node-opcua-pki 6.22.1 → 7.0.0

package/dist/index.mjs

@@ -1,3145 +0,0 @@
-import {
-  CertificateAuthorityCore,
-  NativeCaBackend,
-  Subject,
-  adjustApplicationUri,
-  adjustDate,
-  debugLog,
-  display,
-  displayError,
-  displaySubtitle,
-  displayTitle,
-  doDebug,
-  ensurePrivateDirectory,
-  g_config,
-  isEncryptedPrivateKeyFile,
-  isOpaqueSigner,
-  makePath,
-  mkdirRecursiveSync,
-  quote,
-  resolvePrivateKeyPassphrase,
-  restrictPrivateFilePermissions,
-  warningLog
-} from "./chunk-EQ4DGI4M.mjs";
-
-// packages/node-opcua-pki/lib/index.ts
-import {
-  PrivateKeyPassphraseRequiredError,
-  PrivateKeyUnavailableError as PrivateKeyUnavailableError2
-} from "node-opcua-crypto";
-
-// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
-import fs4 from "fs";
-import path3 from "path";
-import { Subject as Subject2 } from "node-opcua-crypto";
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/_env.ts
-var SAFE_ENV_PASSTHROUGH = /* @__PURE__ */ new Set([
-  // POSIX/Windows shell and process essentials
-  "path",
-  "home",
-  "userprofile",
-  "temp",
-  "tmp",
-  "tmpdir",
-  "systemroot",
-  "windir",
-  "comspec",
-  "pathext",
-  "appdata",
-  "localappdata",
-  // dynamic loader: a custom-built or relocated openssl (e.g. under /opt,
-  // or Homebrew on macOS) may need these to find its own libcrypto/libssl
-  "ld_library_path",
-  "dyld_library_path",
-  "dyld_fallback_library_path",
-  // locale, so openssl's textual output stays parseable
-  "lang",
-  "lc_all",
-  "lc_ctype",
-  // openssl configuration this app, or the host OS/user, may rely on
-  "openssl_conf",
-  "randfile",
-  "openssl_modules",
-  "openssl_engines",
-  "ssl_cert_file",
-  "ssl_cert_dir"
-]);
-function buildChildEnv(extra) {
-  const env = {};
-  for (const key of Object.keys(process.env)) {
-    if (SAFE_ENV_PASSTHROUGH.has(key.toLowerCase())) {
-      env[key] = process.env[key];
-    }
-  }
-  return { ...env, ...extra };
-}
-function redactEnvForLog(options) {
-  const { env, ...rest } = options;
-  return env ? { ...rest, env: Object.keys(env) } : rest;
-}
-var exportedEnvVars = {};
-function setEnv(varName, value) {
-  if (!g_config.silent) {
-    warningLog(`          set ${varName}=${value}`);
-  }
-  exportedEnvVars[varName] = value;
-  if (["OPENSSL_CONF"].indexOf(varName) >= 0) {
-    process.env[varName] = value;
-  }
-  if (["RANDFILE"].indexOf(varName) >= 0) {
-    process.env[varName] = value;
-  }
-}
-function hasEnv(varName) {
-  return Object.prototype.hasOwnProperty.call(exportedEnvVars, varName);
-}
-function getEnv(varName) {
-  return exportedEnvVars[varName];
-}
-function unsetEnv(varName) {
-  delete exportedEnvVars[varName];
-}
-function getEnvironmentVarNames() {
-  return Object.keys(exportedEnvVars).map((varName) => {
-    return { key: varName, pattern: `\\$ENV\\:\\:${varName}` };
-  });
-}
-function buildSubjectAltNameString(params) {
-  return [
-    `URI:${params.applicationUri}`,
-    ...(params.dns ?? []).map((d) => `DNS:${d}`),
-    ...(params.ip ?? []).map((d) => `IP:${d}`)
-  ].join(", ");
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
-import assert from "assert";
-import child_process2 from "child_process";
-import fs2 from "fs";
-import os2 from "os";
-import byline2 from "byline";
-import chalk2 from "chalk";
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/install_prerequisite.ts
-import child_process from "child_process";
-import fs from "fs";
-import os from "os";
-import path from "path";
-import { pipeline } from "stream/promises";
-import byline from "byline";
-import chalk from "chalk";
-import yauzl from "yauzl";
-var doDebug2 = process.env.NODEOPCUAPKIDEBUG || false;
-async function execute(file, args, cwd) {
-  let output = "";
-  return await new Promise((resolve, reject) => {
-    const child = child_process.spawn(file, args, {
-      cwd,
-      windowsHide: true,
-      env: buildChildEnv(),
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    child.on("error", (err) => reject(err));
-    child.on("close", (code) => resolve({ exitCode: code ?? 1, output }));
-    const stream1 = byline(child.stdout);
-    stream1.on("data", (line) => {
-      output += `${line}
-`;
-      if (doDebug2) {
-        process.stdout.write(`        stdout ${chalk.yellow(line)}
-`);
-      }
-    });
-  });
-}
-function is_expected_openssl_version(strVersion) {
-  return !!strVersion.match(/OpenSSL \d/);
-}
-async function getopensslExecPath() {
-  let result1;
-  try {
-    result1 = await execute("which", ["openssl"]);
-  } catch (err) {
-    warningLog("warning: ", err.message);
-    throw new Error("Cannot find openssl");
-  }
-  const exitCode = result1?.exitCode;
-  const output = result1?.output;
-  if (exitCode !== 0) {
-    warningLog(chalk.yellow(" it seems that ") + chalk.cyan("openssl") + chalk.yellow(" is not installed on your computer "));
-    warningLog(chalk.yellow("Please install it before running this programs"));
-    throw new Error("Cannot find openssl");
-  }
-  const opensslExecPath = output.replace(/\n\r/g, "").trim();
-  return opensslExecPath;
-}
-async function check_system_openssl_version() {
-  const opensslExecPath = await getopensslExecPath();
-  if (doDebug2) {
-    warningLog(`              OpenSSL found in : ${chalk.yellow(opensslExecPath)}`);
-  }
-  const result = await execute(opensslExecPath, ["version"]);
-  const exitCode = result?.exitCode;
-  const output = result?.output;
-  const version = output.trim();
-  const versionOK = exitCode === 0 && is_expected_openssl_version(version);
-  if (!versionOK) {
-    let message = chalk.whiteBright("Warning !!!!!!!!!!!! ") + "\nyour version of openssl is " + version + ". It doesn't match the expected version";
-    if (process.platform === "darwin") {
-      message += chalk.cyan("\nplease refer to :") + chalk.yellow(" https://github.com/node-opcua/node-opcua/wiki/installing-node-opcua-or-node-red-on-MacOS");
-    }
-    console.log(message);
-  }
-  return output;
-}
-async function install_and_check_win32_openssl_version() {
-  const downloadFolder = path.join(os.tmpdir(), ".");
-  function get_openssl_folder_win32() {
-    if (process.env.LOCALAPPDATA) {
-      const userProgramFolder = path.join(process.env.LOCALAPPDATA, "Programs");
-      if (fs.existsSync(userProgramFolder)) {
-        return path.join(userProgramFolder, "openssl");
-      }
-    }
-    return path.join(process.cwd(), "openssl");
-  }
-  function get_openssl_exec_path_win32() {
-    const opensslFolder2 = get_openssl_folder_win32();
-    return path.join(opensslFolder2, "openssl.exe");
-  }
-  async function check_openssl_win32() {
-    const opensslExecPath2 = get_openssl_exec_path_win32();
-    const exists = fs.existsSync(opensslExecPath2);
-    if (!exists) {
-      warningLog("checking presence of ", opensslExecPath2);
-      warningLog(chalk.red(" cannot find file ") + opensslExecPath2);
-      return {
-        opensslOk: false,
-        version: `cannot find file ${opensslExecPath2}`
-      };
-    } else {
-      const cwd = ".";
-      const { exitCode, output } = await execute(opensslExecPath2, ["version"], cwd);
-      const version = output.trim();
-      if (doDebug2) {
-        warningLog(" Version = ", version);
-      }
-      return {
-        opensslOk: exitCode === 0 && is_expected_openssl_version(version),
-        version
-      };
-    }
-  }
-  async function find_system_openssl_win32() {
-    try {
-      const result = await execute("where", ["openssl"]);
-      if (result.exitCode !== 0) {
-        return void 0;
-      }
-      const opensslPath2 = result.output.split(/\r?\n/)[0].trim();
-      if (!opensslPath2 || !fs.existsSync(opensslPath2)) {
-        return void 0;
-      }
-      const versionResult = await execute(opensslPath2, ["version"]);
-      const version = versionResult.output.trim();
-      if (versionResult.exitCode === 0 && is_expected_openssl_version(version)) {
-        warningLog(
-          chalk.green("Using system OpenSSL: ") + chalk.cyan(version) + chalk.green(" at ") + chalk.cyan(opensslPath2)
-        );
-        return opensslPath2;
-      }
-      warningLog(chalk.yellow("System OpenSSL found but version not accepted: ") + version);
-      return void 0;
-    } catch (_err) {
-      return void 0;
-    }
-  }
-  function win32or64() {
-    if (process.env.PROCESSOR_ARCHITECTURE === "x86" && process.env.PROCESSOR_ARCHITEW6432) {
-      return 64;
-    }
-    if (process.env.PROCESSOR_ARCHITECTURE === "AMD64") {
-      return 64;
-    }
-    if (process.env.CURRENT_CPU === "x64") {
-      return 64;
-    }
-    return 32;
-  }
-  async function download_openssl() {
-    const url = win32or64() === 64 ? "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-x64_86-win64.zip" : "https://github.com/node-opcua/node-opcua-pki/releases/download/2.14.2/openssl-1.0.2u-i386-win32.zip";
-    const outputFilename = path.join(downloadFolder, path.basename(url));
-    warningLog(`downloading ${chalk.yellow(url)} to ${outputFilename}`);
-    if (fs.existsSync(outputFilename)) {
-      return { downloadedFile: outputFilename };
-    }
-    const response = await fetch(url, { redirect: "follow" });
-    if (!response.ok || !response.body) {
-      throw new Error(`Failed to download OpenSSL from ${url}: ${response.status} ${response.statusText}`);
-    }
-    const contentLength = parseInt(response.headers.get("content-length") || "0", 10);
-    let downloaded = 0;
-    let lastPercent = -1;
-    const fileStream = fs.createWriteStream(outputFilename);
-    const body = response.body;
-    body.on("data", (chunk) => {
-      downloaded += chunk.length;
-      if (contentLength > 0) {
-        const percent = Math.floor(downloaded / contentLength * 100);
-        if (percent !== lastPercent && percent % 10 === 0) {
-          lastPercent = percent;
-          warningLog(`  download progress: ${percent}%`);
-        }
-      }
-    });
-    await pipeline(body, fileStream);
-    const stat = fs.statSync(outputFilename);
-    if (stat.size === 0) {
-      fs.unlinkSync(outputFilename);
-      throw new Error(`Downloaded file is empty: ${outputFilename}`);
-    }
-    warningLog(chalk.green("Download complete: ") + `${stat.size} bytes`);
-    return { downloadedFile: outputFilename };
-  }
-  async function unzip_openssl(zipFilename) {
-    const opensslFolder2 = get_openssl_folder_win32();
-    const zipFile = await new Promise((resolve, reject) => {
-      yauzl.open(zipFilename, { lazyEntries: true }, (err, zipfile) => {
-        if (err) {
-          reject(err);
-        } else {
-          if (!zipfile) {
-            reject(new Error("zipfile is null"));
-          } else {
-            resolve(zipfile);
-          }
-        }
-      });
-    });
-    zipFile.readEntry();
-    await new Promise((resolve, reject) => {
-      zipFile.on("end", (err) => {
-        setImmediate(() => {
-          if (doDebug2) {
-            warningLog("unzip done");
-          }
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
-      zipFile.on("entry", (entry) => {
-        zipFile.openReadStream(entry, (err, readStream) => {
-          if (err) {
-            return reject(err);
-          }
-          const file = path.join(opensslFolder2, entry.fileName);
-          if (doDebug2) {
-            warningLog(" unzipping :", file);
-          }
-          const writeStream = fs.createWriteStream(file, "binary");
-          readStream?.pipe(writeStream);
-          writeStream.on("close", () => {
-            zipFile.readEntry();
-          });
-        });
-      });
-    });
-  }
-  const systemOpenssl = await find_system_openssl_win32();
-  if (systemOpenssl) {
-    return systemOpenssl;
-  }
-  const opensslFolder = get_openssl_folder_win32();
-  const opensslExecPath = get_openssl_exec_path_win32();
-  if (!fs.existsSync(opensslFolder)) {
-    if (doDebug2) {
-      warningLog("creating openssl_folder", opensslFolder);
-    }
-    fs.mkdirSync(opensslFolder);
-  }
-  const { opensslOk, version: _version } = await check_openssl_win32();
-  if (!opensslOk) {
-    warningLog(chalk.yellow("openssl seems to be missing and need to be installed"));
-    const { downloadedFile } = await download_openssl();
-    if (doDebug2) {
-      warningLog("deflating ", chalk.yellow(downloadedFile));
-    }
-    await unzip_openssl(downloadedFile);
-    const opensslExists = !!fs.existsSync(opensslExecPath);
-    if (doDebug2) {
-      warningLog("verifying ", opensslExists, opensslExists ? chalk.green("OK ") : chalk.red(" Error"), opensslExecPath);
-    }
-    const _opensslExecPath2 = await check_openssl_win32();
-    return opensslExecPath;
-  } else {
-    if (doDebug2) {
-      warningLog(chalk.green("openssl is already installed and have the expected version."));
-    }
-    return opensslExecPath;
-  }
-}
-async function install_prerequisite() {
-  if (process.platform !== "win32") {
-    return await check_system_openssl_version();
-  } else {
-    return await install_and_check_win32_openssl_version();
-  }
-}
-async function get_openssl_exec_path() {
-  if (process.platform === "win32") {
-    const opensslExecPath = await install_prerequisite();
-    if (!fs.existsSync(opensslExecPath)) {
-      throw new Error(`internal error cannot find ${opensslExecPath}`);
-    }
-    return opensslExecPath;
-  } else {
-    return "openssl";
-  }
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/execute_openssl.ts
-var opensslPath;
-var n = makePath;
-var PASSIN_ENV_VAR = "NODE_OPCUA_PKI_OPENSSL_PASSIN";
-function passinArg(passphrase = "") {
-  return { args: ["-passin", `env:${PASSIN_ENV_VAR}`], env: { [PASSIN_ENV_VAR]: passphrase } };
-}
-function renderForDisplay(file, args) {
-  return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
-}
-function hasUnsafeArgChar(value) {
-  for (const ch of value) {
-    const code = ch.codePointAt(0);
-    if (code < 32 || code === 127) {
-      return true;
-    }
-    if (code < 128) {
-      continue;
-    }
-    if (/[\p{L}\p{N}\p{M}]/u.test(ch)) {
-      continue;
-    }
-    return true;
-  }
-  return false;
-}
-function checkArgs(file, args) {
-  for (const value of [file, ...args]) {
-    if (typeof value === "string" && hasUnsafeArgChar(value)) {
-      throw new Error(`execute_openssl: refusing argument with an unexpected character: ${JSON.stringify(value)}`);
-    }
-  }
-}
-async function execute2(file, args, options) {
-  const from = new Error();
-  checkArgs(file, args);
-  options.cwd = options.cwd || process.cwd();
-  if (!g_config.silent) {
-    warningLog(chalk2.cyan("                  CWD         "), options.cwd);
-  }
-  const outputs = [];
-  const errorOutputs = [];
-  const display2 = renderForDisplay(file, args);
-  return await new Promise((resolve, reject) => {
-    const child = child_process2.spawn(file, [...args], {
-      cwd: options.cwd,
-      windowsHide: true,
-      env: buildChildEnv(options.env),
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const fail = (message) => {
-      if (!options.hideErrorMessage && !g_config.silent) {
-        const fence = "###########################################";
-        console.error(chalk2.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-        console.error(chalk2.bgWhiteBright.redBright(`CWD = ${options.cwd}`));
-        console.error(chalk2.bgWhiteBright.redBright(message));
-        console.error(chalk2.bgWhiteBright.redBright(`${fence} OPENSSL ERROR ${fence}`));
-        console.error(from.stack);
-      }
-      reject(new Error(message));
-    };
-    child.on("error", (err) => fail(`Command failed: ${display2}
-${err.message}`));
-    child.on("close", (code, signal) => {
-      if (code === 0) {
-        resolve(outputs.join(""));
-        return;
-      }
-      const why = signal ? `signal ${signal}` : `exit code ${code}`;
-      fail(`Command failed: ${display2}
-${errorOutputs.join("")}(${why})`);
-    });
-    if (child.stdout) {
-      const stream2 = byline2(child.stdout);
-      stream2.on("data", (line) => {
-        outputs.push(`${line}
-`);
-      });
-      if (!g_config.silent) {
-        stream2.on("data", (line) => {
-          line = line.toString();
-          if (doDebug) {
-            process.stdout.write(`${chalk2.white("        stdout ") + chalk2.whiteBright(line)}
-`);
-          }
-        });
-      }
-    }
-    if (child.stderr) {
-      const stream1 = byline2(child.stderr);
-      stream1.on("data", (line) => {
-        line = line.toString();
-        errorOutputs.push(`${line}
-`);
-        if (!g_config.silent && displayError) {
