@harperfast/harper 5.0.0-alpha.10

package/dist/security/certificateVerification/index.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Certificate verification for mTLS authentication
+ *
+ * This module provides certificate revocation checking for client certificates
+ * in mutual TLS (mTLS) connections. Supports both OCSP (Online Certificate
+ * Status Protocol) and CRL (Certificate Revocation List) verification methods
+ * with automatic method selection.
+ *
+ * Features:
+ * - OCSP verification with caching
+ * - CRL verification with caching
+ * - CRL-first with OCSP fallback for optimal performance
+ * - Background CRL refresh with exponential backoff
+ * - Graceful degradation during network outages
+ * - Ed25519/Ed448 certificate support
+ *
+ * Default behavior:
+ * - Certificate verification: disabled (must be explicitly enabled)
+ * - Verification approach: CRL-first (with OCSP fallback)
+ * - CRL timeout: 10 seconds, cache TTL: 24 hours
+ * - OCSP timeout: 5 seconds, cache TTL: 1 hour
+ * - Failure mode: fail-closed (rejects connections if verification fails)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyCertificate = verifyCertificate;
+const logger_ts_1 = require("../../utility/logging/logger.js");
+const verificationUtils_ts_1 = require("./verificationUtils.js");
+const verificationConfig_ts_1 = require("./verificationConfig.js");
+const ocspVerification_ts_1 = require("./ocspVerification.js");
+const crlVerification_ts_1 = require("./crlVerification.js");
+const logger = (0, logger_ts_1.loggerWithTag)('cert-verification');
+/**
+ * Verify certificate revocation status using OCSP and/or CRL
+ * @param peerCertificate - Peer certificate object from TLS connection
+ * @param mtlsConfig - The mTLS configuration from the request
+ * @returns Promise resolving to verification result
+ */
+async function verifyCertificate(peerCertificate, mtlsConfig) {
+    logger.debug?.(`verifyCertificate called for: ${peerCertificate.subject?.CN || 'unknown'}`);
+    // Get the verification configuration from mtlsConfig (cached for performance)
+    const config = (0, verificationConfig_ts_1.getCachedCertificateVerificationConfig)(mtlsConfig);
+    // If config is false, verification is disabled
+    if (config === false) {
+        logger.debug?.('Certificate verification disabled');
+        return { valid: true, status: 'disabled', method: 'disabled' };
+    }
+    // Extract certificate chain
+    const certChain = (0, verificationUtils_ts_1.extractCertificateChain)(peerCertificate);
+    logger.trace?.(`Certificate chain length: ${certChain.length}`);
+    // Check if we have sufficient chain for verification (need certificate and issuer)
+    if (certChain.length < 2 || !certChain[0].issuer) {
+        logger.debug?.('Certificate chain insufficient for revocation checking - need certificate and issuer');
+        return { valid: true, status: 'no-issuer-cert', method: 'disabled' };
+    }
+    // Extract certificate revocation URLs in single parse operation
+    const certPem = (0, verificationUtils_ts_1.bufferToPem)(certChain[0].cert, 'CERTIFICATE');
+    const { crlUrls, ocspUrls } = (0, verificationUtils_ts_1.extractRevocationUrls)(certPem);
+    logger.debug?.(`Certificate extensions: CRL distribution points=${crlUrls.length}, OCSP URLs=${ocspUrls.length}`);
+    // Try CRL first (can provide definitive results)
+    if (crlUrls.length > 0) {
+        if (config.crl.enabled) {
+            try {
+                logger.debug?.('Attempting CRL verification');
+                const result = await (0, crlVerification_ts_1.verifyCRL)(certChain[0].cert, certChain[0].issuer, config.crl, crlUrls);
+                // Return on definitive result (good or revoked)
+                if (result.status === 'good' || result.status === 'revoked') {
+                    logger.debug?.(`CRL verification result: ${result.status}`);
+                    return result;
+                }
+                logger.debug?.(`CRL verification inconclusive: ${result.status}, trying OCSP fallback`);
+            }
+            catch (error) {
+                logger.warn?.(`CRL verification failed: ${error}`);
+            }
+        }
+        else {
+            logger.debug?.('Skipping CRL - disabled in configuration');
+        }
+    }
+    else {
+        logger.debug?.('Skipping CRL - no distribution points in certificate');
+    }
+    // Fall back to OCSP if available (real-time status)
+    if (ocspUrls.length > 0) {
+        if (config.ocsp.enabled) {
+            try {
+                logger.debug?.('Attempting OCSP verification');
