node-opcua-pki 6.22.1 → 7.0.0

package/dist/{index.d.ts → lib/pki/certificate_manager.d.ts}

@@ -1,115 +1,20 @@
-import { IKeyOperations, PrivateKey, Certificate, SubjectOptions, DER, CertificateRevocationList } from 'node-opcua-crypto';
-export { AsymmetricDecryptParams, AsymmetricSignParams, IKeyOperations, KeyMetadata, PrivateKeyPassphraseRequiredError, PrivateKeyUnavailableError, Subject, SubjectOptions } from 'node-opcua-crypto';
-import { C as CaBackend, a as CertificateAuthorityCore, P as Params, b as ProcessAltNamesParam, c as CertificateAuthorityCoreOptions, K as KeySize, d as PrivateKeyPassphrase, e as PrivateKeyProvider, f as CreateSelfSignCertificateParam, F as Filename } from './core-BwqSJPHc.js';
-export { g as CertificateStatus, h as CreateCertificateSigningRequestOptions, i as CreateCertificateSigningRequestWithConfigOptions, j as CreateSelfSignCertificateWithConfigParam, G as GenerateKeyPairAndSignOptions, k as GenerateKeyPairAndSignPFXOptions, I as InitializeCSRResult, l as InstallCACertificateResult, m as KeyLength, N as NativeCaBackend, n as PkiBackendCapabilities, S as SignCertificateOptions, o as StartDateEndDateParam, T as Thumbprint, p as adjustApplicationUri, q as adjustDate, r as isOpaqueSigner, s as quote, t as resolvePrivateKeyPassphrase } from './core-BwqSJPHc.js';
-import { EventEmitter } from 'node:events';
-
-/**
- * The default {@link CaBackend}: shells out to the `openssl` CLI, exactly as
- * `CertificateAuthority` always has — this is a pure code move (plus a lock
- * around every database-mutating operation, temp-config cleanup, and
- * explicit `envOverrides` on every config render) with no change in the
- * openssl commands issued or the files produced.
- */
-declare class OpenSslCaBackend implements CaBackend {
-    #private;
-    /** The openssl CLI loads its key from a file, so it cannot call out to an HSM. */
-    readonly supportsExternalSigner = false;
-    preflight(): Promise<void>;
-    generateCaCsr(ca: CertificateAuthorityCore, _caRootDir: string, privateKeyFile: string, csrFile: string): Promise<void>;
-    bootstrap(ca: CertificateAuthorityCore): Promise<void>;
-    regenerateCrl(ca: CertificateAuthorityCore): Promise<void>;
-    signSubordinateCsr(ca: CertificateAuthorityCore, csrFile: string, certFile: string, validityDays: number): Promise<void>;
-    signEndEntityCsr(ca: CertificateAuthorityCore, certificate: string, csr: string, params1: Params, sanOverride: Required<ProcessAltNamesParam>): Promise<void>;
-    revoke(ca: CertificateAuthorityCore, certificate: string, reason: string): Promise<void>;
-    createSelfSignedCertificate(ca: CertificateAuthorityCore, certificateFile: string, privateKeyFile: string, params: Params): Promise<void>;
-}
-
-/** openssl argv entries plus the env they need; merge `env` into `ExecuteOptions.env`. */
-interface OpensslPassArg {
-    args: string[];
-    env: NodeJS.ProcessEnv;
-}
-
-/**
- *
- * return path to the openssl executable
- */
-declare function install_prerequisite(): Promise<string>;
-
-/**
- * Options for {@link CertificateAuthority}: the core's, except that the
- * backend is named rather than supplied.
- */
-interface CertificateAuthorityOptions extends Omit<CertificateAuthorityCoreOptions, "backend"> {
-    /**
-     * Signing backend to use.
-     *
-     * - `"openssl"` (default): shells out to the `openssl` CLI, as this
-     *   class always has.
-     * - `"native"`: signs in pure JS via `node-opcua-crypto`, writing the
-     *   same on-disk database format, and needs no `openssl` executable.
-     *
-     * Setting `signer` implies `"native"`, since the openssl CLI can only
-     * load a key from a file.
-     *
-     * To supply a backend instance directly - including one of your own -
-     * use {@link CertificateAuthorityCore}, which is also the class to
-     * build against when you do not want the openssl backend in your
-     * bundle at all.
-     */
-    backend?: "openssl" | "native";
-}
-/**
- * A Certificate Authority with a backend chosen for you.
- *
- * This is {@link CertificateAuthorityCore} plus the convenience that made
- * it the historical API: name a backend, or name nothing and get openssl.
- * Because it resolves the name, it necessarily references both backends,
- * which is why the core exists separately - a program that never imports
- * this class never pulls the openssl backend into its bundle.
