yusufkhon-guard 1.0.0

package/src/index.js

@@ -0,0 +1,206 @@
+'use strict';
+
+/**
+ * @file index.js
+ * @description `yusufkhon-guard` kutubxonasining asosiy kirish nuqtasi.
+ *              Barcha modullarni eksport qiladi hamda ularni bitta qulay
+ *              `guard()` initializer orqali birlashtirib beradi.
+ * @module yusufkhon-guard
+ * @author Yusufkhon
+ * @license MIT
+ */
+
+const securityHeaders = require('./modules/headers');
+const rateLimiter = require('./modules/rateLimiter');
+const sanitizer = require('./modules/sanitizer');
+const firewall = require('./modules/firewall');
+const httpsRedirect = require('./modules/httpsRedirect');
+const threatDetector = require('./modules/threatDetector');
+const osFirewall = require('./modules/osFirewall');
+const dashboard = require('./modules/dashboard');
+const acme = require('./modules/acme');
+const geoBlock = require('./modules/geoBlock');
+const datacenterRanges = require('./modules/datacenterRanges');
+const botDetector = require('./modules/botDetector');
+const ja3 = require('./modules/ja3');
+const adaptiveRateLimiter = require('./modules/adaptiveRateLimiter');
+const honeypot = require('./modules/honeypot');
+const nosqlGuard = require('./modules/nosqlGuard');
+const csrf = require('./modules/csrf');
+const bodyLimit = require('./modules/bodyLimit');
+const ddosGuard = require('./modules/ddosGuard');
+const connectionGuard = require('./modules/connectionGuard');
+const { IntegrityMonitor } = require('./modules/integrity');
+const { Alerter } = require('./modules/alerts');
+const { RotatingJsonLogger } = require('./modules/logExport');
+const { IpBlocker } = require('./modules/ipBlocker');
+const { scan, formatReport } = require('./scanner');
+const privilege = require('./utils/privilege');
+const cidr = require('./utils/cidr');
+const { Logger, defaultLogger } = require('./utils/logger');
+
+/**
+ * @typedef {Object} GuardOptions
+ * @property {import('./modules/bodyLimit').BodyLimitOptions} [bodyLimit] - Payload hajmi cheklovi (opsional; berilsa yoqiladi).
+ * @property {import('./modules/ddosGuard').DdosGuardOptions|true} [ddos] - L7 DDoS himoyasi (opsional; Attack Mode, concurrency, shedding, challenge).
+ * @property {import('./modules/httpsRedirect').HttpsRedirectOptions|false} [https] - HTTPS'ga yo'naltirish (berilmasa — o'chirilgan).
+ * @property {import('./modules/headers').HeadersOptions|false} [headers] - Xavfsizlik sarlavhalari (`false` — o'chirilgan).
+ * @property {import('./modules/geoBlock').GeoBlockOptions} [geoBlock] - Geo-IP / datacenter / VPN himoyasi (opsional).
+ * @property {import('./modules/honeypot').HoneypotOptions|true} [honeypot] - HoneyPot tuzoqlari (opsional; `true` — standart tuzoqlar).
+ * @property {import('./modules/botDetector').BotDetectorOptions|true} [botDetector] - Bot/skript aniqlash (opsional).
+ * @property {import('./modules/firewall').FirewallOptions|false} [firewall] - "Blue team" aktiv himoya (`false` — o'chirilgan).
+ * @property {import('./modules/adaptiveRateLimiter').AdaptiveOptions} [adaptiveRateLimit] - Aqlli rate-limiting (berilsa, oddiy rateLimit o'rniga ishlaydi).
+ * @property {import('./modules/rateLimiter').RateLimiterOptions|false} [rateLimit] - Oddiy rate-limiting (`false` — o'chirilgan).
+ * @property {import('./modules/csrf').CsrfOptions} [csrf] - CSRF himoyasi (opsional).
+ * @property {import('./modules/nosqlGuard').NosqlGuardOptions|true} [nosql] - NoSQL/JSON himoyasi (opsional).