+                const result = await (0, ocspVerification_ts_1.verifyOCSP)(certChain[0].cert, certChain[0].issuer, config.ocsp, ocspUrls);
+                // Return result (definitive or not)
+                logger.debug?.(`OCSP verification result: ${result.status}`);
+                return result;
+            }
+            catch (error) {
+                logger.warn?.(`OCSP verification failed: ${error}`);
+            }
+        }
+        else {
+            logger.debug?.('Skipping OCSP - disabled in configuration');
+        }
+    }
+    else {
+        logger.debug?.('Skipping OCSP - no responder URLs in certificate');
+    }
+    // All methods tried or skipped - determine failure handling
+    if (config.failureMode === 'fail-closed') {
+        return { valid: false, status: 'no-verification-available', method: 'disabled' };
+    }
+    return { valid: true, status: 'verification-unavailable-allowed', method: 'disabled' };
+}
+//# sourceMappingURL=index.js.map

package/dist/security/certificateVerification/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../security/certificateVerification/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAiBH,8CAiFC;AAhGD,+DAAgE;AAChE,iEAAqG;AACrG,mEAAiF;AACjF,+DAAmD;AACnD,6DAAiD;AAGjD,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,mBAAmB,CAAC,CAAC;AAElD;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CACtC,eAAgC,EAChC,UAAiD;IAEjD,MAAM,CAAC,KAAK,EAAE,CAAC,iCAAiC,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;IAE5F,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAA,8DAAsC,EAAC,UAAU,CAAC,CAAC;IAElE,+CAA+C;IAC/C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,CAAC,mCAAmC,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAA,8CAAuB,EAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,CAAC,6BAA6B,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhE,mFAAmF;IACnF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,CAAC,sFAAsF,CAAC,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtE,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAA,kCAAW,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAA,4CAAqB,EAAC,OAAO,CAAC,CAAC;IAE7D,MAAM,CAAC,KAAK,EAAE,CAAC,mDAAmD,OAAO,CAAC,MAAM,eAAe,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAElH,iDAAiD;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,MAAM,CAAC,KAAK,EAAE,CAAC,6BAA6B,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAS,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAE5F,gDAAgD;gBAChD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC7D,MAAM,CAAC,KAAK,EAAE,CAAC,4BAA4B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC5D,OAAO,MAAM,CAAC;gBACf,CAAC;gBAED,MAAM,CAAC,KAAK,EAAE,CAAC,kCAAkC,MAAM,CAAC,MAAM,wBAAwB,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,EAAE,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,KAAK,EAAE,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;SAAM,CAAC;QACP,MAAM,CAAC,KAAK,EAAE,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IAED,oDAAoD;IACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC;gBACJ,MAAM,CAAC,KAAK,EAAE,CAAC,8BAA8B,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAU,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAE/F,oCAAoC;gBACpC,MAAM,CAAC,KAAK,EAAE,CAAC,6BAA6B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,EAAE,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,KAAK,EAAE,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;SAAM,CAAC;QACP,MAAM,CAAC,KAAK,EAAE,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IAED,4DAA4D;IAC5D,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACxF,CAAC"}

package/dist/security/certificateVerification/ocspVerification.d.ts

@@ -0,0 +1,23 @@
+/**
+ * OCSP (Online Certificate Status Protocol) verification
+ */
+import './pkijs-ed25519-patch.ts';
+import type { CertificateVerificationResult, OCSPCheckResult, OCSPConfig } from './types.ts';
+/**
+ * Verify OCSP status of a client certificate
+ * @param certPem - Client certificate as Buffer (DER format)
+ * @param issuerPem - Issuer (CA) certificate as Buffer (DER format)
+ * @param config - OCSP configuration
+ * @param ocspUrls - Optional pre-extracted OCSP responder URLs (avoids re-parsing)
+ * @returns Promise resolving to verification result
+ */
+export declare function verifyOCSP(certPem: Buffer, issuerPem: Buffer, config?: OCSPConfig, ocspUrls?: string[]): Promise<CertificateVerificationResult>;
+/**
+ * Perform the actual OCSP check using easy-ocsp
+ * @param certPem - Certificate in PEM format
+ * @param issuerPem - Issuer certificate in PEM format
