@owf/x509 0.0.0-stage → 0.0.0

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["X509Name","X509Certificate","X509Certificate","AsnRevokedCertificate"],"sources":["../src/constants.ts","../src/x509-exception.ts","../src/encoding.ts","../src/der.ts","../src/name.ts","../src/extensions.ts","../src/qc-statements.ts","../src/certificate.ts","../src/signature.ts","../src/create.ts","../src/crl.ts"],"sourcesContent":["import { id_pe_qcStatements } from '@peculiar/asn1-x509-qualified'\nimport {\n  id_etsi_qcs_qcCClegislation,\n  id_etsi_qcs_qcCompliance,\n  id_etsi_qcs_qcPDS,\n  id_etsi_qcs_qcSSCD,\n  id_etsi_qcs_qcType,\n  id_etsi_qct_eseal,\n  id_etsi_qct_esign,\n  id_etsi_qct_web,\n} from '@peculiar/asn1-x509-qualified-etsi'\n\n/** X.520 attribute types and PKCS#9 emailAddress, as used in distinguished names */\nexport const ATTRIBUTE_TYPES = {\n  commonName: '2.5.4.3',\n  surname: '2.5.4.4',\n  serialNumber: '2.5.4.5',\n  countryName: '2.5.4.6',\n  localityName: '2.5.4.7',\n  stateOrProvinceName: '2.5.4.8',\n  streetAddress: '2.5.4.9',\n  organizationName: '2.5.4.10',\n  organizationalUnitName: '2.5.4.11',\n  title: '2.5.4.12',\n  postalCode: '2.5.4.17',\n  telephoneNumber: '2.5.4.20',\n  givenName: '2.5.4.42',\n  initials: '2.5.4.43',\n  generationQualifier: '2.5.4.44',\n  pseudonym: '2.5.4.65',\n  organizationIdentifier: '2.5.4.97',\n  emailAddress: '1.2.840.113549.1.9.1',\n} as const\n\nexport type AttributeName = keyof typeof ATTRIBUTE_TYPES\n\n/** Policy qualifier identifiers (RFC 5280 clause 4.2.1.4) */\nexport const POLICY_QUALIFIERS = {\n  cps: '1.3.6.1.5.5.7.2.1',\n  unotice: '1.3.6.1.5.5.7.2.2',\n} as const\n\n/** Access methods for the Authority Information Access extension (RFC 5280 clause 4.2.2.1) */\nexport const ACCESS_METHODS = {\n  ocsp: '1.3.6.1.5.5.7.48.1',\n  caIssuers: '1.3.6.1.5.5.7.48.2',\n} as const\n\n/** QCStatements extension (RFC 3739) and statements from ETSI EN 319 412-5 */\nexport const QC_STATEMENTS = {\n  extension: id_pe_qcStatements,\n  qcCompliance: id_etsi_qcs_qcCompliance,\n  qcSSCD: id_etsi_qcs_qcSSCD,\n  qcPDS: id_etsi_qcs_qcPDS,\n  qcType: id_etsi_qcs_qcType,\n  qcCClegislation: id_etsi_qcs_qcCClegislation,\n} as const\n\n/** QcType values (ETSI EN 319 412-5 clause 4.2.3) */\nexport const QC_TYPES = {\n  esign: id_etsi_qct_esign,\n  eseal: id_etsi_qct_eseal,\n  web: id_etsi_qct_web,\n} as const\n\nexport type QcType = keyof typeof QC_TYPES\n\n/** Signature algorithms supported for creating and describing certificates and CRLs */\nexport const SIGNATURE_ALGORITHMS = {\n  ES256: { oid: '1.2.840.10045.4.3.2', hash: 'SHA-256', family: 'ecdsa' },\n  ES384: { oid: '1.2.840.10045.4.3.3', hash: 'SHA-384', family: 'ecdsa' },\n  ES512: { oid: '1.2.840.10045.4.3.4', hash: 'SHA-512', family: 'ecdsa' },\n  RS256: { oid: '1.2.840.113549.1.1.11', hash: 'SHA-256', family: 'rsa' },\n  RS384: { oid: '1.2.840.113549.1.1.12', hash: 'SHA-384', family: 'rsa' },\n  RS512: { oid: '1.2.840.113549.1.1.13', hash: 'SHA-512', family: 'rsa' },\n} as const\n\nexport type SignatureAlgorithm = keyof typeof SIGNATURE_ALGORITHMS\n\n/** Public key algorithm and curve identifiers */\nexport const KEY_ALGORITHMS = {\n  ecPublicKey: '1.2.840.10045.2.1',\n  rsaEncryption: '1.2.840.113549.1.1.1',\n  'P-256': '1.2.840.10045.3.1.7',\n  'P-384': '1.3.132.0.34',\n  'P-521': '1.3.132.0.35',\n} as const\n\n/** CRL entry revocation reasons (RFC 5280 clause 5.3.1) */\nexport const CRL_REASONS = {\n  unspecified: 0,\n  keyCompromise: 1,\n  cACompromise: 2,\n  affiliationChanged: 3,\n  superseded: 4,\n  cessationOfOperation: 5,\n  certificateHold: 6,\n  removeFromCRL: 8,\n  privilegeWithdrawn: 9,\n  aACompromise: 10,\n} as const\n\nexport type CrlReason = keyof typeof CRL_REASONS\n","import { IdentityException } from '@owf/identity-common'\n\n/**\n * X509Exception is thrown when a certificate or CRL cannot be parsed or created.\n */\nexport class X509Exception extends IdentityException {\n  constructor(message: string, details?: unknown) {\n    super(message, details)\n    Object.setPrototypeOf(this, X509Exception.prototype)\n    this.name = 'X509Exception'\n  }\n}\n","import { base64 } from '@owf/identity-common'\nimport { X509Exception } from './x509-exception'\n\n/** DER bytes, a base64 encoded DER string, or a PEM string */\nexport type DerInput = Uint8Array | ArrayBuffer | string\n\n/** A DER encoded certificate as bytes, a base64 DER string, or a PEM string */\nexport type CertificateInput = DerInput\n\n/** A DER encoded CRL as bytes, a base64 DER string, or a PEM string (`X509 CRL`) */\nexport type CrlInput = DerInput\n\nexport const PEM_LABELS = {\n  certificate: 'CERTIFICATE',\n  crl: 'X509 CRL',\n} as const\n\n/**\n * Normalize a {@link DerInput} to DER bytes. PEM strings must use the given label; the\n * first matching block is used.\n */\nexport function toDer(input: DerInput, label: string = PEM_LABELS.certificate): Uint8Array {\n  if (input instanceof Uint8Array) return input\n  if (input instanceof ArrayBuffer) return new Uint8Array(input)\n  if (typeof input !== 'string') {\n    throw new X509Exception('Input must be DER bytes, a base64 DER string, or PEM')\n  }\n  let body = input\n  if (input.includes('-----BEGIN')) {\n    const pem = input.match(new RegExp(`-----BEGIN ${label}-----([\\\\s\\\\S]*?)-----END ${label}-----`))\n    if (!pem) throw new X509Exception(`No PEM block with label \"${label}\" found`)\n    body = pem[1]\n  }\n  body = body.replace(/\\s/g, '')\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(body)) {\n    throw new X509Exception('Input is neither PEM nor base64 encoded DER')\n  }\n  return base64.decode(body)\n}\n\n/** Encode DER bytes as PEM. */\nexport function toPem(der: Uint8Array, label: string = PEM_LABELS.certificate): string {\n  const lines = base64.encode(der).match(/.{1,64}/g) ?? []\n  return `-----BEGIN ${label}-----\\n${lines.join('\\n')}\\n-----END ${label}-----\\n`\n}\n\n/** Copy bytes into a standalone ArrayBuffer (asn1-schema works on ArrayBuffers). */\nexport function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  return bytes.slice().buffer as ArrayBuffer\n}\n","import { base64url, concatBytes, hexEncode, type JsonWebKey } from '@owf/identity-common'\nimport { AsnConvert } from '@peculiar/asn1-schema'\nimport { AlgorithmIdentifier, SubjectPublicKeyInfo } from '@peculiar/asn1-x509'\nimport * as asn1js from 'asn1js'\nimport { KEY_ALGORITHMS } from './constants'\nimport { toArrayBuffer } from './encoding'\nimport type { ParsedPublicKey } from './types'\nimport { X509Exception } from './x509-exception'\n\nconst CURVES = {\n  'P-256': { oid: KEY_ALGORITHMS['P-256'], size: 32 },\n  'P-384': { oid: KEY_ALGORITHMS['P-384'], size: 48 },\n  'P-521': { oid: KEY_ALGORITHMS['P-521'], size: 66 },\n} as const\n\ntype CurveName = keyof typeof CURVES\n\n/** Byte length of a coordinate (and of r and s in an ECDSA signature) for a named curve OID */\nexport function curveCoordinateLength(namedCurve: string | undefined): number | undefined {\n  return Object.values(CURVES).find((c) => c.oid === namedCurve)?.size\n}\n\n/** Parse a single DER value, rejecting trailing or malformed data. */\nexport function parseDer(bytes: Uint8Array | ArrayBuffer): asn1js.AsnType {\n  const buffer = bytes instanceof Uint8Array ? toArrayBuffer(bytes) : bytes\n  const result = asn1js.fromBER(buffer)\n  if (result.offset === -1 || result.offset !== buffer.byteLength) {\n    throw new X509Exception('Invalid DER encoding')\n  }\n  return result.result\n}\n\n/** Decode an ASN.1 string type (or unwrap an explicit tag around one) to a JS string. */\nexport function asn1ToString(node: asn1js.AsnType): string | undefined {\n  if (node instanceof asn1js.BaseStringBlock) return node.getValue()\n  if (node instanceof asn1js.Constructed && node.valueBlock.value.length === 1) {\n    return asn1ToString(node.valueBlock.value[0])\n  }\n  return undefined\n}\n\n/** Strip leading zeros from an unsigned big endian integer. */\nfunction stripLeadingZeros(bytes: Uint8Array): Uint8Array {\n  let i = 0\n  while (i < bytes.length - 1 && bytes[i] === 0) i++\n  return bytes.subarray(i)\n}\n\n/**\n * Encode unsigned big endian bytes as the content of a DER INTEGER, adding a leading\n * zero when the high bit is set so the value stays positive.\n */\nexport function toPositiveIntegerBytes(bytes: Uint8Array): Uint8Array {\n  const stripped = stripLeadingZeros(bytes)\n  return stripped[0] & 0x80 ? concatBytes(new Uint8Array([0]), stripped) : stripped\n}\n\nfunction integer(bytes: Uint8Array): asn1js.Integer {\n  return new asn1js.Integer({ valueHex: toArrayBuffer(toPositiveIntegerBytes(bytes)) })\n}\n\nfunction leftPad(bytes: Uint8Array, length: number): Uint8Array {\n  const stripped = stripLeadingZeros(bytes)\n  if (stripped.length > length) {\n    throw new X509Exception('Integer does not fit the expected length')\n  }\n  const out = new Uint8Array(length)\n  out.set(stripped, length - stripped.length)\n  return out\n}\n\n/** Convert an IEEE P1363 (r || s) ECDSA signature to DER. */\nexport function ecdsaP1363ToDer(signature: Uint8Array, coordinateLength: number): Uint8Array {\n  if (signature.length !== coordinateLength * 2) {\n    throw new X509Exception(\n      `Expected a ${coordinateLength * 2} byte IEEE P1363 ECDSA signature, got ${signature.length} bytes`\n    )\n  }\n  const seq = new asn1js.Sequence({\n    value: [integer(signature.subarray(0, coordinateLength)), integer(signature.subarray(coordinateLength))],\n  })\n  return new Uint8Array(seq.toBER())\n}\n\n/** Convert a DER ECDSA signature to IEEE P1363 (r || s). */\nexport function ecdsaDerToP1363(signature: Uint8Array, coordinateLength: number): Uint8Array {\n  const seq = parseDer(signature)\n  if (!(seq instanceof asn1js.Sequence) || seq.valueBlock.value.length !== 2) {\n    throw new X509Exception('Invalid DER ECDSA signature')\n  }\n  const [r, s] = seq.valueBlock.value\n  if (!(r instanceof asn1js.Integer) || !(s instanceof asn1js.Integer)) {\n    throw new X509Exception('Invalid DER ECDSA signature')\n  }\n  return concatBytes(\n    leftPad(new Uint8Array(r.valueBlock.valueHexView), coordinateLength),\n    leftPad(new Uint8Array(s.valueBlock.valueHexView), coordinateLength)\n  )\n}\n\n/**\n * Convert a public JWK to a DER SubjectPublicKeyInfo. Refuses private keys: only the\n * public part of the wallet-relying party key is needed to issue its certificate.\n */\nexport function publicJwkToSpki(jwk: JsonWebKey): Uint8Array {\n  if (jwk.d !== undefined || jwk.p !== undefined || jwk.q !