@bhooai/nexus-crypto 0.1.0

package/README.md

@@ -0,0 +1,25 @@
+# @bhooai/nexus-crypto
+
+RSA/ECDSA keypairs, self-signed X.509 certs, CSRs, and HTTPS/mTLS helpers.
+
+## Exports
+
+- **keypair** — `generateKeyPair(type, { modulusLength, namedCurve })` →
+  `{ publicKey, privateKey, pem }`.
+- **x509** — `createSelfSignedCertificate({ keyPair, commonName, organization, country })`.
+- **csr** — `createCsr({ keyPair, commonName, organization, country })` via a
+  **hand-rolled DER/ASN.1 encoder** (`der.ts`). `node:crypto` can't create CSRs, so
+  this is built from scratch (no `node-forge`).
+- **der** — the minimal ASN.1/DER encoder underpinning the CSR.
+- **https** — helpers for HTTPS servers and mTLS.
+
+## Usage
+
+```ts
+import { generateKeyPair, createSelfSignedCertificate, createCsr } from '@bhooai/nexus-crypto';
+const kp = generateKeyPair('rsa', { modulusLength: 2048 });
+const cert = createSelfSignedCertificate({ keyPair: kp, commonName: 'localhost' });
+const csr = createCsr({ keyPair: kp, commonName: 'localhost' });
+```
+
+The backend exposes this at `POST /certs/self-signed` (with optional `csr: true`).

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@bhooai/nexus-crypto",
+  "version": "0.1.0",
+  "publishConfig": { "access": "public" },
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^22.5.0",
+    "typescript": "^5.6.2",
+    "vitest": "^2.1.1"
+  }
+}

package/src/csr.ts

@@ -0,0 +1,165 @@
+import crypto from 'node:crypto';
+import {
+  SEQUENCE,
+  SET,
+  INTEGER,
+  BIT_STRING,
+  OID,
+  OCTET_STRING,
+  UTF8String,
+  BOOLEAN,
+  COMMON_NAME,
+  ORG,
+  COUNTRY,
+  CHALLENGE_PASSWORD,
+  EXTENSION_REQUEST,
+  PrintableString,
+  sha256WithRsaAlgId,
+  ecdsaP256AlgId,
+  oidFromString,
+  toBuffer,
+  type Byte,
+} from './der.js';
+import { pemEncode } from './x509.js';
+
+export interface CsrExtension {
+  type: string;
+  value: Buffer;
+  critical?: boolean;
+}
+
+export interface CsrOptions {
+  keyPair: { publicKey: Buffer; privateKey: Buffer };
+  commonName: string;
+  organization?: string;
+  country?: string;
+  challengePassword?: string;
+  extensions?: CsrExtension[];
+}
+
+export interface CsrResult {
+  csr: Buffer;
+  pem: string;
+}
+
+/** Build a Name (RDNSequence) from subject components. */
+function buildName(
+  commonName: string,
+  organization?: string,
+  country?: string,
+): Byte {
+  const rdns: Byte[] = [];
+  if (country) {
+    rdns.push(SET(SEQUENCE(COUNTRY, PrintableString(country))));
+  }
+  if (organization) {
+    rdns.push(SET(SEQUENCE(ORG, PrintableString(organization))));
+  }
+  rdns.push(SET(SEQUENCE(COMMON_NAME, PrintableString(commonName))));
+  return SEQUENCE(...rdns);
+}
+
+/** Build the attributes [0] IMPLICIT SET OF Attribute for the CRI. */
+function buildAttributes(
+  challengePassword?: string,
+  extensions?: CsrExtension[],
+): Byte {
+  const attrs: Byte[] = [];
+
+  if (challengePassword !== undefined) {
+    // challengePassword attribute: SEQUENCE { OID, SET OF DirectoryString }
+    attrs.push(
+      SEQUENCE(
+        CHALLENGE_PASSWORD,
+        SET(UTF8String(challengePassword)),
+      ),
+    );
+  }
+
+  if (extensions && extensions.length > 0) {
+    const exts: Byte[] = extensions.map((ext) => {
+      const extOid = OID(oidFromString(ext.type));
+      const value = OCTET_STRING(Array.from(ext.value));
+      if (ext.critical) {
+        return SEQUENCE(extOid, BOOLEAN(true), value);
+      }
+      return SEQUENCE(extOid, value);
+    });
+    // extensionRequest attribute: SEQUENCE { OID(1.2.840.113549.1.9.14), SET OF Extensions }
+    // Extensions ::= SEQUENCE OF Extension
+    attrs.push(
+      SEQUENCE(
+        EXTENSION_REQUEST,
+        SET(SEQUENCE(...exts)),
+      ),
+    );
+  }
+
+  // [0] IMPLICIT SET OF Attribute — context tag 0xa0 (constructed), content is
+  // the concatenation of the Attribute SEQUENCEs (no extra SET wrapper, because
+  // the [0] IMPLICIT replaces the SET tag).
+  return tagConstructed(0xa0, ...attrs);
+}
+
+/** Construct a context-class constructed tag wrapping concatenated items. */
+function tagConstructed(tagByte: number, ...items: Byte[]): Byte {
+  const flat: number[] = [];
+  for (const it of items) flat.push(...it);
+  const len = encodeLenLocal(flat.length);
+  return [tagByte, ...len, ...flat];
+}
+
+function encodeLenLocal(n: number): number[] {
+  if (n < 0x80) return [n];
+  const bytes: number[] = [];
+  let v = n;
+  while (v > 0) {
+    bytes.unshift(v & 0xff);
+    v = v >>> 8;
+  }
+  if (bytes.length === 0) bytes.push(0);
+  return [0x80 | bytes.length, ...bytes];
+}
+
+/**
+ * Create a PKCS#10 Certificate Signing Request.
+ *
+ * Builds CertificationRequestInfo DER by hand, signs it with the private key
+ * (SHA-256), and wraps it as SEQUENCE { CRI, signatureAlgorithm, signature }.
+ * No node-forge — only der.ts + node:crypto signing.
+ */
+export function createCsr(opts: CsrOptions): CsrResult {
+  const privateKey = crypto.createPrivateKey({
+    key: opts.keyPair.privateKey,
+    format: 'der',
+    type: 'pkcs8',
+  });
+  const keyType = privateKey.asymmetricKeyType;
+  const isEc = keyType === 'ec';
+  const sigAlgId = isEc ? ecdsaP256AlgId() : sha256WithRsaAlgId();
+
+  const subject = buildName(opts.commonName, opts.organization, opts.country);
+  // publicKey buffer is already SPKI DER — embed verbatim.
+  const spki = Array.from(opts.keyPair.publicKey);
+  const attributes = buildAttributes(opts.challengePassword, opts.extensions);
+
+  const cri = SEQUENCE(
+    INTEGER(0), // version
+    subject,
+    spki,
+    attributes,
+  );
+
+  const criBuf = toBuffer(cri);
+  const signature = crypto.sign('sha256', criBuf, privateKey);
+
+  const csr = SEQUENCE(
+    cri,
+    sigAlgId,
+    BIT_STRING(Array.from(signature)),
+  );
+
+  const csrBuf = toBuffer(csr);
+  const pem = pemEncode(csrBuf, 'CERTIFICATE REQUEST');
+  return { csr: csrBuf, pem };
+}

