node-opcua-pki 6.22.1 → 7.0.0

package/dist/index.d.mts

@@ -1,1003 +0,0 @@
-import { IKeyOperations, PrivateKey, Certificate, SubjectOptions, DER, CertificateRevocationList } from 'node-opcua-crypto';
-export { AsymmetricDecryptParams, AsymmetricSignParams, IKeyOperations, KeyMetadata, PrivateKeyPassphraseRequiredError, PrivateKeyUnavailableError, Subject, SubjectOptions } from 'node-opcua-crypto';
-import { C as CaBackend, a as CertificateAuthorityCore, P as Params, b as ProcessAltNamesParam, c as CertificateAuthorityCoreOptions, K as KeySize, d as PrivateKeyPassphrase, e as PrivateKeyProvider, f as CreateSelfSignCertificateParam, F as Filename } from './core-BwqSJPHc.mjs';
-export { g as CertificateStatus, h as CreateCertificateSigningRequestOptions, i as CreateCertificateSigningRequestWithConfigOptions, j as CreateSelfSignCertificateWithConfigParam, G as GenerateKeyPairAndSignOptions, k as GenerateKeyPairAndSignPFXOptions, I as InitializeCSRResult, l as InstallCACertificateResult, m as KeyLength, N as NativeCaBackend, n as PkiBackendCapabilities, S as SignCertificateOptions, o as StartDateEndDateParam, T as Thumbprint, p as adjustApplicationUri, q as adjustDate, r as isOpaqueSigner, s as quote, t as resolvePrivateKeyPassphrase } from './core-BwqSJPHc.mjs';
-import { EventEmitter } from 'node:events';
-
-/**
- * The default {@link CaBackend}: shells out to the `openssl` CLI, exactly as
- * `CertificateAuthority` always has — this is a pure code move (plus a lock
- * around every database-mutating operation, temp-config cleanup, and
- * explicit `envOverrides` on every config render) with no change in the
- * openssl commands issued or the files produced.
- */
-declare class OpenSslCaBackend implements CaBackend {
-    #private;
-    /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
-    readonly supportsExternalSigner = false;
-    preflight(): Promise<void>;
-    generateCaCsr(ca: CertificateAuthorityCore, _caRootDir: string, privateKeyFile: string, csrFile: string): Promise<void>;
-    bootstrap(ca: CertificateAuthorityCore): Promise<void>;
-    regenerateCrl(ca: CertificateAuthorityCore): Promise<void>;
-    signSubordinateCsr(ca: CertificateAuthorityCore, csrFile: string, certFile: string, validityDays: number): Promise<void>;
-    signEndEntityCsr(ca: CertificateAuthorityCore, certificate: string, csr: string, params1: Params, sanOverride: Required<ProcessAltNamesParam>): Promise<void>;
-    revoke(ca: CertificateAuthorityCore, certificate: string, reason: string): Promise<void>;
-    createSelfSignedCertificate(ca: CertificateAuthorityCore, certificateFile: string, privateKeyFile: string, params: Params): Promise<void>;
-}
-
-/** openssl argv entries plus the env they need; merge `env` into `ExecuteOptions.env`. */
-interface OpensslPassArg {
-    args: string[];
-    env: NodeJS.ProcessEnv;
-}
-
-/**
- *
- * return path to the openssl executable
- */
-declare function install_prerequisite(): Promise<string>;
-
-/**
- * Options for {@link CertificateAuthority}: the core's, except that the
- * backend is named rather than supplied.
- */
-interface CertificateAuthorityOptions extends Omit<CertificateAuthorityCoreOptions, "backend"> {
-    /**
-     * Signing backend to use.
-     *
-     * - `"openssl"` (default): shells out to the `openssl` CLI, as this
-     *   class always has.
-     * - `"native"`: signs in pure JS via `node-opcua-crypto`, writing the
-     *   same on-disk database format, and needs no `openssl` executable.
-     *
-     * Setting `signer` implies `"native"`, since the openssl CLI can only
-     * load a key from a file.
-     *
-     * To supply a backend instance directly - including one of your own -
-     * use {@link CertificateAuthorityCore}, which is also the class to
-     * build against when you do not want the openssl backend in your
-     * bundle at all.
-     */
-    backend?: "openssl" | "native";
-}
-/**
- * A Certificate Authority with a backend chosen for you.
- *
- * This is {@link CertificateAuthorityCore} plus the convenience that made
- * it the historical API: name a backend, or name nothing and get openssl.
- * Because it resolves the name, it necessarily references both backends,
- * which is why the core exists separately - a program that never imports
- * this class never pulls the openssl backend into its bundle.
- */
-declare class CertificateAuthority extends CertificateAuthorityCore {
-    constructor(options: CertificateAuthorityOptions);
-    /**
-     * @internal `-passin env:` argv + env for an openssl call that loads
-     * this CA's key (always emitted, empty when none).
-     *
-     * The openssl backend builds its own now; this remains so that external
-     * code calling it keeps working, and lives here rather than on the core
-     * because the flag means nothing to a backend that spawns nothing.
-     */
-    _opensslPassin(): Promise<OpensslPassArg>;
-    /**
-     * @internal
-     * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
-     * values to the shared env registry, or unset them so the matching
-     * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
-     * reads the registry any more - every openssl config render receives
-     * these values explicitly, from the same {@link caConfigEnvOverrides}
-     * builder this delegates to, so the two cannot drift - kept only for
-     * external code that renders openssl config templates against the
-     * registry directly.
-     *
-     * It lives on this class rather than the core because it is meaningful
-     * only to the openssl backend.