== undefined) {\n    throw new X509Exception('The subject public key must not contain private key material')\n  }\n  if (jwk.kty === 'EC') {\n    const curve = CURVES[jwk.crv as CurveName]\n    if (!curve || !jwk.x || !jwk.y) {\n      throw new X509Exception(`Unsupported EC public key (crv: ${jwk.crv})`)\n    }\n    const point = concatBytes(\n      new Uint8Array([4]),\n      leftPad(base64url.decode(jwk.x), curve.size),\n      leftPad(base64url.decode(jwk.y), curve.size)\n    )\n    const spki = new SubjectPublicKeyInfo({\n      algorithm: new AlgorithmIdentifier({\n        algorithm: KEY_ALGORITHMS.ecPublicKey,\n        parameters: new asn1js.ObjectIdentifier({ value: curve.oid }).toBER(),\n      }),\n      subjectPublicKey: toArrayBuffer(point),\n    })\n    return new Uint8Array(AsnConvert.serialize(spki))\n  }\n  if (jwk.kty === 'RSA') {\n    if (!jwk.n || !jwk.e) throw new X509Exception('RSA public key requires n and e')\n    const rsaPublicKey = new asn1js.Sequence({\n      value: [integer(base64url.decode(jwk.n)), integer(base64url.decode(jwk.e))],\n    })\n    const spki = new SubjectPublicKeyInfo({\n      algorithm: new AlgorithmIdentifier({ algorithm: KEY_ALGORITHMS.rsaEncryption, parameters: null }),\n      subjectPublicKey: rsaPublicKey.toBER(),\n    })\n    return new Uint8Array(AsnConvert.serialize(spki))\n  }\n  throw new X509Exception(`Unsupported key type: ${jwk.kty}`)\n}\n\n/** Describe a SubjectPublicKeyInfo, including a JWK for EC and RSA keys. */\nexport function describePublicKey(spki: SubjectPublicKeyInfo): ParsedPublicKey {\n  const der = new Uint8Array(AsnConvert.serialize(spki))\n  const algorithm = spki.algorithm.algorithm\n  const key = new Uint8Array(spki.subjectPublicKey)\n\n  if (algorithm === KEY_ALGORITHMS.ecPublicKey && spki.algorithm.parameters) {\n    const namedCurveNode = parseDer(spki.algorithm.parameters)\n    const namedCurve =\n      namedCurveNode instanceof asn1js.ObjectIdentifier ? namedCurveNode.valueBlock.toString() : undefined\n    const entry = Object.entries(CURVES).find(([, c]) => c.oid === namedCurve)\n    let jwk: JsonWebKey | undefined\n    if (entry && key[0] === 4 && key.length === 1 + entry[1].size * 2) {\n      const size = entry[1].size\n      jwk = {\n        kty: 'EC',\n        crv: entry[0],\n        x: base64url.encode(key.subarray(1, 1 + size)),\n        y: base64url.encode(key.subarray(1 + size)),\n      }\n    }\n    return { algorithm, namedCurve, spki: der, jwk }\n  }\n\n  if (algorithm === KEY_ALGORITHMS.rsaEncryption) {\n    let jwk: JsonWebKey | undefined\n    try {\n      const seq = parseDer(key)\n      if (seq instanceof asn1js.Sequence) {\n        const [n, e] = seq.valueBlock.value\n        if (n instanceof asn1js.Integer && e instanceof asn1js.Integer) {\n          jwk = {\n            kty: 'RSA',\n            n: base64url.encode(stripLeadingZeros(new Uint8Array(n.valueBlock.valueHexView))),\n            e: base64url.encode(stripLeadingZeros(new Uint8Array(e.valueBlock.valueHexView))),\n          }\n        }\n      }\n    } catch {\n      // Leave jwk undefined for malformed RSA keys\n    }\n    return { algorithm, spki: der, jwk }\n  }\n\n  return { algorithm, spki: der }\n}\n\nexport function toHex(bytes: ArrayBuffer | Uint8Array): string {\n  return hexEncode(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes))\n}\n\nfunction derLength(length: number): Uint8Array {\n  if (length < 0x80) return new Uint8Array([length])\n  const bytes: number[] = []\n  for (let l = length; l > 0; l >>= 8) bytes.unshift(l & 0xff)\n  return new Uint8Array([0x80 | bytes.length, ...bytes])\n}\n\n/** Encode a single DER TLV. */\nexport function derTlv(tag: number, content: Uint8Array): Uint8Array {\n  return concatBytes(new Uint8Array([tag]), derLength(content.length), content)\n}\n\n/** Interpret big endian two's complement INTEGER content as a bigint (non-negative values only). */\nexport function integerBytesToBigInt(bytes: Uint8Array): bigint {\n  return bytes.length === 0 ? BigInt(0) : BigInt(`0x${hexEncode(bytes)}`)\n}\n","import {\n  AttributeTypeAndValue,\n  AttributeValue,\n  type Name,\n  RelativeDistinguishedName,\n  Name as X509Name,\n} from '@peculiar/asn1-x509'\nimport { ATTRIBUTE_TYPES, type AttributeName } from './constants'\nimport { toHex } from './der'\nimport type { DistinguishedName, DistinguishedNameAttribute } from './types'\nimport { X509Exception } from './x509-exception'\n\nconst NAME_BY_OID = new Map<string, AttributeName>(\n  Object.entries(ATTRIBUTE_TYPES).map(([name, oid]) => [oid, name as AttributeName])\n)\n\n/** Short names for the RFC 4514 representation (RFC 4514 clause 3 plus common extensions) */\nconst RFC4514_SHORT_NAMES: Partial<Record<AttributeName, string>> = {\n  commonName: 'CN',\n  surname: 'SN',\n  serialNumber: 'SERIALNUMBER',\n  countryName: 'C',\n  localityName: 'L',\n  stateOrProvinceName: 'ST',\n  streetAddress: 'STREET',\n  organizationName: 'O',\n  organizationalUnitName: 'OU',\n  title: 'T',\n  givenName: 'GN',\n  organizationIdentifier: 'organizationIdentifier',\n  emailAddress: 'E',\n}\n\nfunction attributeValueToString(value: AttributeValue): string {\n  if (value.anyValue) return `#${toHex(value.anyValue)}`\n  return value.toString()\n}\n\nfunction escapeRfc4514(value: string): string {\n  return value\n    .replace(/[\\\\\"+,;<>=]/g, (c) => `\\\\${c}`)\n    .replace(/^[ #]/, (c) => `\\\\${c}`)\n    .replace(/ $/, '\\\\ ')\n}\n\n/** Convert an ASN.1 Name into a {@link DistinguishedName}. */\nexport function parseName(name: Name): DistinguishedName {\n  const attributes: DistinguishedNameAttribute[] = []\n  const rdnStrings: string[] = []\n  for (const rdn of name) {\n    const parts: string[] = []\n    for (const atv of rdn) {\n      const attrName = NAME_BY_OID.get(atv.type)\n      const value = attributeValueToString(atv.value)\n      attributes.push({ type: atv.type, name: attrName, value })\n      const key = (attrName && RFC4514_SHORT_NAMES[attrName]) ?? atv.type\n      parts.push(`${key}=${atv.value.anyValue ? value : escapeRfc4514(value)}`)\n    }\n    rdnStrings.push(parts.join('+'))\n  }\n\n  const first = (n: AttributeName) => attributes.find((a) => a.name === n)?.value\n  return {\n    attributes,\n    rfc4514: rdnStrings.reverse().join(','),\n    commonName: first('commonName'),\n    organizationName: first('organizationName'),\n    organizationIdentifier: first('organizationIdentifier'),\n    organizationalUnitNames: attributes.filter((a) => a.name === 'organizationalUnitName').map((a) => a.value),\n    countryName: first('countryName'),\n    localityName: first('localityName'),\n    stateOrProvinceName: first('stateOrProvinceName'),\n    serialNumber: first('serialNumber'),\n    givenName: first('givenName'),\n    surname: first('surname'),\n    pseudonym: first('pseudonym'),\n  }\n}\n\n/** Attributes that X.520 restricts to PrintableString */\nconst PRINTABLE_ATTRIBUTES = new Set<AttributeName>(['countryName', 'serialNumber'])\n\n/** One name attribute: a well-known attribute name or an attribute type OID, and its value */\nexport type NameAttributeInput = readonly [AttributeName | string, string | undefined]\n\n/**\n * Build an ASN.1 Name from attributes in encoding order (most general first), one attribute\n * per RDN. Empty values are skipped. `countryName` and `serialNumber` are encoded as\n * PrintableString, `emailAddress` as IA5String and everything else as UTF8String.\n */\nexport function buildName(attributes: readonly NameAttributeInput[]): Name {\n  const rdns: RelativeDistinguishedName[] = []\n  for (const [nameOrOid, value] of attributes) {\n    if (value === undefined || value === '') continue\n    const name = nameOrOid in ATTRIBUTE_TYPES ? (nameOrOid as AttributeName) : NAME_BY_OID.get(nameOrOid)\n    if (!name && !/^\\d+(\\.\\d+)+$/.test(nameOrOid)) {\n      throw new X509Exception(`Unknown name attribute: ${nameOrOid}`)\n    }\n    const type = name ? ATTRIBUTE_TYPES[name] : nameOrOid\n    const attributeValue =\n      name && PRINTABLE_ATTRIBUTES.has(name)\n        ? new AttributeValue({ printableString: value })\n        : name === 'emailAddress'\n          ? new AttributeValue({ ia5String: value })\n          : new AttributeValue({ utf8String: value })\n    rdns.push(new RelativeDistinguishedName([new AttributeTypeAndValue({ type, value: attributeValue })]))\n  }\n  return new X509Name(rdns)\n}\n\nfunction normalize(value: string): string {\n  return value.trim().replace(/\\s+/g, ' ').toLowerCase()\n}\n\n/**\n * Compare two distinguished names attribute by attribute, ignoring case and insignificant\n * whitespace in the values (a simplification of the RFC 5280 clause 7.1 matching rules).\n */\nexport function namesEqual(a: DistinguishedName, b: DistinguishedName): boolean {\n  return (\n    a.attributes.length === b.attributes.length &&\n    a.attributes.every(\n      (attr, i) => attr.type === b.attributes[i].type && normalize(attr.value) === normalize(b.attributes[i].value)\n    )\n  )\n}\n","import { AsnConvert } from '@peculiar/asn1-schema'\nimport type { Extension, GeneralName } from '@peculiar/asn1-x509'\nimport { ATTRIBUTE_TYPES } from './constants'\nimport { asn1ToString, parseDer } from './der'\nimport { toArrayBuffer } from './encoding'\nimport { parseName } from './name'\nimport type { SubjectAlternativeNames, X509Extension } from './types'\nimport { X509Exception } from './x509-exception'\n\n/** Convert ASN.1 extensions, rejecting duplicates (RFC 5280 clause 4.2). */\nexport function toExtensions(extensions: Extension[] | undefined): X509Extension[] {\n  const result = (extensions ?? []).map((e) => ({\n    oid: e.extnID,\n    critical: e.critical,\n    value: new Uint8Array(e.extnValue.buffer),\n  }))\n  const seen = new Set<string>()\n  for (const { oid } of result) {\n    if (seen.has(oid)) throw new X509Exception(`Duplicate extension ${oid}`)\n    seen.add(oid)\n  }\n  return result\n}\n\n/** Decode an extension value with an asn1-schema type, if the extension is present. */\nexport function decodeExtension<T>(\n  extensions: X509Extension[],\n  oid: string,\n  type: new () => T,\n  name: string\n): T | undefined {\n  const extension = extensions.find((e) => e.oid === oid)\n  if (!extension) return undefined\n  try {\n    return AsnConvert.parse(toArrayBuffer(extension.value), type)\n  } catch (error) {\n    throw new X509Exception(`Invalid ${name} extension`, error)\n  }\n}\n\nexport function uriOf(name: GeneralName | undefined): string | undefined {\n  return name?.uniformResourceIdentifier\n}\n\nexport function urisOf(names: GeneralName[] | undefined): string[] {\n  return (names ?? []).map(uriOf).filter((u): u is string => u !== undefined)\n}\n\nexport function emptySubjectAlternativeNames(): SubjectAlternativeNames {\n  return { dnsNames: [], uris: [], emails: [], ipAddresses: [], directoryNames: [], otherNames: [] }\n}\n\nexport function toSubjectAlternativeNames(names: GeneralName[]): SubjectAlternativeNames {\n  const result = emptySubjectAlternativeNames()\n  for (const name of names) {\n    if (name.uniformResourceIdentifier !== undefined) result.uris.push(name.uniformResourceIdentifier)\n    else if (name.rfc822Name !== undefined) result.emails.push(name.rfc822Name)\n    else if (name.dNSName !== undefined) result.dnsNames.push(name.dNSName)\n    else if (name.iPAddress !== undefined) result.ipAddresses.push(name.iPAddress)\n    else if (name.directoryName) result.directoryNames.push(parseName(name.directoryName))\n    else if (name.otherName) {\n      const value = new Uint8Array(name.otherName.value)\n      let text: string | undefined\n      try {\n        text = asn1ToString(parseDer(value))\n      } catch {\n        // Not a string value\n      }\n      result.otherNames.push({ typeId: name.otherName.typeId, value, text })\n    }\n  }\n  return result\n}\n\n/** Telephone numbers from otherName entries with type-id id-at-telephoneNumber */\nexport function telephoneNumbers(names: SubjectAlternativeNames): string[] {\n  return names.otherNames\n    .filter((o) => o.typeId === ATTRIBUTE_TYPES.telephoneNumber && o.text !