+ * @param config - OCSP configuration
+ * @param ocspUrls - Optional pre-extracted OCSP responder URLs (avoids re-parsing)
+ * @returns OCSP check result
+ */
+export declare function performOCSPCheck(certPem: string, issuerPem: string, config: any, ocspUrls?: string[]): Promise<OCSPCheckResult>;

package/dist/security/certificateVerification/ocspVerification.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * OCSP (Online Certificate Status Protocol) verification
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyOCSP = verifyOCSP;
+exports.performOCSPCheck = performOCSPCheck;
+// Apply PKI.js Ed25519 patch before importing easy-ocsp
+require("./pkijs-ed25519-patch.js");
+const easy_ocsp_1 = require("easy-ocsp");
+const logger_ts_1 = require("../../utility/logging/logger.js");
+const verificationUtils_ts_1 = require("./verificationUtils.js");
+const logger = (0, logger_ts_1.loggerWithTag)('ocsp-verification');
+// Import the shared source
+const certificateVerificationSource_ts_1 = require("./certificateVerificationSource.js");
+// Lazy-load the certificate verification cache table
+let certCacheTable;
+function getCertificateCacheTable() {
+    if (!certCacheTable) {
+        certCacheTable = (0, verificationUtils_ts_1.getCertificateCacheTable)();
+        // Configure the caching source using the shared CertificateVerificationSource class
+        certCacheTable.sourcedFrom(certificateVerificationSource_ts_1.CertificateVerificationSource);
+    }
+    return certCacheTable;
+}
+/**
+ * Verify OCSP status of a client certificate
+ * @param certPem - Client certificate as Buffer (DER format)
+ * @param issuerPem - Issuer (CA) certificate as Buffer (DER format)
+ * @param config - OCSP configuration
+ * @param ocspUrls - Optional pre-extracted OCSP responder URLs (avoids re-parsing)
+ * @returns Promise resolving to verification result
+ */
+async function verifyOCSP(certPem, issuerPem, config, ocspUrls) {
+    // Check if OCSP verification is disabled
+    if (config?.enabled === false) {
+        return { valid: true, status: 'disabled', method: 'disabled' };
+    }
+    try {
+        // Convert DER buffers to PEM strings for certificate parsing libraries
+        // PKI.js and easy-ocsp expect PEM format for extension extraction and OCSP requests
+        const certPemStr = (0, verificationUtils_ts_1.bufferToPem)(certPem, 'CERTIFICATE');
+        const issuerPemStr = (0, verificationUtils_ts_1.bufferToPem)(issuerPem, 'CERTIFICATE');
+        // Create a cache key that includes all verification parameters
+        const cacheKey = (0, verificationUtils_ts_1.createCacheKey)(certPemStr, issuerPemStr, 'ocsp');
+        // Get the cache table - Harper will automatically handle
+        // concurrent requests and cache stampede prevention
+        // Pass certificate data as context - Harper will make it available as requestContext in the source
+        const cacheEntry = await getCertificateCacheTable().get(cacheKey, {
+            certPem: certPemStr,
+            issuerPem: issuerPemStr,
+            ocspUrls,
+            config: { ocsp: config ?? {} },
+        });
+        if (!cacheEntry) {
+            // This should not happen if the source is configured correctly
+            // but handle it gracefully
+            if (config.failureMode === 'fail-closed') {
+                return { valid: false, status: 'error', error: 'Cache fetch failed', method: 'ocsp' };
+            }
+            logger.warn?.('OCSP cache fetch failed, allowing connection (fail-open mode)');
+            return { valid: true, status: 'error-allowed', method: 'ocsp' };
+        }
+        const cached = cacheEntry;
+        const wasLoadedFromSource = cacheEntry.wasLoadedFromSource?.();
+        logger.trace?.(`OCSP ${wasLoadedFromSource ? 'source fetch' : 'cache hit'} for certificate`);
+        return {
+            valid: cached.status === 'good',
+            status: cached.status,
+            cached: !wasLoadedFromSource,
+            method: cached.method || 'ocsp',
+        };
+    }
+    catch (error) {
+        logger.error?.(`OCSP verification error: ${error}`);
+        // Check failure mode
+        if (config.failureMode === 'fail-closed') {
+            return { valid: false, status: 'error', error: error.message, method: 'ocsp' };
+        }
+        // Fail open - allow connection on OCSP errors
+        logger.warn?.('OCSP check failed, allowing connection (fail-open mode)');
+        return { valid: true, status: 'error-allowed', method: 'ocsp' };
+    }
+}
+/**
+ * Perform the actual OCSP check using easy-ocsp
