@naylence/advanced-security 0.3.0

package/dist/cjs/naylence/fame/security/cert/internal-ca-service.js

@@ -0,0 +1,793 @@
+"use strict";
+/**
+ * Certificate Authority signing service for node certificates.
+ *
+ * Provides in-process API for issuing certificates with node physical
+ * and host-like logical address information using SPIFFE-compliant identities.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CASigningService = exports.NODE_ID_OID = exports.LOGICALS_OID = exports.SID_OID = void 0;
+exports.createTestCA = createTestCA;
+exports.extractSpiffeIdFromCert = extractSpiffeIdFromCert;
+exports.extractSidFromCert = extractSidFromCert;
+exports.extractNodeIdFromCert = extractNodeIdFromCert;
+exports.extractLogicalHostsFromCert = extractLogicalHostsFromCert;
+exports.extractSidFromSpiffeId = extractSidFromSpiffeId;
+exports.verifyCertSidIntegrity = verifyCertSidIntegrity;
+const asn1_schema_1 = require("@peculiar/asn1-schema");
+const asn1_x509_1 = require("@peculiar/asn1-x509");
+const asn1_csr_1 = require("@peculiar/asn1-csr");
+const runtime_1 = require("@naylence/runtime");
+const ca_types_js_1 = require("./ca-types.js");
+// Certificate extension OIDs (using placeholder PEN)
+exports.SID_OID = "1.3.6.1.4.1.58530.1";
+exports.LOGICALS_OID = "1.3.6.1.4.1.58530.2";
+exports.NODE_ID_OID = "1.3.6.1.4.1.58530.4";
+const ED25519_OID = "1.3.101.112";
+let x509ModulePromise = null;
+let cryptoPromise = null;
+let subtleCryptoPromise = null;
+/**
+ * Lazy-load the @peculiar/x509 module.
+ */
+async function loadX509Module() {
+    if (!x509ModulePromise) {
+        x509ModulePromise = Promise.resolve().then(() => __importStar(require("@peculiar/x509"))).then((mod) => {
+            if (mod && typeof mod.X509Certificate === "function") {
+                return mod;
+            }
+            return null;
+        })
+            .catch((error) => {
+            console.error("Failed to load @peculiar/x509:", error);
+            return null;
+        });
+    }
+    return x509ModulePromise;
+}
+async function ensureCrypto() {
+    if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle) {
+        return globalThis.crypto;
+    }
+    if (!cryptoPromise) {
+        if (typeof process !== "undefined" &&
+            typeof process.versions?.node === "string") {
+            cryptoPromise = Promise.resolve().then(() => __importStar(require("crypto"))).then((cryptoModule) => {
+                const webcrypto = cryptoModule
+                    .webcrypto;
+                if (!webcrypto || !webcrypto.subtle) {
+                    throw new Error("WebCrypto API is not available in this Node.js runtime");
+                }
+                globalThis.crypto = webcrypto;
+                return webcrypto;
+            });
+        }
+        else {
+            cryptoPromise = Promise.reject(new Error("WebCrypto API is not available in this environment"));
+        }
+    }
+    return cryptoPromise;
+}
+async function getSubtleCrypto() {
+    if (!subtleCryptoPromise) {
+        subtleCryptoPromise = ensureCrypto().then((cryptoImpl) => cryptoImpl.subtle);
+    }
+    return subtleCryptoPromise;
+}
+async function importEd25519PrivateKey(pem, keyUsages = ["sign"]) {
+    const subtle = await getSubtleCrypto();
+    const der = pemToDer(pem);
+    try {
+        return await subtle.importKey("pkcs8", der, { name: "Ed25519" }, false, keyUsages);
