBuffer(b);
+  if (bufA.byteLength !== bufB.byteLength) {
+    throw new RangeError('Input buffers must have the same byte length');
+  }
+  return getNative().timingSafeEqual(bufA, bufB);
+}
+//# sourceMappingURL=timingSafeEqual.js.map

package/lib/module/utils/timingSafeEqual.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["NitroModules","binaryLikeToArrayBuffer","utils","getNative","createHybridObject","timingSafeEqual","a","b","bufA","bufB","byteLength","RangeError"],"sourceRoot":"../../../src","sources":["utils/timingSafeEqual.ts"],"mappings":";;AAAA,SAASA,YAAY,QAAQ,4BAA4B;AAGzD,SAASC,uBAAuB,QAAQ,cAAc;AAEtD,IAAIC,KAAY;AAChB,SAASC,SAASA,CAAA,EAAU;EAC1B,IAAID,KAAK,IAAI,IAAI,EAAE;IACjBA,KAAK,GAAGF,YAAY,CAACI,kBAAkB,CAAQ,OAAO,CAAC;EACzD;EACA,OAAOF,KAAK;AACd;AAEA,OAAO,SAASG,eAAeA,CAACC,CAAM,EAAEC,CAAM,EAAW;EACvD;EACA;EACA;EACA;EACA;EACA,MAAMC,IAAI,GAAGP,uBAAuB,CAACK,CAAC,CAAC;EACvC,MAAMG,IAAI,GAAGR,uBAAuB,CAACM,CAAC,CAAC;EAEvC,IAAIC,IAAI,CAACE,UAAU,KAAKD,IAAI,CAACC,UAAU,EAAE;IACvC,MAAM,IAAIC,UAAU,CAAC,8CAA8C,CAAC;EACtE;EAEA,OAAOR,SAAS,CAAC,CAAC,CAACE,eAAe,CAACG,IAAI,EAAEC,IAAI,CAAC;AAChD","ignoreList":[]}

package/lib/module/utils/types.js

@@ -0,0 +1,57 @@
+"use strict";
+
+// @types/node
+
+// Node.js style key pair types (lowercase)
+
+// TODO: These enums need to be defined on the native side
+export let KFormatType = /*#__PURE__*/function (KFormatType) {
+  KFormatType[KFormatType["DER"] = 0] = "DER";
+  KFormatType[KFormatType["PEM"] = 1] = "PEM";
+  KFormatType[KFormatType["JWK"] = 2] = "JWK";
+  return KFormatType;
+}({});
+export let KeyType = /*#__PURE__*/function (KeyType) {
+  KeyType[KeyType["SECRET"] = 0] = "SECRET";
+  KeyType[KeyType["PUBLIC"] = 1] = "PUBLIC";
+  KeyType[KeyType["PRIVATE"] = 2] = "PRIVATE";
+  return KeyType;
+}({});
+export let KeyEncoding = /*#__PURE__*/function (KeyEncoding) {
+  KeyEncoding[KeyEncoding["PKCS1"] = 0] = "PKCS1";
+  KeyEncoding[KeyEncoding["PKCS8"] = 1] = "PKCS8";
+  KeyEncoding[KeyEncoding["SPKI"] = 2] = "SPKI";
+  KeyEncoding[KeyEncoding["SEC1"] = 3] = "SEC1";
+  return KeyEncoding;
+}({});
+export let KeyFormat = /*#__PURE__*/function (KeyFormat) {
+  KeyFormat[KeyFormat["RAW"] = 0] = "RAW";
+  KeyFormat[KeyFormat["PKCS8"] = 1] = "PKCS8";
+  KeyFormat[KeyFormat["SPKI"] = 2] = "SPKI";
+  KeyFormat[KeyFormat["JWK"] = 3] = "JWK";
+  return KeyFormat;
+}({});
+export const kNamedCurveAliases = {
+  'P-256': 'prime256v1',
+  'P-384': 'secp384r1',
+  'P-521': 'secp521r1'
+};
+// end TODO
+
+export let KeyVariant = /*#__PURE__*/function (KeyVariant) {
+  KeyVariant[KeyVariant["RSA_SSA_PKCS1_v1_5"] = 0] = "RSA_SSA_PKCS1_v1_5";
+  KeyVariant[KeyVariant["RSA_PSS"] = 1] = "RSA_PSS";
+  KeyVariant[KeyVariant["RSA_OAEP"] = 2] = "RSA_OAEP";
+  KeyVariant[KeyVariant["DSA"] = 3] = "DSA";
+  KeyVariant[KeyVariant["EC"] = 4] = "EC";
+  KeyVariant[KeyVariant["NID"] = 5] = "NID";
+  KeyVariant[KeyVariant["DH"] = 6] = "DH";
+  return KeyVariant;
+}({});
+
+// These are for shortcomings in @types/node
+// Here we use "*Type" instead of "*Types" like node does.