+ * @param certPem - Certificate in PEM format
+ * @param issuerPem - Issuer certificate in PEM format
+ * @param config - OCSP configuration
+ * @param ocspUrls - Optional pre-extracted OCSP responder URLs (avoids re-parsing)
+ * @returns OCSP check result
+ */
+async function performOCSPCheck(certPem, issuerPem, config, ocspUrls) {
+    try {
+        const response = await (0, easy_ocsp_1.getCertStatus)(certPem, {
+            ca: issuerPem,
+            timeout: config.timeout,
+            ...(ocspUrls?.length && { ocspUrl: ocspUrls[0] }),
+        });
+        // Map response status to internal format
+        switch (response.status) {
+            case 'good':
+                return { status: 'good' };
+            case 'revoked':
+                return { status: 'revoked', reason: response.revocationReason?.toString() || 'unspecified' };
+            default:
+                return { status: 'unknown', reason: 'unknown-status' };
+        }
+    }
+    catch (error) {
+        const err = error;
+        // Return appropriate error based on type
+        const reason = err.name === 'AbortError' ? 'timeout' : 'ocsp-error';
+        return { status: 'unknown', reason };
+    }
+}
+//# sourceMappingURL=ocspVerification.js.map

package/dist/security/certificateVerification/ocspVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ocspVerification.js","sourceRoot":"","sources":["../../../security/certificateVerification/ocspVerification.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA2CH,gCA+DC;AAUD,4CA6BC;AA/ID,wDAAwD;AACxD,oCAAkC;AAClC,yCAA0C;AAC1C,+DAAgE;AAChE,iEAIgC;AAShC,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,mBAAmB,CAAC,CAAC;AAElD,2BAA2B;AAC3B,yFAAmF;AAEnF,qDAAqD;AACrD,IAAI,cAAiE,CAAC;AACtE,SAAS,wBAAwB;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,cAAc,GAAG,IAAA,+CAA8B,GAAE,CAAC;QAClD,oFAAoF;QACnF,cAAsB,CAAC,WAAW,CAAC,gEAA6B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAC/B,OAAe,EACf,SAAiB,EACjB,MAAmB,EACnB,QAAmB;IAEnB,yCAAyC;IACzC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACJ,uEAAuE;QACvE,oFAAoF;QACpF,MAAM,UAAU,GAAG,IAAA,kCAAW,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,IAAA,kCAAW,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAE3D,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,qCAAc,EAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAElE,yDAAyD;QACzD,oDAAoD;QACpD,mGAAmG;QACnG,MAAM,UAAU,GAAG,MAAO,wBAAwB,EAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC1E,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,YAAY;YACvB,QAAQ;YACR,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE;SACI,CAAC,CAAC;QAErC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,+DAA+D;YAC/D,2BAA2B;YAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACvF,CAAC;YAED,MAAM,CAAC,IAAI,EAAE,CAAC,+DAA+D,CAAC,CAAC;YAC/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,UAA8C,CAAC;QAC9D,MAAM,mBAAmB,GAAI,UAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAE7F,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,CAAC,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;SAC/B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAEpD,qBAAqB;QACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3F,CAAC;QAED,8CAA8C;QAC9C,MAAM,CAAC,IAAI,EAAE,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,gBAAgB,CACrC,OAAe,EACf,SAAiB,EACjB,MAAW,EACX,QAAmB;IAEnB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAa,EAAC,OAAO,EAAE;YAC7C,EAAE,EAAE,SAAS;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QAEH,yCAAyC;QACzC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzB,KAAK,MAAM;gBACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3B,KAAK,SAAS;gBACb,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,aAAa,EAAE,CAAC;YAC9F;gBACC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACzD,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAc,CAAC;QAE3B,yCAAyC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;AACF,CAAC"}

package/dist/security/certificateVerification/pkijs-ed25519-patch.d.ts

@@ -0,0 +1,14 @@
+/**
+ * PKI.js Ed25519/Ed448 Support Patch
+ *
+ * This module patches PKI.js to add complete Ed25519/Ed448 support for certificate
+ * and OCSP response verification. While PKI.js has some Ed25519/Ed448 support,
+ * it currently lacks:
+ * - getHashAlgorithm() support for Ed25519/Ed448 OIDs
+ * - getAlgorithmByOID() recognition of Ed25519/Ed448
+ * - Certificate verification using Ed25519/Ed448 signatures
+ * - OCSP response signature verification with Ed25519/Ed448
+ *
+ * This patch must be loaded before any module that uses PKI.js (including easy-ocsp).