-          process.stdout.write(`${chalk2.white("        stderr ") + chalk2.red(line)}
-`);
-        }
-      });
-    }
-  });
-}
-async function find_openssl() {
-  return await get_openssl_exec_path();
-}
-async function ensure_openssl_installed() {
-  if (!opensslPath) {
-    opensslPath = await find_openssl();
-    const outputs = await execute_openssl(["version"], { cwd: "." });
-    g_config.opensslVersion = outputs.trim();
-    if (doDebug) {
-      warningLog("OpenSSL version : ", g_config.opensslVersion);
-    }
-  }
-}
-async function execute_openssl_no_failure(args, options) {
-  options = options || {};
-  options.hideErrorMessage = true;
-  try {
-    return await execute_openssl(args, options);
-  } catch (err) {
-    debugLog(" (ignored error =  ERROR : )", err.message);
-  }
-}
-function getTempFolder() {
-  return os2.tmpdir();
-}
-async function execute_openssl(args, options) {
-  debugLog("execute_openssl", args, redactEnvForLog(options));
-  const empty_config_file = n(getTempFolder(), "empty_config.cnf");
-  if (!fs2.existsSync(empty_config_file)) {
-    await fs2.promises.writeFile(empty_config_file, "# empty config file");
-  }
-  options = options || {};
-  options.openssl_conf = options.openssl_conf || empty_config_file;
-  assert(options.openssl_conf);
-  setEnv("OPENSSL_CONF", options.openssl_conf);
-  if (!g_config.silent) {
-    warningLog(chalk2.cyan("                  OPENSSL_CONF"), process.env.OPENSSL_CONF);
-    warningLog(chalk2.cyan("                  RANDFILE    "), process.env.RANDFILE);
-    warningLog(chalk2.cyan("                  CMD         "), chalk2.cyanBright(renderForDisplay("openssl", args)));
-  }
-  await ensure_openssl_installed();
-  return await execute2(opensslPath, args, options);
-}
-
-// packages/node-opcua-pki/lib/toolbox/with_openssl/toolbox.ts
-import assert2 from "assert";
-import fs3 from "fs";
-import path2 from "path";
-function openssl_require2DigitYearInDate() {
-  if (!g_config.opensslVersion) {
-    throw new Error(
-      "openssl_require2DigitYearInDate : openssl version is not known:  please call ensure_openssl_installed()"
-    );
-  }
-  return g_config.opensslVersion.match(/OpenSSL 0\.9/);
-}
-g_config.opensslVersion = "";
-var _counter = 0;
-function stripConditionalBlocks(template, envOverrides) {
-  return template.replace(/\{\{#([A-Z_][A-Z0-9_]*)\}\}([\s\S]*?)\{\{\/\1\}\}\r?\n?/g, (_match, key, content) => {
-    const keep = envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, key) ? envOverrides[key] !== "" : hasEnv(key) && getEnv(key) !== "";
-    return keep ? content : "";
-  });
-}
-function generateStaticConfig(configPath, options, envOverrides) {
-  const prePath = options?.cwd || "";
-  const originalFilename = !path2.isAbsolute(configPath) ? path2.join(prePath, configPath) : configPath;
-  let staticConfig = fs3.readFileSync(originalFilename, { encoding: "utf8" });
-  staticConfig = stripConditionalBlocks(staticConfig, envOverrides);
-  for (const envVar of getEnvironmentVarNames()) {
-    if (envOverrides && Object.prototype.hasOwnProperty.call(envOverrides, envVar.key)) {
-      continue;
-    }
-    staticConfig = staticConfig.replace(new RegExp(envVar.pattern, "gi"), () => getEnv(envVar.key));
-  }
-  if (envOverrides) {
-    for (const [key, value] of Object.entries(envOverrides)) {
-      staticConfig = staticConfig.replace(new RegExp(`\\$ENV\\:\\:${key}`, "gi"), () => value);
-    }
-  }
-  const staticConfigPath = `${configPath}.${process.pid}-${_counter++}.tmp`;
-  const temporaryConfigPath = !path2.isAbsolute(configPath) ? path2.join(prePath, staticConfigPath) : staticConfigPath;
-  fs3.writeFileSync(temporaryConfigPath, staticConfig);
-  if (options?.cwd) {
-    return path2.relative(options.cwd, temporaryConfigPath);
-  } else {
-    return temporaryConfigPath;
-  }
-}
-async function cleanupStaticConfig(configFile, options) {
-  await fs3.promises.rm(path2.resolve(options?.cwd ?? "", configFile), { force: true });
-}
-function x509Date(date) {
-  date = date || /* @__PURE__ */ new Date();
-  const Y = date.getUTCFullYear();
-  const M = date.getUTCMonth() + 1;
-  const D = date.getUTCDate();
-  const h = date.getUTCHours();
-  const m = date.getUTCMinutes();
-  const s = date.getUTCSeconds();
-  function w(s2, l) {
-    return `${s2}`.padStart(l, "0");
-  }
-  if (openssl_require2DigitYearInDate()) {
-    return `${w(Y, 2) + w(M, 2) + w(D, 2) + w(h, 2) + w(m, 2) + w(s, 2)}Z`;
-  } else {
-    return `${w(Y, 4) + w(M, 2) + w(D, 2) + w(h, 2) + w(m, 2) + w(s, 2)}Z`;
-  }
-}
-
-// packages/node-opcua-pki/lib/ca/backends/openssl_ca_backend.ts
-var n2 = makePath;
-function caAltName(ca) {
-  return `URI:urn:${ca.subject.commonName || "NodeOPCUA-CA"}`;
-}
-function caConfigEnvOverrides(ca, altName = caAltName(ca)) {
-  const aiaLegs = [];
-  if (ca.ocspResponderUrl) {
-    aiaLegs.push(`OCSP;URI:${ca.ocspResponderUrl}`);
-  }
-  if (ca.caIssuersUrl) {
-    aiaLegs.push(`caIssuers;URI:${ca.caIssuersUrl}`);
-  }
-  return {
-    ALTNAME: altName,
-    CDP_URL: ca.crlDistributionUrl ?? "",
-    AIA_VALUE: aiaLegs.join(",")
-  };
-}
-var OpenSslCaBackend = class {
-  /** This backend is the `openssl` executable, so it has to be there. */
-  /**
-   * `-passin env:` argv and env for an openssl call that has to load this
-   * CA's key. Built here rather than on the CA: the passphrase is the
-   * CA's business, but expressing it as an openssl argument is this
-   * backend's, and the core has no reason to know the flag exists.
-   */
-  async #passin(ca) {
-    return passinArg(await ca._privateKeyPassphrase());
-  }
-  /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
-  supportsExternalSigner = false;
-  async preflight() {
-    await ensure_openssl_installed();
-  }
-  /**
-   * Render `conf/caconfig.cnf` once with explicit overrides, run `fn`
-   * with the rendered path, and always remove the temp file. Structural
-   * guarantee that (a) every render carries the three required env
-   * values and (b) no rendered `<name>.<pid>-<n>.tmp` file is ever left
-   * behind — each was previously a per-method discipline.
-   */
-  async #withConfig(ca, altName, fn) {
-    const caRootDir = path3.resolve(ca.rootDir);
-    const options = { cwd: caRootDir };
-    const configFile = generateStaticConfig("conf/caconfig.cnf", options, caConfigEnvOverrides(ca, altName));
-    try {
-      return await fn(configFile, options);
-    } finally {
-      await cleanupStaticConfig(configFile, options);
-    }
-  }
-  async #generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile) {
-    const passin = await this.#passin(ca);
-    displayTitle("Generate a certificate request for the CA key");
-    await execute_openssl(
-      [
-        "req",
-        "-new",
-        "-sha256",
-        "-extensions",
-        "v3_ca_req",
-        "-config",
-        n2(configFile),
-        "-key",
-        n2(privateKeyFile),
-        "-out",
-        n2(csrFile),
-        "-subj",
-        ca.subject.toString(),
-        ...passin.args
-      ],
-      { ...options, env: passin.env }
-    );
-  }
-  /**
-   * `openssl ca -gencrl` signs the CRL with the CA key it finds through the
-   * config file (`private_key = $dir/private/cakey.pem`), so it needs the
-   * CA passphrase like every other `openssl ca` invocation.
-   */
-  async #regenerateCrlWith(ca, configFile, options) {
-    const passin = await this.#passin(ca);
-    displaySubtitle("regenerate CRL (Certificate Revocation List)");
-    await execute_openssl(["ca", "-gencrl", "-config", n2(configFile), "-out", "crl/revocation_list.crl", ...passin.args], {
-      ...options,
-      env: passin.env
-    });
-    await execute_openssl(
-      ["crl", "-in", "crl/revocation_list.crl", "-out", "crl/revocation_list.der", "-outform", "der"],
-      options
-    );
-    displaySubtitle("Display (Certificate Revocation List)");
-    await execute_openssl(["crl", "-in", n2(ca.revocationList), "-text", "-noout"], options);
-  }
-  async generateCaCsr(ca, _caRootDir, privateKeyFile, csrFile) {
-    await this.#withConfig(
-      ca,
-      caAltName(ca),
-      (configFile, options) => this.#generateCaCsrWith(ca, configFile, options, privateKeyFile, csrFile)
-    );
-  }
-  async bootstrap(ca) {
-    const caRootDir = path3.resolve(ca.rootDir);
-    const privateKeyFilename = path3.join(caRootDir, "private/cakey.pem");
-    const csrFilename = path3.join(caRootDir, "private/cakey.csr");
-    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
-      await this.#generateCaCsrWith(ca, configFile, options, privateKeyFilename, csrFilename);
-      const issuerCA = ca._issuerCA;
-      if (issuerCA) {
-        displayTitle("Generate CA Certificate (signed by issuer CA)");
-        const issuerCert = path3.resolve(issuerCA.caCertificate);
-        const issuerKey = path3.resolve(issuerCA.rootDir, "private/cakey.pem");
-        const issuerSerial = path3.resolve(issuerCA.rootDir, "serial");
-        const issuerPassin = await this.#passin(issuerCA);
-        const signWithIssuer = async () => {
-          await execute_openssl(
-            [
-              "x509",
-              "-sha256",
-              "-req",
-              "-days",
-              "3650",
-              "-extensions",
-              "v3_ca",
-              "-extfile",
-              n2(configFile),
-              "-in",
-              "private/cakey.csr",
-              "-CA",
-              n2(issuerCert),
-              "-CAkey",
-              n2(issuerKey),
-              "-CAserial",
-              n2(issuerSerial),
-              "-out",
-              "public/cacert.pem",
-              ...issuerPassin.args
-            ],
-            { ...options, env: issuerPassin.env }
-          );
-        };
-        if (path3.resolve(issuerCA.rootDir) === caRootDir) {
-          await signWithIssuer();
-        } else {
-          await issuerCA._withCaDirectoryLock(signWithIssuer);
-        }
-      } else {
-        displayTitle("Generate CA Certificate (self-signed)");
-        const passin = await this.#passin(ca);
-        await execute_openssl(
-          [
-            "x509",
-            "-sha256",
-            "-req",
-            "-days",
-            "3650",
-            "-extensions",
-            "v3_ca",
-            "-extfile",
-            n2(configFile),
-            "-in",
-            "private/cakey.csr",
-            "-signkey",
-            n2(privateKeyFilename),
-            "-out",
-            "public/cacert.pem",
-            ...passin.args
-          ],
-          { ...options, env: passin.env }
-        );
-      }
-      displaySubtitle("generate initial CRL (Certificate Revocation List)");
-      await this.#regenerateCrlWith(ca, configFile, options);
-    });
-    displayTitle("Create Certificate Authority (CA) ---> DONE");
-  }
-  async regenerateCrl(ca) {
-    await this.#withConfig(ca, caAltName(ca), (configFile, options) => this.#regenerateCrlWith(ca, configFile, options));
-  }
-  async signSubordinateCsr(ca, csrFile, certFile, validityDays) {
-    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
-      const caRootDir = options.cwd;
-      const passin = await this.#passin(ca);
-      await execute_openssl(
-        [
-          "x509",
-          "-sha256",
-          "-req",
-          "-days",
-          String(validityDays),
-          "-extensions",
-          "v3_ca",
-          "-extfile",
-          n2(configFile),
-          "-in",
-          n2(csrFile),
-          "-CA",
-          n2(ca.caCertificate),
-          "-CAkey",
-          n2(path3.join(caRootDir, "private/cakey.pem")),
-          "-CAserial",
-          n2(path3.join(caRootDir, "serial")),
-          "-out",
-          n2(certFile),
-          ...passin.args
-        ],
-        { ...options, env: passin.env }
-      );
-    });
-  }
-  async signEndEntityCsr(ca, certificate, csr, params1, sanOverride) {
-    await this.#withConfig(ca, buildSubjectAltNameString(sanOverride), async (configFile, options) => {
-      displaySubtitle("- then we ask the authority to sign the certificate signing request");
-      const passin = await this.#passin(ca);
-      await execute_openssl(
-        [
-          "ca",
-          "-config",
-          configFile,
-          "-startdate",
-          x509Date(params1.startDate),
-          "-enddate",
-          x509Date(params1.endDate),
-          "-batch",
-          "-out",
-          n2(certificate),
-          "-in",
-          n2(csr),
-          ...passin.args
-        ],
-        { ...options, env: passin.env }
-      );
-      displaySubtitle("- dump the certificate for a check");
-      await execute_openssl(["x509", "-in", n2(certificate), "-dates", "-fingerprint", "-purpose", "-noout"], options);
-    });
-  }
-  async revoke(ca, certificate, reason) {
-    setEnv("RANDFILE", path3.join(ca.rootDir, "random.rnd"));
-    await this.#withConfig(ca, caAltName(ca), async (configFile, options) => {
-      displaySubtitle("Revoke certificate");
-      const passin = await this.#passin(ca);
-      await execute_openssl_no_failure(
-        ["ca", "-verbose", "-config", n2(configFile), "-revoke", certificate, "-crl_reason", reason, ...passin.args],
-        { ...options, env: passin.env }
-      );
-      await this.#regenerateCrlWith(ca, configFile, options);
-      displaySubtitle("Verify that certificate is revoked");
-      await execute_openssl_no_failure(
-        [
-          "verify",
-          "-verbose",
-          "-CRLfile",
-          n2(ca.revocationList),
-          "-CAfile",
-          n2(ca.caCertificate),
-          "-crl_check",
-          n2(certificate)
-        ],
-        options
-      );
-      displaySubtitle("Produce CRL in DER form ");
-      await execute_openssl(
-        ["crl", "-in", n2(ca.revocationList), "-out", "crl/revocation_list.der", "-outform", "der"],
-        options
-      );
-      displaySubtitle("Produce CRL in PEM form ");
-      await execute_openssl(
-        ["crl", "-in", n2(ca.revocationList), "-out", "crl/revocation_list.pem", "-outform", "pem", "-text"],
-        options
-      );
-    });
-  }
-  async createSelfSignedCertificate(ca, certificateFile, privateKeyFile, params) {
-    const envOverrides = caConfigEnvOverrides(ca, buildSubjectAltNameString(params));
-    const configFile = generateStaticConfig(ca.configFile, { cwd: ca.rootDir }, envOverrides);
-    const options = {
-      cwd: ca.rootDir,
-      openssl_conf: makePath(configFile)
-    };
-    try {
-      const subject = params.subject ? new Subject2(params.subject).toString() : "";
-      const subjectOptions = subject && subject.length > 1 ? ["-subj", subject] : [];
-      const csrFile = `${certificateFile}_csr`;
-      const passin = await this.#passin(ca);
-      displaySubtitle("- the certificate signing request");
-      await execute_openssl(
-        [
-          "req",
-          "-new",
-          "-sha256",
-          ...subjectOptions,
-          "-batch",
-          "-key",
-          n2(privateKeyFile),
-          "-out",
-          n2(csrFile),
-          ...passin.args
-        ],
-        { ...options, env: passin.env }
-      );
-      displaySubtitle("- creating the self-signed certificate");
-      await execute_openssl(
-        [
-          "ca",
-          "-selfsign",
-          "-keyfile",
-          n2(privateKeyFile),
-          "-startdate",
-          x509Date(params.startDate),
-          "-enddate",
-          x509Date(params.endDate),
-          "-batch",
-          "-out",
-          n2(certificateFile),
-          "-in",
-          n2(csrFile),
-          ...passin.args
-        ],
-        { ...options, env: passin.env }
-      );
-      displaySubtitle("- dump the certificate for a check");
-      await execute_openssl(["x509", "-in", n2(certificateFile), "-dates", "-fingerprint", "-purpose", "-noout"], {});
-      displaySubtitle("- verify self-signed certificate");
-      await execute_openssl_no_failure(["verify", "-verbose", "-CAfile", n2(certificateFile), n2(certificateFile)], options);
-      await fs4.promises.unlink(csrFile);
-    } finally {
-      await cleanupStaticConfig(configFile, { cwd: ca.rootDir });
-    }
-  }
-};
-
-// packages/node-opcua-pki/lib/ca/certificate_authority.ts
-var CertificateAuthority = class extends CertificateAuthorityCore {
-  constructor(options) {
-    if (options.signer && options.backend === "openssl") {
-      throw new Error(
-        "CertificateAuthority: backend 'openssl' cannot be combined with 'signer' - the openssl CLI loads its key from a file and cannot call an external signer. Drop the backend option (a signer implies 'native') or drop the signer."