package/src/der.ts

@@ -0,0 +1,262 @@
+/**
+ * Minimal DER/ASN.1 encoder (hand-rolled, no external deps).
+ *
+ * Works in arrays of byte values (0-255) and flattens to a Buffer at the end.
+ * This is sufficient to encode X.509 TBSCertificates and PKCS#10 CSRs.
+ */
+
+/** A working byte array. */
+export type Byte = number[];
+
+// --- Tag bytes for common ASN.1 types ---
+const TAG_INTEGER = 0x02;
+const TAG_BIT_STRING = 0x03;
+const TAG_OCTET_STRING = 0x04;
+const TAG_NULL = 0x05;
+const TAG_BOOLEAN = 0x01;
+const TAG_OID = 0x06;
+const TAG_UTF8_STRING = 0x0c;
+const TAG_SEQUENCE = 0x30;
+const TAG_SET = 0x31;
+const TAG_PRINTABLE_STRING = 0x13;
+const TAG_IA5_STRING = 0x16;
+const TAG_UTC_TIME = 0x17;
+const TAG_GENERALIZED_TIME = 0x18;
+
+/** DER length encoding: short form for <128, long form otherwise. */
+export function encodeLen(n: number): number[] {
+  if (n < 0) {
+    throw new Error('DER length cannot be negative');
+  }
+  if (n < 0x80) {
+    return [n];
+  }
+  // Long form: 0x80 | number of length bytes, then big-endian length bytes.
+  const bytes: number[] = [];
+  let v = n;
+  while (v > 0) {
+    bytes.unshift(v & 0xff);
+    v = v >>> 8;
+  }
+  // Ensure we never produce a non-minimal long-form encoding (no leading 0).
+  if (bytes.length === 0) bytes.push(0);
+  if (bytes.length > 0x7f) {
+    throw new Error('DER length too large');
+  }
+  return [0x80 | bytes.length, ...bytes];
+}
+
+/** Wrap content with a tag byte and DER length. */
+export function tag(tagByte: number, content: number[]): number[] {
+  return [tagByte, ...encodeLen(content.length), ...content];
+}
+
+/** INTEGER from a non-negative number or bigint (two's complement for negatives). */
+export function INTEGER(n: number | bigint): number[] {
+  if (typeof n === 'bigint') {
+    return INTEGER_bigint(n);
+  }
+  if (!Number.isInteger(n)) {
+    throw new Error('INTEGER requires an integer');
+  }
+  return INTEGER_bigint(BigInt(n));
+}
+
+function INTEGER_bigint(n: bigint): number[] {
+  if (n === 0n) {
+    return tag(TAG_INTEGER, [0x00]);
+  }
+  const bytes: number[] = [];
+  const negative = n < 0n;
+  if (negative) {
+    // Two's complement of a negative bigint: we use a wide representation.
+    // Find the smallest byte width that holds the magnitude, then invert.
+    const magnitude = -n;
+    let bits = 0n;
+    let m = magnitude;
+    while (m > 0n) {
+      bits += 1n;
+      m >>= 1n;
+    }
+    const width = Number((bits + 7n) / 8n) + 1; // extra byte to hold sign bit
+    const mask = (1n << BigInt(width * 8)) - 1n;
+    const twos = ((~magnitude) + 1n) & mask;
+    let t = twos;
+    for (let i = 0; i < width; i++) {
+      bytes.unshift(Number(t & 0xffn));
+      t >>= 8n;
+    }
+    // Trim leading 0xff only if next bit is set, etc. Keep minimal but signed.
+    while (bytes.length > 1 && bytes[0] === 0xff && (bytes[1]! & 0x80) !== 0) {
+      bytes.shift();
+    }
+    return tag(TAG_INTEGER, bytes);
+  }
+  // Positive: encode big-endian, prepend 0x00 if high bit set (so it stays positive).
+  let v = n;
+  while (v > 0n) {
+    bytes.unshift(Number(v & 0xffn));
+    v >>= 8n;
+  }
+  if ((bytes[0]! & 0x80) !== 0) {
+    bytes.unshift(0x00);
+  }
+  return tag(TAG_INTEGER, bytes);
+}
+
+/** BIT STRING with a leading unused-bits byte (default 0). */
+export function BIT_STRING(content: number[], unusedBits = 0): number[] {
+  return tag(TAG_BIT_STRING, [unusedBits, ...content]);
+}
+
+export function OCTET_STRING(content: number[]): number[] {
+  return tag(TAG_OCTET_STRING, content);
+}
+
+export function NULL(): number[] {
+  return tag(TAG_NULL, []);
+}
+
+/** BOOLEAN: 0x00 for false, 0xff for true. */
+export function BOOLEAN(value: boolean): number[] {
+  return tag(TAG_BOOLEAN, [value ? 0xff : 0x00]);
+}
+
+/** Parse a dotted OID string (e.g. "1.2.840.113549.1.1.11") into an arc array. */
+export function oidFromString(s: string): number[] {
+  return s.split('.').map((part) => {
+    const n = Number(part);