== undefined)\n    .map((o) => o.text as string)\n}\n","import { AsnConvert } from '@peculiar/asn1-schema'\nimport { QCStatement, QCStatements } from '@peculiar/asn1-x509-qualified'\nimport { PdsLocation, QcCClegislation, QcEuPDS, QcType } from '@peculiar/asn1-x509-qualified-etsi'\nimport { QC_STATEMENTS, QC_TYPES, type QcType as QcTypeName } from './constants'\nimport type { QcStatements } from './types'\nimport { X509Exception } from './x509-exception'\n\nconst QC_TYPE_BY_OID = new Map<string, QcTypeName>(\n  Object.entries(QC_TYPES).map(([name, oid]) => [oid, name as QcTypeName])\n)\n\n/** Decode the statementInfo of a statement with its ETSI EN 319 412-5 schema. */\nfunction statementInfo<T>(statement: QCStatement, type: new () => T): T {\n  if (!statement.statementInfo) {\n    throw new X509Exception(`QCStatement ${statement.statementId} is missing its statementInfo`)\n  }\n  try {\n    return AsnConvert.parse(statement.statementInfo, type)\n  } catch (error) {\n    throw new X509Exception(`Invalid statementInfo for QCStatement ${statement.statementId}`, error)\n  }\n}\n\n/** Convert a decoded QCStatements extension (RFC 3739, ETSI EN 319 412-5). */\nexport function parseQcStatements(statements: QCStatements): QcStatements {\n  const result: QcStatements = {\n    statementIds: [],\n    qcCompliance: false,\n    qcSSCD: false,\n    qcTypes: [],\n    pds: [],\n    legislationCountries: [],\n  }\n\n  for (const statement of statements) {\n    result.statementIds.push(statement.statementId)\n\n    switch (statement.statementId) {\n      case QC_STATEMENTS.qcCompliance:\n        result.qcCompliance = true\n        break\n      case QC_STATEMENTS.qcSSCD:\n        result.qcSSCD = true\n        break\n      case QC_STATEMENTS.qcType:\n        for (const oid of statementInfo(statement, QcType)) {\n          result.qcTypes.push(QC_TYPE_BY_OID.get(oid) ?? oid)\n        }\n        break\n      case QC_STATEMENTS.qcPDS:\n        for (const { url, language } of statementInfo(statement, QcEuPDS)) {\n          result.pds.push({ url, language })\n        }\n        break\n      case QC_STATEMENTS.qcCClegislation:\n        result.legislationCountries.push(...statementInfo(statement, QcCClegislation))\n        break\n    }\n  }\n  return result\n}\n\nexport interface QcStatementsInput {\n  qcTypes: QcTypeName[]\n  qcSSCD?: boolean\n  pds?: { url: string; language: string }[]\n  legislationCountries?: string[]\n}\n\nfunction statement(statementId: string, info?: unknown): QCStatement {\n  return Object.assign(new QCStatement(), {\n    statementId,\n    statementInfo: info === undefined ? undefined : AsnConvert.serialize(info),\n  })\n}\n\n/** Build a QCStatements extension value with QcCompliance and the given statements. */\nexport function toQcStatements(input: QcStatementsInput): QCStatements {\n  const statements = new QCStatements([statement(QC_STATEMENTS.qcCompliance)])\n\n  if (input.qcSSCD) {\n    statements.push(statement(QC_STATEMENTS.qcSSCD))\n  }\n  if (input.qcTypes.length > 0) {\n    statements.push(statement(QC_STATEMENTS.qcType, new QcType(input.qcTypes.map((t) => QC_TYPES[t]))))\n  }\n  if (input.pds?.length) {\n    statements.push(statement(QC_STATEMENTS.qcPDS, new QcEuPDS(input.pds.map((p) => new PdsLocation(p)))))\n  }\n  if (input.legislationCountries?.length) {\n    statements.push(statement(QC_STATEMENTS.qcCClegislation, new QcCClegislation(input.legislationCountries)))\n  }\n  return statements\n}\n","import { AsnConvert, type IAsnParseOptions } from '@peculiar/asn1-schema'\nimport {\n  AuthorityInfoAccessSyntax,\n  AuthorityKeyIdentifier,\n  BasicConstraints,\n  CertificatePolicies,\n  CRLDistributionPoints,\n  ExtendedKeyUsage,\n  id_ce_authorityKeyIdentifier,\n  id_ce_basicConstraints,\n  id_ce_certificatePolicies,\n  id_ce_cRLDistributionPoints,\n  id_ce_extKeyUsage,\n  id_ce_keyUsage,\n  id_ce_subjectAltName,\n  id_ce_subjectKeyIdentifier,\n  id_pe_authorityInfoAccess,\n  KeyUsage,\n  SubjectAlternativeName,\n  SubjectKeyIdentifier,\n  UserNotice,\n  Certificate as X509Certificate,\n} from '@peculiar/asn1-x509'\nimport { QCStatements } from '@peculiar/asn1-x509-qualified'\nimport {\n  ACCESS_METHODS,\n  POLICY_QUALIFIERS,\n  QC_STATEMENTS,\n  SIGNATURE_ALGORITHMS,\n  type SignatureAlgorithm,\n} from './constants'\nimport { asn1ToString, describePublicKey, parseDer, toHex } from './der'\nimport { type CertificateInput, PEM_LABELS, toArrayBuffer, toDer, toPem } from './encoding'\nimport {\n  decodeExtension,\n  emptySubjectAlternativeNames,\n  toExtensions,\n  toSubjectAlternativeNames,\n  uriOf,\n  urisOf,\n} from './extensions'\nimport { parseName } from './name'\nimport { parseQcStatements } from './qc-statements'\nimport type { Certificate, CertificatePolicyInformation } from './types'\nimport { X509Exception } from './x509-exception'\n\nconst SIGNATURE_ALGORITHM_BY_OID = new Map<string, SignatureAlgorithm>(\n  Object.entries(SIGNATURE_ALGORITHMS).map(([name, { oid }]) => [oid, name as SignatureAlgorithm])\n)\n\nexport function signatureAlgorithmName(oid: string): SignatureAlgorithm | undefined {\n  return SIGNATURE_ALGORITHM_BY_OID.get(oid)\n}\n\nfunction toPolicies(policies: CertificatePolicies | undefined): CertificatePolicyInformation[] {\n  return (policies ?? []).map((policy) => {\n    const cpsUris: string[] = []\n    const userNotices: string[] = []\n    for (const qualifier of policy.policyQualifiers ?? []) {\n      if (qualifier.policyQualifierId === POLICY_QUALIFIERS.cps) {\n        const uri = asn1ToString(parseDer(qualifier.qualifier))\n        if (uri) cpsUris.push(uri)\n      } else if (qualifier.policyQualifierId === POLICY_QUALIFIERS.unotice) {\n        const notice = AsnConvert.parse(qualifier.qualifier, UserNotice)\n        if (notice.explicitText) userNotices.push(notice.explicitText.toString())\n      }\n    }\n    return { oid: policy.policyIdentifier, cpsUris, userNotices }\n  })\n}\n\n/**\n * Parse an X.509 certificate.\n *\n * Decodes the standard extensions of RFC 5280 plus QCStatements. Parsing does not verify the\n * signature; use {@link verifyCertificateSignature} for that.\n *\n * @param input DER bytes, base64 encoded DER, or PEM\n * @param options Resource limits forwarded to asn1js (`berOptions`)\n * @throws X509Exception when the input is not a well-formed X.509 certificate\n */\nexport function parseCertificate(input: CertificateInput, options?: IAsnParseOptions): Certificate {\n  const der = toDer(input, PEM_LABELS.certificate)\n\n  let certificate: X509Certificate\n  try {\n    certificate = AsnConvert.parse(toArrayBuffer(der), X509Certificate, options)\n  } catch (error) {\n    throw new X509Exception('Invalid X.509 certificate', error)\n  }\n  if (!certificate.tbsCertificateRaw) {\n    throw new X509Exception('Unable to extract the TBSCertificate')\n  }\n\n  const tbs = certificate.tbsCertificate\n  const extensions = toExtensions(tbs.extensions)\n  const decode = <T>(oid: string, type: new () => T, name: string) => decodeExtension(extensions, oid, type, name)\n\n  const san = decode(id_ce_subjectAltName, SubjectAlternativeName, 'subjectAltName')\n  const keyUsage = decode(id_ce_keyUsage, KeyUsage, 'keyUsage')\n  const eku = decode(id_ce_extKeyUsage, ExtendedKeyUsage, 'extKeyUsage')\n  const basicConstraints = decode(id_ce_basicConstraints, BasicConstraints, 'basicConstraints')\n  const ski = decode(id_ce_subjectKeyIdentifier, SubjectKeyIdentifier, 'subjectKeyIdentifier')\n  const aki = decode(id_ce_authorityKeyIdentifier, AuthorityKeyIdentifier, 'authorityKeyIdentifier')\n  const crlDps = decode(id_ce_cRLDistributionPoints, CRLDistributionPoints, 'cRLDistributionPoints')\n  const aia = decode(id_pe_authorityInfoAccess, AuthorityInfoAccessSyntax, 'authorityInfoAccess') ?? []\n  const qcStatements = decode(QC_STATEMENTS.extension, QCStatements, 'qcStatements')\n  const accessUrls = (method: string) =>\n    aia\n      .filter((a) => a.accessMethod === method)\n      .map((a) => uriOf(a.accessLocation))\n      .filter((u): u is string => u !== undefined)\n\n  return {\n    der,\n    pem: toPem(der, PEM_LABELS.certificate),\n    version: tbs.version + 1,\n    serialNumber: toHex(tbs.serialNumber),\n    issuer: parseName(tbs.issuer),\n    subject: parseName(tbs.subject),\n    notBefore: tbs.validity.notBefore.getTime(),\n    notAfter: tbs.validity.notAfter.getTime(),\n    publicKey: describePublicKey(tbs.subjectPublicKeyInfo),\n    signatureAlgorithm: certificate.signatureAlgorithm.algorithm,\n    signatureAlgorithmName: signatureAlgorithmName(certificate.signatureAlgorithm.algorithm),\n    tbsCertificate: new Uint8Array(certificate.tbsCertificateRaw),\n    signature: new Uint8Array(certificate.signatureValue),\n\n    policies: toPolicies(decode(id_ce_certificatePolicies, CertificatePolicies, 'certificatePolicies')),\n    subjectAlternativeNames: san ? toSubjectAlternativeNames(san) : emptySubjectAlternativeNames(),\n    keyUsage: keyUsage?.toJSON(),\n    extendedKeyUsage: eku ? [...eku] : undefined,\n    basicConstraints: basicConstraints\n      ? { cA: basicConstraints.cA, pathLenConstraint: basicConstraints.pathLenConstraint }\n      : undefined,\n    subjectKeyIdentifier: ski ? toHex(ski.buffer) : undefined,\n    authorityKeyIdentifier: aki?.keyIdentifier ? toHex(aki.keyIdentifier.buffer) : undefined,\n    crlDistributionPoints: (crlDps ?? []).flatMap((dp) => urisOf(dp.distributionPoint?.fullName)),\n    ocspUrls: accessUrls(ACCESS_METHODS.ocsp),\n    caIssuersUrls: accessUrls(ACCESS_METHODS.caIssuers),\n    qcStatements: qcStatements ? parseQcStatements(qcStatements) : undefined,\n\n    extensions,\n  }\n}\n","import { concatBytes, hexDecode } from '@owf/identity-common'\nimport { AsnConvert } from '@peculiar/asn1-schema'\nimport { AlgorithmIdentifier } from '@peculiar/asn1-x509'\nimport * as asn1js from 'asn1js'\nimport { parseCertificate } from './certificate'\nimport { SIGNATURE_ALGORITHMS, type SignatureAlgorithm } from './constants'\nimport { curveCoordinateLength, derTlv, ecdsaDerToP1363, ecdsaP1363ToDer, toPositiveIntegerBytes } from './der'\nimport { type CertificateInput, toArrayBuffer } from './encoding'\nimport { namesEqual } from './name'\nimport type {\n  Certificate,\n  Crl,\n  ParsedPublicKey,\n  PreparedSignedStructure,\n  SignatureEncoding,\n  SignatureVerifier,\n} from './types'\nimport { X509Exception } from './x509-exception'\n\n/** AlgorithmIdentifier for a supported signature algorithm (RFC 3279, RFC 5758). */\nexport function signatureAlgorithmIdentifier(name: SignatureAlgorithm): AlgorithmIdentifier {\n  const algorithm = SIGNATURE_ALGORITHMS[name]\n  if (!algorithm) throw new X509Exception(`Unsupported signature algorithm: ${name}`)\n  return new AlgorithmIdentifier({\n    algorithm: algorithm.oid,\n    // RSA PKCS#1 v1.5 algorithms carry NULL parameters, ECDSA ones none\n    parameters: algorithm.family === 'rsa' ? new asn1js.Null().toBER() : undefined,\n  })\n}\n\n/** Normalize a serial number to positive DER INTEGER content (RFC 5280 clause 4.1.2.2). */\nexport function toSerialNumber(serialNumber: Uint8Array | string): ArrayBuffer {\n  const bytes = typeof serialNumber === 'string' ? hexDecode(serialNumber.replace(/^0x/i, '')) : serialNumber\n  const positive = toPositiveIntegerBytes(bytes)\n  if (positive.length === 0 || positive.every((b) => b === 0)) {\n    throw new X509Exception('Serial number must be a positive integer')\n  }\n  if (positive.length > 20) {\n    throw new X509Exception('Serial number must not be longer than 20 octets (RFC 5280 clause 4.1.2.2)')\n  }\n  return toArrayBuffer(positive)\n}\n\n/**\n * Combine prepared to-be-signed bytes with their signature into the DER encoding of the\n * signed structure: `SEQUENCE { tbs, signatureAlgorithm, BIT STRING signature }`.\n */\nexport function assembleSignedStructure(\n  prepared: PreparedSignedStructure,\n  signature: Uint8Array,\n  signatureEncoding: SignatureEncoding = 'ieee-p1363'\n): Uint8Array {\n  const algorithm = SIGNATURE_ALGORITHMS[prepared.signatureAlgorithm]\n  let signatureDer = signature\n  if (algorithm.family === 'ecdsa' && signatureEncoding === 'ieee-p1363') {\n    const coordinateLength = curveCoordinateLength(prepared.signerPublicKey.namedCurve)\n    if (!coordinateLength) {\n      throw new X509Exception('Unable to determine the curve of the signer key for ECDSA encoding')\n    }\n    signatureDer = ecdsaP1363ToDer(signature, coordinateLength)\n  }\n  const algorithmIdentifier = new Uint8Array(\n    AsnConvert.serialize(signatureAlgorithmIdentifier(prepared.signatureAlgorithm))\n  )\n  return derTlv(\n    0x30,\n    concatBytes(prepared.tbs, algorithmIdentifier, derTlv(0x03, concatBytes(new Uint8Array([0]), signatureDer)))\n  )\n}\n\nasync function verifySignature(\n  signed: { signature: Uint8Array; signatureAlgorithm: string; signatureAlgorithmName?: SignatureAlgorithm },\n  data: Uint8Array,\n  publicKey: ParsedPublicKey,\n  verifier: SignatureVerifier\n): Promise<boolean> {\n  let signatureP1363 = signed.signature\n  if (signed.signatureAlgorithmName && SIGNATURE_ALGORITHMS[signed.signatureAlgorithmName].family === 'ecdsa') {\n    const coordinateLength = curveCoordinateLength(publicKey.namedCurve)\n    if (!coordinateLength) return false\n    try {\n      signatureP1363 = ecdsaDerToP1363(signed.signature, coordinateLength)\n    } catch {\n      return false\n    }\n  }\n  return verifier({\n    data,\n    signature: signed.signature,\n    signatureP1363,\n    signatureAlgorithm: signed.signatureAlgorithm,\n    signatureAlgorithmName: signed.signatureAlgorithmName,\n    publicKey,\n  })\n}\n\nfunction toCertificate(input: Certificate | CertificateInput): Certificate {\n  return typeof input === 'object' && 'tbsCertificate' in input ? input : parseCertificate(input)\n}\n\n/**\n * Verify that `certificate` was signed by the key of `issuerCertificate`.