-     */
-    _wireRevocationEnvVars(): void;
-}
-
-/**
- * Identifies which PKI sub-store a certificate event originated from.
- */
-type CertificateStore = "trusted" | "rejected" | "issuersCerts";
-/**
- * Identifies which PKI sub-store a CRL event originated from.
- */
-type CrlStore = "crl" | "issuersCrl";
-/**
- * Events emitted by {@link CertificateManager} when the
- * file-system watchers detect certificate or CRL changes.
- */
-interface CertificateManagerEvents {
-    /** A certificate file was added to a store. */
-    certificateAdded: (event: {
-        store: CertificateStore;
-        certificate: Certificate;
-        fingerprint: string;
-        filename: string;
-    }) => void;
-    /** A certificate file was removed from a store. */
-    certificateRemoved: (event: {
-        store: CertificateStore;
-        fingerprint: string;
-        filename: string;
-    }) => void;
-    /** A certificate file was modified in a store. */
-    certificateChange: (event: {
-        store: CertificateStore;
-        certificate: Certificate;
-        fingerprint: string;
-        filename: string;
-    }) => void;
-    /** A CRL file was added. */
-    crlAdded: (event: {
-        store: CrlStore;
-        filename: string;
-    }) => void;
-    /** A CRL file was removed. */
-    crlRemoved: (event: {
-        store: CrlStore;
-        filename: string;
-    }) => void;
-}
-/**
- * Options controlling certificate validation in
- * {@link CertificateManager.addTrustedCertificateFromChain}.
- *
- * By default all checks are **strict** (secure). Set individual
- * flags to `true` only in test/development environments.
- */
-interface AddCertificateValidationOptions {
-    /**
-     * Accept certificates whose validity period has expired
-     * or is not yet active.
-     * @defaultValue false
-     */
-    acceptExpiredCertificate?: boolean;
-    /**
-     * Accept certificates that have been revoked by their
-     * issuer's CRL.  When `false` (the default), a revoked
-     * certificate is rejected with `BadCertificateRevoked`.
-     * @defaultValue false
-     */
-    acceptRevokedCertificate?: boolean;
-    /**
-     * Do not fail when a CRL is missing for an issuer in the
-     * chain.  When `false` (the default), a missing CRL causes
-     * `BadCertificateRevocationUnknown`.
-     * @defaultValue false
-     */
-    ignoreMissingRevocationList?: boolean;
-    /**
-     * Maximum depth of the certificate chain (leaf + issuers).
-     * The leaf certificate counts as depth 1.
-     * @defaultValue 5
-     */
-    maxChainLength?: number;
-}
-/**
- * Options for creating a {@link CertificateManager}.
- */
-interface CertificateManagerOptions {
-    /**
-     * RSA key size for generated private keys.
-     * @defaultValue 2048
-     */
-    keySize?: KeySize;
-    /** Filesystem path where the PKI directory structure is stored. */
-    location: string;
-    /**
-     * Validation options applied by
-     * {@link CertificateManager.addTrustedCertificateFromChain}.
-     *
-     * Defaults are secure — all checks enabled.
-     */
-    addCertificateValidationOptions?: AddCertificateValidationOptions;
-    /**
-     * When `true`, the CertificateManager will **not** start
-     * chokidar file-system watchers on the PKI folders.
-     *
-     * The initial file-system scan still runs so the in-memory
-     * indexes are populated, but live change detection is
-     * disabled.  This is useful in test / CI environments where
-     * many CertificateManager instances are created in parallel
-     * and the accumulated `fs.watch` handles exhaust the libuv
-     * thread-pool, causing event-loop starvation.
-     *
-     * @defaultValue false
-     */
-    disableFileWatchers?: boolean;
-    /**
-     * Encrypt the private key at rest with this passphrase (opt-in,
-     * default off). When set:
-     * - a freshly generated key is written as encrypted PKCS#8;
-     * - an existing *plaintext* key is re-encrypted in place by
-     *   {@link CertificateManager.initialize} (atomic rename, same as
-     *   {@link CertificateManager.reencryptPrivateKey}), so enabling the
-     *   option on an existing install never leaves the key in cleartext;
-     * - an existing encrypted key requires the same passphrase — a
-     *   mismatch, or an encrypted key with no passphrase configured, fails
-     *   `initialize()` closed with `PrivateKeyPassphraseRequiredError`.
-     *
-     * A function is called at most once per `CertificateManager` instance
-     * (the decrypted key is cached in memory for the instance's lifetime,
-     * see {@link CertificateManager.getPrivateKey}). Never logged.
-     *
-     * Existing consumers that read `own/private/private_key.pem` directly
-     * (e.g. node-opcua's `OPCUAServer`, or `createPFX` without its
-     * `privateKeyPassphrase` option) still expect a plaintext key — do not
-     * enable this unless every reader of that file goes through
-     * {@link CertificateManager.getPrivateKey} or is given the passphrase.
-     */
-    privateKeyPassphrase?: PrivateKeyPassphrase;
-    /**
-     * Source the private key from somewhere other than
-     * `own/private/private_key.pem` (an HSM, a KMS, ...). When set, it
-     * overrides disk entirely for every operation that needs the private
-     * key — the on-disk file is not read, and `privateKeyPassphrase` is
-     * ignored.
-     */
-    privateKeyProvider?: PrivateKeyProvider;
-    /**
-     * Use a private key this manager can never read: an opaque
-     * {@link IKeyOperations} provider (HSM, KMS, TPM, OS keystore, ...).
-     *
-     * The distinction with `privateKeyProvider` matters: a
-     * `privateKeyProvider` *sources raw key material* from elsewhere and
-     * hands it back; `keyOperations` never reveals the key — only sign and
-     * decrypt operations on it. Prefer `keyOperations` whenever the key
-     * does not need to be exportable.