+    }
+    catch (error) {
+        throw new Error(`Failed to import Ed25519 private key: ${error.message}`);
+    }
+}
+async function importEd25519PublicKey(pem, keyUsages = ["verify"]) {
+    const subtle = await getSubtleCrypto();
+    const der = pemToDer(pem);
+    try {
+        return await subtle.importKey("spki", der, { name: "Ed25519" }, true, keyUsages);
+    }
+    catch (error) {
+        throw new Error(`Failed to import Ed25519 public key: ${error.message}`);
+    }
+}
+async function computeKeyIdentifier(key) {
+    const subtle = await getSubtleCrypto();
+    let spki;
+    if (key instanceof ArrayBuffer) {
+        spki = key;
+    }
+    else if (ArrayBuffer.isView(key)) {
+        const view = new Uint8Array(key.buffer, key.byteOffset, key.byteLength);
+        spki = view.slice().buffer;
+    }
+    else {
+        spki = await subtle.exportKey("spki", key);
+    }
+    const digest = await subtle.digest("SHA-256", spki);
+    return new Uint8Array(digest);
+}
+function toArrayBuffer(view) {
+    return new Uint8Array(view).buffer;
+}
+function serializeAsn(value) {
+    return asn1_schema_1.AsnConvert.serialize(value);
+}
+function hexToArrayBuffer(hex) {
+    const normalized = hex.length % 2 === 0 ? hex : `0${hex}`;
+    const bytes = new Uint8Array(normalized.length / 2);
+    for (let i = 0; i < bytes.length; i += 1) {
+        const byte = normalized.slice(i * 2, i * 2 + 2);
+        bytes[i] = Number.parseInt(byte, 16);
+    }
+    return bytes.buffer;
+}
+function encodeBitString(data) {
+    const input = new Uint8Array(data);
+    const bitString = new Uint8Array(input.length + 1);
+    bitString.set(input, 1);
+    return bitString.buffer;
+}
+async function createEd25519Certificate(options) {
+    const subtle = await getSubtleCrypto();
+    await ensureCrypto();
+    const serialHex = generateSerialNumber();
+    const issuerName = cloneName(options.issuer);
+    const subjectName = cloneName(options.subject);
+    const subjectSpki = await subtle.exportKey("spki", options.subjectPublicKey);
+    const subjectPublicKeyInfo = asn1_schema_1.AsnConvert.parse(subjectSpki, asn1_x509_1.SubjectPublicKeyInfo);
+    subjectPublicKeyInfo.algorithm = new asn1_x509_1.AlgorithmIdentifier({
+        algorithm: ED25519_OID,
+    });
+    const signatureAlgorithm = new asn1_x509_1.AlgorithmIdentifier({
+        algorithm: ED25519_OID,
+    });
+    const extensions = options.extensions?.length
+        ? new asn1_x509_1.Extensions(options.extensions.map((ext) => new asn1_x509_1.Extension({
+            extnID: ext.type,
+            critical: ext.critical,
+            extnValue: new asn1_schema_1.OctetString(ext.value),
+        })))
+        : undefined;
+    const tbsCertificate = new asn1_x509_1.TBSCertificate({
+        version: asn1_x509_1.Version.v3,
+        serialNumber: hexToArrayBuffer(serialHex),
+        signature: signatureAlgorithm,
+        issuer: issuerName,
+        validity: new asn1_x509_1.Validity({
+            notBefore: options.notBefore,
+            notAfter: options.notAfter,
+        }),
+        subject: subjectName,
+        subjectPublicKeyInfo,
+        extensions,
+    });
+    const tbsDer = asn1_schema_1.AsnConvert.serialize(tbsCertificate);
+    const signature = await subtle.sign("Ed25519", options.signingKey, tbsDer);