\n *\n * The issuer name and, when both are present, the authority / subject key identifiers must\n * match. The cryptographic check is delegated to `verifier`, so no global crypto is needed:\n * with WebCrypto, import `publicKey.jwk` and verify `signatureP1363` over `data`.\n *\n * This checks a single link, not a path to a trust anchor.\n */\nexport async function verifyCertificateSignature(\n  certificate: Certificate | CertificateInput,\n  issuerCertificate: Certificate | CertificateInput,\n  verifier: SignatureVerifier\n): Promise<boolean> {\n  const cert = toCertificate(certificate)\n  const issuer = toCertificate(issuerCertificate)\n  if (!namesEqual(cert.issuer, issuer.subject)) return false\n  if (\n    cert.authorityKeyIdentifier &&\n    issuer.subjectKeyIdentifier &&\n    cert.authorityKeyIdentifier !== issuer.subjectKeyIdentifier\n  ) {\n    return false\n  }\n  return verifySignature(cert, cert.tbsCertificate, issuer.publicKey, verifier)\n}\n\n/**\n * Verify that `crl` was signed by `issuerCertificate`.\n *\n * The CRL issuer name and, when both are present, the key identifiers must match, and the\n * issuer key usage (if present) must allow cRLSign (RFC 5280 clause 6.3.3).\n */\nexport async function verifyCrlSignature(\n  crl: Crl,\n  issuerCertificate: Certificate | CertificateInput,\n  verifier: SignatureVerifier\n): Promise<boolean> {\n  const issuer = toCertificate(issuerCertificate)\n  if (!namesEqual(crl.issuer, issuer.subject)) return false\n  if (\n    crl.authorityKeyIdentifier &&\n    issuer.subjectKeyIdentifier &&\n    crl.authorityKeyIdentifier !== issuer.subjectKeyIdentifier\n  ) {\n    return false\n  }\n  if (issuer.keyUsage && !issuer.keyUsage.includes('crlSign')) return false\n  return verifySignature(crl, crl.tbsCertList, issuer.publicKey, verifier)\n}\n","import { AsnConvert, OctetString } from '@peculiar/asn1-schema'\nimport {\n  AccessDescription,\n  AuthorityInfoAccessSyntax,\n  AuthorityKeyIdentifier,\n  BasicConstraints,\n  CertificatePolicies,\n  CRLDistributionPoints,\n  DistributionPoint,\n  DistributionPointName,\n  ExtendedKeyUsage,\n  Extension,\n  Extensions,\n  GeneralName,\n  id_ce_authorityKeyIdentifier,\n  id_ce_basicConstraints,\n  id_ce_certificatePolicies,\n  id_ce_cRLDistributionPoints,\n  id_ce_extKeyUsage,\n  id_ce_keyUsage,\n  id_ce_subjectAltName,\n  id_ce_subjectKeyIdentifier,\n  id_pe_authorityInfoAccess,\n  KeyIdentifier,\n  KeyUsage,\n  KeyUsageFlags,\n  type KeyUsageType,\n  OtherName,\n  PolicyInformation,\n  PolicyQualifierInfo,\n  SubjectAlternativeName,\n  SubjectKeyIdentifier,\n  SubjectPublicKeyInfo,\n  TBSCertificate,\n  Validity,\n  Version,\n  Certificate as X509Certificate,\n} from '@peculiar/asn1-x509'\nimport * as asn1js from 'asn1js'\nimport { parseCertificate } from './certificate'\nimport { ACCESS_METHODS, POLICY_QUALIFIERS, QC_STATEMENTS } from './constants'\nimport { describePublicKey, publicJwkToSpki } from './der'\nimport { type CertificateInput, PEM_LABELS, toArrayBuffer, toDer } from './encoding'\nimport { buildName } from './name'\nimport { toQcStatements } from './qc-statements'\nimport { assembleSignedStructure, signatureAlgorithmIdentifier, toSerialNumber } from './signature'\nimport type {\n  Certificate,\n  CertificateTemplate,\n  PreparedSignedStructure,\n  SignatureEncoding,\n  SignOptions,\n  X509Extension,\n} from './types'\nimport { X509Exception } from './x509-exception'\n\nfunction extension(extnID: string, value: unknown, critical = false): Extension {\n  return new Extension({ extnID, critical, extnValue: new OctetString(AsnConvert.serialize(value)) })\n}\n\nexport function keyUsageFlags(usages: KeyUsageType[]): number {\n  return usages.reduce((flags, usage) => flags | KeyUsageFlags[usage === 'crlSign' ? 'cRLSign' : usage], 0)\n}\n\n/** Parse an issuer certificate into its ASN.1 form. */\nexport function parseIssuerCertificate(input: CertificateInput): X509Certificate {\n  try {\n    return AsnConvert.parse(toArrayBuffer(toDer(input, PEM_LABELS.certificate)), X509Certificate)\n  } catch (error) {\n    throw new X509Exception('Invalid issuer certificate', error)\n  }\n}\n\n/** The subject key identifier of an ASN.1 certificate, if present. */\nexport function subjectKeyIdentifierOf(certificate: X509Certificate): ArrayBuffer | undefined {\n  const ski = certificate.tbsCertificate.extensions?.find((e) => e.extnID === id_ce_subjectKeyIdentifier)\n  return ski ? AsnConvert.parse(ski.extnValue.buffer, SubjectKeyIdentifier).buffer : undefined\n}\n\n/**\n * Encode an otherName whose value is a PrintableString (or UTF8String for non-printable\n * values), e.g. an `id-at-telephoneNumber` subject alternative name.\n */\nexport function stringOtherName(typeId: string, value: string): { typeId: string; value: Uint8Array } {\n  const printable = /^[A-Za-z0-9 '()+,\\-./:=?]*$/.test(value)\n  const encoded = printable ? new asn1js.PrintableString({ value }) : new asn1js.Utf8String({ value })\n  return { typeId, value: new Uint8Array(encoded.toBER()) }\n}\n\n/**\n * Build the TBSCertificate for a certificate template.\n *\n * Sign the returned `tbs` bytes with the issuer key wherever that key lives and pass the\n * signature to {@link assembleCertificate}. {@link createCertificate} wraps both steps\n * around a signer callback.\n */\nexport async function prepareCertificate(template: CertificateTemplate): Promise<PreparedSignedStructure> {\n  if (!(template.notAfter > template.notBefore)) {\n    throw new X509Exception('notAfter must be later than notBefore')\n  }\n\n  const spkiDer =\n    template.subjectPublicKey instanceof Uint8Array\n      ? template.subjectPublicKey\n      : publicJwkToSpki(template.subjectPublicKey)\n  let subjectPublicKeyInfo: SubjectPublicKeyInfo\n  try {\n    subjectPublicKeyInfo = AsnConvert.parse(toArrayBuffer(spkiDer), SubjectPublicKeyInfo)\n  } catch (error) {\n    throw new X509Exception('Invalid subject public key', error)\n  }\n\n  const issuer = template.issuerCertificate ? parseIssuerCertificate(template.issuerCertificate) : undefined\n  const subject = buildName(template.subject)\n  if (subject.length === 0) throw new X509Exception('The subject must not be empty')\n\n  const extensions: Extension[] = []\n  const basicConstraints = template.basicConstraints ?? { cA: false }\n  extensions.push(extension(id_ce_basicConstraints, new BasicConstraints(basicConstraints), true))\n\n  const keyUsage = template.keyUsage ?? (basicConstraints.cA ? ['keyCertSign', 'crlSign'] : ['digitalSignature'])\n  if (keyUsage.length > 0) {\n    extensions.push(extension(id_ce_keyUsage, new KeyUsage(keyUsageFlags(keyUsage)), true))\n  }\n\n  if (template.extendedKeyUsage?.length) {\n    extensions.push(extension(id_ce_extKeyUsage, new ExtendedKeyUsage(template.extendedKeyUsage)))\n  }\n\n  if (template.certificatePolicies?.length) {\n    extensions.push(\n      extension(\n        id_ce_certificatePolicies,\n        new CertificatePolicies(\n          template.certificatePolicies.map(\n            (policy) =>\n              new PolicyInformation({\n                policyIdentifier: policy.oid,\n                policyQualifiers: policy.cpsUris?.length\n                  ? policy.cpsUris.map(\n                      (uri) =>\n                        new PolicyQualifierInfo({\n                          policyQualifierId: POLICY_QUALIFIERS.cps,\n                          qualifier: new asn1js.IA5String({ value: uri }).toBER(),\n                        })\n                    )\n                  : undefined,\n              })\n          )\n        )\n      )\n    )\n  }\n\n  const san = template.subjectAlternativeNames\n  const generalNames = [\n    ...(san?.dnsNames ?? []).map((dNSName) => new GeneralName({ dNSName })),\n    ...(san?.uris ?? []).map((uniformResourceIdentifier) => new GeneralName({ uniformResourceIdentifier })),\n    ...(san?.emails ?? []).map((rfc822Name) => new GeneralName({ rfc822Name })),\n    ...(san?.otherNames ?? []).map(\n      (o) => new GeneralName({ otherName: new OtherName({ typeId: o.typeId, value: toArrayBuffer(o.value) }) })\n    ),\n  ]\n  if (generalNames.length > 0) {\n    extensions.push(extension(id_ce_subjectAltName, new SubjectAlternativeName(generalNames)))\n  }\n\n  let subjectKeyIdentifier: ArrayBuffer | undefined\n  if (template.hasher) {\n    // RFC 7093 method 1: leftmost 160 bits of the SHA-256 hash of the subjectPublicKey\n    const hash = await template.hasher(subjectPublicKeyInfo.subjectPublicKey, 'sha-256')\n    subjectKeyIdentifier = toArrayBuffer(hash.slice(0, 20))\n    extensions.push(extension(id_ce_subjectKeyIdentifier, new SubjectKeyIdentifier(subjectKeyIdentifier)))\n  }\n\n  const authorityKeyIdentifier = issuer ? subjectKeyIdentifierOf(issuer) : subjectKeyIdentifier\n  if (authorityKeyIdentifier) {\n    extensions.push(\n      extension(\n        id_ce_authorityKeyIdentifier,\n        new AuthorityKeyIdentifier({ keyIdentifier: new KeyIdentifier(authorityKeyIdentifier) })\n      )\n    )\n  }\n\n  if (template.crlDistributionPoints?.length) {\n    extensions.push(\n      extension(\n        id_ce_cRLDistributionPoints,\n        new CRLDistributionPoints(\n          template.crlDistributionPoints.map(\n            (uri) =>\n              new DistributionPoint({\n                distributionPoint: new DistributionPointName({\n                  fullName: [new GeneralName({ uniformResourceIdentifier: uri })],\n                }),\n              })\n          )\n        )\n      )\n    )\n  }\n\n  const accessDescriptions = [\n    ...(template.ocspUrls ?? []).map((uri) => [ACCESS_METHODS.ocsp, uri] as const),\n    ...(template.caIssuersUrls ?? []).map((uri) => [ACCESS_METHODS.caIssuers, uri] as const),\n  ].map(\n    ([accessMethod, uri]) =>\n      new AccessDescription({ accessMethod, accessLocation: new GeneralName({ uniformResourceIdentifier: uri }) })\n  )\n  if (accessDescriptions.length > 0) {\n    extensions.push(extension(id_pe_authorityInfoAccess, new AuthorityInfoAccessSyntax(accessDescriptions)))\n  }\n\n  if (template.qcStatements) {\n    const qcStatements = toQcStatements({ ...template.qcStatements, qcTypes: template.qcStatements.qcTypes ?? [] })\n    extensions.push(extension(QC_STATEMENTS.extension, qcStatements))\n  }\n\n  for (const custom of template.extensions ?? []) {\n    extensions.push(toAsnExtension(custom))\n  }\n  const seen = new Set<string>()\n  for (const { extnID } of extensions) {\n    if (seen.has(extnID)) throw new X509Exception(`Duplicate extension ${extnID}`)\n    seen.add(extnID)\n  }\n\n  const tbs = new TBSCertificate({\n    version: Version.v3,\n    serialNumber: toSerialNumber(template.serialNumber),\n    signature: signatureAlgorithmIdentifier(template.signatureAlgorithm),\n    issuer: issuer ? issuer.tbsCertificate.subject : subject,\n    validity: new Validity({ notBefore: template.notBefore, notAfter: template.notAfter }),\n    subject,\n    subjectPublicKeyInfo,\n    extensions: new Extensions(extensions),\n  })\n\n  return {\n    tbs: new Uint8Array(AsnConvert.serialize(tbs)),\n    signatureAlgorithm: template.signatureAlgorithm,\n    signerPublicKey: describePublicKey(issuer ? issuer.tbsCertificate.subjectPublicKeyInfo : subjectPublicKeyInfo),\n  }\n}\n\nexport function toAsnExtension(extension: X509Extension): Extension {\n  return new Extension({\n    extnID: extension.oid,\n    critical: extension.critical,\n    extnValue: new OctetString(toArrayBuffer(extension.value)),\n  })\n}\n\n/**\n * Combine a prepared TBSCertificate with the issuer signature.