+ * @property {import('./modules/sanitizer').SanitizerOptions|false} [sanitize] - Input tozalash (`false` — o'chirilgan).
+ * @property {import('./utils/logger').Logger} [logger] - Umumiy logger (barcha modullarga uzatiladi).
+ */
+
+/**
+ * Barcha himoya qatlamlarini bitta massivda qaytaruvchi umumiy initializer.
+ * Natijani to'g'ridan-to'g'ri `app.use(...)` ga berish mumkin.
+ *
+ * Standart holatda faqat 4 ta asosiy modul yoqiladi (headers, firewall,
+ * rateLimit, sanitize). Qolganlari (bodyLimit, geoBlock, honeypot, botDetector,
+ * adaptiveRateLimit, csrf, nosql, https) — mos sozlama berilgandagina qo'shiladi.
+ *
+ * @example
+ * const guard = require('yusufkhon-guard');
+ * app.use(guard({
+ *   bodyLimit:  { maxBodySize: '512kb' },
+ *   honeypot:   true,
+ *   botDetector:{ block: true },
+ *   geoBlock:   { allowCountries: ['UZ','US'], blockDatacenter: true },
+ *   csrf:       { allowedOrigins: ['https://mysite.uz'] },
+ *   nosql:      true,
+ *   firewall:   { persistPath: './logs/bans.json' },
+ * }));
+ *
+ * @param {GuardOptions} [options={}] - Umumiy sozlamalar.
+ * @returns {import('express').RequestHandler[] & { firewall?: import('./modules/firewall').Firewall }} Middleware'lar massivi (firewall nusxasi biriktirilgan).
+ */
+function guard(options = {}) {
+  const logger = options.logger || defaultLogger;
+
+  /** @type {import('express').RequestHandler[]} */
+  const stack = [];
+  let firewallInstance;
+
+  // Firewall nusxasini oldindan yaratamiz (boshqa modullar unga strike/ban qo'shishi uchun).
+  let firewallMw;
+  if (options.firewall !== false) {
+    firewallMw = firewall({ logger, ...(options.firewall || {}) });
+    firewallInstance = firewallMw.firewall;
+  }
+
+  // 0. Payload hajmi cheklovi — body parserdan oldin ishlashi kerak.
+  if (options.bodyLimit) {
+    stack.push(bodyLimit({ logger, firewall: firewallInstance, ...(options.bodyLimit === true ? {} : options.bodyLimit) }));
+  }
+
+  // 1. HTTPS'ga yo'naltirish.
+  if (options.https) {
+    stack.push(httpsRedirect(options.https === true ? {} : options.https));
+  }
+
+  // 2. Xavfsizlik sarlavhalari.
+  if (options.headers !== false) {
+    stack.push(securityHeaders(options.headers || {}));
+  }
+
+  // 2.5. L7 DDoS himoyasi — hujum paytida og'ir ishlardan oldin chetlash/challenge.
+  let ddosMw;
+  if (options.ddos) {
+    ddosMw = ddosGuard({ logger, firewall: firewallInstance, ...(options.ddos === true ? {} : options.ddos) });
+    stack.push(ddosMw);
+  }
+
+  // 3. Geo-IP / datacenter / VPN himoyasi.
+  if (options.geoBlock) {
+    stack.push(geoBlock({ logger, firewall: firewallInstance, ...options.geoBlock }));
+  }
+
+  // 4. HoneyPot tuzoqlari — bloklangan IP'ni darhol to'sadi.
+  if (options.honeypot) {
+    stack.push(honeypot({ logger, firewall: firewallInstance, osFirewall, ...(options.honeypot === true ? {} : options.honeypot) }));
+  }
+
+  // 5. Bot / skript aniqlash.
+  if (options.botDetector) {
+    stack.push(botDetector({ logger, firewall: firewallInstance, ...(options.botDetector === true ? {} : options.botDetector) }));
+  }
+
+  // 6. Aktiv himoya (blue team).