+    if (!Number.isInteger(n) || n < 0) {
+      throw new Error(`Invalid OID arc: ${part}`);
+    }
+    return n;
+  });
+}
+
+/** OID encoder: first two arcs packed as 40*a+b, rest base-128 with continuation. */
+export function OID(arcs: number[]): number[] {
+  if (arcs.length < 2) {
+    throw new Error('OID needs at least 2 arcs');
+  }
+  const content: number[] = [];
+  content.push(40 * arcs[0]! + arcs[1]!);
+  for (let i = 2; i < arcs.length; i++) {
+    const arc = arcs[i]!;
+    if (arc < 0) throw new Error('OID arc cannot be negative');
+    if (arc === 0) {
+      content.push(0x00);
+      continue;
+    }
+    const buf: number[] = [];
+    let v = arc;
+    while (v > 0) {
+      buf.unshift(v & 0x7f);
+      v = v >>> 7;
+    }
+    for (let j = 0; j < buf.length; j++) {
+      if (j < buf.length - 1) {
+        content.push(buf[j]! | 0x80);
+      } else {
+        content.push(buf[j]!);
+      }
+    }
+  }
+  return tag(TAG_OID, content);
+}
+
+export function SEQUENCE(...items: Byte[]): Byte {
+  const flat: number[] = [];
+  for (const it of items) flat.push(...it);
+  return tag(TAG_SEQUENCE, flat);
+}
+
+export function SET(...items: Byte[]): Byte {
+  const flat: number[] = [];
+  for (const it of items) flat.push(...it);
+  return tag(TAG_SET, flat);
+}
+
+function asciiBytes(s: string): number[] {
+  const out: number[] = [];
+  for (let i = 0; i < s.length; i++) {
+    out.push(s.charCodeAt(i) & 0xff);
+  }
+  return out;
+}
+
+function pad2(n: number): string {
+  return n < 10 ? '0' + n : String(n);
+}
+
+/** UTCTime: YYMMDDHHMMSSZ (used for years 1950-2049). */
+export function UTCTime(date: Date): number[] {
+  const yy = date.getUTCFullYear() % 100;
+  const s =
+    pad2(yy) +
+    pad2(date.getUTCMonth() + 1) +
+    pad2(date.getUTCDate()) +
+    pad2(date.getUTCHours()) +
+    pad2(date.getUTCMinutes()) +
+    pad2(date.getUTCSeconds()) +
+    'Z';
+  return tag(TAG_UTC_TIME, asciiBytes(s));
+}
+
+/** GeneralizedTime: YYYYMMDDHHMMSSZ (used for years >= 2050). */
+export function GeneralizedTime(date: Date): number[] {
+  const s =
+    String(date.getUTCFullYear()).padStart(4, '0') +
+    pad2(date.getUTCMonth() + 1) +
+    pad2(date.getUTCDate()) +
+    pad2(date.getUTCHours()) +
+    pad2(date.getUTCMinutes()) +
+    pad2(date.getUTCSeconds()) +
+    'Z';
+  return tag(TAG_GENERALIZED_TIME, asciiBytes(s));
+}
+
+export function PrintableString(s: string): number[] {
+  return tag(TAG_PRINTABLE_STRING, asciiBytes(s));
+}
+
+export function UTF8String(s: string): number[] {
+  return tag(TAG_UTF8_STRING, Array.from(Buffer.from(s, 'utf8')));
+}
+
+export function IA5String(s: string): number[] {
+  return tag(TAG_IA5_STRING, asciiBytes(s));
+}
+
+// --- Common OID constants (already tagged, ready to embed) ---
+export const RSA_ENCRYPTION = OID([1, 2, 840, 113549, 1, 1, 1]);
+export const SHA256_WITH_RSA = OID([1, 2, 840, 113549, 1, 1, 11]);
+export const EC_PUBLIC_KEY = OID([1, 2, 840, 10045, 2, 1]);
+export const ECDSA_P256 = OID([1, 2, 840, 10045, 4, 3, 2]);
+export const PRIME256V1 = OID([1, 2, 840, 10045, 3, 1, 7]);
+export const COMMON_NAME = OID([2, 5, 4, 3]);
+export const ORG = OID([2, 5, 4, 10]);
+export const COUNTRY = OID([2, 5, 4, 6]);
+export const EXTENSION_REQUEST = OID([1, 2, 840, 113549, 1, 9, 14]);
+export const CHALLENGE_PASSWORD = OID([1, 2, 840, 113549, 1, 9, 7]);
+
+/** AlgorithmIdentifier SEQUENCE { OID, NULL } for RSA-SHA256. */
+export function sha256WithRsaAlgId(): number[] {
+  return SEQUENCE(SHA256_WITH_RSA, NULL());
+}
+
+/** AlgorithmIdentifier SEQUENCE { OID, curveName OID } for ECDSA P-256. */
+export function ecdsaP256AlgId(): number[] {
+  return SEQUENCE(ECDSA_P256);
+}
+
+/** Flatten a byte array into a Buffer. */
+export function toBuffer(bytes: number[]): Buffer {
+  return Buffer.from(bytes);
+}
+
+/** Debug helper: render a byte array as hex. */
+export function hex(bytes: number[]): string {
+  return bytes
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join(' ');
+}

