edockit 0.2.4 → 0.4.0-dev.0

package/dist/identity-b3a70fc1.js

@@ -0,0 +1,897 @@
+/*!
+ * MIT License
+ * Copyright (c) 2025 Edgars Jēkabsons, ZenomyTech SIA
+ */
+import { X509Certificate } from '@peculiar/x509';
+import { p as fromBER, q as isConvertible, s as schemaStorage, r as isTypeOfArray, t as Constructed, e as AsnTypeTypes, S as Sequence, u as compareSchema, v as defaultConverter, w as Set, b as AsnPropTypes, x as asn1js, y as BaseBlock, z as isArrayEqual, D as Null, P as Primitive, F as BufferSourceConverter, H as fetchIssuerCertificate, m as arrayBufferToPEM, I as fetchOCSP, C as Certificate, J as hexToArrayBuffer, L as CertID, g as AlgorithmIdentifier, O as OctetString, R as Request, M as TBSRequest, Q as OCSPRequest, U as OCSPResponse, V as OCSPResponseStatus, W as BasicOCSPResponse, X as normalizeDistinguishedName, n as arrayBufferToHex, Y as normalizeKeyIdentifier } from './normalize-70da6516.js';
+
+class AsnSchemaValidationError extends Error {
+    constructor() {
+        super(...arguments);
+        this.schemas = [];
+    }
+}
+
+class AsnParser {
+    static parse(data, target) {
+        const asn1Parsed = fromBER(data);
+        if (asn1Parsed.result.error) {
+            throw new Error(asn1Parsed.result.error);
+        }
+        const res = this.fromASN(asn1Parsed.result, target);
+        return res;
+    }
+    static fromASN(asn1Schema, target) {
+        try {
+            if (isConvertible(target)) {
+                const value = new target();
+                return value.fromASN(asn1Schema);
+            }
+            const schema = schemaStorage.get(target);
+            schemaStorage.cache(target);
+            let targetSchema = schema.schema;
+            const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema);
+            if (choiceResult === null || choiceResult === void 0 ? void 0 : choiceResult.result) {
+                return choiceResult.result;
+            }
+            if (choiceResult === null || choiceResult === void 0 ? void 0 : choiceResult.targetSchema) {
+                targetSchema = choiceResult.targetSchema;
+            }
+            const sequenceResult = this.handleSequenceTypes(asn1Schema, schema, target, targetSchema);
+            const res = new target();
+            if (isTypeOfArray(target)) {
+                return this.handleArrayTypes(asn1Schema, schema, target);
+            }
+            this.processSchemaItems(schema, sequenceResult, res);
+            return res;
+        }
+        catch (error) {
+            if (error instanceof AsnSchemaValidationError) {
+                error.schemas.push(target.name);
+            }
+            throw error;
+        }
+    }
+    static handleChoiceTypes(asn1Schema, schema, target, targetSchema) {
+        if (asn1Schema.constructor === Constructed &&
+            schema.type === AsnTypeTypes.Choice &&
+            asn1Schema.idBlock.tagClass === 3) {
+            for (const key in schema.items) {
+                const schemaItem = schema.items[key];
+                if (schemaItem.context === asn1Schema.idBlock.tagNumber && schemaItem.implicit) {
+                    if (typeof schemaItem.type === "function" &&
+                        schemaStorage.has(schemaItem.type)) {
+                        const fieldSchema = schemaStorage.get(schemaItem.type);
+                        if (fieldSchema && fieldSchema.type === AsnTypeTypes.Sequence) {
+                            const newSeq = new Sequence();
+                            if ("value" in asn1Schema.valueBlock &&
+                                Array.isArray(asn1Schema.valueBlock.value) &&
+                                "value" in newSeq.valueBlock) {
+                                newSeq.valueBlock.value = asn1Schema.valueBlock.value;
+                                const fieldValue = this.fromASN(newSeq, schemaItem.type);
+                                const res = new target();
+                                res[key] = fieldValue;
+                                return { result: res };
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        else if (asn1Schema.constructor === Constructed &&
+            schema.type !== AsnTypeTypes.Choice) {
+            const newTargetSchema = new Constructed({
+                idBlock: {
+                    tagClass: 3,
+                    tagNumber: asn1Schema.idBlock.tagNumber,
+                },
+                value: schema.schema.valueBlock.value,
+            });
