@harperfast/integration-testing 0.1.0 → 0.3.0-0

package/dist/security/certGenUtils.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Pure Node.js X.509 certificate and CRL generation utilities
+ *
+ * Uses Node.js built-in webcrypto (Ed25519) + pkijs for ASN.1 encoding.
+ * No openssl CLI dependency — fully portable across macOS and Linux.
+ */
+import * as pkijs from 'pkijs';
+declare const OCSP_SIGNING_OID = "1.3.6.1.5.5.7.3.9";
+declare const CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
+export interface Ed25519KeyPair {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    /** PKCS8 PEM string */
+    privateKeyPem: string;
+}
+export declare function generateEd25519KeyPair(): Promise<Ed25519KeyPair>;
+/** Convert a pkijs Certificate to PEM string */
+export declare function certToPem(cert: pkijs.Certificate): string;
+/** Convert a pkijs CertificateRevocationList to PEM string */
+export declare function crlToPem(crl: pkijs.CertificateRevocationList): string;
+interface CertOptions {
+    serialNumber: number;
+    subject: {
+        CN: string;
+        O?: string;
+    };
+    issuer: {
+        CN: string;
+        O?: string;
+    };
+    validDays: number;
+    issuerKey: CryptoKey;
+    subjectPublicKey: CryptoKey;
+    isCA?: boolean;
+    extensions?: pkijs.Extension[];
+}
+/** Create a signed Ed25519 X.509 v3 certificate */
+export declare function createCertificate(opts: CertOptions): Promise<pkijs.Certificate>;
+/** Create a CRL Distribution Points extension */
+export declare function makeCRLDistributionPointsExt(url: string): pkijs.Extension;
+/** Create an Authority Info Access extension with an OCSP URL */
+export declare function makeOCSPAIAExt(url: string): pkijs.Extension;
+/** Create an Extended Key Usage extension */
+export declare function makeExtKeyUsageExt(oids: string[]): pkijs.Extension;
+export { OCSP_SIGNING_OID, CLIENT_AUTH_OID };
+/** Create a signed X.509v2 CRL */
+export declare function createCRL(issuerCert: pkijs.Certificate, issuerKey: CryptoKey, revokedSerials: number[]): Promise<pkijs.CertificateRevocationList>;
+/**
+ * Sign a pkijs BasicOCSPResponse with an Ed25519 key.
+ * Must be called after tbsResponseData.responses is populated.
+ */
+export declare function signBasicOCSPResponse(basicResponse: pkijs.BasicOCSPResponse, privateKey: CryptoKey): Promise<void>;

package/dist/security/certGenUtils.js

@@ -0,0 +1,170 @@
+/**
+ * Pure Node.js X.509 certificate and CRL generation utilities
+ *
+ * Uses Node.js built-in webcrypto (Ed25519) + pkijs for ASN.1 encoding.
+ * No openssl CLI dependency — fully portable across macOS and Linux.
