edockit 0.4.0-dev.0 → 0.4.0-dev.1

package/dist/identity-b3a70fc1.js

@@ -1,897 +0,0 @@
-/*!
- * MIT License
- * Copyright (c) 2025 Edgars Jēkabsons, ZenomyTech SIA
- */
-import { X509Certificate } from '@peculiar/x509';
-import { p as fromBER, q as isConvertible, s as schemaStorage, r as isTypeOfArray, t as Constructed, e as AsnTypeTypes, S as Sequence, u as compareSchema, v as defaultConverter, w as Set, b as AsnPropTypes, x as asn1js, y as BaseBlock, z as isArrayEqual, D as Null, P as Primitive, F as BufferSourceConverter, H as fetchIssuerCertificate, m as arrayBufferToPEM, I as fetchOCSP, C as Certificate, J as hexToArrayBuffer, L as CertID, g as AlgorithmIdentifier, O as OctetString, R as Request, M as TBSRequest, Q as OCSPRequest, U as OCSPResponse, V as OCSPResponseStatus, W as BasicOCSPResponse, X as normalizeDistinguishedName, n as arrayBufferToHex, Y as normalizeKeyIdentifier } from './normalize-70da6516.js';
-
-class AsnSchemaValidationError extends Error {
-    constructor() {
-        super(...arguments);
-        this.schemas = [];
-    }
-}
-
-class AsnParser {
-    static parse(data, target) {
-        const asn1Parsed = fromBER(data);
-        if (asn1Parsed.result.error) {
-            throw new Error(asn1Parsed.result.error);
-        }
-        const res = this.fromASN(asn1Parsed.result, target);
-        return res;
-    }
-    static fromASN(asn1Schema, target) {
-        try {
-            if (isConvertible(target)) {
-                const value = new target();
-                return value.fromASN(asn1Schema);
-            }
-            const schema = schemaStorage.get(target);
-            schemaStorage.cache(target);
-            let targetSchema = schema.schema;
-            const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema);
-            if (choiceResult === null || choiceResult === void 0 ? void 0 : choiceResult.result) {
-                return choiceResult.result;
-            }
-            if (choiceResult === null || choiceResult === void 0 ? void 0 : choiceResult.targetSchema) {
-                targetSchema = choiceResult.targetSchema;
-            }
-            const sequenceResult = this.handleSequenceTypes(asn1Schema, schema, target, targetSchema);
-            const res = new target();
-            if (isTypeOfArray(target)) {
-                return this.handleArrayTypes(asn1Schema, schema, target);
-            }
-            this.processSchemaItems(schema, sequenceResult, res);
-            return res;
-        }
-        catch (error) {
-            if (error instanceof AsnSchemaValidationError) {
-                error.schemas.push(target.name);
-            }
-            throw error;
-        }
-    }
-    static handleChoiceTypes(asn1Schema, schema, target, targetSchema) {
-        if (asn1Schema.constructor === Constructed &&
-            schema.type === AsnTypeTypes.Choice &&
-            asn1Schema.idBlock.tagClass === 3) {
-            for (const key in schema.items) {
-                const schemaItem = schema.items[key];
-                if (schemaItem.context === asn1Schema.idBlock.tagNumber && schemaItem.implicit) {
-                    if (typeof schemaItem.type === "function" &&
-                        schemaStorage.has(schemaItem.type)) {
-                        const fieldSchema = schemaStorage.get(schemaItem.type);
-                        if (fieldSchema && fieldSchema.type === AsnTypeTypes.Sequence) {
-                            const newSeq = new Sequence();
-                            if ("value" in asn1Schema.valueBlock &&
-                                Array.isArray(asn1Schema.valueBlock.value) &&
-                                "value" in newSeq.valueBlock) {
-                                newSeq.valueBlock.value = asn1Schema.valueBlock.value;
-                                const fieldValue = this.fromASN(newSeq, schemaItem.type);
-                                const res = new target();
-                                res[key] = fieldValue;
-                                return { result: res };
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        else if (asn1Schema.constructor === Constructed &&
-            schema.type !== AsnTypeTypes.Choice) {
-            const newTargetSchema = new Constructed({
-                idBlock: {
-                    tagClass: 3,
-                    tagNumber: asn1Schema.idBlock.tagNumber,
-                },
-                value: schema.schema.valueBlock.value,
-            });
