@harperfast/integration-testing 0.1.0 → 0.3.0-0

package/dist/src/security/certGenUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certGenUtils.js","sourceRoot":"","sources":["../../../src/security/certGenUtils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,yBAAyB;AACzB,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,0BAA0B;AAC1B,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAC1C,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAChD,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AACtD,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAEpD,2CAA2C;AAC3C,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAgB,EAAE,CAAC,CAAC,CAAC;AAS5F,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC3C,0FAA0F;IAC1F,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAe,EAAE,IAAI,EAAE;QAC3F,MAAM;QACN,QAAQ;KACR,CAAC,CAAkB,CAAC;IAErB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,gCAAgC,KAAK,+BAA+B,CAAC;IAE3F,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,GAAQ,EAAE,UAAqB;IAC7D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAE/B,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC;IACvC,GAAG,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACvE,GAAG,CAAC,cAAc,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzG,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,QAAQ,CAAC,GAAoC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,6BAA6B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;AACnG,CAAC;AAaD,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAiB;IACxD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK;IAEvB,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,GAAG,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAErF,oBAAoB;IACpB,MAAM,QAAQ,GAAG,CAAC,EAA8B,EAAE,MAAwC,EAAE,EAAE;QAC7F,MAAM,CAAC,cAAc,CAAC,IAAI,CACzB,IAAI,KAAK,CAAC,qBAAqB,CAAC;YAC/B,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;SAC9C,CAAC,CACF,CAAC;QACF,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACV,MAAM,CAAC,cAAc,CAAC,IAAI,CACzB,IAAI,KAAK,CAAC,qBAAqB,CAAC;gBAC/B,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CACF,CAAC;QACH,CAAC;IACF,CAAC,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnC,8CAA8C;IAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEtD,mDAAmD;IACnD,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;IACrB,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CACnB,IAAI,KAAK,CAAC,SAAS,CAAC;QACnB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;KAChC,CAAC,CACF,CAAC;IAEF,iCAAiC;IACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACvD,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC;QACtC,iBAAiB,EAAE,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;KACjC,CAAC,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC;QACxC,YAAY,EAAE,sBAAsB;QACpC,cAAc,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;KACjC,CAAC,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAChD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE;KACtB,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAE7C,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,UAA6B,EAC7B,SAAoB,EACpB,cAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;IAClD,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,gCAAgC;IAEjD,mCAAmC;IACnC,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;IAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,UAAU,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,UAAU,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAC3C,CAAC,MAAM,EAAE,EAAE,CACV,IAAI,KAAK,CAAC,kBAAkB,CAAC;YAC5B,eAAe,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACtD,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACvD,CAAC,CACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,aAAsC,EACtC,UAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAEzC,+BAA+B;IAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACpE,aAAa,CAAC,eAAe,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACvE,aAAa,CAAC,SAAS,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/src/security/crl/generate-test-certs.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Generate test certificates for CRL integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+export interface CrlCertificates {
+    /** Path to CA certificate */
+    ca: string;
+    /** Valid client certificate paths */
+    valid: {
+        /** Path to valid client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to valid client private key */
+        key: string;
+    };
+    /** Revoked client certificate paths */
+    revoked: {
+        /** Path to revoked client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to revoked client private key */
+        key: string;
+    };
+    /** Path to Certificate Revocation List */
+    crl: string;
+}
+/**
+ * Generate CRL test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = valid client
+ *   3 = revoked client
+ */
+export declare function generateCrlCertificates(outputDir: string, crlHost: string, crlPort: number): Promise<CrlCertificates>;