+  if (firewallMw) stack.push(firewallMw);
+
+  // 7. Rate limiting — aqlli (adaptive) yoki oddiy.
+  if (options.adaptiveRateLimit) {
+    stack.push(adaptiveRateLimiter({ logger, firewall: firewallInstance, ...(options.adaptiveRateLimit === true ? {} : options.adaptiveRateLimit) }));
+  } else if (options.rateLimit !== false) {
+    stack.push(rateLimiter({ logger, ...(options.rateLimit || {}) }));
+  }
+
+  // 8. CSRF himoyasi.
+  if (options.csrf) {
+    stack.push(csrf({ logger, ...options.csrf }));
+  }
+
+  // 9. NoSQL / JSON himoyasi.
+  if (options.nosql) {
+    stack.push(nosqlGuard({ logger, ...(options.nosql === true ? {} : options.nosql) }));
+  }
+
+  // 10. Input sanitization.
+  if (options.sanitize !== false) {
+    stack.push(sanitizer({ logger, ...(options.sanitize || {}) }));
+  }
+
+  // Firewall va DDoS nusxalarini massivga biriktiramiz (hodisa/monitoring uchun).
+  if (firewallInstance) {
+    Object.defineProperty(stack, 'firewall', { value: firewallInstance, enumerable: false });
+  }
+  if (ddosMw) {
+    Object.defineProperty(stack, 'ddos', { value: ddosMw, enumerable: false });
+  }
+
+  logger.success(`yusufkhon-guard faollashtirildi (${stack.length} ta modul).`);
+
+  return stack;
+}
+
+// Asosiy eksport — `guard` funksiyasi.
+module.exports = guard;
+
+// Nomlangan (named) eksportlar — modullardan alohida foydalanish uchun.
+module.exports.guard = guard;
+module.exports.securityHeaders = securityHeaders;
+module.exports.rateLimiter = rateLimiter;
+module.exports.sanitizer = sanitizer;
+module.exports.firewall = firewall;
+module.exports.httpsRedirect = httpsRedirect;
+module.exports.threatDetector = threatDetector;
+module.exports.osFirewall = osFirewall;
+module.exports.dashboard = dashboard;
+module.exports.acme = acme;
+module.exports.geoBlock = geoBlock;
+module.exports.datacenterRanges = datacenterRanges;
+module.exports.botDetector = botDetector;
+module.exports.ja3 = ja3;
+module.exports.adaptiveRateLimiter = adaptiveRateLimiter;
+module.exports.honeypot = honeypot;
+module.exports.nosqlGuard = nosqlGuard;
+module.exports.csrf = csrf;
+module.exports.bodyLimit = bodyLimit;
+module.exports.ddosGuard = ddosGuard;
+module.exports.connectionGuard = connectionGuard;
+module.exports.IntegrityMonitor = IntegrityMonitor;
+module.exports.Alerter = Alerter;
+module.exports.RotatingJsonLogger = RotatingJsonLogger;
+module.exports.IpBlocker = IpBlocker;
+module.exports.scan = scan;
+module.exports.formatReport = formatReport;
+module.exports.privilege = privilege;
+module.exports.cidr = cidr;
+module.exports.Logger = Logger;
+module.exports.logger = defaultLogger;

package/src/modules/acme/client.js

@@ -0,0 +1,240 @@
+'use strict';
+
+/**
+ * @file client.js
+ * @description ACME v2 (RFC 8555) protokol mijozi. Let's Encrypt bilan
+ *              hisob yaratish, buyurtma (order) ochish, HTTP-01 challenge'ni
+ *              bajarish, CSR'ni yakunlash (finalize) va sertifikatni yuklab
+ *              olish jarayonlarini boshqaradi. Global `fetch` (Node 18+) va
+ *              ichki `crypto`'dan foydalanadi — zero-dependency.
+ * @module modules/acme/client
+ */
+
+const jose = require('./jose');
+const { defaultLogger } = require('../../utils/logger');
+
+/**
+ * Let's Encrypt katalog (directory) URL manzillari.