-      );
-    }
-    const backend = options.signer || options.backend === "native" ? new NativeCaBackend() : new OpenSslCaBackend();
-    super({ ...options, backend });
-  }
-  /**
-   * @internal `-passin env:` argv + env for an openssl call that loads
-   * this CA's key (always emitted, empty when none).
-   *
-   * The openssl backend builds its own now; this remains so that external
-   * code calling it keeps working, and lives here rather than on the core
-   * because the flag means nothing to a backend that spawns nothing.
-   */
-  async _opensslPassin() {
-    return passinArg(await this._privateKeyPassphrase());
-  }
-  /**
-   * @internal
-   * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
-   * values to the shared env registry, or unset them so the matching
-   * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
-   * reads the registry any more - every openssl config render receives
-   * these values explicitly, from the same {@link caConfigEnvOverrides}
-   * builder this delegates to, so the two cannot drift - kept only for
-   * external code that renders openssl config templates against the
-   * registry directly.
-   *
-   * It lives on this class rather than the core because it is meaningful
-   * only to the openssl backend.
-   */
-  _wireRevocationEnvVars() {
-    const overrides = caConfigEnvOverrides(this);
-    if (overrides.CDP_URL) {
-      setEnv("CDP_URL", overrides.CDP_URL);
-    } else {
-      unsetEnv("CDP_URL");
-    }
-    if (overrides.AIA_VALUE) {
-      setEnv("AIA_VALUE", overrides.AIA_VALUE);
-    } else {
-      unsetEnv("AIA_VALUE");
-    }
-  }
-};
-
-// packages/node-opcua-pki/lib/pki/certificate_manager.ts
-import { EventEmitter } from "events";
-import fs7 from "fs";
-import path4 from "path";
-import { drainPendingLocks, withLock } from "@ster5/global-mutex";
-import chalk3 from "chalk";
-import chokidar from "chokidar";
-import {
-  caSignerFromKeyOperations,
-  exploreCertificate,
-  exploreCertificateInfo,
-  exploreCertificateRevocationList,
-  generatePrivateKeyFile,
-  keyOperationsFromPrivateKey,
-  makeSHA1Thumbprint,
-  PrivateKeyUnavailableError,
-  readCertificateChain,
-  readCertificateChainAsync,
-  readCertificateRevocationList,
-  readPrivateKey,
-  split_der,
-  toPem,
-  verifyCertificateSignature,
-  writePrivateKeyFile
-} from "node-opcua-crypto";
-
-// packages/node-opcua-pki/lib/toolbox/without_openssl/create_certificate_signing_request.ts
-import assert3 from "assert";
-import fs5 from "fs";
-import { coercePrivateKeyPem, createCertificateSigningRequest, pemToPrivateKey, Subject as Subject3 } from "node-opcua-crypto";
-async function createCertificateSigningRequestAsync(certificateSigningRequestFilename, params) {
-  assert3(params);
-  assert3(params.rootDir);
-  assert3(params.configFile);
-  assert3(params.privateKey);
-  if (typeof params.privateKey === "string") {
-    assert3(fs5.existsSync(params.privateKey), `Private key must exist${params.privateKey}`);
-  }
-  assert3(fs5.existsSync(params.rootDir), "RootDir key must exist");
-  assert3(typeof certificateSigningRequestFilename === "string");
-  const subject = params.subject ? new Subject3(params.subject).toString() : void 0;
-  displaySubtitle("- Creating a Certificate Signing Request with subtile");
-  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await pemToPrivateKey(
-    typeof params.privateKey === "string" ? await fs5.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem(params.privateKey)
-  );
-  const { csr } = await createCertificateSigningRequest({
-    privateKey,
-    dns: params.dns,
-    ip: params.ip,
-    subject,
-    applicationUri: params.applicationUri,
-    purpose: params.purpose
-  });
-  await fs5.promises.writeFile(certificateSigningRequestFilename, csr, "utf-8");
-  display(
-    `- privateKey ${typeof params.privateKey === "string" ? params.privateKey : isOpaqueSigner(params.privateKey) ? "<opaque-signer>" : "<in-memory>"}`
-  );
-  display(`- certificateSigningRequestFilename ${certificateSigningRequestFilename}`);
-}
-
-// packages/node-opcua-pki/lib/toolbox/without_openssl/create_self_signed_certificate.ts
-import assert4 from "assert";
-import fs6 from "fs";
-import {
-  CertificatePurpose,
-  coercePrivateKeyPem as coercePrivateKeyPem2,
-  createSelfSignedCertificate as createSelfSignedCertificate1,
-  pemToPrivateKey as pemToPrivateKey2,
-  Subject as Subject4
-} from "node-opcua-crypto";
-async function createSelfSignedCertificateAsync(certificate, params) {
-  params.purpose = params.purpose || CertificatePurpose.ForApplication;
-  assert4(params.purpose, "Please provide a Certificate Purpose");
-  assert4(fs6.existsSync(params.configFile));
-  assert4(fs6.existsSync(params.rootDir));
-  if (typeof params.privateKey === "string") {
-    assert4(fs6.existsSync(params.privateKey));
-  }
-  if (!params.subject) {
-    throw Error("Missing subject");
-  }
-  assert4(typeof params.applicationUri === "string");
-  assert4(Array.isArray(params.dns));
-  adjustDate(params);
-  assert4(Object.prototype.hasOwnProperty.call(params, "validity"));
-  let subject = new Subject4(params.subject);
-  subject = subject.toString();
-  const purpose = params.purpose;
-  displayTitle("Generate a certificate request");
-  const privateKey = isOpaqueSigner(params.privateKey) ? params.privateKey : await pemToPrivateKey2(
-    typeof params.privateKey === "string" ? await fs6.promises.readFile(params.privateKey, "utf-8") : coercePrivateKeyPem2(params.privateKey)
-  );
-  const { cert } = await createSelfSignedCertificate1({
-    privateKey,
-    notBefore: params.startDate,
-    notAfter: params.endDate,
-    validity: params.validity,
-    dns: params.dns,
-    ip: params.ip,
-    subject,
-    applicationUri: params.applicationUri,
-    purpose
-  });
-  await fs6.promises.writeFile(certificate, cert, "utf-8");
-}
-async function createSelfSignedCertificate(certificate, params) {
-  await createSelfSignedCertificateAsync(certificate, params);
-}
-
-// packages/node-opcua-pki/lib/pki/templates/simple_config_template.cnf.ts
-var config = '##################################################################################################\n## SIMPLE OPENSSL CONFIG FILE FOR SELF-SIGNED CERTIFICATE GENERATION\n################################################################################################################\n\ndistinguished_name       = req_distinguished_name\ndefault_md               = sha1\n\ndefault_md                = sha256                      # The default digest algorithm\n\n[ v3_ca ]\nsubjectKeyIdentifier        = hash\nauthorityKeyIdentifier      = keyid:always,issuer:always\n\n# authorityKeyIdentifier    = keyid\nbasicConstraints            = CA:TRUE\nkeyUsage                    = critical, cRLSign, keyCertSign\nnsComment                   = "Self-signed Certificate for CA generated by Node-OPCUA Certificate utility"\n#nsCertType                 = sslCA, emailCA\n#subjectAltName             = email:copy\n#issuerAltName              = issuer:copy\n#obj                        = DER:02:03\n# crlDistributionPoints       = @crl_info\n# [ crl_info ]\n# URI.0                     = http://localhost:8900/crl.pem\nsubjectAltName              = $ENV::ALTNAME\n\n[ req ]\ndays                      = 390\nreq_extensions            = v3_req\nx509_extensions           = v3_ca\n\n[v3_req]\nbasicConstraints       = CA:false\nkeyUsage               = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nsubjectAltName         = $ENV::ALTNAME\n\n[ v3_ca_signed]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "certificate generated by Node-OPCUA Certificate utility and signed by a CA"\nsubjectAltName            = $ENV::ALTNAME\n[ v3_selfsigned]\nsubjectKeyIdentifier      = hash\nauthorityKeyIdentifier    = keyid,issuer\nbasicConstraints          = critical, CA:FALSE\nkeyUsage                  = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment\nextendedKeyUsage          = clientAuth,serverAuth \nnsComment                 = "Self-signed certificate generated by Node-OPCUA Certificate utility"\nsubjectAltName            = $ENV::ALTNAME\n[ req_distinguished_name ]\ncountryName             = Country Name (2 letter code)\ncountryName_default     = FR\ncountryName_min         = 2\ncountryName_max         = 2\n# stateOrProvinceName     = State or Province Name (full name)\n# stateOrProvinceName_default = Ile de France\n# localityName            = Locality Name (city, district)\n# localityName_default    = Paris\norganizationName          = Organization Name (company)\norganizationName_default  = NodeOPCUA\n# organizationalUnitName  = Organizational Unit Name (department, division)\n# organizationalUnitName_default = R&D\ncommonName                = Common Name (hostname, FQDN, IP, or your name)\ncommonName_max            = 256\ncommonName_default        = NodeOPCUA\n# emailAddress            = Email Address\n# emailAddress_max        = 40\n# emailAddress_default    = node-opcua (at) node-opcua (dot) com\nsubjectAltName            = $ENV::ALTNAME';
-var simple_config_template_cnf_default = config;
-
-// packages/node-opcua-pki/lib/pki/certificate_manager.ts
-var configurationFileSimpleTemplate = simple_config_template_cnf_default;
-var fsWriteFile = fs7.promises.writeFile;
-function getOrComputeInfo(entry) {
-  if (!entry.info) {
-    entry.info = exploreCertificate(entry.certificate);
-  }
-  return entry.info;
-}
-var VerificationStatus = /* @__PURE__ */ ((VerificationStatus2) => {
-  VerificationStatus2["BadCertificateInvalid"] = "BadCertificateInvalid";
-  VerificationStatus2["BadSecurityChecksFailed"] = "BadSecurityChecksFailed";
-  VerificationStatus2["BadCertificatePolicyCheckFailed"] = "BadCertificatePolicyCheckFailed";
-  VerificationStatus2["BadCertificateTimeInvalid"] = "BadCertificateTimeInvalid";
-  VerificationStatus2["BadCertificateIssuerTimeInvalid"] = "BadCertificateIssuerTimeInvalid";
-  VerificationStatus2["BadCertificateHostNameInvalid"] = "BadCertificateHostNameInvalid";
-  VerificationStatus2["BadCertificateUriInvalid"] = "BadCertificateUriInvalid";
-  VerificationStatus2["BadCertificateUseNotAllowed"] = "BadCertificateUseNotAllowed";
-  VerificationStatus2["BadCertificateIssuerUseNotAllowed"] = "BadCertificateIssuerUseNotAllowed";
-  VerificationStatus2["BadCertificateUntrusted"] = "BadCertificateUntrusted";
-  VerificationStatus2["BadCertificateRevocationUnknown"] = "BadCertificateRevocationUnknown";
-  VerificationStatus2["BadCertificateIssuerRevocationUnknown"] = "BadCertificateIssuerRevocationUnknown";
-  VerificationStatus2["BadCertificateRevoked"] = "BadCertificateRevoked";
-  VerificationStatus2["BadCertificateIssuerRevoked"] = "BadCertificateIssuerRevoked";
-  VerificationStatus2["BadCertificateChainIncomplete"] = "BadCertificateChainIncomplete";
-  VerificationStatus2["Good"] = "Good";
-  return VerificationStatus2;
-})(VerificationStatus || {});
-function coerceCertificateChain(certificate) {
-  if (Array.isArray(certificate)) {
-    if (certificate.length === 0) return [];
-    return certificate.reduce((acc, cert) => {
-      return acc.concat(split_der(cert));
-    }, []);
-  }
-  return split_der(certificate);
-}
-function makeFingerprint(certificate) {
-  const chain = coerceCertificateChain(certificate);
-  return makeSHA1Thumbprint(chain[0]).toString("hex");
-}
-function short(stringToShorten) {
-  return stringToShorten.substring(0, 10);
-}
-var disallowedInLabel = /[^A-Za-z0-9._ -]/g;
-function toFilenameLabel(commonName) {
-  const label = (commonName || "").normalize("NFKC").replace(disallowedInLabel, "_").replace(/[^\x20-\x7E]/g, "").slice(0, 64).trim();
-  return label || "certificate";
-}
-function buildIdealCertificateName(certificate) {
-  const chain = coerceCertificateChain(certificate);
-  const fingerprint = makeFingerprint(chain);
-  try {
-    const commonName = exploreCertificate(chain[0]).tbsCertificate.subject.commonName || "";
-    const sanitizedCommonName = toFilenameLabel(commonName);
-    return `${sanitizedCommonName}[${fingerprint}]`;
-  } catch (_err) {
-    return `invalid_certificate_[${fingerprint}]`;
-  }
-}
-function safeStoreJoin(folder, filename) {
-  const full = path4.resolve(folder, filename);
-  const base = path4.resolve(folder);
-  if (full !== base && !full.startsWith(base + path4.sep)) {
-    warningLog("refusing to write certificate outside its store folder:", filename);
-    throw new Error(`certificate filename escapes its store folder: ${filename}`);
-  }
-  return full;
-}
-function findMatchingIssuerKey(entries, wantedIssuerKey) {
-  return entries.filter((entry) => {
-    const info = getOrComputeInfo(entry);
-    return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
-  });
-}
-function isSelfSigned2(info) {
-  return info.tbsCertificate.extensions?.subjectKeyIdentifier === info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
-}
-function isSelfSigned3(certificate) {
-  const info = exploreCertificate(certificate);
-  return isSelfSigned2(info);
-}
-function _isIssuerInfo(info) {
-  const basicConstraints = info.tbsCertificate.extensions?.basicConstraints;
-  if (basicConstraints?.cA) {
-    return true;
-  }
-  const keyUsage = info.tbsCertificate.extensions?.keyUsage;
-  if (keyUsage?.keyCertSign) {
-    return true;
-  }
-  return false;
-}
-function isIssuer(certificate) {
-  try {
-    const info = exploreCertificate(certificate);
-    return _isIssuerInfo(info);
-  } catch (_err) {
-    return false;
-  }
-}
-function isIntermediateIssuer(certificate) {
-  try {
-    const info = exploreCertificate(certificate);
-    if (!_isIssuerInfo(info)) {
-      return false;
-    }
-    return !isSelfSigned2(info);
-  } catch (_err) {
-    return false;
-  }
-}
-function isRootIssuer(certificate) {
-  try {
-    const info = exploreCertificate(certificate);
-    if (!_isIssuerInfo(info)) {
-      return false;
-    }
-    return isSelfSigned2(info);
-  } catch (_err) {
-    return false;
-  }
-}
-function findIssuerCertificateInChain(certificate, chain) {
-  const coercedCertificate = coerceCertificateChain(certificate);
-  const firstCertificate = coercedCertificate[0];
-  if (!firstCertificate) {
-    return null;
-  }
-  const certInfo = exploreCertificate(firstCertificate);
-  if (isSelfSigned2(certInfo)) {
-    return firstCertificate;
-  }
-  const wantedIssuerKey = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
-  if (!wantedIssuerKey) {
-    debugLog("Certificate has no extension 3");
-    return null;
-  }
-  const coercedChain = coerceCertificateChain(chain);
-  const potentialIssuers = coercedChain.filter((c) => {
-    const info = exploreCertificate(c);
-    return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
-  });
-  if (potentialIssuers.length === 1) {
-    return potentialIssuers[0];
-  }
-  if (potentialIssuers.length > 1) {
-    debugLog("findIssuerCertificateInChain: certificate is not self-signed but has several issuers");
-    return potentialIssuers[0];
-  }
-  return null;
-}
-var CertificateManagerState = /* @__PURE__ */ ((CertificateManagerState2) => {
-  CertificateManagerState2[CertificateManagerState2["Uninitialized"] = 0] = "Uninitialized";
-  CertificateManagerState2[CertificateManagerState2["Initializing"] = 1] = "Initializing";
-  CertificateManagerState2[CertificateManagerState2["Initialized"] = 2] = "Initialized";
-  CertificateManagerState2[CertificateManagerState2["Disposing"] = 3] = "Disposing";
-  CertificateManagerState2[CertificateManagerState2["Disposed"] = 4] = "Disposed";
-  return CertificateManagerState2;
-})(CertificateManagerState || {});
-var ChainCompletionStatus = /* @__PURE__ */ ((ChainCompletionStatus2) => {
-  ChainCompletionStatus2["AlreadyComplete"] = "AlreadyComplete";
-  ChainCompletionStatus2["ChainCompleted"] = "ChainCompleted";
-  ChainCompletionStatus2["IssuerNotFound"] = "IssuerNotFound";
-  ChainCompletionStatus2["EmptyChain"] = "EmptyChain";
-  ChainCompletionStatus2["MaxDepthReached"] = "MaxDepthReached";
-  return ChainCompletionStatus2;
-})(ChainCompletionStatus || {});
-var CertificateManager = class _CertificateManager extends EventEmitter {
-  // ── Global instance registry ─────────────────────────────────
-  // Tracks all initialized CertificateManager instances so their
-  // file watchers can be closed automatically on process exit,
-  // even if the consumer forgets to call dispose().