+ */
+import { webcrypto } from 'node:crypto';
+import * as pkijs from 'pkijs';
+import * as asn1js from 'asn1js';
+// Ed25519 OID (RFC 8410)
+const ED25519_OID = '1.3.101.112';
+// Standard extension OIDs
+const BASIC_CONSTRAINTS_OID = '2.5.29.19';
+const CRL_DISTRIBUTION_POINTS_OID = '2.5.29.31';
+const AUTHORITY_INFO_ACCESS_OID = '1.3.6.1.5.5.7.1.1';
+const EXT_KEY_USAGE_OID = '2.5.29.37';
+const OCSP_SIGNING_OID = '1.3.6.1.5.5.7.3.9';
+const CLIENT_AUTH_OID = '1.3.6.1.5.5.7.3.2';
+const OCSP_ACCESS_METHOD_OID = '1.3.6.1.5.5.7.48.1';
+// Configure pkijs to use Node.js webcrypto
+pkijs.setEngine('node', new pkijs.CryptoEngine({ name: 'node', crypto: webcrypto }));
+export async function generateEd25519KeyPair() {
+    // Ed25519 is supported at runtime (Node 20+) but @types/node lacks dedicated types for it
+    const keyPair = (await webcrypto.subtle.generateKey({ name: 'Ed25519' }, true, [
+        'sign',
+        'verify',
+    ]));
+    const pkcs8 = await webcrypto.subtle.exportKey('pkcs8', keyPair.privateKey);
+    const b64 = Buffer.from(pkcs8).toString('base64');
+    const lines = b64.match(/.{1,64}/g).join('\n');
+    const privateKeyPem = `-----BEGIN PRIVATE KEY-----\n${lines}\n-----END PRIVATE KEY-----\n`;
+    return { privateKey: keyPair.privateKey, publicKey: keyPair.publicKey, privateKeyPem };
+}
+/**
+ * Sign a pkijs Certificate or CertificateRevocationList with an Ed25519 key.
+ * Bypasses pkijs's sign() method which does not support Ed25519.
+ */
+async function signWithEd25519(obj, privateKey) {
+    const algId = new pkijs.AlgorithmIdentifier({ algorithmId: ED25519_OID });
+    obj.signature = algId;
+    obj.signatureAlgorithm = algId;
+    const tbsBer = obj.encodeTBS().toBER();
+    obj.tbsView = new Uint8Array(tbsBer);
+    const sig = await webcrypto.subtle.sign('Ed25519', privateKey, tbsBer);
+    obj.signatureValue = new asn1js.BitString({ valueHex: sig });
+}
+/** Convert a pkijs Certificate to PEM string */
+export function certToPem(cert) {
+    const der = cert.toSchema(false).toBER();
+    const b64 = Buffer.from(der).toString('base64');
+    return `-----BEGIN CERTIFICATE-----\n${b64.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
+}
+/** Convert a pkijs CertificateRevocationList to PEM string */
+export function crlToPem(crl) {
+    const der = crl.toSchema(false).toBER();
+    const b64 = Buffer.from(der).toString('base64');
+    return `-----BEGIN X509 CRL-----\n${b64.match(/.{1,64}/g).join('\n')}\n-----END X509 CRL-----\n`;
+}
+/** Create a signed Ed25519 X.509 v3 certificate */
+export async function createCertificate(opts) {
+    const cert = new pkijs.Certificate();
+    cert.version = 2; // v3
+    cert.serialNumber = new asn1js.Integer({ value: opts.serialNumber });
+    const now = new Date();
+    cert.notBefore.value = now;
+    cert.notAfter.value = new Date(now.getTime() + opts.validDays * 24 * 60 * 60 * 1000);
+    // Build subject RDN
+    const buildRDN = (dn, target) => {
+        target.typesAndValues.push(new pkijs.AttributeTypeAndValue({
+            type: '2.5.4.3',
+            value: new asn1js.Utf8String({ value: dn.CN }),
+        }));
+        if (dn.O) {
+            target.typesAndValues.push(new pkijs.AttributeTypeAndValue({
+                type: '2.5.4.10',
+                value: new asn1js.Utf8String({ value: dn.O }),