-            for (const key in schema.items) {
-                delete asn1Schema[key];
-            }
-            return { targetSchema: newTargetSchema };
-        }
-        return null;
-    }
-    static handleSequenceTypes(asn1Schema, schema, target, targetSchema) {
-        if (schema.type === AsnTypeTypes.Sequence) {
-            const asn1ComparedSchema = compareSchema({}, asn1Schema, targetSchema);
-            if (!asn1ComparedSchema.verified) {
-                throw new AsnSchemaValidationError(`Data does not match to ${target.name} ASN1 schema.${asn1ComparedSchema.result.error ? ` ${asn1ComparedSchema.result.error}` : ""}`);
-            }
-            return asn1ComparedSchema;
-        }
-        else {
-            const asn1ComparedSchema = compareSchema({}, asn1Schema, targetSchema);
-            if (!asn1ComparedSchema.verified) {
-                throw new AsnSchemaValidationError(`Data does not match to ${target.name} ASN1 schema.${asn1ComparedSchema.result.error ? ` ${asn1ComparedSchema.result.error}` : ""}`);
-            }
-            return asn1ComparedSchema;
-        }
-    }
-    static processRepeatedField(asn1Elements, asn1Index, schemaItem) {
-        let elementsToProcess = asn1Elements.slice(asn1Index);
-        if (elementsToProcess.length === 1 && elementsToProcess[0].constructor.name === "Sequence") {
-            const seq = elementsToProcess[0];
-            if (seq.valueBlock && seq.valueBlock.value && Array.isArray(seq.valueBlock.value)) {
-                elementsToProcess = seq.valueBlock.value;
-            }
-        }
-        if (typeof schemaItem.type === "number") {
-            const converter = defaultConverter(schemaItem.type);
-            if (!converter)
-                throw new Error(`No converter for ASN.1 type ${schemaItem.type}`);
-            return elementsToProcess
-                .filter((el) => el && el.valueBlock)
-                .map((el) => {
-                try {
-                    return converter.fromASN(el);
-                }
-                catch {
-                    return undefined;
-                }
-            })
-                .filter((v) => v !== undefined);
-        }
-        else {
-            return elementsToProcess
-                .filter((el) => el && el.valueBlock)
-                .map((el) => {
-                try {
-                    return this.fromASN(el, schemaItem.type);
-                }
-                catch {
-                    return undefined;
-                }
-            })
-                .filter((v) => v !== undefined);
-        }
-    }
-    static processPrimitiveField(asn1Element, schemaItem) {
-        const converter = defaultConverter(schemaItem.type);
-        if (!converter)
-            throw new Error(`No converter for ASN.1 type ${schemaItem.type}`);
-        return converter.fromASN(asn1Element);
-    }
-    static isOptionalChoiceField(schemaItem) {
-        return (schemaItem.optional &&
-            typeof schemaItem.type === "function" &&
-            schemaStorage.has(schemaItem.type) &&
-            schemaStorage.get(schemaItem.type).type === AsnTypeTypes.Choice);
-    }
-    static processOptionalChoiceField(asn1Element, schemaItem) {
-        try {
-            const value = this.fromASN(asn1Element, schemaItem.type);
-            return { processed: true, value };
-        }
-        catch (err) {
-            if (err instanceof AsnSchemaValidationError &&
-                /Wrong values for Choice type/.test(err.message)) {
-                return { processed: false };
-            }
-            throw err;
-        }
-    }
-    static handleArrayTypes(asn1Schema, schema, target) {
-        if (!("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value))) {
-            throw new Error(`Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.`);
-        }
-        const itemType = schema.itemType;
-        if (typeof itemType === "number") {
-            const converter = defaultConverter(itemType);
-            if (!converter) {
-                throw new Error(`Cannot get default converter for array item of ${target.name} ASN1 schema`);
-            }
-            return target.from(asn1Schema.valueBlock.value, (element) => converter.fromASN(element));
-        }
-        else {
-            return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType));
-        }
-    }
-    static processSchemaItems(schema, asn1ComparedSchema, res) {
-        for (const key in schema.items) {