-  static #activeInstances = /* @__PURE__ */ new Set();
-  static #cleanupInstalled = false;
-  static #exitHandler;
-  /**
-   * Install a best-effort `exit` hook that closes any watcher
-   * still open when the process terminates.
-   *
-   * **This library never terminates the host process.** No
-   * SIGINT/SIGTERM handler is installed: deciding how (and
-   * whether) to shut down on a signal is the application's
-   * responsibility, and a listener registered here would both
-   * pre-empt the application's own graceful shutdown and
-   * silently suppress Node's default signal behaviour.
-   *
-   * Nothing here is load-bearing for process exit. The native
-   * `fs.watch` handles are `unref()`'d when the watchers are
-   * created (see `#readCertificates`), so an undisposed
-   * CertificateManager never keeps the event loop alive. This
-   * hook is only tidiness on the way out.
-   *
-   * `exit` rather than `beforeExit`: `beforeExit` fires when
-   * the loop merely drains and the loop can subsequently be
-   * resurrected, which would leave a still-in-use instance
-   * marked Disposed. `exit` is terminal, synchronous-only and
-   * cannot alter the exit code.
-   */
-  static #installExitCleanup() {
-    if (_CertificateManager.#cleanupInstalled) return;
-    _CertificateManager.#cleanupInstalled = true;
-    const closeDanglingWatchers = () => {
-      for (const cm of _CertificateManager.#activeInstances) {
-        for (const w of cm.#watchers) {
-          try {
-            w.close();
-          } catch {
-          }
-        }
-        cm.#watchers.splice(0);
-        cm.state = 4 /* Disposed */;
-      }
-      _CertificateManager.#activeInstances.clear();
-    };
-    _CertificateManager.#exitHandler = closeDanglingWatchers;
-    process.on("exit", closeDanglingWatchers);
-  }
-  /**
-   * Remove the `exit` hook once the last instance is disposed,
-   * so a library that is initialized and disposed repeatedly
-   * does not accumulate process listeners. A later
-   * `initialize()` re-arms it.
-   */
-  static #uninstallExitCleanupIfIdle() {
-    if (_CertificateManager.#activeInstances.size > 0) return;
-    if (_CertificateManager.#exitHandler) {
-      process.removeListener("exit", _CertificateManager.#exitHandler);
-      _CertificateManager.#exitHandler = void 0;
-    }
-    _CertificateManager.#cleanupInstalled = false;
-  }
-  /**
-   * Dispose **all** active CertificateManager instances,
-   * closing their file watchers and freeing resources.
-   *
-   * This is mainly useful in test tear-down to ensure the
-   * Node.js process can exit cleanly.
-   */
-  static async disposeAll() {
-    const instances = [..._CertificateManager.#activeInstances];
-    await Promise.all(instances.map((cm) => _CertificateManager.prototype.dispose.call(cm)));
-  }
-  /**
-   * Assert that all CertificateManager instances have been
-   * properly disposed. Throws an Error listing the locations
-   * of any leaked instances.
-   *
-   * Intended for use in test `afterAll()` / `afterEach()`
-   * hooks to catch missing `dispose()` calls early.
-   *
-   * @example
-   * ```ts
-   * after(() => {
-   *     CertificateManager.checkAllDisposed();
-   * });
-   * ```
-   */
-  static checkAllDisposed() {
-    if (_CertificateManager.#activeInstances.size === 0) return;
-    const locations = [..._CertificateManager.#activeInstances].map((cm) => cm.rootDir);
-    throw new Error(
-      `${_CertificateManager.#activeInstances.size} CertificateManager instance(s) not disposed:
-  - ${locations.join("\n  - ")}`
-    );
-  }
-  // ─────────────────────────────────────────────────────────────
-  /**
-   * When `true` (the default), any certificate that is not
-   * already in the trusted or rejected store is automatically
-   * written to the rejected folder the first time it is seen.
-   */
-  untrustUnknownCertificate = true;
-  /** Current lifecycle state of this instance. */
-  state = 0 /* Uninitialized */;
-  /** @deprecated Use {@link folderPollingInterval} instead (typo fix). */
-  folderPoolingInterval = 5e3;
-  /** Interval in milliseconds for file-system polling (when enabled). */
-  get folderPollingInterval() {
-    return this.folderPoolingInterval;
-  }
-  set folderPollingInterval(value) {
-    this.folderPoolingInterval = value;
-  }
-  /** RSA key size used when generating the private key. */
-  keySize;
-  #location;
-  #watchers = [];
-  #pendingUnrefs = /* @__PURE__ */ new Set();
-  #readCertificatesCalled = false;
-  #filenameToHash = /* @__PURE__ */ new Map();
-  #initializingPromise;
-  #addCertValidation;
-  #disableFileWatchers;
-  #privateKeyPassphrase;
-  #privateKeyProvider;
-  #keyOperations;
-  /** The stable lazy wrap handed out by {@link getKeyOperations} for non-opaque configurations. */
-  #lazyLocalKeyOperations;
-  /**
-   * The on-disk key, decrypted once and kept for the instance's lifetime,
-   * so the passphrase (or its resolver function) is consulted at most
-   * once. Cleared by `dispose()`. Not used when a provider is configured:
-   * the provider is the authority on the current key.
-   */
-  #cachedPrivateKey;
-  #thumbs = {
-    rejected: /* @__PURE__ */ new Map(),
-    trusted: /* @__PURE__ */ new Map(),
-    issuers: {
-      certs: /* @__PURE__ */ new Map()
-    },
-    crl: /* @__PURE__ */ new Map(),
-    issuersCrl: /* @__PURE__ */ new Map()
-  };
-  /**
-   * Create a new CertificateManager.
-   *
-   * The constructor creates the root directory if it does not
-   * exist but does **not** initialise the PKI store — call
-   * {@link initialize} before using any other method.
-   *
-   * @param options - configuration options
-   */
-  constructor(options) {
-    super();
-    options.keySize = options.keySize || 2048;
-    if (!options.location) {
-      throw new Error("CertificateManager: missing 'location' option");
-    }
-    this.#location = makePath(options.location, "");
-    this.keySize = options.keySize;
-    const v = options.addCertificateValidationOptions ?? {};
-    this.#addCertValidation = {
-      acceptExpiredCertificate: v.acceptExpiredCertificate ?? false,
-      acceptRevokedCertificate: v.acceptRevokedCertificate ?? false,
-      ignoreMissingRevocationList: v.ignoreMissingRevocationList ?? false,
-      maxChainLength: v.maxChainLength ?? 5
-    };
-    this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
-    this.#privateKeyPassphrase = options.privateKeyPassphrase;
-    this.#privateKeyProvider = options.privateKeyProvider;
-    this.#keyOperations = options.keyOperations;
-    if (this.#keyOperations && this.#privateKeyProvider) {
-      throw new Error(
-        "CertificateManager: 'keyOperations' and 'privateKeyProvider' are mutually exclusive: one hides the key, the other sources its material"
-      );
-    }
-    if (this.#keyOperations && this.#privateKeyPassphrase) {
-      throw new Error(
-        "CertificateManager: 'privateKeyPassphrase' is meaningless with 'keyOperations': there is no key material for a passphrase to protect"
-      );
-    }
-    mkdirRecursiveSync(options.location);
-    if (!fs7.existsSync(this.#location)) {
-      throw new Error(`CertificateManager cannot access location ${this.#location}`);
-    }
-  }
-  /** Path to the OpenSSL configuration file. */
-  get configFile() {
-    return path4.join(this.rootDir, "own/openssl.cnf");
-  }
-  /** Root directory of the PKI store. */
-  get rootDir() {
-    return this.#location;
-  }
-  /**
-   * Path to the private key file (`own/private/private_key.pem`).
-   *
-   * Kept for backward compatibility with code that reads the key
-   * directly from disk. When a passphrase or a `privateKeyProvider` is
-   * configured, prefer {@link getPrivateKey} instead — this getter still
-   * returns the on-disk path even if a provider is configured (there may
-   * be no meaningful file in that case).
-   */
-  get privateKey() {
-    return path4.join(this.rootDir, "own/private/private_key.pem");
-  }
-  /**
-   * Resolve the private key: from `privateKeyProvider` if configured,
-   * otherwise from disk (decrypting with `privateKeyPassphrase` if the
-   * key is encrypted). Fails closed — throws
-   * `PrivateKeyPassphraseRequiredError` — if the on-disk key is encrypted
-   * and no passphrase is configured, or if the wrong passphrase is
-   * configured.
-   *
-   * The on-disk key is read and decrypted once and then cached for the
-   * lifetime of this instance, so a `privateKeyPassphrase` function is
-   * called at most once (concurrent first calls share the same read). A
-   * failed read is not cached, so a caller can fix the passphrase and
-   * retry. A `privateKeyProvider` is consulted on every call: it is the
-   * authority on what the current key is.
-   */
-  async getPrivateKey() {
-    if (this.#keyOperations) {
-      throw new PrivateKeyUnavailableError(
-        "CertificateManager.getPrivateKey is not available when keyOperations is configured: the private key is held by the key-operations provider (HSM/KMS) and cannot be read \u2014 use getKeyOperations() instead"
-      );
-    }
-    if (this.#privateKeyProvider) {
-      return await this.#privateKeyProvider.getPrivateKey();
-    }
-    if (this.#cachedPrivateKey) {
-      return this.#cachedPrivateKey;
-    }
-    if (!this.#privateKeyPromise) {
-      this.#privateKeyPromise = (async () => {
-        const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-        return readPrivateKey(this.privateKey, passphrase);
-      })().then(
-        (key) => {
-          this.#cachedPrivateKey = key;
-          return key;
-        },
-        (err) => {
-          this.#privateKeyPromise = void 0;
-          throw err;
-        }
-      );
-    }
-    return await this.#privateKeyPromise;
-  }
-  /** In-flight first read of the on-disk key, so concurrent callers share one passphrase resolution. */
-  #privateKeyPromise;
-  /**
-   * True when this manager's key is opaque — configured through
-   * `keyOperations`, held by an HSM/KMS, never obtainable as material.
-   * When true, {@link getPrivateKey} throws `PrivateKeyUnavailableError`
-   * and {@link getKeyOperations} is the only way to use the key.
-   */
-  isPrivateKeyOpaque() {
-    return !!this.#keyOperations;
-  }
-  /**
-   * The key as an opaque {@link IKeyOperations} — the recommended way to
-   * *use* the private key regardless of where it lives.
-   *
-   * Returns the configured `keyOperations` object when the key is opaque.
-   * Otherwise returns a stable lazy wrap over {@link getPrivateKey}: its
-   * methods resolve the key on first use (disk read, passphrase,
-   * `privateKeyProvider` — all async), so the wrap offers no synchronous
-   * fast path; callers that need one resolve the key themselves and build
-   * a `LocalKeyOperations` over it. The wrap follows key rotation: a
-   * `privateKeyProvider` that starts returning a different key gets a
-   * fresh underlying `LocalKeyOperations`.
-   */
-  getKeyOperations() {
-    if (this.#keyOperations) {
-      return this.#keyOperations;
-    }
-    if (!this.#lazyLocalKeyOperations) {
-      let cached;
-      const resolve = async () => {
-        const key = await this.getPrivateKey();
-        if (!cached || cached.key !== key) {
-          cached = { key, ops: keyOperationsFromPrivateKey(key) };
-        }
-        return cached.ops;
-      };
-      this.#lazyLocalKeyOperations = {
-        sign: async (data, params) => (await resolve()).sign(data, params),
-        decryptBlock: async (block, params) => (await resolve()).decryptBlock(block, params),
-        getKeyMetadata: async () => (await resolve()).getKeyMetadata(),
-        getPublicKey: async () => (await resolve()).getPublicKey()
-      };
-    }
-    return this.#lazyLocalKeyOperations;
-  }
-  /**
-   * Fail closed at `initialize()` time, not on the first certificate
-   * operation, if the key cannot actually be used: wrong/missing
-   * passphrase on an encrypted key, a broken `privateKeyProvider`, or an
-   * unreachable `keyOperations` provider (probed via `getKeyMetadata`).