package/src/https.ts

@@ -0,0 +1,36 @@
+import https from 'node:https';
+
+export interface HttpsAgentOptions {
+  cert: Buffer;
+  key: Buffer;
+  ca?: Buffer;
+  rejectUnauthorized?: boolean;
+}
+
+/** Create an https.Agent suitable for mutual TLS (client-side). */
+export function createHttpsAgent(opts: HttpsAgentOptions): https.Agent {
+  return new https.Agent({
+    cert: opts.cert,
+    key: opts.key,
+    ca: opts.ca,
+    rejectUnauthorized: opts.rejectUnauthorized ?? true,
+  });
+}
+
+export interface TlsConfigOptions {
+  cert: Buffer;
+  key: Buffer;
+  ca?: Buffer;
+}
+
+/** Return the { cert, key, ca } object for use with https.createServer. */
+export function createTlsConfig(opts: TlsConfigOptions): {
+  cert: Buffer;
+  key: Buffer;
+  ca?: Buffer;
+} {
+  if (opts.ca !== undefined) {
+    return { cert: opts.cert, key: opts.key, ca: opts.ca };
+  }
+  return { cert: opts.cert, key: opts.key };
+}

package/src/index.ts

@@ -0,0 +1,5 @@
+export * from './der.js';
+export * from './keypair.js';
+export * from './x509.js';
+export * from './csr.js';
+export * from './https.js';