package/dist/src/security/crl/generate-test-certs.js

@@ -0,0 +1,81 @@
+/**
+ * Generate test certificates for CRL integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { generateEd25519KeyPair, createCertificate, createCRL, makeCRLDistributionPointsExt, certToPem, crlToPem, CLIENT_AUTH_OID, makeExtKeyUsageExt, } from "../certGenUtils.js";
+/**
+ * Generate CRL test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = valid client
+ *   3 = revoked client
+ */
+export async function generateCrlCertificates(outputDir, crlHost, crlPort) {
+    const crlUrl = `http://${crlHost}:${crlPort}/test.crl`;
+    // --- CA ---
+    const caKey = await generateEd25519KeyPair();
+    const caKeyPath = path.join(outputDir, 'harper-ca.key');
+    fs.writeFileSync(caKeyPath, caKey.privateKeyPem);
+    const caCert = await createCertificate({
+        serialNumber: 1,
+        subject: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: caKey.publicKey,
+        isCA: true,
+    });
+    const caCertPath = path.join(outputDir, 'harper-ca.crt');
+    fs.writeFileSync(caCertPath, certToPem(caCert));
+    // --- Valid client cert ---
+    const validKey = await generateEd25519KeyPair();
+    const validKeyPath = path.join(outputDir, 'client-valid.key');
+    fs.writeFileSync(validKeyPath, validKey.privateKeyPem);
+    const validCert = await createCertificate({
+        serialNumber: 2,
+        subject: { CN: 'Valid CRL Client', O: 'Harper CRL Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        validDays: 30,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: validKey.publicKey,
+        extensions: [makeCRLDistributionPointsExt(crlUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const validCertPath = path.join(outputDir, 'client-valid.crt');
+    fs.writeFileSync(validCertPath, certToPem(validCert));
+    // Build chain: client cert + CA cert
+    const validChainPath = path.join(outputDir, 'client-valid-chain.crt');
+    fs.writeFileSync(validChainPath, certToPem(validCert) + certToPem(caCert));
+    // --- Revoked client cert ---
+    const revokedKey = await generateEd25519KeyPair();
+    const revokedKeyPath = path.join(outputDir, 'client-revoked.key');
+    fs.writeFileSync(revokedKeyPath, revokedKey.privateKeyPem);
+    const revokedCert = await createCertificate({
+        serialNumber: 3,
+        subject: { CN: 'Revoked CRL Client', O: 'Harper CRL Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper CRL Test' },
+        validDays: 30,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: revokedKey.publicKey,
+        extensions: [makeCRLDistributionPointsExt(crlUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const revokedCertPath = path.join(outputDir, 'client-revoked.crt');
+    fs.writeFileSync(revokedCertPath, certToPem(revokedCert));
+    // Build chain: client cert + CA cert
+    const revokedChainPath = path.join(outputDir, 'client-revoked-chain.crt');
+    fs.writeFileSync(revokedChainPath, certToPem(revokedCert) + certToPem(caCert));
+    // --- CRL (serial 3 = revoked) ---
+    const crl = await createCRL(caCert, caKey.privateKey, [3]);
+    const crlPath = path.join(outputDir, 'test.crl');
+    fs.writeFileSync(crlPath, crlToPem(crl));
+    return {
+        ca: caCertPath,
+        valid: { cert: validChainPath, key: validKeyPath },
+        revoked: { cert: revokedChainPath, key: revokedKeyPath },
+        crl: crlPath,
+    };
+}
+//# sourceMappingURL=generate-test-certs.js.map

package/dist/src/security/crl/generate-test-certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-test-certs.js","sourceRoot":"","sources":["../../../../src/security/crl/generate-test-certs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,SAAS,EACT,4BAA4B,EAC5B,SAAS,EACT,QAAQ,EACR,eAAe,EACf,kBAAkB,GAClB,MAAM,oBAAoB,CAAC;AAuB5B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,SAAiB,EACjB,OAAe,EACf,OAAe;IAEf,MAAM,MAAM,GAAG,UAAU,OAAO,IAAI,OAAO,WAAW,CAAC;IAEvD,aAAa;IACb,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACvD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACtD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,IAAI,EAAE,IAAI;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhD,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACzC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACzD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACtD,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;QACpC,UAAU,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC/D,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtD,qCAAqC;IACrC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAClE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QAC3C,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QAC3D,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE;QACtD,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,UAAU,CAAC,SAAS;QACtC,UAAU,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1D,qCAAqC;IACrC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/E,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzC,OAAO;QACN,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE;QAClD,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE;QACxD,GAAG,EAAE,OAAO;KACZ,CAAC;AACH,CAAC"}