-            const asn1SchemaValue = asn1ComparedSchema.result[key];
-            if (!asn1SchemaValue) {
-                continue;
-            }
-            const schemaItem = schema.items[key];
-            const schemaItemType = schemaItem.type;
-            let parsedValue;
-            if (typeof schemaItemType === "number" || isConvertible(schemaItemType)) {
-                parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
-            }
-            else {
-                parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
-            }
-            if (parsedValue &&
-                typeof parsedValue === "object" &&
-                "value" in parsedValue &&
-                "raw" in parsedValue) {
-                res[key] = parsedValue.value;
-                res[`${key}Raw`] = parsedValue.raw;
-            }
-            else {
-                res[key] = parsedValue;
-            }
-        }
-    }
-    static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
-        var _a;
-        const converter = (_a = schemaItem.converter) !== null && _a !== void 0 ? _a : (isConvertible(schemaItemType)
-            ? new schemaItemType()
-            : null);
-        if (!converter) {
-            throw new Error("Converter is empty");
-        }
-        if (schemaItem.repeated) {
-            return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter);
-        }
-        else {
-            return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter);
-        }
-    }
-    static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter) {
-        if (schemaItem.implicit) {
-            const Container = schemaItem.repeated === "sequence" ? Sequence : Set;
-            const newItem = new Container();
-            newItem.valueBlock = asn1SchemaValue.valueBlock;
-            const newItemAsn = fromBER(newItem.toBER(false));
-            if (newItemAsn.offset === -1) {
-                throw new Error(`Cannot parse the child item. ${newItemAsn.result.error}`);
-            }
-            if (!("value" in newItemAsn.result.valueBlock &&
-                Array.isArray(newItemAsn.result.valueBlock.value))) {
-                throw new Error("Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.");
-            }
-            const value = newItemAsn.result.valueBlock.value;
-            return Array.from(value, (element) => converter.fromASN(element));
-        }
-        else {
-            return Array.from(asn1SchemaValue, (element) => converter.fromASN(element));
-        }
-    }
-    static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter) {
-        let value = asn1SchemaValue;
-        if (schemaItem.implicit) {
-            let newItem;
-            if (isConvertible(schemaItemType)) {
-                newItem = new schemaItemType().toSchema("");
-            }
-            else {
-                const Asn1TypeName = AsnPropTypes[schemaItemType];
-                const Asn1Type = asn1js[Asn1TypeName];
-                if (!Asn1Type) {
-                    throw new Error(`Cannot get '${Asn1TypeName}' class from asn1js module`);
-                }
-                newItem = new Asn1Type();
-            }
-            newItem.valueBlock = value.valueBlock;
-            value = fromBER(newItem.toBER(false)).result;
-        }
-        return converter.fromASN(value);
-    }
-    static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
-        if (schemaItem.repeated) {
-            if (!Array.isArray(asn1SchemaValue)) {
-                throw new Error("Cannot get list of items from the ASN.1 parsed value. ASN.1 value should be iterable.");
-            }
-            return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType));
-        }
-        else {
-            const valueToProcess = this.handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType);
-            if (this.isOptionalChoiceField(schemaItem)) {
-                try {
-                    return this.fromASN(valueToProcess, schemaItemType);
-                }
-                catch (err) {
-                    if (err instanceof AsnSchemaValidationError &&
-                        /Wrong values for Choice type/.test(err.message)) {
-                        return undefined;
-                    }
-                    throw err;
-                }
-            }
-            else {
-                const parsedValue = this.fromASN(valueToProcess, schemaItemType);
-                if (schemaItem.raw) {
-                    return {
