{"version":3,"file":"certInfo.js","sourceRoot":"","sources":["../../src/codeSign/certInfo.ts"],"names":[],"mappings":";;;AAkXA,oCAuIC;AAzfD,mCAAqD;AACrD,iCAAgC;AAChC,+BAA8B;AAC9B,mDAA8D;AAC9D,uCAAmC;AACnC,+CAAkC;AAElC,yCAAyC;AACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAE5C,2CAA2C;AAC3C,MAAM,YAAY,GAAG,4BAA4B,CAAA;AAEjD,wDAAwD;AACxD,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,oBAAoB,GAA2B;IACnD,SAAS,EAAE,GAAG;IACd,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,YAAY;CACzB,CAAA;AAED,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAEtC,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,mFAAmF;QACnF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4FAA4F;AAC5F,uFAAuF;AACvF,MAAM,cAAc,GAAG,IAAI,kBAAc,EAAE,CAAA;AAC3C,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAqB,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAQ,CAAC,CAAA;AAE9I,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,EAAE,CAAA;AACX,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,yCAAyC;AAEzC,+EAA+E;AAE/E,uCAAuC;AACvC,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;IAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5K,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/I,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAA;AAErC;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,aAAqB;IACtD,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,IAAI,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,oEAAoE,aAAa,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAA;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IACvC,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAClD,CAAC;IACD,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,CAAC,GAAa,IAAI,KAAK,CAAC,EAAE,CAAC,CAAA;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,sDAAsD;AACtD,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,EAAU,EAAE,IAAY,EAAE,aAAqB;IACjF,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,MAAM,0DAA0D,CAAC,CAAA;IAC5H,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,sCAAsC;IAEnE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5C,4DAA4D;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;QAE9I,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,GAAG,EAAE,CAAA;QAEV,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;gBACvF,CAAC,EAAE,CAAA;YACL,CAAC;QACH,CAAC,CAAA;QAED,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QACD,KAAK,EAAE,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QACD,KAAK,EAAE,CAAA;QACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAA;QACR,CAAC;QAED,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,gDAAgD;QAChD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,qCAAqC;IACrC,iFAAiF;IACjF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAClC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,2DAA2D,CAAC,CAAA;IAC9J,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,gBAAgB,GAAwF;IAC5G,yBAAyB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,gCAAgC;IAC7G,yBAAyB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,iCAAiC;IAC7G,yBAAyB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,4BAA4B;IAClH,yBAAyB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,4BAA4B;CACjH,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,MAAO,CAAA;AAEzC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,IAAY,EAAE,UAAkB,EAAE,EAAU,EAAE,MAAc;IACxG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,8BAA8B,yBAAyB,iEAAiE,CAClK,CAAA;IACH,CAAC;IACD,sFAAsF;IACtF,sEAAsE;IACtE,MAAM,cAAc,GAAG,IAAI,CAAA;IAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,gCAAgC,cAAc,oDAAoD,CAAC,CAAA;IAC3J,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,CAAA,CAAC,qBAAqB;IAClC,MAAM,CAAC,GAAG,EAAE,CAAA,CAAC,oBAAoB;IAEjC,uCAAuC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAE7B,0EAA0E;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,kFAAkF;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