- */
-declare class CertificateAuthority extends CertificateAuthorityCore {
-    constructor(options: CertificateAuthorityOptions);
-    /**
-     * @internal `-passin env:` argv + env for an openssl call that loads
-     * this CA's key (always emitted, empty when none).
-     *
-     * The openssl backend builds its own now; this remains so that external
-     * code calling it keeps working, and lives here rather than on the core
-     * because the flag means nothing to a backend that spawns nothing.
-     */
-    _opensslPassin(): Promise<OpensslPassArg>;
-    /**
-     * @internal
-     * Legacy shim: publish the `CDP_URL` / `AIA_VALUE` config substitution
-     * values to the shared env registry, or unset them so the matching
-     * `{{#KEY}}...{{/KEY}}` blocks are stripped. Nothing in this package
-     * reads the registry any more - every openssl config render receives
-     * these values explicitly, from the same {@link caConfigEnvOverrides}
-     * builder this delegates to, so the two cannot drift - kept only for
-     * external code that renders openssl config templates against the
-     * registry directly.
-     *
-     * It lives on this class rather than the core because it is meaningful
-     * only to the openssl backend.
-     */
-    _wireRevocationEnvVars(): void;
-}
-
+import { EventEmitter } from "node:events";
+import { type Certificate, type CertificateRevocationList, type DER, type IKeyOperations, type PrivateKey } from "node-opcua-crypto";
+import type { SubjectOptions } from "../misc/subject.js";
+import type { CreateSelfSignCertificateParam, Filename, KeySize, PrivateKeyPassphrase, PrivateKeyProvider } from "../toolbox/common.js";
 /**
  * Identifies which PKI sub-store a certificate event originated from.
  */
-type CertificateStore = "trusted" | "rejected" | "issuersCerts";
+export type CertificateStore = "trusted" | "rejected" | "issuersCerts";
 /**
  * Identifies which PKI sub-store a CRL event originated from.
  */
-type CrlStore = "crl" | "issuersCrl";
+export type CrlStore = "crl" | "issuersCrl";
 /**
  * Events emitted by {@link CertificateManager} when the
  * file-system watchers detect certificate or CRL changes.
  */
-interface CertificateManagerEvents {
+export interface CertificateManagerEvents {
     /** A certificate file was added to a store. */
     certificateAdded: (event: {
         store: CertificateStore;
@@ -148,7 +53,7 @@ interface CertificateManagerEvents {
  * By default all checks are **strict** (secure). Set individual
  * flags to `true` only in test/development environments.
  */
-interface AddCertificateValidationOptions {
+export interface AddCertificateValidationOptions {
     /**
      * Accept certificates whose validity period has expired
      * or is not yet active.
@@ -179,7 +84,7 @@ interface AddCertificateValidationOptions {
 /**
  * Options for creating a {@link CertificateManager}.
  */
-interface CertificateManagerOptions {
+export interface CertificateManagerOptions {
     /**
      * RSA key size for generated private keys.
      * @defaultValue 2048
@@ -267,7 +172,7 @@ interface CertificateManagerOptions {
  * Parameters for {@link createSelfSignedCertificate}.
  * All fields from {@link CreateSelfSignCertificateParam} are required.
  */
-interface CreateSelfSignCertificateParam1 extends CreateSelfSignCertificateParam {
+export interface CreateSelfSignCertificateParam1 extends CreateSelfSignCertificateParam {
     /**
      * Output path for the certificate.
      * @defaultValue `"own/certs/self_signed_certificate.pem"`
@@ -300,7 +205,7 @@ interface CreateSelfSignCertificateParam1 extends CreateSelfSignCertificateParam
  * a trusted CA — even if the leaf certificate itself is not
  * in the trusted store.
  */
-interface VerifyCertificateOptions {
+export interface VerifyCertificateOptions {
     /** Accept certificates whose "Not After" date has passed. */
     acceptOutdatedCertificate?: boolean;
     /** Accept issuer certificates whose "Not After" date has passed. */
@@ -328,7 +233,7 @@ interface VerifyCertificateOptions {
  * These mirror the OPC UA `StatusCode` values for certificate
  * validation results.