-     *
-     * When set:
-     * - {@link CertificateManager.getPrivateKey} and
-     *   {@link CertificateManager.reencryptPrivateKey} throw
-     *   `PrivateKeyUnavailableError` — there is no key material to return
-     *   or rewrite, and no on-disk key is generated or expected;
-     * - {@link CertificateManager.getKeyOperations} returns this object;
-     * - `initialize()` fails closed if the provider cannot answer
-     *   `getKeyMetadata()` (unreachable HSM, misconfiguration);
-     * - mutually exclusive with `privateKeyProvider` and
-     *   `privateKeyPassphrase` — both describe key *material*, which an
-     *   opaque configuration does not have.
-     */
-    keyOperations?: IKeyOperations;
-}
-/**
- * Parameters for {@link createSelfSignedCertificate}.
- * All fields from {@link CreateSelfSignCertificateParam} are required.
- */
-interface CreateSelfSignCertificateParam1 extends CreateSelfSignCertificateParam {
-    /**
-     * Output path for the certificate.
-     * @defaultValue `"own/certs/self_signed_certificate.pem"`
-     */
-    outputFile?: Filename;
-    /** X.500 subject for the certificate. */
-    subject: SubjectOptions | string;
-    /** OPC UA application URI for the SAN extension. */
-    applicationUri: string;
-    /** DNS host names to include in the SAN extension. */
-    dns: string[];
-    /** Certificate "Not Before" date. */
-    startDate: Date;
-    /** Number of days the certificate is valid. */
-    validity: number;
-}
-/**
- * Options to fine-tune certificate verification behaviour.
- * Passed to {@link CertificateManager.verifyCertificate}.
- *
- * Without any options, `verifyCertificate` is **strict**: only
- * certificates that are explicitly present in the trusted store
- * will return {@link VerificationStatus.Good}. Unknown or
- * rejected certificates return
- * {@link VerificationStatus.BadCertificateUntrusted} even when
- * their issuer chain is valid.
- *
- * Set {@link acceptCertificateWithValidIssuerChain} to `true`
- * to accept certificates whose issuer chain validates against
- * a trusted CA — even if the leaf certificate itself is not
- * in the trusted store.
- */
-interface VerifyCertificateOptions {
-    /** Accept certificates whose "Not After" date has passed. */
-    acceptOutdatedCertificate?: boolean;
-    /** Accept issuer certificates whose "Not After" date has passed. */
-    acceptOutDatedIssuerCertificate?: boolean;
-    /** Do not fail when a CRL is missing for an issuer. */
-    ignoreMissingRevocationList?: boolean;
-    /** Accept certificates whose "Not Before" date is in the future. */
-    acceptPendingCertificate?: boolean;
-    /**
-     * Accept a certificate that is not in the trusted store when
-     * its issuer (CA) certificate is trusted, the signature is
-     * valid, and the certificate does not appear in the CRL.
-     *
-     * When `false` (the default), only certificates explicitly
-     * placed in the trusted store are accepted — this is the
-     * same behaviour as {@link CertificateManager.isCertificateTrusted}.
-     *
-     * @defaultValue false
-     */
-    acceptCertificateWithValidIssuerChain?: boolean;
-}
-/**
- * OPC UA certificate verification status codes.
- *
- * These mirror the OPC UA `StatusCode` values for certificate
- * validation results.
- */
-declare enum VerificationStatus {
-    /** The certificate provided as a parameter is not valid. */
-    BadCertificateInvalid = "BadCertificateInvalid",
-    /** An error occurred verifying security. */
-    BadSecurityChecksFailed = "BadSecurityChecksFailed",
-    /** The certificate does not meet the requirements of the security policy. */
-    BadCertificatePolicyCheckFailed = "BadCertificatePolicyCheckFailed",
-    /** The certificate has expired or is not yet valid. */
-    BadCertificateTimeInvalid = "BadCertificateTimeInvalid",
-    /** An issuer certificate has expired or is not yet valid. */
-    BadCertificateIssuerTimeInvalid = "BadCertificateIssuerTimeInvalid",
-    /** The HostName used to connect to a server does not match a HostName in the certificate. */
-    BadCertificateHostNameInvalid = "BadCertificateHostNameInvalid",
-    /** The URI specified in the ApplicationDescription does not match the URI in the certificate. */
-    BadCertificateUriInvalid = "BadCertificateUriInvalid",
-    /** The certificate may not be used for the requested operation. */
-    BadCertificateUseNotAllowed = "BadCertificateUseNotAllowed",
-    /** The issuer certificate may not be used for the requested operation. */
-    BadCertificateIssuerUseNotAllowed = "BadCertificateIssuerUseNotAllowed",
-    /** The certificate is not trusted. */
-    BadCertificateUntrusted = "BadCertificateUntrusted",
-    /** It was not possible to determine if the certificate has been revoked. */
-    BadCertificateRevocationUnknown = "BadCertificateRevocationUnknown",
-    /** It was not possible to determine if the issuer certificate has been revoked. */
-    BadCertificateIssuerRevocationUnknown = "BadCertificateIssuerRevocationUnknown",
-    /** The certificate has been revoked. */
-    BadCertificateRevoked = "BadCertificateRevoked",
-    /** The issuer certificate has been revoked. */
-    BadCertificateIssuerRevoked = "BadCertificateIssuerRevoked",
-    /** The certificate chain is incomplete. */
-    BadCertificateChainIncomplete = "BadCertificateChainIncomplete",
-    /** Validation OK. */
-    Good = "Good"
-}
-declare function coerceCertificateChain(certificate: Certificate | Certificate[]): Certificate[];
-declare function makeFingerprint(certificate: Certificate | Certificate[] | CertificateRevocationList): string;
-declare function toFilenameLabel(commonName: string): string;
-declare function safeStoreJoin(folder: string, filename: string): string;
-/**
- * Check if the provided certificate acts as an issuer (CA)
- * @param certificate - the DER-encoded certificate
- * @returns true if the certificate has CA basicConstraints or keyCertSign keyUsage
- */
-declare function isIssuer(certificate: Certificate): boolean;
-/**
- * Check if the provided certificate acts as an intermediate issuer.