+    const certificate = new asn1_x509_1.Certificate({
+        tbsCertificate,
+        signatureAlgorithm,
+        signatureValue: encodeBitString(signature),
+    });
+    certificate.tbsCertificateRaw = tbsDer;
+    return asn1_schema_1.AsnConvert.serialize(certificate);
+}
+function derToPem(der, label) {
+    const base64 = bufferToBase64(der);
+    return `-----BEGIN ${label}-----\n${formatPem(base64)}\n-----END ${label}-----\n`;
+}
+function addDays(base, days) {
+    const result = new Date(base.getTime());
+    result.setUTCDate(result.getUTCDate() + days);
+    return result;
+}
+function generateSerialNumber(bytes = 16) {
+    const cryptoImpl = globalThis.crypto;
+    if (!cryptoImpl) {
+        throw new Error("Crypto API not initialized");
+    }
+    const random = new Uint8Array(bytes);
+    cryptoImpl.getRandomValues(random);
+    random[0] &= 0x7f;
+    return Array.from(random, (value) => value.toString(16).padStart(2, "0")).join("");
+}
+function getFameRootDomain() {
+    if (typeof process !== "undefined" && process.env?.FAME_ROOT) {
+        return process.env.FAME_ROOT;
+    }
+    return "fame.fabric";
+}
+const OID_COMMON_NAME = "2.5.4.3";
+const OID_ORGANIZATIONAL_UNIT = "2.5.4.11";
+const OID_ORGANIZATION = "2.5.4.10";
+function createRelativeDistinguishedName(oid, value) {
+    return new asn1_x509_1.RelativeDistinguishedName([
+        new asn1_x509_1.AttributeTypeAndValue({
+            type: oid,
+            value: new asn1_x509_1.AttributeValue({ utf8String: value }),
+        }),
+    ]);
+}
+function buildCertificateName(commonName, organization, organizationalUnit) {
+    const rdns = [
+        createRelativeDistinguishedName(OID_COMMON_NAME, commonName),
+    ];
+    if (organizationalUnit) {
+        rdns.push(createRelativeDistinguishedName(OID_ORGANIZATIONAL_UNIT, organizationalUnit));
+    }
+    if (organization) {
+        rdns.push(createRelativeDistinguishedName(OID_ORGANIZATION, organization));
+    }
+    return new asn1_x509_1.Name(rdns);
+}
+function cloneName(name) {
+    return asn1_schema_1.AsnConvert.parse(asn1_schema_1.AsnConvert.serialize(name), asn1_x509_1.Name);
+}
+function getCertificateIdentity(cert) {
+    const parsed = asn1_schema_1.AsnConvert.parse(cert.rawData, asn1_x509_1.Certificate);
+    return {
+        name: cloneName(parsed.tbsCertificate.subject),
+        subjectPublicKeyInfo: asn1_schema_1.AsnConvert.serialize(parsed.tbsCertificate.subjectPublicKeyInfo),
+    };
+}
+async function buildCaExtensions(subjectPublicKey, issuerPublicKey, options) {
+    const extensions = [];
+    const basicConstraints = new asn1_x509_1.BasicConstraints({ cA: true });
+    if (options.pathLength !== null && options.pathLength !== undefined) {
+        basicConstraints.pathLenConstraint = options.pathLength;
+    }
+    extensions.push({
+        type: asn1_x509_1.id_ce_basicConstraints,
+        critical: true,
+        value: serializeAsn(basicConstraints),
+    });
+    const keyUsageFlags = asn1_x509_1.KeyUsageFlags.digitalSignature |
+        asn1_x509_1.KeyUsageFlags.keyCertSign |
+        asn1_x509_1.KeyUsageFlags.cRLSign;
+    extensions.push({
+        type: asn1_x509_1.id_ce_keyUsage,
+        critical: true,
+        value: serializeAsn(new asn1_x509_1.KeyUsage(keyUsageFlags)),
+    });
+    const subjectKeyId = await computeKeyIdentifier(subjectPublicKey);