+            }));
+        }
+    };
+    buildRDN(opts.subject, cert.subject);
+    buildRDN(opts.issuer, cert.issuer);
+    // Import public key into SubjectPublicKeyInfo
+    const spki = await webcrypto.subtle.exportKey('spki', opts.subjectPublicKey);
+    const spkiAsn1 = asn1js.fromBER(spki);
+    cert.subjectPublicKeyInfo.fromSchema(spkiAsn1.result);
+    // Add basic constraints extension (always present)
+    cert.extensions = [];
+    const bc = new pkijs.BasicConstraints({ cA: opts.isCA === true });
+    cert.extensions.push(new pkijs.Extension({
+        extnID: BASIC_CONSTRAINTS_OID,
+        critical: true,
+        extnValue: bc.toSchema().toBER(),
+    }));
+    // Add caller-supplied extensions
+    if (opts.extensions) {
+        cert.extensions.push(...opts.extensions);
+    }
+    await signWithEd25519(cert, opts.issuerKey);
+    return cert;
+}
+/** Create a CRL Distribution Points extension */
+export function makeCRLDistributionPointsExt(url) {
+    const dp = new pkijs.DistributionPoint({
+        distributionPoint: [new pkijs.GeneralName({ type: 6, value: url })],
+    });
+    const cdp = new pkijs.CRLDistributionPoints({ distributionPoints: [dp] });
+    return new pkijs.Extension({
+        extnID: CRL_DISTRIBUTION_POINTS_OID,
+        critical: false,
+        extnValue: cdp.toSchema().toBER(),
+    });
+}
+/** Create an Authority Info Access extension with an OCSP URL */
+export function makeOCSPAIAExt(url) {
+    const desc = new pkijs.AccessDescription({
+        accessMethod: OCSP_ACCESS_METHOD_OID,
+        accessLocation: new pkijs.GeneralName({ type: 6, value: url }),
+    });
+    const aia = new pkijs.InfoAccess({ accessDescriptions: [desc] });
+    return new pkijs.Extension({
+        extnID: AUTHORITY_INFO_ACCESS_OID,
+        critical: false,
+        extnValue: aia.toSchema().toBER(),
+    });
+}
+/** Create an Extended Key Usage extension */
+export function makeExtKeyUsageExt(oids) {
+    const seq = new asn1js.Sequence({
+        value: oids.map((oid) => new asn1js.ObjectIdentifier({ value: oid })),
+    });
+    return new pkijs.Extension({
+        extnID: EXT_KEY_USAGE_OID,
+        critical: false,
+        extnValue: seq.toBER(),
+    });
+}
+export { OCSP_SIGNING_OID, CLIENT_AUTH_OID };
+/** Create a signed X.509v2 CRL */
+export async function createCRL(issuerCert, issuerKey, revokedSerials) {
+    const crl = new pkijs.CertificateRevocationList();
+    crl.version = 1; // CRLv2 = version field value 1
+    // Copy issuer from CA cert subject
+    crl.issuer = issuerCert.subject;
+    const now = new Date();
+    const next = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000);
+    crl.thisUpdate = new pkijs.Time({ type: 0, value: now });
+    crl.nextUpdate = new pkijs.Time({ type: 0, value: next });
+    if (revokedSerials.length > 0) {
+        crl.revokedCertificates = revokedSerials.map((serial) => new pkijs.RevokedCertificate({
+            userCertificate: new asn1js.Integer({ value: serial }),
+            revocationDate: new pkijs.Time({ type: 0, value: now }),
+        }));
+    }
+    await signWithEd25519(crl, issuerKey);
+    return crl;
+}
+/**
+ * Sign a pkijs BasicOCSPResponse with an Ed25519 key.
+ * Must be called after tbsResponseData.responses is populated.