package/dist/src/security/ocsp/generate-test-certs.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Generate test certificates for OCSP integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+import * as pkijs from 'pkijs';
+import { type Ed25519KeyPair } from '../certGenUtils.ts';
+export interface OcspCertificates {
+    /** Path to CA certificate */
+    ca: string;
+    /** Valid client certificate paths */
+    valid: {
+        /** Path to valid client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to valid client private key */
+        key: string;
+    };
+    /** Revoked client certificate paths */
+    revoked: {
+        /** Path to revoked client certificate chain (cert + CA) */
+        cert: string;
+        /** Path to revoked client private key */
+        key: string;
+    };
+    /** OCSP responder certificate paths */
+    ocsp: {
+        /** Path to OCSP responder certificate */
+        cert: string;
+        /** Path to OCSP responder private key */
+        key: string;
+    };
+}
+/** In-memory cert data needed by the OCSP server */
+export interface OcspServerCerts {
+    caCert: pkijs.Certificate;
+    ocspKeyPair: Ed25519KeyPair;
+    ocspCert: pkijs.Certificate;
+    /** Maps decimal serial number string → status */
+    statusMap: Map<string, 'good' | 'revoked'>;
+}
+/**
+ * Generate OCSP test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = OCSP responder
+ *   3 = valid client
+ *   4 = revoked client
+ *
+ * Returns both file paths (for test code) and in-memory objects (for OCSP server).
+ */
+export declare function generateOcspCertificates(outputDir: string, ocspHost: string, ocspPort: number): Promise<{
+    files: OcspCertificates;
+    serverCerts: OcspServerCerts;
+}>;