+    extensions.push({
+        type: asn1_x509_1.id_ce_subjectKeyIdentifier,
+        critical: false,
+        value: serializeAsn(new asn1_x509_1.SubjectKeyIdentifier(subjectKeyId)),
+    });
+    const authorityKeyId = await computeKeyIdentifier(issuerPublicKey);
+    extensions.push({
+        type: asn1_x509_1.id_ce_authorityKeyIdentifier,
+        critical: false,
+        value: serializeAsn(new asn1_x509_1.AuthorityKeyIdentifier({
+            keyIdentifier: new asn1_x509_1.KeyIdentifier(authorityKeyId),
+        })),
+    });
+    if (options.permittedDnsDomains?.length) {
+        const permittedSubtrees = new asn1_x509_1.GeneralSubtrees(options.permittedDnsDomains.map((domain) => new asn1_x509_1.GeneralSubtree({ base: new asn1_x509_1.GeneralName({ dNSName: domain }) })));
+        const constraints = new asn1_x509_1.NameConstraints({ permittedSubtrees });
+        extensions.push({
+            type: asn1_x509_1.id_ce_nameConstraints,
+            critical: true,
+            value: serializeAsn(constraints),
+        });
+    }
+    return extensions;
+}
+async function buildLeafExtensions(publicKey, nodeSid, nodeId, spiffeId, logicalHosts, issuerPublicKey) {
+    const extensions = [];
+    extensions.push({
+        type: asn1_x509_1.id_ce_subjectAltName,
+        critical: false,
+        value: serializeAsn(new asn1_x509_1.SubjectAlternativeName([
+            new asn1_x509_1.GeneralName({ uniformResourceIdentifier: spiffeId }),
+        ])),
+    });
+    const keyUsageFlags = asn1_x509_1.KeyUsageFlags.digitalSignature;
+    extensions.push({
+        type: asn1_x509_1.id_ce_keyUsage,
+        critical: true,
+        value: serializeAsn(new asn1_x509_1.KeyUsage(keyUsageFlags)),
+    });
+    extensions.push({
+        type: asn1_x509_1.id_ce_extKeyUsage,
+        critical: false,
+        value: serializeAsn(new asn1_x509_1.ExtendedKeyUsage([asn1_x509_1.id_kp_clientAuth, asn1_x509_1.id_kp_serverAuth])),
+    });
+    const subjectKeyId = await computeKeyIdentifier(publicKey);
+    extensions.push({
+        type: asn1_x509_1.id_ce_subjectKeyIdentifier,
+        critical: false,
+        value: serializeAsn(new asn1_x509_1.SubjectKeyIdentifier(subjectKeyId)),
+    });
+    const authorityKeyId = await computeKeyIdentifier(issuerPublicKey);
+    extensions.push({
+        type: asn1_x509_1.id_ce_authorityKeyIdentifier,
+        critical: false,
+        value: serializeAsn(new asn1_x509_1.AuthorityKeyIdentifier({
+            keyIdentifier: new asn1_x509_1.KeyIdentifier(authorityKeyId),
+        })),
+    });
+    extensions.push({
+        type: exports.SID_OID,
+        critical: false,
+        value: toArrayBuffer(new TextEncoder().encode(nodeSid)),
+    });
+    extensions.push({
+        type: exports.NODE_ID_OID,
+        critical: false,
+        value: toArrayBuffer(new TextEncoder().encode(nodeId)),
+    });
+    if (logicalHosts.length) {
+        const logicalsJson = JSON.stringify(logicalHosts);
+        extensions.push({
+            type: exports.LOGICALS_OID,
+            critical: false,
+            value: toArrayBuffer(new TextEncoder().encode(logicalsJson)),
+        });
+    }
+    return extensions;
+}
+/**
+ * In-process certificate signing service.
+ *
+ * Issues SPIFFE-compliant node certificates with Fame-specific extensions
+ * for physical paths and logical addresses.
