@andrewheberle/serverless-ssh-ca 0.17.5 → 0.17.7

package/dist/src/sshsig/formats.js

@@ -1,174 +0,0 @@
-export function parsePubkey(pk_algo, publickey, raw_publickey) {
-    let pubkey;
-    if (pk_algo === "ssh-rsa") {
-        pubkey = {
-            pk_algo,
-            e: new Uint8Array(publickey.readString().bytes()),
-            n: new Uint8Array(publickey.readString().bytes()),
-            toString() {
-                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
-            },
-        };
-    }
-    else if (pk_algo === "ssh-ed25519") {
-        pubkey = {
-            pk_algo,
-            key: new Uint8Array(publickey.readString().bytes()),
-            toString() {
-                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
-            },
-        };
-    }
-    else if (pk_algo === "sk-ssh-ed25519@openssh.com") {
-        const key = new Uint8Array(publickey.readString().bytes());
-        const application = publickey.readString().toString();
-        pubkey = {
-            pk_algo,
-            key,
-            application,
-            toString() {
-                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
-            },
-        };
-    }
-    else if (pk_algo === "ecdsa-sha2-nistp256" || pk_algo === "ecdsa-sha2-nistp384" ||
-        pk_algo === "ecdsa-sha2-nistp521") {
-        const curve = publickey.readString().toString();
-        const point = new Uint8Array(publickey.readString().bytes());
-        pubkey = {
-            pk_algo,
-            curve,
-            point,
-            toString() {
-                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
-            },
-        };
-    }
-    else if (pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
-        const curve = publickey.readString().toString();
-        const point = new Uint8Array(publickey.readString().bytes());
-        const application = publickey.readString().toString();
-        pubkey = {
-            pk_algo,
-            curve,
-            point,
-            application,
-            toString() {
-                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
-            },
-        };
-    }
-    else {
-        throw new Error(`Unsupported pk_algo: ${pk_algo}`);
-    }
-    return pubkey;
-}
-function base64Encode(bytes) {
-    return btoa(String.fromCharCode.apply(null, bytes));
-}
-function base64UrlEncode(bytes) {
-    return base64Encode(bytes)
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=/g, "");
-}
-export function convertPublicKey(publickey) {
-    const pk_algo = publickey.pk_algo;
-    if (pk_algo === "ssh-rsa") {
-        return {
-            keyData: {
-                kty: "RSA",
-                e: base64UrlEncode(publickey.e),
-                n: base64UrlEncode(publickey.n),
-            },
-            format: "jwk",
-        };
-    }
-    else if (pk_algo === "ssh-ed25519" || pk_algo === "sk-ssh-ed25519@openssh.com") {
-        return {
-            keyData: publickey.key.buffer,
-            format: "raw",
-        };
-    }
-    else if (pk_algo === "ecdsa-sha2-nistp256" || pk_algo === "ecdsa-sha2-nistp384" ||
-        pk_algo === "ecdsa-sha2-nistp521" ||
-        pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
-        if (publickey.point[0] !== 0x04) {
-            throw new Error("Only uncompressed (0x04) format is supported");
-        }
-        const point = publickey.point.slice(1);
-        let crv;
-        if (pk_algo === "ecdsa-sha2-nistp256" ||
-            pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
-            crv = "P-256";
-        }
-        else if (pk_algo === "ecdsa-sha2-nistp384") {
-            crv = "P-384";
-        }
-        {
-            crv = "P-521";
-        }
-        return {
-            keyData: {
-                kty: "EC",
-                crv,
-                x: base64UrlEncode(point.slice(0, point.length / 2)),
-                y: base64UrlEncode(point.slice(point.length / 2)),
-            },
-            format: "jwk",
-        };
-    }
-    else {
-        throw new Error(`Unsupported algo: ${pk_algo}`);
-    }
-}
-export function convertAlgorithm(sig_algo) {
-    if (sig_algo === "rsa-sha2-512") {
-        return {
-            name: "RSASSA-PKCS1-v1_5",
-            hash: { name: "SHA-512" },
-        };
-    }
-    else if (sig_algo === "ssh-ed25519" || sig_algo === "sk-ssh-ed25519@openssh.com") {
-        return {
-            name: "Ed25519",
-            hash: { name: "SHA-512" },
-        };
-    }
-    else if (sig_algo === "ecdsa-sha2-nistp256" ||
-        sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
-        return {
-            name: "ECDSA",
-            namedCurve: "P-256",
-            hash: { name: "SHA-256" },
-        };
-    }
-    else if (sig_algo === "ecdsa-sha2-nistp384") {
-        return {
-            name: "ECDSA",
-            namedCurve: "P-384",
-            hash: { name: "SHA-384" },
-        };
-    }
-    else if (sig_algo === "ecdsa-sha2-nistp521") {
-        return {
-            name: "ECDSA",
-            namedCurve: "P-521",
-            hash: { name: "SHA-512" },
-        };
-    }
-    else {
-        throw new Error(`Unsupported algo: ${sig_algo}`);
-    }
-}
-export function convertHash(hashName) {
-    if (hashName === "sha256") {
-        return "SHA-256";
-    }
-    else if (hashName === "sha512") {
-        return "SHA-512";
-    }
-    else {
-        throw new Error(`Unknown hash: ${hashName}`);
-    }
-}

