@opcua/for-node-red 3.34.2 → 3.36.0

package/node_modules/@sterfive/opcua-pinned/node_modules/node-opcua-common/source/opcua_secure_object.ts

@@ -2,12 +2,10 @@
  * @module node-opcua-common
  */
 import { EventEmitter } from "node:events";
-import fs from "node:fs";
 import { assert } from "node-opcua-assert";
-import { readCertificateChain, readPrivateKey } from "node-opcua-crypto";
 import { type Certificate, type PrivateKey, split_der } from "node-opcua-crypto/web";
 
-import type { ICertificateChainProvider } from "./certificate_chain_provider";
+import { DiskCertificateKeyPairProvider } from "./disk_certificate_key_pair_provider";
 
 export interface ICertificateKeyPairProvider {
     getCertificate(): Certificate;
@@ -15,120 +13,50 @@ export interface ICertificateKeyPairProvider {
     getPrivateKey(): PrivateKey;
 }
 
-export interface IHasCertificateFile {
+/**
+ * Extends {@link ICertificateKeyPairProvider} with diagnostic
+ * file-location properties so that consumers can report where
+ * certificates are stored (real path or `"<in-memory>"`).
+ *
+ * Does **not** alter the public `ICertificateKeyPairProvider`
+ * interface — zero breaking change to `ServerSecureChannelParent`,
+ * `ClientSecureChannelParent`, or any external implementation.
+ */
+export interface ICertificateKeyPairProviderWithLocation extends ICertificateKeyPairProvider {
     readonly certificateFile: string;
     readonly privateKeyFile: string;
+    invalidate?(): void;
 }
 
 /**
- * Holds cryptographic secrets (certificate chain and private key) for a
- * certificate/key file pair. Secrets are lazily loaded from disk on first
- * access and kept in truly private `#`-fields so they never appear in
- * `JSON.stringify`, `console.log`, `Object.keys`, or `util.inspect`.
+ * Wrap a bare {@link ICertificateKeyPairProvider} (without location
+ * properties) into an {@link ICertificateKeyPairProviderWithLocation}.
+ *
+ * If the provider already implements the extended interface, it is
+ * returned as-is. Otherwise a thin wrapper adds `"<unknown>"` defaults.
  */
-export class SecretHolder implements ICertificateChainProvider {
-    #certificateChain: Certificate[] | null = null;
-    #privateKey: PrivateKey | null = null;
-    #obj: IHasCertificateFile;
-
-    constructor(obj: IHasCertificateFile) {
-        this.#obj = obj;
-    }
-
-    public getCertificate(): Certificate {
-        // Ensure the chain is loaded before accessing [0]
-        const chain = this.getCertificateChain();
-        return chain[0];
-    }
-
-    public getCertificateChain(): Certificate[] {
-        if (!this.#certificateChain) {
-            const file = this.#obj.certificateFile;
-            if (!fs.existsSync(file)) {
-                throw new Error(`Certificate file must exist: ${file}`);
-            }
-            const chain = readCertificateChain(file);
-            if (!chain || chain.length === 0) {
-                throw new Error(`Invalid certificate chain (length=0) ${file}`);
+function ensureProviderHasLocation(
+    provider: ICertificateKeyPairProvider
+): ICertificateKeyPairProviderWithLocation {
+    if ("certificateFile" in provider && "privateKeyFile" in provider) {
+        return provider as ICertificateKeyPairProviderWithLocation;
+    }
+    return {
+        get certificateFile() {
+            return "<unknown>";
+        },
+        get privateKeyFile() {
+            return "<unknown>";
+        },
+        getCertificate: () => provider.getCertificate(),
+        getCertificateChain: () => provider.getCertificateChain(),
+        getPrivateKey: () => provider.getPrivateKey(),
+        invalidate: () => {
+            if ("invalidate" in provider && typeof provider.invalidate === "function") {
+                provider.invalidate();
             }
-            this.#certificateChain = chain;
         }
-        return this.#certificateChain;
-    }
-
-    public getPrivateKey(): PrivateKey {
-        if (!this.#privateKey) {
-            const file = this.#obj.privateKeyFile;
-            if (!fs.existsSync(file)) {
-                throw new Error(`Private key file must exist: ${file}`);
-            }
-            const key = readPrivateKey(file);
-            if (key instanceof Buffer) {
-                throw new Error(`Invalid private key ${file}. Should not be a buffer`);
-            }
-            this.#privateKey = key;
-        }
-        return this.#privateKey;
-    }
-
-    /**
-     * Clears cached secrets so the GC can reclaim sensitive material.
-     * After calling dispose the holder will re-read from disk on next access.
-     */
-    public dispose(): void {
-        this.#certificateChain = null;
-        this.#privateKey = null;
-    }
-
-    /**
-     * Alias for {@link dispose}.
-     * Implements `ICertificateChainProvider.invalidate()`.
-     */
-    public invalidate(): void {
-        this.dispose();
-    }
-
-    // Prevent secrets from leaking through JSON serialization
-    public toJSON(): Record<string, string> {
-        return { certificateFile: this.#obj.certificateFile, privateKeyFile: this.#obj.privateKeyFile };
-    }
-
-    // Prevent secrets from leaking through console.log / util.inspect
-    public [Symbol.for("nodejs.util.inspect.custom")](): string {
-        return `SecretHolder { certificateFile: "${this.#obj.certificateFile}", privateKeyFile: "${this.#obj.privateKeyFile}" }`;
-    }
-}
-
-/**
- * Module-private WeakMap that associates an ICertificateKeyPairProvider
- * with its SecretHolder. Using a WeakMap means:
- * - The secret holder is invisible from the outside (no enumerable property)
- * - If the owning object is GC'd, the SecretHolder is automatically collected
- */
-const secretHolders = new WeakMap<object, SecretHolder>();
-
-function getSecretHolder(obj: ICertificateKeyPairProvider & IHasCertificateFile): SecretHolder {
-    let holder = secretHolders.get(obj);
-    if (!holder) {
-        holder = new SecretHolder(obj);
-        secretHolders.set(obj, holder);
-    }
-    return holder;
-}
-
-/**
- * Invalidate any cached certificate chain and private key for the given
- * provider so that the next `getCertificate()` / `getPrivateKey()` call
- * re-reads from disk.
- *
- * This is the public replacement for the old `$$certificateChain = null`
- * / `$$privateKey = null` pattern.
- */
-export function invalidateCachedSecrets(obj: ICertificateKeyPairProvider): void {
-    const holder = secretHolders.get(obj);
-    if (holder) {
-        holder.dispose();
-    }
+    };
 }
 
 /**
@@ -172,39 +100,95 @@ export function getPartialCertificateChain(certificateChain?: Certificate | Cert
 export interface IOPCUASecureObjectOptions {
     certificateFile?: string;
     privateKeyFile?: string;
+    /**
+     * Optional pre-built certificate + private-key provider. When supplied,
+     * `OPCUASecureObject.getCertificate()` / `.getCertificateChain()` /
+     * `.getPrivateKey()` delegate to this object verbatim, and the disk-backed
+     * path (`fs.existsSync` + `readCertificateChain` + `readPrivateKey`) is
+     * not used.
+     *
+     * Intended for browser builds (bundled via esbuild) and test fixtures that
+     * want to stage a cert+key pair without staging PKI folders on disk.
+     *
+     * When present, `certificateFile` / `privateKeyFile` become optional and
+     * may be omitted.
+     * When absent, those two fields remain required strings and a
+     * {@link DiskCertificateKeyPairProvider} is created automatically.
+     */
+    certificateKeyPairProvider?: ICertificateKeyPairProvider;
 }
 
 /**
  * An object that provides a certificate and a privateKey.
- * Secrets are loaded lazily and stored in a module-private WeakMap
- * so they never appear on the instance.
+ *
+ * All certificate/key access is delegated to an internal
+ * {@link ICertificateKeyPairProviderWithLocation} provider.
+ *
+ * - When constructed with file paths, a {@link DiskCertificateKeyPairProvider}
+ *   is created automatically.
+ * - When constructed with an injected provider, it is used directly.
+ * - The provider can be replaced at runtime via {@link setProvider}.
  */
-
 // biome-ignore lint/suspicious/noExplicitAny: EventEmitter use any
 export class OPCUASecureObject<T extends Record<string | symbol, any> = any>
     extends EventEmitter<T>
-    implements ICertificateKeyPairProvider, IHasCertificateFile
+    implements ICertificateKeyPairProvider
 {
-    public readonly certificateFile: string;
-    public readonly privateKeyFile: string;
+    #provider: ICertificateKeyPairProviderWithLocation;
 
     constructor(options: IOPCUASecureObjectOptions) {
         super();
-        assert(typeof options.certificateFile === "string");
-        assert(typeof options.privateKeyFile === "string");
-        this.certificateFile = options.certificateFile || "invalid certificate file";
-        this.privateKeyFile = options.privateKeyFile || "invalid private key file";
+        if (options.certificateKeyPairProvider) {
+            // Injected provider — wrap if missing location properties
+            this.#provider = ensureProviderHasLocation(options.certificateKeyPairProvider);
+        } else {
+            // Auto-create disk provider from file paths
+            assert(typeof options.certificateFile === "string", "certificateFile or certificateKeyPairProvider is required");
+            assert(typeof options.privateKeyFile === "string", "privateKeyFile or certificateKeyPairProvider is required");
+            this.#provider = new DiskCertificateKeyPairProvider(
+                options.certificateFile || "invalid certificate file",
+                options.privateKeyFile || "invalid private key file"
+            );
+        }
+    }
+
+    /** File path of the certificate (or `"<in-memory>"`). */
+    public get certificateFile(): string {
+        return this.#provider.certificateFile;
+    }
+
+    /** File path of the private key (or `"<in-memory>"`). */
+    public get privateKeyFile(): string {
+        return this.#provider.privateKeyFile;
     }
 