package/src/keypair.ts

@@ -0,0 +1,59 @@
+import crypto from 'node:crypto';
+
+export interface KeyPairResult {
+  publicKey: Buffer;
+  privateKey: Buffer;
+  pem: { public: string; private: string };
+}
+
+export interface KeyPairOptions {
+  modulusLength?: number;
+  namedCurve?: string;
+}
+
+/**
+ * Generate an RSA or EC keypair.
+ *
+ * Returns DER buffers (spki public, pkcs8 private) and PEM strings.
+ * RSA defaults to 2048-bit; EC defaults to prime256v1 (P-256).
+ */
+export function generateKeyPair(
+  type: 'rsa' | 'ec',
+  opts: KeyPairOptions = {},
+): KeyPairResult {
+  let publicKey: crypto.KeyObject;
+  let privateKey: crypto.KeyObject;
+  if (type === 'rsa') {
+    ({ publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: opts.modulusLength ?? 2048,
+    }));
+  } else if (type === 'ec') {
+    ({ publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
+      namedCurve: opts.namedCurve ?? 'prime256v1',
+    }));
+  } else {
+    throw new Error(`Unsupported key type: ${type}`);
+  }
+
+  const publicKeyDer = publicKey.export({ type: 'spki', format: 'der' }) as Buffer;
+  const privateKeyDer = privateKey.export({ type: 'pkcs8', format: 'der' }) as Buffer;
+
+  return {
+    publicKey: publicKeyDer,
+    privateKey: privateKeyDer,
+    pem: {
+      public: exportPublicKeyPem(publicKey),
+      private: exportPrivateKeyPem(privateKey),
+    },
+  };
+}
+
+/** Export a KeyObject as a SPKI PEM string. */
+export function exportPublicKeyPem(key: crypto.KeyObject): string {
+  return key.export({ type: 'spki', format: 'pem' }).toString('utf8');
+}
+
+/** Export a KeyObject as a PKCS#8 PEM string. */
+export function exportPrivateKeyPem(key: crypto.KeyObject): string {
+  return key.export({ type: 'pkcs8', format: 'pem' }).toString('utf8');
+}

package/src/x509.ts

@@ -0,0 +1,156 @@
+import crypto from 'node:crypto';
+import {
+  SEQUENCE,
+  INTEGER,
+  BIT_STRING,
+  UTCTime,
+  GeneralizedTime,
+  OID,
+  COMMON_NAME,
+  ORG,
+  COUNTRY,
+  PrintableString,
+  NULL,
+  sha256WithRsaAlgId,
+  ecdsaP256AlgId,
+  toBuffer,
+  SET,
+  type Byte,
+} from './der.js';
+
+export interface X509Options {
+  keyPair: { publicKey: Buffer; privateKey: Buffer };
+  commonName: string;
+  organization?: string;
+  country?: string;
+  notBefore?: Date;
+  notAfter?: Date;
+  serial?: number;
+}
+
+export interface X509Result {
+  cert: Buffer;
+  pem: string;
+}
+
+/** Build a Name (RDNSequence) from subject components. */
+function buildName(
+  commonName: string,
+  organization?: string,
+  country?: string,
+): Byte {
+  const rdns: Byte[] = [];
+  if (country) {
+    rdns.push(SET(SEQUENCE(COUNTRY, PrintableString(country))));
+  }
+  if (organization) {
+    rdns.push(SET(SEQUENCE(ORG, PrintableString(organization))));
+  }
+  rdns.push(SET(SEQUENCE(COMMON_NAME, PrintableString(commonName))));
+  return SEQUENCE(...rdns);
+}
+
+/** Pick Time encoding: UTCTime for 1950-2049, GeneralizedTime otherwise. */
+function timeEncode(date: Date): Byte {
+  const year = date.getUTCFullYear();
+  if (year >= 1950 && year <= 2049) {
+    return UTCTime(date);
+  }
+  return GeneralizedTime(date);
+}
+
+/**
+ * Create a self-signed X.509 v3 certificate.
+ *
+ * Builds TBSCertificate DER by hand, signs it with the private key (SHA-256),
+ * and wraps it as SEQUENCE { tbs, signatureAlgorithm, signature }.
+ * No extensions are added (a v3 cert with no extensions is still valid DER).
+ */
+export function createSelfSignedCertificate(opts: X509Options): X509Result {
+  const privateKey = crypto.createPrivateKey({
+    key: opts.keyPair.privateKey,
+    format: 'der',
+    type: 'pkcs8',
+  });
+  const keyType = privateKey.asymmetricKeyType;
+  const isEc = keyType === 'ec';
+
+  const sigAlgId = isEc ? ecdsaP256AlgId() : sha256WithRsaAlgId();
+  const signAlg = isEc ? 'sha256' : 'sha256';
+
+  const notBefore = opts.notBefore ?? new Date();
+  const notAfter =
+    opts.notAfter ?? new Date(notBefore.getTime() + 365 * 24 * 60 * 60 * 1000);
+  const serial = opts.serial ?? 1;
+
+  // version [0] EXPLICIT INTEGER(2) → v3
+  const version = tagExplicit(0, INTEGER(2));
+
+  const issuer = buildName(opts.commonName, opts.organization, opts.country);
+  const subject = buildName(opts.commonName, opts.organization, opts.country);
+  const validity = SEQUENCE(timeEncode(notBefore), timeEncode(notAfter));
+
+  // The publicKey buffer is already a SPKI DER (from generateKeyPairSync with
+  // type 'spki', format 'der') — embed it verbatim.
+  const spki = Array.from(opts.keyPair.publicKey);
+
+  const tbs = SEQUENCE(
+    version,
+    INTEGER(serial),
+    sigAlgId,
+    issuer,
+    validity,
+    subject,
+    spki,
+  );
+
+  const tbsBuf = toBuffer(tbs);
+  const signature = crypto.sign(signAlg, tbsBuf, privateKey);
+
+  const cert = SEQUENCE(
+    tbs,
+    sigAlgId,
+    BIT_STRING(Array.from(signature)),
+  );
+
+  const certBuf = toBuffer(cert);
+  const pem = pemEncode(certBuf, 'CERTIFICATE');
+  return { cert: certBuf, pem };
+}
+
+/** IMPLICIT/EXPLICIT context tag helper. EXPLICIT wraps content in another TLV. */
+function tagExplicit(tagNumber: number, content: Byte): Byte {
+  const tagByte = 0xa0 | (tagNumber & 0x1f);
+  return tag(tagByte, content);
+}
+
+function tag(tagByte: number, content: Byte): Byte {
+  // Local copy to avoid exporting a private helper; matches der.tag semantics.
+  const len = encodeLenLocal(content.length);
+  return [tagByte, ...len, ...content];
+}
+
+function encodeLenLocal(n: number): number[] {
+  if (n < 0x80) return [n];
+  const bytes: number[] = [];
+  let v = n;
+  while (v > 0) {
+    bytes.unshift(v & 0xff);
+    v = v >>> 8;
+  }
+  if (bytes.length === 0) bytes.push(0);
+  return [0x80 | bytes.length, ...bytes];
+}
+
+/** Wrap a DER buffer as a PEM string. */
+export function pemEncode(der: Buffer, label: string): string {
+  const b64 = der.toString('base64');
+  const lines: string[] = [];
+  for (let i = 0; i < b64.length; i += 64) {
+    lines.push(b64.slice(i, i + 64));
+  }
+  return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----\n`;
+}
+
+// Re-export for index convenience.
+export { OID, NULL };