package/dist/src/security/ocsp/generate-test-certs.js

@@ -0,0 +1,106 @@
+/**
+ * Generate test certificates for OCSP integration testing
+ *
+ * Uses pure Node.js (webcrypto + pkijs) — no openssl CLI dependency.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import * as pkijs from 'pkijs';
+import { generateEd25519KeyPair, createCertificate, makeOCSPAIAExt, makeExtKeyUsageExt, certToPem, OCSP_SIGNING_OID, CLIENT_AUTH_OID, } from "../certGenUtils.js";
+/**
+ * Generate OCSP test certificates using pure Node.js (no openssl CLI).
+ *
+ * Serial numbers:
+ *   1 = CA
+ *   2 = OCSP responder
+ *   3 = valid client
+ *   4 = revoked client
+ *
+ * Returns both file paths (for test code) and in-memory objects (for OCSP server).
+ */
+export async function generateOcspCertificates(outputDir, ocspHost, ocspPort) {
+    const ocspUrl = `http://${ocspHost}:${ocspPort}`;
+    // --- CA ---
+    const caKey = await generateEd25519KeyPair();
+    const caKeyPath = path.join(outputDir, 'harper-ca.key');
+    fs.writeFileSync(caKeyPath, caKey.privateKeyPem);
+    const caCert = await createCertificate({
+        serialNumber: 1,
+        subject: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: caKey.publicKey,
+        isCA: true,
+    });
+    const caCertPath = path.join(outputDir, 'harper-ca.crt');
+    fs.writeFileSync(caCertPath, certToPem(caCert));
+    // --- OCSP responder cert ---
+    const ocspKey = await generateEd25519KeyPair();
+    const ocspKeyPath = path.join(outputDir, 'ocsp.key');
+    fs.writeFileSync(ocspKeyPath, ocspKey.privateKeyPem);
+    const ocspCert = await createCertificate({
+        serialNumber: 2,
+        subject: { CN: 'OCSP Responder', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: ocspKey.publicKey,
+        extensions: [makeExtKeyUsageExt([OCSP_SIGNING_OID])],
+    });
+    const ocspCertPath = path.join(outputDir, 'ocsp.crt');
+    fs.writeFileSync(ocspCertPath, certToPem(ocspCert));
+    // --- Valid client cert ---
+    const validKey = await generateEd25519KeyPair();
+    const validKeyPath = path.join(outputDir, 'client-valid.key');
+    fs.writeFileSync(validKeyPath, validKey.privateKeyPem);
+    const validCert = await createCertificate({
+        serialNumber: 3,
+        subject: { CN: 'Valid Client', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: validKey.publicKey,
+        extensions: [makeOCSPAIAExt(ocspUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const validCertPath = path.join(outputDir, 'client-valid.crt');
+    fs.writeFileSync(validCertPath, certToPem(validCert));
+    const validChainPath = path.join(outputDir, 'client-valid-chain.crt');
+    fs.writeFileSync(validChainPath, certToPem(validCert) + certToPem(caCert));
+    // --- Revoked client cert ---
+    const revokedKey = await generateEd25519KeyPair();
+    const revokedKeyPath = path.join(outputDir, 'client-revoked.key');
+    fs.writeFileSync(revokedKeyPath, revokedKey.privateKeyPem);
+    const revokedCert = await createCertificate({
+        serialNumber: 4,
+        subject: { CN: 'Revoked Client', O: 'Harper OCSP Test' },
+        issuer: { CN: 'Harper Test CA', O: 'Harper OCSP Test' },
+        validDays: 365,
+        issuerKey: caKey.privateKey,
+        subjectPublicKey: revokedKey.publicKey,
+        extensions: [makeOCSPAIAExt(ocspUrl), makeExtKeyUsageExt([CLIENT_AUTH_OID])],
+    });
+    const revokedCertPath = path.join(outputDir, 'client-revoked.crt');
+    fs.writeFileSync(revokedCertPath, certToPem(revokedCert));
+    const revokedChainPath = path.join(outputDir, 'client-revoked-chain.crt');
+    fs.writeFileSync(revokedChainPath, certToPem(revokedCert) + certToPem(caCert));
+    const statusMap = new Map([
+        ['3', 'good'], // valid client serial
+        ['4', 'revoked'], // revoked client serial
+    ]);
+    return {
+        files: {
+            ca: caCertPath,
+            valid: { cert: validChainPath, key: validKeyPath },
+            revoked: { cert: revokedChainPath, key: revokedKeyPath },
+            ocsp: { cert: ocspCertPath, key: ocspKeyPath },
+        },
+        serverCerts: {
+            caCert,
+            ocspKeyPair: ocspKey,
+            ocspCert,
+            statusMap,
+        },
+    };
+}
+//# sourceMappingURL=generate-test-certs.js.map

package/dist/src/security/ocsp/generate-test-certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-test-certs.js","sourceRoot":"","sources":["../../../../src/security/ocsp/generate-test-certs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,eAAe,GAEf,MAAM,oBAAoB,CAAC;AAqC5B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,SAAiB,EACjB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,OAAO,GAAG,UAAU,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAEjD,aAAa;IACb,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACxD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,IAAI,EAAE,IAAI;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhD,8BAA8B;IAC9B,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACxC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACxD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEpD,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACzC,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACtD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;QACpC,UAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC/D,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAClE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QAC3C,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACxD,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE;QACvD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,gBAAgB,EAAE,UAAU,CAAC,SAAS;QACtC,UAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAA6B;QACrD,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,sBAAsB;QACrC,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,wBAAwB;KAC1C,CAAC,CAAC;IAEH,OAAO;QACN,KAAK,EAAE;YACN,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE;YAClD,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE;SAC9C;QACD,WAAW,EAAE;YACZ,MAAM;YACN,WAAW,EAAE,OAAO;YACpB,QAAQ;YACR,SAAS;SACT;KACD,CAAC;AACH,CAAC"}