\n *\n * @param signatureEncoding Encoding of ECDSA signatures; WebCrypto produces `ieee-p1363` (default)\n */\nexport function assembleCertificate(\n  prepared: PreparedSignedStructure,\n  signature: Uint8Array,\n  signatureEncoding?: SignatureEncoding\n): Certificate {\n  return parseCertificate(assembleSignedStructure(prepared, signature, signatureEncoding))\n}\n\n/**\n * Create an X.509 v3 certificate.\n *\n * The issuer key is never passed in: the `signer` callback receives the DER encoded\n * TBSCertificate and returns the signature, so the key can stay in WebCrypto, a KMS or an\n * HSM. Only the public key of the subject is needed; a JWK with private key material is\n * rejected.\n */\nexport async function createCertificate(template: CertificateTemplate & SignOptions): Promise<Certificate> {\n  const prepared = await prepareCertificate(template)\n  const signature = await template.signer(prepared.tbs)\n  return assembleCertificate(prepared, signature, template.signatureEncoding)\n}\n","import { hexDecode } from '@owf/identity-common'\nimport { AsnConvert, type IAsnParseOptions, OctetString } from '@peculiar/asn1-schema'\nimport {\n  RevokedCertificate as AsnRevokedCertificate,\n  AuthorityKeyIdentifier,\n  CertificateIssuer,\n  CertificateList,\n  CRLReason,\n  DistributionPointName,\n  Extension,\n  FreshestCRL,\n  GeneralName,\n  InvalidityDate,\n  IssuingDistributionPoint,\n  id_ce_authorityKeyIdentifier,\n  id_ce_certificateIssuer,\n  id_ce_cRLNumber,\n  id_ce_cRLReasons,\n  id_ce_deltaCRLIndicator,\n  id_ce_freshestCRL,\n  id_ce_invalidityDate,\n  id_ce_issuerAltName,\n  id_ce_issuingDistributionPoint,\n  id_pe_authorityInfoAccess,\n  KeyIdentifier,\n  TBSCertList,\n  Time,\n  Version,\n} from '@peculiar/asn1-x509'\nimport * as asn1js from 'asn1js'\nimport { signatureAlgorithmName } from './certificate'\nimport { CRL_REASONS, type CrlReason } from './constants'\nimport { parseIssuerCertificate, subjectKeyIdentifierOf, toAsnExtension } from './create'\nimport { describePublicKey, integerBytesToBigInt, parseDer, toHex, toPositiveIntegerBytes } from './der'\nimport { type CertificateInput, type CrlInput, PEM_LABELS, toArrayBuffer, toDer, toPem } from './encoding'\nimport { decodeExtension, toExtensions, urisOf } from './extensions'\nimport { namesEqual, parseName } from './name'\nimport { assembleSignedStructure, signatureAlgorithmIdentifier, toSerialNumber, verifyCrlSignature } from './signature'\nimport type {\n  Certificate,\n  Crl,\n  CrlTemplate,\n  DistinguishedName,\n  PreparedSignedStructure,\n  RevocationCheckOptions,\n  RevocationStatus,\n  RevokedCertificate,\n  SignatureEncoding,\n  SignatureVerifier,\n  SignOptions,\n  X509Extension,\n} from './types'\nimport { X509Exception } from './x509-exception'\n\nconst REASON_BY_CODE = new Map<number, CrlReason>(\n  Object.entries(CRL_REASONS).map(([name, code]) => [code, name as CrlReason])\n)\n\n/** CRL extensions understood by {@link getRevocationStatus} */\nconst KNOWN_CRL_EXTENSIONS = new Set([\n  id_ce_authorityKeyIdentifier,\n  id_ce_issuerAltName,\n  id_ce_cRLNumber,\n  id_ce_deltaCRLIndicator,\n  id_ce_issuingDistributionPoint,\n  id_ce_freshestCRL,\n  id_pe_authorityInfoAccess,\n])\n\n/** CRL entry extensions understood by {@link getRevocationStatus} */\nconst KNOWN_ENTRY_EXTENSIONS = new Set([\n  id_ce_cRLReasons,\n  id_ce_invalidityDate,\n  id_ce_certificateIssuer,\n  '2.5.29.23', // holdInstructionCode\n])\n\nfunction decodeInteger(extensions: X509Extension[], oid: string, name: string): bigint | undefined {\n  const extension = extensions.find((e) => e.oid === oid)\n  if (!extension) return undefined\n  const node = parseDer(extension.value)\n  const bytes = node instanceof asn1js.Integer ? new Uint8Array(node.valueBlock.valueHexView) : undefined\n  if (!bytes || bytes.length === 0 || bytes[0] & 0x80) {\n    throw new X509Exception(`Invalid ${name} extension`)\n  }\n  return integerBytesToBigInt(bytes)\n}\n\nfunction directoryNameOf(names: GeneralName[]): DistinguishedName | undefined {\n  const name = names.find((n) => n.directoryName)?.directoryName\n  return name ? parseName(name) : undefined\n}\n\nfunction toRevokedCertificates(entries: AsnRevokedCertificate[] | undefined): RevokedCertificate[] {\n  let certificateIssuer: DistinguishedName | undefined\n  return (entries ?? []).map((entry) => {\n    const extensions = toExtensions(entry.crlEntryExtensions)\n    const decode = <T>(oid: string, type: new () => T, name: string) => decodeExtension(extensions, oid, type, name)\n    const reason = decode(id_ce_cRLReasons, CRLReason, 'reasonCode')\n    const invalidity = decode(id_ce_invalidityDate, InvalidityDate, 'invalidityDate')\n    const issuer = decode(id_ce_certificateIssuer, CertificateIssuer, 'certificateIssuer')\n    // RFC 5280 clause 5.3.3: the certificate issuer applies to this and all following entries\n    if (issuer) certificateIssuer = directoryNameOf(issuer)\n    return {\n      serialNumber: toHex(entry.userCertificate),\n      revocationDate: entry.revocationDate.getTime(),\n      reason: reason ? REASON_BY_CODE.get(reason.reason) : undefined,\n      invalidityDate: invalidity?.value,\n      certificateIssuer,\n      extensions,\n    }\n  })\n}\n\nexport interface ParseCrlOptions extends IAsnParseOptions {\n  /**\n   * Upper bound for the number of revoked certificate entries, protecting against resource\n   * exhaustion by untrusted input. Defaults to 100 000. Ignored when `berOptions.maxNodes`\n   * is set explicitly.\n   */\n  maxEntries?: number\n}\n\n/** ASN.1 nodes per CRL entry: SEQUENCE, INTEGER, Time and up to three extensions of four nodes */\nconst NODES_PER_ENTRY = 16\n\n/**\n * Parse an X.509 certificate revocation list (RFC 5280 clause 5).\n *\n * Parsing does not verify the signature; use {@link verifyCrlSignature} or {@link checkRevocation}.\n *\n * @param input DER bytes, base64 encoded DER, or PEM (`X509 CRL`)\n * @throws X509Exception when the input is not a well-formed CRL or exceeds the size limits\n */\nexport function parseCrl(input: CrlInput, options: ParseCrlOptions = {}): Crl {\n  const der = toDer(input, PEM_LABELS.crl)\n  const { maxEntries = 100_000, berOptions } = options\n  let crl: CertificateList\n  try {\n    crl = AsnConvert.parse(toArrayBuffer(der), CertificateList, {\n      berOptions: { maxNodes: 1_000 + maxEntries * NODES_PER_ENTRY, ...berOptions },\n    })\n  } catch (error) {\n    throw new X509Exception('Invalid CRL', error)\n  }\n  if (!crl.tbsCertListRaw) throw new X509Exception('Unable to extract the TBSCertList')\n\n  const tbs = crl.tbsCertList\n  const extensions = toExtensions(tbs.crlExtensions)\n  const decode = <T>(oid: string, type: new () => T, name: string) => decodeExtension(extensions, oid, type, name)\n  const aki = decode(id_ce_authorityKeyIdentifier, AuthorityKeyIdentifier, 'authorityKeyIdentifier')\n  const idp = decode(id_ce_issuingDistributionPoint, IssuingDistributionPoint, 'issuingDistributionPoint')\n  const freshest = decode(id_ce_freshestCRL, FreshestCRL, 'freshestCRL')\n\n  return {\n    der,\n    pem: toPem(der, PEM_LABELS.crl),\n    version: tbs.version === undefined ? 1 : tbs.version + 1,\n    issuer: parseName(tbs.issuer),\n    thisUpdate: tbs.thisUpdate.getTime(),\n    nextUpdate: tbs.nextUpdate?.getTime(),\n    signatureAlgorithm: crl.signatureAlgorithm.algorithm,\n    signatureAlgorithmName: signatureAlgorithmName(crl.signatureAlgorithm.algorithm),\n    signature: new Uint8Array(crl.signature),\n    tbsCertList: new Uint8Array(crl.tbsCertListRaw),\n    crlNumber: decodeInteger(extensions, id_ce_cRLNumber, 'cRLNumber'),\n    deltaCrlIndicator: decodeInteger(extensions, id_ce_deltaCRLIndicator, 'deltaCRLIndicator'),\n    authorityKeyIdentifier: aki?.keyIdentifier ? toHex(aki.keyIdentifier.buffer) : undefined,\n    issuingDistributionPoint: idp\n      ? {\n          distributionPointUris: urisOf(idp.distributionPoint?.fullName),\n          onlyContainsUserCerts: idp.onlyContainsUserCerts,\n          onlyContainsCACerts: idp.onlyContainsCACerts,\n          onlyContainsAttributeCerts: idp.onlyContainsAttributeCerts,\n          indirectCRL: idp.indirectCRL,\n          onlySomeReasons: idp.onlySomeReasons?.toJSON(),\n        }\n      : undefined,\n    freshestCrl: (freshest ?? []).flatMap((dp) => urisOf(dp.distributionPoint?.fullName)),\n    revokedCertificates: toRevokedCertificates(tbs.revokedCertificates),\n    extensions,\n  }\n}\n\n// ============================================================================\n// Revocation checking\n// ============================================================================\n\nfunction normalizeSerial(hex: string): string {\n  return hex.toLowerCase().replace(/^(00)+(?=..)/, '')\n}\n\nfunction unknown(\n  reason: Extract<RevocationStatus, { status: 'unknown' }>['reason'],\n  message: string\n): RevocationStatus {\n  return { status: 'unknown', reason, message }\n}\n\n/**\n * Look up the revocation status of `certificate` in `crl`.\n *\n * This does **not** verify the CRL signature; use {@link checkRevocation} unless the CRL\n * has already been verified. The CRL must be issued by the certificate issuer (or be an\n * indirect CRL naming it), must be current, and must cover the certificate. Otherwise the\n * status is `unknown` with the reason, and the caller should find a suitable CRL or fall\n * back to OCSP.\n */\nexport function getRevocationStatus(\n  certificate: Certificate,\n  crl: Crl,\n  options: RevocationCheckOptions = {}\n): RevocationStatus {\n  if (crl.deltaCrlIndicator !== undefined) {\n    return unknown('delta_crl', 'Delta CRLs can only be used together with their base CRL')\n  }\n  const unsupported = crl.extensions.find((e) => e.critical && !KNOWN_CRL_EXTENSIONS.has(e.oid))\n  if (unsupported) {\n    return unknown('unsupported_critical_extension', `Unsupported critical CRL extension ${unsupported.oid}`)\n  }\n\n  const idp = crl.issuingDistributionPoint\n  const indirect = idp?.indirectCRL ?? false\n  if (!indirect) {\n    if (!namesEqual(crl.issuer, certificate.issuer)) {\n      return unknown('issuer_mismatch', 'The CRL is not issued by the certificate issuer')\n    }\n    if (\n      crl.authorityKeyIdentifier &&\n      certificate.authorityKeyIdentifier &&\n      crl.authorityKeyIdentifier !== certificate.authorityKeyIdentifier\n    ) {\n      return unknown('issuer_mismatch', 'The CRL is signed with a different key than the certificate')\n    }\n  }\n\n  if (options.now !