-   */
-  async #probePrivateKey() {
-    if (this.#keyOperations) {
-      await this.#keyOperations.getKeyMetadata();
-      return;
-    }
-    await this.getPrivateKey();
-  }
-  /**
-   * The key to hand to a certificate-issuance primitive: the raw
-   * {@link PrivateKey} for a local configuration, or a {@link CaSigner}
-   * adapted from `keyOperations` when the key is opaque — which requires
-   * the provider to implement `getPublicKey` (the adapter says so if not).
-   */
-  async #resolveSigningKey() {
-    if (this.#keyOperations) {
-      return caSignerFromKeyOperations(this.#keyOperations);
-    }
-    return await this.getPrivateKey();
-  }
-  /**
-   * Enable, disable, or rotate the passphrase protecting the on-disk
-   * private key: decrypt with `oldPassphrase` (omit if the key is
-   * currently unencrypted), then write back encrypted with
-   * `newPassphrase` (omit to leave it unencrypted). The write goes to a
-   * temporary file in the same directory and is atomically renamed into
-   * place, so a crash mid-rotation cannot leave a partially-written key;
-   * the temporary file is removed if anything fails, so a rotation *to*
-   * plaintext can never leave a stray cleartext copy behind. Runs under
-   * the same lock as `initialize()`.
-   *
-   * This only rewrites the on-disk file — it does not update this
-   * instance's own `privateKeyPassphrase` (set at construction), and it
-   * drops this instance's cached key so that disk stays the source of
-   * truth. Construct a new `CertificateManager` with the new passphrase to
-   * continue using it afterward.
-   *
-   * Not supported when a `privateKeyProvider` is configured (there is no
-   * disk file for this method to rewrite).
-   */
-  async reencryptPrivateKey(oldPassphrase, newPassphrase) {
-    if (this.#keyOperations) {
-      throw new PrivateKeyUnavailableError(
-        "reencryptPrivateKey: not supported when keyOperations is configured \u2014 there is no key material to rewrite"
-      );
-    }
-    if (this.#privateKeyProvider) {
-      throw new Error("reencryptPrivateKey: not supported when a privateKeyProvider is configured");
-    }
-    const oldPass = await resolvePrivateKeyPassphrase(oldPassphrase);
-    const newPass = await resolvePrivateKeyPassphrase(newPassphrase);
-    await this.withLock2(async () => {
-      const privateKey = readPrivateKey(this.privateKey, oldPass);
-      await this.#rewritePrivateKeyFile(privateKey, newPass);
-    });
-    this.#cachedPrivateKey = void 0;
-    this.#privateKeyPromise = void 0;
-  }
-  /**
-   * Atomically replace the on-disk private key with `privateKey`, written
-   * as PKCS#8 (encrypted with `passphrase` if given). Temp file next to the
-   * target, `0600`, renamed into place; the temp file is unlinked on any
-   * failure so no partial or cleartext copy can be left behind.
-   * Caller must hold the lock.
-   */
-  async #rewritePrivateKeyFile(privateKey, passphrase) {
-    const tmpFilename = `${this.privateKey}.${process.pid}-${Date.now()}.tmp`;
-    try {
-      await writePrivateKeyFile(tmpFilename, privateKey, { passphrase });
-      await fs7.promises.rename(tmpFilename, this.privateKey);
-    } finally {
-      await fs7.promises.rm(tmpFilename, { force: true });
-    }
-  }
-  /** Path to the OpenSSL random seed file. */
-  get randomFile() {
-    return path4.join(this.rootDir, "./random.rnd");
-  }
-  /**
-   * Move a certificate to the rejected store.
-   * If the certificate was previously trusted, it will be removed from the trusted folder.
-   * @param certificateOrChain - the DER-encoded certificate or certificate chain
-   */
-  async rejectCertificate(certificateOrChain) {
-    await this.#moveCertificate(certificateOrChain, "rejected");
-  }
-  /**
-   * Move a certificate to the trusted store.
-   * If the certificate was previously rejected, it will be removed from the rejected folder.
-   * @param certificateOrChain - the DER-encoded certificate or certificate chain
-   */
-  async trustCertificate(certificateOrChain) {
-    await this.#moveCertificate(certificateOrChain, "trusted");
-  }
-  /**
-   * Check whether the trusted certificate store is empty.
-   *
-   * This inspects the in-memory index, which is kept in
-   * sync with the `trusted/certs/` folder by file-system
-   * watchers after {@link initialize} has been called.
-   */
-  isTrustListEmpty() {
-    return this.#thumbs.trusted.size === 0;
-  }
-  /**
-   * Return the number of certificates currently in the
-   * trusted store.
-   */
-  getTrustedCertificateCount() {
-    return this.#thumbs.trusted.size;
-  }
-  /** Path to the rejected certificates folder. */
-  get rejectedFolder() {
-    return path4.join(this.rootDir, "rejected");
-  }
-  /** Path to the trusted certificates folder. */
-  get trustedFolder() {
-    return path4.join(this.rootDir, "trusted/certs");
-  }
-  /** Path to the trusted CRL folder. */
-  get crlFolder() {
-    return path4.join(this.rootDir, "trusted/crl");
-  }
-  /** Path to the issuer (CA) certificates folder. */
-  get issuersCertFolder() {
-    return path4.join(this.rootDir, "issuers/certs");
-  }
-  /** Path to the issuer CRL folder. */
-  get issuersCrlFolder() {
-    return path4.join(this.rootDir, "issuers/crl");
-  }
-  /** Path to the own certificate folder. */
-  get ownCertFolder() {
-    return path4.join(this.rootDir, "own/certs");
-  }
-  get ownPrivateFolder() {
-    return path4.join(this.rootDir, "own/private");
-  }
-  /**
-   * Check if a certificate is in the trusted store.
-   * If the certificate is unknown and `untrustUnknownCertificate` is set,
-   * it will be written to the rejected folder.
-   * @param certificate - the DER-encoded certificate
-   * @returns `"Good"` if trusted, `"BadCertificateUntrusted"` if rejected/unknown,
-   *   or `"BadCertificateInvalid"` if the certificate cannot be parsed.
-   */
-  async isCertificateTrusted(certificateOrCertificateChain) {
-    try {
-      const chain = coerceCertificateChain(certificateOrCertificateChain);
-      const leafCertificate = chain[0];
-      if (chain.length < 1) {
-        return "BadCertificateInvalid";
-      }
-      let fingerprint;
-      try {
-        fingerprint = makeFingerprint(chain[0]);
-      } catch (_err) {
-        return "BadCertificateInvalid";
-      }
-      if (this.#thumbs.trusted.has(fingerprint)) {
-        return "Good";
-      }
-      if (!this.#thumbs.rejected.has(fingerprint)) {
-        if (!this.untrustUnknownCertificate) {
-          return "Good";
-        }
-        try {
-          exploreCertificateInfo(chain[0]);
-        } catch (_err) {
-          return "BadCertificateInvalid";
-        }
-        const filename = safeStoreJoin(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
-        debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
-        await fsWriteFile(filename, toPem(chain, "CERTIFICATE"));
-        this.#thumbs.rejected.set(fingerprint, { certificate: leafCertificate, filename });
-      }
-      return "BadCertificateUntrusted";
-    } catch (_err) {
-      return "BadCertificateInvalid";
-    }
-  }
-  async #innerVerifyCertificateAsync(certificateOrChain, _isIssuer, level, options) {
-    if (level >= 5) {
-      return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-    }
-    const chain = coerceCertificateChain(certificateOrChain);
-    debugLog("NB CERTIFICATE IN CHAIN = ", chain.length);
-    const info = exploreCertificate(chain[0]);
-    let hasValidIssuer = false;
-    let hasTrustedIssuer = false;
-    const hasIssuerKey = info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
-    debugLog("Certificate as an Issuer Key", hasIssuerKey);
-    if (hasIssuerKey) {
-      const isSelfSigned = isSelfSigned2(info);
-      debugLog("Is the Certificate self-signed  ?", isSelfSigned);
-      if (!isSelfSigned) {
-        debugLog(
-          "Is issuer found in the list of know issuers ?",
-          "\n subjectKeyIdentifier   = ",
-          info.tbsCertificate.extensions?.subjectKeyIdentifier,
-          "\n authorityKeyIdentifier = ",
-          info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier
-        );
-        let issuerCertificate = await this.findIssuerCertificate(chain[0]);
-        if (!issuerCertificate) {
-          issuerCertificate = findIssuerCertificateInChain(chain[0], chain);
-          if (!issuerCertificate) {
-            debugLog(
-              " the issuer has not been found in the chain itself nor in the issuer.cert list => the chain is incomplete!"
-            );
-            return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
-          }
-          debugLog(" the issuer certificate has been found in the chain itself ! the chain is complete !");
-        } else {
-          debugLog(" the issuer certificate has been found in the issuer.cert folder !");
-        }
-        const issuerStatus = await this.#innerVerifyCertificateAsync(issuerCertificate, true, level + 1, options);
-        if (issuerStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
-          return "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */;
-        }
-        if (issuerStatus === "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */) {
-          return "BadCertificateIssuerRevocationUnknown" /* BadCertificateIssuerRevocationUnknown */;
-        }
-        if (issuerStatus === "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */) {
-          if (!options?.acceptOutDatedIssuerCertificate) {
-            return "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
-          }
-        }
-        if (issuerStatus === "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
-          debugLog("warning issuerStatus = ", issuerStatus.toString(), "the issuer certificate is not trusted");
-        }
-        if (issuerStatus !== "Good" /* Good */ && issuerStatus !== "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
-          return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-        }
-        const isCertificateSignatureOK = verifyCertificateSignature(chain[0], issuerCertificate);
-        if (!isCertificateSignatureOK) {
-          debugLog(" the certificate was not signed by the issuer as it claim to be ! Danger");
-          return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-        }
-        hasValidIssuer = true;
-        let revokedStatus = await this.isCertificateRevoked(chain, issuerCertificate);
-        if (revokedStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
-          if (options?.ignoreMissingRevocationList) {
-            revokedStatus = "Good" /* Good */;
-          }
-        }
-        if (revokedStatus !== "Good" /* Good */) {
-          debugLog("revokedStatus", revokedStatus);
-          return revokedStatus;
-        }
-        const issuerTrustedStatus = await this.#checkRejectedOrTrusted(issuerCertificate);
-        debugLog("issuerTrustedStatus", issuerTrustedStatus);
-        if (issuerTrustedStatus === "unknown") {
-          hasTrustedIssuer = false;
-        } else if (issuerTrustedStatus === "trusted") {
-          hasTrustedIssuer = true;
-        } else if (issuerTrustedStatus === "rejected") {
-          return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-        }
-      } else {
-        const isCertificateSignatureOK = verifyCertificateSignature(chain[0], chain[0]);
-        if (!isCertificateSignatureOK) {
-          debugLog("Self-signed Certificate signature is not valid");
-          return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-        }
-        const revokedStatus = await this.isCertificateRevoked(chain);
-        debugLog("revokedStatus of self signed certificate:", revokedStatus);
-      }
-    }
-    const status = await this.#checkRejectedOrTrusted(chain[0]);
-    if (status === "rejected") {
-      if (!(options.acceptCertificateWithValidIssuerChain && hasValidIssuer && hasTrustedIssuer)) {
-        return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
-      }
-    }
-    const { validity } = exploreCertificate(chain[0]).tbsCertificate;
-    const now = /* @__PURE__ */ new Date();
-    let isTimeInvalid = false;
-    if (validity.notBefore.getTime() > now.getTime()) {
-      debugLog(
-        `${chalk3.red("certificate is invalid : certificate is not active yet !")} not before date =${validity.notBefore}`
-      );
-      if (!options.acceptPendingCertificate) {
-        isTimeInvalid = true;
-      }
-    }
-    if (validity.notAfter.getTime() <= now.getTime()) {
-      debugLog(`${chalk3.red("certificate is invalid : certificate has expired !")} not after date =${validity.notAfter}`);
-      if (!options.acceptOutdatedCertificate) {
-        isTimeInvalid = true;
-      }
-    }
-    if (status === "trusted") {
-      return isTimeInvalid ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "Good" /* Good */;
-    }
-    if (hasIssuerKey) {
-      if (!hasTrustedIssuer) {
-        return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
-      }
-      if (!hasValidIssuer) {
-        return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
-      }
-      if (!options.acceptCertificateWithValidIssuerChain) {
-        return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
-      }
-      return isTimeInvalid ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "Good" /* Good */;
-    } else {
-      return "BadCertificateUntrusted" /* BadCertificateUntrusted */;
-    }
-  }
-  /**
-   * Internal verification hook called by {@link verifyCertificate}.
-   *
-   * Subclasses can override this to inject additional validation
-   * logic (e.g. application-level policy checks) while still
-   * delegating to the default chain/CRL/trust verification.
-   *
-   * @param certificate - the DER-encoded certificate to verify
-   * @param options - verification options forwarded from the
-   *   public API
-   * @returns the verification status code
-   */
-  async verifyCertificateAsync(certificate, options) {
-    const chain = coerceCertificateChain(certificate);
-    for (const element of chain) {
-      try {
-        exploreCertificate(element);
-      } catch (_err) {
-        return "BadCertificateInvalid" /* BadCertificateInvalid */;
-      }
-    }
-    const status1 = await this.#innerVerifyCertificateAsync(chain, false, 0, options);
-    return status1;
-  }
-  /**
-   * Verify a certificate against the PKI trust store.
-   *
-   * This performs a full validation including trust status,
-   * issuer chain, CRL revocation checks, and time validity.
-   *
-   * @param certificate - the DER-encoded certificate to verify
-   * @param options - optional flags to relax validation rules
-   * @returns the verification status code
-   */
-  async verifyCertificate(certificate, options) {
-    if (!certificate) {
-      return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-    }
-    try {
-      const status = await this.verifyCertificateAsync(certificate, options || {});
-      return status;
-    } catch (error) {
-      warningLog(`verifyCertificate error: ${error.message}`);
-      return "BadCertificateInvalid" /* BadCertificateInvalid */;
-    }
-  }
-  /**
-   * Initialize the PKI directory structure, generate the
-   * private key (if missing), and start file-system watchers.
-   *
-   * This method is idempotent — subsequent calls are no-ops.
-   * It must be called before any certificate operations.