-                        value: parsedValue,
-                        raw: asn1SchemaValue.valueBeforeDecodeView,
-                    };
-                }
-                return parsedValue;
-            }
-        }
-    }
-    static handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType) {
-        if (schemaItem.implicit && typeof schemaItem.context === "number") {
-            const schema = schemaStorage.get(schemaItemType);
-            if (schema.type === AsnTypeTypes.Sequence) {
-                const newSeq = new Sequence();
-                if ("value" in asn1SchemaValue.valueBlock &&
-                    Array.isArray(asn1SchemaValue.valueBlock.value) &&
-                    "value" in newSeq.valueBlock) {
-                    newSeq.valueBlock.value = asn1SchemaValue.valueBlock.value;
-                    return newSeq;
-                }
-            }
-            else if (schema.type === AsnTypeTypes.Set) {
-                const newSet = new Set();
-                if ("value" in asn1SchemaValue.valueBlock &&
-                    Array.isArray(asn1SchemaValue.valueBlock.value) &&
-                    "value" in newSet.valueBlock) {
-                    newSet.valueBlock.value = asn1SchemaValue.valueBlock.value;
-                    return newSet;
-                }
-            }
-        }
-        return asn1SchemaValue;
-    }
-}
-
-class AsnSerializer {
-    static serialize(obj) {
-        if (obj instanceof BaseBlock) {
-            return obj.toBER(false);
-        }
-        return this.toASN(obj).toBER(false);
-    }
-    static toASN(obj) {
-        if (obj && typeof obj === "object" && isConvertible(obj)) {
-            return obj.toASN();
-        }
-        if (!(obj && typeof obj === "object")) {
-            throw new TypeError("Parameter 1 should be type of Object.");
-        }
-        const target = obj.constructor;
-        const schema = schemaStorage.get(target);
-        schemaStorage.cache(target);
-        let asn1Value = [];
-        if (schema.itemType) {
-            if (!Array.isArray(obj)) {
-                throw new TypeError("Parameter 1 should be type of Array.");
-            }
-            if (typeof schema.itemType === "number") {
-                const converter = defaultConverter(schema.itemType);
-                if (!converter) {
-                    throw new Error(`Cannot get default converter for array item of ${target.name} ASN1 schema`);
-                }
-                asn1Value = obj.map((o) => converter.toASN(o));
-            }
-            else {
-                asn1Value = obj.map((o) => this.toAsnItem({ type: schema.itemType }, "[]", target, o));
-            }
-        }
-        else {
-            for (const key in schema.items) {
-                const schemaItem = schema.items[key];
-                const objProp = obj[key];
-                if (objProp === undefined ||
-                    schemaItem.defaultValue === objProp ||
-                    (typeof schemaItem.defaultValue === "object" &&
-                        typeof objProp === "object" &&
-                        isArrayEqual(this.serialize(schemaItem.defaultValue), this.serialize(objProp)))) {
-                    continue;
-                }
-                const asn1Item = AsnSerializer.toAsnItem(schemaItem, key, target, objProp);
-                if (typeof schemaItem.context === "number") {
-                    if (schemaItem.implicit) {
-                        if (!schemaItem.repeated &&
-                            (typeof schemaItem.type === "number" || isConvertible(schemaItem.type))) {
-                            const value = {};
-                            value.valueHex =
-                                asn1Item instanceof Null
-                                    ? asn1Item.valueBeforeDecodeView
-                                    : asn1Item.valueBlock.toBER();
-                            asn1Value.push(new Primitive({
-                                optional: schemaItem.optional,
-                                idBlock: {
-                                    tagClass: 3,
-                                    tagNumber: schemaItem.context,
-                                },
-                                ...value,
-                            }));
-                        }
-                        else {
-                            asn1Value.push(new Constructed({
-                                optional: schemaItem.optional,