,sCAAsC;QACtC,IAAI,EAAE,GAAW,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,EAAE,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QAC7C,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QAEtB,4CAA4C;QAC5C,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,wEAAwE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrB,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;oBACjC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;oBACnB,KAAK,GAAG,GAAG,IAAI,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACnC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC/B,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;IAC9B,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,KAAa,EAAE,SAAc,EAAE,UAAe,EAAE,QAAgB;;IAC9F,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAEpC,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE5E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1E,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAExE,kEAAkE;IAClE,iFAAiF;IACjF,IAAI,QAAgB,CAAA;IACpB,IAAI,MAAA,UAAU,CAAC,OAAO,0CAAE,aAAa,EAAE,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAE,UAAU,CAAC,UAAU,CAAC,KAAe,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC1H,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,4EAA4E;QAC5E,6EAA6E;QAC7E,mCAAmC;QACnC,OAAO,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAA;IAEnC,sCAAsC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,IAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChI,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAE3D,yFAAyF;IACzF,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,0DAA0D,MAAM,EAAE,CAAC,CAAA;QACrI,CAAC;QACD,kBAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,0EAA0E,CAAC,CAAA;QAC9G,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,6FAA6F,MAAM,EAAE,CAAC,CAAA;IAC9J,CAAC;IAED,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,WAAW,0CAAE,iBAAiB,CAAA;IACnD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAA;IAChF,CAAC;IAED,yFAAyF;IACzF,EAAE;IACF,0FAA0F;IAC1F,uFAAuF;IACvF,4FAA4F;IAC5F,0FAA0F;IAC1F,MAAM,KAAK,GAAwB,EAAE,CAAA;IAErC,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,OAAoB,CAAA;QAExB,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACjD,wEAAwE;YACxE,OAAO,GAAI,EAAE,CAAC,OAA8B,CAAC,QAAQ,EAAE,CAAA;QACzD,CAAC;aAAM,IAAI,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,4BAA4B,EAAE,CAAC;YACjE,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,WAAW,CAAA;YAEjF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,yEAAyE;gBACzE,MAAM,SAAS,GAAG,sBAAsB,CACtC,KAAK,EACL,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,eAAe,EACvE,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,EAC7C,QAAQ,CACT,CAAA;gBACD,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACtD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,SAAQ;QACV,CAAC;QAED,oEAAoE;QACpE,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9C,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAyB,CAAA;gBAC7C,IAAI,OAAO,CAAC,WAAW,YAAY,KAAK,CAAC,WAAW,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,gDAAgD,CAAC,CAAA;IACjH,CAAC;IAED,gEAAgE;IAChE,4FAA4F;IAC5F,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;;QACpC,MAAM,MAAM,GAAG,MAAA,IAAI,CAAC,UAAU,0CAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC,CAAA;QAC5E,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,YAAY,KAAK,CAAC,WAAW,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAClE,CAAC;QACD,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC3D,OAAO,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,OAAO,KAAK,CAAC,MAAM,4EAA4E;YACzJ,uFAAuF,CAC1F,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAC,UAAU,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAA;IAE/D,mEAAmE;IACnE,sFAAsF;IACtF,yFAAyF;IACzF,kEAAkE;IAClE,MAAM,wBAAwB,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE;;QACP,MAAM,QAAQ,GAAG,MAAA,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,mCAAI,CAAC,CAAC,IAAI,CAAA;QACvD,OAAO,GAAG,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;IACzE,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAA;AACjD,CAAC;AAED;;;GAGG;AACU,QAAA,YAAY,GAAG;IAC1B,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;IACb,yBAAyB;CAC1B,CAAA","sourcesContent":["import { createDecipheriv, createHash } from \"crypto\"\nimport * as asn1js from \"asn1js\"\nimport * as pkijs from \"pkijs\"\nimport { Crypto as PeculiarCrypto } from \"@peculiar/webcrypto\"\nimport { readFile } from \"fs-extra\"\nimport { log } from \"builder-util\"\n\n// OID for codeSigning extended key usage\nconst CODE_SIGNING_OID = \"1.3.6.1.5.5.7.3.3\"\n\n// OID for the PKCS#12 certificate bag type\nconst CERT_BAG_OID = \"1.2.840.113549.1.12.10.1.3\"\n\n// Maps certificate attribute OIDs to their short names.\n// Matches the attributeTypeNames map in the Go reference implementation exactly:\n// https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go\nconst ATTRIBUTE_TYPE_NAMES: Record<string, string> = {\n  \"2.5.4.6\": \"C\",\n  \"2.5.4.10\": \"O\",\n  \"2.5.4.11\": \"OU\",\n  \"2.5.4.3\": \"CN\",\n  \"2.5.4.5\": \"SERIALNUMBER\",\n  \"2.5.4.7\": \"L\",\n  \"2.5.4.8\": \"ST\",\n  \"2.5.4.9\": \"STREET\",\n  \"2.5.4.17\": \"POSTALCODE\",\n}\n\n// Characters that must be quoted in a DN value to match Go binary BloodyMsString output\nconst NEEDS_DN_ESCAPING = /[,+\"\\\\<>;]/\n\nfunction escapeDnValue(value: string): string {\n  if (NEEDS_DN_ESCAPING.test(value)) {\n    // Escape embedded double-quotes by doubling them, then wrap entire value in quotes\n    return `\"${value.replace(/\"/g, '\"\"')}\"`\n  }\n  return value\n}\n\n// Set up the pkijs WebCrypto engine once. @peculiar/webcrypto supports legacy cipher suites\n// (RC2, 3DES) used by real-world CA-issued PFX files, unlike native Node.js WebCrypto.\nconst peculiarCrypto = new PeculiarCrypto()\npkijs.setEngine(\"peculiar\", new pkijs.CryptoEngine({ name: \"peculiar\", crypto: peculiarCrypto as any, subtle: peculiarCrypto.subtle }) as any)\n\nfunction toArrayBuffer(buf: Buffer): ArrayBuffer {\n  const ab = new ArrayBuffer(buf.byteLength)\n  new Uint8Array(ab).set(buf)\n  return ab\n}\n\n// ── PKCS#12 legacy PBE support (RFC 7292 Appendix B) ───────────────────────\n//\n// pkijs's CryptoEngine.decryptEncryptedContentInfo only handles PBES2\n// (OID 1.2.840.113549.1.5.13). Many real-world PFX files use the older\n// pkcs-12PbeIds ciphers (SHA1+3DES, SHA1+2DES, SHA1+RC2-128, SHA1+RC2-40).\n// We implement 3DES/2DES using Node.js's built-in `crypto` module and RC2\n// with a pure-TypeScript RFC 2268 implementation — RC2 was moved to\n// OpenSSL 3's legacy provider (not loaded by default) and is unavailable\n// via `createDecipheriv` in Node.js 22+.\n\n// ── RFC 2268 RC2-CBC implementation ─────────────────────────────────────────\n\n/** Permutation table from RFC 2268. */\nconst RC2_PITABLE = Uint8Array.from([\n  0xd9, 0x78, 0xf9, 0xc4, 0x19, 0xdd, 0xb5, 0xed, 0x28, 0xe9, 0xfd, 0x79, 0x4a, 0xa0, 0xd8, 0x9d, 0xc6, 0x7e, 0x37, 0x83, 0x2b, 0x76, 0x53, 0x8e, 0x62, 0x4c, 0x64, 0x88, 0x44,\n  0x8b, 0xfb, 0xa2, 0x17, 0x9a, 0x59, 0xf5, 0x87, 0xb3, 0x4f, 0x13, 0x61, 0x45, 0x6d, 0x8d, 0x09, 0x81, 0x7d, 0x32, 0xbd, 0x8f, 0x40, 0xeb, 0x86, 0xb7, 0x7b, 0x0b, 0xf0, 0x95,\n  0x21, 0x22, 0x5c, 0x6b, 0x4e, 0x82, 0x54, 0xd6, 0x65, 0x93, 0xce, 0x60, 0xb2, 0x1c, 0x73, 0x56, 0xc0, 0x14, 0xa7, 0x8c, 0xf1, 0xdc, 0x12, 0x75, 0xca, 0x1f, 0x3b, 0xbe, 0xe4,\n  0xd1, 0x42, 0x3d, 0xd4, 0x30, 0xa3, 0x3c, 0xb6, 0x26, 0x6f, 0xbf, 0x0e, 0xda, 0x46, 0x69, 0x07, 0x57, 0x27, 0xf2, 0x1d, 0x9b, 0xbc, 0x94, 0x43, 0x03, 0xf8, 0x11, 0xc7, 0xf6,\n  0x90, 0xef, 0x3e, 0xe7, 0x06, 0xc3, 0xd5, 0x2f, 0xc8, 0x66, 0x1e, 0xd7, 0x08, 0xe8, 0xea, 0xde, 0x80, 0x52, 0xee, 0xf7, 0x84, 0xaa, 0x72, 0xac, 0x35, 0x4d, 0x6a, 0x2a, 0x96,\n  0x1a, 0xd2, 0x71, 0x5a, 0x15, 0x49, 0x74, 0x4b, 0x9f, 0xd0, 0x5e, 0x04, 0x18, 0xa4, 