+ * @readonly
+ */
+const DIRECTORY_URLS = {
+  staging: 'https://acme-staging-v02.api.letsencrypt.org/directory',
+  production: 'https://acme-v02.api.letsencrypt.org/directory',
+};
+
+/**
+ * Kutish (sleep) yordamchisi.
+ * @private
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * ACME v2 mijozi.
+ * @class
+ */
+class AcmeClient {
+  /**
+   * @param {Object} options
+   * @param {string} [options.directoryUrl] - To'g'ridan-to'g'ri katalog URL'i.
+   * @param {'staging'|'production'} [options.environment='staging'] - Muhit (directoryUrl berilmasa).
+   * @param {import('crypto').KeyObject} options.accountKey - Hisob yopiq kaliti (ES256).
+   * @param {import('../../utils/logger').Logger} [options.logger=defaultLogger] - Logger.
+   */
+  constructor(options) {
+    if (!options || !options.accountKey) {
+      throw new Error('AcmeClient: `accountKey` majburiy (jose.generateAccountKey()).');
+    }
+    this.directoryUrl =
+      options.directoryUrl || DIRECTORY_URLS[options.environment || 'staging'];
+    this.accountKey = options.accountKey;
+    this.publicJwk = jose.publicJwk(
+      require('crypto').createPublicKey(options.accountKey)
+    );
+    this.thumbprint = jose.jwkThumbprint(this.publicJwk);
+    this.logger = options.logger || defaultLogger;
+
+    /** @type {Object|null} */
+    this.directory = null;
+    /** @type {string|null} */
+    this.nonce = null;
+    /** @type {string|null} Hisob URL'i (kid). */
+    this.kid = null;
+  }
+
+  /**
+   * Katalogni yuklaydi (barcha ACME endpoint URL'lari).
+   * @returns {Promise<Object>}
+   */
+  async init() {
+    const res = await fetch(this.directoryUrl);
+    if (!res.ok) throw new Error(`ACME katalogini yuklab bo'lmadi: HTTP ${res.status}`);
+    this.directory = await res.json();
+    return this.directory;
+  }
+
+  /**
+   * Yangi Replay-Nonce oladi.
+   * @returns {Promise<string>}
+   */
+  async fetchNonce() {
+    const res = await fetch(this.directory.newNonce, { method: 'HEAD' });
+    const nonce = res.headers.get('replay-nonce');
+    if (!nonce) throw new Error('Replay-Nonce olinmadi.');
+    this.nonce = nonce;
+    return nonce;
+  }
+
+  /**
+   * Imzolangan (JWS) POST so'rovini yuboradi. Nonce'ni avtomat boshqaradi.
+   * @private
+   * @param {string} url - ACME URL.
+   * @param {Object|string} payload - Yuk (POST-as-GET uchun "").
+   * @returns {Promise<{ status: number, headers: Headers, body: any, text: string }>}
+   */
+  async signedRequest(url, payload) {
+    if (!this.nonce) await this.fetchNonce();
+
+    const jws = jose.signedJws({
+      privateKey: this.accountKey,
+      url,
+      nonce: this.nonce,
+      payload,
+      kid: this.kid || undefined,
+      jwk: this.kid ? undefined : this.publicJwk,
+    });
+
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/jose+json' },
+      body: jws,
+    });
+
+    // Har bir javob yangi nonce beradi.
+    const newNonce = res.headers.get('replay-nonce');
+    if (newNonce) this.nonce = newNonce;
+
+    const text = await res.text();
+    let body;
+    const ct = res.headers.get('content-type') || '';
+    if (ct.includes('json')) {
+      try { body = JSON.parse(text); } catch { body = text; }
+    } else {
+      body = text;
+    }
+
+    if (res.status >= 400) {
+      const detail = body && body.detail ? body.detail : text;
+      const err = new Error(`ACME xato (${res.status}): ${detail}`);
+      err.status = res.status;
+      err.body = body;
+      throw err;
+    }
+
+    return { status: res.status, headers: res.headers, body, text };
+  }
+
+  /**
+   * Yangi hisob yaratadi (yoki mavjudini qaytaradi) va `kid`ni o'rnatadi.