-                                idBlock: {
-                                    tagClass: 3,
-                                    tagNumber: schemaItem.context,
-                                },
-                                value: asn1Item.valueBlock.value,
-                            }));
-                        }
-                    }
-                    else {
-                        asn1Value.push(new Constructed({
-                            optional: schemaItem.optional,
-                            idBlock: {
-                                tagClass: 3,
-                                tagNumber: schemaItem.context,
-                            },
-                            value: [asn1Item],
-                        }));
-                    }
-                }
-                else if (schemaItem.repeated) {
-                    asn1Value = asn1Value.concat(asn1Item);
-                }
-                else {
-                    asn1Value.push(asn1Item);
-                }
-            }
-        }
-        let asnSchema;
-        switch (schema.type) {
-            case AsnTypeTypes.Sequence:
-                asnSchema = new Sequence({ value: asn1Value });
-                break;
-            case AsnTypeTypes.Set:
-                asnSchema = new Set({ value: asn1Value });
-                break;
-            case AsnTypeTypes.Choice:
-                if (!asn1Value[0]) {
-                    throw new Error(`Schema '${target.name}' has wrong data. Choice cannot be empty.`);
-                }
-                asnSchema = asn1Value[0];
-                break;
-        }
-        return asnSchema;
-    }
-    static toAsnItem(schemaItem, key, target, objProp) {
-        let asn1Item;
-        if (typeof schemaItem.type === "number") {
-            const converter = schemaItem.converter;
-            if (!converter) {
-                throw new Error(`Property '${key}' doesn't have converter for type ${AsnPropTypes[schemaItem.type]} in schema '${target.name}'`);
-            }
-            if (schemaItem.repeated) {
-                if (!Array.isArray(objProp)) {
-                    throw new TypeError("Parameter 'objProp' should be type of Array.");
-                }
-                const items = Array.from(objProp, (element) => converter.toASN(element));
-                const Container = schemaItem.repeated === "sequence" ? Sequence : Set;
-                asn1Item = new Container({
-                    value: items,
-                });
-            }
-            else {
-                asn1Item = converter.toASN(objProp);
-            }
-        }
-        else {
-            if (schemaItem.repeated) {
-                if (!Array.isArray(objProp)) {
-                    throw new TypeError("Parameter 'objProp' should be type of Array.");
-                }
-                const items = Array.from(objProp, (element) => this.toASN(element));
-                const Container = schemaItem.repeated === "sequence" ? Sequence : Set;
-                asn1Item = new Container({
-                    value: items,
-                });
-            }
-            else {
-                asn1Item = this.toASN(objProp);
-            }
-        }
-        return asn1Item;
-    }
-}
-
-class AsnConvert {
-    static serialize(obj) {
-        return AsnSerializer.serialize(obj);
-    }
-    static parse(data, target) {
-        return AsnParser.parse(data, target);
-    }
-    static toString(data) {
-        const buf = BufferSourceConverter.isBufferSource(data)
-            ? BufferSourceConverter.toArrayBuffer(data)
-            : AsnConvert.serialize(data);
-        const asn = fromBER(buf);
-        if (asn.offset === -1) {
-            throw new Error(`Cannot decode ASN.1 data. ${asn.result.error}`);
-        }
-        return asn.result.toString();
-    }
-}
-
-// src/core/revocation/ocsp.ts
-/**
- * OID for Authority Information Access extension
- */
-const id_pe_authorityInfoAccess = "1.3.6.1.5.5.7.1.1";
-/**
- * SHA-1 algorithm identifier for OCSP
- */
-const SHA1_OID = "1.3.14.3.2.26";
-/**
- * Compute SHA-1 hash of data (cross-platform)
- */
-async function computeSHA1(data) {
-    if (typeof crypto !== "undefined" && crypto.subtle) {
-        return crypto.subtle.digest("SHA-1", data);
-    }
-    // Node.js fallback
-    const nodeCrypto = require("crypto");
-    const hash = nodeCrypto.createHash("sha1");
-    hash.update(Buffer.from(data));
-    return hash.digest().buffer;
-}
-/**
- * Extract OCSP responder URLs from certificate