0xec, 0xc2, 0xe0, 0x41, 0x6e, 0x0f, 0x51, 0xcb, 0xcc, 0x24, 0x91, 0xaf, 0x50, 0xa1, 0xf4,\n  0x70, 0x39, 0x99, 0x7c, 0x3a, 0x85, 0x23, 0xb8, 0xb4, 0x7a, 0xfc, 0x02, 0x36, 0x5b, 0x25, 0x55, 0x97, 0x31, 0x2d, 0x5d, 0xfa, 0x98, 0xe3, 0x8a, 0x92, 0xae, 0x05, 0xdf, 0x29,\n  0x10, 0x67, 0x6c, 0xba, 0xc9, 0xd3, 0x00, 0xe6, 0xcf, 0xe1, 0x9e, 0xa8, 0x2c, 0x63, 0x16, 0x01, 0x3f, 0x58, 0xe2, 0x89, 0xa9, 0x0d, 0x38, 0x34, 0x1b, 0xab, 0x33, 0xff, 0xb0,\n  0xbb, 0x48, 0x0c, 0x5f, 0xb9, 0xb1, 0xcd, 0x2e, 0xc5, 0xf3, 0xdb, 0x47, 0xe5, 0xa5, 0x9c, 0x77, 0x0a, 0xa6, 0x20, 0x68, 0xfe, 0x7f, 0xc1, 0xad,\n])\n\n/** Rotation amounts for R[0], R[1], R[2], R[3] in each mix round. */\nconst RC2_ROT = [1, 2, 3, 5] as const\n\n/**\n * Expand a variable-length key to 64 sixteen-bit subkeys (RFC 2268 Section 2).\n * `effectiveBits` controls the effective key length for export-grade keys\n * (40 = RC2-40, 128 = RC2-128).\n */\nfunction rc2ExpandKey(key: Buffer, effectiveBits: number): number[] {\n  // Guard: effectiveBits = 0 causes T8 = 0, making L[128-0] = L[128] an OOB\n  // access on a 128-element Uint8Array (silently returns undefined, producing\n  // a wrong key schedule). Values > 1024 exceed the RFC 2268 key schedule table.\n  if (!Number.isInteger(effectiveBits) || effectiveBits < 1 || effectiveBits > 1024) {\n    throw new Error(`rc2ExpandKey: effectiveBits must be an integer in [1, 1024], got ${effectiveBits}`)\n  }\n  const T = key.length\n  const T8 = Math.ceil(effectiveBits / 8)\n  // 0xff >> (effectiveBits & 7) gives 0xff for multiples-of-8 effective lengths\n  // (no masking), and a smaller mask for non-multiples.\n  const TM = 0xff >> (effectiveBits & 7)\n  const L = new Uint8Array(128)\n  for (let i = 0; i < T; i++) {\n    L[i] = key[i]\n  }\n  for (let i = T; i < 128; i++) {\n    L[i] = RC2_PITABLE[(L[i - 1] + L[i - T]) & 0xff]\n  }\n  L[128 - T8] = RC2_PITABLE[L[128 - T8] & TM]\n  for (let i = 127 - T8; i >= 0; i--) {\n    L[i] = RC2_PITABLE[L[i + 1] ^ L[i + T8]]\n  }\n  const K: number[] = new Array(64)\n  for (let i = 0; i < 64; i++) {\n    K[i] = L[2 * i] | (L[2 * i + 1] << 8)\n  }\n  return K\n}\n\n/** Rotate a 16-bit word right by `bits` positions. */\nfunction ror16(word: number, bits: number): number {\n  return ((word & 0xffff) >> bits) | ((word << (16 - bits)) & 0xffff)\n}\n\n/**\n * Decrypt `data` using RC2-CBC with PKCS#7 padding removal (RFC 2268).\n *\n * Used for pbeWithSHAAnd40BitRC2CBC  (OID 1.2.840.113549.1.12.1.6) and\n *          pbeWithSHAAnd128BitRC2CBC (OID 1.2.840.113549.1.12.1.5).\n *\n * These OIDs are commonly used to encrypt certificate bags in PKCS#12\n * files produced by OpenSSL and Windows with default settings. Node.js 22+\n * (OpenSSL 3 default provider) does not support RC2 via `createDecipheriv`.\n */\nfunction rc2CbcDecrypt(key: Buffer, iv: Buffer, data: Buffer, effectiveBits: number): Buffer {\n  // Guard: a non-multiple-of-8 ciphertext causes the last partial block to be\n  // processed with `undefined` bytes.  In JS, `undefined | (undefined << 8)`\n  // produces NaN, and `NaN & 0xffff` produces 0 — so partial blocks silently\n  // produce garbage output rather than throwing.\n  if (data.length === 0 || data.length % 8 !== 0) {\n    throw new Error(`rc2CbcDecrypt: ciphertext length ${data.length} is not a positive multiple of the 8-byte RC2 block size`)\n  }\n  if (iv.length !== 8) {\n    throw new Error(`rc2CbcDecrypt: IV must be exactly 8 bytes, got ${iv.length}`)\n  }\n  const K = rc2ExpandKey(key, effectiveBits)\n  const out = Buffer.alloc(data.length)\n  const prev = Buffer.from(iv) // CBC running state; starts as the IV\n\n  for (let offset = 0; offset < data.length; offset += 8) {\n    const ct = data.subarray(offset, offset + 8)\n    // Parse ciphertext block as four little-endian 16-bit words\n    const R = [(ct[0] | (ct[1] << 8)) & 0xffff, (ct[2] | (ct[3] << 8)) & 0xffff, (ct[4] | (ct[5] << 8)) & 0xffff, (ct[6] | (ct[7] << 8)) & 0xffff]\n\n    // Reverse the encryption round plan [5 mix, 1 mash, 6 mix, 1 mash, 5 mix].