-   */
-  async initialize() {
-    if (this.state !== 0 /* Uninitialized */) {
-      return;
-    }
-    this.state = 1 /* Initializing */;
-    this.#initializingPromise = this.#initialize();
-    try {
-      await this.#initializingPromise;
-    } catch (err) {
-      this.#initializingPromise = void 0;
-      this.state = 0 /* Uninitialized */;
-      throw err;
-    }
-    this.#initializingPromise = void 0;
-    this.state = 2 /* Initialized */;
-    _CertificateManager.#activeInstances.add(this);
-    _CertificateManager.#installExitCleanup();
-  }
-  async #initialize() {
-    const pkiDir = this.#location;
-    mkdirRecursiveSync(pkiDir);
-    mkdirRecursiveSync(path4.join(pkiDir, "own"));
-    mkdirRecursiveSync(path4.join(pkiDir, "own/certs"));
-    ensurePrivateDirectory(path4.join(pkiDir, "own/private"));
-    mkdirRecursiveSync(path4.join(pkiDir, "rejected"));
-    mkdirRecursiveSync(path4.join(pkiDir, "trusted"));
-    mkdirRecursiveSync(path4.join(pkiDir, "trusted/certs"));
-    mkdirRecursiveSync(path4.join(pkiDir, "trusted/crl"));
-    mkdirRecursiveSync(path4.join(pkiDir, "issuers"));
-    mkdirRecursiveSync(path4.join(pkiDir, "issuers/certs"));
-    mkdirRecursiveSync(path4.join(pkiDir, "issuers/crl"));
-    const ownsDiskKey = !this.#privateKeyProvider && !this.#keyOperations;
-    const needsKeyGeneration = ownsDiskKey && !fs7.existsSync(this.privateKey);
-    const needsKeyEncryption = ownsDiskKey && !needsKeyGeneration && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey);
-    if (!fs7.existsSync(this.configFile) || needsKeyGeneration || needsKeyEncryption) {
-      return await this.withLock2(async () => {
-        if (this.state === 3 /* Disposing */ || this.state === 4 /* Disposed */) {
-          return;
-        }
-        if (!fs7.existsSync(this.configFile)) {
-          fs7.writeFileSync(this.configFile, configurationFileSimpleTemplate);
-        }
-        if (ownsDiskKey && !fs7.existsSync(this.privateKey)) {
-          debugLog("generating private key ...");
-          const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-          await generatePrivateKeyFile(this.privateKey, this.keySize, { passphrase });
-          this.#cachedPrivateKey = readPrivateKey(this.privateKey, passphrase);
-        } else if (ownsDiskKey && this.#privateKeyPassphrase !== void 0 && !isEncryptedPrivateKeyFile(this.privateKey)) {
-          warningLog("initialize: private key is plaintext but a passphrase is configured; encrypting it in place");
-          const passphrase = await resolvePrivateKeyPassphrase(this.#privateKeyPassphrase);
-          const plaintextKey = readPrivateKey(this.privateKey);
-          await this.#rewritePrivateKeyFile(plaintextKey, passphrase);
-          this.#cachedPrivateKey = plaintextKey;
-        }
-        if (ownsDiskKey) {
-          restrictPrivateFilePermissions(this.privateKey, 384);
-        }
-        await this.#probePrivateKey();
-        await this.#readCertificates();
-      });
-    } else {
-      if (ownsDiskKey) {
-        restrictPrivateFilePermissions(this.privateKey, 384);
-      }
-      await this.#probePrivateKey();
-      await this.#readCertificates();
-    }
-  }
-  /**
-   * Dispose of the CertificateManager, releasing file watchers
-   * and other resources. The instance should not be used after
-   * calling this method.
-   */
-  async dispose() {
-    if (this.state === 3 /* Disposing */) {
-      throw new Error("Already disposing");
-    }
-    if (this.state === 0 /* Uninitialized */) {
-      this.state = 4 /* Disposed */;
-      return;
-    }
-    if (this.state === 1 /* Initializing */) {
-      if (this.#initializingPromise) {
-        await this.#initializingPromise;
-      }
-    }
-    try {
-      this.state = 3 /* Disposing */;
-      await drainPendingLocks();
-      for (const unreff of this.#pendingUnrefs) {
-        unreff();
-      }
-      this.#pendingUnrefs.clear();
-      await Promise.all(this.#watchers.map((w) => w.close()));
-      this.#watchers.forEach((w) => {
-        w.removeAllListeners();
-      });
-      this.#watchers.splice(0);
-    } finally {
-      this.state = 4 /* Disposed */;
-      this.#cachedPrivateKey = void 0;
-      this.#privateKeyPromise = void 0;
-      _CertificateManager.#activeInstances.delete(this);
-      _CertificateManager.#uninstallExitCleanupIfIdle();
-    }
-  }
-  /**
-   * Force a full re-scan of all PKI folders, rebuilding
-   * the in-memory `_thumbs` index from scratch.
-   *
-   * Call this after external processes have modified the
-   * PKI folders (e.g. via `writeTrustList` or CLI tools)
-   * to ensure the CertificateManager sees the latest
-   * state without waiting for file-system events.
-   */
-  async reloadCertificates() {
-    await Promise.all(this.#watchers.map((w) => w.close()));
-    for (const w of this.#watchers) {
-      w.removeAllListeners();
-    }
-    this.#watchers.splice(0);
-    this.#thumbs.rejected.clear();
-    this.#thumbs.trusted.clear();
-    this.#thumbs.issuers.certs.clear();
-    this.#thumbs.crl.clear();
-    this.#thumbs.issuersCrl.clear();
-    this.#filenameToHash.clear();
-    this.#readCertificatesCalled = false;
-    await this.#readCertificates();
-  }
-  async withLock2(action) {
-    const lockFileName = path4.join(this.rootDir, "mutex");
-    return withLock({ fileToLock: lockFileName }, async () => {
-      return await action();
-    });
-  }
-  /**
-   * Create a self-signed certificate for this PKI's private key.
-   *
-   * The certificate is written to `params.outputFile` or
-   * `own/certs/self_signed_certificate.pem` by default.
-   *
-   * @param params - certificate parameters (subject, SANs,
-   *   validity, etc.)
-   */
-  async createSelfSignedCertificate(params) {
-    if (typeof params.applicationUri !== "string") {
-      throw new Error("createSelfSignedCertificate: expecting applicationUri to be a string");
-    }
-    if (!this.#privateKeyProvider && !this.#keyOperations && !fs7.existsSync(this.privateKey)) {
-      throw new Error(`Cannot find private key ${this.privateKey}`);
-    }
-    let certificateFilename = path4.join(this.rootDir, "own/certs/self_signed_certificate.pem");
-    certificateFilename = params.outputFile || certificateFilename;
-    const _params = {
-      ...params,
-      rootDir: this.rootDir,
-      configFile: this.configFile,
-      privateKey: await this.#resolveSigningKey(),
-      subject: params.subject || "CN=FIXME"
-    };
-    await this.withLock2(async () => {
-      await createSelfSignedCertificate(certificateFilename, _params);
-    });
-  }
-  /**
-   * Create a Certificate Signing Request (CSR) using this
-   * PKI's private key and configuration.
-   *
-   * The CSR file is written to `own/certs/` with a timestamped
-   * filename.
-   *
-   * @param params - CSR parameters (subject, SANs)
-   * @returns the filesystem path to the generated CSR file
-   */
-  async createCertificateRequest(params) {
-    if (!params) {
-      throw new Error("params is required");
-    }
-    if (Object.prototype.hasOwnProperty.call(params, "rootDir")) {
-      throw new Error("rootDir should not be specified ");
-    }
-    const _params = {
-      ...params,
-      rootDir: path4.resolve(this.rootDir),
-      configFile: path4.resolve(this.configFile),
-      privateKey: await this.#resolveSigningKey()
-    };
-    return await this.withLock2(async () => {
-      const now = /* @__PURE__ */ new Date();
-      const today = `${now.toISOString().slice(0, 10)}_${now.getTime()}`;
-      const certificateSigningRequestFilename = path4.join(this.rootDir, "own/certs", `certificate_${today}.csr`);
-      await createCertificateSigningRequestAsync(certificateSigningRequestFilename, _params);
-      return certificateSigningRequestFilename;
-    });
-  }
-  /**
-   * Add a CA (issuer) certificate to the issuers store.
-   * If the certificate is already present, this is a no-op.
-   * @param certificate - the DER-encoded CA certificate
-   * @param validate - if `true`, verify the certificate before adding
-   * @param addInTrustList - if `true`, also add to the trusted store
-   * @returns `VerificationStatus.Good` on success
-   */
-  async addIssuer(certificate, validate = false, addInTrustList = false) {
-    if (validate) {
-      const status = await this.verifyCertificate(certificate);
-      if (status !== "Good" /* Good */ && status !== "BadCertificateUntrusted" /* BadCertificateUntrusted */) {
-        return status;
-      }
-    }
-    const pemCertificate = toPem(certificate, "CERTIFICATE");
-    const fingerprint = makeFingerprint(certificate);
-    if (this.#thumbs.issuers.certs.has(fingerprint)) {
-      return "Good" /* Good */;
-    }
-    const filename = safeStoreJoin(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
-    await fs7.promises.writeFile(filename, pemCertificate, "ascii");
-    this.#thumbs.issuers.certs.set(fingerprint, { certificate, filename });
-    if (addInTrustList) {
-      await this.trustCertificate(certificate);
-    }
-    return "Good" /* Good */;
-  }
-  /**
-   * Add multiple CA (issuer) certificates to the issuers store.
-   * @param certificates - the DER-encoded CA certificates
-   * @param validate - if `true`, verify each certificate before adding
-   * @param addInTrustList - if `true`, also add each certificate to the trusted store
-   * @returns `VerificationStatus.Good` on success
-   */
-  async addIssuers(certificates, validate = false, addInTrustList = false) {
-    for (const certificate of certificates) {
-      if (!isIssuer(certificate)) {
-        warningLog(`Certificate ${makeFingerprint(certificate)} is not a issuer certificate`);
-        continue;
-      }
-      await this.addIssuer(certificate, validate, addInTrustList);
-    }
-    return "Good" /* Good */;
-  }
-  /**
-   * Add a CRL to the certificate manager.
-   * @param crl - the CRL to add
-   * @param target - "issuers" (default) writes to issuers/crl, "trusted" writes to trusted/crl
-   */
-  async addRevocationList(crl, target = "issuers") {
-    return await this.withLock2(async () => {
-      try {
-        const index = target === "trusted" ? this.#thumbs.crl : this.#thumbs.issuersCrl;
-        const folder = target === "trusted" ? this.crlFolder : this.issuersCrlFolder;
-        const crlInfo = exploreCertificateRevocationList(crl);
-        const key = crlInfo.tbsCertList.issuerFingerprint;
-        if (!index.has(key)) {
-          index.set(key, { crls: [], serialNumbers: {} });
-        }
-        const pemCertificate = toPem(crl, "X509 CRL");
-        const sanitizedKey = key.replace(/:/g, "");
-        const filename = path4.join(folder, `crl_[${sanitizedKey}].pem`);
-        await fs7.promises.writeFile(filename, pemCertificate, "ascii");
-        await this.#onCrlFileAdded(index, filename);
-        await this.#waitAndCheckCRLProcessingStatus();
-        return "Good" /* Good */;
-      } catch (err) {
-        debugLog(err);
-        return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-      }
-    });
-  }
-  /**
-   * Remove all CRL files from the specified folder(s) and clear the
-   * corresponding in-memory index.
-   * @param target - "issuers" clears issuers/crl, "trusted" clears
-   *   trusted/crl, "all" clears both.
-   */
-  async clearRevocationLists(target) {
-    const clearFolder = async (folder, index) => {
-      try {
-        const files = await fs7.promises.readdir(folder);
-        for (const file of files) {
-          const ext = path4.extname(file).toLowerCase();
-          if (ext === ".crl" || ext === ".pem" || ext === ".der") {
-            await fs7.promises.unlink(path4.join(folder, file));
-          }
-        }
-      } catch (err) {
-        if (err.code !== "ENOENT") {
-          throw err;
-        }
-      }
-      index.clear();
-    };
-    if (target === "issuers" || target === "all") {
-      await clearFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl);
-    }
-    if (target === "trusted" || target === "all") {
-      await clearFolder(this.crlFolder, this.#thumbs.crl);
-    }
-  }
-  /**
-   * Check whether an issuer certificate with the given thumbprint
-   * is already registered.
-   * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
-   */
-  async hasIssuer(thumbprint) {
-    await this.#readCertificates();
-    const normalized = thumbprint.toLowerCase();
-    return this.#thumbs.issuers.certs.has(normalized);
-  }
-  /**
-   * Remove a trusted certificate identified by its SHA-1 thumbprint.
-   * Deletes the file on disk and removes the entry from the
-   * in-memory index.
-   * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
-   * @returns the removed certificate buffer, or `null` if not found
-   */
-  async removeTrustedCertificate(thumbprint) {
-    await this.#readCertificates();
-    const normalized = thumbprint.toLowerCase();
-    const entry = this.#thumbs.trusted.get(normalized);
-    if (!entry) {
-      return null;
-    }
-    try {
-      await fs7.promises.unlink(entry.filename);
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        throw err;
-      }
-    }
-    this.#thumbs.trusted.delete(normalized);
-    return entry.certificate;
-  }
-  /**
-   * Remove an issuer certificate identified by its SHA-1 thumbprint.
-   * Deletes the file on disk and removes the entry from the
-   * in-memory index.
-   * @param thumbprint - hex-encoded SHA-1 thumbprint (lowercase)
-   * @returns the removed certificate buffer, or `null` if not found
-   */
-  async removeIssuer(thumbprint) {
-    await this.#readCertificates();
-    const normalized = thumbprint.toLowerCase();
-    const entry = this.#thumbs.issuers.certs.get(normalized);
-    if (!entry) {
-      return null;
-    }
-    try {
-      await fs7.promises.unlink(entry.filename);
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        throw err;
-      }
-    }
-    this.#thumbs.issuers.certs.delete(normalized);
-    return entry.certificate;
-  }
-  /**
-   * Remove all CRL files that were issued by the given CA certificate
-   * from the specified folder (or both).
-   * @param issuerCertificate - the CA certificate whose CRLs to remove
-   * @param target - "issuers", "trusted", or "all" (default "all")
-   */
-  async removeRevocationListsForIssuer(issuerCertificate, target = "all") {
-    const issuerInfo = exploreCertificate(issuerCertificate);
-    const issuerFingerprint = issuerInfo.tbsCertificate.subjectFingerPrint;
-    const processIndex = async (index) => {
-      const crlData = index.get(issuerFingerprint);
-      if (!crlData) return;
-      for (const crlEntry of crlData.crls) {
-        try {
-          await fs7.promises.unlink(crlEntry.filename);
-        } catch (err) {
-          if (err.code !== "ENOENT") {
-            throw err;
-          }
-        }
-      }
-      index.delete(issuerFingerprint);
-    };
-    if (target === "issuers" || target === "all") {
-      await processIndex(this.#thumbs.issuersCrl);
-    }
-    if (target === "trusted" || target === "all") {
-      await processIndex(this.#thumbs.crl);
-    }
-  }
-  /**
-   * Validate a certificate (optionally with its chain) and add
-   * the leaf certificate to the trusted store.
-   *
-   * Performs OPC UA Part 4, Table 100 validation:
-   *
-   * 1. **Certificate Structure** — parse the DER encoding.
-   * 2. **Build Certificate Chain** — walk from the leaf to a
-   *    self-signed root CA, using the provided chain and the
-   *    issuers store.
-   * 3. **Signature** — verify each certificate's signature
-   *    against its issuer.
-   * 4. **Issuer Presence** — every issuer in the chain must
-   *    already be registered in the issuers store (per GDS
-   *    7.8.2.6).
-   * 5. **Validity Period** — each certificate must be within
-   *    its validity window (overridable via
-   *    {@link AddCertificateValidationOptions.acceptExpiredCertificate}).
-   * 6. **Revocation Check** — each certificate is checked
-   *    against its issuer's CRL (overridable via
-   *    {@link AddCertificateValidationOptions.acceptRevokedCertificate}
-   *    and {@link AddCertificateValidationOptions.ignoreMissingRevocationList}).
-   *
-   * Only the leaf certificate is added to the trusted store.
-   *
-   * @param certificateChain - DER-encoded certificate or chain
-   * @returns `VerificationStatus.Good` on success, or an error
-   *  status indicating why the certificate was rejected.