- * @param cert X509Certificate to extract OCSP URLs from
- * @returns Array of OCSP responder URLs
- */
-function extractOCSPUrls(cert) {
-    try {
-        const aiaExt = cert.getExtension(id_pe_authorityInfoAccess);
-        if (!aiaExt) {
-            return [];
-        }
-        // Get OCSP URLs from the extension
-        return aiaExt.ocsp.filter((gn) => gn.type === "url").map((gn) => gn.value);
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Extract CA Issuers URLs from certificate (for fetching issuer cert)
- * @param cert X509Certificate to extract URLs from
- * @returns Array of CA Issuers URLs
- */
-function extractCAIssuersUrls(cert) {
-    try {
-        const aiaExt = cert.getExtension(id_pe_authorityInfoAccess);
-        if (!aiaExt) {
-            return [];
-        }
-        return aiaExt.caIssuers.filter((gn) => gn.type === "url").map((gn) => gn.value);
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Find issuer certificate from certificate chain
- * @param cert Certificate to find issuer for
- * @param chain Array of PEM-formatted certificates
- * @returns Issuer certificate or null if not found
- */
-function findIssuerInChain(cert, chain) {
-    const issuerName = cert.issuer;
-    for (const pemCert of chain) {
-        try {
-            const chainCert = new X509Certificate(pemCert);
-            // Check if this cert's subject matches our cert's issuer
-            if (chainCert.subject === issuerName) {
-                return chainCert;
-            }
-        }
-        catch {
-            // Skip invalid certificates
-        }
-    }
-    return null;
-}
-/**
- * Fetch issuer certificate from AIA extension
- * @param cert Certificate to fetch issuer for
- * @param timeout Timeout in ms
- * @param proxyUrl Optional CORS proxy URL
- * @returns Issuer certificate or null
- */
-async function fetchIssuerFromAIA(cert, timeout = 5000, proxyUrl) {
-    const urls = extractCAIssuersUrls(cert);
-    for (const url of urls) {
-        try {
-            const result = await fetchIssuerCertificate(url, timeout, proxyUrl);
-            if (result.ok && result.data) {
-                // Try to parse as DER first, then PEM
-                try {
-                    return new X509Certificate(result.data);
-                }
-                catch {
-                    // Try converting to PEM
-                    const pem = arrayBufferToPEM(result.data);
-                    return new X509Certificate(pem);
-                }
-            }
-        }
-        catch {
-            // Try next URL
-        }
-    }
-    return null;
-}
-/**
- * Build OCSP request for a certificate
- * @param cert Certificate to check
- * @param issuerCert Issuer certificate
- * @returns DER-encoded OCSP request
- */
-async function buildOCSPRequest(cert, issuerCert) {
-    // Get issuer name hash (SHA-1 of issuer's DN in DER)
-    // Parse the raw certificate to get the proper ASN.1 structures for serialization
-    const issuerCertAsn = AsnParser.parse(issuerCert.rawData, Certificate);
-    const issuerNameDer = AsnConvert.serialize(issuerCertAsn.tbsCertificate.subject);
-    const issuerNameHash = await computeSHA1(issuerNameDer);
-    // Get issuer key hash (SHA-1 of issuer's public key BIT STRING value, not the full SPKI)
-    const issuerKeyHash = await computeSHA1(issuerCertAsn.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey);
-    // Get certificate serial number
-    const serialNumber = hexToArrayBuffer(cert.serialNumber);
-    // Build CertID
-    const certId = new CertID({
-        hashAlgorithm: new AlgorithmIdentifier({ algorithm: SHA1_OID }),
-        issuerNameHash: new OctetString(issuerNameHash),
-        issuerKeyHash: new OctetString(issuerKeyHash),
-        serialNumber: serialNumber,
-    });
-    // Build request
-    const request = new Request({ reqCert: certId });
-    // Build TBS request
-    const tbsRequest = new TBSRequest({
-        requestList: [request],
-    });
-    // Build OCSP request
-    const ocspRequest = new OCSPRequest({ tbsRequest });
-    return AsnConvert.serialize(ocspRequest);
-}
-/**
- * Parse OCSP response and extract revocation status
- * @param responseData DER-encoded OCSP response
- * @returns Revocation result
- */
-function parseOCSPResponse(responseData) {
-    const now = new Date();
-    try {
-        const response = AsnConvert.parse(responseData, OCSPResponse);
-        // Check response status
-        switch (response.responseStatus) {