\n    // For decryption j starts at 63 and decrements in each reverse-mix step.\n    let j = 63\n\n    const rMix = () => {\n      for (let i = 3; i >= 0; i--) {\n        R[i] = ror16(R[i], RC2_ROT[i])\n        const r3 = R[(i + 3) % 4]\n        R[i] = (R[i] - K[j] - (r3 & R[(i + 2) % 4]) - (~r3 & 0xffff & R[(i + 1) % 4])) & 0xffff\n        j--\n      }\n    }\n\n    const rMash = () => {\n      for (let i = 3; i >= 0; i--) {\n        R[i] = (R[i] - K[R[(i + 3) % 4] & 63]) & 0xffff\n      }\n    }\n\n    for (let n = 0; n < 5; n++) {\n      rMix()\n    }\n    rMash()\n    for (let n = 0; n < 6; n++) {\n      rMix()\n    }\n    rMash()\n    for (let n = 0; n < 5; n++) {\n      rMix()\n    }\n\n    // XOR decrypted words with previous ciphertext block (CBC mode)\n    for (let i = 0; i < 4; i++) {\n      out[offset + i * 2] = (R[i] & 0xff) ^ prev[i * 2]\n      out[offset + i * 2 + 1] = (R[i] >> 8) ^ prev[i * 2 + 1]\n    }\n    // Advance CBC state to current ciphertext block\n    ct.copy(prev)\n  }\n\n  // Validate and strip PKCS#7 padding.\n  // Without this guard, padLen = 0 silently returns the full buffer (no stripping)\n  // and padLen > 8 causes Buffer.subarray(0, negative) → empty buffer, both\n  // silently.  A wrong key/IV produces decrypted bytes that fail this check.\n  const padLen = out[out.length - 1]\n  if (padLen < 1 || padLen > 8) {\n    throw new Error(`rc2CbcDecrypt: invalid PKCS#7 pad byte 0x${padLen.toString(16).padStart(2, \"0\")} — the ciphertext is corrupt or the wrong key/IV was used`)\n  }\n  for (let i = out.length - padLen; i < out.length; i++) {\n    if (out[i] !== padLen) {\n      throw new Error(`rc2CbcDecrypt: invalid PKCS#7 padding — the ciphertext is corrupt or the wrong key/IV was used`)\n    }\n  }\n  return out.subarray(0, out.length - padLen)\n}\n\n/** PKCS#12 legacy PBE OIDs (pkcs-12PbeIds) and their cipher parameters. */\nconst PKCS12_PBE_ALGOS: Record<string, { cipher: string; keyLen: number; ivLen: number; rc2Bits?: number }> = {\n  \"1.2.840.113549.1.12.1.3\": { cipher: \"des-ede3-cbc\", keyLen: 24, ivLen: 8 }, // pbeWithSHAAnd3KeyTripleDESCBC\n  \"1.2.840.113549.1.12.1.4\": { cipher: \"des-ede-cbc\", keyLen: 16, ivLen: 8 }, //  pbeWithSHAAnd2KeyTripleDESCBC\n  \"1.2.840.113549.1.12.1.5\": { cipher: \"rc2-cbc\", keyLen: 16, ivLen: 8, rc2Bits: 128 }, // pbeWithSHAAnd128BitRC2CBC\n  \"1.2.840.113549.1.12.1.6\": { cipher: \"rc2-cbc\", keyLen: 5, ivLen: 8, rc2Bits: 40 }, //  pbeWithSHAAnd40BitRC2CBC\n}\n\n/**\n * Maximum PKCS#12 PBE iteration count accepted.\n *\n * A maliciously crafted PFX can set iterations to Number.MAX_SAFE_INTEGER,\n * causing the SHA-1 loop to run for an arbitrary amount of time (DoS).\n * Real-world PFX files use 1 000–50 000 iterations; this cap is generous\n * enough to accommodate even unusually high-security certs while blocking\n * obviously hostile inputs.\n */\nconst MAX_PKCS12_PBE_ITERATIONS = 300_000\n\n/**\n * PKCS#12 key/IV derivation function from RFC 7292 Appendix B (SHA-1 variant).\n * id = 1 to derive a key, id = 2 to derive an IV.\n *\n * Throws if `iterations` is outside [1, MAX_PKCS12_PBE_ITERATIONS] to prevent\n * CPU exhaustion from a crafted PFX file.\n */\nfunction pkcs12PbeDeriveKey(password: Buffer, salt: Buffer, iterations: number, id: number, length: number): Buffer {\n  if (!Number.isInteger(iterations) || iterations < 1 || iterations > MAX_PKCS12_PBE_ITERATIONS) {\n    throw new Error(\n      `PKCS#12 PBE iteration count ${iterations} is outside safe range [1, ${MAX_PKCS12_PBE_ITERATIONS}]; refusing to process — the file may be crafted to exhaust CPU`\n    )\n  }\n  // A crafted PFX could supply a multi-megabyte salt, causing Buffer.alloc(sLen) inside\n  // the KDF to allocate gigabytes (sLen = ceil(salt.length / 64) * 64).