package/dist/src/sshsig/index.d.ts

@@ -1,15 +0,0 @@
-import { Sig } from "./sig";
-/**
- * Verifies SSH signature against provided data.
- *
- * Returns `true` if the `signature` is a valid signature over `signed_data`, `false` otherwise.
- *
- * @param {Sig | string} signature SSH signature.
- * @param {Uint8Array | string} signed_data Data that has been signed.
- * @param {object} options Pass-in subtle crypto if required or a specific namespace.
- * @returns {Promise<boolean>} Resolves to true if the signature is valid, to false otherwise.
- */
-export declare function verify(signature: Sig | string, signed_data: Uint8Array | string, options?: {
-    subtle?: SubtleCrypto;
-    namespace?: string;
-}): Promise<boolean>;

package/dist/src/sshsig/index.js

@@ -1,31 +0,0 @@
-import { verify as rawVerify } from "./verifier";
-import { parse } from "./sig_parser";
-/**
- * Verifies SSH signature against provided data.
- *
- * Returns `true` if the `signature` is a valid signature over `signed_data`, `false` otherwise.
- *
- * @param {Sig | string} signature SSH signature.
- * @param {Uint8Array | string} signed_data Data that has been signed.
- * @param {object} options Pass-in subtle crypto if required or a specific namespace.
- * @returns {Promise<boolean>} Resolves to true if the signature is valid, to false otherwise.
- */
-export async function verify(signature, signed_data, options) {
-    if (typeof options === "undefined") {
-        options = {};
-    }
-    const subtle = options.subtle || crypto.subtle;
-    if (typeof signature === "string") {
-        signature = parse(signature);
-    }
-    // check namespace matches if provided in options, otherwise default to
-    // signature's namespace. Reject if they don't match.
-    const namespace = options.namespace || signature.namespace;
-    if (namespace !== signature.namespace) {
-        return false;
-    }
-    if (typeof signed_data === "string") {
-        signed_data = new TextEncoder().encode(signed_data);
-    }
-    return await rawVerify(subtle, signature, signed_data);
-}

package/dist/src/sshsig/reader.d.ts

@@ -1,20 +0,0 @@
-/**
- * Byte stream reader helper.
- *
- * This class exposes several helper functions for reading SSH structured data.
- */
-export declare class Reader {
-    private view;
-    private pos;
-    constructor(view: DataView);
-    readUint8(): number;
-    readUint32(): number;
-    peekUint32(): number;
-    peekBytes(pos: number, num: number): Reader;
-    readBytes(num: number): Reader;
-    readString(): Reader;
-    peekString(): Reader;
-    toString(): string;
-    bytes(): ArrayBuffer | SharedArrayBuffer;
-    get isAtEnd(): boolean;
-}