     public getCertificate(): Certificate {
-        return getSecretHolder(this).getCertificate();
+        return this.#provider.getCertificate();
     }
 
     public getCertificateChain(): Certificate[] {
-        return getSecretHolder(this).getCertificateChain();
+        return this.#provider.getCertificateChain();
     }
 
     public getPrivateKey(): PrivateKey {
-        return getSecretHolder(this).getPrivateKey();
+        return this.#provider.getPrivateKey();
+    }
+
+    /**
+     * Replace the internal provider.
+     * Accepts any {@link ICertificateKeyPairProvider} — wraps it
+     * with location defaults if it lacks `certificateFile`/`privateKeyFile`.
+     */
+    public setProvider(provider: ICertificateKeyPairProvider): void {
+        this.#provider = ensureProviderHasLocation(provider);
+    }
+
+    /**
+     * Invalidate cached certificate chain and private key so the next
+     * `getCertificate()` / `getPrivateKey()` call re-reads from the
+     * underlying source. For in-memory providers, this is a no-op.
+     */
+    public invalidateCachedCertificates(): void {
+        this.#provider.invalidate?.();
     }
 }

package/node_modules/@sterfive/opcua-pinned/node_modules/node-opcua-crypto/dist/{chunk-CHOBVT6V.cjs → chunk-2DISC7JP.cjs}

@@ -7,14 +7,14 @@
 
 
 
-var _chunkLRB5Q533cjs = require('./chunk-LRB5Q533.cjs');
+var _chunkFRVYTI7Scjs = require('./chunk-FRVYTI7S.cjs');
 
 // source_nodejs/generate_private_key_filename.ts
 var _crypto = require('crypto');
 var _fs = require('fs'); var _fs2 = _interopRequireDefault(_fs);
 async function generatePrivateKeyFile(privateKeyFilename, modulusLength) {
-  const keys = await _chunkLRB5Q533cjs.generateKeyPair.call(void 0, modulusLength);
-  const privateKeyPem = await _chunkLRB5Q533cjs.privateKeyToPEM.call(void 0, keys.privateKey);
+  const keys = await _chunkFRVYTI7Scjs.generateKeyPair.call(void 0, modulusLength);
+  const privateKeyPem = await _chunkFRVYTI7Scjs.privateKeyToPEM.call(void 0, keys.privateKey);
   await _fs2.default.promises.writeFile(privateKeyFilename, privateKeyPem.privPem, "utf-8");
   privateKeyPem.privPem = "";
   privateKeyPem.privDer = new ArrayBuffer(0);
@@ -36,7 +36,7 @@ var _path = require('path'); var _path2 = _interopRequireDefault(_path);
 var _sshpk = require('sshpk'); var _sshpk2 = _interopRequireDefault(_sshpk);
 function _readPemFile(filename) {
   _assert2.default.call(void 0, typeof filename === "string");
-  return _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, _fs2.default.readFileSync(filename, "utf-8"));
+  return _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, _fs2.default.readFileSync(filename, "utf-8"));
 }
 function _countPemCertBlocks(pem) {
   const matches = pem.match(/-----BEGIN CERTIFICATE-----/g);
@@ -53,11 +53,11 @@ function readCertificate(filename) {
       `[node-opcua-crypto] readCertificate: "${_path2.default.basename(filename)}" contains ${count} PEM certificate block(s) but only the first will be used. Use readCertificateChain() to read all certificates.`
     );
   }
-  return _chunkLRB5Q533cjs.convertPEMtoDER.call(void 0, pem);
+  return _chunkFRVYTI7Scjs.convertPEMtoDER.call(void 0, pem);
 }
 function readCertificateChain(filename) {
   if (filename.match(/.*\.der/)) {
-    return _chunkLRB5Q533cjs.split_der.call(void 0, _fs2.default.readFileSync(filename));
+    return _chunkFRVYTI7Scjs.split_der.call(void 0, _fs2.default.readFileSync(filename));
   }
   const pem = _readPemFile(filename);
   return _extractAllPemDerCertificates(pem);
@@ -65,9 +65,9 @@ function readCertificateChain(filename) {
 async function readCertificateChainAsync(filename) {
   const buf = await _fs2.default.promises.readFile(filename);
   if (filename.match(/.*\.der/)) {
-    return _chunkLRB5Q533cjs.split_der.call(void 0, buf);
+    return _chunkFRVYTI7Scjs.split_der.call(void 0, buf);
   }
-  const pem = _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf.toString("utf-8"));
+  const pem = _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf.toString("utf-8"));
   return _extractAllPemDerCertificates(pem);
 }
 function _extractAllPemDerCertificates(pem) {
@@ -79,7 +79,7 @@ function _extractAllPemDerCertificates(pem) {
     const base64 = match[1].replace(/\r?\n/g, "");
     const derBuffer = Buffer.from(base64, "base64");
     try {
-      const separatedCerts = _chunkLRB5Q533cjs.split_der.call(void 0, derBuffer);
+      const separatedCerts = _chunkFRVYTI7Scjs.split_der.call(void 0, derBuffer);
       for (const c of separatedCerts) {
         certs.push(c);
       }
@@ -95,14 +95,14 @@ async function readCertificateAsync(filename) {
   if (filename.match(/.*\.der/)) {
     return buf;
   }
-  const raw_key = _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf.toString("utf-8"));
+  const raw_key = _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf.toString("utf-8"));
   const count = _countPemCertBlocks(raw_key);
   if (count > 1) {
     console.warn(
       `[node-opcua-crypto] readCertificateAsync: "${_path2.default.basename(filename)}" contains ${count} PEM certificate block(s) but only the first will be used. Use readCertificateChainAsync() to read all certificates.`
     );
   }
-  return _chunkLRB5Q533cjs.convertPEMtoDER.call(void 0, raw_key);
+  return _chunkFRVYTI7Scjs.convertPEMtoDER.call(void 0, raw_key);
 }
 function readPublicKey(filename) {
   if (filename.match(/.*\.der/)) {
@@ -118,13 +118,13 @@ async function readPublicKeyAsync(filename) {
   if (filename.match(/.*\.der/)) {
     return _crypto.createPublicKey.call(void 0, buf);
   }
-  return _crypto.createPublicKey.call(void 0, _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf.toString("utf-8")));
+  return _crypto.createPublicKey.call(void 0, _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf.toString("utf-8")));
 }
 function myCreatePrivateKey(rawKey) {
   if (!_crypto.createPrivateKey || process.env.NO_CREATE_PRIVATEKEY) {
     if (Buffer.isBuffer(rawKey)) {
-      const pemKey = _chunkLRB5Q533cjs.toPem.call(void 0, rawKey, "PRIVATE KEY");
-      _assert2.default.call(void 0, ["RSA PRIVATE KEY", "PRIVATE KEY"].indexOf(_chunkLRB5Q533cjs.identifyPemType.call(void 0, pemKey)) >= 0);
+      const pemKey = _chunkFRVYTI7Scjs.toPem.call(void 0, rawKey, "PRIVATE KEY");
+      _assert2.default.call(void 0, ["RSA PRIVATE KEY", "PRIVATE KEY"].indexOf(_chunkFRVYTI7Scjs.identifyPemType.call(void 0, pemKey)) >= 0);
       return { hidden: pemKey };
     }
     return { hidden: ensureTrailingLF(rawKey) };
@@ -153,28 +153,28 @@ async function readPrivateKeyAsync(filename) {
   if (filename.match(/.*\.der/)) {
     return myCreatePrivateKey(buf);
   }
-  return myCreatePrivateKey(_chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf.toString("utf-8")));
+  return myCreatePrivateKey(_chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf.toString("utf-8")));
 }
 function readCertificatePEM(filename) {
   return _readPemFile(filename);
 }
 async function readCertificatePEMAsync(filename) {
   const buf = await _fs2.default.promises.readFile(filename, "utf-8");
-  return _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf);
+  return _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf);
 }
 function readPublicKeyPEM(filename) {
   return _readPemFile(filename);
 }
 async function readPublicKeyPEMAsync(filename) {
   const buf = await _fs2.default.promises.readFile(filename, "utf-8");
-  return _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf);
+  return _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf);
 }
 function readPrivateKeyPEM(filename) {
   return _readPemFile(filename);
 }
 async function readPrivateKeyPEMAsync(filename) {
   const buf = await _fs2.default.promises.readFile(filename, "utf-8");
-  return _chunkLRB5Q533cjs.removeTrailingLF.call(void 0, buf);
+  return _chunkFRVYTI7Scjs.removeTrailingLF.call(void 0, buf);
 }
 var _g_certificate_store = "";
 function setCertificateStore(store) {
@@ -219,7 +219,7 @@ async function readCertificateRevocationList(filename) {
     return crl;
   }
   const raw_crl = crl.toString();
-  return _chunkLRB5Q533cjs.convertPEMtoDER.call(void 0, raw_crl);
+  return _chunkFRVYTI7Scjs.convertPEMtoDER.call(void 0, raw_crl);
 }
 
 // source_nodejs/read_certificate_signing_request.ts
@@ -230,14 +230,14 @@ async function readCertificateSigningRequest(filename) {
     return csr;
   }
   const raw_crl = csr.toString();
-  return _chunkLRB5Q533cjs.convertPEMtoDER.call(void 0, raw_crl);
+  return _chunkFRVYTI7Scjs.convertPEMtoDER.call(void 0, raw_crl);
 }
 