  */
-declare enum VerificationStatus {
+export declare enum VerificationStatus {
     /** The certificate provided as a parameter is not valid. */
     BadCertificateInvalid = "BadCertificateInvalid",
     /** An error occurred verifying security. */
@@ -362,30 +267,30 @@ declare enum VerificationStatus {
     /** Validation OK. */
     Good = "Good"
 }
-declare function coerceCertificateChain(certificate: Certificate | Certificate[]): Certificate[];
-declare function makeFingerprint(certificate: Certificate | Certificate[] | CertificateRevocationList): string;
-declare function toFilenameLabel(commonName: string): string;
-declare function safeStoreJoin(folder: string, filename: string): string;
+export declare function coerceCertificateChain(certificate: Certificate | Certificate[]): Certificate[];
+export declare function makeFingerprint(certificate: Certificate | Certificate[] | CertificateRevocationList): string;
+export declare function toFilenameLabel(commonName: string): string;
+export declare function safeStoreJoin(folder: string, filename: string): string;
 /**
  * Check if the provided certificate acts as an issuer (CA)
  * @param certificate - the DER-encoded certificate
  * @returns true if the certificate has CA basicConstraints or keyCertSign keyUsage
  */
-declare function isIssuer(certificate: Certificate): boolean;
+export declare function isIssuer(certificate: Certificate): boolean;
 /**
  * Check if the provided certificate acts as an intermediate issuer.
  * An intermediate issuer is a CA certificate that is not a root CA (not self-signed).
  * @param certificate - the DER-encoded certificate
  * @returns true if the certificate is a CA and is not self-signed
  */
-declare function isIntermediateIssuer(certificate: Certificate): boolean;
+export declare function isIntermediateIssuer(certificate: Certificate): boolean;
 /**
  * Check if the provided certificate acts as a root issuer.
  * A root issuer is a CA certificate that is self-signed.
  * @param certificate - the DER-encoded certificate
  * @returns true if the certificate is a CA and is self-signed
  */
-declare function isRootIssuer(certificate: Certificate): boolean;
+export declare function isRootIssuer(certificate: Certificate): boolean;
 /**
  * Find the issuer certificate for a given certificate within
  * a provided certificate chain.
@@ -394,11 +299,11 @@ declare function isRootIssuer(certificate: Certificate): boolean;
  * @param chain - candidate issuer certificates to search
  * @returns the matching issuer certificate, or `null` if not found
  */
-declare function findIssuerCertificateInChain(certificate: Certificate | Certificate[], chain: Certificate[]): Certificate | null;
+export declare function findIssuerCertificateInChain(certificate: Certificate | Certificate[], chain: Certificate[]): Certificate | null;
 /**
  * Lifecycle state of a {@link CertificateManager} instance.
  */
-declare enum CertificateManagerState {
+export declare enum CertificateManagerState {
     Uninitialized = 0,
     Initializing = 1,
     Initialized = 2,
@@ -453,7 +358,7 @@ declare enum CertificateManagerState {
 /**
  * Status codes returned by {@link CertificateManager.completeCertificateChain}.
  */
-declare enum ChainCompletionStatus {
+export declare enum ChainCompletionStatus {
     /** The chain already reached a self-signed root — no action was needed. */
     AlreadyComplete = "AlreadyComplete",
     /** One or more issuer certificates were successfully appended. */
@@ -469,7 +374,7 @@ declare enum ChainCompletionStatus {
 /**
  * Result of {@link CertificateManager.completeCertificateChain}.
  */
-interface ChainCompletionResult {
+export interface ChainCompletionResult {
     /** The (possibly completed) certificate chain, leaf first. */
     chain: Certificate[];
     /** Status code indicating whether completion succeeded and why/why not. */
@@ -477,7 +382,7 @@ interface ChainCompletionResult {
     /** Human-readable diagnostic message. */
     message: string;
 }
-declare class CertificateManager extends EventEmitter {
+export declare class CertificateManager extends EventEmitter {
     #private;
     /**
      * Dispose **all** active CertificateManager instances,
@@ -872,132 +777,3 @@ declare class CertificateManager extends EventEmitter {
      */
     isCertificateRevoked(certificate: Certificate | Certificate[], issuerCertificate?: Certificate | null): Promise<VerificationStatus>;
 }
-
-/**
- * Options for creating a PFX (PKCS#12) file.
- */
-interface CreatePFXOptions {
-    /** Path to the certificate file (PEM or DER). */
-    certificateFile: Filename;
-    /** Path to the private key file (PEM, plaintext or encrypted PKCS#8). */
-    privateKeyFile: Filename;
-    /**
-     * Passphrase that decrypts `privateKeyFile` if it is an encrypted
-     * PKCS#8 key (e.g. a `CertificateManager` created with
-     * `privateKeyPassphrase`). Omit for a plaintext key. This is distinct
-     * from `passphrase`, which protects the *output* PFX bundle.
-     */
-    privateKeyPassphrase?: string;
-    /** Output path for the generated PFX file. */
-    outputFile: Filename;
-    /**
-     * Optional passphrase to protect the PFX file.
-     * If omitted, the PFX is created without a password.
-     */
-    passphrase?: string;
-    /**
-     * Optional path(s) to CA / intermediate certificate files
-     * to include in the PFX bundle.
-     */
-    caCertificateFiles?: Filename[];
-    /**
-     * Optional display label stored on the bundle, the equivalent of
-     * openssl's `-name`. The Windows certificate store and `keytool` show
-     * it; {@link extractAllFromPFX} and {@link dumpPFX} report it back.