- * An intermediate issuer is a CA certificate that is not a root CA (not self-signed).
- * @param certificate - the DER-encoded certificate
- * @returns true if the certificate is a CA and is not self-signed
- */
-declare function isIntermediateIssuer(certificate: Certificate): boolean;
-/**
- * Check if the provided certificate acts as a root issuer.
- * A root issuer is a CA certificate that is self-signed.
- * @param certificate - the DER-encoded certificate
- * @returns true if the certificate is a CA and is self-signed
- */
-declare function isRootIssuer(certificate: Certificate): boolean;
-/**
- * Find the issuer certificate for a given certificate within
- * a provided certificate chain.
- *
- * @param certificate - the DER-encoded certificate whose issuer to find
- * @param chain - candidate issuer certificates to search
- * @returns the matching issuer certificate, or `null` if not found
- */
-declare function findIssuerCertificateInChain(certificate: Certificate | Certificate[], chain: Certificate[]): Certificate | null;
-/**
- * Lifecycle state of a {@link CertificateManager} instance.
- */
-declare enum CertificateManagerState {
-    Uninitialized = 0,
-    Initializing = 1,
-    Initialized = 2,
-    Disposing = 3,
-    Disposed = 4
-}
-/**
- * Manages a GDS-compliant PKI directory structure for an OPC UA
- * application.
- *
- * The PKI store layout follows the OPC UA specification:
- *
- * ```
- * <location>/
- *   ├── own/
- *   │   ├── certs/        Own certificate(s)
- *   │   └── private/      Own private key
- *   ├── trusted/
- *   │   ├── certs/        Trusted peer certificates
- *   │   └── crl/          CRLs for trusted certs
- *   ├── rejected/         Untrusted / rejected certificates
- *   └── issuers/
- *       ├── certs/        CA (issuer) certificates
- *       └── crl/          CRLs for issuer certificates
- * ```
- *
- * File-system watchers keep the in-memory indexes in sync with
- * on-disk changes. Call {@link dispose} when the instance is no
- * longer needed to release watchers and allow the process to
- * exit cleanly.
- *
- * ## Environment Variables
- *
- * - **`OPCUA_PKI_USE_POLLING`** — set to `"true"` to use
- *   polling-based file watching instead of native OS events.
- *   Useful for NFS, CIFS, Docker volumes, or other remote /
- *   virtual file systems where native events are unreliable.
- *
- * - **`OPCUA_PKI_POLLING_INTERVAL`** — polling interval in
- *   milliseconds (only effective when polling is enabled).
- *   Clamped to the range [100, 600 000]. Defaults to
- *   {@link folderPollingInterval} (5 000 ms).
- *
- * @example
- * ```ts
- * const cm = new CertificateManager({ location: "/var/pki" });
- * await cm.initialize();
- * const status = await cm.verifyCertificate(cert);
- * await cm.dispose();
- * ```
- */
-/**
- * Status codes returned by {@link CertificateManager.completeCertificateChain}.
- */
-declare enum ChainCompletionStatus {
-    /** The chain already reached a self-signed root — no action was needed. */
-    AlreadyComplete = "AlreadyComplete",
-    /** One or more issuer certificates were successfully appended. */
-    ChainCompleted = "ChainCompleted",
-    /** The issuer for the last certificate in the chain could not be found
-     *  in the issuers or trusted stores. The chain is still partial. */
-    IssuerNotFound = "IssuerNotFound",
-    /** The input chain was empty. */
-    EmptyChain = "EmptyChain",
-    /** Chain completion was stopped because the maximum depth was reached. */
-    MaxDepthReached = "MaxDepthReached"
-}
-/**
- * Result of {@link CertificateManager.completeCertificateChain}.
- */
-interface ChainCompletionResult {
-    /** The (possibly completed) certificate chain, leaf first. */
-    chain: Certificate[];
-    /** Status code indicating whether completion succeeded and why/why not. */
-    status: ChainCompletionStatus;
-    /** Human-readable diagnostic message. */
-    message: string;
-}
-declare class CertificateManager extends EventEmitter {
-    #private;
-    /**
-     * Dispose **all** active CertificateManager instances,
-     * closing their file watchers and freeing resources.
-     *
-     * This is mainly useful in test tear-down to ensure the
-     * Node.js process can exit cleanly.
-     */
-    static disposeAll(): Promise<void>;
-    /**
-     * Assert that all CertificateManager instances have been
-     * properly disposed. Throws an Error listing the locations
-     * of any leaked instances.
-     *
-     * Intended for use in test `afterAll()` / `afterEach()`
-     * hooks to catch missing `dispose()` calls early.
-     *
-     * @example
-     * ```ts
-     * after(() => {
-     *     CertificateManager.checkAllDisposed();
-     * });
-     * ```
-     */
-    static checkAllDisposed(): void;
-    /**
-     * When `true` (the default), any certificate that is not
-     * already in the trusted or rejected store is automatically
-     * written to the rejected folder the first time it is seen.