-   */
-  async addTrustedCertificateFromChain(certificateChain) {
-    try {
-      return await this.#addTrustedCertificateFromChainImpl(certificateChain);
-    } catch (_err) {
-      warningLog("addTrustedCertificateFromChain: unexpected error", _err);
-      return "BadCertificateInvalid" /* BadCertificateInvalid */;
-    }
-  }
-  async #addTrustedCertificateFromChainImpl(certificateChain) {
-    let certificates;
-    try {
-      certificates = coerceCertificateChain(certificateChain);
-    } catch (_err) {
-      return "BadCertificateInvalid" /* BadCertificateInvalid */;
-    }
-    if (certificates.length === 0) {
-      return "BadCertificateInvalid" /* BadCertificateInvalid */;
-    }
-    const leafCertificate = certificates[0];
-    const opts = this.#addCertValidation;
-    let leafInfo;
-    try {
-      leafInfo = exploreCertificate(leafCertificate);
-    } catch (_err) {
-      return "BadCertificateInvalid" /* BadCertificateInvalid */;
-    }
-    await this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs);
-    let currentCert = leafCertificate;
-    let currentInfo = leafInfo;
-    let depth = 0;
-    while (true) {
-      depth++;
-      if (depth > opts.maxChainLength) {
-        return "BadSecurityChecksFailed" /* BadSecurityChecksFailed */;
-      }
-      if (!opts.acceptExpiredCertificate) {
-        const { validity } = currentInfo.tbsCertificate;
-        const now = /* @__PURE__ */ new Date();
-        if (validity.notBefore.getTime() > now.getTime()) {
-          return "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */;
-        }
-        if (validity.notAfter.getTime() <= now.getTime()) {
-          return depth === 1 ? "BadCertificateTimeInvalid" /* BadCertificateTimeInvalid */ : "BadCertificateIssuerTimeInvalid" /* BadCertificateIssuerTimeInvalid */;
-        }
-      }
-      if (isSelfSigned2(currentInfo)) {
-        try {
-          if (!verifyCertificateSignature(currentCert, currentCert)) {
-            return "BadCertificateInvalid" /* BadCertificateInvalid */;
-          }
-        } catch (_err) {
-          return "BadCertificateInvalid" /* BadCertificateInvalid */;
-        }
-        break;
-      }
-      let issuerCert = await this.findIssuerCertificate(currentCert);
-      if (!issuerCert) {
-        issuerCert = findIssuerCertificateInChain(currentCert, certificates);
-        if (!issuerCert || issuerCert === currentCert) {
-          return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
-        }
-      }
-      try {
-        if (!verifyCertificateSignature(currentCert, issuerCert)) {
-          return "BadCertificateInvalid" /* BadCertificateInvalid */;
-        }
-      } catch (_err) {
-        return "BadCertificateInvalid" /* BadCertificateInvalid */;
-      }
-      const issuerThumbprint = makeFingerprint(issuerCert);
-      if (!await this.hasIssuer(issuerThumbprint)) {
-        return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
-      }
-      const revokedStatus = await this.isCertificateRevoked(currentCert, issuerCert);
-      if (revokedStatus === "BadCertificateRevoked" /* BadCertificateRevoked */) {
-        if (!opts.acceptRevokedCertificate) {
-          return "BadCertificateRevoked" /* BadCertificateRevoked */;
-        }
-      } else if (revokedStatus === "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */) {
-        if (!opts.ignoreMissingRevocationList) {
-          return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
-        }
-      }
-      currentCert = issuerCert;
-      try {
-        currentInfo = exploreCertificate(currentCert);
-      } catch (_err) {
-        return "BadCertificateInvalid" /* BadCertificateInvalid */;
-      }
-    }
-    await this.trustCertificate(certificates);
-    return "Good" /* Good */;
-  }
-  /**
-   * Check whether an issuer certificate is still needed by any
-   * certificate in the trusted store.
-   *
-   * This is used before removing an issuer to ensure that
-   * doing so would not break the chain of any trusted
-   * certificate.
-   *
-   * @param issuerCertificate - the CA certificate to check
-   * @returns `true` if at least one trusted certificate was
-   *   signed by this issuer.
-   */
-  async isIssuerInUseByTrustedCertificate(issuerCertificate) {
-    await this.#readCertificates();
-    for (const entry of this.#thumbs.trusted.values()) {
-      if (!entry.certificate) continue;
-      try {
-        if (verifyCertificateSignature(entry.certificate, issuerCertificate)) {
-          return true;
-        }
-      } catch (_err) {
-      }
-    }
-    return false;
-  }
-  /**
-   *  find the issuer certificate among the trusted  issuer certificates.
-   *
-   *  The findIssuerCertificate method is an asynchronous method that attempts to find
-   *  the issuer certificate for a given certificate from the list of issuer certificate declared in the PKI
-   *
-   *  - If the certificate is self-signed, it returns the certificate itself.
-   *
-   *  - If the certificate has no extension 3, it is assumed to be generated by an old system, and a null value is returned.
-   *
-   *  - the method checks both issuer and trusted certificates and returns the appropriate issuercertificate,
-   *    if found. If multiple matching certificates are found, a warning is logged to the console.
-   *
-   */
-  async findIssuerCertificate(certificate) {
-    const firstCertificate = coerceCertificateChain(certificate)[0];
-    const certInfo = exploreCertificate(firstCertificate);
-    if (isSelfSigned2(certInfo)) {
-      return firstCertificate;
-    }
-    const wantedIssuerKey = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
-    if (!wantedIssuerKey) {
-      debugLog("Certificate has no extension 3");
-      return null;
-    }
-    const issuerCertificates = [...this.#thumbs.issuers.certs.values()];
-    const selectedIssuerCertificates = findMatchingIssuerKey(issuerCertificates, wantedIssuerKey);
-    if (selectedIssuerCertificates.length > 0) {
-      if (selectedIssuerCertificates.length > 1) {
-        warningLog("Warning more than one issuer certificate exists with subjectKeyIdentifier ", wantedIssuerKey);
-      }
-      return selectedIssuerCertificates[0].certificate || null;
-    }
-    const trustedCertificates = [...this.#thumbs.trusted.values()];
-    const selectedTrustedCertificates = findMatchingIssuerKey(trustedCertificates, wantedIssuerKey);
-    if (selectedTrustedCertificates.length > 1) {
-      warningLog(
-        "Warning more than one certificate exists with subjectKeyIdentifier in trusted certificate list ",
-        wantedIssuerKey,
-        selectedTrustedCertificates.length
-      );
-    }
-    return selectedTrustedCertificates.length > 0 ? selectedTrustedCertificates[0].certificate : null;
-  }
-  /**
-   * Outcome status for {@link CertificateManager.completeCertificateChain}.
-   */
-  static ChainCompletionStatus = ChainCompletionStatus;
-  /**
-   * Complete a certificate chain by walking the issuer store.
-   *
-   * Starting from the last certificate in the provided chain, this method
-   * repeatedly calls {@link findIssuerCertificate} to locate the parent
-   * certificate until it reaches a self-signed root or can no longer find
-   * an issuer.
-   *
-   * @param chain - the (potentially partial) certificate chain, leaf first
-   * @param maxDepth - maximum number of issuers to append (default: 10)
-   * @returns a {@link ChainCompletionResult} containing the (possibly completed)
-   *          chain, a status code, and an optional diagnostic message.
-   */
-  async completeCertificateChain(chain, maxDepth = 10) {
-    if (chain.length === 0) {
-      return {
-        chain,
-        status: "EmptyChain" /* EmptyChain */,
-        message: "Input chain is empty \u2014 nothing to complete."
-      };
-    }
-    await this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs);
-    const result = [...chain];
-    let depth = 0;
-    while (depth < maxDepth) {
-      const lastCert = result[result.length - 1];
-      const lastInfo = exploreCertificate(lastCert);
-      if (isSelfSigned2(lastInfo)) {
-        const wasExtended = result.length > chain.length;
-        return {
-          chain: result,
-          status: wasExtended ? "ChainCompleted" /* ChainCompleted */ : "AlreadyComplete" /* AlreadyComplete */,
-          message: wasExtended ? `Chain completed: ${result.length - chain.length} issuer(s) appended, ending at self-signed root "${lastInfo.tbsCertificate.subject.commonName}".` : `Chain is already complete (self-signed root "${lastInfo.tbsCertificate.subject.commonName}").`
-        };
-      }
-      const issuerCert = await this.findIssuerCertificate(lastCert);
-      if (!issuerCert) {
-        const cn = lastInfo.tbsCertificate.subject.commonName ?? "?";
-        const akid = lastInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier ?? "?";
-        const msg = `Cannot find issuer for "${cn}" (authorityKeyIdentifier: ${akid}). Ensure the CA certificate is present in the issuers/certs folder.`;
-        warningLog(`completeCertificateChain: ${msg}`);
-        return {
-          chain: result,
-          status: "IssuerNotFound" /* IssuerNotFound */,
-          message: msg
-        };
-      }
-      const issuerFingerprint = makeFingerprint(issuerCert);
-      const alreadyInChain = result.some((c) => makeFingerprint(c) === issuerFingerprint);
-      if (alreadyInChain) {
-        return {
-          chain: result,
-          status: "AlreadyComplete" /* AlreadyComplete */,
-          message: `Chain ends at root "${exploreCertificate(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
-        };
-      }
-      result.push(issuerCert);
-      depth++;
-    }
-    return {
-      chain: result,
-      status: "MaxDepthReached" /* MaxDepthReached */,
-      message: `Chain completion stopped after ${maxDepth} iterations \u2014 possible circular chain or very deep hierarchy.`
-    };
-  }
-  /**
-   *
-   * check if the certificate explicitly appear in the trust list, the reject list or none.
-   * In case of being in the reject and trusted list at the same time is consider: rejected.
-   * @internal
-   * @private
-   */
-  async #checkRejectedOrTrusted(certificate) {
-    const firstCertificate = coerceCertificateChain(certificate)[0];
-    const fingerprint = makeFingerprint(firstCertificate);
-    debugLog("#checkRejectedOrTrusted fingerprint ", short(fingerprint));
-    await this.#readCertificates();
-    if (this.#thumbs.rejected.has(fingerprint)) {
-      return "rejected";
-    }
-    if (this.#thumbs.trusted.has(fingerprint)) {
-      return "trusted";
-    }
-    return "unknown";
-  }
-  async #moveCertificate(certificateOrChain, newStatus) {
-    await this.withLock2(async () => {
-      const chain = coerceCertificateChain(certificateOrChain);
-      const certificate = chain[0];
-      const fingerprint = makeFingerprint(certificate);
-      let status = await this.#checkRejectedOrTrusted(certificate);
-      if (status === "unknown") {
-        const pem = toPem(chain, "CERTIFICATE");
-        const filename = safeStoreJoin(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
-        await fs7.promises.writeFile(filename, pem);
-        this.#thumbs.rejected.set(fingerprint, { certificate, filename });
-        status = "rejected";
-      }
-      debugLog("#moveCertificate", fingerprint.substring(0, 10), "from", status, "to", newStatus);
-      if (status !== "rejected" && status !== "trusted") {
-        throw new Error(`#moveCertificate: unexpected status '${status}' for certificate ${fingerprint.substring(0, 10)}`);
-      }
-      if (status !== newStatus) {
-        const indexSrc = status === "rejected" ? this.#thumbs.rejected : this.#thumbs.trusted;
-        const srcEntry = indexSrc.get(fingerprint);
-        if (!srcEntry) {
-          debugLog(" cannot find certificate ", fingerprint.substring(0, 10), " in", status);
-          throw new Error(`#moveCertificate: certificate ${fingerprint.substring(0, 10)} not found in ${status} index`);
-        }
-        const destFolder = newStatus === "trusted" ? this.trustedFolder : this.rejectedFolder;
-        const certificateDest = safeStoreJoin(destFolder, path4.basename(srcEntry.filename));
-        debugLog("#moveCertificate", fingerprint.substring(0, 10), "old name", srcEntry.filename);
-        debugLog("#moveCertificate", fingerprint.substring(0, 10), "new name", certificateDest);
-        await fs7.promises.rename(srcEntry.filename, certificateDest);
-        indexSrc.delete(fingerprint);
-        const indexDest = newStatus === "trusted" ? this.#thumbs.trusted : this.#thumbs.rejected;
-        indexDest.set(fingerprint, { certificate, filename: certificateDest });
-      }
-    });
-  }
-  #findAssociatedCRLs(issuerCertificate) {
-    const issuerCertificateInfo = exploreCertificate(issuerCertificate);
-    const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
-    return this.#thumbs.issuersCrl.get(key) ?? this.#thumbs.crl.get(key) ?? null;
-  }
-  /**
-   * Check whether a certificate has been revoked by its issuer's CRL.
-   *
-   * - Self-signed certificates are never considered revoked.
-   * - If no `issuerCertificate` is provided, the method attempts
-   *   to find it via {@link findIssuerCertificate}.
-   *
-   * @param certificate - the DER-encoded certificate to check
-   * @param issuerCertificate - optional issuer certificate; looked
-   *   up automatically when omitted
-   * @returns `Good` if not revoked, `BadCertificateRevoked` if the
-   *   serial number appears in a CRL,
-   *   `BadCertificateRevocationUnknown` if no CRL is available,
-   *   or `BadCertificateChainIncomplete` if the issuer cannot be
-   *   found.
-   */
-  async isCertificateRevoked(certificate, issuerCertificate) {
-    const chain = coerceCertificateChain(certificate);
-    const firstCertificate = chain[0];
-    if (isSelfSigned3(firstCertificate)) {
-      return "Good" /* Good */;
-    }
-    if (!issuerCertificate) {
-      issuerCertificate = await this.findIssuerCertificate(firstCertificate);
-    }
-    if (!issuerCertificate) {
-      issuerCertificate = findIssuerCertificateInChain(firstCertificate, chain);
-    }
-    if (!issuerCertificate) {
-      return "BadCertificateChainIncomplete" /* BadCertificateChainIncomplete */;
-    }
-    const crls = this.#findAssociatedCRLs(issuerCertificate);
-    if (!crls) {
-      return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
-    }
-    const certInfo = exploreCertificate(firstCertificate);
-    const serialNumber = certInfo.tbsCertificate.serialNumber || certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.serial || "";
-    const key = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint || "<unknown>";
-    const crl2 = this.#thumbs.crl.get(key) ?? null;
-    if (crls.serialNumbers[serialNumber] || crl2?.serialNumbers[serialNumber]) {
-      return "BadCertificateRevoked" /* BadCertificateRevoked */;
-    }
-    return "Good" /* Good */;
-  }
-  #pendingCrlToProcess = 0;
-  #onCrlProcessWaiters = [];
-  #queue = [];
-  #onCrlFileAdded(index, filename) {
-    this.#queue.push({ index, filename });
-    this.#pendingCrlToProcess += 1;
-    if (this.#pendingCrlToProcess === 1) {
-      this.#processNextCrl();
-    }
-  }
-  async #processNextCrl() {
-    try {
-      const nextCRL = this.#queue.shift();
-      if (!nextCRL) return;
-      const { index, filename } = nextCRL;
-      const crl = await readCertificateRevocationList(filename);
-      const crlInfo = exploreCertificateRevocationList(crl);
-      debugLog(chalk3.cyan("add CRL in folder "), filename);
-      const fingerprint = crlInfo.tbsCertList.issuerFingerprint;
-      if (!index.has(fingerprint)) {
-        index.set(fingerprint, { crls: [], serialNumbers: {} });
-      }
-      const data = index.get(fingerprint) || { crls: [], serialNumbers: {} };
-      data.crls.push({ crlInfo, filename });
-      for (const revokedCertificate of crlInfo.tbsCertList.revokedCertificates) {
-        const serialNumber = revokedCertificate.userCertificate;
-        if (!data.serialNumbers[serialNumber]) {
-          data.serialNumbers[serialNumber] = revokedCertificate.revocationDate;
-        }
-      }
-      debugLog(chalk3.cyan("CRL"), fingerprint, "serial numbers = ", Object.keys(data.serialNumbers));
-    } catch (err) {
-      debugLog("CRL filename error =");
-      debugLog(err);
-    }
-    this.#pendingCrlToProcess -= 1;
-    if (this.#pendingCrlToProcess === 0) {
-      for (const waiter of this.#onCrlProcessWaiters) {
-        waiter();
-      }
-      this.#onCrlProcessWaiters.length = 0;
-    } else {
-      this.#processNextCrl();
-    }
-  }
-  async #readCertificates() {
-    if (this.#readCertificatesCalled) {
-      return;
-    }
-    this.#readCertificatesCalled = true;
-    const usePolling = process.env.OPCUA_PKI_USE_POLLING === "true";
-    const envInterval = process.env.OPCUA_PKI_POLLING_INTERVAL ? parseInt(process.env.OPCUA_PKI_POLLING_INTERVAL, 10) : void 0;
-    const pollingInterval = Math.min(10 * 60 * 1e3, Math.max(100, envInterval ?? this.folderPollingInterval));
-    const chokidarOptions = {
-      usePolling,
-      ...usePolling ? { interval: pollingInterval } : {},
-      depth: 0,
-      persistent: false
-    };
-    const allCapturedHandles = [];
-    const origWatch = fs7.watch;
-    let watcherReadyCount = 0;
-    const totalWatchers = 5;
-    fs7.watch = ((...args) => {
-      const handle = origWatch.apply(fs7, args);
-      handle.setMaxListeners(handle.getMaxListeners() + 1);
-      handle.on("error", () => {
-      });
-      allCapturedHandles.push(handle);
-      return handle;
-    });
-    const createUnreffedWatcher = (folder) => {
-      const startIdx = allCapturedHandles.length;
-      const w = chokidar.watch(folder, chokidarOptions);
-      const unreffAll = () => {
-        for (let i = startIdx; i < allCapturedHandles.length; i++) {
-          allCapturedHandles[i].unref();
-        }
-        watcherReadyCount++;
-        if (watcherReadyCount >= totalWatchers) {
-          fs7.watch = origWatch;
-        }
-      };
-      return { w, capturedHandles: allCapturedHandles.slice(startIdx), unreffAll };
-    };
-    await Promise.all([
-      this.#scanCertFolder(this.trustedFolder, this.#thumbs.trusted),
-      this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs),
-      this.#scanCertFolder(this.rejectedFolder, this.#thumbs.rejected),
-      this.#scanCrlFolder(this.crlFolder, this.#thumbs.crl),
-      this.#scanCrlFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl)
-    ]);
-    if (this.#disableFileWatchers) {
-      fs7.watch = origWatch;
-    } else {
-      this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
-      this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
-      this.#startWatcher(this.rejectedFolder, this.#thumbs.rejected, createUnreffedWatcher, "rejected");
-      this.#startCrlWatcher(this.crlFolder, this.#thumbs.crl, createUnreffedWatcher, "crl");
-      this.#startCrlWatcher(this.issuersCrlFolder, this.#thumbs.issuersCrl, createUnreffedWatcher, "issuersCrl");
-    }
-  }
-  /**
-   * Scan a certificate folder and populate the in-memory index.