+// export type CipherCBCType = 'aes-128-cbc' | 'aes-192-cbc' | 'aes-256-cbc';
+
+// from @paulmillr/noble-curves
+//# sourceMappingURL=types.js.map

package/lib/module/utils/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["KFormatType","KeyType","KeyEncoding","KeyFormat","kNamedCurveAliases","KeyVariant"],"sourceRoot":"../../../src","sources":["utils/types.ts"],"mappings":";;AAE8C;;AAkI9C;;AAyLA;AACA,WAAYA,WAAW,0BAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAA,OAAXA,WAAW;AAAA;AAMvB,WAAYC,OAAO,0BAAPA,OAAO;EAAPA,OAAO,CAAPA,OAAO;EAAPA,OAAO,CAAPA,OAAO;EAAPA,OAAO,CAAPA,OAAO;EAAA,OAAPA,OAAO;AAAA;AAMnB,WAAYC,WAAW,0BAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAXA,WAAW,CAAXA,WAAW;EAAA,OAAXA,WAAW;AAAA;AAOvB,WAAYC,SAAS,0BAATA,SAAS;EAATA,SAAS,CAATA,SAAS;EAATA,SAAS,CAATA,SAAS;EAATA,SAAS,CAATA,SAAS;EAATA,SAAS,CAATA,SAAS;EAAA,OAATA,SAAS;AAAA;AASrB,OAAO,MAAMC,kBAAkB,GAAG;EAChC,OAAO,EAAE,YAAY;EACrB,OAAO,EAAE,WAAW;EACpB,OAAO,EAAE;AACX,CAAU;AACV;;AA0JA,WAAYC,UAAU,0BAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAVA,UAAU,CAAVA,UAAU;EAAA,OAAVA,UAAU;AAAA;;AAuBtB;AACA;AACA;;AA4CA","ignoreList":[]}

package/lib/module/utils/validation.js

@@ -0,0 +1,131 @@
+"use strict";
+
+import { Buffer as SBuffer } from 'safe-buffer';
+import { lazyDOMException } from './errors';
+
+// The maximum buffer size that we'll support in the WebCrypto impl
+const kMaxBufferLength = 2 ** 31 - 1;
+export function validateFunction(f) {
+  return f !== null && typeof f === 'function';
+}
+export function isStringOrBuffer(val) {
+  return typeof val === 'string' || ArrayBuffer.isView(val) || val instanceof ArrayBuffer;
+}
+export function validateObject(value, name, options) {
+  const useDefaultOptions = options == null;
+  const allowArray = useDefaultOptions ? false : options.allowArray;
+  const allowFunction = useDefaultOptions ? false : options.allowFunction;
+  const nullable = useDefaultOptions ? false : options.nullable;
+  if (!nullable && value === null || !allowArray && Array.isArray(value) || typeof value !== 'object' && (!allowFunction || typeof value !== 'function')) {
+    throw new Error(`${name} is not a valid object ${value}`);
+  }
+  return true;
+}
+export const validateMaxBufferLength = (data, name) => {
+  const length = typeof data === 'string' || data instanceof SBuffer ? data.length : data.byteLength;
+  if (length > kMaxBufferLength) {
+    throw lazyDOMException(`${name} must be less than ${kMaxBufferLength + 1} bits`, 'OperationError');
+  }
+};
+
+// Returns the intersection of `usageSet` and the spread `usages`, preserving
+// the spread order. Dedup and canonical ordering are not performed here —
+// the `CryptoKey` constructor runs `getSortedUsages` on every input.