-     */
-    untrustUnknownCertificate: boolean;
-    /** Current lifecycle state of this instance. */
-    state: CertificateManagerState;
-    /** @deprecated Use {@link folderPollingInterval} instead (typo fix). */
-    folderPoolingInterval: number;
-    /** Interval in milliseconds for file-system polling (when enabled). */
-    get folderPollingInterval(): number;
-    set folderPollingInterval(value: number);
-    /** RSA key size used when generating the private key. */
-    readonly keySize: KeySize;
-    /**
-     * Create a new CertificateManager.
-     *
-     * The constructor creates the root directory if it does not
-     * exist but does **not** initialise the PKI store — call
-     * {@link initialize} before using any other method.
-     *
-     * @param options - configuration options
-     */
-    constructor(options: CertificateManagerOptions);
-    /** Path to the OpenSSL configuration file. */
-    get configFile(): string;
-    /** Root directory of the PKI store. */
-    get rootDir(): string;
-    /**
-     * Path to the private key file (`own/private/private_key.pem`).
-     *
-     * Kept for backward compatibility with code that reads the key
-     * directly from disk. When a passphrase or a `privateKeyProvider` is
-     * configured, prefer {@link getPrivateKey} instead — this getter still
-     * returns the on-disk path even if a provider is configured (there may
-     * be no meaningful file in that case).
-     */
-    get privateKey(): string;
-    /**
-     * Resolve the private key: from `privateKeyProvider` if configured,
-     * otherwise from disk (decrypting with `privateKeyPassphrase` if the
-     * key is encrypted). Fails closed — throws
-     * `PrivateKeyPassphraseRequiredError` — if the on-disk key is encrypted
-     * and no passphrase is configured, or if the wrong passphrase is
-     * configured.
-     *
-     * The on-disk key is read and decrypted once and then cached for the
-     * lifetime of this instance, so a `privateKeyPassphrase` function is
-     * called at most once (concurrent first calls share the same read). A
-     * failed read is not cached, so a caller can fix the passphrase and
-     * retry. A `privateKeyProvider` is consulted on every call: it is the
-     * authority on what the current key is.
-     */
-    getPrivateKey(): Promise<PrivateKey>;
-    /**
-     * True when this manager's key is opaque — configured through
-     * `keyOperations`, held by an HSM/KMS, never obtainable as material.
-     * When true, {@link getPrivateKey} throws `PrivateKeyUnavailableError`
-     * and {@link getKeyOperations} is the only way to use the key.
-     */
-    isPrivateKeyOpaque(): boolean;
-    /**
-     * The key as an opaque {@link IKeyOperations} — the recommended way to
-     * *use* the private key regardless of where it lives.
-     *
-     * Returns the configured `keyOperations` object when the key is opaque.
-     * Otherwise returns a stable lazy wrap over {@link getPrivateKey}: its
-     * methods resolve the key on first use (disk read, passphrase,
-     * `privateKeyProvider` — all async), so the wrap offers no synchronous
-     * fast path; callers that need one resolve the key themselves and build
-     * a `LocalKeyOperations` over it. The wrap follows key rotation: a
-     * `privateKeyProvider` that starts returning a different key gets a
-     * fresh underlying `LocalKeyOperations`.
-     */
-    getKeyOperations(): IKeyOperations;
-    /**
-     * Enable, disable, or rotate the passphrase protecting the on-disk
-     * private key: decrypt with `oldPassphrase` (omit if the key is
-     * currently unencrypted), then write back encrypted with
-     * `newPassphrase` (omit to leave it unencrypted). The write goes to a
-     * temporary file in the same directory and is atomically renamed into
-     * place, so a crash mid-rotation cannot leave a partially-written key;
-     * the temporary file is removed if anything fails, so a rotation *to*
-     * plaintext can never leave a stray cleartext copy behind. Runs under
-     * the same lock as `initialize()`.
-     *
-     * This only rewrites the on-disk file — it does not update this
-     * instance's own `privateKeyPassphrase` (set at construction), and it
-     * drops this instance's cached key so that disk stays the source of
-     * truth. Construct a new `CertificateManager` with the new passphrase to
-     * continue using it afterward.
-     *
-     * Not supported when a `privateKeyProvider` is configured (there is no
-     * disk file for this method to rewrite).
-     */
-    reencryptPrivateKey(oldPassphrase?: PrivateKeyPassphrase, newPassphrase?: PrivateKeyPassphrase): Promise<void>;
-    /** Path to the OpenSSL random seed file. */
-    get randomFile(): string;
-    /**
-     * Move a certificate to the rejected store.
-     * If the certificate was previously trusted, it will be removed from the trusted folder.
-     * @param certificateOrChain - the DER-encoded certificate or certificate chain
-     */
-    rejectCertificate(certificateOrChain: Certificate | Certificate[]): Promise<void>;
-    /**
-     * Move a certificate to the trusted store.
-     * If the certificate was previously rejected, it will be removed from the rejected folder.
-     * @param certificateOrChain - the DER-encoded certificate or certificate chain
-     */
-    trustCertificate(certificateOrChain: Certificate | Certificate[]): Promise<void>;
-    /**
-     * Check whether the trusted certificate store is empty.
-     *
-     * This inspects the in-memory index, which is kept in
-     * sync with the `trusted/certs/` folder by file-system
-     * watchers after {@link initialize} has been called.
-     */
-    isTrustListEmpty(): boolean;
-    /**
-     * Return the number of certificates currently in the
-     * trusted store.