\n  const MAX_SALT_BYTES = 4096\n  if (salt.length > MAX_SALT_BYTES) {\n    throw new Error(`PKCS#12 PBE salt length ${salt.length} exceeds the safe maximum of ${MAX_SALT_BYTES} bytes — the file may be crafted to exhaust memory`)\n  }\n\n  const u = 20 // SHA-1 output bytes\n  const v = 64 // SHA-1 block bytes\n\n  // Step 1: D = ID byte repeated v times\n  const D = Buffer.alloc(v, id)\n\n  // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes\n  const sLen = salt.length > 0 ? Math.ceil(salt.length / v) * v : 0\n  const S = Buffer.alloc(sLen)\n  for (let i = 0; i < sLen; i++) {\n    S[i] = salt[i % salt.length]\n  }\n\n  // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes\n  const pLen = password.length > 0 ? Math.ceil(password.length / v) * v : 0\n  const P = Buffer.alloc(pLen)\n  for (let i = 0; i < pLen; i++) {\n    P[i] = password[i % password.length]\n  }\n\n  // Step 4: I = S || P (mutable, updated in step 6C)\n  const I = new Uint8Array(Buffer.concat([S, P]))\n\n  const c = Math.ceil(length / u)\n  const result = Buffer.alloc(c * u)\n\n  for (let i = 0; i < c; i++) {\n    // Step 6A: A_i = H^iterations(D || I)\n    let Ai: Buffer = createHash(\"sha1\").update(D).update(Buffer.from(I)).digest()\n    for (let j = 1; j < iterations; j++) {\n      Ai = createHash(\"sha1\").update(Ai).digest()\n    }\n    Ai.copy(result, i * u)\n\n    // Step 6B: B = A_i repeated to fill v bytes\n    const B = new Uint8Array(v)\n    for (let j = 0; j < v; j++) {\n      B[j] = Ai[j % u]\n    }\n\n    // Step 6C: each v-byte block of I is incremented by (B + 1) mod 2^(v*8)\n    const blockCount = Math.ceil(I.length / v)\n    for (let j = 0; j < blockCount; j++) {\n      let carry = 1\n      for (let b = v - 1; b >= 0; b--) {\n        const idx = j * v + b\n        if (idx < I.length) {\n          const sum = I[idx] + B[b] + carry\n          I[idx] = sum & 0xff\n          carry = sum >> 8\n        }\n      }\n    }\n  }\n\n  return result.subarray(0, length)\n}\n\n/**\n * Encode a password as UTF-16 Big Endian with a null terminator, which is the\n * format required by PKCS#12 PBE key derivation (RFC 7292).\n * An empty string yields [0x00, 0x00] (just the null terminator).\n */\nfunction pkcs12PasswordToUtf16(password: string): Buffer {\n  const buf = Buffer.alloc((password.length + 1) * 2)\n  for (let i = 0; i < password.length; i++) {\n    const code = password.charCodeAt(i)\n    buf[i * 2] = (code >> 8) & 0xff\n    buf[i * 2 + 1] = code & 0xff\n  }\n  // Last two bytes are already 0x00 0x00 (null terminator) from Buffer.alloc.\n  return buf\n}\n\n/**\n * Decrypt PKCS#12 legacy PBE encrypted content using Node.js crypto.\n *\n * @param algId   - OID from PKCS12_PBE_ALGOS\n * @param algParams - asn1js object for PKCS12PBEParams (SEQUENCE { OCTET STRING, INTEGER })\n * @param encContent - asn1js object for the encrypted content (Constructed or Primitive [0] IMPLICIT)\n * @param password - plain-text password string\n */\nfunction decryptLegacyPkcs12Pbe(algId: string, algParams: any, encContent: any, password: string): Buffer {\n  const algo = PKCS12_PBE_ALGOS[algId]\n\n  // PKCS12PBEParams ::= SEQUENCE { salt OCTET STRING, iterations INTEGER }\n  const salt = Buffer.from(algParams.valueBlock.value[0].valueBlock.valueHexView)\n  const iterations = Number(algParams.valueBlock.value[1].valueBlock.valueDec)\n\n  const pwdBytes = pkcs12PasswordToUtf16(password)\n  const key = pkcs12PbeDeriveKey(pwdBytes, salt, iterations, 1, algo.keyLen)\n  const iv = pkcs12PbeDeriveKey(pwdBytes, salt, iterations, 2, algo.ivLen)\n\n  // Extract raw encrypted bytes from the [0] IMPLICIT OCTET STRING.\n  // The encryptedContent field can be a Constructed (fragmented) or Primitive tag.