+ */
+export async function signBasicOCSPResponse(basicResponse, privateKey) {
+    const algId = new pkijs.AlgorithmIdentifier({ algorithmId: ED25519_OID });
+    basicResponse.signatureAlgorithm = algId;
+    // Encode the TBS response data
+    const tbsDer = basicResponse.tbsResponseData.toSchema(true).toBER();
+    basicResponse.tbsResponseData.tbsView = new Uint8Array(tbsDer);
+    const sig = await webcrypto.subtle.sign('Ed25519', privateKey, tbsDer);
+    basicResponse.signature = new asn1js.BitString({ valueHex: sig });
+}
+//# sourceMappingURL=certGenUtils.js.map

package/dist/security/certGenUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certGenUtils.js","sourceRoot":"","sources":["../../src/security/certGenUtils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,yBAAyB;AACzB,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,0BAA0B;AAC1B,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAC1C,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAChD,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AACtD,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAEpD,2CAA2C;AAC3C,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAgB,EAAE,CAAQ,CAAC,CAAC;AASnG,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC3C,0FAA0F;IAC1F,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAe,EAAE,IAAI,EAAE;QAC3F,MAAM;QACN,QAAQ;KACR,CAAC,CAAkB,CAAC;IAErB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,gCAAgC,KAAK,+BAA+B,CAAC;IAE3F,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,GAAQ,EAAE,UAAqB;IAC7D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAE/B,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC;IACvC,GAAG,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACvE,GAAG,CAAC,cAAc,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzG,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,QAAQ,CAAC,GAAoC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,6BAA6B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;AACnG,CAAC;AAaD,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAiB;IACxD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK;IAEvB,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAErF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,CAAC,EAA8B,EAAE,MAAwC,EAAE,EAAE;QAC7F,MAAM,CAAC,cAAc,CAAC,IAAI,CACzB,IAAI,KAAK,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;SAC9C,CAAC,CACF,CAAC;QACF,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACV,MAAM,CAAC,cAAc,CAAC,IAAI,CACzB,IAAI,KAAK,CAAC,qBAAqB,CAAC;gBAC/B,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CACF,CAAC;QACH,CAAC;IACF,CAAC,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnC,8CAA8C;IAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEtD,mDAAmD;IACnD,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;IACrB,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CACnB,IAAI,KAAK,CAAC,SAAS,CAAC;QACnB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;KAChC,CAAC,CACF,CAAC;IAEF,iCAAiC;IACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACvD,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC;QACtC,iBAAiB,EAAE,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;KACjC,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC;QACxC,YAAY,EAAE,sBAAsB;QACpC,cAAc,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;KACjC,CAAC,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAChD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE;KACtB,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAE7C,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,UAA6B,EAC7B,SAAoB,EACpB,cAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;IAClD,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,gCAAgC;IAEjD,mCAAmC;IACnC,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;IAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,UAAU,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,UAAU,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAC3C,CAAC,MAAM,EAAE,EAAE,CACV,IAAI,KAAK,CAAC,kBAAkB,CAAC;YAC5B,eAAe,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACtD,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACvD,CAAC,CACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,aAAsC,EACtC,UAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAEzC,+BAA+B;IAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACpE,aAAa,CAAC,eAAe,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACvE,aAAa,CAAC,SAAS,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/security/crl/generate-test-certs.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Generate test certificates for CRL integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+export interface CrlCertificates {
+    /** Path to CA certificate */
+    ca: string;
+    /** Valid client certificate paths */