+export const getUsagesUnion = (usageSet, ...usages) => {
+  const newset = [];
+  for (let n = 0; n < usages.length; n++) {
+    if (!usages[n] || usages[n] === undefined) continue;
+    if (usageSet.includes(usages[n])) newset.push(usages[n]);
+  }
+  return newset;
+};
+const kCanonicalUsageOrder = ['encrypt', 'decrypt', 'sign', 'verify', 'deriveKey', 'deriveBits', 'wrapKey', 'unwrapKey', 'encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits'];
+export function getSortedUsages(usages) {
+  const set = new Set(usages);
+  return kCanonicalUsageOrder.filter(usage => set.has(usage));
+}
+const kKeyOps = {
+  sign: 1,
+  verify: 2,
+  encrypt: 3,
+  decrypt: 4,
+  wrapKey: 5,
+  unwrapKey: 6,
+  deriveKey: 7,
+  deriveBits: 8,
+  encapsulateBits: 9,
+  decapsulateBits: 10,
+  encapsulateKey: 11,
+  decapsulateKey: 12
+};
+export const validateKeyOps = (keyOps, usagesSet) => {
+  if (keyOps === undefined) return;
+  if (!Array.isArray(keyOps)) {
+    throw lazyDOMException('keyData.key_ops', 'InvalidArgument');
+  }
+  let flags = 0;
+  for (let n = 0; n < keyOps.length; n++) {
+    const op = keyOps[n];
+    const op_flag = kKeyOps[op];
+    // Skipping unknown key ops
+    if (op_flag === undefined) continue;
+    // Have we seen it already? if so, error
+    if (flags & 1 << op_flag) throw lazyDOMException('Duplicate key operation', 'DataError');
+    flags |= 1 << op_flag;
+
+    // TODO(@jasnell): RFC7517 section 4.3 strong recommends validating
+    // key usage combinations. Specifically, it says that unrelated key
+    // ops SHOULD NOT be used together. We're not yet validating that here.
+  }
+  if (usagesSet !== undefined) {
+    for (const use of usagesSet) {
+      if (!keyOps.includes(use)) {
+        throw lazyDOMException('Key operations and usage mismatch', 'DataError');
+      }
+    }
+  }
+};
+
+// WebCrypto JWK import structural validation, mirroring Node's
+// `internal/crypto/webcrypto_util.validateJwk` + `validateKeyOps`:
+//   - `ext`: if present and false, `extractable` must also be false
+//   - `use`: if `keyUsages` is non-empty and `use` is present, must equal
+//     the algorithm's expected use ('sig' or 'enc')
+//   - `key_ops`: must be an array, must not contain duplicates, and every
+//     requested usage must appear in it
+export function validateJwkStructure(jwk, extractable, keyUsages, expectedUse) {
+  if (jwk.ext === false && extractable) {
+    throw lazyDOMException('JWK "ext" is false but extractable was requested', 'DataError');
+  }
+  if (keyUsages.length > 0 && jwk.use !== undefined) {
+    if (jwk.use !== expectedUse) {
+      throw lazyDOMException('Invalid JWK "use" Parameter', 'DataError');