+   * @param {Object} params
+   * @param {string} [params.email] - Bog'lanish uchun email.
+   * @param {boolean} [params.termsAgreed=true] - Xizmat shartlariga rozilik.
+   * @returns {Promise<string>} Hisob URL'i (kid).
+   */
+  async createAccount({ email, termsAgreed = true } = {}) {
+    const payload = { termsOfServiceAgreed: termsAgreed };
+    if (email) payload.contact = [`mailto:${email}`];
+
+    const res = await this.signedRequest(this.directory.newAccount, payload);
+    this.kid = res.headers.get('location');
+    if (!this.kid) throw new Error('Hisob URL (kid) olinmadi.');
+    this.logger.success('ACME hisob tayyor.');
+    return this.kid;
+  }
+
+  /**
+   * Yangi sertifikat buyurtmasini ochadi.
+   * @param {string[]} domains
+   * @returns {Promise<{ order: Object, orderUrl: string }>}
+   */
+  async createOrder(domains) {
+    const identifiers = domains.map((value) => ({ type: 'dns', value }));
+    const res = await this.signedRequest(this.directory.newOrder, { identifiers });
+    return { order: res.body, orderUrl: res.headers.get('location') };
+  }
+
+  /**
+   * Avtorizatsiya (authorization) obyektini oladi.
+   * @param {string} url
+   * @returns {Promise<Object>}
+   */
+  async getAuthorization(url) {
+    const res = await this.signedRequest(url, '');
+    return res.body;
+  }
+
+  /**
+   * HTTP-01 challenge uchun kalit avtorizatsiyasini hisoblaydi.
+   * @param {string} token
+   * @returns {string} `token.thumbprint`.
+   */
+  keyAuthorization(token) {
+    return `${token}.${this.thumbprint}`;
+  }
+
+  /**
+   * Challenge'ni "tayyor" deb belgilaydi (ACME'ni tekshirishga undaydi).
+   * @param {string} challengeUrl
+   * @returns {Promise<Object>}
+   */
+  async completeChallenge(challengeUrl) {
+    const res = await this.signedRequest(challengeUrl, {});
+    return res.body;
+  }
+
+  /**
+   * Resurs holati kerakli qiymatga yetguncha (yoki xato bo'lguncha) so'rab turadi.
+   * @param {string} url - Kuzatiladigan resurs URL'i.
+   * @param {string[]} until - Kutilayotgan holatlar (masalan, ['valid']).
+   * @param {Object} [opts]
+   * @param {number} [opts.tries=15] - Urinishlar soni.
+   * @param {number} [opts.intervalMs=2000] - Urinishlar orasidagi kutish.
+   * @returns {Promise<Object>}
+   */
+  async poll(url, until, { tries = 15, intervalMs = 2000 } = {}) {
+    for (let i = 0; i < tries; i++) {
+      const res = await this.signedRequest(url, '');
+      const status = res.body && res.body.status;
+      if (until.includes(status)) return res.body;
+      if (status === 'invalid') {
+        throw new Error(`ACME holati "invalid": ${JSON.stringify(res.body)}`);
+      }
+      await sleep(intervalMs);
+    }
+    throw new Error(`ACME holati kutilgan (${until.join('/')}) qiymatga yetmadi: ${url}`);
+  }
+
+  /**
+   * Buyurtmani CSR bilan yakunlaydi.
+   * @param {string} finalizeUrl
+   * @param {string} csrDerBase64Url
+   * @returns {Promise<Object>}
+   */
+  async finalizeOrder(finalizeUrl, csrDerBase64Url) {
+    const res = await this.signedRequest(finalizeUrl, { csr: csrDerBase64Url });
+    return res.body;
+  }
+
+  /**
+   * Yakuniy sertifikat zanjirini (PEM) yuklab oladi.