package/dist/src/security/ocspServer.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Node.js OCSP (Online Certificate Status Protocol) responder
+ *
+ * A pure-Node.js replacement for `openssl ocsp`. Handles OCSP requests using pkijs
+ * for ASN.1 encoding and certGenUtils for Ed25519 signatures.
+ */
+import { type Server } from 'node:http';
+import type { OcspServerCerts } from './ocsp/generate-test-certs.ts';
+/**
+ * Start a Node.js HTTP OCSP responder.
+ *
+ * @param port - Port to listen on
+ * @param certs - In-memory certificate and key data for the responder
+ * @returns Promise resolving to the HTTP server (already listening)
+ */
+export declare function startOcspServer(port: number, certs: OcspServerCerts): Promise<Server>;
+/** Stop a running OCSP server */
+export declare function stopOcspServer(server: Server): Promise<void>;

package/dist/src/security/ocspServer.js

@@ -0,0 +1,132 @@
+/**
+ * Node.js OCSP (Online Certificate Status Protocol) responder
+ *
+ * A pure-Node.js replacement for `openssl ocsp`. Handles OCSP requests using pkijs
+ * for ASN.1 encoding and certGenUtils for Ed25519 signatures.
+ */
+import { createServer } from 'node:http';
+import * as pkijs from 'pkijs';
+import * as asn1js from 'asn1js';
+import { signBasicOCSPResponse } from "./certGenUtils.js";
+const OCSP_BASIC_RESPONSE_OID = '1.3.6.1.5.5.7.48.1.1';
+/**
+ * Build a DER-encoded OCSPResponse for the given DER-encoded OCSPRequest.
+ */
+async function buildOcspResponse(requestBody, certs) {
+    // Parse incoming OCSP request
+    const asn1 = asn1js.fromBER(requestBody);
+    if (asn1.offset === -1) {
+        throw new Error('Failed to parse OCSP request');
+    }
+    const ocspRequest = new pkijs.OCSPRequest({ schema: asn1.result });
+    const now = new Date();
+    const nextUpdate = new Date(now.getTime() + 60 * 60 * 1000); // 1 hour
+    // Build SingleResponse for each requested certificate
+    const singleResponses = ocspRequest.tbsRequest.requestList.map((req) => {
+        // Extract the decimal serial number to look up status
+        const serialDec = req.reqCert.serialNumber.valueBlock.valueDec;
+        const status = certs.statusMap.get(String(serialDec));
+        // certStatus ASN.1 encoding:
+        //   good    [0] IMPLICIT NULL
+        //   revoked [1] IMPLICIT RevokedInfo (SEQUENCE with revocation time)
+        //   unknown [2] IMPLICIT UnknownInfo
+        let certStatus;
+        if (status === 'good') {
+            certStatus = new asn1js.Primitive({
+                idBlock: { tagClass: 3, tagNumber: 0 },
+                valueHex: new ArrayBuffer(0),
+            });
+        }
+        else if (status === 'revoked') {
+            certStatus = new asn1js.Constructed({
+                idBlock: { tagClass: 3, tagNumber: 1 },
+                value: [new asn1js.GeneralizedTime({ valueDate: now })],
+            });
+        }
+        else {
+            // unknown
+            certStatus = new asn1js.Primitive({
+                idBlock: { tagClass: 3, tagNumber: 2 },
+                valueHex: new ArrayBuffer(0),
+            });
+        }
+        return new pkijs.SingleResponse({
+            certID: req.reqCert, // echo back the same certID