+            for (const key in schema.items) {
+                delete asn1Schema[key];
+            }
+            return { targetSchema: newTargetSchema };
+        }
+        return null;
+    }
+    static handleSequenceTypes(asn1Schema, schema, target, targetSchema) {
+        if (schema.type === AsnTypeTypes.Sequence) {
+            const asn1ComparedSchema = compareSchema({}, asn1Schema, targetSchema);
+            if (!asn1ComparedSchema.verified) {
+                throw new AsnSchemaValidationError(`Data does not match to ${target.name} ASN1 schema.${asn1ComparedSchema.result.error ? ` ${asn1ComparedSchema.result.error}` : ""}`);
+            }
+            return asn1ComparedSchema;
+        }
+        else {
+            const asn1ComparedSchema = compareSchema({}, asn1Schema, targetSchema);
+            if (!asn1ComparedSchema.verified) {
+                throw new AsnSchemaValidationError(`Data does not match to ${target.name} ASN1 schema.${asn1ComparedSchema.result.error ? ` ${asn1ComparedSchema.result.error}` : ""}`);
+            }
+            return asn1ComparedSchema;
+        }
+    }
+    static processRepeatedField(asn1Elements, asn1Index, schemaItem) {
+        let elementsToProcess = asn1Elements.slice(asn1Index);
+        if (elementsToProcess.length === 1 && elementsToProcess[0].constructor.name === "Sequence") {
+            const seq = elementsToProcess[0];
+            if (seq.valueBlock && seq.valueBlock.value && Array.isArray(seq.valueBlock.value)) {
+                elementsToProcess = seq.valueBlock.value;
+            }
+        }
+        if (typeof schemaItem.type === "number") {
+            const converter = defaultConverter(schemaItem.type);
+            if (!converter)
+                throw new Error(`No converter for ASN.1 type ${schemaItem.type}`);
+            return elementsToProcess
+                .filter((el) => el && el.valueBlock)
+                .map((el) => {
+                try {
+                    return converter.fromASN(el);
+                }
+                catch {
+                    return undefined;
+                }
+            })
+                .filter((v) => v !== undefined);
+        }
+        else {
+            return elementsToProcess
+                .filter((el) => el && el.valueBlock)
+                .map((el) => {
+                try {
+                    return this.fromASN(el, schemaItem.type);
+                }
+                catch {
+                    return undefined;
+                }
+            })
+                .filter((v) => v !== undefined);
+        }
+    }
+    static processPrimitiveField(asn1Element, schemaItem) {
+        const converter = defaultConverter(schemaItem.type);
+        if (!converter)
+            throw new Error(`No converter for ASN.1 type ${schemaItem.type}`);
+        return converter.fromASN(asn1Element);
+    }
+    static isOptionalChoiceField(schemaItem) {
+        return (schemaItem.optional &&
+            typeof schemaItem.type === "function" &&
+            schemaStorage.has(schemaItem.type) &&
+            schemaStorage.get(schemaItem.type).type === AsnTypeTypes.Choice);
+    }
+    static processOptionalChoiceField(asn1Element, schemaItem) {
+        try {
+            const value = this.fromASN(asn1Element, schemaItem.type);
+            return { processed: true, value };
+        }
+        catch (err) {
+            if (err instanceof AsnSchemaValidationError &&
+                /Wrong values for Choice type/.test(err.message)) {
+                return { processed: false };
+            }
+            throw err;
+        }
+    }
+    static handleArrayTypes(asn1Schema, schema, target) {
+        if (!("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value))) {
+            throw new Error(`Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.`);
+        }
+        const itemType = schema.itemType;
+        if (typeof itemType === "number") {
+            const converter = defaultConverter(itemType);
+            if (!converter) {
+                throw new Error(`Cannot get default converter for array item of ${target.name} ASN1 schema`);
+            }
+            return target.from(asn1Schema.valueBlock.value, (element) => converter.fromASN(element));
+        }
+        else {
+            return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType));
+        }
+    }
+    static processSchemaItems(schema, asn1ComparedSchema, res) {
+        for (const key in schema.items) {