+   * @param {string} certificateUrl
+   * @returns {Promise<string>} PEM sertifikat zanjiri.
+   */
+  async downloadCertificate(certificateUrl) {
+    const res = await this.signedRequest(certificateUrl, '');
+    return typeof res.body === 'string' ? res.body : res.text;
+  }
+}
+
+module.exports = { AcmeClient, DIRECTORY_URLS };

package/src/modules/acme/csr.js

@@ -0,0 +1,172 @@
+'use strict';
+
+/**
+ * @file csr.js
+ * @description Minimal ASN.1 DER kodlagich va PKCS#10 (CSR) quruvchisi.
+ *              Node.js `crypto` yordamida ECDSA P-256 kalit yaratadi va Subject
+ *              Alternative Name (SAN) li sertifikat so'rovnomasini (CSR) tuzadi.
+ *              ACME `finalize` bosqichida base64url(DER) ko'rinishida yuboriladi.
+ *
+ *              Ochiq kalit (SubjectPublicKeyInfo) to'g'ridan-to'g'ri Node'ning
+ *              `spki` DER eksportidan olinadi — shu bois EC nuqtasini qo'lda
+ *              kodlash shart emas, faqat CSR "qobig'i" ASN.1 bilan yig'iladi.
+ * @module modules/acme/csr
+ */
+
+const crypto = require('crypto');
+
+// --- Minimal ASN.1 DER kodlagich ---
+
+/**
+ * DER uzunlik (length) maydonini kodlaydi.
+ * @private
+ * @param {number} len
+ * @returns {Buffer}
+ */
+function encodeLength(len) {
+  if (len < 0x80) return Buffer.from([len]);
+  const bytes = [];
+  let n = len;
+  while (n > 0) {
+    bytes.unshift(n & 0xff);
+    n >>= 8;
+  }
+  return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+
+/**
+ * Tag + uzunlik + kontentdan TLV (Type-Length-Value) tuzadi.
+ * @private
+ * @param {number} tag
+ * @param {Buffer} content
+ * @returns {Buffer}
+ */
+function tlv(tag, content) {
+  return Buffer.concat([Buffer.from([tag]), encodeLength(content.length), content]);
+}
+
+/** SEQUENCE (0x30). @param {...Buffer} parts @returns {Buffer} */
+const seq = (...parts) => tlv(0x30, Buffer.concat(parts));
+/** SET (0x31). @param {...Buffer} parts @returns {Buffer} */
+const set = (...parts) => tlv(0x31, Buffer.concat(parts));
+/** INTEGER (0x02). @param {number} n @returns {Buffer} */
+const int = (n) => tlv(0x02, Buffer.from([n]));
+/** UTF8String (0x0c). @param {string} s @returns {Buffer} */
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+/** OCTET STRING (0x04). @param {Buffer} b @returns {Buffer} */
+const octet = (b) => tlv(0x04, b);
+
+/**
+ * Nuqtali OID matnini DER baytlariga kodlaydi.
+ * @private
+ * @param {string} oidStr - Masalan, "1.2.840.10045.4.3.2".
+ * @returns {Buffer}
+ */
+function oid(oidStr) {
+  const parts = oidStr.split('.').map(Number);
+  const first = 40 * parts[0] + parts[1];
+  const body = [first];
+  for (let i = 2; i < parts.length; i++) {
+    let val = parts[i];
+    const stack = [val & 0x7f];
+    val >>= 7;
+    while (val > 0) {
+      stack.unshift((val & 0x7f) | 0x80);
+      val >>= 7;
+    }
+    body.push(...stack);
+  }
+  return tlv(0x06, Buffer.from(body));
+}
+
+// --- Ma'lum OID'lar ---
+const OID_CN = '2.5.4.3'; // commonName
+const OID_EXTENSION_REQUEST = '1.2.840.113549.1.9.14';
+const OID_SAN = '2.5.29.17'; // subjectAltName
+const OID_ECDSA_SHA256 = '1.2.840.10045.4.3.2';
+
+/**
+ * SubjectAltName kengaytmasi qiymatini (extnValue) tuzadi.