 // source_nodejs/write.ts
 
 function certificatesToPem(certificates) {
   const certs = Array.isArray(certificates) ? certificates : [certificates];
-  return `${certs.map((der) => _chunkLRB5Q533cjs.toPem.call(void 0, der, "CERTIFICATE")).join("\n")}
+  return `${certs.map((der) => _chunkFRVYTI7Scjs.toPem.call(void 0, der, "CERTIFICATE")).join("\n")}
 `;
 }
 function writeCertificateChain(filename, certificates) {
@@ -248,7 +248,7 @@ async function writeCertificateChainAsync(filename, certificates) {
 }
 function certificatesToDer(certificates) {
   const certs = Array.isArray(certificates) ? certificates : [certificates];
-  return _chunkLRB5Q533cjs.combine_der.call(void 0, certs);
+  return _chunkFRVYTI7Scjs.combine_der.call(void 0, certs);
 }
 function writeCertificateChainDer(filename, certificates) {
   _fs2.default.writeFileSync(filename, certificatesToDer(certificates));
@@ -287,4 +287,4 @@ async function writeCertificateChainDerAsync(filename, certificates) {
 
 
 exports.generatePrivateKeyFile = generatePrivateKeyFile; exports.generatePrivateKeyFileAlternate = generatePrivateKeyFileAlternate; exports.readCertificate = readCertificate; exports.readCertificateChain = readCertificateChain; exports.readCertificateChainAsync = readCertificateChainAsync; exports.readCertificateAsync = readCertificateAsync; exports.readPublicKey = readPublicKey; exports.readPublicKeyAsync = readPublicKeyAsync; exports.readPrivateKey = readPrivateKey; exports.readPrivateKeyAsync = readPrivateKeyAsync; exports.readCertificatePEM = readCertificatePEM; exports.readCertificatePEMAsync = readCertificatePEMAsync; exports.readPublicKeyPEM = readPublicKeyPEM; exports.readPublicKeyPEMAsync = readPublicKeyPEMAsync; exports.readPrivateKeyPEM = readPrivateKeyPEM; exports.readPrivateKeyPEMAsync = readPrivateKeyPEMAsync; exports.setCertificateStore = setCertificateStore; exports.getCertificateStore = getCertificateStore; exports.readPrivateRsaKey = readPrivateRsaKey; exports.readPublicRsaKey = readPublicRsaKey; exports.readCertificateRevocationList = readCertificateRevocationList; exports.readCertificateSigningRequest = readCertificateSigningRequest; exports.certificatesToPem = certificatesToPem; exports.writeCertificateChain = writeCertificateChain; exports.writeCertificateChainAsync = writeCertificateChainAsync; exports.certificatesToDer = certificatesToDer; exports.writeCertificateChainDer = writeCertificateChainDer; exports.writeCertificateChainDerAsync = writeCertificateChainDerAsync;
-//# sourceMappingURL=chunk-CHOBVT6V.cjs.map
+//# sourceMappingURL=chunk-2DISC7JP.cjs.map