-   * Uses async readdir/stat to yield the event loop between
-   * file reads, preventing main-loop stalls with large folders.
-   */
-  async #scanCertFolder(folder, index) {
-    if (!fs7.existsSync(folder)) return;
-    const files = await fs7.promises.readdir(folder);
-    for (const file of files) {
-      const filename = path4.join(folder, file);
-      try {
-        const stat = await fs7.promises.stat(filename);
-        if (!stat.isFile()) continue;
-        const certs = await readCertificateChainAsync(filename);
-        if (certs.length === 0) continue;
-        const certificate = certs[0];
-        if (certs.length > 1) {
-          try {
-            await fs7.promises.writeFile(filename, toPem(certs, "CERTIFICATE"), "ascii");
-          } catch (writeErr) {
-            debugLog(`scanCertFolder: could not rewrite legacy PEM ${filename} (read-only fs?)`, writeErr);
-          }
-          for (let i = 1; i < certs.length; i++) {
-            if (isIssuer(certs[i])) {
-              try {
-                await this.addIssuer(certs[i]);
-              } catch (issuerErr) {
-                debugLog(`scanCertFolder: could not auto-register issuer from ${filename}`, issuerErr);
-              }
-            }
-          }
-        }
-        const info = exploreCertificate(certificate);
-        const fingerprint = makeFingerprint(certificate);
-        index.set(fingerprint, { certificate, filename, info });
-        this.#filenameToHash.set(filename, fingerprint);
-      } catch (err) {
-        debugLog(`scanCertFolder: skipping ${filename}`, err);
-      }
-    }
-  }
-  /**
-   * Scan a CRL folder and populate the in-memory CRL index.
-   */
-  async #scanCrlFolder(folder, index) {
-    if (!fs7.existsSync(folder)) return;
-    const files = await fs7.promises.readdir(folder);
-    for (const file of files) {
-      const filename = path4.join(folder, file);
-      try {
-        const stat = await fs7.promises.stat(filename);
-        if (!stat.isFile()) continue;
-        this.#onCrlFileAdded(index, filename);
-      } catch (err) {
-        debugLog(`scanCrlFolder: skipping ${filename}`, err);
-      }
-    }
-    await this.#waitAndCheckCRLProcessingStatus();
-  }
-  /**
-   * Start a chokidar watcher for a CRL folder.
-   * Non-blocking — does NOT await "ready".
-   */
-  #startCrlWatcher(folder, index, createUnreffedWatcher, store) {
-    const { w, unreffAll } = createUnreffedWatcher(folder);
-    w.on("error", (err) => {
-      debugLog(`chokidar CRL watcher error on ${folder}:`, err);
-    });
-    let ready = false;
-    w.on("unlink", (filename) => {
-      for (const [key, data] of index.entries()) {
-        data.crls = data.crls.filter((c) => c.filename !== filename);
-        if (data.crls.length === 0) {
-          index.delete(key);
-        }
-      }
-      if (ready) {
-        this.emit("crlRemoved", { store, filename });
-      }
-    });
-    w.on("add", (filename) => {
-      if (ready) {
-        this.#onCrlFileAdded(index, filename);
-        this.emit("crlAdded", { store, filename });
-      }
-    });
-    w.on("change", (changedPath) => {
-      debugLog("change in folder ", folder, changedPath);
-    });
-    this.#watchers.push(w);
-    this.#pendingUnrefs.add(unreffAll);
-    w.on("ready", () => {
-      ready = true;
-      this.#pendingUnrefs.delete(unreffAll);
-      unreffAll();
-    });
-  }
-  /**
-   * Start a chokidar watcher for a certificate folder.
-   * Non-blocking — does NOT await "ready".
-   */
-  #startWatcher(folder, index, createUnreffedWatcher, store) {
-    const { w, unreffAll } = createUnreffedWatcher(folder);
-    w.on("error", (err) => {
-      debugLog(`chokidar cert watcher error on ${folder}:`, err);
-    });
-    let ready = false;
-    w.on("unlink", (filename) => {
-      debugLog(chalk3.cyan(`unlink in folder ${folder}`), filename);
-      const h = this.#filenameToHash.get(filename);
-      if (h && index.has(h)) {
-        index.delete(h);
-        this.emit("certificateRemoved", { store, fingerprint: h, filename });
-      }
-    });
-    w.on("add", (filename) => {
-      debugLog(chalk3.cyan(`add in folder ${folder}`), filename);
-      try {
-        const certificate = readCertificateChain(filename)[0];
-        const info = exploreCertificate(certificate);
-        const fingerprint = makeFingerprint(certificate);
-        const isNew = !index.has(fingerprint);
-        index.set(fingerprint, { certificate, filename, info });
-        this.#filenameToHash.set(filename, fingerprint);
-        debugLog(
-          chalk3.magenta("CERT"),
-          info.tbsCertificate.subjectFingerPrint,
-          info.tbsCertificate.serialNumber,
-          info.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint
-        );
-        if (ready || isNew) {
-          this.emit("certificateAdded", { store, certificate, fingerprint, filename });
-        }
-      } catch (err) {
-        debugLog(`Walk files in folder ${folder} with file ${filename}`);
-        debugLog(err);
-      }
-    });
-    w.on("change", (changedPath) => {
-      debugLog(chalk3.cyan(`change in folder ${folder}`), changedPath);
-      try {
-        const certificate = readCertificateChain(changedPath)[0];
-        const newFingerprint = makeFingerprint(certificate);
-        const oldHash = this.#filenameToHash.get(changedPath);
-        if (oldHash && oldHash !== newFingerprint) {
-          index.delete(oldHash);
-        }
-        index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificate(certificate) });
-        this.#filenameToHash.set(changedPath, newFingerprint);
-        this.emit("certificateChange", { store, certificate, fingerprint: newFingerprint, filename: changedPath });
-      } catch (err) {
-        debugLog(`change event: failed to re-read ${changedPath}`, err);
-      }
-    });
-    this.#watchers.push(w);
-    this.#pendingUnrefs.add(unreffAll);
-    w.on("ready", () => {
-      ready = true;
-      this.#pendingUnrefs.delete(unreffAll);
-      unreffAll();
-      debugLog("ready");
-      debugLog([...index.keys()].map((k) => k.substring(0, 10)));
-    });
-  }
-  // make sure that all crls have been processed.
-  async #waitAndCheckCRLProcessingStatus() {
-    return new Promise((resolve, _reject) => {
-      if (this.#pendingCrlToProcess === 0) {
-        setImmediate(resolve);
-        return;
-      }
-      this.#onCrlProcessWaiters.push(resolve);
-    });
-  }
-};
-
-// packages/node-opcua-pki/lib/pki/toolbox_pfx.ts
-import assert5 from "assert";
-import fs8 from "fs";
-import {
-  certificateMatchesPrivateKey,
-  certificatesToPem,
-  coercePrivateKeyPem as coercePrivateKeyPem3,
-  createPfx,
-  makeSHA1Thumbprint as makeSHA1Thumbprint2,
-  Pkcs12UnsupportedAlgorithmError,
-  parsePfx,
-  readCertificateChain as readCertificateChain2,
-  readPrivateKey as readPrivateKey2,
-  toPem as toPem2,
-  x509
-} from "node-opcua-crypto";
-async function readPfxFile(options) {
-  const { pfxFile, passphrase = "" } = options;
-  assert5(fs8.existsSync(pfxFile), `PFX file does not exist: ${pfxFile}`);
-  try {
-    return await parsePfx(await fs8.promises.readFile(pfxFile), passphrase);
-  } catch (err) {
-    if (err instanceof Pkcs12UnsupportedAlgorithmError) {
-      const explained = new Error(
-        [
-          `${pfxFile} uses an encryption algorithm that is not supported (${err.message}).`,
-          "Bundles written by openssl 1.x default to 40-bit RC2, which openssl 3 itself",
-          "rejects unless given -legacy. Convert the file once with:",
-          "  openssl pkcs12 -legacy -in old.pfx -nodes -out tmp.pem",
-          "  openssl pkcs12 -export -in tmp.pem -out new.pfx"
-        ].join("\n")
-      );
-      explained.cause = err;
-      throw explained;
-    }
-    throw err;
-  }
-}
-async function createPFX(options) {
-  const { certificateFile, privateKeyFile, privateKeyPassphrase, outputFile, passphrase = "", caCertificateFiles } = options;
-  assert5(fs8.existsSync(certificateFile), `Certificate file does not exist: ${certificateFile}`);
-  assert5(fs8.existsSync(privateKeyFile), `Private key file does not exist: ${privateKeyFile}`);
-  const [certificate, ...bundledIssuers] = readCertificateChain2(certificateFile);
-  if (!certificate) {
-    throw new Error(`Certificate file holds no certificate: ${certificateFile}`);
-  }
-  const certificateChain = [...bundledIssuers];
-  for (const caFile of caCertificateFiles ?? []) {
-    assert5(fs8.existsSync(caFile), `CA certificate file does not exist: ${caFile}`);
-    certificateChain.push(...readCertificateChain2(caFile));
-  }
-  const privateKey = readPrivateKey2(privateKeyFile, privateKeyPassphrase);
-  if (!certificateMatchesPrivateKey(certificate, privateKey)) {
-    throw new Error(`The private key ${privateKeyFile} does not match the certificate ${certificateFile}`);
-  }
-  const pfx = await createPfx({
-    certificate,
-    certificateChain,
-    privateKey,
-    password: passphrase,
-    friendlyName: options.friendlyName
-  });
-  await fs8.promises.writeFile(outputFile, pfx);
-}
-async function extractCertificateFromPFX(options) {
-  const { certificate } = await readPfxFile(options);
-  return toPem2(certificate, "CERTIFICATE");
-}
-async function extractPrivateKeyFromPFX(options) {
-  const { privateKey } = await readPfxFile(options);
-  return coercePrivateKeyPem3(privateKey);
-}
-async function extractCACertificatesFromPFX(options) {
-  const { certificateChain } = await readPfxFile(options);
-  return certificateChain.length === 0 ? "" : certificatesToPem(certificateChain);
-}
-async function extractAllFromPFX(options) {
-  const { certificate, certificateChain, privateKey, friendlyName } = await readPfxFile(options);
-  return {
-    certificate: toPem2(certificate, "CERTIFICATE"),
-    privateKey: coercePrivateKeyPem3(privateKey),
-    caCertificates: certificateChain.length === 0 ? "" : certificatesToPem(certificateChain),
-    friendlyName
-  };
-}
-async function convertPFXtoPEM(pfxFile, pemFile, passphrase = "") {
-  const { certificate, certificateChain, privateKey } = await readPfxFile({ pfxFile, passphrase });
-  const parts = [coercePrivateKeyPem3(privateKey), toPem2(certificate, "CERTIFICATE")];
-  if (certificateChain.length > 0) {
-    parts.push(certificatesToPem(certificateChain));
-  }
-  await fs8.promises.writeFile(pemFile, `${parts.map((part) => part.trimEnd()).join("\n")}
-`, "utf-8");
-}
-function formatThumbprint(certificate) {
-  return (makeSHA1Thumbprint2(certificate).toString("hex").toUpperCase().match(/../g) ?? []).join(":");
-}
-function describePublicKey(certificate) {
-  const algorithm = certificate.publicKey.algorithm;
-  if (algorithm.modulusLength) {
-    return `${algorithm.name} ${algorithm.modulusLength} bits`;
-  }
-  if (algorithm.namedCurve) {
-    return `${algorithm.name} ${algorithm.namedCurve}`;
-  }
-  return algorithm.name;
-}
-function describeCertificate(der, indent) {
-  const certificate = new x509.X509Certificate(der);
-  return [
-    `${indent}subject          : ${certificate.subject}`,
-    `${indent}issuer           : ${certificate.issuer}`,
-    `${indent}serial number    : ${certificate.serialNumber}`,
-    `${indent}not before       : ${certificate.notBefore.toISOString()}`,
-    `${indent}not after        : ${certificate.notAfter.toISOString()}`,
-    `${indent}public key       : ${describePublicKey(certificate)}`,
-    `${indent}signature        : ${certificate.signatureAlgorithm.name}`,
-    `${indent}SHA-1 thumbprint : ${formatThumbprint(der)}`
-  ];
-}
-async function dumpPFX(pfxFile, passphrase = "") {
-  const { certificate, certificateChain, privateKey, friendlyName } = await readPfxFile({ pfxFile, passphrase });
-  const lines = [`PFX bundle : ${pfxFile}`];
-  if (friendlyName) {
-    lines.push(`friendly name : ${friendlyName}`);
-  }
-  const keyVerdict = certificateMatchesPrivateKey(certificate, privateKey) ? "matches this certificate" : "DOES NOT match this certificate";
-  lines.push("", "certificate", ...describeCertificate(certificate, "  "), `  private key      : ${keyVerdict}`);
-  lines.push("", `issuer chain : ${certificateChain.length} certificate(s)`);
-  for (const [index, issuer] of certificateChain.entries()) {
-    lines.push(`  [${index}]`, ...describeCertificate(issuer, "    "));
-  }
-  return `${lines.join("\n")}
-`;
-}
-export {
-  CertificateAuthority,
-  CertificateAuthorityCore,
-  CertificateManager,
-  CertificateManagerState,
-  ChainCompletionStatus,
-  NativeCaBackend,
-  OpenSslCaBackend,
-  PrivateKeyPassphraseRequiredError,
-  PrivateKeyUnavailableError2 as PrivateKeyUnavailableError,
-  Subject,
-  VerificationStatus,
-  adjustApplicationUri,
-  adjustDate,
-  coerceCertificateChain,
-  convertPFXtoPEM,
-  createPFX,
-  dumpPFX,
-  extractAllFromPFX,
-  extractCACertificatesFromPFX,
-  extractCertificateFromPFX,
-  extractPrivateKeyFromPFX,
-  findIssuerCertificateInChain,
-  install_prerequisite,
-  isIntermediateIssuer,
-  isIssuer,
-  isOpaqueSigner,
-  isRootIssuer,
-  makeFingerprint,
-  quote,
-  resolvePrivateKeyPassphrase,
-  safeStoreJoin,
-  toFilenameLabel
-};
-//# sourceMappingURL=index.mjs.map