+    }
+  }
+  if (jwk.key_ops !== undefined) {
+    if (!Array.isArray(jwk.key_ops)) {
+      throw lazyDOMException('JWK "key_ops" must be an array', 'DataError');
+    }
+    const seen = new Set();
+    for (const op of jwk.key_ops) {
+      if (seen.has(op)) {
+        throw lazyDOMException('Duplicate key operation', 'DataError');
+      }
+      seen.add(op);
+    }
+    for (const usage of keyUsages) {
+      if (!jwk.key_ops.includes(usage)) {
+        throw lazyDOMException(`JWK "key_ops" does not include requested usage "${usage}"`, 'DataError');
+      }
+    }
+  }
+}
+export function hasAnyNotIn(set, checks) {
+  for (const s of set) {
+    if (!checks.includes(s)) {
+      return true;
+    }
+  }
+  return false;
+}
+//# sourceMappingURL=validation.js.map

package/lib/module/utils/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Buffer","SBuffer","lazyDOMException","kMaxBufferLength","validateFunction","f","isStringOrBuffer","val","ArrayBuffer","isView","validateObject","value","name","options","useDefaultOptions","allowArray","allowFunction","nullable","Array","isArray","Error","validateMaxBufferLength","data","length","byteLength","getUsagesUnion","usageSet","usages","newset","n","undefined","includes","push","kCanonicalUsageOrder","getSortedUsages","set","Set","filter","usage","has","kKeyOps","sign","verify","encrypt","decrypt","wrapKey","unwrapKey","deriveKey","deriveBits","encapsulateBits","decapsulateBits","encapsulateKey","decapsulateKey","validateKeyOps","keyOps","usagesSet","flags","op","op_flag","use","validateJwkStructure","jwk","extractable","keyUsages","expectedUse","ext","key_ops","seen","add","hasAnyNotIn","checks","s"],"sourceRoot":"../../../src","sources":["utils/validation.ts"],"mappings":";;AAAA,SAASA,MAAM,IAAIC,OAAO,QAAQ,aAAa;AAE/C,SAASC,gBAAgB,QAAQ,UAAU;;AAE3C;AACA,MAAMC,gBAAgB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;AAEpC,OAAO,SAASC,gBAAgBA,CAACC,CAAU,EAAW;EACpD,OAAOA,CAAC,KAAK,IAAI,IAAI,OAAOA,CAAC,KAAK,UAAU;AAC9C;AAEA,OAAO,SAASC,gBAAgBA,CAACC,GAAY,EAA+B;EAC1E,OACE,OAAOA,GAAG,KAAK,QAAQ,IACvBC,WAAW,CAACC,MAAM,CAACF,GAAG,CAAC,IACvBA,GAAG,YAAYC,WAAW;AAE9B;AAEA,OAAO,SAASE,cAAcA,CAC5BC,KAAc,EACdC,IAAY,EACZC,OAIQ,EACI;EACZ,MAAMC,iBAAiB,GAAGD,OAAO,IAAI,IAAI;EACzC,MAAME,UAAU,GAAGD,iBAAiB,GAAG,KAAK,GAAGD,OAAO,CAACE,UAAU;EACjE,MAAMC,aAAa,GAAGF,iBAAiB,GAAG,KAAK,GAAGD,OAAO,CAACG,aAAa;EACvE,MAAMC,QAAQ,GAAGH,iBAAiB,GAAG,KAAK,GAAGD,OAAO,CAACI,QAAQ;EAC7D,IACG,CAACA,QAAQ,IAAIN,KAAK,KAAK,IAAI,IAC3B,CAACI,UAAU,IAAIG,KAAK,CAACC,OAAO,CAACR,KAAK,CAAE,IACpC,OAAOA,KAAK,KAAK,QAAQ,KACvB,CAACK,aAAa,IAAI,OAAOL,KAAK,KAAK,UAAU,CAAE,EAClD;IACA,MAAM,IAAIS,KAAK,CAAC,GAAGR,IAAI,0BAA0BD,KAAK,EAAE,CAAC;EAC3D;EACA,OAAO,IAAI;AACb;AAEA,OAAO,MAAMU,uBAAuB,GAAGA,CACrCC,IAA6B,EAC7BV,IAAY,KACH;EACT,MAAMW,MAAM,GACV,OAAOD,IAAI,KAAK,QAAQ,IAAIA,IAAI,YAAYrB,OAAO,GAC/CqB,IAAI,CAACC,MAAM,GACXD,IAAI,CAACE,UAAU;EACrB,IAAID,MAAM,GAAGpB,gBAAgB,EAAE;IAC7B,MAAMD,gBAAgB,CACpB,GAAGU,IAAI,sBAAsBT,gBAAgB,GAAG,CAAC,OAAO,EACxD,gBACF,CAAC;EACH;AACF,CAAC;;AAED;AACA;AACA;AACA,OAAO,MAAMsB,cAAc,GAAGA,CAACC,QAAoB,EAAE,GAAGC,MAAkB,KAAK;EAC7E,MAAMC,MAAkB,GAAG,EAAE;EAC7B,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGF,MAAM,CAACJ,MAAM,EAAEM,CAAC,EAAE,EAAE;IACtC,IAAI,CAACF,MAAM,CAACE,CAAC,CAAC,IAAIF,MAAM,CAACE,CAAC,CAAC,KAAKC,SAAS,EAAE;IAC3C,IAAIJ,QAAQ,CAACK,QAAQ,CAACJ,MAAM,CAACE,CAAC,CAAa,CAAC,EAC1CD,MAAM,CAACI,IAAI,CAACL,MAAM,CAACE,CAAC,CAAa,CAAC;EACtC;EACA,OAAOD,MAAM;AACf,CAAC;AAED,MAAMK,oBAAyC,GAAG,CAChD,SAAS,EACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,CAClB;AAED,OAAO,SAASC,eAAeA,CAACP,MAAkB,EAAc;EAC9D,MAAMQ,GAAG,GAAG,IAAIC,GAAG,CAAWT,MAAM,CAAC;EACrC,OAAOM,oBAAoB,CAACI,MAAM,CAACC,KAAK,IAAIH,GAAG,CAACI,GAAG,CAACD,KAAK,CAAC,CAAC;AAC7D;AAEA,MAAME,OAEL,GAAG;EACFC,IAAI,EAAE,CAAC;EACPC,MAAM,EAAE,CAAC;EACTC,OAAO,EAAE,CAAC;EACVC,OAAO,EAAE,CAAC;EACVC,OAAO,EAAE,CAAC;EACVC,SAAS,EAAE,CAAC;EACZC,SAAS,EAAE,CAAC;EACZC,UAAU,EAAE,CAAC;EACbC,eAAe,EAAE,CAAC;EAClBC,eAAe,EAAE,EAAE;EACnBC,cAAc,EAAE,EAAE;EAClBC,cAAc,EAAE;AAClB,CAAC;AAED,OAAO,MAAMC,cAAc,GAAGA,CAC5BC,MAA8B,EAC9BC,SAAqB,KAClB;EACH,IAAID,MAAM,KAAKxB,SAAS,EAAE;EAC1B,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACmC,MAAM,CAAC,EAAE;IAC1B,MAAMpD,gBAAgB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;EAC9D;EACA,IAAIsD,KAAK,GAAG,CAAC;EACb,KAAK,IAAI3B,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGyB,MAAM,CAAC/B,MAAM,EAAEM,CAAC,EAAE,EAAE;IACtC,MAAM4B,EAAY,GAAGH,MAAM,CAACzB,CAAC,CAAa;IAC1C,MAAM6B,OAAO,GAAGlB,OAAO,CAACiB,EAAE,CAAC;IAC3B;IACA,IAAIC,OAAO,KAAK5B,SAAS,EAAE;IAC3B;IACA,IAAI0B,KAAK,GAAI,CAAC,IAAIE,OAAQ,EACxB,MAAMxD,gBAAgB,CAAC,yBAAyB,EAAE,WAAW,CAAC;IAChEsD,KAAK,IAAI,CAAC,IAAIE,OAAO;;IAErB;IACA;IACA;EACF;EAEA,IAAIH,SAAS,KAAKzB,SAAS,EAAE;IAC3B,KAAK,MAAM6B,GAAG,IAAIJ,SAAS,EAAE;MAC3B,IAAI,CAACD,MAAM,CAACvB,QAAQ,CAAC4B,GAAG,CAAC,EAAE;QACzB,MAAMzD,gBAAgB,CACpB,mCAAmC,EACnC,WACF,CAAC;MACH;IACF;EACF;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS0D,oBAAoBA,CAClCC,GAAQ,EACRC,WAAoB,EACpBC,SAAqB,EACrBC,WAA0B,EACpB;EACN,IAAIH,GAAG,CAACI,GAAG,KAAK,KAAK,IAAIH,WAAW,EAAE;IACpC,MAAM5D,gBAAgB,CACpB,kDAAkD,EAClD,WACF,CAAC;EACH;EACA,IAAI6D,SAAS,CAACxC,MAAM,GAAG,CAAC,IAAIsC,GAAG,CAACF,GAAG,KAAK7B,SAAS,EAAE;IACjD,IAAI+B,GAAG,CAACF,GAAG,KAAKK,WAAW,EAAE;MAC3B,MAAM9D,gBAAgB,CAAC,6BAA6B,EAAE,WAAW,CAAC;IACpE;EACF;EACA,IAAI2D,GAAG,CAACK,OAAO,KAAKpC,SAAS,EAAE;IAC7B,IAAI,CAACZ,KAAK,CAACC,OAAO,CAAC0C,GAAG,CAACK,OAAO,CAAC,EAAE;MAC/B,MAAMhE,gBAAgB,CAAC,gCAAgC,EAAE,WAAW,CAAC;IACvE;IACA,MAAMiE,IAAI,GAAG,IAAI/B,GAAG,CAAS,CAAC;IAC9B,KAAK,MAAMqB,EAAE,IAAII,GAAG,CAACK,OAAO,EAAE;MAC5B,IAAIC,IAAI,CAAC5B,GAAG,CAACkB,EAAE,CAAC,EAAE;QAChB,MAAMvD,gBAAgB,CAAC,yBAAyB,EAAE,WAAW,CAAC;MAChE;MACAiE,IAAI,CAACC,GAAG,CAACX,EAAE,CAAC;IACd;IACA,KAAK,MAAMnB,KAAK,IAAIyB,SAAS,EAAE;MAC7B,IAAI,CAACF,GAAG,CAACK,OAAO,CAACnC,QAAQ,CAACO,KAAK,CAAC,EAAE;QAChC,MAAMpC,gBAAgB,CACpB,mDAAmDoC,KAAK,GAAG,EAC3D,WACF,CAAC;MACH;IACF;EACF;AACF;AAEA,OAAO,SAAS+B,WAAWA,CAAClC,GAAa,EAAEmC,MAAgB,EAAE;EAC3D,KAAK,MAAMC,CAAC,IAAIpC,GAAG,EAAE;IACnB,IAAI,CAACmC,MAAM,CAACvC,QAAQ,CAACwC,CAAC,CAAC,EAAE;MACvB,OAAO,IAAI;IACb;EACF;EACA,OAAO,KAAK;AACd","ignoreList":[]}

package/lib/module/x509certificate.js

@@ -0,0 +1,184 @@
+"use strict";
+
+import { NitroModules } from 'react-native-nitro-modules';
+import { Buffer } from '@craftzdog/react-native-buffer';
+import { PublicKeyObject, KeyObject } from './keys';
+import { binaryLikeToArrayBuffer } from './utils';
+const X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT = 0x1;
+const X509_CHECK_FLAG_NO_WILDCARDS = 0x2;
+const X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS = 0x4;
+const X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS = 0x8;
+const X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS = 0x10;
+const X509_CHECK_FLAG_NEVER_CHECK_SUBJECT = 0x20;
+function getFlags(options) {
+  if (!options) return 0;
+  let flags = 0;
+  if (options.subject === 'always') {
+    flags |= X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT;
+  } else if (options.subject === 'never') {
+    flags |= X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
+  }
+  if (options.wildcards === false) {
+    flags |= X509_CHECK_FLAG_NO_WILDCARDS;
+  }
+  if (options.partialWildcards === false) {
+    flags |= X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS;
+  }
+  if (options.multiLabelWildcards === true) {
+    flags |= X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS;
+  }
+  if (options.singleLabelSubdomains === true) {
+    flags |= X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS;
+  }
+  return flags;
+}
+export class X509Certificate {
+  cache = new Map();
+  constructor(buffer) {
+    this.handle = NitroModules.createHybridObject('X509CertificateHandle');
+
+    // For string input, route through binaryLikeToArrayBuffer so the result
+    // is a tight ArrayBuffer of just the encoded bytes. `Buffer.from(str).buffer`
+    // can return a pool-backed ArrayBuffer with byteOffset > 0, exposing
+    // unrelated bytes (and giving the wrong byteLength) to native.