+            const asn1SchemaValue = asn1ComparedSchema.result[key];
+            if (!asn1SchemaValue) {
+                continue;
+            }
+            const schemaItem = schema.items[key];
+            const schemaItemType = schemaItem.type;
+            let parsedValue;
+            if (typeof schemaItemType === "number" || isConvertible(schemaItemType)) {
+                parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            }
+            else {
+                parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            }
+            if (parsedValue &&
+                typeof parsedValue === "object" &&
+                "value" in parsedValue &&
+                "raw" in parsedValue) {
+                res[key] = parsedValue.value;
+                res[`${key}Raw`] = parsedValue.raw;
+            }
+            else {
+                res[key] = parsedValue;
+            }
+        }
+    }
+    static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+        var _a;
+        const converter = (_a = schemaItem.converter) !== null && _a !== void 0 ? _a : (isConvertible(schemaItemType)
+            ? new schemaItemType()
+            : null);
+        if (!converter) {
+            throw new Error("Converter is empty");
+        }
+        if (schemaItem.repeated) {
+            return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter);
+        }
+        else {
+            return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter);
+        }
+    }
+    static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter) {
+        if (schemaItem.implicit) {
+            const Container = schemaItem.repeated === "sequence" ? Sequence : Set;
+            const newItem = new Container();
+            newItem.valueBlock = asn1SchemaValue.valueBlock;
+            const newItemAsn = fromBER(newItem.toBER(false));
+            if (newItemAsn.offset === -1) {
+                throw new Error(`Cannot parse the child item. ${newItemAsn.result.error}`);
+            }
+            if (!("value" in newItemAsn.result.valueBlock &&
+                Array.isArray(newItemAsn.result.valueBlock.value))) {
+                throw new Error("Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.");
+            }
+            const value = newItemAsn.result.valueBlock.value;
+            return Array.from(value, (element) => converter.fromASN(element));
+        }
+        else {
+            return Array.from(asn1SchemaValue, (element) => converter.fromASN(element));
+        }
+    }
+    static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter) {
+        let value = asn1SchemaValue;
+        if (schemaItem.implicit) {
+            let newItem;
+            if (isConvertible(schemaItemType)) {
+                newItem = new schemaItemType().toSchema("");
+            }
+            else {
+                const Asn1TypeName = AsnPropTypes[schemaItemType];
+                const Asn1Type = asn1js[Asn1TypeName];
+                if (!Asn1Type) {
+                    throw new Error(`Cannot get '${Asn1TypeName}' class from asn1js module`);
+                }
+                newItem = new Asn1Type();
+            }
+            newItem.valueBlock = value.valueBlock;
+            value = fromBER(newItem.toBER(false)).result;
+        }
+        return converter.fromASN(value);
+    }
+    static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+        if (schemaItem.repeated) {
+            if (!Array.isArray(asn1SchemaValue)) {
+                throw new Error("Cannot get list of items from the ASN.1 parsed value. ASN.1 value should be iterable.");
+            }
+            return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType));
+        }
+        else {
+            const valueToProcess = this.handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType);
+            if (this.isOptionalChoiceField(schemaItem)) {
+                try {
+                    return this.fromASN(valueToProcess, schemaItemType);
+                }
+                catch (err) {
+                    if (err instanceof AsnSchemaValidationError &&
+                        /Wrong values for Choice type/.test(err.message)) {
+                        return undefined;
+                    }
+                    throw err;
+                }
+            }
+            else {
+                const parsedValue = this.fromASN(valueToProcess, schemaItemType);
+                if (schemaItem.raw) {
+                    return {