\n  let encBytes: Buffer\n  if (encContent.idBlock?.isConstructed) {\n    encBytes = Buffer.concat((encContent.valueBlock.value as any[]).map((p: any) => Buffer.from(p.valueBlock.valueHexView)))\n  } else {\n    encBytes = Buffer.from(encContent.valueBlock.valueHexView)\n  }\n\n  if (algo.rc2Bits != null) {\n    // RC2 is not available in Node.js 22+ via createDecipheriv (OpenSSL 3 moved\n    // it to the legacy provider which is not loaded by default). Use our pure-TS\n    // RFC 2268 implementation instead.\n    return rc2CbcDecrypt(key, iv, encBytes, algo.rc2Bits)\n  }\n\n  const decipher = createDecipheriv(algo.cipher, key, iv)\n  return Buffer.concat([decipher.update(encBytes), decipher.final()])\n}\n\n/**\n * Reads certificate info from a PKCS#12 (.pfx) file using pkijs (unobfuscated TypeScript).\n * Mirrors the `certificate-info` subcommand of app-builder-bin.\n * https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go\n *\n * Returns { commonName, bloodyMicrosoftSubjectDn } on success.\n *\n * Known divergences from the Go binary:\n * - No OpenSSL fallback when the pure PKCS#12 decoder fails for a non-password reason.\n * - Unknown OIDs are rendered using the raw numeric OID as the type name (e.g. `2.5.4.100=value`); Go uses `OID=#hexbytes` when ASN.1 marshal succeeds.\n * - RDN ordering uses DER order; Go normalizes via pkix.Name.ToRDNSequence then reverses via\n *   BloodyMsString. These coincide for pkijs-generated certs (CN-first DER) but may\n *   differ for real CA-issued certs stored in traditional C-first DER order.\n */\nexport async function readCertInfo(file: string, password: string): Promise<{ commonName: string; bloodyMicrosoftSubjectDn: string }> {\n  const pfxDer = await readFile(file)\n\n  // asn1js requires a plain ArrayBuffer\n  const pfxBuf = toArrayBuffer(pfxDer)\n  let asn1: ReturnType<typeof asn1js.fromBER>\n  try {\n    asn1 = asn1js.fromBER(pfxBuf)\n    if (asn1.offset === -1) {\n      throw new Error(\"offset -1: invalid BER encoding\")\n    }\n  } catch (err) {\n    throw new Error(`PKCS#12 file \"${file}\" contains invalid ASN.1/DER data: ${err instanceof Error ? err.message : String(err)}`)\n  }\n\n  const pfx = new pkijs.PFX({ schema: asn1.result })\n  const pwBuf = toArrayBuffer(Buffer.from(password, \"utf-8\"))\n\n  // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container.\n  // pkijs throws \"Integrity for the PKCS#12 data is broken!\" on wrong password.\n  try {\n    await pfx.parseInternalValues({ password: pwBuf, checkIntegrity: true })\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err)\n    const lower = detail.toLowerCase()\n    if (lower.includes(\"integrity\") || lower.includes(\"mac\") || lower.includes(\"password\") || lower.includes(\"pkcs#12\")) {\n      throw new Error(`password incorrect for certificate file \"${file}\" — verify the password matches the PFX. pkijs detail: ${detail}`)\n    }\n    log.debug({ file, error: detail }, \"pkijs failed to decode PKCS#12; no OpenSSL fallback available in Node.js\")\n    throw new Error(`Failed to decode PKCS#12 file \"${file}\" — the file may be corrupt, use an unsupported cipher, or require OpenSSL. pkijs detail: ${detail}`)\n  }\n\n  const authSafe = pfx.parsedValue?.authenticatedSafe\n  if (authSafe == null) {\n    throw new Error(`Failed to parse AuthenticatedSafe in PKCS#12 file \"${file}\"`)\n  }\n\n  // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates.\n  //\n  // We do NOT call authSafe.parseInternalValues() because pkijs's CryptoEngine only handles\n  // PBES2 (OID 1.2.840.113549.1.5.13) for EncryptedData. Real-world PFX files (including\n  // CA-issued and electron-builder-generated certs) often use the older pkcs-12PbeIds ciphers\n  // (e.g. pbeWithSHAAnd3KeyTripleDESCBC). We handle those with our own Node.js crypto path.\n  const certs: pkijs.Certificate[] = []\n\n  for (const ci of authSafe.safeContents) {\n    let safeBER: ArrayBuffer\n\n    if (ci.contentType === pkijs.id_ContentType_Data) {\n      // Data: content is an OCTET STRING containing DER-encoded SafeContents.