+ */
+class CASigningService extends ca_types_js_1.CAService {
+    constructor(options) {
+        super();
+        this.rootCertPem = options.rootCertPem;
+        this.rootKeyPem = options.rootKeyPem;
+        this.intermediateCertPem = options.intermediateCertPem;
+        this.intermediateKeyPem = options.intermediateKeyPem;
+    }
+    async ensureRootMaterials() {
+        const x509 = await loadX509Module();
+        if (!x509) {
+            throw new Error("@peculiar/x509 module not available");
+        }
+        if (!this.rootCert) {
+            this.rootCert = new x509.X509Certificate(pemToDer(this.rootCertPem));
+        }
+        if (!this.rootKey) {
+            this.rootKey = await importEd25519PrivateKey(this.rootKeyPem);
+        }
+        return x509;
+    }
+    async ensureSigningMaterials() {
+        const x509 = await this.ensureRootMaterials();
+        if (this.intermediateCertPem && this.intermediateKeyPem) {
+            if (!this.signingCert) {
+                this.signingCert = new x509.X509Certificate(pemToDer(this.intermediateCertPem));
+            }
+            if (!this.signingKey) {
+                this.signingKey = await importEd25519PrivateKey(this.intermediateKeyPem);
+            }
+        }
+        else {
+            this.signingCert = this.rootCert;
+            this.signingKey = this.rootKey;
+        }
+        return x509;
+    }
+    getRootCertificate() {
+        if (!this.rootCert) {
+            throw new Error("Root certificate not initialized");
+        }
+        return this.rootCert;
+    }
+    getRootKey() {
+        if (!this.rootKey) {
+            throw new Error("Root private key not initialized");
+        }
+        return this.rootKey;
+    }
+    getSigningCertificate() {
+        if (!this.signingCert) {
+            throw new Error("Signing certificate not initialized");
+        }
+        return this.signingCert;
+    }
+    getSigningKey() {
+        if (!this.signingKey) {
+            throw new Error("Signing key not initialized");
+        }
+        return this.signingKey;
+    }
+    /**
+     * Issue a certificate from a CSR.
+     *
+     * Parses the PKCS#10 CSR, extracts the public key, calculates node SID,
+     * and signs a certificate. Mirrors Python's default_ca_service.issue_certificate.
+     *
+     * @param csr - Certificate signing request
+     * @returns Certificate issuance response with the signed certificate
+     */
+    async issueCertificate(csr) {
+        // Parse PKCS#10 CSR to extract SubjectPublicKeyInfo
+        const csrDer = pemToDer(csr.csrPem);
+        const certRequest = asn1_schema_1.AsnConvert.parse(csrDer, asn1_csr_1.CertificationRequest);
+        const subjectPublicKeyInfo = certRequest.certificationRequestInfo.subjectPKInfo;
+        // Convert SubjectPublicKeyInfo to PEM format
+        const publicKeyDer = asn1_schema_1.AsnConvert.serialize(subjectPublicKeyInfo);
+        const publicKeyPem = derToPem(publicKeyDer, "PUBLIC KEY");
+        // Determine node SID and physical path (mirrors Python logic)
+        const physicalPath = csr.physicalPath || `/unknown/${csr.requesterId}`;
+        const nodeSid = (0, runtime_1.secureDigest)(physicalPath);
+        const logicals = csr.logicals || [];
+        // Issue the certificate (short-lived: 1 day)
+        const certificatePem = await this.signNodeCert(publicKeyPem, csr.requesterId, // Use requesterId as node_id
+        nodeSid, physicalPath, logicals, 1, // TTL: 1 day (matches Python)
+        undefined);
+        // Parse certificate to get expiration
+        const certDer = pemToDer(certificatePem);
+        const cert = asn1_schema_1.AsnConvert.parse(certDer, asn1_x509_1.Certificate);
+        const notAfter = cert.tbsCertificate.validity.notAfter.getTime();
+        const expiresAt = new Date(notAfter).toISOString();
+        return {
+            certificatePem,
+            expiresAt,
+        };
+    }
+    /**
+     * Sign a SPIFFE-compatible node certificate with SID-based identity.