package/node_modules/@sterfive/opcua-pinned/node_modules/node-opcua-crypto/dist/{chunk-CHOBVT6V.cjs.map → chunk-2DISC7JP.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/node-opcua-crypto/node-opcua-crypto/packages/node-opcua-crypto/dist/chunk-CHOBVT6V.cjs","../source_nodejs/generate_private_key_filename.ts","../source_nodejs/read.ts","../source_nodejs/read_certificate_revocation_list.ts","../source_nodejs/read_certificate_signing_request.ts","../source_nodejs/write.ts"],"names":["fs"],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACYA,gCAAoC;AACpC,gEAAe;AAEf,MAAA,SAAsB,sBAAA,CAAuB,kBAAA,EAA4B,aAAA,EAA0C;AAC/G,EAAA,MAAM,KAAA,EAAO,MAAM,+CAAA,aAA6B,CAAA;AAChD,EAAA,MAAM,cAAA,EAAgB,MAAM,+CAAA,IAAgB,CAAK,UAAU,CAAA;AAC3D,EAAA,MAAM,YAAA,CAAG,QAAA,CAAS,SAAA,CAAU,kBAAA,EAAoB,aAAA,CAAc,OAAA,EAAS,OAAO,CAAA;AAC9E,EAAA,aAAA,CAAc,QAAA,EAAU,EAAA;AACxB,EAAA,aAAA,CAAc,QAAA,EAAU,IAAI,WAAA,CAAY,CAAC,CAAA;AAC7C;AAQA,MAAA,SAAsB,+BAAA,CAAgC,kBAAA,EAA4B,aAAA,EAAmC;AACjH,EAAA,MAAM,EAAE,WAAW,EAAA,EAAI,yCAAA,KAAoB,EAAO;AAAA,IAC9C,aAAA;AAAA,IACA,kBAAA,EAAoB,EAAE,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnD,iBAAA,EAAmB,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA,EACrD,CAAC,CAAA;AACD,EAAA,MAAM,YAAA,CAAG,QAAA,CAAS,SAAA,CAAU,kBAAA,EAAoB,UAAA,EAAY,OAAO,CAAA;AACvE;ADlBA;AACA;AEPA,gFAAmB;AACnB;AACA;AACA,wEAAiB;AACjB,4EAAkB;AAelB,SAAS,YAAA,CAAa,QAAA,EAAuB;AACzC,EAAA,8BAAA,OAAc,SAAA,IAAa,QAAQ,CAAA;AACnC,EAAA,OAAO,gDAAA,YAAiBA,CAAG,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC9D;AAUA,SAAS,mBAAA,CAAoB,GAAA,EAAqB;AAC9C,EAAA,MAAM,QAAA,EAAU,GAAA,CAAI,KAAA,CAAM,8BAA8B,CAAA;AACxD,EAAA,OAAO,QAAA,EAAU,OAAA,CAAQ,OAAA,EAAS,CAAA;AACtC;AAaO,SAAS,eAAA,CAAgB,QAAA,EAA+B;AAC3D,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAOA,YAAAA,CAAG,YAAA,CAAa,QAAQ,CAAA;AAAA,EACnC;AACA,EAAA,MAAM,IAAA,EAAM,YAAA,CAAa,QAAQ,CAAA;AACjC,EAAA,MAAM,MAAA,EAAQ,mBAAA,CAAoB,GAAG,CAAA;AACrC,EAAA,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAG;AACX,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,sCAAA,EAAyC,cAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA,WAAA,EACnD,KAAK,CAAA,+GAAA;AAAA,IAEtB,CAAA;AAAA,EACJ;AACA,EAAA,OAAO,+CAAA,GAAmB,CAAA;AAC9B;AAWO,SAAS,oBAAA,CAAqB,QAAA,EAAiC;AAClE,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,yCAAA,YAAUA,CAAG,YAAA,CAAa,QAAQ,CAAgB,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,IAAA,EAAM,YAAA,CAAa,QAAQ,CAAA;AACjC,EAAA,OAAO,6BAAA,CAA8B,GAAG,CAAA;AAC5C;AAKA,MAAA,SAAsB,yBAAA,CAA0B,QAAA,EAA0C;AACtF,EAAA,MAAM,IAAA,EAAM,MAAMA,YAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAA;AAC/C,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,yCAAA,GAA4B,CAAA;AAAA,EACvC;AACA,EAAA,MAAM,IAAA,EAAM,gDAAA,GAAiB,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAClD,EAAA,OAAO,6BAAA,CAA8B,GAAG,CAAA;AAC5C;AAMA,SAAS,6BAAA,CAA8B,GAAA,EAA4B;AAC/D,EAAA,MAAM,MAAA,EAAuB,CAAC,CAAA;AAC9B,EAAA,MAAM,MAAA,EAAQ,sFAAA;AACd,EAAA,IAAI,KAAA;AACJ,EAAA,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AACtB,EAAA,MAAA,CAAO,MAAA,IAAU,IAAA,EAAM;AACnB,IAAA,MAAM,OAAA,EAAS,KAAA,CAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AAC5C,IAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC9C,IAAA,IAAI;AACA,MAAA,MAAM,eAAA,EAAiB,yCAAA,SAAmB,CAAA;AAC1C,MAAA,IAAA,CAAA,MAAW,EAAA,GAAK,cAAA,EAAgB;AAC5B,QAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA;AAAA,MAChB;AAAA,IACJ,EAAA,MAAA,CAAS,IAAA,EAAM;AAEX,MAAA,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA;AAAA,IACxB;AACA,IAAA,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,KAAA;AACX;AAYA,MAAA,SAAsB,oBAAA,CAAqB,QAAA,EAAwC;AAC/E,EAAA,MAAM,IAAA,EAAM,MAAMA,YAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAA;AAC/C,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,MAAM,QAAA,EAAU,gDAAA,GAAiB,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,EAAQ,mBAAA,CAAoB,OAAO,CAAA;AACzC,EAAA,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAG;AACX,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,2CAAA,EAA8C,cAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA,WAAA,EACxD,KAAK,CAAA,oHAAA;AAAA,IAEtB,CAAA;AAAA,EACJ;AACA,EAAA,OAAO,+CAAA,OAAuB,CAAA;AAClC;AAKO,SAAS,aAAA,CAAc,QAAA,EAA6B;AACvD,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAA,EAAMA,YAAAA,CAAG,YAAA,CAAa,QAAQ,CAAA;AACpC,IAAA,OAAO,qCAAA,GAAmB,CAAA;AAAA,EAC9B,EAAA,KAAO;AACH,IAAA,MAAM,QAAA,EAAkB,YAAA,CAAa,QAAQ,CAAA;AAC7C,IAAA,OAAO,qCAAA,OAAuB,CAAA;AAAA,EAClC;AACJ;AAKA,MAAA,SAAsB,kBAAA,CAAmB,QAAA,EAAsC;AAC3E,EAAA,MAAM,IAAA,EAAM,MAAMA,YAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAA;AAC/C,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,qCAAA,GAAmB,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,qCAAA,gDAAgB,GAAiB,CAAI,QAAA,CAAS,OAAO,CAAC,CAAC,CAAA;AAClE;AAIA,SAAS,kBAAA,CAAmB,MAAA,EAAqC;AAC7D,EAAA,GAAA,CAAI,CAAC,yBAAA,GAAoB,OAAA,CAAQ,GAAA,CAAI,oBAAA,EAAsB;AAEvD,IAAA,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AACzB,MAAA,MAAM,OAAA,EAAS,qCAAA,MAAM,EAAQ,aAAa,CAAA;AAC1C,MAAA,8BAAA,CAAQ,iBAAA,EAAmB,aAAa,CAAA,CAAE,OAAA,CAAQ,+CAAA,MAAsB,CAAW,EAAA,GAAK,CAAC,CAAA;AACzF,MAAA,OAAO,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,gBAAA,CAAiB,MAAgB,EAAE,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,YAAA;AAC3B,EAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,WAAA;AAC3B,EAAA,MAAM,SAAA,EAAW,sCAAA,MAAuB,CAAA;AACxC,EAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,MAAA;AAC3B,EAAA,OAAO,EAAE,MAAA,EAAQ,SAAS,CAAA;AAC9B;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAqB;AAC3C,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,KAAK,EAAA,EAAI,IAAA,EAAM,CAAA,EAAA;AAAM;AAC1C;AAI6D;AAC1B,EAAA;AACS,IAAA;AACP,IAAA;AAC1B,EAAA;AACkC,IAAA;AACX,IAAA;AAC9B,EAAA;AACJ;AAK0C;AACR,EAAA;AACC,EAAA;AACE,IAAA;AACjC,EAAA;AAC0B,EAAA;AAC9B;AAEmC;AACH,EAAA;AAChC;AAKsB;AACY,EAAA;AACH,EAAA;AAC/B;AAEiC;AACD,EAAA;AAChC;AAKsB;AACY,EAAA;AACH,EAAA;AAC/B;AAKkC;AACF,EAAA;AAChC;AAMsB;AACY,EAAA;AACH,EAAA;AAC/B;AAEmC;AAEC;AACd,EAAA;AACK,EAAA;AAChB,EAAA;AACX;AAC8C;AACf,EAAA;AACK,IAAA;AAChC,EAAA;AACO,EAAA;AACX;AAKkC;AACP,EAAA;AACH,IAAA;AACpB,EAAA;AACiC,EAAA;AACR,IAAA;AACzB,EAAA;AACgC,EAAA;AACX,EAAA;AACO,EAAA;AACI,EAAA;AAChB,EAAA;AACpB;AAEiC;AACI,EAAA;AACR,IAAA;AACzB,EAAA;AACgC,EAAA;AACF,EAAA;AACF,EAAA;AACK,EAAA;AACrC;AF3GmC;AACA;AG9LpB;AAIO;AACY,EAAA;AACI,EAAA;AAEvB,IAAA;AACX,EAAA;AAC6B,EAAA;AACC,EAAA;AAClC;AH4LmC;AACA;AIzMpB;AAMO;AACY,EAAA;AACI,EAAA;AAEvB,IAAA;AACX,EAAA;AAC6B,EAAA;AACC,EAAA;AAClC;AJqMmC;AACA;AKpNpB;AAemB;AACF,EAAA;AACC,EAAA;AAAqC;AACtE;AAQsC;AACP,EAAA;AAC/B;AAKsB;AACU,EAAA;AAChC;AAUkC;AACF,EAAA;AACJ,EAAA;AAC5B;AAQyC;AACV,EAAA;AAC/B;AAKsB;AACU,EAAA;AAChC;AL0KmC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/node-opcua-crypto/node-opcua-crypto/packages/node-opcua-crypto/dist/chunk-CHOBVT6V.cjs","sourcesContent":[null,"// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport { generateKeyPairSync } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport { generateKeyPair, privateKeyToPEM } from \"../source/index.js\";\nexport async function generatePrivateKeyFile(privateKeyFilename: string, modulusLength: 1024 | 2048 | 3072 | 4096) {\n    const keys = await generateKeyPair(modulusLength);\n    const privateKeyPem = await privateKeyToPEM(keys.privateKey);\n    await fs.promises.writeFile(privateKeyFilename, privateKeyPem.privPem, \"utf-8\");\n    privateKeyPem.privPem = \"\";\n    privateKeyPem.privDer = new ArrayBuffer(0);\n}\n\n/**\n * alternate function to generate PrivateKeyFile, using native\n * node:crypto.\n *\n * This function is slower than generatePrivateKeyFile\n */\nexport async function generatePrivateKeyFileAlternate(privateKeyFilename: string, modulusLength: 2048 | 3072 | 4096) {\n    const { privateKey } = generateKeyPairSync(\"rsa\", {\n        modulusLength,\n        privateKeyEncoding: { type: \"pkcs8\", format: \"pem\" },\n        publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    });\n    await fs.promises.writeFile(privateKeyFilename, privateKey, \"utf-8\");\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport assert from \"node:assert\";\nimport { createPrivateKey, createPublicKey } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport sshpk from \"sshpk\";\nimport type {\n    Certificate,\n    CertificatePEM,\n    DER,\n    KeyObject,\n    PEM,\n    PrivateKey,\n    PrivateKeyPEM,\n    PublicKey,\n    PublicKeyPEM,\n} from \"../source/common.js\";\nimport { split_der } from \"../source/crypto_explore_certificate.js\";\nimport { convertPEMtoDER, identifyPemType, removeTrailingLF, toPem } from \"../source/crypto_utils.js\";\n\nfunction _readPemFile(filename: string): PEM {\n    assert(typeof filename === \"string\");\n    return removeTrailingLF(fs.readFileSync(filename, \"utf-8\"));\n}\n\nfunction _readPemOrDerFileAsDER(filename: string): DER {\n    if (filename.match(/.*\\.der/)) {\n        return fs.readFileSync(filename) as Buffer;\n    }\n    const raw_key: string = _readPemFile(filename);\n    return convertPEMtoDER(raw_key);\n}\n\nfunction _countPemCertBlocks(pem: string): number {\n    const matches = pem.match(/-----BEGIN CERTIFICATE-----/g);\n    return matches ? matches.length : 0;\n}\n\n/**\n * Read a DER or PEM certificate from file.