-     */
-    friendlyName?: string;
-}
-/**
- * Options for extracting data from a PFX (PKCS#12) file.
- */
-interface ExtractPFXOptions {
-    /** Path to the PFX file. */
-    pfxFile: Filename;
-    /**
-     * Passphrase used when the PFX was created.
-     * Pass an empty string for unprotected PFX files.
-     */
-    passphrase?: string;
-}
-/**
- * Result of extracting data from a PFX file.
- */
-interface ExtractPFXResult {
-    /** The certificate in PEM format. */
-    certificate: string;
-    /** The private key in PEM format. */
-    privateKey: string;
-    /**
-     * The CA / intermediate certificates in PEM format
-     * (empty string if none).
-     */
-    caCertificates: string;
-    /** The display label the bundle carries, if it has one. */
-    friendlyName?: string;
-}
-/**
- * Create a PFX (PKCS#12) file from a certificate and private key.
- *
- * The bundle is protected with PBES2 / AES-256-CBC under an SHA-256 MAC. If
- * `certificateFile` holds more than one PEM block, the first is the
- * identity and the rest join the issuer chain, ahead of any
- * `caCertificateFiles`.
- *
- * Nothing is written unless every input reads back cleanly and the private
- * key belongs to the certificate, so a wrong `privateKeyPassphrase` or a
- * mismatched pair leaves no half-made file behind.
- *
- * @param options - see {@link CreatePFXOptions}
- */
-declare function createPFX(options: CreatePFXOptions): Promise<void>;
-/**
- * Extract the client/server certificate from a PFX file.
- *
- * @returns the certificate in PEM format.
- */
-declare function extractCertificateFromPFX(options: ExtractPFXOptions): Promise<string>;
-/**
- * Extract the private key from a PFX file.
- *
- * @returns the private key as unencrypted PKCS#8 PEM.
- */
-declare function extractPrivateKeyFromPFX(options: ExtractPFXOptions): Promise<string>;
-/**
- * Extract the CA / intermediate certificates from a PFX file.
- *
- * @returns the CA certificates in PEM format
- *          (empty string if none are present).
- */
-declare function extractCACertificatesFromPFX(options: ExtractPFXOptions): Promise<string>;
-/**
- * Extract certificate + private key + CA certs from a PFX file
- * in a single call.
- *
- * Prefer this over the single-part helpers when you want more than one
- * part: the file is read, decrypted and MAC-verified once here, against
- * once per part.
- *
- * @returns an {@link ExtractPFXResult} with all PEM-encoded parts.
- */
-declare function extractAllFromPFX(options: ExtractPFXOptions): Promise<ExtractPFXResult>;
-/**
- * Convert a PFX file to a single PEM file holding the private key, the
- * certificate, and any issuer certificates the bundle carries, in that
- * order.
- */
-declare function convertPFXtoPEM(pfxFile: Filename, pemFile: Filename, passphrase?: string): Promise<void>;
-/**
- * Dump the contents of a PFX file in human-readable form.
- *
- * The layout is this package's own, not `openssl pkcs12 -info`'s: it
- * describes the identity the bundle carries rather than the algorithms it
- * was encrypted with, and it states outright whether the enclosed key
- * matches the enclosed certificate - the question a bundle that will not
- * load is usually being asked. Treat the text as something to read, not to
- * parse; use {@link extractAllFromPFX} to get at the parts.
- *
- * @returns the human-readable dump as a string.
- */
-declare function dumpPFX(pfxFile: Filename, passphrase?: string): Promise<string>;
-
-export { type AddCertificateValidationOptions, CaBackend, CertificateAuthority, CertificateAuthorityCore, CertificateAuthorityCoreOptions, type CertificateAuthorityOptions, CertificateManager, type CertificateManagerEvents, type CertificateManagerOptions, CertificateManagerState, type CertificateStore, type ChainCompletionResult, ChainCompletionStatus, type CreatePFXOptions, CreateSelfSignCertificateParam, type CreateSelfSignCertificateParam1, type CrlStore, type ExtractPFXOptions, type ExtractPFXResult, Filename, KeySize, OpenSslCaBackend, Params, PrivateKeyPassphrase, PrivateKeyProvider, ProcessAltNamesParam, VerificationStatus, type VerifyCertificateOptions, coerceCertificateChain, convertPFXtoPEM, createPFX, dumpPFX, extractAllFromPFX, extractCACertificatesFromPFX, extractCertificateFromPFX, extractPrivateKeyFromPFX, findIssuerCertificateInChain, install_prerequisite, isIntermediateIssuer, isIssuer, isRootIssuer, makeFingerprint, safeStoreJoin, toFilenameLabel };