+                        value: parsedValue,
+                        raw: asn1SchemaValue.valueBeforeDecodeView,
+                    };
+                }
+                return parsedValue;
+            }
+        }
+    }
+    static handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType) {
+        if (schemaItem.implicit && typeof schemaItem.context === "number") {
+            const schema = schemaStorage.get(schemaItemType);
+            if (schema.type === AsnTypeTypes.Sequence) {
+                const newSeq = new Sequence();
+                if ("value" in asn1SchemaValue.valueBlock &&
+                    Array.isArray(asn1SchemaValue.valueBlock.value) &&
+                    "value" in newSeq.valueBlock) {
+                    newSeq.valueBlock.value = asn1SchemaValue.valueBlock.value;
+                    return newSeq;
+                }
+            }
+            else if (schema.type === AsnTypeTypes.Set) {
+                const newSet = new Set();
+                if ("value" in asn1SchemaValue.valueBlock &&
+                    Array.isArray(asn1SchemaValue.valueBlock.value) &&
+                    "value" in newSet.valueBlock) {
+                    newSet.valueBlock.value = asn1SchemaValue.valueBlock.value;
+                    return newSet;
+                }
+            }
+        }
+        return asn1SchemaValue;
+    }
+}
+
+class AsnSerializer {
+    static serialize(obj) {
+        if (obj instanceof BaseBlock) {
+            return obj.toBER(false);
+        }
+        return this.toASN(obj).toBER(false);
+    }
+    static toASN(obj) {
+        if (obj && typeof obj === "object" && isConvertible(obj)) {
+            return obj.toASN();
+        }
+        if (!(obj && typeof obj === "object")) {
+            throw new TypeError("Parameter 1 should be type of Object.");
+        }
+        const target = obj.constructor;
+        const schema = schemaStorage.get(target);
+        schemaStorage.cache(target);
+        let asn1Value = [];
+        if (schema.itemType) {
+            if (!Array.isArray(obj)) {
+                throw new TypeError("Parameter 1 should be type of Array.");
+            }
+            if (typeof schema.itemType === "number") {
+                const converter = defaultConverter(schema.itemType);
+                if (!converter) {
+                    throw new Error(`Cannot get default converter for array item of ${target.name} ASN1 schema`);
+                }
+                asn1Value = obj.map((o) => converter.toASN(o));
+            }
+            else {
+                asn1Value = obj.map((o) => this.toAsnItem({ type: schema.itemType }, "[]", target, o));
+            }
+        }
+        else {
+            for (const key in schema.items) {
+                const schemaItem = schema.items[key];
+                const objProp = obj[key];
+                if (objProp === undefined ||
+                    schemaItem.defaultValue === objProp ||
+                    (typeof schemaItem.defaultValue === "object" &&
+                        typeof objProp === "object" &&
+                        isArrayEqual(this.serialize(schemaItem.defaultValue), this.serialize(objProp)))) {
+                    continue;
+                }
+                const asn1Item = AsnSerializer.toAsnItem(schemaItem, key, target, objProp);
+                if (typeof schemaItem.context === "number") {
+                    if (schemaItem.implicit) {
+                        if (!schemaItem.repeated &&
+                            (typeof schemaItem.type === "number" || isConvertible(schemaItem.type))) {
+                            const value = {};
+                            value.valueHex =
+                                asn1Item instanceof Null
+                                    ? asn1Item.valueBeforeDecodeView
+                                    : asn1Item.valueBlock.toBER();
+                            asn1Value.push(new Primitive({
+                                optional: schemaItem.optional,
+                                idBlock: {
+                                    tagClass: 3,
+                                    tagNumber: schemaItem.context,
+                                },
+                                ...value,
+                            }));
+                        }
+                        else {
+                            asn1Value.push(new Constructed({
+                                optional: schemaItem.optional,