+ */
+export declare function applyEd25519Patch(): void;

package/dist/security/certificateVerification/pkijs-ed25519-patch.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * PKI.js Ed25519/Ed448 Support Patch
+ *
+ * This module patches PKI.js to add complete Ed25519/Ed448 support for certificate
+ * and OCSP response verification. While PKI.js has some Ed25519/Ed448 support,
+ * it currently lacks:
+ * - getHashAlgorithm() support for Ed25519/Ed448 OIDs
+ * - getAlgorithmByOID() recognition of Ed25519/Ed448
+ * - Certificate verification using Ed25519/Ed448 signatures
+ * - OCSP response signature verification with Ed25519/Ed448
+ *
+ * This patch must be loaded before any module that uses PKI.js (including easy-ocsp).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyEd25519Patch = applyEd25519Patch;
+const pkijs = __importStar(require("pkijs"));
+const node_crypto_1 = require("node:crypto");
+// Ed25519/Ed448 OIDs (these are standardized object identifiers, not IP addresses)
+const ED25519_OID = '1.3.101.112';
+const ED448_OID = '1.3.101.113';
+// Algorithm names as constants
+const ED25519_NAME = 'Ed25519';
+const ED448_NAME = 'Ed448';
+// Apply patches only once
+let patchesApplied = false;
+function isEd25519OrEd448(oid) {
+    return oid === ED25519_OID || oid === ED448_OID;
+}
+function isEdDSAAlgorithmName(name) {
+    return name === ED25519_NAME || name === ED448_NAME;
+}
+function getEdDSAAlgorithmName(oid) {
+    return oid === ED25519_OID ? ED25519_NAME : ED448_NAME;
+}
+function applyEd25519Patch() {
+    if (patchesApplied)
+        return;
+    patchesApplied = true;
+    const CryptoEngine = pkijs.CryptoEngine.prototype;
+    const Certificate = pkijs.Certificate.prototype;
+    // Store original methods
+    const originals = {
+        getHashAlgorithm: CryptoEngine.getHashAlgorithm,
+        getAlgorithmByOID: CryptoEngine.getAlgorithmByOID,
+        getAlgorithmParameters: CryptoEngine.getAlgorithmParameters,
+        verifyWithPublicKey: CryptoEngine.verifyWithPublicKey,
+        certificateVerify: Certificate.verify,
+        getPublicKey: Certificate.getPublicKey,
+    };
+    // Patch getHashAlgorithm - Ed25519/Ed448 don't use separate hashes
+    CryptoEngine.getHashAlgorithm = function (...params) {
+        const [signatureAlgorithm] = params;
+        if (isEd25519OrEd448(signatureAlgorithm.algorithmId)) {
+            // EdDSA signatures have built-in hash functions per RFC 8032:
+            // - Ed25519 uses SHA-512 internally (Section 5.1.6)
+            // - Ed448 uses SHAKE256 internally (Section 5.2.6)
+            // The hash is not a parameter - it's part of the algorithm definition.
+            // Returning a placeholder since PKI.js expects a string, but our patched
+            // verification methods bypass any code that would use this value.