+            certStatus,
+            thisUpdate: now,
+            nextUpdate,
+        });
+    });
+    // Use the OCSP responder cert's subject as the responderID (byName, tagNumber=1)
+    const responseData = new pkijs.ResponseData({
+        responderID: certs.ocspCert.subject,
+        producedAt: now,
+        responses: singleResponses,
+    });
+    // Create BasicOCSPResponse and sign it
+    const basicResponse = new pkijs.BasicOCSPResponse({
+        tbsResponseData: responseData,
+        certs: [certs.ocspCert, certs.caCert],
+    });
+    await signBasicOCSPResponse(basicResponse, certs.ocspKeyPair.privateKey);
+    // Encode BasicOCSPResponse to DER, wrap in OCSPResponse
+    const basicDer = basicResponse.toSchema().toBER();
+    const ocspResponse = new pkijs.OCSPResponse({
+        responseStatus: new asn1js.Enumerated({ value: 0 }), // successful
+        responseBytes: new pkijs.ResponseBytes({
+            responseType: OCSP_BASIC_RESPONSE_OID,
+            response: new asn1js.OctetString({ valueHex: basicDer }),
+        }),
+    });
+    return Buffer.from(ocspResponse.toSchema().toBER());
+}
+/**
+ * Start a Node.js HTTP OCSP responder.
+ *
+ * @param port - Port to listen on
+ * @param certs - In-memory certificate and key data for the responder
+ * @returns Promise resolving to the HTTP server (already listening)
+ */
+export async function startOcspServer(port, certs) {
+    return new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            if (req.method !== 'POST' && req.method !== 'GET') {
+                res.writeHead(405);
+                res.end();
+                return;
+            }
+            const chunks = [];
+            req.on('data', (chunk) => chunks.push(chunk));
+            req.on('end', async () => {
+                try {
+                    const body = Buffer.concat(chunks);
+                    const response = await buildOcspResponse(body, certs);
+                    res.writeHead(200, { 'Content-Type': 'application/ocsp-response' });
+                    res.end(response);
+                }
+                catch (err) {
+                    console.error('OCSP server error:', err);
+                    // Return an "internalError" response
+                    const errResponse = new pkijs.OCSPResponse({
+                        responseStatus: new asn1js.Enumerated({ value: 2 }), // internalError
+                    });
+                    const errDer = Buffer.from(errResponse.toSchema().toBER());
+                    res.writeHead(200, { 'Content-Type': 'application/ocsp-response' });
+                    res.end(errDer);
+                }
+            });
+            req.on('error', (err) => {
+                console.error('OCSP request error:', err);
+                res.writeHead(500);
+                res.end();
+            });
+        });
+        server.on('error', reject);
+        server.listen(port, '127.0.0.1', () => resolve(server));
+    });
+}
+/** Stop a running OCSP server */
+export async function stopOcspServer(server) {
+    return new Promise((resolve) => server.close(() => resolve()));
+}
+//# sourceMappingURL=ocspServer.js.map