+                                idBlock: {
+                                    tagClass: 3,
+                                    tagNumber: schemaItem.context,
+                                },
+                                value: asn1Item.valueBlock.value,
+                            }));
+                        }
+                    }
+                    else {
+                        asn1Value.push(new Constructed({
+                            optional: schemaItem.optional,
+                            idBlock: {
+                                tagClass: 3,
+                                tagNumber: schemaItem.context,
+                            },
+                            value: [asn1Item],
+                        }));
+                    }
+                }
+                else if (schemaItem.repeated) {
+                    asn1Value = asn1Value.concat(asn1Item);
+                }
+                else {
+                    asn1Value.push(asn1Item);
+                }
+            }
+        }
+        let asnSchema;
+        switch (schema.type) {
+            case AsnTypeTypes.Sequence:
+                asnSchema = new Sequence({ value: asn1Value });
+                break;
+            case AsnTypeTypes.Set:
+                asnSchema = new Set({ value: asn1Value });
+                break;
+            case AsnTypeTypes.Choice:
+                if (!asn1Value[0]) {
+                    throw new Error(`Schema '${target.name}' has wrong data. Choice cannot be empty.`);
+                }
+                asnSchema = asn1Value[0];
+                break;
+        }
+        return asnSchema;
+    }
+    static toAsnItem(schemaItem, key, target, objProp) {
+        let asn1Item;
+        if (typeof schemaItem.type === "number") {
+            const converter = schemaItem.converter;
+            if (!converter) {
+                throw new Error(`Property '${key}' doesn't have converter for type ${AsnPropTypes[schemaItem.type]} in schema '${target.name}'`);
+            }
+            if (schemaItem.repeated) {
+                if (!Array.isArray(objProp)) {
+                    throw new TypeError("Parameter 'objProp' should be type of Array.");
+                }
+                const items = Array.from(objProp, (element) => converter.toASN(element));
+                const Container = schemaItem.repeated === "sequence" ? Sequence : Set;
+                asn1Item = new Container({
+                    value: items,
+                });
+            }
+            else {
+                asn1Item = converter.toASN(objProp);
+            }
+        }
+        else {
+            if (schemaItem.repeated) {
+                if (!Array.isArray(objProp)) {
+                    throw new TypeError("Parameter 'objProp' should be type of Array.");
+                }
+                const items = Array.from(objProp, (element) => this.toASN(element));
+                const Container = schemaItem.repeated === "sequence" ? Sequence : Set;
+                asn1Item = new Container({
+                    value: items,
+                });
+            }
+            else {
+                asn1Item = this.toASN(objProp);
+            }
+        }
+        return asn1Item;
+    }
+}
+
+class AsnConvert {
+    static serialize(obj) {
+        return AsnSerializer.serialize(obj);
+    }
+    static parse(data, target) {
+        return AsnParser.parse(data, target);
+    }
+    static toString(data) {
+        const buf = BufferSourceConverter.isBufferSource(data)
+            ? BufferSourceConverter.toArrayBuffer(data)
+            : AsnConvert.serialize(data);
+        const asn = fromBER(buf);
+        if (asn.offset === -1) {
+            throw new Error(`Cannot decode ASN.1 data. ${asn.result.error}`);
+        }
+        return asn.result.toString();
+    }
+}
+
+// src/core/revocation/ocsp.ts
+/**
+ * OID for Authority Information Access extension
+ */
+const id_pe_authorityInfoAccess = "1.3.6.1.5.5.7.1.1";
+/**
+ * SHA-1 algorithm identifier for OCSP
+ */
+const SHA1_OID = "1.3.14.3.2.26";
+/**
+ * Compute SHA-1 hash of data (cross-platform)
+ */
+async function computeSHA1(data) {
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+        return crypto.subtle.digest("SHA-1", data);
+    }
+    // Node.js fallback
+    const nodeCrypto = require("crypto");
+    const hash = nodeCrypto.createHash("sha1");
+    hash.update(Buffer.from(data));
+    return hash.digest().buffer;
+}
+/**
+ * Extract OCSP responder URLs from certificate