-            case OCSPResponseStatus.successful:
-                break;
-            case OCSPResponseStatus.malformedRequest:
-                return {
-                    isValid: false,
-                    status: "error",
-                    method: "ocsp",
-                    reason: "OCSP responder returned: malformed request",
-                    checkedAt: now,
-                };
-            case OCSPResponseStatus.internalError:
-                return {
-                    isValid: false,
-                    status: "error",
-                    method: "ocsp",
-                    reason: "OCSP responder returned: internal error",
-                    checkedAt: now,
-                };
-            case OCSPResponseStatus.tryLater:
-                return {
-                    isValid: false,
-                    status: "unknown",
-                    method: "ocsp",
-                    reason: "OCSP responder returned: try later",
-                    checkedAt: now,
-                };
-            case OCSPResponseStatus.sigRequired:
-                return {
-                    isValid: false,
-                    status: "error",
-                    method: "ocsp",
-                    reason: "OCSP responder requires signature",
-                    checkedAt: now,
-                };
-            case OCSPResponseStatus.unauthorized:
-                return {
-                    isValid: false,
-                    status: "error",
-                    method: "ocsp",
-                    reason: "OCSP responder returned: unauthorized",
-                    checkedAt: now,
-                };
-            default:
-                return {
-                    isValid: false,
-                    status: "error",
-                    method: "ocsp",
-                    reason: `OCSP responder returned unknown status: ${response.responseStatus}`,
-                    checkedAt: now,
-                };
-        }
-        // Parse response bytes
-        if (!response.responseBytes) {
-            return {
-                isValid: false,
-                status: "error",
-                method: "ocsp",
-                reason: "OCSP response has no response bytes",
-                checkedAt: now,
-            };
-        }
-        // Parse BasicOCSPResponse
-        const basicResponse = AsnConvert.parse(response.responseBytes.response.buffer, BasicOCSPResponse);
-        // Get the first single response
-        const responses = basicResponse.tbsResponseData.responses;
-        if (!responses || responses.length === 0) {
-            return {
-                isValid: false,
-                status: "error",
-                method: "ocsp",
-                reason: "OCSP response contains no certificate status",
-                checkedAt: now,
-            };
-        }
-        const singleResponse = responses[0];
-        const certStatus = singleResponse.certStatus;
-        // Check certificate status
-        if (certStatus.good !== undefined) {
-            return {
-                isValid: true,
-                status: "good",
-                method: "ocsp",
-                checkedAt: now,
-            };
-        }
-        else if (certStatus.revoked) {
-            return {
-                isValid: false,
-                status: "revoked",
-                method: "ocsp",
-                reason: certStatus.revoked.revocationReason !== undefined
-                    ? `Certificate revoked (reason: ${certStatus.revoked.revocationReason})`
-                    : "Certificate revoked",
-                revokedAt: certStatus.revoked.revocationTime,
-                checkedAt: now,
-            };
-        }
-        else if (certStatus.unknown !== undefined) {
-            return {
-                isValid: false,
-                status: "unknown",
-                method: "ocsp",
-                reason: "OCSP responder does not know about this certificate",
-                checkedAt: now,
-            };
-        }
-        return {
-            isValid: false,
-            status: "error",
-            method: "ocsp",
-            reason: "Unexpected certificate status in OCSP response",
-            checkedAt: now,
-        };
-    }
-    catch (error) {
-        return {
-            isValid: false,
-            status: "error",
-            method: "ocsp",
-            reason: `Failed to parse OCSP response: ${error instanceof Error ? error.message : String(error)}`,