package/tests/crypto.test.ts

@@ -0,0 +1,213 @@
+import { describe, it, expect } from 'vitest';
+import crypto from 'node:crypto';
+import {
+  generateKeyPair,
+  createSelfSignedCertificate,
+  createCsr,
+  createTlsConfig,
+  encodeLen,
+  OID,
+  SEQUENCE,
+  NULL,
+  toBuffer,
+} from '../src/index.js';
+
+/** Node's X509Certificate has no `subjectCN` accessor; derive it from subject. */
+function subjectCN(x509: crypto.X509Certificate): string | undefined {
+  const subject = x509.subject;
+  const match = subject.match(/(?:^|\n)CN=([^\n]+)/);
+  return match ? match[1] : undefined;
+}
+
+// --- Tiny DER reader helpers for re-parsing our own CSR DER in the test ---
+function readLen(buf: Buffer, offset: number): { len: number; next: number } {
+  const first = buf[offset]!;
+  if (first < 0x80) {
+    return { len: first, next: offset + 1 };
+  }
+  const numBytes = first & 0x7f;
+  let len = 0;
+  let o = offset + 1;
+  for (let i = 0; i < numBytes; i++) {
+    len = (len << 8) | buf[o]!;
+    o++;
+  }
+  return { len, next: o };
+}
+
+/** Read one TLV; returns { tag, content, rest } where content is the V bytes. */
+function readTlv(buf: Buffer, offset: number): {
+  tag: number;
+  content: Buffer;
+  rest: Buffer;
+} {
+  const tag = buf[offset]!;
+  const { len, next } = readLen(buf, offset + 1);
+  const content = buf.subarray(next, next + len);
+  const rest = buf.subarray(next + len);
+  return { tag, content, rest };
+}
+
+/** Split a constructed SEQUENCE's content into its child TLV byte slices. */
+function splitChildren(content: Buffer): Buffer[] {
+  const children: Buffer[] = [];
+  let o = 0;
+  while (o < content.length) {
+    const { len, next } = readLen(content, o + 1);
+    const fullLen = next + len - o;
+    children.push(content.subarray(o, o + fullLen));
+    o += fullLen;
+  }
+  return children;
+}
+
+describe('nexus-crypto', () => {
+  it('generateKeyPair rsa produces valid PEM and DER buffers', () => {
+    const kp = generateKeyPair('rsa');
+    expect(kp.publicKey.length).toBeGreaterThan(0);
+    expect(kp.privateKey.length).toBeGreaterThan(0);
+    expect(kp.pem.public.startsWith('-----BEGIN PUBLIC KEY-----')).toBe(true);
+    expect(kp.pem.private.startsWith('-----BEGIN PRIVATE KEY-----')).toBe(true);
+    // createPublicKey accepts the PEM.
+    const pub = crypto.createPublicKey(kp.pem.public);
+    expect(pub.asymmetricKeyType).toBe('rsa');
+  });
+
+  it('generateKeyPair ec (prime256v1) produces valid PEM and DER buffers', () => {
+    const kp = generateKeyPair('ec');
+    expect(kp.publicKey.length).toBeGreaterThan(0);
+    expect(kp.privateKey.length).toBeGreaterThan(0);
+    expect(kp.pem.public.startsWith('-----BEGIN PUBLIC KEY-----')).toBe(true);
+    expect(kp.pem.private.startsWith('-----BEGIN PRIVATE KEY-----')).toBe(true);
+    const pub = crypto.createPublicKey(kp.pem.public);
+    expect(pub.asymmetricKeyType).toBe('ec');
+  });
+
+  it('createSelfSignedCertificate rsa parses and self-verifies', () => {
+    const kp = generateKeyPair('rsa');
+    const { pem } = createSelfSignedCertificate({
+      keyPair: kp,
+      commonName: 'test.rsa.example',
+      organization: 'BhooAI',
+      country: 'IN',
+    });
+    expect(pem.startsWith('-----BEGIN CERTIFICATE-----')).toBe(true);
+    const x509 = new crypto.X509Certificate(pem);
+    expect(subjectCN(x509)).toBe('test.rsa.example');
+    expect(x509.validFrom).toBeDefined();
+    expect(x509.validTo).toBeDefined();
+    // Self-signed: verifies against its own public key.
+    const pub = crypto.createPublicKey(kp.pem.public);
+    expect(x509.verify(pub)).toBe(true);
+  });
+
+  it('createSelfSignedCertificate ec parses and self-verifies', () => {
+    const kp = generateKeyPair('ec');
+    const { pem } = createSelfSignedCertificate({
+      keyPair: kp,
+      commonName: 'test.ec.example',
+    });