+ * @param cert X509Certificate to extract OCSP URLs from
+ * @returns Array of OCSP responder URLs
+ */
+function extractOCSPUrls(cert) {
+    try {
+        const aiaExt = cert.getExtension(id_pe_authorityInfoAccess);
+        if (!aiaExt) {
+            return [];
+        }
+        // Get OCSP URLs from the extension
+        return aiaExt.ocsp.filter((gn) => gn.type === "url").map((gn) => gn.value);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Extract CA Issuers URLs from certificate (for fetching issuer cert)
+ * @param cert X509Certificate to extract URLs from
+ * @returns Array of CA Issuers URLs
+ */
+function extractCAIssuersUrls(cert) {
+    try {
+        const aiaExt = cert.getExtension(id_pe_authorityInfoAccess);
+        if (!aiaExt) {
+            return [];
+        }
+        return aiaExt.caIssuers.filter((gn) => gn.type === "url").map((gn) => gn.value);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Find issuer certificate from certificate chain
+ * @param cert Certificate to find issuer for
+ * @param chain Array of PEM-formatted certificates
+ * @returns Issuer certificate or null if not found
+ */
+function findIssuerInChain(cert, chain) {
+    const issuerName = cert.issuer;
+    for (const pemCert of chain) {
+        try {
+            const chainCert = new X509Certificate(pemCert);
+            // Check if this cert's subject matches our cert's issuer
+            if (chainCert.subject === issuerName) {
+                return chainCert;
+            }
+        }
+        catch {
+            // Skip invalid certificates
+        }
+    }
+    return null;
+}
+/**
+ * Fetch issuer certificate from AIA extension
+ * @param cert Certificate to fetch issuer for
+ * @param timeout Timeout in ms
+ * @param proxyUrl Optional CORS proxy URL
+ * @returns Issuer certificate or null
+ */
+async function fetchIssuerFromAIA(cert, timeout = 5000, proxyUrl) {
+    const urls = extractCAIssuersUrls(cert);
+    for (const url of urls) {
+        try {
+            const result = await fetchIssuerCertificate(url, timeout, proxyUrl);
+            if (result.ok && result.data) {
+                // Try to parse as DER first, then PEM
+                try {
+                    return new X509Certificate(result.data);
+                }
+                catch {
+                    // Try converting to PEM
+                    const pem = arrayBufferToPEM(result.data);
+                    return new X509Certificate(pem);
+                }
+            }
+        }
+        catch {
+            // Try next URL
+        }
+    }
+    return null;
+}
+/**
+ * Build OCSP request for a certificate
+ * @param cert Certificate to check
+ * @param issuerCert Issuer certificate
+ * @returns DER-encoded OCSP request
+ */
+async function buildOCSPRequest(cert, issuerCert) {
+    // Get issuer name hash (SHA-1 of issuer's DN in DER)
+    // Parse the raw certificate to get the proper ASN.1 structures for serialization
+    const issuerCertAsn = AsnParser.parse(issuerCert.rawData, Certificate);
+    const issuerNameDer = AsnConvert.serialize(issuerCertAsn.tbsCertificate.subject);
+    const issuerNameHash = await computeSHA1(issuerNameDer);
+    // Get issuer key hash (SHA-1 of issuer's public key BIT STRING value, not the full SPKI)
+    const issuerKeyHash = await computeSHA1(issuerCertAsn.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey);
+    // Get certificate serial number
+    const serialNumber = hexToArrayBuffer(cert.serialNumber);
+    // Build CertID
+    const certId = new CertID({
+        hashAlgorithm: new AlgorithmIdentifier({ algorithm: SHA1_OID }),
+        issuerNameHash: new OctetString(issuerNameHash),
+        issuerKeyHash: new OctetString(issuerKeyHash),
+        serialNumber: serialNumber,
+    });
+    // Build request
+    const request = new Request({ reqCert: certId });
+    // Build TBS request
+    const tbsRequest = new TBSRequest({
+        requestList: [request],
+    });
+    // Build OCSP request
+    const ocspRequest = new OCSPRequest({ tbsRequest });
+    return AsnConvert.serialize(ocspRequest);
+}
+/**
+ * Parse OCSP response and extract revocation status
+ * @param responseData DER-encoded OCSP response
+ * @returns Revocation result
+ */
+function parseOCSPResponse(responseData) {
+    const now = new Date();
+    try {
+        const response = AsnConvert.parse(responseData, OCSPResponse);
+        // Check response status
+        switch (response.responseStatus) {