-     */
-    getTrustedCertificateCount(): number;
-    /** Path to the rejected certificates folder. */
-    get rejectedFolder(): string;
-    /** Path to the trusted certificates folder. */
-    get trustedFolder(): string;
-    /** Path to the trusted CRL folder. */
-    get crlFolder(): string;
-    /** Path to the issuer (CA) certificates folder. */
-    get issuersCertFolder(): string;
-    /** Path to the issuer CRL folder. */
-    get issuersCrlFolder(): string;
-    /** Path to the own certificate folder. */
-    get ownCertFolder(): string;
-    get ownPrivateFolder(): string;
-    /**
-     * Check if a certificate is in the trusted store.
-     * If the certificate is unknown and `untrustUnknownCertificate` is set,
-     * it will be written to the rejected folder.
-     * @param certificate - the DER-encoded certificate
-     * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
-     *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
-     */
-    isCertificateTrusted(certificateOrCertificateChain: Certificate | Certificate[]): Promise<"Good" | "BadCertificateUntrusted" | "BadCertificateInvalid">;
-    /**
-     * Internal verification hook called by {@link verifyCertificate}.
-     *
-     * Subclasses can override this to inject additional validation
-     * logic (e.g. application-level policy checks) while still
-     * delegating to the default chain/CRL/trust verification.
-     *
-     * @param certificate - the DER-encoded certificate to verify
-     * @param options - verification options forwarded from the
-     *   public API
-     * @returns the verification status code
-     */
-    protected verifyCertificateAsync(certificate: Certificate | Certificate[], options: VerifyCertificateOptions): Promise<VerificationStatus>;
-    /**
-     * Verify a certificate against the PKI trust store.
-     *
-     * This performs a full validation including trust status,
-     * issuer chain, CRL revocation checks, and time validity.
-     *
-     * @param certificate - the DER-encoded certificate to verify
-     * @param options - optional flags to relax validation rules
-     * @returns the verification status code
-     */
-    verifyCertificate(certificate: Certificate | Certificate[], options?: VerifyCertificateOptions): Promise<VerificationStatus>;
-    /**
-     * Initialize the PKI directory structure, generate the
-     * private key (if missing), and start file-system watchers.
-     *
-     * This method is idempotent — subsequent calls are no-ops.
-     * It must be called before any certificate operations.
-     */
-    initialize(): Promise<void>;
-    /**
-     * Dispose of the CertificateManager, releasing file watchers
-     * and other resources. The instance should not be used after
-     * calling this method.
-     */
-    dispose(): Promise<void>;
-    /**
-     * Force a full re-scan of all PKI folders, rebuilding
-     * the in-memory `_thumbs` index from scratch.
-     *
-     * Call this after external processes have modified the
-     * PKI folders (e.g. via `writeTrustList` or CLI tools)
-     * to ensure the CertificateManager sees the latest
-     * state without waiting for file-system events.
-     */
-    reloadCertificates(): Promise<void>;
-    protected withLock2<T>(action: () => Promise<T>): Promise<T>;
-    /**
-     * Create a self-signed certificate for this PKI's private key.
-     *
-     * The certificate is written to `params.outputFile` or
-     * `own/certs/self_signed_certificate.pem` by default.
-     *
-     * @param params - certificate parameters (subject, SANs,
-     *   validity, etc.)
-     */
-    createSelfSignedCertificate(params: CreateSelfSignCertificateParam1): Promise<void>;
-    /**
-     * Create a Certificate Signing Request (CSR) using this
-     * PKI's private key and configuration.
-     *
-     * The CSR file is written to `own/certs/` with a timestamped
-     * filename.
-     *
-     * @param params - CSR parameters (subject, SANs)
-     * @returns the filesystem path to the generated CSR file
-     */
-    createCertificateRequest(params: CreateSelfSignCertificateParam): Promise<Filename>;
-    /**
-     * Add a CA (issuer) certificate to the issuers store.
-     * If the certificate is already present, this is a no-op.
-     * @param certificate - the DER-encoded CA certificate
-     * @param validate - if `true`, verify the certificate before adding
-     * @param addInTrustList - if `true`, also add to the trusted store
-     * @returns `VerificationStatus.Good` on success
-     */
-    addIssuer(certificate: DER, validate?: boolean, addInTrustList?: boolean): Promise<VerificationStatus>;
-    /**
-     * Add multiple CA (issuer) certificates to the issuers store.
-     * @param certificates - the DER-encoded CA certificates
-     * @param validate - if `true`, verify each certificate before adding
-     * @param addInTrustList - if `true`, also add each certificate to the trusted store
-     * @returns `VerificationStatus.Good` on success
-     */
-    addIssuers(certificates: Certificate[], validate?: boolean, addInTrustList?: boolean): Promise<VerificationStatus>;
-    /**
-     * Add a CRL to the certificate manager.
-     * @param crl - the CRL to add
-     * @param target - "issuers" (default) writes to issuers/crl, "trusted" writes to trusted/crl
-     */
-    addRevocationList(crl: CertificateRevocationList, target?: "issuers" | "trusted"): Promise<VerificationStatus>;
-    /**
-     * Remove all CRL files from the specified folder(s) and clear the
-     * corresponding in-memory index.
-     * @param target - "issuers" clears issuers/crl, "trusted" clears
-     *   trusted/crl, "all" clears both.
-     */
-    clearRevocationLists(target: "issuers" | "trusted" | "all"): Promise<void>;
-    /**
-     * Check whether an issuer certificate with the given thumbprint
-     * is already registered.
-     * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
-     */
-    hasIssuer(thumbprint: string): Promise<boolean>;
-    /**
-     * Remove a trusted certificate identified by its SHA-1 thumbprint.
-     * Deletes the file on disk and removes the entry from the
-     * in-memory index.