\n      safeBER = (ci.content as asn1js.OctetString).getValue()\n    } else if (ci.contentType === pkijs.id_ContentType_EncryptedData) {\n      // EncryptedData: decrypt the SafeContents, routing by algorithm OID.\n      const encData = new pkijs.EncryptedData({ schema: ci.content })\n      const algId = encData.encryptedContentInfo.contentEncryptionAlgorithm.algorithmId\n\n      if (Object.prototype.hasOwnProperty.call(PKCS12_PBE_ALGOS, algId)) {\n        // Legacy PKCS#12 PBE (pbeWithSHAAnd*) — use our RFC 7292 implementation.\n        const decrypted = decryptLegacyPkcs12Pbe(\n          algId,\n          encData.encryptedContentInfo.contentEncryptionAlgorithm.algorithmParams,\n          encData.encryptedContentInfo.encryptedContent,\n          password\n        )\n        safeBER = toArrayBuffer(decrypted)\n      } else {\n        // PBES2 or other modern OID — delegate to the pkijs engine.\n        safeBER = await encData.decrypt({ password: pwBuf })\n      }\n    } else {\n      // EnvelopedData or other types — skip (not needed for cert extraction).\n      continue\n    }\n\n    // Parse SafeContents and collect X.509 certificates from cert bags.\n    const sc = pkijs.SafeContents.fromBER(safeBER)\n    for (const bag of sc.safeBags) {\n      if (bag.bagId === CERT_BAG_OID) {\n        const certBag = bag.bagValue as pkijs.CertBag\n        if (certBag.parsedValue instanceof pkijs.Certificate) {\n          certs.push(certBag.parsedValue)\n        }\n      }\n    }\n  }\n\n  if (certs.length === 0) {\n    throw new Error(`No certificates found in PKCS#12 file \"${file}\" — the file may be a key-only PFX or be empty`)\n  }\n\n  // Find the certificate with the codeSigning Extended Key Usage.\n  // pkijs auto-parses known extensions via ExtensionValueFactory (registered at module init).\n  const signingCert = certs.find(cert => {\n    const ekuExt = cert.extensions?.find(e => e.extnID === pkijs.id_ExtKeyUsage)\n    if (ekuExt == null) {\n      return false\n    }\n    if (ekuExt.parsedValue instanceof pkijs.ExtKeyUsage) {\n      return ekuExt.parsedValue.keyPurposes.includes(CODE_SIGNING_OID)\n    }\n    // Fallback: manually parse the extension OctetString value.\n    try {\n      const inner = asn1js.fromBER(ekuExt.extnValue.valueBlock.valueHexView)\n      if (inner.offset === -1) {\n        return false\n      }\n      const eku = new pkijs.ExtKeyUsage({ schema: inner.result })\n      return eku.keyPurposes.includes(CODE_SIGNING_OID)\n    } catch {\n      return false\n    }\n  })\n\n  if (signingCert == null) {\n    throw new Error(\n      `No certificate with ExtKeyUsageCodeSigning found in \"${file}\" — ${certs.length} certificate(s) present but none have the codeSigning extended key usage. ` +\n        `Ensure the PFX contains a code-signing certificate, not just a CA or TLS certificate.`\n    )\n  }\n\n  const cnAttr = signingCert.subject.typesAndValues.find(a => a.type === \"2.5.4.3\")\n  const commonName = String(cnAttr?.value.valueBlock.value ?? \"\")\n\n  // Format DN as \"CN=X,O=X,...\" matching Go's BloodyMsString output.\n  // Uses ATTRIBUTE_TYPE_NAMES to mirror Go's attributeTypeNames map exactly, so STREET,\n  // POSTALCODE, and SERIALNUMBER (present in EV code-signing certs) are handled correctly.\n  // Unknown OIDs fall back to the bare OID string as the type name.\n  const bloodyMicrosoftSubjectDn = signingCert.subject.typesAndValues\n    .map(a => {\n      const typeName = ATTRIBUTE_TYPE_NAMES[a.type] ?? a.type\n      return `${typeName}=${escapeDnValue(String(a.value.valueBlock.value))}`\n    })\n    .join(\",\")\n\n  return { commonName, bloodyMicrosoftSubjectDn }\n}\n\n/**\n * Internal functions exported exclusively for unit testing.\n * Not part of the public API — do not use outside of test files.\n */\nexport const _testingOnly = {\n  pkcs12PbeDeriveKey,\n  pkcs12PasswordToUtf16,\n  rc2CbcDecrypt,\n  MAX_PKCS12_PBE_ITERATIONS,\n}\n"]}