+            case OCSPResponseStatus.successful:
+                break;
+            case OCSPResponseStatus.malformedRequest:
+                return {
+                    isValid: false,
+                    status: "error",
+                    method: "ocsp",
+                    reason: "OCSP responder returned: malformed request",
+                    checkedAt: now,
+                };
+            case OCSPResponseStatus.internalError:
+                return {
+                    isValid: false,
+                    status: "error",
+                    method: "ocsp",
+                    reason: "OCSP responder returned: internal error",
+                    checkedAt: now,
+                };
+            case OCSPResponseStatus.tryLater:
+                return {
+                    isValid: false,
+                    status: "unknown",
+                    method: "ocsp",
+                    reason: "OCSP responder returned: try later",
+                    checkedAt: now,
+                };
+            case OCSPResponseStatus.sigRequired:
+                return {
+                    isValid: false,
+                    status: "error",
+                    method: "ocsp",
+                    reason: "OCSP responder requires signature",
+                    checkedAt: now,
+                };
+            case OCSPResponseStatus.unauthorized:
+                return {
+                    isValid: false,
+                    status: "error",
+                    method: "ocsp",
+                    reason: "OCSP responder returned: unauthorized",
+                    checkedAt: now,
+                };
+            default:
+                return {
+                    isValid: false,
+                    status: "error",
+                    method: "ocsp",
+                    reason: `OCSP responder returned unknown status: ${response.responseStatus}`,
+                    checkedAt: now,
+                };
+        }
+        // Parse response bytes
+        if (!response.responseBytes) {
+            return {
+                isValid: false,
+                status: "error",
+                method: "ocsp",
+                reason: "OCSP response has no response bytes",
+                checkedAt: now,
+            };
+        }
+        // Parse BasicOCSPResponse
+        const basicResponse = AsnConvert.parse(response.responseBytes.response.buffer, BasicOCSPResponse);
+        // Get the first single response
+        const responses = basicResponse.tbsResponseData.responses;
+        if (!responses || responses.length === 0) {
+            return {
+                isValid: false,
+                status: "error",
+                method: "ocsp",
+                reason: "OCSP response contains no certificate status",
+                checkedAt: now,
+            };
+        }
+        const singleResponse = responses[0];
+        const certStatus = singleResponse.certStatus;
+        // Check certificate status
+        if (certStatus.good !== undefined) {
+            return {
+                isValid: true,
+                status: "good",
+                method: "ocsp",
+                checkedAt: now,
+            };
+        }
+        else if (certStatus.revoked) {
+            return {
+                isValid: false,
+                status: "revoked",
+                method: "ocsp",
+                reason: certStatus.revoked.revocationReason !== undefined
+                    ? `Certificate revoked (reason: ${certStatus.revoked.revocationReason})`
+                    : "Certificate revoked",
+                revokedAt: certStatus.revoked.revocationTime,
+                checkedAt: now,
+            };
+        }
+        else if (certStatus.unknown !== undefined) {
+            return {
+                isValid: false,
+                status: "unknown",
+                method: "ocsp",
+                reason: "OCSP responder does not know about this certificate",
+                checkedAt: now,
+            };
+        }
+        return {
+            isValid: false,
+            status: "error",
+            method: "ocsp",
+            reason: "Unexpected certificate status in OCSP response",
+            checkedAt: now,
+        };
+    }
+    catch (error) {
+        return {
+            isValid: false,
+            status: "error",
+            method: "ocsp",
+            reason: `Failed to parse OCSP response: ${error instanceof Error ? error.message : String(error)}`,