+    valid: {
+        /** Path to valid client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to valid client private key */
+        key: string;
+    };
+    /** Revoked client certificate paths */
+    revoked: {
+        /** Path to revoked client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to revoked client private key */
+        key: string;
+    };
+    /** Path to Certificate Revocation List */
+    crl: string;
+}
+/**
+ * Generate CRL test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = valid client
+ *   3 = revoked client
+ */
+export declare function generateCrlCertificates(outputDir: string, crlHost: string, crlPort: number): Promise<CrlCertificates>;

package/dist/security/crl/generate-test-certs.js

@@ -0,0 +1,81 @@
+/**
+ * Generate test certificates for CRL integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { generateEd25519KeyPair, createCertificate, createCRL, makeCRLDistributionPointsExt, certToPem, crlToPem, CLIENT_AUTH_OID, makeExtKeyUsageExt, } from "../certGenUtils.js";
+/**
+ * Generate CRL test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = valid client
+ *   3 = revoked client
+ */
+export async function generateCrlCertificates(outputDir, crlHost, crlPort) {
+    const crlUrl = `http://${crlHost}:${crlPort}/test.crl`;
+    // --- CA ---
+    const caKey = await generateEd25519KeyPair();
+    const caKeyPath = path.join(outputDir, 'harper-ca.key');
+    fs.writeFileSync(caKeyPath, caKey.privateKeyPem);
+    const caCert = await createCertificate({
+        serialNumber: 1,
+        subject: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: caKey.publicKey,
+        isCA: true,
+    });
+    const caCertPath = path.join(outputDir, 'harper-ca.crt');
+    fs.writeFileSync(caCertPath, certToPem(caCert));
+    // --- Valid client cert ---
+    const validKey = await generateEd25519KeyPair();
+    const validKeyPath = path.join(outputDir, 'client-valid.key');
+    fs.writeFileSync(validKeyPath, validKey.privateKeyPem);
+    const validCert = await createCertificate({
+        serialNumber: 2,
+        subject: { CN: 'Valid CRL Client', O: 'Harper CRL Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        validDays: 30,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: validKey.publicKey,
+        extensions: [makeCRLDistributionPointsExt(crlUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const validCertPath = path.join(outputDir, 'client-valid.crt');
+    fs.writeFileSync(validCertPath, certToPem(validCert));
+    // Build chain: client cert + CA cert
+    const validChainPath = path.join(outputDir, 'client-valid-chain.crt');
+    fs.writeFileSync(validChainPath, certToPem(validCert) + certToPem(caCert));
+    // --- Revoked client cert ---
+    const revokedKey = await generateEd25519KeyPair();
+    const revokedKeyPath = path.join(outputDir, 'client-revoked.key');
+    fs.writeFileSync(revokedKeyPath, revokedKey.privateKeyPem);
+    const revokedCert = await createCertificate({
+        serialNumber: 3,
+        subject: { CN: 'Revoked CRL Client', O: 'Harper CRL Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        validDays: 30,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: revokedKey.publicKey,
+        extensions: [makeCRLDistributionPointsExt(crlUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const revokedCertPath = path.join(outputDir, 'client-revoked.crt');
+    fs.writeFileSync(revokedCertPath, certToPem(revokedCert));
+    // Build chain: client cert + CA cert
+    const revokedChainPath = path.join(outputDir, 'client-revoked-chain.crt');
+    fs.writeFileSync(revokedChainPath, certToPem(revokedCert) + certToPem(caCert));
+    // --- CRL (serial 3 = revoked) ---
+    const crl = await createCRL(caCert, caKey.privateKey, [3]);
+    const crlPath = path.join(outputDir, 'test.crl');
+    fs.writeFileSync(crlPath, crlToPem(crl));
+    return {
+        ca: caCertPath,
+        valid: { cert: validChainPath, key: validKeyPath },
+        revoked: { cert: revokedChainPath, key: revokedKeyPath },
+        crl: crlPath,
+    };
+}
+//# sourceMappingURL=generate-test-certs.js.map