+    expect(pem.startsWith('-----BEGIN CERTIFICATE-----')).toBe(true);
+    const x509 = new crypto.X509Certificate(pem);
+    expect(subjectCN(x509)).toBe('test.ec.example');
+    const pub = crypto.createPublicKey(kp.pem.public);
+    expect(x509.verify(pub)).toBe(true);
+  });
+
+  it('createCsr rsa produces a verifiable CSR', () => {
+    const kp = generateKeyPair('rsa');
+    const { csr, pem } = createCsr({
+      keyPair: kp,
+      commonName: 'csr.rsa.example',
+    });
+    expect(pem.startsWith('-----BEGIN CERTIFICATE REQUEST-----')).toBe(true);
+    // Outer SEQUENCE: tag 0x30.
+    const outer = readTlv(csr, 0);
+    expect(outer.tag).toBe(0x30);
+    // Children: CRI SEQUENCE, sigAlg SEQUENCE, signature BIT STRING.
+    const kids = splitChildren(outer.content);
+    expect(kids.length).toBe(3);
+    expect(kids[0]![0]).toBe(0x30); // CRI
+    expect(kids[1]![0]).toBe(0x30); // sigAlg
+    expect(kids[2]![0]).toBe(0x03); // BIT STRING
+
+    const criBytes = kids[0]!;
+    const sigTlv = readTlv(kids[2]!, 0);
+    // BIT STRING content: first byte is unused-bits count (0), rest is signature.
+    const signature = sigTlv.content.subarray(1);
+
+    const verify = crypto.createVerify('SHA256').update(criBytes);
+    expect(verify.verify(kp.pem.public, signature)).toBe(true);
+  });
+
+  it('createCsr with challengePassword + extension still verifies', () => {
+    const kp = generateKeyPair('rsa');
+    const extValue = Buffer.from('hello-extension');
+    const { csr, pem } = createCsr({
+      keyPair: kp,
+      commonName: 'csr.ext.example',
+      challengePassword: 'secret-pass',
+      extensions: [{ type: '1.2.3.4.5.6.7', value: extValue }],
+    });
+    expect(pem.startsWith('-----BEGIN CERTIFICATE REQUEST-----')).toBe(true);
+    const outer = readTlv(csr, 0);
+    const kids = splitChildren(outer.content);
+    expect(kids.length).toBe(3);
+    const verify = crypto
+      .createVerify('SHA256')
+      .update(kids[0]!)
+      .verify(kp.pem.public, readTlv(kids[2]!, 0).content.subarray(1));
+    expect(verify).toBe(true);
+  });
+
+  it('createCsr ec verifies with EC key', () => {
+    const kp = generateKeyPair('ec');
+    const { csr, pem } = createCsr({
+      keyPair: kp,
+      commonName: 'csr.ec.example',
+    });
+    expect(pem.startsWith('-----BEGIN CERTIFICATE REQUEST-----')).toBe(true);
+    const outer = readTlv(csr, 0);
+    const kids = splitChildren(outer.content);
+    expect(kids.length).toBe(3);
+    const verify = crypto
+      .createVerify('SHA256')
+      .update(kids[0]!)
+      .verify(kp.pem.public, readTlv(kids[2]!, 0).content.subarray(1));
+    expect(verify).toBe(true);
+  });
+
+  it('DER unit tests: encodeLen, OID, SEQUENCE(NULL())', () => {
+    expect(encodeLen(0)).toEqual([0x00]);
+    expect(encodeLen(127)).toEqual([0x7f]);
+    expect(encodeLen(128)).toEqual([0x81, 0x80]);
+
+    const oid = OID([1, 2, 840, 113549, 1, 1, 11]);
+    // 0x06 (OID tag), length 0x09, then the standard sha256WithRSAEncryption arcs.
+    expect(oid.slice(0, 2)).toEqual([0x06, 0x09]);
+    expect(oid.slice(2)).toEqual([
+      0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
+    ]);
+
+    const seq = SEQUENCE(NULL());
+    expect(seq[0]).toBe(0x30);
+    // SEQUENCE length 2 (NULL is 0x05 0x00).
+    expect(seq[1]).toBe(0x02);
+    expect(seq.slice(2)).toEqual([0x05, 0x00]);
+    // Round-trip through a Buffer.
+    expect(toBuffer(seq)).toEqual(Buffer.from([0x30, 0x02, 0x05, 0x00]));
+  });
+
+  it('createTlsConfig returns the cert/key object', () => {
+    const cert = Buffer.from('cert');
+    const key = Buffer.from('key');
+    const cfg = createTlsConfig({ cert, key });
+    expect(cfg.cert).toBe(cert);
+    expect(cfg.key).toBe(key);
+    expect('ca' in cfg).toBe(false);
+
+    const ca = Buffer.from('ca');
+    const cfg2 = createTlsConfig({ cert, key, ca });
+    expect(cfg2.ca).toBe(ca);
+  });
+});

