{"version":3,"file":"X509ValidationOptions.mjs","names":[],"sources":["../../../src/modules/x509/X509ValidationOptions.ts"],"sourcesContent":["import type { X509RevocationReason } from './X509CrlDistributionPoint'\n\n/**\n * Revocation checking mode based on Java PKIXRevocationChecker.Option patterns\n */\nexport enum X509RevocationCheckMode {\n  /**\n   * Completely disable revocation checking\n   */\n  Disabled = 'Disabled',\n\n  /**\n   * Check revocation status but allow validation to succeed if:\n   * - CRL cannot be obtained due to network error\n   * This is the RECOMMENDED default for production systems\n   */\n  SoftFail = 'SoftFail',\n\n  /**\n   * Require successful revocation check - fail if network unavailable or service errors\n   * Use with caution in production as network failures will block certificate validation\n   */\n  Require = 'Require',\n}\n\nexport interface X509RevocationCheckOptions {\n  /**\n   * Mode for revocation checking\n   * @default {@link X509RevocationCheckMode.SoftFail}\n   *\n   * Note: Currently defaults to 'SoftFail' to provide enhanced security\n   * without breaking existing functionality in network failure scenarios\n   */\n  mode?: X509RevocationCheckMode\n\n  /**\n   * Whether to check revocation for all certificates in the chain (except the root).\n   *\n   * Defaults to `true`, so every certificate in the chain (the end-entity and any intermediate CAs)\n   * is checked, as RFC 5280 expects. Set to `false` to only check the end-entity/leaf certificate,\n   * which is faster but weaker.\n   *\n   * @default true\n   */\n  checkFullChain?: boolean\n\n  /**\n   * Timeout in milliseconds for CRL fetches\n   * @default 5000\n   */\n  timeoutMs?: number\n\n  /**\n   * Maximum size in bytes for CRL downloads\n   * @default 10485760 (10 MB)\n   */\n  maxCrlSizeBytes?: number\n\n  /**\n   * How long (in seconds) a verified CRL is served from the cache without contacting the\n   * distribution point. After this period the CRL bytes are fetched again: when unchanged (same\n   * SHA-256) the cached CRL is reused without re-parsing or re-verifying, otherwise it is fully\n   * re-verified. Independently of this period, a cached CRL is never served past its own\n   * `nextUpdate`. When unset in per-call revocation options, the value configured on the X509\n   * module's `revocationCheck` applies.\n   *\n   * @default 3600 (1 hour)\n   */\n  crlCacheExpirySeconds?: number\n\n  /**\n   * The date/time to use for revocation checking\n   * Used to verify CRL validity (thisUpdate/nextUpdate) and revocation dates\n   * @default new Date() (current time)\n   */\n  verificationDate?: Date\n\n  /**\n   * Specific revocation reasons that must be covered by CRLs\n   * If a certificate has no reasons specified in its CRL distribution points (a \"full\" DP),\n   * it covers all reasons automatically.\n   *\n   * If a certificate only has distribution points with specific reasons, this array determines\n   * which reasons must be covered for the check to be considered complete.\n   *\n   * @default The reasons actually published across the certificate's CRL distribution points.\n   * There is no point requiring coverage of reasons the issuer never published a distribution point\n   * for, so by default only the reasons present in the certificate's DPs are required.\n   *\n   * Set to a subset to only require coverage of specific reasons.\n   */\n  requiredReasons?: X509RevocationReason[]\n}\n"],"mappings":";;;;AAKA,IAAY,0BAAL,yBAAA,yBAAA;;;;CAIL,wBAAA,cAAA;;;;;;CAOA,wBAAA,cAAA;;;;;CAMA,wBAAA,aAAA;;AACF,EAAA,CAAA,CAAA"}