+    const ab = binaryLikeToArrayBuffer(buffer);
+    this.handle.init(ab);
+  }
+  cached(key, compute) {
+    if (this.cache.has(key)) {
+      return this.cache.get(key);
+    }
+    const value = compute();
+    this.cache.set(key, value);
+    return value;
+  }
+  get subject() {
+    return this.cached('subject', () => this.handle.subject());
+  }
+  get subjectAltName() {
+    return this.cached('subjectAltName', () => this.handle.subjectAltName());
+  }
+  get issuer() {
+    return this.cached('issuer', () => this.handle.issuer());
+  }
+  get infoAccess() {
+    return this.cached('infoAccess', () => this.handle.infoAccess());
+  }
+  get validFrom() {
+    return this.cached('validFrom', () => this.handle.validFrom());
+  }
+  get validTo() {
+    return this.cached('validTo', () => this.handle.validTo());
+  }
+  get validFromDate() {
+    return this.cached('validFromDate', () => new Date(this.handle.validFromDate()));
+  }
+  get validToDate() {
+    return this.cached('validToDate', () => new Date(this.handle.validToDate()));
+  }
+  get fingerprint() {
+    return this.cached('fingerprint', () => this.handle.fingerprint());
+  }
+  get fingerprint256() {
+    return this.cached('fingerprint256', () => this.handle.fingerprint256());
+  }
+  get fingerprint512() {
+    return this.cached('fingerprint512', () => this.handle.fingerprint512());
+  }
+  get extKeyUsage() {
+    return this.cached('extKeyUsage', () => this.handle.keyUsage());
+  }
+  get keyUsage() {
+    return this.extKeyUsage;
+  }
+  get serialNumber() {
+    return this.cached('serialNumber', () => this.handle.serialNumber());
+  }
+  get signatureAlgorithm() {
+    return this.cached('signatureAlgorithm', () => this.handle.signatureAlgorithm());
+  }
+  get signatureAlgorithmOid() {
+    return this.cached('signatureAlgorithmOid', () => this.handle.signatureAlgorithmOid());
+  }
+  get ca() {
+    return this.cached('ca', () => this.handle.ca());
+  }
+  get raw() {
+    return this.cached('raw', () => Buffer.from(this.handle.raw()));
+  }
+  get publicKey() {
+    return this.cached('publicKey', () => new PublicKeyObject(this.handle.publicKey()));
+  }
+  get issuerCertificate() {
+    return undefined;
+  }
+  checkHost(name, options) {
+    if (typeof name !== 'string') {
+      throw new TypeError('The "name" argument must be a string');
+    }
+    return this.handle.checkHost(name, getFlags(options));
+  }
+  checkEmail(email, options) {
+    if (typeof email !== 'string') {
+      throw new TypeError('The "email" argument must be a string');
+    }
+    return this.handle.checkEmail(email, getFlags(options));
+  }
+  checkIP(ip) {
+    if (typeof ip !== 'string') {
+      throw new TypeError('The "ip" argument must be a string');
+    }
+    return this.handle.checkIP(ip);
+  }
+  checkIssued(otherCert) {
+    if (!(otherCert instanceof X509Certificate)) {
+      throw new TypeError('The "otherCert" argument must be an instance of X509Certificate');
+    }
+    return this.handle.checkIssued(otherCert.handle);
+  }
+  checkPrivateKey(pkey) {
+    if (!(pkey instanceof KeyObject)) {
+      throw new TypeError('The "pkey" argument must be an instance of KeyObject');
+    }
+    if (pkey.type !== 'private') {
+      throw new TypeError('The "pkey" argument must be a private key');
+    }
+    return this.handle.checkPrivateKey(pkey.handle);
+  }
+  verify(pkey) {
+    if (!(pkey instanceof KeyObject)) {
+      throw new TypeError('The "pkey" argument must be an instance of KeyObject');
+    }
+    if (pkey.type !== 'public') {
+      throw new TypeError(`The "pkey" argument must be a public key, got '${pkey.type}'`);
+    }
+    return this.handle.verify(pkey.handle);
+  }
+  toString() {
+    return this.cached('pem', () => this.handle.pem());
+  }
+  toJSON() {
+    return this.toString();
+  }
+  toLegacyObject() {
+    return {
+      subject: this.subject,
+      issuer: this.issuer,
+      subjectaltname: this.subjectAltName,
+      infoAccess: this.infoAccess,
+      ca: this.ca,
+      modulus: undefined,
+      bits: undefined,
+      exponent: undefined,
+      valid_from: this.validFrom,
+      valid_to: this.validTo,
+      fingerprint: this.fingerprint,
+      fingerprint256: this.fingerprint256,
+      fingerprint512: this.fingerprint512,
+      ext_key_usage: this.keyUsage,
+      serialNumber: this.serialNumber,
+      raw: this.raw
+    };
+  }
+}
+//# sourceMappingURL=x509certificate.js.map