+            return 'UNUSED-EDDSA-BUILTIN-HASH';
+        }
+        return originals.getHashAlgorithm.call(this, signatureAlgorithm);
+    };
+    // Patch getAlgorithmByOID to recognize Ed25519/Ed448
+    CryptoEngine.getAlgorithmByOID = function (...params) {
+        const [oid] = params;
+        if (isEd25519OrEd448(oid)) {
+            return { name: getEdDSAAlgorithmName(oid) };
+        }
+        return originals.getAlgorithmByOID.call(this, ...params);
+    };
+    // Patch getAlgorithmParameters
+    CryptoEngine.getAlgorithmParameters = function (...params) {
+        const [algorithmName, operation] = params;
+        if (isEdDSAAlgorithmName(algorithmName)) {
+            return {
+                algorithm: { name: algorithmName },
+                usages: operation === 'sign' ? ['sign'] : ['verify'],
+            };
+        }
+        return originals.getAlgorithmParameters.call(this, ...params);
+    };
+    // Patch getPublicKey for Ed25519/Ed448
+    Certificate.getPublicKey = async function (...params) {
+        const [, cryptoEngine = pkijs.getCrypto(true)] = params;
+        const algId = this.subjectPublicKeyInfo.algorithm.algorithmId;
+        if (isEd25519OrEd448(algId)) {
+            const algorithmName = getEdDSAAlgorithmName(algId);
+            return cryptoEngine.importKey('spki', this.subjectPublicKeyInfo.toSchema().toBER(false), algorithmName, true, [
+                'verify',
+            ]);
+        }
+        return originals.getPublicKey.call(this, ...params);
+    };
+    // Patch Certificate.verify for Ed25519/Ed448
+    Certificate.verify = async function (...params) {
+        const [issuerCertificate] = params;
+        if (isEd25519OrEd448(this.signatureAlgorithm.algorithmId)) {
+            try {
+                // Use Node.js X509Certificate for Ed25519/Ed448 verification
+                const certDer = this.toSchema().toBER(false);
+                const issuerDer = issuerCertificate.toSchema().toBER(false);
+                const nodeCert = new node_crypto_1.X509Certificate(Buffer.from(certDer));
+                const nodeIssuer = new node_crypto_1.X509Certificate(Buffer.from(issuerDer));
+                return nodeCert.verify(nodeIssuer.publicKey);
+            }
+            catch {
+                // Any failure in verification should return false
+                return false;
+            }
+        }
+        return originals.certificateVerify.call(this, ...params);
+    };
+    // Patch verifyWithPublicKey for OCSP response verification
+    if (originals.verifyWithPublicKey) {
+        CryptoEngine.verifyWithPublicKey = async function (...params) {
+            const [data, signature, publicKeyInfo] = params;
+            const algId = publicKeyInfo.algorithm.algorithmId;
+            if (isEd25519OrEd448(algId)) {
+                const algorithmName = getEdDSAAlgorithmName(algId);
+                try {
+                    // Get crypto.subtle from available sources
+                    const cryptoSubtle = this.crypto?.subtle || this.subtle || pkijs.getCrypto(true)?.subtle || node_crypto_1.webcrypto?.subtle;
+                    if (!cryptoSubtle) {
+                        throw new Error('No crypto.subtle available');
+                    }
+                    // Import the public key
+                    const publicKey = await cryptoSubtle.importKey('spki', publicKeyInfo.toSchema().toBER(false), algorithmName, false, ['verify']);
+                    // Handle BIT STRING signature value
+                    let signatureValue = signature.valueBlock.valueHexView;
+                    // Check if this is a BIT STRING with unused bits
+                    if ('unusedBits' in signature.valueBlock && signature.valueBlock.unusedBits > 0) {
+                        signatureValue = signatureValue.slice(0, signatureValue.length - 1);
+                    }
+                    // Verify the signature
+                    return await cryptoSubtle.verify(algorithmName, publicKey, signatureValue, data);
+                }
+                catch {
+                    // Any failure in verification should return false
+                    return false;
+                }
+            }
+            return originals.verifyWithPublicKey.call(this, ...params);
+        };
+    }
+}
+// Apply patch on module load
+applyEd25519Patch();
+//# sourceMappingURL=pkijs-ed25519-patch.js.map