== false) {\n    const now = options.now ?? new Date()\n    if (now < crl.thisUpdate) {\n      return unknown('crl_not_yet_valid', `The CRL is not valid before ${crl.thisUpdate.toISOString()}`)\n    }\n    if (crl.nextUpdate && now > crl.nextUpdate) {\n      return unknown('crl_expired', `The CRL expired at ${crl.nextUpdate.toISOString()}`)\n    }\n  }\n\n  if (idp) {\n    const isCA = certificate.basicConstraints?.cA === true\n    if (idp.onlyContainsAttributeCerts) return unknown('out_of_scope', 'The CRL only covers attribute certificates')\n    if (idp.onlyContainsCACerts && !isCA) return unknown('out_of_scope', 'The CRL only covers CA certificates')\n    if (idp.onlyContainsUserCerts && isCA) return unknown('out_of_scope', 'The CRL only covers end-entity certificates')\n    if (\n      idp.distributionPointUris.length > 0 &&\n      !idp.distributionPointUris.some((uri) => certificate.crlDistributionPoints.includes(uri))\n    ) {\n      return unknown('out_of_scope', 'The CRL distribution point does not match the certificate')\n    }\n  }\n\n  const serial = normalizeSerial(certificate.serialNumber)\n  const entry = crl.revokedCertificates.find(\n    (e) =>\n      normalizeSerial(e.serialNumber) === serial &&\n      (!indirect || namesEqual(e.certificateIssuer ?? crl.issuer, certificate.issuer))\n  )\n\n  if (entry) {\n    const unsupportedEntry = entry.extensions.find((e) => e.critical && !KNOWN_ENTRY_EXTENSIONS.has(e.oid))\n    if (unsupportedEntry) {\n      return unknown(\n        'unsupported_critical_extension',\n        `Unsupported critical CRL entry extension ${unsupportedEntry.oid}`\n      )\n    }\n    if (entry.reason === 'removeFromCRL') return { status: 'good' }\n    return {\n      status: 'revoked',\n      revocationDate: entry.revocationDate,\n      reason: entry.reason,\n      invalidityDate: entry.invalidityDate,\n    }\n  }\n\n  if (idp?.onlySomeReasons) {\n    return unknown('out_of_scope', `The CRL only covers the reasons ${idp.onlySomeReasons.join(', ')}`)\n  }\n  return { status: 'good' }\n}\n\n/**\n * Verify the CRL signature against `crlIssuerCertificate`, then look up the revocation\n * status of `certificate` (see {@link getRevocationStatus}).\n *\n * The signature check is delegated to `verifier`; an invalid signature yields `unknown`\n * with reason `invalid_signature`. Fetching the CRL (see `crlDistributionPoints` on the\n * certificate) is up to the caller.\n */\nexport async function checkRevocation(options: {\n  certificate: Certificate\n  crl: Crl\n  crlIssuerCertificate: Certificate | CertificateInput\n  verifier: SignatureVerifier\n  now?: Date | false\n}): Promise<RevocationStatus> {\n  if (!(await verifyCrlSignature(options.crl, options.crlIssuerCertificate, options.verifier))) {\n    return unknown('invalid_signature', 'The CRL signature is invalid or not issued by the given certificate')\n  }\n  return getRevocationStatus(options.certificate, options.crl, { now: options.now })\n}\n\n// ============================================================================\n// CRL creation\n// ============================================================================\n\nfunction bigintToIntegerBytes(value: bigint | number): Uint8Array {\n  const n = BigInt(value)\n  if (n < BigInt(0)) throw new X509Exception('CRL numbers must not be negative')\n  const hex = n.toString(16)\n  const bytes = toPositiveIntegerBytes(hexDecode(hex.length % 2 ? `0${hex}` : hex))\n  if (bytes.length > 20) throw new X509Exception('CRL numbers must not be longer than 20 octets')\n  return bytes\n}\n\nfunction derExtension(oid: string, value: Uint8Array | ArrayBuffer, critical = false): Extension {\n  return new Extension({\n    extnID: oid,\n    critical,\n    extnValue: new OctetString(value instanceof Uint8Array ? toArrayBuffer(value) : value),\n  })\n}\n\n/**\n * Build the TBSCertList of a v2 CRL. Sign the returned `tbs` bytes with the CRL issuer key\n * and pass the signature to {@link assembleCrl}, or use {@link createCrl} with a signer.\n */\nexport function prepareCrl(template: CrlTemplate): PreparedSignedStructure {\n  if (!(template.nextUpdate > template.thisUpdate)) {\n    throw new X509Exception('nextUpdate must be later than thisUpdate')\n  }\n  const issuer = parseIssuerCertificate(template.issuerCertificate)\n\n  const extensions: Extension[] = []\n  const ski = subjectKeyIdentifierOf(issuer)\n  if (ski) {\n    extensions.push(\n      derExtension(\n        id_ce_authorityKeyIdentifier,\n        AsnConvert.serialize(new AuthorityKeyIdentifier({ keyIdentifier: new KeyIdentifier(ski) }))\n      )\n    )\n  }\n  extensions.push(\n    derExtension(\n      id_ce_cRLNumber,\n      new asn1js.Integer({ valueHex: toArrayBuffer(bigintToIntegerBytes(template.crlNumber)) }).toBER()\n    )\n  )\n  const idp = template.issuingDistributionPoint\n  if (idp) {\n    extensions.push(\n      derExtension(\n        id_ce_issuingDistributionPoint,\n        AsnConvert.serialize(\n          new IssuingDistributionPoint({\n            distributionPoint: idp.distributionPointUris?.length\n              ? new DistributionPointName({\n                  fullName: idp.distributionPointUris.map((uri) => new GeneralName({ uniformResourceIdentifier: uri })),\n                })\n              : undefined,\n            onlyContainsUserCerts: idp.onlyContainsUserCerts ?? false,\n            onlyContainsCACerts: idp.onlyContainsCACerts ?? false,\n          })\n        ),\n        true\n      )\n    )\n  }\n  for (const custom of template.extensions ?? []) extensions.push(toAsnExtension(custom))\n\n  const revoked = (template.revokedCertificates ?? []).map((entry) => {\n    const entryExtensions: Extension[] = []\n    if (entry.reason && entry.reason !== 'unspecified') {\n      entryExtensions.push(\n        derExtension(id_ce_cRLReasons, new asn1js.Enumerated({ value: CRL_REASONS[entry.reason] }).toBER())\n      )\n    }\n    if (entry.invalidityDate) {\n      entryExtensions.push(\n        derExtension(id_ce_invalidityDate, AsnConvert.serialize(new InvalidityDate(entry.invalidityDate)))\n      )\n    }\n    return new AsnRevokedCertificate({\n      userCertificate: toSerialNumber(entry.serialNumber),\n      revocationDate: new Time(entry.revocationDate),\n      crlEntryExtensions: entryExtensions.length > 0 ? entryExtensions : undefined,\n    })\n  })\n\n  const tbs = new TBSCertList({\n    version: Version.v2,\n    signature: signatureAlgorithmIdentifier(template.signatureAlgorithm),\n    issuer: issuer.tbsCertificate.subject,\n    thisUpdate: new Time(template.thisUpdate),\n    nextUpdate: new Time(template.nextUpdate),\n    revokedCertificates: revoked.length > 0 ? revoked : undefined,\n    crlExtensions: extensions,\n  })\n\n  return {\n    tbs: new Uint8Array(AsnConvert.serialize(tbs)),\n    signatureAlgorithm: template.signatureAlgorithm,\n    signerPublicKey: describePublicKey(issuer.tbsCertificate.subjectPublicKeyInfo),\n  }\n}\n\n/** Combine a prepared TBSCertList with the issuer signature. */\nexport function assembleCrl(\n  prepared: PreparedSignedStructure,\n  signature: Uint8Array,\n  signatureEncoding?: SignatureEncoding\n): Crl {\n  return parseCrl(assembleSignedStructure(prepared, signature, signatureEncoding))\n}\n\n/**\n * Create a v2 CRL. The CRL issuer key is never passed in: the `signer` callback receives the\n * DER encoded TBSCertList and returns the signature.\n */\nexport async function createCrl(template: CrlTemplate & SignOptions): Promise<Crl> {\n  const prepared = prepareCrl(template)\n  return assembleCrl(prepared, await template.signer(prepared.tbs), template.signatureEncoding)\n}\n"],"mappings":";;;;;;;;AAaA,MAAa,kBAAkB;CAC7B,YAAY;CACZ,SAAS;CACT,cAAc;CACd,aAAa;CACb,cAAc;CACd,qBAAqB;CACrB,eAAe;CACf,kBAAkB;CAClB,wBAAwB;CACxB,OAAO;CACP,YAAY;CACZ,iBAAiB;CACjB,WAAW;CACX,UAAU;CACV,qBAAqB;CACrB,WAAW;CACX,wBAAwB;CACxB,cAAc;AAChB;;AAKA,MAAa,oBAAoB;CAC/B,KAAK;CACL,SAAS;AACX;;AAGA,MAAa,iBAAiB;CAC5B,MAAM;CACN,WAAW;AACb;;AAGA,MAAa,gBAAgB;CAC3B,WAAW;CACX,cAAc;CACd,QAAQ;CACR,OAAO;CACP,QAAQ;CACR,iBAAiB;AACnB;;AAGA,MAAa,WAAW;CACtB,OAAO;CACP,OAAO;CACP,KAAK;AACP;;AAKA,MAAa,uBAAuB;CAClC,OAAO;EAAE,KAAK;EAAuB,MAAM;EAAW,QAAQ;CAAQ;CACtE,OAAO;EAAE,KAAK;EAAuB,MAAM;EAAW,QAAQ;CAAQ;CACtE,OAAO;EAAE,KAAK;EAAuB,MAAM;EAAW,QAAQ;CAAQ;CACtE,OAAO;EAAE,KAAK;EAAyB,MAAM;EAAW,QAAQ;CAAM;CACtE,OAAO;EAAE,KAAK;EAAyB,MAAM;EAAW,QAAQ;CAAM;CACtE,OAAO;EAAE,KAAK;EAAyB,MAAM;EAAW,QAAQ;CAAM;AACxE;;AAKA,MAAa,iBAAiB;CAC5B,aAAa;CACb,eAAe;CACf,SAAS;CACT,SAAS;CACT,SAAS;AACX;;AAGA,MAAa,cAAc;CACzB,aAAa;CACb,eAAe;CACf,cAAc;CACd,oBAAoB;CACpB,YAAY;CACZ,sBAAsB;CACtB,iBAAiB;CACjB,eAAe;CACf,oBAAoB;CACpB,cAAc;AAChB;;;;;;AC/FA,IAAa,gBAAb,MAAa,sBAAsB,kBAAkB;CACnD,YAAY,SAAiB,SAAmB;EAC9C,MAAM,SAAS,OAAO;EACtB,OAAO,eAAe,MAAM,cAAc,SAAS;EACnD,KAAK,OAAO;CACd;AACF;;;ACCA,MAAa,aAAa;CACxB,aAAa;CACb,KAAK;AACP;;;;;AAMA,SAAgB,MAAM,OAAiB,QAAgB,WAAW,aAAyB;CACzF,IAAI,iBAAiB,YAAY,OAAO;CACxC,IAAI,iBAAiB,aAAa,OAAO,IAAI,WAAW,KAAK;CAC7D,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,cAAc,sDAAsD;CAEhF,IAAI,OAAO;CACX,IAAI,MAAM,SAAS,YAAY,GAAG;EAChC,MAAM,MAAM,MAAM,MAAM,IAAI,OAAO,cAAc,MAAM,4BAA4B,MAAM,MAAM,CAAC;EAChG,IAAI,CAAC,KAAK,MAAM,IAAI,cAAc,4BAA4B,MAAM,QAAQ;EAC5E,OAAO,IAAI;CACb;CACA,OAAO,KAAK,QAAQ,OAAO,EAAE;CAC7B,IAAI,CAAC,yBAAyB,KAAK,IAAI,GACrC,MAAM,IAAI,cAAc,6CAA6C;CAEvE,OAAO,OAAO,OAAO,IAAI;AAC3B;;AAGA,SAAgB,MAAM,KAAiB,QAAgB,WAAW,aAAqB;CAErF,OAAO,cAAc,MAAM,UADb,OAAO,OAAO,GAAG,CAAC,CAAC,MAAM,UAAU,KAAK,CAAC,EAAA,CACb,KAAK,IAAI,EAAE,aAAa,MAAM;AAC1E;;AAGA,SAAgB,cAAc,OAAgC;CAC5D,OAAO,MAAM,MAAM,CAAC,CAAC;AACvB;;;ACxCA,MAAM,SAAS;CACb,SAAS;EAAE,KAAK,eAAe;EAAU,MAAM;CAAG;CAClD,SAAS;EAAE,KAAK,eAAe;EAAU,MAAM;CAAG;CAClD,SAAS;EAAE,KAAK,eAAe;EAAU,MAAM;CAAG;AACpD;;AAKA,SAAgB,sBAAsB,YAAoD;CACxF,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,MAAM,EAAE,QAAQ,UAAU,CAAC,EAAE;AAClE;;AAGA,SAAgB,SAAS,OAAiD;CACxE,MAAM,SAAS,iBAAiB,aAAa,cAAc,KAAK,IAAI;CACpE,MAAM,SAAS,OAAO,QAAQ,MAAM;CACpC,IAAI,OAAO,WAAW,MAAM,OAAO,WAAW,OAAO,YACnD,MAAM,IAAI,cAAc,sBAAsB;CAEhD,OAAO,OAAO;AAChB;;AAGA,SAAgB,aAAa,MAA0C;CACrE,IAAI,gBAAgB,OAAO,iBAAiB,OAAO,KAAK,SAAS;CACjE,IAAI,gBAAgB,OAAO,eAAe,KAAK,WAAW,MAAM,WAAW,GACzE,OAAO,aAAa,KAAK,WAAW,MAAM,EAAE;AAGhD;;AAGA,SAAS,kBAAkB,OAA+B;CACxD,IAAI,IAAI;CACR,OAAO,IAAI,MAAM,SAAS,KAAK,MAAM,OAAO,GAAG;CAC/C,OAAO,MAAM,SAAS,CAAC;AACzB;;;;;AAMA,SAAgB,uBAAuB,OAA+B;CACpE,MAAM,WAAW,kBAAkB,KAAK;CACxC,OAAO,SAAS,KAAK,MAAO,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI;AAC3E;AAEA,SAAS,QAAQ,OAAmC;CAClD,OAAO,IAAI,OAAO,QAAQ,EAAE,UAAU,cAAc,uBAAuB,KAAK,CAAC,EAAE,CAAC;AACtF;AAEA,SAAS,QAAQ,OAAmB,QAA4B;CAC9D,MAAM,WAAW,kBAAkB,KAAK;CACxC,IAAI,SAAS,SAAS,QACpB,MAAM,IAAI,cAAc,0CAA0C;CAEpE,MAAM,MAAM,IAAI,WAAW,MAAM;CACjC,IAAI,IAAI,UAAU,SAAS,SAAS,MAAM;CAC1C,OAAO;AACT;;AAGA,SAAgB,gBAAgB,WAAuB,kBAAsC;CAC3F,IAAI,UAAU,WAAW,mBAAmB,GAC1C,MAAM,IAAI,cACR,cAAc,mBAAmB,EAAE,wCAAwC,UAAU,OAAO,OAC9F;CAEF,MAAM,MAAM,IAAI,OAAO,SAAS,EAC9B,OAAO,CAAC,QAAQ,UAAU,SAAS,GAAG,gBAAgB,CAAC,GAAG,QAAQ,UAAU,SAAS,gBAAgB,CAAC,CAAC,EACzG,CAAC;CACD,OAAO,IAAI,WAAW,IAAI,MAAM,CAAC;AACnC;;AAGA,SAAgB,gBAAgB,WAAuB,kBAAsC;CAC3F,MAAM,MAAM,SAAS,SAAS;CAC9B,IAAI,EAAE,eAAe,OAAO,aAAa,IAAI,WAAW,MAAM,WAAW,GACvE,MAAM,IAAI,cAAc,6BAA6B;CAEvD,MAAM,CAAC,GAAG,KAAK,IAAI,WAAW;CAC9B,IAAI,EAAE,aAAa,OAAO,YAAY,EAAE,aAAa,OAAO,UAC1D,MAAM,IAAI,cAAc,6BAA6B;CAEvD,OAAO,YACL,QAAQ,IAAI,WAAW,EAAE,WAAW,YAAY,GAAG,gBAAgB,GACnE,QAAQ,IAAI,WAAW,EAAE,WAAW,YAAY,GAAG,gBAAgB,CACrE;AACF;;;;;AAMA,SAAgB,gBAAgB,KAA6B;CAC3D,IAAI,IAAI,MAAM,KAAA,KAAa,IAAI,MAAM,KAAA,KAAa,IAAI,MAAM,KAAA,GAC1D,MAAM,IAAI,cAAc,8DAA8D;CAExF,IAAI,IAAI,QAAQ,MAAM;EACpB,MAAM,QAAQ,OAAO,IAAI;EACzB,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,GAC3B,MAAM,IAAI,cAAc,mCAAmC,IAAI,IAAI,EAAE;EAEvE,MAAM,QAAQ,YACZ,IAAI,WAAW,CAAC,CAAC,CAAC,GAClB,QAAQ,UAAU,OAAO,IAAI,CAAC,GAAG,MAAM,IAAI,GAC3C,QAAQ,UAAU,OAAO,IAAI,CAAC,GAAG,MAAM,IAAI,CAC7C;EACA,MAAM,OAAO,IAAI,qBAAqB;GACpC,WAAW,IAAI,oBAAoB;IACjC,WAAW,eAAe;IAC1B,YAAY,IAAI,OAAO,iBAAiB,EAAE,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM;GACtE,CAAC;GACD,kBAAkB,cAAc,KAAK;EACvC,CAAC;EACD,OAAO,IAAI,WAAW,WAAW,UAAU,IAAI,CAAC;CAClD;CACA,IAAI,IAAI,QAAQ,OAAO;EACrB,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,IAAI,cAAc,iCAAiC;EAC/E,MAAM,eAAe,IAAI,OAAO,SAAS,EACvC,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,CAAC,CAAC,GAAG,QAAQ,UAAU,OAAO,IAAI,CAAC,CAAC,CAAC,EAC5E,CAAC;EACD,MAAM,OAAO,IAAI,qBAAqB;GACpC,WAAW,IAAI,oBAAoB;IAAE,WAAW,eAAe;IAAe,YAAY;GAAK,CAAC;GAChG,kBAAkB,aAAa,MAAM;EACvC,CAAC;EACD,OAAO,IAAI,WAAW,WAAW,UAAU,IAAI,CAAC;CAClD;CACA,MAAM,IAAI,cAAc,yBAAyB,IAAI,KAAK;AAC5D;;AAGA,SAAgB,kBAAkB,MAA6C;CAC7E,MAAM,MAAM,IAAI,WAAW,WAAW,UAAU,IAAI,CAAC;CACrD,MAAM,YAAY,KAAK,UAAU;CACjC,MAAM,MAAM,IAAI,WAAW,KAAK,gBAAgB;CAEhD,IAAI,cAAc,eAAe,eAAe,KAAK,UAAU,YAAY;EACzE,MAAM,iBAAiB,SAAS,KAAK,UAAU,UAAU;EACzD,MAAM,aACJ,0BAA0B,OAAO,mBAAmB,eAAe,WAAW,SAAS,IAAI,KAAA;EAC7F,MAAM,QAAQ,OAAO,QAAQ,MAAM,CAAC,CAAC,MAAM,GAAG,OAAO,EAAE,QAAQ,UAAU;EACzE,IAAI;EACJ,IAAI,SAAS,IAAI,OAAO,KAAK,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC,OAAO,GAAG;GACjE,MAAM,OAAO,MAAM,EAAE,CAAC;GACtB,MAAM;IACJ,KAAK;IACL,KAAK,MAAM;IACX,GAAG,UAAU,OAAO,IAAI,SAAS,GAAG,IAAI,IAAI,CAAC;IAC7C,GAAG,UAAU,OAAO,IAAI,SAAS,IAAI,IAAI,CAAC;GAC5C;EACF;EACA,OAAO;GAAE;GAAW;GAAY,MAAM;GAAK;EAAI;CACjD;CAEA,IAAI,cAAc,eAAe,eAAe;EAC9C,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,SAAS,GAAG;GACxB,IAAI,eAAe,OAAO,UAAU;IAClC,MAAM,CAAC,GAAG,KAAK,IAAI,WAAW;IAC9B,IAAI,aAAa,OAAO,WAAW,aAAa,OAAO,SACrD,MAAM;KACJ,KAAK;KACL,GAAG,UAAU,OAAO,kBAAkB,IAAI,WAAW,EAAE,WAAW,YAAY,CAAC,CAAC;KAChF,GAAG,UAAU,OAAO,kBAAkB,IAAI,WAAW,EAAE,WAAW,YAAY,CAAC,CAAC;IAClF;GAEJ;EACF,QAAQ,CAER;EACA,OAAO;GAAE;GAAW,MAAM;GAAK;EAAI;CACrC;CAEA,OAAO;EAAE;EAAW,MAAM;CAAI;AAChC;AAEA,SAAgB,MAAM,OAAyC;CAC7D,OAAO,UAAU,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK,CAAC;AAC9E;AAEA,SAAS,UAAU,QAA4B;CAC7C,IAAI,SAAS,KAAM,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC;CACjD,MAAM,QAAkB,CAAC;CACzB,KAAK,IAAI,IAAI,QAAQ,IAAI,GAAG,MAAM,GAAG,MAAM,QAAQ,IAAI,GAAI;CAC3D,OAAO,IAAI,WAAW,CAAC,MAAO,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvD;;AAGA,SAAgB,OAAO,KAAa,SAAiC;CACnE,OAAO,YAAY,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,UAAU,QAAQ,MAAM,GAAG,OAAO;AAC9E;;AAGA,SAAgB,qBAAqB,OAA2B;CAC9D,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC,IAAI,OAAO,KAAK,UAAU,KAAK,GAAG;AACxE;;;ACnMA,MAAM,cAAc,IAAI,IACtB,OAAO,QAAQ,eAAe,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,KAAK,IAAqB,CAAC,CACnF;;AAGA,MAAM,sBAA8D;CAClE,YAAY;CACZ,SAAS;CACT,cAAc;CACd,aAAa;CACb,cAAc;CACd,qBAAqB;CACrB,eAAe;CACf,kBAAkB;CAClB,wBAAwB;CACxB,OAAO;CACP,WAAW;CACX,wBAAwB;CACxB,cAAc;AAChB;AAEA,SAAS,uBAAuB,OAA+B;CAC7D,IAAI,MAAM,UAAU,OAAO,IAAI,MAAM,MAAM,QAAQ;CACnD,OAAO,MAAM,SAAS;AACxB;AAEA,SAAS,cAAc,OAAuB;CAC5C,OAAO,MACJ,QAAQ,iBAAiB,MAAM,KAAK,GAAG,CAAC,CACxC,QAAQ,UAAU,MAAM,KAAK,GAAG,CAAC,CACjC,QAAQ,MAAM,KAAK;AACxB;;AAGA,SAAgB,UAAU,MAA+B;CACvD,MAAM,aAA2C,CAAC;CAClD,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,QAAkB,CAAC;EACzB,KAAK,MAAM,OAAO,KAAK;GACrB,MAAM,WAAW,YAAY,IAAI,IAAI,IAAI;GACzC,MAAM,QAAQ,uBAAuB,IAAI,KAAK;GAC9C,WAAW,KAAK;IAAE,MAAM,IAAI;IAAM,MAAM;IAAU;GAAM,CAAC;GACzD,MAAM,OAAO,YAAY,oBAAoB,cAAc,IAAI;GAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,MAAM,WAAW,QAAQ,cAAc,KAAK,GAAG;EAC1E;EACA,WAAW,KAAK,MAAM,KAAK,GAAG,CAAC;CACjC;CAEA,MAAM,SAAS,MAAqB,WAAW,MAAM,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE;CAC1E,OAAO;EACL;EACA,SAAS,WAAW,QAAQ,CAAC,CAAC,KAAK,GAAG;EACtC,YAAY,MAAM,YAAY;EAC9B,kBAAkB,MAAM,kBAAkB;EAC1C,wBAAwB,MAAM,wBAAwB;EACtD,yBAAyB,WAAW,QAAQ,MAAM,EAAE,SAAS,wBAAwB,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK;EACzG,aAAa,MAAM,aAAa;EAChC,cAAc,MAAM,cAAc;EAClC,qBAAqB,MAAM,qBAAqB;EAChD,cAAc,MAAM,cAAc;EAClC,WAAW,MAAM,WAAW;EAC5B,SAAS,MAAM,SAAS;EACxB,WAAW,MAAM,WAAW;CAC9B;AACF;;AAGA,MAAM,uCAAuB,IAAI,IAAmB,CAAC,eAAe,cAAc,CAAC;;;;;;AAUnF,SAAgB,UAAU,YAAiD;CACzE,MAAM,OAAoC,CAAC;CAC3C,KAAK,MAAM,CAAC,WAAW,UAAU,YAAY;EAC3C,IAAI,UAAU,KAAA,KAAa,UAAU,IAAI;EACzC,MAAM,OAAO,aAAa,kBAAmB,YAA8B,YAAY,IAAI,SAAS;EACpG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS,GAC1C,MAAM,IAAI,cAAc,2BAA2B,WAAW;EAEhE,MAAM,OAAO,OAAO,gBAAgB,QAAQ;EAC5C,MAAM,iBACJ,QAAQ,qBAAqB,IAAI,IAAI,IACjC,IAAI,eAAe,EAAE,iBAAiB,MAAM,CAAC,IAC7C,SAAS,iBACP,IAAI,eAAe,EAAE,WAAW,MAAM,CAAC,IACvC,IAAI,eAAe,EAAE,YAAY,MAAM,CAAC;EAChD,KAAK,KAAK,IAAI,0BAA0B,CAAC,IAAI,sBAAsB;GAAE;GAAM,OAAO;EAAe,CAAC,CAAC,CAAC,CAAC;CACvG;CACA,OAAO,IAAIA,KAAS,IAAI;AAC1B;AAEA,SAAS,UAAU,OAAuB;CACxC,OAAO,MAAM,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,CAAC,CAAC,YAAY;AACvD;;;;;AAMA,SAAgB,WAAW,GAAsB,GAA+B;CAC9E,OACE,EAAE,WAAW,WAAW,EAAE,WAAW,UACrC,EAAE,WAAW,OACV,MAAM,MAAM,KAAK,SAAS,EAAE,WAAW,EAAE,CAAC,QAAQ,UAAU,KAAK,KAAK,MAAM,UAAU,EAAE,WAAW,EAAE,CAAC,KAAK,CAC9G;AAEJ;;;;ACnHA,SAAgB,aAAa,YAAsD;CACjF,MAAM,UAAU,cAAc,CAAC,EAAA,CAAG,KAAK,OAAO;EAC5C,KAAK,EAAE;EACP,UAAU,EAAE;EACZ,OAAO,IAAI,WAAW,EAAE,UAAU,MAAM;CAC1C,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,QAAQ;EAC5B,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,IAAI,cAAc,uBAAuB,KAAK;EACvE,KAAK,IAAI,GAAG;CACd;CACA,OAAO;AACT;;AAGA,SAAgB,gBACd,YACA,KACA,MACA,MACe;CACf,MAAM,YAAY,WAAW,MAAM,MAAM,EAAE,QAAQ,GAAG;CACtD,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,IAAI;EACF,OAAO,WAAW,MAAM,cAAc,UAAU,KAAK,GAAG,IAAI;CAC9D,SAAS,OAAO;EACd,MAAM,IAAI,cAAc,WAAW,KAAK,aAAa,KAAK;CAC5D;AACF;AAEA,SAAgB,MAAM,MAAmD;CACvE,OAAO,MAAM;AACf;AAEA,SAAgB,OAAO,OAA4C;CACjE,QAAQ,SAAS,CAAC,EAAA,CAAG,IAAI,KAAK,CAAC,CAAC,QAAQ,MAAmB,MAAM,KAAA,CAAS;AAC5E;AAEA,SAAgB,+BAAwD;CACtE,OAAO;EAAE,UAAU,CAAC;EAAG,MAAM,CAAC;EAAG,QAAQ,CAAC;EAAG,aAAa,CAAC;EAAG,gBAAgB,CAAC;EAAG,YAAY,CAAC;CAAE;AACnG;AAEA,SAAgB,0BAA0B,OAA+C;CACvF,MAAM,SAAS,6BAA6B;CAC5C,KAAK,MAAM,QAAQ,OACjB,IAAI,KAAK,8BAA8B,KAAA,GAAW,OAAO,KAAK,KAAK,KAAK,yBAAyB;MAC5F,IAAI,KAAK,eAAe,KAAA,GAAW,OAAO,OAAO,KAAK,KAAK,UAAU;MACrE,IAAI,KAAK,YAAY,KAAA,GAAW,OAAO,SAAS,KAAK,KAAK,OAAO;MACjE,IAAI,KAAK,cAAc,KAAA,GAAW,OAAO,YAAY,KAAK,KAAK,SAAS;MACxE,IAAI,KAAK,eAAe,OAAO,eAAe,KAAK,UAAU,KAAK,aAAa,CAAC;MAChF,IAAI,KAAK,WAAW;EACvB,MAAM,QAAQ,IAAI,WAAW,KAAK,UAAU,KAAK;EACjD,IAAI;EACJ,IAAI;GACF,OAAO,aAAa,SAAS,KAAK,CAAC;EACrC,QAAQ,CAER;EACA,OAAO,WAAW,KAAK;GAAE,QAAQ,KAAK,UAAU;GAAQ;GAAO;EAAK,CAAC;CACvE;CAEF,OAAO;AACT;;AAGA,SAAgB,iBAAiB,OAA0C;CACzE,OAAO,MAAM,WACV,QAAQ,MAAM,EAAE,WAAW,gBAAgB,mBAAmB,EAAE,SAAS,KAAA,CAAS,CAAC,CACnF,KAAK,MAAM,EAAE,IAAc;AAChC;;;ACxEA,MAAM,iBAAiB,IAAI,IACzB,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,KAAK,IAAkB,CAAC,CACzE;;AAGA,SAAS,cAAiB,WAAwB,MAAsB;CACtE,IAAI,CAAC,UAAU,eACb,MAAM,IAAI,cAAc,eAAe,UAAU,YAAY,8BAA8B;CAE7F,IAAI;EACF,OAAO,WAAW,MAAM,UAAU,eAAe,IAAI;CACvD,SAAS,OAAO;EACd,MAAM,IAAI,cAAc,yCAAyC,UAAU,eAAe,KAAK;CACjG;AACF;;AAGA,SAAgB,kBAAkB,YAAwC;CACxE,MAAM,SAAuB;EAC3B,cAAc,CAAC;EACf,cAAc;EACd,QAAQ;EACR,SAAS,CAAC;EACV,KAAK,CAAC;EACN,sBAAsB,CAAC;CACzB;CAEA,KAAK,MAAM,aAAa,YAAY;EAClC,OAAO,aAAa,KAAK,UAAU,WAAW;EAE9C,QAAQ,UAAU,aAAlB;GACE,KAAK,cAAc;IACjB,OAAO,eAAe;IACtB;GACF,KAAK,cAAc;IACjB,OAAO,SAAS;IAChB;GACF,KAAK,cAAc;IACjB,KAAK,MAAM,OAAO,cAAc,WAAW,MAAM,GAC/C,OAAO,QAAQ,KAAK,eAAe,IAAI,GAAG,KAAK,GAAG;IAEpD;GACF,KAAK,cAAc;IACjB,KAAK,MAAM,EAAE,KAAK,cAAc,cAAc,WAAW,OAAO,GAC9D,OAAO,IAAI,KAAK;KAAE;KAAK;IAAS,CAAC;IAEnC;GACF,KAAK,cAAc,iBACjB,OAAO,qBAAqB,KAAK,GAAG,cAAc,WAAW,eAAe,CAAC;EAEjF;CACF;CACA,OAAO;AACT;AASA,SAAS,UAAU,aAAqB,MAA6B;CACnE,OAAO,OAAO,OAAO,IAAI,YAAY,GAAG;EACtC;EACA,eAAe,SAAS,KAAA,IAAY,KAAA,IAAY,WAAW,UAAU,IAAI;CAC3E,CAAC;AACH;;AAGA,SAAgB,eAAe,OAAwC;CACrE,MAAM,aAAa,IAAI,aAAa,CAAC,UAAU,cAAc,YAAY,CAAC,CAAC;CAE3E,IAAI,MAAM,QACR,WAAW,KAAK,UAAU,cAAc,MAAM,CAAC;CAEjD,IAAI,MAAM,QAAQ,SAAS,GACzB,WAAW,KAAK,UAAU,cAAc,QAAQ,IAAI,OAAO,MAAM,QAAQ,KAAK,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;CAEpG,IAAI,MAAM,KAAK,QACb,WAAW,KAAK,UAAU,cAAc,OAAO,IAAI,QAAQ,MAAM,IAAI,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAEvG,IAAI,MAAM,sBAAsB,QAC9B,WAAW,KAAK,UAAU,cAAc,iBAAiB,IAAI,gBAAgB,MAAM,oBAAoB,CAAC,CAAC;CAE3G,OAAO;AACT;;;AC/CA,MAAM,6BAA6B,IAAI,IACrC,OAAO,QAAQ,oBAAoB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,IAA0B,CAAC,CACjG;AAEA,SAAgB,uBAAuB,KAA6C;CAClF,OAAO,2BAA2B,IAAI,GAAG;AAC3C;AAEA,SAAS,WAAW,UAA2E;CAC7F,QAAQ,YAAY,CAAC,EAAA,CAAG,KAAK,WAAW;EACtC,MAAM,UAAoB,CAAC;EAC3B,MAAM,cAAwB,CAAC;EAC/B,KAAK,MAAM,aAAa,OAAO,oBAAoB,CAAC,GAClD,IAAI,UAAU,sBAAsB,kBAAkB,KAAK;GACzD,MAAM,MAAM,aAAa,SAAS,UAAU,SAAS,CAAC;GACtD,IAAI,KAAK,QAAQ,KAAK,GAAG;EAC3B,OAAO,IAAI,UAAU,sBAAsB,kBAAkB,SAAS;GACpE,MAAM,SAAS,WAAW,MAAM,UAAU,WAAW,UAAU;GAC/D,IAAI,OAAO,cAAc,YAAY,KAAK,OAAO,aAAa,SAAS,CAAC;EAC1E;EAEF,OAAO;GAAE,KAAK,OAAO;GAAkB;GAAS;EAAY;CAC9D,CAAC;AACH;;;;;;;;;;;AAYA,SAAgB,iBAAiB,OAAyB,SAAyC;CACjG,MAAM,MAAM,MAAM,OAAO,WAAW,WAAW;CAE/C,IAAI;CACJ,IAAI;EACF,cAAc,WAAW,MAAM,cAAc,GAAG,GAAGC,aAAiB,OAAO;CAC7E,SAAS,OAAO;EACd,MAAM,IAAI,cAAc,6BAA6B,KAAK;CAC5D;CACA,IAAI,CAAC,YAAY,mBACf,MAAM,IAAI,cAAc,sCAAsC;CAGhE,MAAM,MAAM,YAAY;CACxB,MAAM,aAAa,aAAa,IAAI,UAAU;CAC9C,MAAM,UAAa,KAAa,MAAmB,SAAiB,gBAAgB,YAAY,KAAK,MAAM,IAAI;CAE/G,MAAM,MAAM,OAAO,sBAAsB,wBAAwB,gBAAgB;CACjF,MAAM,WAAW,OAAO,gBAAgB,UAAU,UAAU;CAC5D,MAAM,MAAM,OAAO,mBAAmB,kBAAkB,aAAa;CACrE,MAAM,mBAAmB,OAAO,wBAAwB,kBAAkB,kBAAkB;CAC5F,MAAM,MAAM,OAAO,4BAA4B,sBAAsB,sBAAsB;CAC3F,MAAM,MAAM,OAAO,8BAA8B,wBAAwB,wBAAwB;CACjG,MAAM,SAAS,OAAO,6BAA6B,uBAAuB,uBAAuB;CACjG,MAAM,MAAM,OAAO,2BAA2B,2BAA2B,qBAAqB,KAAK,CAAC;CACpG,MAAM,eAAe,OAAO,cAAc,WAAW,cAAc,cAAc;CACjF,MAAM,cAAc,WAClB,IACG,QAAQ,MAAM,EAAE,iBAAiB,MAAM,CAAC,CACxC,KAAK,MAAM,MAAM,EAAE,cAAc,CAAC,CAAC,CACnC,QAAQ,MAAmB,MAAM,KAAA,CAAS;CAE/C,OAAO;EACL;EACA,KAAK,MAAM,KAAK,WAAW,WAAW;EACtC,SAAS,IAAI,UAAU;EACvB,cAAc,MAAM,IAAI,YAAY;EACpC,QAAQ,UAAU,IAAI,MAAM;EAC5B,SAAS,UAAU,IAAI,OAAO;EAC9B,WAAW,IAAI,SAAS,UAAU,QAAQ;EAC1C,UAAU,IAAI,SAAS,SAAS,QAAQ;EACxC,WAAW,kBAAkB,IAAI,oBAAoB;EACrD,oBAAoB,YAAY,mBAAmB;EACnD,wBAAwB,uBAAuB,YAAY,mBAAmB,SAAS;EACvF,gBAAgB,IAAI,WAAW,YAAY,iBAAiB;EAC5D,WAAW,IAAI,WAAW,YAAY,cAAc;EAEpD,UAAU,WAAW,OAAO,2BAA2B,qBAAqB,qBAAqB,CAAC;EAClG,yBAAyB,MAAM,0BAA0B,GAAG,IAAI,6BAA6B;EAC7F,UAAU,UAAU,OAAO;EAC3B,kBAAkB,MAAM,CAAC,GAAG,GAAG,IAAI,KAAA;EACnC,kBAAkB,mBACd;GAAE,IAAI,iBAAiB;GAAI,mBAAmB,iBAAiB;EAAkB,IACjF,KAAA;EACJ,sBAAsB,MAAM,MAAM,IAAI,MAAM,IAAI,KAAA;EAChD,wBAAwB,KAAK,gBAAgB,MAAM,IAAI,cAAc,MAAM,IAAI,KAAA;EAC/E,wBAAwB,UAAU,CAAC,EAAA,CAAG,SAAS,OAAO,OAAO,GAAG,mBAAmB,QAAQ,CAAC;EAC5F,UAAU,WAAW,eAAe,IAAI;EACxC,eAAe,WAAW,eAAe,SAAS;EAClD,cAAc,eAAe,kBAAkB,YAAY,IAAI,KAAA;EAE/D;CACF;AACF;;;;AC5HA,SAAgB,6BAA6B,MAA+C;CAC1F,MAAM,YAAY,qBAAqB;CACvC,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,oCAAoC,MAAM;CAClF,OAAO,IAAI,oBAAoB;EAC7B,WAAW,UAAU;EAErB,YAAY,UAAU,WAAW,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,KAAA;CACvE,CAAC;AACH;;AAGA,SAAgB,eAAe,cAAgD;CAE7E,MAAM,WAAW,uBADH,OAAO,iBAAiB,WAAW,UAAU,aAAa,QAAQ,QAAQ,EAAE,CAAC,IAAI,YAClD;CAC7C,IAAI,SAAS,WAAW,KAAK,SAAS,OAAO,MAAM,MAAM,CAAC,GACxD,MAAM,IAAI,cAAc,0CAA0C;CAEpE,IAAI,SAAS,SAAS,IACpB,MAAM,IAAI,cAAc,2EAA2E;CAErG,OAAO,cAAc,QAAQ;AAC/B;;;;;AAMA,SAAgB,wBACd,UACA,WACA,oBAAuC,cAC3B;CACZ,MAAM,YAAY,qBAAqB,SAAS;CAChD,IAAI,eAAe;CACnB,IAAI,UAAU,WAAW,WAAW,sBAAsB,cAAc;EACtE,MAAM,mBAAmB,sBAAsB,SAAS,gBAAgB,UAAU;EAClF,IAAI,CAAC,kBACH,MAAM,IAAI,cAAc,oEAAoE;EAE9F,eAAe,gBAAgB,WAAW,gBAAgB;CAC5D;CACA,MAAM,sBAAsB,IAAI,WAC9B,WAAW,UAAU,6BAA6B,SAAS,kBAAkB,CAAC,CAChF;CACA,OAAO,OACL,IACA,YAAY,SAAS,KAAK,qBAAqB,OAAO,GAAM,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAC7G;AACF;AAEA,eAAe,gBACb,QACA,MACA,WACA,UACkB;CAClB,IAAI,iBAAiB,OAAO;CAC5B,IAAI,OAAO,0BAA0B,qBAAqB,OAAO,uBAAuB,CAAC,WAAW,SAAS;EAC3G,MAAM,mBAAmB,sBAAsB,UAAU,UAAU;EACnE,IAAI,CAAC,kBAAkB,OAAO;EAC9B,IAAI;GACF,iBAAiB,gBAAgB,OAAO,WAAW,gBAAgB;EACrE,QAAQ;GACN,OAAO;EACT;CACF;CACA,OAAO,SAAS;EACd;EACA,WAAW,OAAO;EAClB;EACA,oBAAoB,OAAO;EAC3B,wBAAwB,OAAO;EAC/B;CACF,CAAC;AACH;AAEA,SAAS,cAAc,OAAoD;CACzE,OAAO,OAAO,UAAU,YAAY,oBAAoB,QAAQ,QAAQ,iBAAiB,KAAK;AAChG;;;;;;;;;;AAWA,eAAsB,2BACpB,aACA,mBACA,UACkB;CAClB,MAAM,OAAO,cAAc,WAAW;CACtC,MAAM,SAAS,cAAc,iBAAiB;CAC9C,IAAI,CAAC,WAAW,KAAK,QAAQ,OAAO,OAAO,GAAG,OAAO;CACrD,IACE,KAAK,0BACL,OAAO,wBACP,KAAK,2BAA2B,OAAO,sBAEvC,OAAO;CAET,OAAO,gBAAgB,MAAM,KAAK,gBAAgB,OAAO,WAAW,QAAQ;AAC9E;;;;;;;AAQA,eAAsB,mBACpB,KACA,mBACA,UACkB;CAClB,MAAM,SAAS,cAAc,iBAAiB;CAC9C,IAAI,CAAC,WAAW,IAAI,QAAQ,OAAO,OAAO,GAAG,OAAO;CACpD,IACE,IAAI,0BACJ,OAAO,wBACP,IAAI,2BAA2B,OAAO,sBAEtC,OAAO;CAET,IAAI,OAAO,YAAY,CAAC,OAAO,SAAS,SAAS,SAAS,GAAG,OAAO;CACpE,OAAO,gBAAgB,KAAK,IAAI,aAAa,OAAO,WAAW,QAAQ;AACzE;;;AC7FA,SAAS,UAAU,QAAgB,OAAgB,WAAW,OAAkB;CAC9E,OAAO,IAAI,UAAU;EAAE;EAAQ;EAAU,WAAW,IAAI,YAAY,WAAW,UAAU,KAAK,CAAC;CAAE,CAAC;AACpG;AAEA,SAAgB,cAAc,QAAgC;CAC5D,OAAO,OAAO,QAAQ,OAAO,UAAU,QAAQ,cAAc,UAAU,YAAY,YAAY,QAAQ,CAAC;AAC1G;;AAGA,SAAgB,uBAAuB,OAA0C;CAC/E,IAAI;EACF,OAAO,WAAW,MAAM,cAAc,MAAM,OAAO,WAAW,WAAW,CAAC,GAAGC,WAAe;CAC9F,SAAS,OAAO;EACd,MAAM,IAAI,cAAc,8BAA8B,KAAK;CAC7D;AACF;;AAGA,SAAgB,uBAAuB,aAAuD;CAC5F,MAAM,MAAM,YAAY,eAAe,YAAY,MAAM,MAAM,EAAE,WAAW,0BAA0B;CACtG,OAAO,MAAM,WAAW,MAAM,IAAI,UAAU,QAAQ,oBAAoB,CAAC,