package/dist/src/security/ocspServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ocspServer.js","sourceRoot":"","sources":["../../../src/security/ocspServer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAEvD;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,KAAsB;IAC3E,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;IAEtE,sDAAsD;IACtD,MAAM,eAAe,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtE,sDAAsD;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEtD,6BAA6B;QAC7B,8BAA8B;QAC9B,qEAAqE;QACrE,qCAAqC;QACrC,IAAI,UAAiE,CAAC;QACtE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,UAAU,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC;gBACjC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,QAAQ,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC;aACrB,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,UAAU,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC;gBACnC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,KAAK,EAAE,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;aAChD,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACP,UAAU;YACV,UAAU,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC;gBACjC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,QAAQ,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC;aACrB,CAAC,CAAC;QACX,CAAC;QAED,OAAO,IAAI,KAAK,CAAC,cAAc,CAAC;YAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,4BAA4B;YACjD,UAAU;YACV,UAAU,EAAE,GAAG;YACf,UAAU;SACV,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,YAAY,CAAC;QAC3C,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QACnC,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,eAAe;KAC1B,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC;QACjD,eAAe,EAAE,YAAY;QAC7B,KAAK,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAEzE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC;IAElD,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,YAAY,CAAC;QAC3C,cAAc,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa;QAClE,aAAa,EAAE,IAAI,KAAK,CAAC,aAAa,CAAC;YACtC,YAAY,EAAE,uBAAuB;YACrC,QAAQ,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAsB;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACR,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;gBACxB,IAAI,CAAC;oBACJ,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACnC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;oBACzC,qCAAqC;oBACrC,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,YAAY,CAAC;wBAC1C,cAAc,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,gBAAgB;qBACrE,CAAC,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;gBAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/src/securityServices.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Security Services Utilities for Integration Tests
+ *
+ * This module provides utilities for managing OCSP responders, CRL servers,
+ * and certificate generation for security-related integration tests.
+ *
+ * All certificate generation and OCSP responding is done in pure Node.js
+ * using webcrypto + pkijs — no openssl CLI dependency.
+ */
+import { type Server } from 'node:http';
+import type { OcspCertificates } from './security/ocsp/generate-test-certs.ts';
+import type { CrlCertificates } from './security/crl/generate-test-certs.ts';
+export interface OcspResponderContext {
+    server: Server;
+    port: number;
+    certsPath: string;
+    certs: OcspCertificates;
+}
+export interface CrlServerContext {
+    server: Server;
+    port: number;
+    certsPath: string;
+    certs: CrlCertificates;
+}
+/**
+ * Stop an OCSP responder server
+ */
+export declare function stopOcspResponder(ctx: OcspResponderContext): Promise<void>;
+/**
+ * Start a Node.js HTTP server to serve CRL files
+ */
+export declare function startCrlServer(certsPath: string, port: number, certs: CrlCertificates): Promise<CrlServerContext>;
+/**
+ * Stop a CRL server
+ */
+export declare function stopCrlServer(ctx: CrlServerContext): Promise<void>;
+export { generateOcspCertificates, type OcspCertificates } from './security/ocsp/generate-test-certs.ts';
+export { generateCrlCertificates, type CrlCertificates } from './security/crl/generate-test-certs.ts';
+/**
+ * Setup CRL server with automatic port allocation and retry on conflict
+ */
+export declare function setupCrlServerWithCerts(certsPath: string, hostname?: string, maxRetries?: number): Promise<CrlServerContext>;
+/**
+ * Setup OCSP responder with automatic port allocation and retry on conflict
+ *
+ * Generates certificates with OCSP URL embedded, then starts the Node.js
+ * OCSP responder on the same port.
+ */
+export declare function setupOcspResponderWithCerts(certsPath: string, hostname?: string, maxRetries?: number): Promise<OcspResponderContext>;