\n *\n * **Note:** If the PEM file contains multiple certificate blocks\n * (e.g. a leaf cert + CA chain), only the **first** certificate\n * is returned. Use {@link readCertificateChain} to read all\n * certificates individually.\n *\n * @deprecated Use {@link readCertificateChain} instead, which\n * returns each certificate as a separate DER buffer.\n */\nexport function readCertificate(filename: string): Certificate {\n    if (filename.match(/.*\\.der/)) {\n        return fs.readFileSync(filename) as Certificate;\n    }\n    const pem = _readPemFile(filename);\n    const count = _countPemCertBlocks(pem);\n    if (count > 1) {\n        console.warn(\n            `[node-opcua-crypto] readCertificate: \"${path.basename(filename)}\"` +\n            ` contains ${count} PEM certificate block(s) but only the first` +\n            ` will be used. Use readCertificateChain() to read all certificates.`,\n        );\n    }\n    return convertPEMtoDER(pem) as Certificate;\n}\n\n/**\n * Read a PEM or DER certificate file that may contain multiple\n * certificates (e.g. a leaf cert + CA issuer chain) and return\n * each certificate as a separate DER `Buffer`.\n *\n * - For a DER file, returns a single-element array.\n * - For a PEM file with N certificate blocks, returns N elements\n *   in the same order they appear in the file (leaf first).\n */\nexport function readCertificateChain(filename: string): Certificate[] {\n    if (filename.match(/.*\\.der/)) {\n        return split_der(fs.readFileSync(filename) as Certificate);\n    }\n    const pem = _readPemFile(filename);\n    return _extractAllPemDerCertificates(pem);\n}\n\n/**\n * Async version of {@link readCertificateChain}.\n */\nexport async function readCertificateChainAsync(filename: string): Promise<Certificate[]> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return split_der(buf as Certificate);\n    }\n    const pem = removeTrailingLF(buf.toString(\"utf-8\"));\n    return _extractAllPemDerCertificates(pem);\n}\n\n/**\n * Extract all CERTIFICATE PEM blocks from a PEM string and\n * return each as a separate DER `Buffer`.\n */\nfunction _extractAllPemDerCertificates(pem: string): Certificate[] {\n    const certs: Certificate[] = [];\n    const regex = /-----BEGIN CERTIFICATE-----\\r?\\n([/+=a-zA-Z0-9\\r\\n]*)\\r?\\n-----END CERTIFICATE-----/g;\n    let match: RegExpExecArray | null;\n    match = regex.exec(pem);\n    while (match !== null) {\n        const base64 = match[1].replace(/\\r?\\n/g, \"\");\n        const derBuffer = Buffer.from(base64, \"base64\") as Certificate;\n        try {\n            const separatedCerts = split_der(derBuffer);\n            for (const c of separatedCerts) {\n                certs.push(c);\n            }\n        } catch (_err) {\n            // Fallback: push buffer as is if it fails parsing\n            certs.push(derBuffer);\n        }\n        match = regex.exec(pem);\n    }\n    return certs;\n}\n\n/**\n * Async version of {@link readCertificate}.\n * Uses `fs.promises.readFile` so the event loop is not blocked\n * during I/O.\n *\n * **Note:** If the PEM file contains multiple certificate blocks,\n * only the first is returned. Use {@link readCertificateChainAsync}.\n *\n * @deprecated Use {@link readCertificateChainAsync} instead.\n */\nexport async function readCertificateAsync(filename: string): Promise<Certificate> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return buf as Certificate;\n    }\n    const raw_key = removeTrailingLF(buf.toString(\"utf-8\"));\n    const count = _countPemCertBlocks(raw_key);\n    if (count > 1) {\n        console.warn(\n            `[node-opcua-crypto] readCertificateAsync: \"${path.basename(filename)}\"` +\n            ` contains ${count} PEM certificate block(s) but only the first` +\n            ` will be used. Use readCertificateChainAsync() to read all certificates.`,\n        );\n    }\n    return convertPEMtoDER(raw_key) as Certificate;\n}\n\n/**\n * read a DER or PEM certificate from file\n */\nexport function readPublicKey(filename: string): KeyObject {\n    if (filename.match(/.*\\.der/)) {\n        const der = fs.readFileSync(filename) as Buffer;\n        return createPublicKey(der);\n    } else {\n        const raw_key: string = _readPemFile(filename);\n        return createPublicKey(raw_key);\n    }\n}\n\n/**\n * Async version of {@link readPublicKey}.\n */\nexport async function readPublicKeyAsync(filename: string): Promise<KeyObject> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return createPublicKey(buf);\n    }\n    return createPublicKey(removeTrailingLF(buf.toString(\"utf-8\")));\n}\n\n// console.log(\"createPrivateKey\", (crypto as any).createPrivateKey, process.env.NO_CREATE_PRIVATEKEY);\n\nfunction myCreatePrivateKey(rawKey: string | Buffer): PrivateKey {\n    if (!createPrivateKey || process.env.NO_CREATE_PRIVATEKEY) {\n        // we are not running nodejs or createPrivateKey is not supported in the environment\n        if (Buffer.isBuffer(rawKey)) {\n            const pemKey = toPem(rawKey, \"PRIVATE KEY\");\n            assert([\"RSA PRIVATE KEY\", \"PRIVATE KEY\"].indexOf(identifyPemType(pemKey) as string) >= 0);\n            return { hidden: pemKey };\n        }\n        return { hidden: ensureTrailingLF(rawKey as string) };\n    }\n    // see https://askubuntu.com/questions/1409458/openssl-config-cuases-error-in-node-js-crypto-how-should-the-config-be-updated\n    const backup = process.env.OPENSSL_CONF;\n    process.env.OPENSSL_CONF = \"/dev/null\";\n    const retValue = createPrivateKey(rawKey);\n    process.env.OPENSSL_CONF = backup;\n    return { hidden: retValue };\n}\n\nfunction ensureTrailingLF(str: string): string {\n    return str.match(/\\n$/) ? str : `${str}\\n`;\n}\n/**\n * read a DER or PEM certificate from file\n */\nexport function readPrivateKey(filename: string): PrivateKey {\n    if (filename.match(/.*\\.der/)) {\n        const der: Buffer = fs.readFileSync(filename);\n        return myCreatePrivateKey(der);\n    } else {\n        const raw_key: string = _readPemFile(filename);\n        return myCreatePrivateKey(raw_key);\n    }\n}\n\n/**\n * Async version of {@link readPrivateKey}.\n */\nexport async function readPrivateKeyAsync(filename: string): Promise<PrivateKey> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return myCreatePrivateKey(buf);\n    }\n    return myCreatePrivateKey(removeTrailingLF(buf.toString(\"utf-8\")));\n}\n\nexport function readCertificatePEM(filename: string): CertificatePEM {\n    return _readPemFile(filename);\n}\n\n/**\n * Async version of {@link readCertificatePEM}.\n */\nexport async function readCertificatePEMAsync(filename: string): Promise<CertificatePEM> {\n    const buf = await fs.promises.readFile(filename, \"utf-8\");\n    return removeTrailingLF(buf);\n}\n\nexport function readPublicKeyPEM(filename: string): PublicKeyPEM {\n    return _readPemFile(filename);\n}\n\n/**\n * Async version of {@link readPublicKeyPEM}.\n */\nexport async function readPublicKeyPEMAsync(filename: string): Promise<PublicKeyPEM> {\n    const buf = await fs.promises.readFile(filename, \"utf-8\");\n    return removeTrailingLF(buf);\n}\n/**\n *\n * @deprecated\n */\nexport function readPrivateKeyPEM(filename: string): PrivateKeyPEM {\n    return _readPemFile(filename);\n}\n\n/**\n * Async version of {@link readPrivateKeyPEM}.\n * @deprecated\n */\nexport async function readPrivateKeyPEMAsync(filename: string): Promise<PrivateKeyPEM> {\n    const buf = await fs.promises.readFile(filename, \"utf-8\");\n    return removeTrailingLF(buf);\n}\n\nlet _g_certificate_store: string = \"\";\n\nexport function setCertificateStore(store: string): string {\n    const old_store = _g_certificate_store;\n    _g_certificate_store = store;\n    return old_store;\n}\nexport function getCertificateStore(): string {\n    if (!_g_certificate_store) {\n        _g_certificate_store = path.join(__dirname, \"../../certificates/\");\n    }\n    return _g_certificate_store;\n}\n/**\n *\n * @param filename\n */\nexport function readPrivateRsaKey(filename: string): PrivateKey {\n    if (!createPrivateKey) {\n        throw new Error(\"createPrivateKey is not supported in this environment\");\n    }\n    if (filename.substring(0, 1) !== \".\" && !fs.existsSync(filename)) {\n        filename = path.join(getCertificateStore(), filename);\n    }\n    const content = fs.readFileSync(filename, \"utf8\");\n    const sshKey = sshpk.parsePrivateKey(content, \"auto\");\n    const key = sshKey.toString(\"pkcs1\") as PEM;\n    const hidden = createPrivateKey({ format: \"pem\", type: \"pkcs1\", key });\n    return { hidden };\n}\n\nexport function readPublicRsaKey(filename: string): PublicKey {\n    if (filename.substring(0, 1) !== \".