package/dist/security/crl/generate-test-certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-test-certs.js","sourceRoot":"","sources":["../../../src/security/crl/generate-test-certs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,SAAS,EACT,4BAA4B,EAC5B,SAAS,EACT,QAAQ,EACR,eAAe,EACf,kBAAkB,GAClB,MAAM,oBAAoB,CAAC;AAuB5B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,SAAiB,EACjB,OAAe,EACf,OAAe;IAEf,MAAM,MAAM,GAAG,UAAU,OAAO,IAAI,OAAO,WAAW,CAAC;IAEvD,aAAa;IACb,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACvD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACtD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,IAAI,EAAE,IAAI;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhD,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACzC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACzD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACtD,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;QACpC,UAAU,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC/D,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtD,qCAAqC;IACrC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAClE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QAC3C,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QAC3D,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACtD,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,UAAU,CAAC,SAAS;QACtC,UAAU,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1D,qCAAqC;IACrC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/E,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzC,OAAO;QACN,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE;QAClD,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE;QACxD,GAAG,EAAE,OAAO;KACZ,CAAC;AACH,CAAC"}

package/dist/security/ocsp/generate-test-certs.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Generate test certificates for OCSP integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+import * as pkijs from 'pkijs';
+import { type Ed25519KeyPair } from '../certGenUtils.ts';
+export interface OcspCertificates {
+    /** Path to CA certificate */
+    ca: string;
+    /** Valid client certificate paths */
+    valid: {
+        /** Path to valid client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to valid client private key */
+        key: string;
+    };
+    /** Revoked client certificate paths */
+    revoked: {
+        /** Path to revoked client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to revoked client private key */
+        key: string;
+    };
+    /** OCSP responder certificate paths */
+    ocsp: {
+        /** Path to OCSP responder certificate */
+        cert: string;
+        /** Path to OCSP responder private key */
+        key: string;
+    };
+}
+/** In-memory cert data needed by the OCSP server */
+export interface OcspServerCerts {
+    caCert: pkijs.Certificate;
+    ocspKeyPair: Ed25519KeyPair;
+    ocspCert: pkijs.Certificate;
+    /** Maps decimal serial number string → status */
+    statusMap: Map<string, 'good' | 'revoked'>;
+}
+/**
+ * Generate OCSP test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = OCSP responder
+ *   3 = valid client
+ *   4 = revoked client
+ *
+ * Returns both file paths (for test code) and in-memory objects (for OCSP server).
+ */
+export declare function generateOcspCertificates(outputDir: string, ocspHost: string, ocspPort: number): Promise<{
+    files: OcspCertificates;
+    serverCerts: OcspServerCerts;
+}>;

package/dist/security/ocsp/generate-test-certs.js

@@ -0,0 +1,106 @@
+/**
+ * Generate test certificates for OCSP integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import * as pkijs from 'pkijs';
+import { generateEd25519KeyPair, createCertificate, makeOCSPAIAExt, makeExtKeyUsageExt, certToPem, OCSP_SIGNING_OID, CLIENT_AUTH_OID, } from "../certGenUtils.js";
+/**
+ * Generate OCSP test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = OCSP responder
+ *   3 = valid client
+ *   4 = revoked client
+ *
+ * Returns both file paths (for test code) and in-memory objects (for OCSP server).
+ */
+export async function generateOcspCertificates(outputDir, ocspHost, ocspPort) {
+    const ocspUrl = `http://${ocspHost}:${ocspPort}`;
+    // --- CA ---
+    const caKey = await generateEd25519KeyPair();
+    const caKeyPath = path.join(outputDir, 'harper-ca.key');
+    fs.writeFileSync(caKeyPath, caKey.privateKeyPem);
+    const caCert = await createCertificate({
+        serialNumber: 1,
+        subject: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: caKey.publicKey,
+        isCA: true,
+    });
+    const caCertPath = path.join(outputDir, 'harper-ca.crt');
+    fs.writeFileSync(caCertPath, certToPem(caCert));
+    // --- OCSP responder cert ---
+    const ocspKey = await generateEd25519KeyPair();
+    const ocspKeyPath = path.join(outputDir, 'ocsp.key');
+    fs.writeFileSync(ocspKeyPath, ocspKey.privateKeyPem);
+    const ocspCert = await createCertificate({
+        serialNumber: 2,
+        subject: { CN: 'OCSP Responder', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: ocspKey.publicKey,
+        extensions: [makeExtKeyUsageExt([OCSP_SIGNING_OID])],
+    });
+    const ocspCertPath = path.join(outputDir, 'ocsp.crt');
+    fs.writeFileSync(ocspCertPath, certToPem(ocspCert));
+    // --- Valid client cert ---
+    const validKey = await generateEd25519KeyPair();