package/dist/security/certificateVerification/pkijs-ed25519-patch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkijs-ed25519-patch.js","sourceRoot":"","sources":["../../../security/certificateVerification/pkijs-ed25519-patch.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BH,8CA8IC;AA1KD,6CAA+B;AAC/B,6CAAyD;AAEzD,mFAAmF;AACnF,MAAM,WAAW,GAAG,aAAsB,CAAC;AAC3C,MAAM,SAAS,GAAG,aAAsB,CAAC;AAGzC,+BAA+B;AAC/B,MAAM,YAAY,GAAG,SAAkB,CAAC;AACxC,MAAM,UAAU,GAAG,OAAgB,CAAC;AAGpC,0BAA0B;AAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,gBAAgB,CAAC,GAAW;IACpC,OAAO,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACzC,OAAO,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;AACxD,CAAC;AAED,SAAgB,iBAAiB;IAChC,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IAEtB,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;IAClD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;IAEhD,yBAAyB;IACzB,MAAM,SAAS,GAAG;QACjB,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;QACjD,sBAAsB,EAAE,YAAY,CAAC,sBAAsB;QAC3D,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,iBAAiB,EAAE,WAAW,CAAC,MAAM;QACrC,YAAY,EAAE,WAAW,CAAC,YAAY;KACtC,CAAC;IAEF,mEAAmE;IACnE,YAAY,CAAC,gBAAgB,GAAG,UAC/B,GAAG,MAAqD;QAExD,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACpC,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,8DAA8D;YAC9D,oDAAoD;YACpD,mDAAmD;YACnD,uEAAuE;YACvE,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,2BAA2B,CAAC;QACpC,CAAC;QACD,OAAO,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC,CAAC;IAEF,qDAAqD;IACrD,YAAY,CAAC,iBAAiB,GAAG,UAChC,GAAG,MAAsD;QAEzD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACrB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,+BAA+B;IAC/B,YAAY,CAAC,sBAAsB,GAAG,UACrC,GAAG,MAA2D;QAE9D,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC;QAC1C,IAAI,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;gBAClC,MAAM,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;aACpD,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,uCAAuC;IACvC,WAAW,CAAC,YAAY,GAAG,KAAK,WAC/B,GAAG,MAAiD;QAEpD,MAAM,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC;QAC9D,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;gBAC7G,QAAQ;aACR,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,6CAA6C;IAC7C,WAAW,CAAC,MAAM,GAAG,KAAK,WACzB,GAAG,MAAsD;QAEzD,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;QACnC,IAAI,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC;gBACJ,6DAA6D;gBAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAE5D,MAAM,QAAQ,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3D,MAAM,UAAU,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAE/D,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACR,kDAAkD;gBAClD,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,2DAA2D;IAC3D,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;QACnC,YAAY,CAAC,mBAAmB,GAAG,KAAK,WACvC,GAAG,MAAwD;YAE3D,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC;YAChD,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC;YAClD,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAEnD,IAAI,CAAC;oBACJ,2CAA2C;oBAC3C,MAAM,YAAY,GAChB,IAAY,CAAC,MAAM,EAAE,MAAM,IAAK,IAAY,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,uBAAS,EAAE,MAAM,CAAC;oBAE5G,IAAI,CAAC,YAAY,EAAE,CAAC;wBACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC/C,CAAC;oBAED,wBAAwB;oBACxB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,CAC7C,MAAM,EACN,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EACrC,aAAa,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACV,CAAC;oBAEF,oCAAoC;oBACpC,IAAI,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;oBACvD,iDAAiD;oBACjD,IAAI,YAAY,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;wBACjF,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBACrE,CAAC;oBAED,uBAAuB;oBACvB,OAAO,MAAM,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;gBAClF,CAAC;gBAAC,MAAM,CAAC;oBACR,kDAAkD;oBAClD,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;YACD,OAAO,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;QAC5D,CAAC,CAAC;IACH,CAAC;AACF,CAAC;AAED,6BAA6B;AAC7B,iBAAiB,EAAE,CAAC"}

package/dist/security/certificateVerification/types.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Shared TypeScript interfaces and types for certificate verification
+ */
+import type { Context } from '../../resources/ResourceInterface.ts';
+export type CertificateStatus = 'good' | 'revoked' | 'unknown';
+export type VerificationMethod = 'ocsp' | 'crl';
+export type VerificationResultMethod = VerificationMethod | 'disabled';
+export type FailureMode = 'fail-open' | 'fail-closed';
+export interface PeerCertificate {