\" && !fs.existsSync(filename)) {\n        filename = path.join(getCertificateStore(), filename);\n    }\n    const content = fs.readFileSync(filename, \"utf-8\");\n    const sshKey = sshpk.parseKey(content, \"ssh\");\n    const key = sshKey.toString(\"pkcs1\") as PEM;\n    return createPublicKey({ format: \"pem\", type: \"pkcs1\", key });\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport fs from \"node:fs\";\nimport type { CertificateRevocationList } from \"../source/common.js\";\nimport { convertPEMtoDER } from \"../source/crypto_utils.js\";\n\nexport async function readCertificateRevocationList(filename: string): Promise<CertificateRevocationList> {\n    const crl = await fs.promises.readFile(filename);\n    if (crl[0] === 0x30 && crl[1] === 0x82) {\n        // der format\n        return crl as CertificateRevocationList;\n    }\n    const raw_crl = crl.toString();\n    return convertPEMtoDER(raw_crl);\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport fs from \"node:fs\";\nimport type { CertificateRevocationList } from \"../source/common.js\";\nimport { convertPEMtoDER } from \"../source/crypto_utils.js\";\n\nexport type CertificateSigningRequest = Buffer;\n\nexport async function readCertificateSigningRequest(filename: string): Promise<CertificateSigningRequest> {\n    const csr = await fs.promises.readFile(filename);\n    if (csr[0] === 0x30 && csr[1] === 0x82) {\n        // der format\n        return csr as CertificateRevocationList;\n    }\n    const raw_crl = csr.toString();\n    return convertPEMtoDER(raw_crl);\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport fs from \"node:fs\";\n\nimport type { Certificate } from \"../source/common.js\";\nimport { combine_der } from \"../source/crypto_explore_certificate.js\";\nimport { toPem } from \"../source/crypto_utils.js\";\n\n// ── PEM ──────────────────────────────────────────────────────\n\n/**\n * Convert one or more DER certificates to a PEM string.\n *\n * Accepts a single `Certificate` (DER buffer) or an array.\n * Returns a multi-block PEM string with each certificate\n * separated by a newline.\n */\nexport function certificatesToPem(certificates: Certificate | Certificate[]): string {\n    const certs = Array.isArray(certificates) ? certificates : [certificates];\n    return `${certs.map((der) => toPem(der, \"CERTIFICATE\")).join(\"\\n\")}\\n`;\n}\n\n/**\n * Write one or more DER certificates to a PEM file.\n *\n * Each certificate is written as a separate PEM block in the\n * order provided (typically leaf first, then issuer chain).\n */\nexport function writeCertificateChain(filename: string, certificates: Certificate | Certificate[]): void {\n    fs.writeFileSync(filename, certificatesToPem(certificates), \"utf-8\");\n}\n\n/**\n * Async version of {@link writeCertificateChain}.\n */\nexport async function writeCertificateChainAsync(filename: string, certificates: Certificate | Certificate[]): Promise<void> {\n    await fs.promises.writeFile(filename, certificatesToPem(certificates), \"utf-8\");\n}\n\n// ── DER ──────────────────────────────────────────────────────\n\n/**\n * Convert one or more DER certificates to a single concatenated\n * DER buffer (OPC UA certificate chain format).\n *\n * Accepts a single `Certificate` (DER buffer) or an array.\n */\nexport function certificatesToDer(certificates: Certificate | Certificate[]): Certificate {\n    const certs = Array.isArray(certificates) ? certificates : [certificates];\n    return combine_der(certs);\n}\n\n/**\n * Write one or more DER certificates to a `.der` file as a\n * concatenated DER chain (OPC UA binary chain format).\n *\n * Order should be leaf first, then issuer chain.\n */\nexport function writeCertificateChainDer(filename: string, certificates: Certificate | Certificate[]): void {\n    fs.writeFileSync(filename, certificatesToDer(certificates));\n}\n\n/**\n * Async version of {@link writeCertificateChainDer}.\n */\nexport async function writeCertificateChainDerAsync(filename: string, certificates: Certificate | Certificate[]): Promise<void> {\n    await fs.promises.writeFile(filename, certificatesToDer(certificates));\n}\n"]}
+{"version":3,"sources":["/home/runner/work/node-opcua-crypto/node-opcua-crypto/packages/node-opcua-crypto/dist/chunk-2DISC7JP.cjs","../source_nodejs/generate_private_key_filename.ts","../source_nodejs/read.ts","../source_nodejs/read_certificate_revocation_list.ts","../source_nodejs/read_certificate_signing_request.ts","../source_nodejs/write.ts"],"names":["fs"],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACYA,gCAAoC;AACpC,gEAAe;AAEf,MAAA,SAAsB,sBAAA,CAAuB,kBAAA,EAA4B,aAAA,EAA0C;AAC/G,EAAA,MAAM,KAAA,EAAO,MAAM,+CAAA,aAA6B,CAAA;AAChD,EAAA,MAAM,cAAA,EAAgB,MAAM,+CAAA,IAAgB,CAAK,UAAU,CAAA;AAC3D,EAAA,MAAM,YAAA,CAAG,QAAA,CAAS,SAAA,CAAU,kBAAA,EAAoB,aAAA,CAAc,OAAA,EAAS,OAAO,CAAA;AAC9E,EAAA,aAAA,CAAc,QAAA,EAAU,EAAA;AACxB,EAAA,aAAA,CAAc,QAAA,EAAU,IAAI,WAAA,CAAY,CAAC,CAAA;AAC7C;AAQA,MAAA,SAAsB,+BAAA,CAAgC,kBAAA,EAA4B,aAAA,EAAmC;AACjH,EAAA,MAAM,EAAE,WAAW,EAAA,EAAI,yCAAA,KAAoB,EAAO;AAAA,IAC9C,aAAA;AAAA,IACA,kBAAA,EAAoB,EAAE,IAAA,EAAM,OAAA,EAAS,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnD,iBAAA,EAAmB,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA,EACrD,CAAC,CAAA;AACD,EAAA,MAAM,YAAA,CAAG,QAAA,CAAS,SAAA,CAAU,kBAAA,EAAoB,UAAA,EAAY,OAAO,CAAA;AACvE;ADlBA;AACA;AEPA,gFAAmB;AACnB;AACA;AACA,wEAAiB;AACjB,4EAAkB;AAelB,SAAS,YAAA,CAAa,QAAA,EAAuB;AACzC,EAAA,8BAAA,OAAc,SAAA,IAAa,QAAQ,CAAA;AACnC,EAAA,OAAO,gDAAA,YAAiBA,CAAG,YAAA,CAAa,QAAA,EAAU,OAAO,CAAC,CAAA;AAC9D;AAUA,SAAS,mBAAA,CAAoB,GAAA,EAAqB;AAC9C,EAAA,MAAM,QAAA,EAAU,GAAA,CAAI,KAAA,CAAM,8BAA8B,CAAA;AACxD,EAAA,OAAO,QAAA,EAAU,OAAA,CAAQ,OAAA,EAAS,CAAA;AACtC;AAaO,SAAS,eAAA,CAAgB,QAAA,EAA+B;AAC3D,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAOA,YAAAA,CAAG,YAAA,CAAa,QAAQ,CAAA;AAAA,EACnC;AACA,EAAA,MAAM,IAAA,EAAM,YAAA,CAAa,QAAQ,CAAA;AACjC,EAAA,MAAM,MAAA,EAAQ,mBAAA,CAAoB,GAAG,CAAA;AACrC,EAAA,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAG;AACX,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,sCAAA,EAAyC,cAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA,WAAA,EACnD,KAAK,CAAA,+GAAA;AAAA,IAEtB,CAAA;AAAA,EACJ;AACA,EAAA,OAAO,+CAAA,GAAmB,CAAA;AAC9B;AAWO,SAAS,oBAAA,CAAqB,QAAA,EAAiC;AAClE,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,yCAAA,YAAUA,CAAG,YAAA,CAAa,QAAQ,CAAgB,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,IAAA,EAAM,YAAA,CAAa,QAAQ,CAAA;AACjC,EAAA,OAAO,6BAAA,CAA8B,GAAG,CAAA;AAC5C;AAKA,MAAA,SAAsB,yBAAA,CAA0B,QAAA,EAA0C;AACtF,EAAA,MAAM,IAAA,EAAM,MAAMA,YAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAA;AAC/C,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,yCAAA,GAA4B,CAAA;AAAA,EACvC;AACA,EAAA,MAAM,IAAA,EAAM,gDAAA,GAAiB,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAClD,EAAA,OAAO,6BAAA,CAA8B,GAAG,CAAA;AAC5C;AAMA,SAAS,6BAAA,CAA8B,GAAA,EAA4B;AAC/D,EAAA,MAAM,MAAA,EAAuB,CAAC,CAAA;AAC9B,EAAA,MAAM,MAAA,EAAQ,sFAAA;AACd,EAAA,IAAI,KAAA;AACJ,EAAA,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AACtB,EAAA,MAAA,CAAO,MAAA,IAAU,IAAA,EAAM;AACnB,IAAA,MAAM,OAAA,EAAS,KAAA,CAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AAC5C,IAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC9C,IAAA,IAAI;AACA,MAAA,MAAM,eAAA,EAAiB,yCAAA,SAAmB,CAAA;AAC1C,MAAA,IAAA,CAAA,MAAW,EAAA,GAAK,cAAA,EAAgB;AAC5B,QAAA,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA;AAAA,MAChB;AAAA,IACJ,EAAA,MAAA,CAAS,IAAA,EAAM;AAEX,MAAA,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA;AAAA,IACxB;AACA,IAAA,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,KAAA;AACX;AAYA,MAAA,SAAsB,oBAAA,CAAqB,QAAA,EAAwC;AAC/E,EAAA,MAAM,IAAA,EAAM,MAAMA,YAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAA;AAC/C,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,MAAM,QAAA,EAAU,gDAAA,GAAiB,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,EAAQ,mBAAA,CAAoB,OAAO,CAAA;AACzC,EAAA,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAG;AACX,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,2CAAA,EAA8C,cAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA,WAAA,EACxD,KAAK,CAAA,oHAAA;AAAA,IAEtB,CAAA;AAAA,EACJ;AACA,EAAA,OAAO,+CAAA,OAAuB,CAAA;AAClC;AAKO,SAAS,aAAA,CAAc,QAAA,EAA6B;AACvD,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAA,EAAMA,YAAAA,CAAG,YAAA,CAAa,QAAQ,CAAA;AACpC,IAAA,OAAO,qCAAA,GAAmB,CAAA;AAAA,EAC9B,EAAA,KAAO;AACH,IAAA,MAAM,QAAA,EAAkB,YAAA,CAAa,QAAQ,CAAA;AAC7C,IAAA,OAAO,qCAAA,OAAuB,CAAA;AAAA,EAClC;AACJ;AAKA,MAAA,SAAsB,kBAAA,CAAmB,QAAA,EAAsC;AAC3E,EAAA,MAAM,IAAA,EAAM,MAAMA,YAAAA,CAAG,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAA;AAC/C,EAAA,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,IAAA,OAAO,qCAAA,GAAmB,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,qCAAA,gDAAgB,GAAiB,CAAI,QAAA,CAAS,OAAO,CAAC,CAAC,CAAA;AAClE;AAIA,SAAS,kBAAA,CAAmB,MAAA,EAAqC;AAC7D,EAAA,GAAA,CAAI,CAAC,yBAAA,GAAoB,OAAA,CAAQ,GAAA,CAAI,oBAAA,EAAsB;AAEvD,IAAA,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AACzB,MAAA,MAAM,OAAA,EAAS,qCAAA,MAAM,EAAQ,aAAa,CAAA;AAC1C,MAAA,8BAAA,CAAQ,iBAAA,EAAmB,aAAa,CAAA,CAAE,OAAA,CAAQ,+CAAA,MAAsB,CAAW,EAAA,GAAK,CAAC,CAAA;AACzF,MAAA,OAAO,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,gBAAA,CAAiB,MAAgB,EAAE,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,YAAA;AAC3B,EAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,WAAA;AAC3B,EAAA,MAAM,SAAA,EAAW,sCAAA,MAAuB,CAAA;AACxC,EAAA,OAAA,CAAQ,GAAA,CAAI,aAAA,EAAe,MAAA;AAC3B,EAAA,OAAO,EAAE,MAAA,EAAQ,SAAS,CAAA;AAC9B;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAqB;AAC3C,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,KAAK,EAAA,EAAI,IAAA,EAAM,CAAA,EAAA;AAAM;AAC1C;AAI6D;AAC1B,EAAA;AACS,IAAA;AACP,IAAA;AAC1B,EAAA;AACkC,IAAA;AACX,IAAA;AAC9B,EAAA;AACJ;AAK0C;AACR,EAAA;AACC,EAAA;AACE,IAAA;AACjC,EAAA;AAC0B,EAAA;AAC9B;AAEmC;AACH,EAAA;AAChC;AAKsB;AACY,EAAA;AACH,EAAA;AAC/B;AAEiC;AACD,EAAA;AAChC;AAKsB;AACY,EAAA;AACH,EAAA;AAC/B;AAKkC;AACF,EAAA;AAChC;AAMsB;AACY,EAAA;AACH,EAAA;AAC/B;AAEmC;AAEC;AACd,EAAA;AACK,EAAA;AAChB,EAAA;AACX;AAC8C;AACf,EAAA;AACK,IAAA;AAChC,EAAA;AACO,EAAA;AACX;AAKkC;AACP,EAAA;AACH,IAAA;AACpB,EAAA;AACiC,EAAA;AACR,IAAA;AACzB,EAAA;AACgC,EAAA;AACX,EAAA;AACO,EAAA;AACI,EAAA;AAChB,EAAA;AACpB;AAEiC;AACI,EAAA;AACR,IAAA;AACzB,EAAA;AACgC,EAAA;AACF,EAAA;AACF,EAAA;AACK,EAAA;AACrC;AF3GmC;AACA;AG9LpB;AAIO;AACY,EAAA;AACI,EAAA;AAEvB,IAAA;AACX,EAAA;AAC6B,EAAA;AACC,EAAA;AAClC;AH4LmC;AACA;AIzMpB;AAMO;AACY,EAAA;AACI,EAAA;AAEvB,IAAA;AACX,EAAA;AAC6B,EAAA;AACC,EAAA;AAClC;AJqMmC;AACA;AKpNpB;AAemB;AACF,EAAA;AACC,EAAA;AAAqC;AACtE;AAQsC;AACP,EAAA;AAC/B;AAKsB;AACU,EAAA;AAChC;AAUkC;AACF,EAAA;AACJ,EAAA;AAC5B;AAQyC;AACV,EAAA;AAC/B;AAKsB;AACU,EAAA;AAChC;AL0KmC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/node-opcua-crypto/node-opcua-crypto/packages/node-opcua-crypto/dist/chunk-2DISC7JP.cjs","sourcesContent":[null,"// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport { generateKeyPairSync } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport { generateKeyPair, privateKeyToPEM } from \"../source/index.js\";\nexport async function generatePrivateKeyFile(privateKeyFilename: string, modulusLength: 1024 | 2048 | 3072 | 4096) {\n    const keys = await generateKeyPair(modulusLength);\n    const privateKeyPem = await privateKeyToPEM(keys.privateKey);\n    await fs.promises.writeFile(privateKeyFilename, privateKeyPem.privPem, \"utf-8\");\n    privateKeyPem.privPem = \"\";\n    privateKeyPem.privDer = new ArrayBuffer(0);\n}\n\n/**\n * alternate function to generate PrivateKeyFile, using native\n * node:crypto.\n *\n * This function is slower than generatePrivateKeyFile\n */\nexport async function generatePrivateKeyFileAlternate(privateKeyFilename: string, modulusLength: 2048 | 3072 | 4096) {\n    const { privateKey } = generateKeyPairSync(\"rsa\", {\n        modulusLength,\n        privateKeyEncoding: { type: \"pkcs8\", format: \"pem\" },\n        publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    });\n    await fs.promises.writeFile(privateKeyFilename, privateKey, \"utf-8\");\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport assert from \"node:assert\";\nimport { createPrivateKey, createPublicKey } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport sshpk from \"sshpk\";\nimport type {\n    Certificate,\n    CertificatePEM,\n    DER,\n    KeyObject,\n    PEM,\n    PrivateKey,\n    PrivateKeyPEM,\n    PublicKey,\n    PublicKeyPEM,\n} from \"../source/common.js\";\nimport { split_der } from \"../source/crypto_explore_certificate.js\";\nimport { convertPEMtoDER, identifyPemType, removeTrailingLF, toPem } from \"../source/crypto_utils.js\";\n\nfunction _readPemFile(filename: string): PEM {\n    assert(typeof filename === \"string\");\n    return removeTrailingLF(fs.readFileSync(filename, \"utf-8\"));\n}\n\nfunction _readPemOrDerFileAsDER(filename: string): DER {\n    if (filename.match(/.*\\.der/)) {\n        return fs.readFileSync(filename) as Buffer;\n    }\n    const raw_key: string = _readPemFile(filename);\n    return convertPEMtoDER(raw_key);\n}\n\nfunction _countPemCertBlocks(pem: string): number {\n    const matches = pem.match(/-----BEGIN CERTIFICATE-----/g);\n    return matches ? matches.length : 0;\n}\n\n/**\n * Read a DER or PEM certificate from file.\n *\n * **Note:** If the PEM file contains multiple certificate blocks\n * (e.g. a leaf cert + CA chain), only the **first** certificate\n * is returned. Use {@link readCertificateChain} to read all\n * certificates individually.\n *\n * @deprecated Use {@link readCertificateChain} instead, which\n * returns each certificate as a separate DER buffer.\n */\nexport function readCertificate(filename: string): Certificate {\n    if (filename.match(/.*\\.der/)) {\n        return fs.readFileSync(filename) as Certificate;\n    }\n    const pem = _readPemFile(filename);\n    const count = _countPemCertBlocks(pem);\n    if (count > 1) {\n        console.warn(\n            `[node-opcua-crypto] readCertificate: \"${path.basename(filename)}\"` +\n            ` contains ${count} PEM certificate block(s) but only the first` +\n            ` will be used. Use readCertificateChain() to read all certificates.`,\n        );\n    }\n    return convertPEMtoDER(pem) as Certificate;\n}\n\n/**\n * Read a PEM or DER certificate file that may contain multiple\n * certificates (e.g. a leaf cert + CA issuer chain) and return\n * each certificate as a separate DER `Buffer`.\n *\n * - For a DER file, returns a single-element array.\n * - For a PEM file with N certificate blocks, returns N elements\n *   in the same order they appear in the file (leaf first).\n */\nexport function readCertificateChain(filename: string): Certificate[] {\n    if (filename.match(/.*\\.der/)) {\n        return split_der(fs.readFileSync(filename) as Certificate);\n    }\n    const pem = _readPemFile(filename);\n    return _extractAllPemDerCertificates(pem);\n}\n\n/**\n * Async version of {@link readCertificateChain}.\n */\nexport async function readCertificateChainAsync(filename: string): Promise<Certificate[]> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return split_der(buf as Certificate);\n    }\n    const pem = removeTrailingLF(buf.toString(\"utf-8\"));\n    return _extractAllPemDerCertificates(pem);\n}\n\n/**\n * Extract all CERTIFICATE PEM blocks from a PEM string and\n * return each as a separate DER `Buffer`.\n */\nfunction _extractAllPemDerCertificates(pem: string): Certificate[] {\n    const certs: Certificate[] = [];\n    const regex = /-----BEGIN CERTIFICATE-----\\r?\\n([/+=a-zA-Z0-9\\r\\n]*)\\r?\\n-----END CERTIFICATE-----/g;\n    let match: RegExpExecArray | null;\n    match = regex.exec(pem);\n    while (match !== null) {\n        const base64 = match[1].replace(/\\r?\\n/g, \"\");\n        const derBuffer = Buffer.from(base64, \"base64\") as Certificate;\n        try {\n            const separatedCerts = split_der(derBuffer);\n            for (const c of separatedCerts) {\n                certs.push(c);\n            }\n        } catch (_err) {\n            // Fallback: push buffer as is if it fails parsing\n            certs.push(derBuffer);\n        }\n        match = regex.exec(pem);\n    }\n    return certs;\n}\n\n/**\n * Async version of {@link readCertificate}.\n * Uses `fs.promises.readFile` so the event loop is not blocked\n * during I/O.\n *\n * **Note:** If the PEM file contains multiple certificate blocks,\n * only the first is returned. Use {@link readCertificateChainAsync}.\n *\n * @deprecated Use {@link readCertificateChainAsync} instead.\n */\nexport async function readCertificateAsync(filename: string): Promise<Certificate> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return buf as Certificate;\n    }\n    const raw_key = removeTrailingLF(buf.toString(\"utf-8\"));\n    const count = _countPemCertBlocks(raw_key);\n    if (count > 1) {\n        console.warn(\n            `[node-opcua-crypto] readCertificateAsync: \"${path.basename(filename)}\"` +\n            ` contains ${count} PEM certificate block(s) but only the first` +\n            ` will be used. Use readCertificateChainAsync() to read all certificates.`,\n        );\n    }\n    return convertPEMtoDER(raw_key) as Certificate;\n}\n\n/**\n * read a DER or PEM certificate from file\n */\nexport function readPublicKey(filename: string): KeyObject {\n    if (filename.match(/.*\\.der/)) {\n        const der = fs.readFileSync(filename) as Buffer;\n        return createPublicKey(der);\n    } else {\n        const raw_key: string = _readPemFile(filename);\n        return createPublicKey(raw_key);\n    }\n}\n\n/**\n * Async version of {@link readPublicKey}.\n */\nexport async function readPublicKeyAsync(filename: string): Promise<KeyObject> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return createPublicKey(buf);\n    }\n    return createPublicKey(removeTrailingLF(buf.toString(\"utf-8\")));\n}\n\n// console.log(\"createPrivateKey\", (crypto as any).createPrivateKey, process.env.NO_CREATE_PRIVATEKEY);\n\nfunction myCreatePrivateKey(rawKey: string | Buffer): PrivateKey {\n    if (!createPrivateKey || process.env.NO_CREATE_PRIVATEKEY) {\n        // we are not running nodejs or createPrivateKey is not supported in the environment\n        if (Buffer.isBuffer(rawKey)) {\n            const pemKey = toPem(rawKey, \"PRIVATE KEY\");\n            assert([\"RSA PRIVATE KEY\", \"PRIVATE KEY\"].indexOf(identifyPemType(pemKey) as string) >= 0);\n            return { hidden: pemKey };\n        }\n        return { hidden: ensureTrailingLF(rawKey as string) };\n    }\n    // see https://askubuntu.com/questions/1409458/openssl-config-cuases-error-in-node-js-crypto-how-should-the-config-be-updated\n    const backup = process.env.OPENSSL_CONF;\n    process.env.OPENSSL_CONF = \"/dev/null\";\n    const retValue = createPrivateKey(rawKey);\n    process.env.OPENSSL_CONF = backup;\n    return { hidden: retValue };\n}\n\nfunction ensureTrailingLF(str: string): string {\n    return str.match(/\\n$/) ? str : `${str}\\n`;\n}\n/**\n * read a DER or PEM certificate from file\n */\nexport function readPrivateKey(filename: string): PrivateKey {\n    if (filename.match(/.