-     * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
-     * @returns the removed certificate buffer, or `null` if not found
-     */
-    removeTrustedCertificate(thumbprint: string): Promise<Certificate | null>;
-    /**
-     * Remove an issuer certificate identified by its SHA-1 thumbprint.
-     * Deletes the file on disk and removes the entry from the
-     * in-memory index.
-     * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
-     * @returns the removed certificate buffer, or `null` if not found
-     */
-    removeIssuer(thumbprint: string): Promise<Certificate | null>;
-    /**
-     * Remove all CRL files that were issued by the given CA certificate
-     * from the specified folder (or both).
-     * @param issuerCertificate - the CA certificate whose CRLs to remove
-     * @param target - "issuers", "trusted", or "all" (default "all")
-     */
-    removeRevocationListsForIssuer(issuerCertificate: Certificate, target?: "issuers" | "trusted" | "all"): Promise<void>;
-    /**
-     * Validate a certificate (optionally with its chain) and add
-     * the leaf certificate to the trusted store.
-     *
-     * Performs OPC UA Part 4, Table 100 validation:
-     *
-     * 1. **Certificate Structure** — parse the DER encoding.
-     * 2. **Build Certificate Chain** — walk from the leaf to a
-     *    self-signed root CA, using the provided chain and the
-     *    issuers store.
-     * 3. **Signature** — verify each certificate's signature
-     *    against its issuer.
-     * 4. **Issuer Presence** — every issuer in the chain must
-     *    already be registered in the issuers store (per GDS
-     *    7.8.2.6).
-     * 5. **Validity Period** — each certificate must be within
-     *    its validity window (overridable via
-     *    {@link AddCertificateValidationOptions.acceptExpiredCertificate}).
-     * 6. **Revocation Check** — each certificate is checked
-     *    against its issuer's CRL (overridable via
-     *    {@link AddCertificateValidationOptions.acceptRevokedCertificate}
-     *    and {@link AddCertificateValidationOptions.ignoreMissingRevocationList}).
-     *
-     * Only the leaf certificate is added to the trusted store.
-     *
-     * @param certificateChain - DER-encoded certificate or chain
-     * @returns `VerificationStatus.Good` on success, or an error
-     *  status indicating why the certificate was rejected.
-     */
-    addTrustedCertificateFromChain(certificateChain: Certificate | Certificate[]): Promise<VerificationStatus>;
-    /**
-     * Check whether an issuer certificate is still needed by any
-     * certificate in the trusted store.
-     *
-     * This is used before removing an issuer to ensure that
-     * doing so would not break the chain of any trusted
-     * certificate.
-     *
-     * @param issuerCertificate - the CA certificate to check
-     * @returns `true` if at least one trusted certificate was
-     *   signed by this issuer.
-     */
-    isIssuerInUseByTrustedCertificate(issuerCertificate: Certificate): Promise<boolean>;
-    /**
-     *  find the issuer certificate among the trusted  issuer certificates.
-     *
-     *  The findIssuerCertificate method is an asynchronous method that attempts to find
-     *  the issuer certificate for a given certificate from the list of issuer certificate declared in the PKI
-     *
-     *  - If the certificate is self-signed, it returns the certificate itself.
-     *
-     *  - If the certificate has no extension 3, it is assumed to be generated by an old system, and a null value is returned.
-     *
-     *  - the method checks both issuer and trusted certificates and returns the appropriate issuercertificate,
-     *    if found. If multiple matching certificates are found, a warning is logged to the console.
-     *
-     */
-    findIssuerCertificate(certificate: Certificate | Certificate[]): Promise<Certificate | null>;
-    /**
-     * Outcome status for {@link CertificateManager.completeCertificateChain}.
-     */
-    static readonly ChainCompletionStatus: typeof ChainCompletionStatus;
-    /**
-     * Complete a certificate chain by walking the issuer store.
-     *
-     * Starting from the last certificate in the provided chain, this method
-     * repeatedly calls {@link findIssuerCertificate} to locate the parent
-     * certificate until it reaches a self-signed root or can no longer find
-     * an issuer.
-     *
-     * @param chain - the (potentially partial) certificate chain, leaf first
-     * @param maxDepth - maximum number of issuers to append (default: 10)
-     * @returns a {@link ChainCompletionResult} containing the (possibly completed)
-     *          chain, a status code, and an optional diagnostic message.
-     */
-    completeCertificateChain(chain: Certificate[], maxDepth?: number): Promise<ChainCompletionResult>;
-    /**
-     * Check whether a certificate has been revoked by its issuer's CRL.
-     *
-     * - Self-signed certificates are never considered revoked.
-     * - If no `issuerCertificate` is provided, the method attempts
-     *   to find it via {@link findIssuerCertificate}.
-     *
-     * @param certificate - the DER-encoded certificate to check
-     * @param issuerCertificate - optional issuer certificate; looked
-     *   up automatically when omitted
-     * @returns `Good` if not revoked, `BadCertificateRevoked` if the
-     *   serial number appears in a CRL,
-     *   `BadCertificateRevocationUnknown` if no CRL is available,
-     *   or `BadCertificateChainIncomplete` if the issuer cannot be
-     *   found.
-     */
-    isCertificateRevoked(certificate: Certificate | Certificate[], issuerCertificate?: Certificate | null): Promise<VerificationStatus>;
-}
-
-/**
- * Options for creating a PFX (PKCS#12) file.