+    subject?: {
+        CN?: string;
+        [key: string]: any;
+    };
+    raw?: Buffer;
+    issuerCertificate?: PeerCertificate;
+}
+export interface CertificateVerificationResult {
+    valid: boolean;
+    status: string;
+    cached?: boolean;
+    error?: string;
+    method?: VerificationResultMethod;
+}
+export interface CertificateCacheEntry {
+    certificate_id: string;
+    status: CertificateStatus;
+    reason?: string;
+    checked_at: number;
+    expiresAt: number;
+    method: VerificationMethod;
+}
+export interface CRLCacheEntry {
+    distribution_point: string;
+    issuer_dn: string;
+    crl_blob: Buffer;
+    this_update: number;
+    next_update: number;
+    signature_valid: boolean;
+    expiresAt: number;
+}
+export interface RevokedCertificateEntry {
+    composite_id: string;
+    serial_number: string;
+    issuer_key_id: string;
+    revocation_date: number;
+    revocation_reason?: string;
+    crl_source: string;
+    crl_next_update: number;
+    expiresAt: number;
+}
+export interface CertificateChainEntry {
+    cert: Buffer;
+    issuer?: Buffer;
+}
+export interface OCSPCheckResult {
+    status: CertificateStatus;
+    reason?: string;
+}
+export interface CRLCheckResult {
+    status: CertificateStatus;
+    reason?: string;
+    source?: string;
+}
+export interface OCSPConfig {
+    enabled?: boolean;
+    timeout?: number;
+    cacheTtl?: number;
+    errorCacheTtl?: number;
+    failureMode?: FailureMode;
+}
+export interface CRLConfig {
+    enabled?: boolean;
+    timeout?: number;
+    cacheTtl?: number;
+    failureMode?: FailureMode;
+    gracePeriod?: number;
+}
+export interface CertificateVerificationConfig {
+    failureMode?: FailureMode;
+    ocsp?: OCSPConfig;
+    crl?: CRLConfig;
+}
+export interface CertificateVerificationContext extends Context {
+    certPem: string;
+    issuerPem: string;
+    ocspUrls?: string[];
+    distributionPoint?: string;
+    config?: CertificateVerificationConfig;
+}
+export interface CRLVerificationContext extends Context {
+    distributionPoint: string;
+    issuerPem: string;
+    config?: CRLConfig;
+}
+export interface VerificationDefaults {
+    timeout: number;
+    cacheTtl: number;
+    failureMode: FailureMode;
+}
+export interface OCSPDefaults extends VerificationDefaults {
+    errorCacheTtl: number;
+}
+export interface CRLDefaults extends VerificationDefaults {
+    gracePeriod: number;
+}

package/dist/security/certificateVerification/types.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Shared TypeScript interfaces and types for certificate verification
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/security/certificateVerification/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../security/certificateVerification/types.ts"],"names":[],"mappings":";AAAA;;GAEG"}

package/dist/security/certificateVerification/verificationConfig.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Configuration parsing and default values for certificate verification
+ */
+import type { CertificateVerificationConfig } from './types.ts';
+export declare const CRL_DEFAULT_VALIDITY_PERIOD: number;
+export declare const ERROR_CACHE_TTL = 300000;
+export declare const CRL_USER_AGENT: string;
+/**
+ * Cached version of getCertificateVerificationConfig to avoid redundant parsing
+ * This is the recommended function to use in hot paths like certificate verification.
+ *
+ * MEMORY SAFETY:
+ * - Uses WeakMap for object configs to prevent memory leaks
+ * - Config objects can be garbage collected when no longer referenced elsewhere
+ * - Primitive values (boolean, null, undefined) use simple reference equality
+ * - No strong references held to config objects, preventing memory accumulation
+ *
+ * ERROR HANDLING:
+ * - Invalid config causes validation errors to be thrown on first access
+ * - Validation errors are logged once and then cached
+ * - Subsequent accesses with the same invalid config return false (disabled) to prevent
+ *   repeated error logging and allow the application to continue running
+ * - This provides fail-safe behavior: invalid security config defaults to disabled
+ *   rather than crashing on every request
+ *
+ * @param mtlsConfig - The mTLS configuration from env.get()
+ * @returns Configuration object or false if verification is disabled or invalid
+ */
+export declare function getCachedCertificateVerificationConfig(mtlsConfig?: boolean | Record<string, any> | null): false | CertificateVerificationConfig;