CAAC,SAAS,KAAA;AACrF;;;;;AAMA,SAAgB,gBAAgB,QAAgB,OAAsD;CAEpG,MAAM,UADY,8BAA8B,KAAK,KAC7B,IAAI,IAAI,OAAO,gBAAgB,EAAE,MAAM,CAAC,IAAI,IAAI,OAAO,WAAW,EAAE,MAAM,CAAC;CACnG,OAAO;EAAE;EAAQ,OAAO,IAAI,WAAW,QAAQ,MAAM,CAAC;CAAE;AAC1D;;;;;;;;AASA,eAAsB,mBAAmB,UAAiE;CACxG,IAAI,EAAE,SAAS,WAAW,SAAS,YACjC,MAAM,IAAI,cAAc,uCAAuC;CAGjE,MAAM,UACJ,SAAS,4BAA4B,aACjC,SAAS,mBACT,gBAAgB,SAAS,gBAAgB;CAC/C,IAAI;CACJ,IAAI;EACF,uBAAuB,WAAW,MAAM,cAAc,OAAO,GAAG,oBAAoB;CACtF,SAAS,OAAO;EACd,MAAM,IAAI,cAAc,8BAA8B,KAAK;CAC7D;CAEA,MAAM,SAAS,SAAS,oBAAoB,uBAAuB,SAAS,iBAAiB,IAAI,KAAA;CACjG,MAAM,UAAU,UAAU,SAAS,OAAO;CAC1C,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,cAAc,+BAA+B;CAEjF,MAAM,aAA0B,CAAC;CACjC,MAAM,mBAAmB,SAAS,oBAAoB,EAAE,IAAI,MAAM;CAClE,WAAW,KAAK,UAAU,wBAAwB,IAAI,iBAAiB,gBAAgB,GAAG,IAAI,CAAC;CAE/F,MAAM,WAAW,SAAS,aAAa,iBAAiB,KAAK,CAAC,eAAe,SAAS,IAAI,CAAC,kBAAkB;CAC7G,IAAI,SAAS,SAAS,GACpB,WAAW,KAAK,UAAU,gBAAgB,IAAI,SAAS,cAAc,QAAQ,CAAC,GAAG,IAAI,CAAC;CAGxF,IAAI,SAAS,kBAAkB,QAC7B,WAAW,KAAK,UAAU,mBAAmB,IAAI,iBAAiB,SAAS,gBAAgB,CAAC,CAAC;CAG/F,IAAI,SAAS,qBAAqB,QAChC,WAAW,KACT,UACE,2BACA,IAAI,oBACF,SAAS,oBAAoB,KAC1B,WACC,IAAI,kBAAkB;EACpB,kBAAkB,OAAO;EACzB,kBAAkB,OAAO,SAAS,SAC9B,OAAO,QAAQ,KACZ,QACC,IAAI,oBAAoB;GACtB,mBAAmB,kBAAkB;GACrC,WAAW,IAAI,OAAO,UAAU,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM;EACxD,CAAC,CACL,IACA,KAAA;CACN,CAAC,CACL,CACF,CACF,CACF;CAGF,MAAM,MAAM,SAAS;CACrB,MAAM,eAAe;EACnB,IAAI,KAAK,YAAY,CAAC,EAAA,CAAG,KAAK,YAAY,IAAI,YAAY,EAAE,QAAQ,CAAC,CAAC;EACtE,IAAI,KAAK,QAAQ,CAAC,EAAA,CAAG,KAAK,8BAA8B,IAAI,YAAY,EAAE,0BAA0B,CAAC,CAAC;EACtG,IAAI,KAAK,UAAU,CAAC,EAAA,CAAG,KAAK,eAAe,IAAI,YAAY,EAAE,WAAW,CAAC,CAAC;EAC1E,IAAI,KAAK,cAAc,CAAC,EAAA,CAAG,KACxB,MAAM,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU;GAAE,QAAQ,EAAE;GAAQ,OAAO,cAAc,EAAE,KAAK;EAAE,CAAC,EAAE,CAAC,CAC1G;CACF;CACA,IAAI,aAAa,SAAS,GACxB,WAAW,KAAK,UAAU,sBAAsB,IAAI,uBAAuB,YAAY,CAAC,CAAC;CAG3F,IAAI;CACJ,IAAI,SAAS,QAAQ;EAGnB,uBAAuB,eAAc,MADlB,SAAS,OAAO,qBAAqB,kBAAkB,SAAS,EAC9C,CAAK,MAAM,GAAG,EAAE,CAAC;EACtD,WAAW,KAAK,UAAU,4BAA4B,IAAI,qBAAqB,oBAAoB,CAAC,CAAC;CACvG;CAEA,MAAM,yBAAyB,SAAS,uBAAuB,MAAM,IAAI;CACzE,IAAI,wBACF,WAAW,KACT,UACE,8BACA,IAAI,uBAAuB,EAAE,eAAe,IAAI,cAAc,sBAAsB,EAAE,CAAC,CACzF,CACF;CAGF,IAAI,SAAS,uBAAuB,QAClC,WAAW,KACT,UACE,6BACA,IAAI,sBACF,SAAS,sBAAsB,KAC5B,QACC,IAAI,kBAAkB,EACpB,mBAAmB,IAAI,sBAAsB,EAC3C,UAAU,CAAC,IAAI,YAAY,EAAE,2BAA2B,IAAI,CAAC,CAAC,EAChE,CAAC,EACH,CAAC,CACL,CACF,CACF,CACF;CAGF,MAAM,qBAAqB,CACzB,IAAI,SAAS,YAAY,CAAC,EAAA,CAAG,KAAK,QAAQ,CAAC,eAAe,MAAM,GAAG,CAAU,GAC7E,IAAI,SAAS,iBAAiB,CAAC,EAAA,CAAG,KAAK,QAAQ,CAAC,eAAe,WAAW,GAAG,CAAU,CACzF,CAAC,CAAC,KACC,CAAC,cAAc,SACd,IAAI,kBAAkB;EAAE;EAAc,gBAAgB,IAAI,YAAY,EAAE,2BAA2B,IAAI,CAAC;CAAE,CAAC,CAC/G;CACA,IAAI,mBAAmB,SAAS,GAC9B,WAAW,KAAK,UAAU,2BAA2B,IAAI,0BAA0B,kBAAkB,CAAC,CAAC;CAGzG,IAAI,SAAS,cAAc;EACzB,MAAM,eAAe,eAAe;GAAE,GAAG,SAAS;GAAc,SAAS,SAAS,aAAa,WAAW,CAAC;EAAE,CAAC;EAC9G,WAAW,KAAK,UAAU,cAAc,WAAW,YAAY,CAAC;CAClE;CAEA,KAAK,MAAM,UAAU,SAAS,cAAc,CAAC,GAC3C,WAAW,KAAK,eAAe,MAAM,CAAC;CAExC,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,YAAY,YAAY;EACnC,IAAI,KAAK,IAAI,MAAM,GAAG,MAAM,IAAI,cAAc,uBAAuB,QAAQ;EAC7E,KAAK,IAAI,MAAM;CACjB;CAEA,MAAM,MAAM,IAAI,eAAe;EAC7B,SAAS,QAAQ;EACjB,cAAc,eAAe,SAAS,YAAY;EAClD,WAAW,6BAA6B,SAAS,kBAAkB;EACnE,QAAQ,SAAS,OAAO,eAAe,UAAU;EACjD,UAAU,IAAI,SAAS;GAAE,WAAW,SAAS;GAAW,UAAU,SAAS;EAAS,CAAC;EACrF;EACA;EACA,YAAY,IAAI,WAAW,UAAU;CACvC,CAAC;CAED,OAAO;EACL,KAAK,IAAI,WAAW,WAAW,UAAU,GAAG,CAAC;EAC7C,oBAAoB,SAAS;EAC7B,iBAAiB,kBAAkB,SAAS,OAAO,eAAe,uBAAuB,oBAAoB;CAC/G;AACF;AAEA,SAAgB,eAAe,WAAqC;CAClE,OAAO,IAAI,UAAU;EACnB,QAAQ,UAAU;EAClB,UAAU,UAAU;EACpB,WAAW,IAAI,YAAY,cAAc,UAAU,KAAK,CAAC;CAC3D,CAAC;AACH;;;;;;AAOA,SAAgB,oBACd,UACA,WACA,mBACa;CACb,OAAO,iBAAiB,wBAAwB,UAAU,WAAW,iBAAiB,CAAC;AACzF;;;;;;;;;AAUA,eAAsB,kBAAkB,UAAmE;CACzG,MAAM,WAAW,MAAM,mBAAmB,QAAQ;CAElD,OAAO,oBAAoB,UAAU,MADb,SAAS,OAAO,SAAS,GAAG,GACJ,SAAS,iBAAiB;AAC5E;;;ACjOA,MAAM,iBAAiB,IAAI,IACzB,OAAO,QAAQ,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,MAAM,IAAiB,CAAC,CAC7E;;AAGA,MAAM,uCAAuB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAM,yCAAyB,IAAI,IAAI;CACrC;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,cAAc,YAA6B,KAAa,MAAkC;CACjG,MAAM,YAAY,WAAW,MAAM,MAAM,EAAE,QAAQ,GAAG;CACtD,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,OAAO,SAAS,UAAU,KAAK;CACrC,MAAM,QAAQ,gBAAgB,OAAO,UAAU,IAAI,WAAW,KAAK,WAAW,YAAY,IAAI,KAAA;CAC9F,IAAI,CAAC,SAAS,MAAM,WAAW,KAAK,MAAM,KAAK,KAC7C,MAAM,IAAI,cAAc,WAAW,KAAK,WAAW;CAErD,OAAO,qBAAqB,KAAK;AACnC;AAEA,SAAS,gBAAgB,OAAqD;CAC5E,MAAM,OAAO,MAAM,MAAM,MAAM,EAAE,aAAa,CAAC,EAAE;CACjD,OAAO,OAAO,UAAU,IAAI,IAAI,KAAA;AAClC;AAEA,SAAS,sBAAsB,SAAoE;CACjG,IAAI;CACJ,QAAQ,WAAW,CAAC,EAAA,CAAG,KAAK,UAAU;EACpC,MAAM,aAAa,aAAa,MAAM,kBAAkB;EACxD,MAAM,UAAa,KAAa,MAAmB,SAAiB,gBAAgB,YAAY,KAAK,MAAM,IAAI;EAC/G,MAAM,SAAS,OAAO,kBAAkB,WAAW,YAAY;EAC/D,MAAM,aAAa,OAAO,sBAAsB,gBAAgB,gBAAgB;EAChF,MAAM,SAAS,OAAO,yBAAyB,mBAAmB,mBAAmB;EAErF,IAAI,QAAQ,oBAAoB,gBAAgB,MAAM;EACtD,OAAO;GACL,cAAc,MAAM,MAAM,eAAe;GACzC,gBAAgB,MAAM,eAAe,QAAQ;GAC7C,QAAQ,SAAS,eAAe,IAAI,OAAO,MAAM,IAAI,KAAA;GACrD,gBAAgB,YAAY;GAC5B;GACA;EACF;CACF,CAAC;AACH;;AAYA,MAAM,kBAAkB;;;;;;;;;AAUxB,SAAgB,SAAS,OAAiB,UAA2B,CAAC,GAAQ;CAC5E,MAAM,MAAM,MAAM,OAAO,WAAW,GAAG;CACvC,MAAM,EAAE,aAAa,KAAS,eAAe;CAC7C,IAAI;CACJ,IAAI;EACF,MAAM,WAAW,MAAM,cAAc,GAAG,GAAG,iBAAiB,EAC1D,YAAY;GAAE,UAAU,MAAQ,aAAa;GAAiB,GAAG;EAAW,EAC9E,CAAC;CACH,SAAS,OAAO;EACd,MAAM,IAAI,cAAc,eAAe,KAAK;CAC9C;CACA,IAAI,CAAC,IAAI,gBAAgB,MAAM,IAAI,cAAc,mCAAmC;CAEpF,MAAM,MAAM,IAAI;CAChB,MAAM,aAAa,aAAa,IAAI,aAAa;CACjD,MAAM,UAAa,KAAa,MAAmB,SAAiB,gBAAgB,YAAY,KAAK,MAAM,IAAI;CAC/G,MAAM,MAAM,OAAO,8BAA8B,wBAAwB,wBAAwB;CACjG,MAAM,MAAM,OAAO,gCAAgC,0BAA0B,0BAA0B;CACvG,MAAM,WAAW,OAAO,mBAAmB,aAAa,aAAa;CAErE,OAAO;EACL;EACA,KAAK,MAAM,KAAK,WAAW,GAAG;EAC9B,SAAS,IAAI,YAAY,KAAA,IAAY,IAAI,IAAI,UAAU;EACvD,QAAQ,UAAU,IAAI,MAAM;EAC5B,YAAY,IAAI,WAAW,QAAQ;EACnC,YAAY,IAAI,YAAY,QAAQ;EACpC,oBAAoB,IAAI,mBAAmB;EAC3C,wBAAwB,uBAAuB,IAAI,mBAAmB,SAAS;EAC/E,WAAW,IAAI,WAAW,IAAI,SAAS;EACvC,aAAa,IAAI,WAAW,IAAI,cAAc;EAC9C,WAAW,cAAc,YAAY,iBAAiB,WAAW;EACjE,mBAAmB,cAAc,YAAY,yBAAyB,mBAAmB;EACzF,wBAAwB,KAAK,gBAAgB,MAAM,IAAI,cAAc,MAAM,IAAI,KAAA;EAC/E,0BAA0B,MACtB;GACE,uBAAuB,OAAO,IAAI,mBAAmB,QAAQ;GAC7D,uBAAuB,IAAI;GAC3B,qBAAqB,IAAI;GACzB,4BAA4B,IAAI;GAChC,aAAa,IAAI;GACjB,iBAAiB,IAAI,iBAAiB,OAAO;EAC/C,IACA,KAAA;EACJ,cAAc,YAAY,CAAC,EAAA,CAAG,SAAS,OAAO,OAAO,GAAG,mBAAmB,QAAQ,CAAC;EACpF,qBAAqB,sBAAsB,IAAI,mBAAmB;EAClE;CACF;AACF;AAMA,SAAS,gBAAgB,KAAqB;CAC5C,OAAO,IAAI,YAAY,CAAC,CAAC,QAAQ,gBAAgB,EAAE;AACrD;AAEA,SAAS,QACP,QACA,SACkB;CAClB,OAAO;EAAE,QAAQ;EAAW;EAAQ;CAAQ;AAC9C;;;;;;;;;;AAWA,SAAgB,oBACd,aACA,KACA,UAAkC,CAAC,GACjB;CAClB,IAAI,IAAI,sBAAsB,KAAA,GAC5B,OAAO,QAAQ,aAAa,0DAA0D;CAExF,MAAM,cAAc,IAAI,WAAW,MAAM,MAAM,EAAE,YAAY,CAAC,qBAAqB,IAAI,EAAE,GAAG,CAAC;CAC7F,IAAI,aACF,OAAO,QAAQ,kCAAkC,sCAAsC,YAAY,KAAK;CAG1G,MAAM,MAAM,IAAI;CAChB,MAAM,WAAW,KAAK,eAAe;CACrC,IAAI,CAAC,UAAU;EACb,IAAI,CAAC,WAAW,IAAI,QAAQ,YAAY,MAAM,GAC5C,OAAO,QAAQ,mBAAmB,iDAAiD;EAErF,IACE,IAAI,0BACJ,YAAY,0BACZ,IAAI,2BAA2B,YAAY,wBAE3C,OAAO,QAAQ,mBAAmB,6DAA6D;CAEnG;CAEA,IAAI,QAAQ,QAAQ,OAAO;EACzB,MAAM,MAAM,QAAQ,uBAAO,IAAI,KAAK;EACpC,IAAI,MAAM,IAAI,YACZ,OAAO,QAAQ,qBAAqB,+BAA+B,IAAI,WAAW,YAAY,GAAG;EAEnG,IAAI,IAAI,cAAc,MAAM,IAAI,YAC9B,OAAO,QAAQ,eAAe,sBAAsB,IAAI,WAAW,YAAY,GAAG;CAEtF;CAEA,IAAI,KAAK;EACP,MAAM,OAAO,YAAY,kBAAkB,OAAO;EAClD,IAAI,IAAI,4BAA4B,OAAO,QAAQ,gBAAgB,4CAA4C;EAC/G,IAAI,IAAI,uBAAuB,CAAC,MAAM,OAAO,QAAQ,gBAAgB,qCAAqC;EAC1G,IAAI,IAAI,yBAAyB,MAAM,OAAO,QAAQ,gBAAgB,6CAA6C;EACnH,IACE,IAAI,sBAAsB,SAAS,KACnC,CAAC,IAAI,sBAAsB,MAAM,QAAQ,YAAY,sBAAsB,SAAS,GAAG,CAAC,GAExF,OAAO,QAAQ,gBAAgB,2DAA2D;CAE9F;CAEA,MAAM,SAAS,gBAAgB,YAAY,YAAY;CACvD,MAAM,QAAQ,IAAI,oBAAoB,MACnC,MACC,gBAAgB,EAAE,YAAY,MAAM,WACnC,CAAC,YAAY,WAAW,EAAE,qBAAqB,IAAI,QAAQ,YAAY,MAAM,EAClF;CAEA,IAAI,OAAO;EACT,MAAM,mBAAmB,MAAM,WAAW,MAAM,MAAM,EAAE,YAAY,CAAC,uBAAuB,IAAI,EAAE,GAAG,CAAC;EACtG,IAAI,kBACF,OAAO,QACL,kCACA,4CAA4C,iBAAiB,KAC/D;EAEF,IAAI,MAAM,WAAW,iBAAiB,OAAO,EAAE,QAAQ,OAAO;EAC9D,OAAO;GACL,QAAQ;GACR,gBAAgB,MAAM;GACtB,QAAQ,MAAM;GACd,gBAAgB,MAAM;EACxB;CACF;CAEA,IAAI,KAAK,iBACP,OAAO,QAAQ,gBAAgB,mCAAmC,IAAI,gBAAgB,KAAK,IAAI,GAAG;CAEpG,OAAO,EAAE,QAAQ,OAAO;AAC1B;;;;;;;;;AAUA,eAAsB,gBAAgB,SAMR;CAC5B,IAAI,CAAE,MAAM,mBAAmB,QAAQ,KAAK,QAAQ,sBAAsB,QAAQ,QAAQ,GACxF,OAAO,QAAQ,qBAAqB,qEAAqE;CAE3G,OAAO,oBAAoB,QAAQ,aAAa,QAAQ,KAAK,EAAE,KAAK,QAAQ,IAAI,CAAC;AACnF;AAMA,SAAS,qBAAqB,OAAoC;CAChE,MAAM,IAAI,OAAO,KAAK;CACtB,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,IAAI,cAAc,kCAAkC;CAC7E,MAAM,MAAM,EAAE,SAAS,EAAE;CACzB,MAAM,QAAQ,uBAAuB,UAAU,IAAI,SAAS,IAAI,IAAI,QAAQ,GAAG,CAAC;CAChF,IAAI,MAAM,SAAS,IAAI,MAAM,IAAI,cAAc,+CAA+C;CAC9F,OAAO;AACT;AAEA,SAAS,aAAa,KAAa,OAAiC,WAAW,OAAkB;CAC/F,OAAO,IAAI,UAAU;EACnB,QAAQ;EACR;EACA,WAAW,IAAI,YAAY,iBAAiB,aAAa,cAAc,KAAK,IAAI,KAAK;CACvF,CAAC;AACH;;;;;AAMA,SAAgB,WAAW,UAAgD;CACzE,IAAI,EAAE,SAAS,aAAa,SAAS,aACnC,MAAM,IAAI,cAAc,0CAA0C;CAEpE,MAAM,SAAS,uBAAuB,SAAS,iBAAiB;CAEhE,MAAM,aAA0B,CAAC;CACjC,MAAM,MAAM,uBAAuB,MAAM;CACzC,IAAI,KACF,WAAW,KACT,aACE,8BACA,WAAW,UAAU,IAAI,uBAAuB,EAAE,eAAe,IAAI,cAAc,GAAG,EAAE,CAAC,CAAC,CAC5F,CACF;CAEF,WAAW,KACT,aACE,iBACA,IAAI,OAAO,QAAQ,EAAE,UAAU,cAAc,qBAAqB,SAAS,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAClG,CACF;CACA,MAAM,MAAM,SAAS;CACrB,IAAI,KACF,WAAW,KACT,aACE,gCACA,WAAW,UACT,IAAI,yBAAyB;EAC3B,mBAAmB,IAAI,uBAAuB,SAC1C,IAAI,sBAAsB,EACxB,UAAU,IAAI,sBAAsB,KAAK,QAAQ,IAAI,YAAY,EAAE,2BAA2B,IAAI,CAAC,CAAC,EACtG,CAAC,IACD,KAAA;EACJ,uBAAuB,IAAI,yBAAyB;EACpD,qBAAqB,IAAI,uBAAuB;CAClD,CAAC,CACH,GACA,IACF,CACF;CAEF,KAAK,MAAM,UAAU,SAAS,cAAc,CAAC,GAAG,WAAW,KAAK,eAAe,MAAM,CAAC;CAEtF,MAAM,WAAW,SAAS,uBAAuB,CAAC,EAAA,CAAG,KAAK,UAAU;EAClE,MAAM,kBAA+B,CAAC;EACtC,IAAI,MAAM,UAAU,MAAM,WAAW,eACnC,gBAAgB,KACd,aAAa,kBAAkB,IAAI,OAAO,WAAW,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CACpG;EAEF,IAAI,MAAM,gBACR,gBAAgB,KACd,aAAa,sBAAsB,WAAW,UAAU,IAAI,eAAe,MAAM,cAAc,CAAC,CAAC,CACnG;EAEF,OAAO,IAAIC,mBAAsB;GAC/B,iBAAiB,eAAe,MAAM,YAAY;GAClD,gBAAgB,IAAI,KAAK,MAAM,cAAc;GAC7C,oBAAoB,gBAAgB,SAAS,IAAI,kBAAkB,KAAA;EACrE,CAAC;CACH,CAAC;CAED,MAAM,MAAM,IAAI,YAAY;EAC1B,SAAS,QAAQ;EACjB,WAAW,6BAA6B,SAAS,kBAAkB;EACnE,QAAQ,OAAO,eAAe;EAC9B,YAAY,IAAI,KAAK,SAAS,UAAU;EACxC,YAAY,IAAI,KAAK,SAAS,UAAU;EACxC,qBAAqB,QAAQ,SAAS,IAAI,UAAU,KAAA;EACpD,eAAe;CACjB,CAAC;CAED,OAAO;EACL,KAAK,IAAI,WAAW,WAAW,UAAU,GAAG,CAAC;EAC7C,oBAAoB,SAAS;EAC7B,iBAAiB,kBAAkB,OAAO,eAAe,oBAAoB;CAC/E;AACF;;AAGA,SAAgB,YACd,UACA,WACA,mBACK;CACL,OAAO,SAAS,wBAAwB,UAAU,WAAW,iBAAiB,CAAC;AACjF;;;;;AAMA,eAAsB,UAAU,UAAmD;CACjF,MAAM,WAAW,WAAW,QAAQ;CACpC,OAAO,YAAY,UAAU,MAAM,SAAS,OAAO,SAAS,GAAG,GAAG,SAAS,iBAAiB;AAC9F"}

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "@owf/x509",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.0",
+  "description": "Environment agnostic X.509 certificate and CRL parsing, creation and verification with pluggable crypto",
+  "files": [
+    "dist"
+  ],
+  "license": "Apache-2.0",
+  "exports": "./src/index.ts",
+  "homepage": "https://github.com/openwallet-foundation-labs/identity-common-ts/tree/main/packages/x509",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/openwallet-foundation-labs/identity-common-ts",
+    "directory": "packages/x509"
+  },
+  "publishConfig": {
+    "access": "public",
+    "main": "./dist/index.cjs",
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.mts",
+    "exports": {
+      ".": {
+        "types": "./dist/index.d.mts",
+        "import": "./dist/index.mjs",
+        "require": "./dist/index.cjs",
+        "default": "./dist/index.mjs"
+      },
+      "./package.json": "./package.json"
+    }
+  },
+  "scripts": {
+    "build": "tsdown src/index.ts --format esm,cjs --dts --sourcemap"
+  },
+  "dependencies": {
+    "@owf/identity-common": "workspace:*",
+    "@peculiar/asn1-schema": "catalog:",
+    "@peculiar/asn1-x509": "catalog:",
+    "@peculiar/asn1-x509-qualified": "catalog:",
+    "@peculiar/asn1-x509-qualified-etsi": "catalog:",
+    "asn1js": "^3.0.10"
+  },
+  "keywords": [
+    "x509",
+    "certificate",
+    "crl",
+    "pkix",
+    "rfc5280",
+    "asn1",
+    "react-native"
+  ]
+}