+     *
+     * @param publicKeyPem - Node's public key in PEM format
+     * @param nodeId - Unique identifier for the node
+     * @param nodeSid - Node's pre-computed SID (base62-encoded)
+     * @param physicalPath - Physical path (for SID verification only)
+     * @param logicals - List of host-like logical addresses
+     * @param ttlDays - Certificate validity period in days
+     * @param spiffeTrustDomain - SPIFFE trust domain
+     * @returns PEM-encoded signed certificate
+     */
+    async signNodeCert(publicKeyPem, nodeId, nodeSid, physicalPath, logicals, ttlDays = 365, spiffeTrustDomain = "naylence.fame") {
+        await this.ensureSigningMaterials();
+        const signingCert = this.getSigningCertificate();
+        const signingKey = this.getSigningKey();
+        const expectedSid = (0, runtime_1.secureDigest)(physicalPath);
+        if (expectedSid !== nodeSid) {
+            throw new Error("Provided SID does not match the computed SID for the physical path");
+        }
+        const logicalHosts = logicals ?? [];
+        for (const logical of logicalHosts) {
+            const [valid, error] = (0, runtime_1.validateHostLogical)(logical);
+            if (!valid) {
+                throw new Error(`Invalid logical host '${logical}': ${error ?? "unknown error"}`);
+            }
+        }
+        await ensureCrypto();
+        const publicKey = await importEd25519PublicKey(publicKeyPem, ["verify"]);
+        const issuerIdentity = getCertificateIdentity(signingCert);
+        const now = new Date();
+        const notBefore = new Date(now.getTime() - 60000);
+        const notAfter = addDays(now, ttlDays);
+        const spiffeId = `spiffe://${spiffeTrustDomain}/nodes/${nodeSid}`;
+        const extensions = await buildLeafExtensions(publicKey, nodeSid, nodeId, spiffeId, logicalHosts, issuerIdentity.subjectPublicKeyInfo);
+        const issuerName = issuerIdentity.name;
+        const subjectName = buildCertificateName(nodeSid, "Naylence Fame", "Fame Nodes");
+        const certDer = await createEd25519Certificate({
+            subject: subjectName,
+            issuer: issuerName,
+            subjectPublicKey: publicKey,
+            signingKey,
+            notBefore,
+            notAfter,
+            extensions,
+        });
+        return derToPem(certDer, "CERTIFICATE");
+    }
+    /**
+     * Create an intermediate CA certificate.
+     *
+     * @param publicKeyPem - Intermediate CA's public key in PEM format
+     * @param caName - Name for the intermediate CA
+     * @param permittedPaths - List of logical prefixes this CA can issue for
+     * @param ttlDays - Certificate validity period in days
+     * @returns PEM-encoded intermediate CA certificate
+     */
+    async createIntermediateCA(publicKeyPem, caName, permittedPaths, ttlDays = 1825) {
+        await this.ensureRootMaterials();
+        const rootCert = this.getRootCertificate();
+        const rootKey = this.getRootKey();
+        await ensureCrypto();
+        const subjectPublicKey = await importEd25519PublicKey(publicKeyPem);
+        const now = new Date();
+        const notBefore = new Date(now.getTime() - 60000);
+        const notAfter = addDays(now, ttlDays);
+        const subjectName = buildCertificateName(caName, "Naylence Fame", "Fame Intermediate CAs");
+        const issuerIdentity = getCertificateIdentity(rootCert);
+        const extensions = await buildCaExtensions(subjectPublicKey, issuerIdentity.subjectPublicKeyInfo, {
+            pathLength: 0,
+            permittedDnsDomains: permittedPaths.length
+                ? [getFameRootDomain()]
+                : undefined,
+        });
+        const certDer = await createEd25519Certificate({
+            subject: subjectName,
+            issuer: issuerIdentity.name,
+            subjectPublicKey,
+            signingKey: rootKey,
+            notBefore,
+            notAfter,
+            extensions,
+        });
+        return derToPem(certDer, "CERTIFICATE");
+    }
+}
+exports.CASigningService = CASigningService;
+/**
+ * Create a test root CA for development/testing.