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist"
+  },
+  "include": ["src/**/*"],
+  "references": []
+}

package/vitest.config.ts

@@ -0,0 +1,10 @@
+import { defineProject } from 'vitest/config';
+
+export default defineProject({
+  test: {
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    globals: false,
+    testTimeout: 15_000,
+  },
+});

package/vitest.config.ts.timestamp-1786095205351-28d79db3b4fbb8.mjs

@@ -0,0 +1,14 @@
+// packages/nexus-crypto/vitest.config.ts
+import { defineProject } from "file:///C:/server/BhooAI/BhooAI-Nexus/BhooAI-Nexus/bhooai-nexus/node_modules/vitest/dist/config.js";
+var vitest_config_default = defineProject({
+  test: {
+    environment: "node",
+    include: ["tests/**/*.test.ts"],
+    globals: false,
+    testTimeout: 15e3
+  }
+});
+export {
+  vitest_config_default as default
+};
+//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsicGFja2FnZXMvbmV4dXMtY3J5cHRvL3ZpdGVzdC5jb25maWcudHMiXSwKICAic291cmNlc0NvbnRlbnQiOiBbImNvbnN0IF9fdml0ZV9pbmplY3RlZF9vcmlnaW5hbF9kaXJuYW1lID0gXCJDOlxcXFxzZXJ2ZXJcXFxcQmhvb0FJXFxcXEJob29BSS1OZXh1c1xcXFxCaG9vQUktTmV4dXNcXFxcYmhvb2FpLW5leHVzXFxcXHBhY2thZ2VzXFxcXG5leHVzLWNyeXB0b1wiO2NvbnN0IF9fdml0ZV9pbmplY3RlZF9vcmlnaW5hbF9maWxlbmFtZSA9IFwiQzpcXFxcc2VydmVyXFxcXEJob29BSVxcXFxCaG9vQUktTmV4dXNcXFxcQmhvb0FJLU5leHVzXFxcXGJob29haS1uZXh1c1xcXFxwYWNrYWdlc1xcXFxuZXh1cy1jcnlwdG9cXFxcdml0ZXN0LmNvbmZpZy50c1wiO2NvbnN0IF9fdml0ZV9pbmplY3RlZF9vcmlnaW5hbF9pbXBvcnRfbWV0YV91cmwgPSBcImZpbGU6Ly8vQzovc2VydmVyL0Job29BSS9CaG9vQUktTmV4dXMvQmhvb0FJLU5leHVzL2Job29haS1uZXh1cy9wYWNrYWdlcy9uZXh1cy1jcnlwdG8vdml0ZXN0LmNvbmZpZy50c1wiO2ltcG9ydCB7IGRlZmluZVByb2plY3QgfSBmcm9tICd2aXRlc3QvY29uZmlnJztcblxuZXhwb3J0IGRlZmF1bHQgZGVmaW5lUHJvamVjdCh7XG4gIHRlc3Q6IHtcbiAgICBlbnZpcm9ubWVudDogJ25vZGUnLFxuICAgIGluY2x1ZGU6IFsndGVzdHMvKiovKi50ZXN0LnRzJ10sXG4gICAgZ2xvYmFsczogZmFsc2UsXG4gICAgdGVzdFRpbWVvdXQ6IDE1XzAwMCxcbiAgfSxcbn0pOyJdLAogICJtYXBwaW5ncyI6ICI7QUFBNmEsU0FBUyxxQkFBcUI7QUFFM2MsSUFBTyx3QkFBUSxjQUFjO0FBQUEsRUFDM0IsTUFBTTtBQUFBLElBQ0osYUFBYTtBQUFBLElBQ2IsU0FBUyxDQUFDLG9CQUFvQjtBQUFBLElBQzlCLFNBQVM7QUFBQSxJQUNULGFBQWE7QUFBQSxFQUNmO0FBQ0YsQ0FBQzsiLAogICJuYW1lcyI6IFtdCn0K