package/dist/src/securityServices.js

@@ -0,0 +1,120 @@
+/**
+ * Security Services Utilities for Integration Tests
+ *
+ * This module provides utilities for managing OCSP responders, CRL servers,
+ * and certificate generation for security-related integration tests.
+ *
+ * All certificate generation and OCSP responding is done in pure Node.js
+ * using webcrypto + pkijs — no openssl CLI dependency.
+ */
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { startOcspServer, stopOcspServer } from "./security/ocspServer.js";
+/**
+ * Stop an OCSP responder server
+ */
+export async function stopOcspResponder(ctx) {
+    return stopOcspServer(ctx.server);
+}
+/**
+ * Start a Node.js HTTP server to serve CRL files
+ */
+export async function startCrlServer(certsPath, port, certs) {
+    return new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            if (req.url === '/test.crl') {
+                try {
+                    const crl = readFileSync(join(certsPath, 'test.crl'));
+                    res.writeHead(200, {
+                        'Content-Type': 'application/pkix-crl',
+                        'Cache-Control': 'no-cache',
+                    });
+                    res.end(crl);
+                }
+                catch {
+                    res.writeHead(500);
+                    res.end('Internal Server Error');
+                }
+            }
+            else if (req.url === '/health') {
+                res.writeHead(200, { 'Content-Type': 'text/plain' });
+                res.end('OK');
+            }
+            else {
+                res.writeHead(404);
+                res.end('Not Found');
+            }
+        });
+        server.on('error', reject);
+        server.listen(port, () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                reject(new Error('Server did not bind to a network port'));
+                return;
+            }
+            resolve({
+                server,
+                port: address.port,
+                certsPath,
+                certs,
+            });
+        });
+    });
+}
+/**
+ * Stop a CRL server
+ */
+export async function stopCrlServer(ctx) {
+    return new Promise((resolve) => {
+        ctx.server.close(() => resolve());
+    });
+}
+// Re-export certificate generation functions and types
+export { generateOcspCertificates } from "./security/ocsp/generate-test-certs.js";
+export { generateCrlCertificates } from "./security/crl/generate-test-certs.js";
+/**
+ * Setup CRL server with automatic port allocation and retry on conflict
+ */
+export async function setupCrlServerWithCerts(certsPath, hostname = '127.0.0.1', maxRetries = 5) {
+    for (let attempt = 0; attempt < maxRetries; attempt++) {
+        const port = 50000 + Math.floor(Math.random() * 10000);
+        try {
+            const { generateCrlCertificates } = await import("./security/crl/generate-test-certs.js");
+            const certs = await generateCrlCertificates(certsPath, hostname, port);
+            return startCrlServer(certsPath, port, certs);
+        }
+        catch (error) {
+            if (error.code === 'EADDRINUSE' && attempt < maxRetries - 1) {
+                continue;
+            }
+            throw new Error(`Failed to setup CRL server after ${attempt + 1} attempts: ${error.message}`);
+        }
+    }
+    throw new Error(`Failed to setup CRL server after ${maxRetries} attempts`);
+}
+/**
+ * Setup OCSP responder with automatic port allocation and retry on conflict
+ *
+ * Generates certificates with OCSP URL embedded, then starts the Node.js
+ * OCSP responder on the same port.
+ */
+export async function setupOcspResponderWithCerts(certsPath, hostname = '127.0.0.1', maxRetries = 5) {
+    for (let attempt = 0; attempt < maxRetries; attempt++) {
+        const port = 50000 + Math.floor(Math.random() * 10000);
+        try {
+            const { generateOcspCertificates } = await import("./security/ocsp/generate-test-certs.js");
+            const { files, serverCerts } = await generateOcspCertificates(certsPath, hostname, port);
+            const server = await startOcspServer(port, serverCerts);
+            return { server, port, certsPath, certs: files };
+        }
+        catch (error) {
+            if (error.code === 'EADDRINUSE' && attempt < maxRetries - 1) {
+                continue;
+            }
+            throw new Error(`Failed to setup OCSP responder after ${attempt + 1} attempts: ${error.message}`);
+        }
+    }
+    throw new Error(`Failed to setup OCSP responder after ${maxRetries} attempts`);
+}
+//# sourceMappingURL=securityServices.js.map

package/dist/src/securityServices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityServices.js","sourceRoot":"","sources":["../../src/securityServices.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAgB3E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAyB;IAChE,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,SAAiB,EACjB,IAAY,EACZ,KAAsB;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBAClB,cAAc,EAAE,sBAAsB;wBACtC,eAAe,EAAE,UAAU;qBAC3B,CAAC,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACR,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;gBAClC,CAAC;YACF,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtB,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACxB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YACD,OAAO,CAAC;gBACP,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS;gBACT,KAAK;aACL,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAqB;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,OAAO,EAAE,wBAAwB,EAAyB,MAAM,wCAAwC,CAAC;AACzG,OAAO,EAAE,uBAAuB,EAAwB,MAAM,uCAAuC,CAAC;AAEtG;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,SAAiB,EACjB,WAAmB,WAAW,EAC9B,aAAqB,CAAC;IAEtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC;YACJ,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,SAAiB,EACjB,WAAmB,WAAW,EAC9B,aAAqB,CAAC;IAEtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC;YACJ,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAC5F,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEzF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAExD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,GAAG,CAAC,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,WAAW,CAAC,CAAC;AAChF,CAAC"}