- */
-interface CreatePFXOptions {
-    /** Path to the certificate file (PEM or DER). */
-    certificateFile: Filename;
-    /** Path to the private key file (PEM, plaintext or encrypted PKCS#8). */
-    privateKeyFile: Filename;
-    /**
-     * Passphrase that decrypts `privateKeyFile` if it is an encrypted
-     * PKCS#8 key (e.g. a `CertificateManager` created with
-     * `privateKeyPassphrase`). Omit for a plaintext key. This is distinct
-     * from `passphrase`, which protects the *output* PFX bundle.
-     */
-    privateKeyPassphrase?: string;
-    /** Output path for the generated PFX file. */
-    outputFile: Filename;
-    /**
-     * Optional passphrase to protect the PFX file.
-     * If omitted, the PFX is created without a password.
-     */
-    passphrase?: string;
-    /**
-     * Optional path(s) to CA / intermediate certificate files
-     * to include in the PFX bundle.
-     */
-    caCertificateFiles?: Filename[];
-    /**
-     * Optional display label stored on the bundle, the equivalent of
-     * openssl's `-name`. The Windows certificate store and `keytool` show
-     * it; {@link extractAllFromPFX} and {@link dumpPFX} report it back.
-     */
-    friendlyName?: string;
-}
-/**
- * Options for extracting data from a PFX (PKCS#12) file.
- */
-interface ExtractPFXOptions {
-    /** Path to the PFX file. */
-    pfxFile: Filename;
-    /**
-     * Passphrase used when the PFX was created.
-     * Pass an empty string for unprotected PFX files.
-     */
-    passphrase?: string;
-}
-/**
- * Result of extracting data from a PFX file.
- */
-interface ExtractPFXResult {
-    /** The certificate in PEM format. */
-    certificate: string;
-    /** The private key in PEM format. */
-    privateKey: string;
-    /**
-     * The CA / intermediate certificates in PEM format
-     * (empty string if none).
-     */
-    caCertificates: string;
-    /** The display label the bundle carries, if it has one. */
-    friendlyName?: string;
-}
-/**
- * Create a PFX (PKCS#12) file from a certificate and private key.
- *
- * The bundle is protected with PBES2 / AES-256-CBC under an SHA-256 MAC. If
- * `certificateFile` holds more than one PEM block, the first is the
- * identity and the rest join the issuer chain, ahead of any
- * `caCertificateFiles`.
- *
- * Nothing is written unless every input reads back cleanly and the private
- * key belongs to the certificate, so a wrong `privateKeyPassphrase` or a
- * mismatched pair leaves no half-made file behind.
- *
- * @param options - see {@link CreatePFXOptions}
- */
-declare function createPFX(options: CreatePFXOptions): Promise<void>;
-/**
- * Extract the client/server certificate from a PFX file.
- *
- * @returns the certificate in PEM format.
- */
-declare function extractCertificateFromPFX(options: ExtractPFXOptions): Promise<string>;
-/**
- * Extract the private key from a PFX file.
- *
- * @returns the private key as unencrypted PKCS#8 PEM.
- */
-declare function extractPrivateKeyFromPFX(options: ExtractPFXOptions): Promise<string>;
-/**
- * Extract the CA / intermediate certificates from a PFX file.
- *
- * @returns the CA certificates in PEM format
- *          (empty string if none are present).
- */
-declare function extractCACertificatesFromPFX(options: ExtractPFXOptions): Promise<string>;
-/**
- * Extract certificate + private key + CA certs from a PFX file
- * in a single call.
- *
- * Prefer this over the single-part helpers when you want more than one
- * part: the file is read, decrypted and MAC-verified once here, against
- * once per part.
- *
- * @returns an {@link ExtractPFXResult} with all PEM-encoded parts.
- */
-declare function extractAllFromPFX(options: ExtractPFXOptions): Promise<ExtractPFXResult>;
-/**
- * Convert a PFX file to a single PEM file holding the private key, the
- * certificate, and any issuer certificates the bundle carries, in that
- * order.
- */
-declare function convertPFXtoPEM(pfxFile: Filename, pemFile: Filename, passphrase?: string): Promise<void>;
-/**
- * Dump the contents of a PFX file in human-readable form.
- *
- * The layout is this package's own, not `openssl pkcs12 -info`'s: it
- * describes the identity the bundle carries rather than the algorithms it
- * was encrypted with, and it states outright whether the enclosed key
- * matches the enclosed certificate - the question a bundle that will not
- * load is usually being asked. Treat the text as something to read, not to
- * parse; use {@link extractAllFromPFX} to get at the parts.
- *
- * @returns the human-readable dump as a string.
- */
-declare function dumpPFX(pfxFile: Filename, passphrase?: string): Promise<string>;
-
-export { type AddCertificateValidationOptions, CaBackend, CertificateAuthority, CertificateAuthorityCore, CertificateAuthorityCoreOptions, type CertificateAuthorityOptions, CertificateManager, type CertificateManagerEvents, type CertificateManagerOptions, CertificateManagerState, type CertificateStore, type ChainCompletionResult, ChainCompletionStatus, type CreatePFXOptions, CreateSelfSignCertificateParam, type CreateSelfSignCertificateParam1, type CrlStore, type ExtractPFXOptions, type ExtractPFXResult, Filename, KeySize, OpenSslCaBackend, Params, PrivateKeyPassphrase, PrivateKeyProvider, ProcessAltNamesParam, VerificationStatus, type VerifyCertificateOptions, coerceCertificateChain, convertPFXtoPEM, createPFX, dumpPFX, extractAllFromPFX, extractCACertificatesFromPFX, extractCertificateFromPFX, extractPrivateKeyFromPFX, findIssuerCertificateInChain, install_prerequisite, isIntermediateIssuer, isIssuer, isRootIssuer, makeFingerprint, safeStoreJoin, toFilenameLabel };