-            checkedAt: now,
-        };
-    }
-}
-/**
- * Check certificate revocation via OCSP
- * @param cert Certificate to check
- * @param issuerCert Issuer certificate (optional, will try to find/fetch)
- * @param options OCSP check options
- * @returns Revocation result
- */
-async function checkOCSP(cert, issuerCert, options = {}) {
-    const { timeout = 5000, certificateChain = [], proxyUrl } = options;
-    const now = new Date();
-    // Get OCSP URLs
-    const ocspUrls = extractOCSPUrls(cert);
-    if (ocspUrls.length === 0) {
-        return {
-            isValid: false,
-            status: "unknown",
-            method: "ocsp",
-            reason: "Certificate has no OCSP responder URL",
-            checkedAt: now,
-        };
-    }
-    // Try to find issuer certificate
-    let issuer = issuerCert;
-    if (!issuer) {
-        // Try certificate chain first
-        issuer = findIssuerInChain(cert, certificateChain);
-    }
-    if (!issuer) {
-        // Try AIA extension
-        issuer = await fetchIssuerFromAIA(cert, timeout, proxyUrl);
-    }
-    if (!issuer) {
-        return {
-            isValid: false,
-            status: "unknown",
-            method: "ocsp",
-            reason: "Could not find or fetch issuer certificate for OCSP",
-            checkedAt: now,
-        };
-    }
-    // Build OCSP request
-    let request;
-    try {
-        request = await buildOCSPRequest(cert, issuer);
-    }
-    catch (error) {
-        return {
-            isValid: false,
-            status: "error",
-            method: "ocsp",
-            reason: `Failed to build OCSP request: ${error instanceof Error ? error.message : String(error)}`,
-            checkedAt: now,
-        };
-    }
-    // Try each OCSP URL
-    for (const url of ocspUrls) {
-        try {
-            const result = await fetchOCSP(url, request, timeout, proxyUrl);
-            if (result.ok && result.data) {
-                return parseOCSPResponse(result.data);
-            }
-        }
-        catch {
-            // Try next URL
-        }
-    }
-    return {
-        isValid: false,
-        status: "error",
-        method: "ocsp",
-        reason: "All OCSP requests failed",
-        checkedAt: now,
-    };
-}
-
-const AUTHORITY_KEY_IDENTIFIER_OID = "2.5.29.35";
-const SUBJECT_KEY_IDENTIFIER_OID = "2.5.29.14";
-async function computeSha256Hex(input) {
-    const digest = await crypto.subtle.digest("SHA-256", input);
-    return arrayBufferToHex(digest);
-}
-function getAuthorityKeyIdentifierHex(certificate) {
-    const authorityKeyIdentifier = certificate.getExtension(AUTHORITY_KEY_IDENTIFIER_OID);
-    return normalizeKeyIdentifier(authorityKeyIdentifier?.keyId);
-}
-function getSubjectKeyIdentifierHex(certificate) {
-    const subjectKeyIdentifier = certificate.getExtension(SUBJECT_KEY_IDENTIFIER_OID);
-    return normalizeKeyIdentifier(subjectKeyIdentifier?.keyId);
-}
-async function extractIssuerIdentityFromCertificate(certificatePem, options = {}) {
-    const signerCertificate = new X509Certificate(certificatePem);
-    let issuerCertificate = options.certificateChain && options.certificateChain.length > 0
-        ? findIssuerInChain(signerCertificate, options.certificateChain)
-        : null;
-    if (!issuerCertificate && options.fetchOptions) {
-        issuerCertificate = await fetchIssuerFromAIA(signerCertificate, options.fetchOptions.timeout, options.fetchOptions.proxyUrl);
-    }
-    return {
-        issuerSubjectDn: normalizeDistinguishedName(signerCertificate.issuer),
-        authorityKeyIdentifierHex: getAuthorityKeyIdentifierHex(signerCertificate),
-        issuerCertificate: issuerCertificate
-            ? {
-                subjectDn: normalizeDistinguishedName(issuerCertificate.subject),
-                spkiSha256Hex: await computeSha256Hex(issuerCertificate.publicKey.rawData),
-            }
-            : null,
-    };
-}
-async function extractCertificateIdentityFromCertificate(certificatePem) {
-    const certificate = new X509Certificate(certificatePem);
-    return {
-        subjectDn: normalizeDistinguishedName(certificate.subject),
-        subjectKeyIdentifierHex: getSubjectKeyIdentifierHex(certificate),
-        spkiSha256Hex: await computeSha256Hex(certificate.publicKey.rawData),
-    };
-}
-
-export { AsnConvert as A, extractCertificateIdentityFromCertificate as a, checkOCSP as c, extractIssuerIdentityFromCertificate as e };
-//# sourceMappingURL=identity-b3a70fc1.js.map