+ *
+ * Generates an Ed25519 key pair and self-signed root CA certificate.
+ *
+ * @returns Tuple of [rootCertPem, rootKeyPem]
+ */
+async function createTestCA() {
+    const subtle = await getSubtleCrypto();
+    await ensureCrypto();
+    const keyPair = await subtle.generateKey({
+        name: "Ed25519",
+        namedCurve: "Ed25519",
+    }, true, ["sign", "verify"]);
+    const privateKeyDer = await subtle.exportKey("pkcs8", keyPair.privateKey);
+    const publicKeyDer = await subtle.exportKey("spki", keyPair.publicKey);
+    const rootKeyPem = derToPem(privateKeyDer, "PRIVATE KEY");
+    const publicKeyPem = derToPem(publicKeyDer, "PUBLIC KEY");
+    const now = new Date();
+    const notBefore = new Date(now.getTime() - 60000);
+    const notAfter = addDays(now, 365 * 20);
+    const subjectName = buildCertificateName("Fame Test Root CA", "Naylence Fame");
+    const extensions = await buildCaExtensions(keyPair.publicKey, keyPair.publicKey, { pathLength: null });
+    const certDer = await createEd25519Certificate({
+        subject: subjectName,
+        issuer: subjectName,
+        subjectPublicKey: keyPair.publicKey,
+        signingKey: keyPair.privateKey,
+        notBefore,
+        notAfter,
+        extensions,
+    });
+    const rootCertPem = derToPem(certDer, "CERTIFICATE");
+    return [rootCertPem, rootKeyPem, publicKeyPem];
+}
+/**
+ * Extract SPIFFE ID from certificate SAN.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns SPIFFE ID string or null if not found
+ */
+async function extractSpiffeIdFromCert(certPem) {
+    const x509 = await loadX509Module();
+    if (!x509) {
+        throw new Error("@peculiar/x509 module not available");
+    }
+    try {
+        const certDer = pemToDer(certPem);
+        const cert = new x509.X509Certificate(certDer);
+        // TODO: Extract SAN extension and find SPIFFE URI
+        // This requires accessing the certificate extensions
+        console.log("Extracting SPIFFE ID from cert:", cert.subject);
+        return null;
+    }
+    catch (error) {
+        console.error("Failed to extract SPIFFE ID:", error);
+        return null;
+    }
+}
+/**
+ * Extract raw SID bytes from certificate extension.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns SID bytes or null if not found
+ */
+async function extractSidFromCert(certPem) {
+    const x509 = await loadX509Module();
+    if (!x509) {
+        throw new Error("@peculiar/x509 module not available");
+    }
+    try {
+        const certDer = pemToDer(certPem);
+        const cert = new x509.X509Certificate(certDer);
+        const sidExtension = cert.getExtension(exports.SID_OID);
+        if (sidExtension) {
+            return new Uint8Array(sidExtension);
+        }
+        return null;
+    }
+    catch (error) {
+        console.error("Failed to extract SID:", error);
+        return null;
+    }
+}
+/**
+ * Extract node ID from certificate extension.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns Node ID string or null if not found
+ */
+async function extractNodeIdFromCert(certPem) {
+    const x509 = await loadX509Module();
+    if (!x509) {
+        throw new Error("@peculiar/x509 module not available");
+    }
+    try {
+        const certDer = pemToDer(certPem);
+        const cert = new x509.X509Certificate(certDer);
+        const nodeIdExtension = cert.getExtension(exports.NODE_ID_OID);
+        if (nodeIdExtension) {
+            const decoder = new TextDecoder();
+            return decoder.decode(nodeIdExtension);
+        }
+        return null;
+    }
+    catch (error) {
+        console.error("Failed to extract node ID:", error);
+        return null;
+    }
+}
+/**
+ * Extract logical hosts from certificate private extension.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns List of logical host addresses, empty if none found
+ */
+async function extractLogicalHostsFromCert(certPem) {
+    const x509 = await loadX509Module();
+    if (!x509) {
+        throw new Error("@peculiar/x509 module not available");
+    }
+    try {
+        const certDer = pemToDer(certPem);
+        const cert = new x509.X509Certificate(certDer);
+        const logicalsExtension = cert.getExtension(exports.LOGICALS_OID);
+        if (logicalsExtension) {
+            const decoder = new TextDecoder();
+            const jsonStr = decoder.decode(logicalsExtension);
+            return JSON.parse(jsonStr);
+        }
+        return [];
+    }
+    catch (error) {
+        console.error("Failed to extract logical hosts:", error);
+        return [];
+    }
+}
+/**
+ * Extract the SID string from a SPIFFE ID.