*\\.der/)) {\n        const der: Buffer = fs.readFileSync(filename);\n        return myCreatePrivateKey(der);\n    } else {\n        const raw_key: string = _readPemFile(filename);\n        return myCreatePrivateKey(raw_key);\n    }\n}\n\n/**\n * Async version of {@link readPrivateKey}.\n */\nexport async function readPrivateKeyAsync(filename: string): Promise<PrivateKey> {\n    const buf = await fs.promises.readFile(filename);\n    if (filename.match(/.*\\.der/)) {\n        return myCreatePrivateKey(buf);\n    }\n    return myCreatePrivateKey(removeTrailingLF(buf.toString(\"utf-8\")));\n}\n\nexport function readCertificatePEM(filename: string): CertificatePEM {\n    return _readPemFile(filename);\n}\n\n/**\n * Async version of {@link readCertificatePEM}.\n */\nexport async function readCertificatePEMAsync(filename: string): Promise<CertificatePEM> {\n    const buf = await fs.promises.readFile(filename, \"utf-8\");\n    return removeTrailingLF(buf);\n}\n\nexport function readPublicKeyPEM(filename: string): PublicKeyPEM {\n    return _readPemFile(filename);\n}\n\n/**\n * Async version of {@link readPublicKeyPEM}.\n */\nexport async function readPublicKeyPEMAsync(filename: string): Promise<PublicKeyPEM> {\n    const buf = await fs.promises.readFile(filename, \"utf-8\");\n    return removeTrailingLF(buf);\n}\n/**\n *\n * @deprecated\n */\nexport function readPrivateKeyPEM(filename: string): PrivateKeyPEM {\n    return _readPemFile(filename);\n}\n\n/**\n * Async version of {@link readPrivateKeyPEM}.\n * @deprecated\n */\nexport async function readPrivateKeyPEMAsync(filename: string): Promise<PrivateKeyPEM> {\n    const buf = await fs.promises.readFile(filename, \"utf-8\");\n    return removeTrailingLF(buf);\n}\n\nlet _g_certificate_store: string = \"\";\n\nexport function setCertificateStore(store: string): string {\n    const old_store = _g_certificate_store;\n    _g_certificate_store = store;\n    return old_store;\n}\nexport function getCertificateStore(): string {\n    if (!_g_certificate_store) {\n        _g_certificate_store = path.join(__dirname, \"../../certificates/\");\n    }\n    return _g_certificate_store;\n}\n/**\n *\n * @param filename\n */\nexport function readPrivateRsaKey(filename: string): PrivateKey {\n    if (!createPrivateKey) {\n        throw new Error(\"createPrivateKey is not supported in this environment\");\n    }\n    if (filename.substring(0, 1) !== \".\" && !fs.existsSync(filename)) {\n        filename = path.join(getCertificateStore(), filename);\n    }\n    const content = fs.readFileSync(filename, \"utf8\");\n    const sshKey = sshpk.parsePrivateKey(content, \"auto\");\n    const key = sshKey.toString(\"pkcs1\") as PEM;\n    const hidden = createPrivateKey({ format: \"pem\", type: \"pkcs1\", key });\n    return { hidden };\n}\n\nexport function readPublicRsaKey(filename: string): PublicKey {\n    if (filename.substring(0, 1) !== \".\" && !fs.existsSync(filename)) {\n        filename = path.join(getCertificateStore(), filename);\n    }\n    const content = fs.readFileSync(filename, \"utf-8\");\n    const sshKey = sshpk.parseKey(content, \"ssh\");\n    const key = sshKey.toString(\"pkcs1\") as PEM;\n    return createPublicKey({ format: \"pem\", type: \"pkcs1\", key });\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport fs from \"node:fs\";\nimport type { CertificateRevocationList } from \"../source/common.js\";\nimport { convertPEMtoDER } from \"../source/crypto_utils.js\";\n\nexport async function readCertificateRevocationList(filename: string): Promise<CertificateRevocationList> {\n    const crl = await fs.promises.readFile(filename);\n    if (crl[0] === 0x30 && crl[1] === 0x82) {\n        // der format\n        return crl as CertificateRevocationList;\n    }\n    const raw_crl = crl.toString();\n    return convertPEMtoDER(raw_crl);\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport fs from \"node:fs\";\nimport type { CertificateRevocationList } from \"../source/common.js\";\nimport { convertPEMtoDER } from \"../source/crypto_utils.js\";\n\nexport type CertificateSigningRequest = Buffer;\n\nexport async function readCertificateSigningRequest(filename: string): Promise<CertificateSigningRequest> {\n    const csr = await fs.promises.readFile(filename);\n    if (csr[0] === 0x30 && csr[1] === 0x82) {\n        // der format\n        return csr as CertificateRevocationList;\n    }\n    const raw_crl = csr.toString();\n    return convertPEMtoDER(raw_crl);\n}\n","// ---------------------------------------------------------------------------------------------------------------------\n// node-opcua-crypto\n// ---------------------------------------------------------------------------------------------------------------------\n// Copyright (c) 2014-2022 - Etienne Rossignon - etienne.rossignon (at) gadz.org\n// Copyright (c) 2022-2026 - Sterfive.com\n// ---------------------------------------------------------------------------------------------------------------------\n//\n// This  project is licensed under the terms of the MIT license.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated\n// documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the\n// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n// permit persons to whom the Software is furnished to do so,  subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the\n// Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE\n// WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\n// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n// ---------------------------------------------------------------------------------------------------------------------\n\nimport fs from \"node:fs\";\n\nimport type { Certificate } from \"../source/common.js\";\nimport { combine_der } from \"../source/crypto_explore_certificate.js\";\nimport { toPem } from \"../source/crypto_utils.js\";\n\n// ── PEM ──────────────────────────────────────────────────────\n\n/**\n * Convert one or more DER certificates to a PEM string.\n *\n * Accepts a single `Certificate` (DER buffer) or an array.\n * Returns a multi-block PEM string with each certificate\n * separated by a newline.\n */\nexport function certificatesToPem(certificates: Certificate | Certificate[]): string {\n    const certs = Array.isArray(certificates) ? certificates : [certificates];\n    return `${certs.map((der) => toPem(der, \"CERTIFICATE\")).join(\"\\n\")}\\n`;\n}\n\n/**\n * Write one or more DER certificates to a PEM file.\n *\n * Each certificate is written as a separate PEM block in the\n * order provided (typically leaf first, then issuer chain).\n */\nexport function writeCertificateChain(filename: string, certificates: Certificate | Certificate[]): void {\n    fs.writeFileSync(filename, certificatesToPem(certificates), \"utf-8\");\n}\n\n/**\n * Async version of {@link writeCertificateChain}.\n */\nexport async function writeCertificateChainAsync(filename: string, certificates: Certificate | Certificate[]): Promise<void> {\n    await fs.promises.writeFile(filename, certificatesToPem(certificates), \"utf-8\");\n}\n\n// ── DER ──────────────────────────────────────────────────────\n\n/**\n * Convert one or more DER certificates to a single concatenated\n * DER buffer (OPC UA certificate chain format).\n *\n * Accepts a single `Certificate` (DER buffer) or an array.\n */\nexport function certificatesToDer(certificates: Certificate | Certificate[]): Certificate {\n    const certs = Array.isArray(certificates) ? certificates : [certificates];\n    return combine_der(certs);\n}\n\n/**\n * Write one or more DER certificates to a `.der` file as a\n * concatenated DER chain (OPC UA binary chain format).\n *\n * Order should be leaf first, then issuer chain.\n */\nexport function writeCertificateChainDer(filename: string, certificates: Certificate | Certificate[]): void {\n    fs.writeFileSync(filename, certificatesToDer(certificates));\n}\n\n/**\n * Async version of {@link writeCertificateChainDer}.\n */\nexport async function writeCertificateChainDerAsync(filename: string, certificates: Certificate | Certificate[]): Promise<void> {\n    await fs.promises.writeFile(filename, certificatesToDer(certificates));\n}\n"]}

package/node_modules/@sterfive/opcua-pinned/node_modules/node-opcua-crypto/dist/{chunk-ZGFOQAZK.js → chunk-EJK7NCWU.js}

@@ -8,7 +8,7 @@ import {
   removeTrailingLF,
   split_der,
   toPem
-} from "./chunk-JHDYJSUT.js";
+} from "./chunk-NX3DSTD6.js";
 
 // source_nodejs/generate_private_key_filename.ts
 import { generateKeyPairSync } from "crypto";
@@ -288,4 +288,4 @@ export {
   writeCertificateChainDer,
   writeCertificateChainDerAsync
 };
-//# sourceMappingURL=chunk-ZGFOQAZK.js.map
+//# sourceMappingURL=chunk-EJK7NCWU.js.map