+            checkedAt: now,
+        };
+    }
+}
+/**
+ * Check certificate revocation via OCSP
+ * @param cert Certificate to check
+ * @param issuerCert Issuer certificate (optional, will try to find/fetch)
+ * @param options OCSP check options
+ * @returns Revocation result
+ */
+async function checkOCSP(cert, issuerCert, options = {}) {
+    const { timeout = 5000, certificateChain = [], proxyUrl } = options;
+    const now = new Date();
+    // Get OCSP URLs
+    const ocspUrls = extractOCSPUrls(cert);
+    if (ocspUrls.length === 0) {
+        return {
+            isValid: false,
+            status: "unknown",
+            method: "ocsp",
+            reason: "Certificate has no OCSP responder URL",
+            checkedAt: now,
+        };
+    }
+    // Try to find issuer certificate
+    let issuer = issuerCert;
+    if (!issuer) {
+        // Try certificate chain first
+        issuer = findIssuerInChain(cert, certificateChain);
+    }
+    if (!issuer) {
+        // Try AIA extension
+        issuer = await fetchIssuerFromAIA(cert, timeout, proxyUrl);
+    }
+    if (!issuer) {
+        return {
+            isValid: false,
+            status: "unknown",
+            method: "ocsp",
+            reason: "Could not find or fetch issuer certificate for OCSP",
+            checkedAt: now,
+        };
+    }
+    // Build OCSP request
+    let request;
+    try {
+        request = await buildOCSPRequest(cert, issuer);
+    }
+    catch (error) {
+        return {
+            isValid: false,
+            status: "error",
+            method: "ocsp",
+            reason: `Failed to build OCSP request: ${error instanceof Error ? error.message : String(error)}`,
+            checkedAt: now,
+        };
+    }
+    // Try each OCSP URL
+    for (const url of ocspUrls) {
+        try {
+            const result = await fetchOCSP(url, request, timeout, proxyUrl);
+            if (result.ok && result.data) {
+                return parseOCSPResponse(result.data);
+            }
+        }
+        catch {
+            // Try next URL
+        }
+    }
+    return {
+        isValid: false,
+        status: "error",
+        method: "ocsp",
+        reason: "All OCSP requests failed",
+        checkedAt: now,
+    };
+}
+
+const AUTHORITY_KEY_IDENTIFIER_OID = "2.5.29.35";
+const SUBJECT_KEY_IDENTIFIER_OID = "2.5.29.14";
+async function computeSha256Hex(input) {
+    const digest = await crypto.subtle.digest("SHA-256", input);
+    return arrayBufferToHex(digest);
+}
+function getAuthorityKeyIdentifierHex(certificate) {
+    const authorityKeyIdentifier = certificate.getExtension(AUTHORITY_KEY_IDENTIFIER_OID);
+    return normalizeKeyIdentifier(authorityKeyIdentifier?.keyId);
+}
+function getSubjectKeyIdentifierHex(certificate) {
+    const subjectKeyIdentifier = certificate.getExtension(SUBJECT_KEY_IDENTIFIER_OID);
+    return normalizeKeyIdentifier(subjectKeyIdentifier?.keyId);
+}
+async function extractIssuerIdentityFromCertificate(certificatePem, options = {}) {
+    const signerCertificate = new X509Certificate(certificatePem);
+    let issuerCertificate = options.certificateChain && options.certificateChain.length > 0
+        ? findIssuerInChain(signerCertificate, options.certificateChain)
+        : null;
+    if (!issuerCertificate && options.fetchOptions) {
+        issuerCertificate = await fetchIssuerFromAIA(signerCertificate, options.fetchOptions.timeout, options.fetchOptions.proxyUrl);
+    }
+    return {
+        issuerSubjectDn: normalizeDistinguishedName(signerCertificate.issuer),
+        authorityKeyIdentifierHex: getAuthorityKeyIdentifierHex(signerCertificate),
+        issuerCertificate: issuerCertificate
+            ? {
+                subjectDn: normalizeDistinguishedName(issuerCertificate.subject),
+                spkiSha256Hex: await computeSha256Hex(issuerCertificate.publicKey.rawData),
+            }
+            : null,
+    };
+}
+async function extractCertificateIdentityFromCertificate(certificatePem) {
+    const certificate = new X509Certificate(certificatePem);
+    return {
+        subjectDn: normalizeDistinguishedName(certificate.subject),
+        subjectKeyIdentifierHex: getSubjectKeyIdentifierHex(certificate),
+        spkiSha256Hex: await computeSha256Hex(certificate.publicKey.rawData),
+    };
+}
+
+export { AsnConvert as A, extractCertificateIdentityFromCertificate as a, checkOCSP as c, extractIssuerIdentityFromCertificate as e };
+//# sourceMappingURL=identity-b3a70fc1.js.map