+    const validKeyPath = path.join(outputDir, 'client-valid.key');
+    fs.writeFileSync(validKeyPath, validKey.privateKeyPem);
+    const validCert = await createCertificate({
+        serialNumber: 3,
+        subject: { CN: 'Valid Client', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: validKey.publicKey,
+        extensions: [makeOCSPAIAExt(ocspUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const validCertPath = path.join(outputDir, 'client-valid.crt');
+    fs.writeFileSync(validCertPath, certToPem(validCert));
+    const validChainPath = path.join(outputDir, 'client-valid-chain.crt');
+    fs.writeFileSync(validChainPath, certToPem(validCert) + certToPem(caCert));
+    // --- Revoked client cert ---
+    const revokedKey = await generateEd25519KeyPair();
+    const revokedKeyPath = path.join(outputDir, 'client-revoked.key');
+    fs.writeFileSync(revokedKeyPath, revokedKey.privateKeyPem);
+    const revokedCert = await createCertificate({
+        serialNumber: 4,
+        subject: { CN: 'Revoked Client', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: revokedKey.publicKey,
+        extensions: [makeOCSPAIAExt(ocspUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const revokedCertPath = path.join(outputDir, 'client-revoked.crt');
+    fs.writeFileSync(revokedCertPath, certToPem(revokedCert));
+    const revokedChainPath = path.join(outputDir, 'client-revoked-chain.crt');
+    fs.writeFileSync(revokedChainPath, certToPem(revokedCert) + certToPem(caCert));
+    const statusMap = new Map([
+        ['3', 'good'], // valid client serial
+        ['4', 'revoked'], // revoked client serial
+    ]);
+    return {
+        files: {
+            ca: caCertPath,
+            valid: { cert: validChainPath, key: validKeyPath },
+            revoked: { cert: revokedChainPath, key: revokedKeyPath },
+            ocsp: { cert: ocspCertPath, key: ocspKeyPath },
+        },
+        serverCerts: {
+            caCert,
+            ocspKeyPair: ocspKey,
+            ocspCert,
+            statusMap,
+        },
+    };
+}
+//# sourceMappingURL=generate-test-certs.js.map

package/dist/security/ocsp/generate-test-certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-test-certs.js","sourceRoot":"","sources":["../../../src/security/ocsp/generate-test-certs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,eAAe,GAEf,MAAM,oBAAoB,CAAC;AAqC5B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,SAAiB,EACjB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,OAAO,GAAG,UAAU,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAEjD,aAAa;IACb,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACxD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,IAAI,EAAE,IAAI;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhD,8BAA8B;IAC9B,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACxC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACxD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEpD,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACzC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACtD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;QACpC,UAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC/D,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAClE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QAC3C,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACxD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,UAAU,CAAC,SAAS;QACtC,UAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAA6B;QACrD,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,sBAAsB;QACrC,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,wBAAwB;KAC1C,CAAC,CAAC;IAEH,OAAO;QACN,KAAK,EAAE;YACN,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE;YAClD,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE;SAC9C;QACD,WAAW,EAAE;YACZ,MAAM;YACN,WAAW,EAAE,OAAO;YACpB,QAAQ;YACR,SAAS;SACT;KACD,CAAC;AACH,CAAC"}

package/dist/security/ocspServer.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Node.js OCSP (Online Certificate Status Protocol) responder
+ *
+ * A pure-Node.js replacement for `openssl ocsp`. Handles OCSP requests using pkijs
+ * for ASN.1 encoding and certGenUtils for Ed25519 signatures.
+ */
+import { type Server } from 'node:http';
+import type { OcspServerCerts } from './ocsp/generate-test-certs.ts';
+/**
+ * Start a Node.js HTTP OCSP responder.
+ *
+ * @param port - Port to listen on
+ * @param certs - In-memory certificate and key data for the responder
+ * @returns Promise resolving to the HTTP server (already listening)
+ */
+export declare function startOcspServer(port: number, certs: OcspServerCerts): Promise<Server>;
+/** Stop a running OCSP server */
+export declare function stopOcspServer(server: Server): Promise<void>;