+ *
+ * @param spiffeId - SPIFFE ID in format spiffe://trust-domain/nodes/<sid>
+ * @returns SID string (base62-encoded) or null if not a valid node SPIFFE ID
+ */
+function extractSidFromSpiffeId(spiffeId) {
+    if (!spiffeId.startsWith("spiffe://")) {
+        return null;
+    }
+    // Parse spiffe://trust-domain/nodes/<sid>
+    const parts = spiffeId.split("/");
+    if (parts.length >= 5 && parts[3] === "nodes") {
+        return parts[4] ?? null; // The SID string (base62-encoded)
+    }
+    return null;
+}
+/**
+ * Verify that the SID in the certificate matches the expected physical path.
+ *
+ * @param certPem - Certificate in PEM format
+ * @param physicalPath - The expected physical path to verify against
+ * @returns True if SID matches computed hash of physical path, False otherwise
+ */
+async function verifyCertSidIntegrity(certPem, physicalPath) {
+    const sidBytes = await extractSidFromCert(certPem);
+    if (!sidBytes) {
+        return false;
+    }
+    try {
+        const decoder = new TextDecoder();
+        const certSid = decoder.decode(sidBytes);
+        // Compute expected SID from physical path and compare
+        // TODO: Import secureDigest from runtime
+        // const expectedSid = secureDigest(physicalPath);
+        // return certSid === expectedSid;
+        console.log("Verifying SID integrity:", { certSid, physicalPath });
+        return false; // Placeholder until secureDigest is available
+    }
+    catch (error) {
+        console.error("Failed to verify SID integrity:", error);
+        return false;
+    }
+}
+// ============================================================================
+// Utility Functions
+// ============================================================================
+/**
+ * Convert PEM to DER format as ArrayBuffer.
+ */
+function pemToDer(pem) {
+    const base64 = pem
+        .replace(/-----BEGIN[^-]+-----/, "")
+        .replace(/-----END[^-]+-----/, "")
+        .replace(/\s/g, "");
+    const bytes = base64ToBuffer(base64);
+    // Create a new ArrayBuffer and copy the data
+    const buffer = new ArrayBuffer(bytes.length);
+    const view = new Uint8Array(buffer);
+    view.set(bytes);
+    return buffer;
+}
+/**
+ * Convert base64 string to Uint8Array.
+ */
+function base64ToBuffer(base64) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(base64, "base64");
+    }
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Convert ArrayBuffer to base64 string.
+ */
+function bufferToBase64(buffer) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(buffer).toString("base64");
+    }
+    const bytes = new Uint8Array(buffer);
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+/**
+ * Format base64 string into 64-character lines.
+ */
+function formatPem(base64) {
+    const lines = [];
+    for (let i = 0; i < base64.length; i += 64) {
+        lines.push(base64.substring(i, Math.min(i + 64, base64.length)));
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=internal-ca-service.js.map