+ * @private
+ * @param {string[]} domains
+ * @returns {Buffer} DER SEQUENCE OF GeneralName.
+ */
+function buildSanValue(domains) {
+  // dNSName ::= [2] IMPLICIT IA5String  -> kontekst primitiv tag 0x82.
+  const names = domains.map((d) => tlv(0x82, Buffer.from(d, 'ascii')));
+  return seq(...names);
+}
+
+/**
+ * PKCS#10 uchun attributes ([0] IMPLICIT) — extensionRequest (SAN) bilan.
+ * @private
+ * @param {string[]} domains
+ * @returns {Buffer}
+ */
+function buildAttributes(domains) {
+  const sanExtension = seq(oid(OID_SAN), octet(buildSanValue(domains)));
+  const extensions = seq(sanExtension); // SEQUENCE OF Extension
+  const attribute = seq(oid(OID_EXTENSION_REQUEST), set(extensions));
+  // [0] IMPLICIT SET OF Attribute -> kontekst konstruktiv tag 0xA0.
+  return tlv(0xa0, attribute);
+}
+
+/**
+ * @typedef {Object} CsrResult
+ * @property {string} csrDerBase64Url - ACME `finalize` uchun base64url(DER).
+ * @property {Buffer} csrDer - Xom DER.
+ * @property {string} csrPem - PEM ko'rinish (tekshirish/saqlash uchun).
+ * @property {string} privateKeyPem - Sertifikatning yopiq kaliti (PKCS#8 PEM).
+ * @property {crypto.KeyObject} privateKey - Yopiq kalit obyekti.
+ */
+
+/**
+ * Berilgan domenlar uchun ECDSA P-256 kalit yaratadi va SAN'li CSR tuzadi.
+ *
+ * @param {string[]} domains - Sertifikat qamrab oladigan domenlar (kamida bitta).
+ * @returns {CsrResult}
+ */
+function createCsr(domains) {
+  if (!Array.isArray(domains) || domains.length === 0) {
+    throw new Error('createCsr(): kamida bitta domen kerak.');
+  }
+
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+
+  // Subject: CN = birinchi domen.
+  const subject = seq(set(seq(oid(OID_CN), utf8(domains[0]))));
+
+  // SubjectPublicKeyInfo — Node'ning tayyor SPKI DER eksporti.
+  const spki = publicKey.export({ type: 'spki', format: 'der' });
+
+  // CertificationRequestInfo ::= SEQ { version(0), subject, SPKI, [0] attributes }
+  const cri = seq(int(0), subject, spki, buildAttributes(domains));
+
+  // CRI ni domen kaliti bilan imzolaymiz (ECDSA-SHA256, DER imzo).
+  const signature = crypto.sign('SHA256', cri, { key: privateKey, dsaEncoding: 'der' });
+
+  const sigAlg = seq(oid(OID_ECDSA_SHA256));
+  // BIT STRING: birinchi bayt — ishlatilmagan bitlar soni (0).
+  const sigBitString = tlv(0x03, Buffer.concat([Buffer.from([0x00]), signature]));
+
+  const csrDer = seq(cri, sigAlg, sigBitString);
+
+  const csrPem =
+    '-----BEGIN CERTIFICATE REQUEST-----\n' +
+    (csrDer.toString('base64').match(/.{1,64}/g) || []).join('\n') +
+    '\n-----END CERTIFICATE REQUEST-----\n';
+
+  return {
+    csrDerBase64Url: csrDer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''),
+    csrDer,
+    csrPem,
+    privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+    privateKey,
+  };
+}
+
+module.exports = {
+  createCsr,
+  // Ichki yordamchilar (test uchun ochiq).
+  _internal: { encodeLength, tlv, seq, set, int, utf8, octet, oid, buildSanValue },
+};