package/dist/src/sshsig/reader.js

@@ -1,54 +0,0 @@
-/**
- * Byte stream reader helper.
- *
- * This class exposes several helper functions for reading SSH structured data.
- */
-export class Reader {
-    view;
-    pos = 0;
-    constructor(view) {
-        this.view = view;
-        this.view = view;
-    }
-    readUint8() {
-        return this.view.getUint8(this.pos++);
-    }
-    readUint32() {
-        const v = this.peekUint32();
-        this.pos += 4;
-        return v;
-    }
-    peekUint32() {
-        return this.view.getUint32(this.pos);
-    }
-    peekBytes(pos, num) {
-        const dv = new DataView(this.view.buffer, pos + this.view.byteOffset, num);
-        return new Reader(dv);
-    }
-    readBytes(num) {
-        const reader = this.peekBytes(this.pos, num);
-        this.pos += num;
-        return reader;
-    }
-    readString() {
-        const len = this.readUint32();
-        return this.readBytes(len);
-    }
-    peekString() {
-        const len = this.peekUint32();
-        return this.peekBytes(this.pos + 4, len);
-    }
-    toString() {
-        let s = "";
-        for (let i = 0; i < this.view.byteLength; i++) {
-            s += String.fromCharCode(this.view.getUint8(i));
-        }
-        return s;
-    }
-    bytes() {
-        return this.view.buffer.slice(this.view.byteOffset + this.pos, this.view.byteOffset + this.view.byteLength);
-    }
-    get isAtEnd() {
-        return this.pos == this.view.byteLength;
-    }
-}

package/dist/src/sshsig/sig.d.ts

@@ -1,16 +0,0 @@
-import { Pubkey } from "./formats";
-/**
- * Represents a parsed SSH signature.
- */
-export interface Sig {
-    publickey: Pubkey;
-    namespace: string;
-    reserved: ArrayBuffer;
-    hash_algorithm: string;
-    signature: {
-        sig_algo: string;
-        raw_signature: ArrayBuffer;
-        flags?: number;
-        counter?: number;
-    };
-}

package/dist/src/sshsig/sig.js

@@ -1 +0,0 @@
-export {};

package/dist/src/sshsig/sig_parser.d.ts

@@ -1,9 +0,0 @@
-import { Sig } from "./sig";
-/**
- * Parse bytes into an SSH signature object.
- *
- * This function throws an Error when the signature is invalid or unsupported.
- *
- * @param {DataView | string} signature Raw bytes to parse.
- */
-export declare function parse(signature: DataView | string): Sig;

package/dist/src/sshsig/sig_parser.js

@@ -1,83 +0,0 @@
-import { Reader } from "./reader";
-import { parsePubkey } from "./formats";
-import { dearmor } from "./armor";
-/**
- * Parse bytes into an SSH signature object.
- *
- * This function throws an Error when the signature is invalid or unsupported.
- *
- * @param {DataView | string} signature Raw bytes to parse.
- */
-export function parse(signature) {
-    let view;
-    if (typeof signature === "string") {
-        const bytes = dearmor(signature);
-        view = new DataView(bytes.buffer, bytes.byteOffset, bytes.length);
-    }
-    else {
-        view = signature;
-    }
-    const reader = new Reader(view);
-    const magic = reader.readBytes(6).toString();
-    if (magic !== "SSHSIG") {
-        throw new Error("Expected SSHSIG magic value but got unexpected bytes");
-    }
-    const version = reader.readUint32();
-    if (version !== 1) {
-        throw new Error("Expected version 1 but got unexpected version");
-    }
-    const raw_publickey = reader.peekString().bytes();
-    const publickey = reader.readString();
-    const pk_algo = publickey.readString().toString();
-    const pubkey = parsePubkey(pk_algo, publickey, raw_publickey);
-    const namespace = reader.readString().toString();
-    const reserved = reader.readString().bytes();
-    const hash_algorithm = reader.readString().toString();
-    const raw_signature = reader.readString();
-    const sig_algo = raw_signature.readString().toString();
-    const sig_bytes = raw_signature.readString();
-    let bytes;
-    if (sig_algo === "ecdsa-sha2-nistp256" || sig_algo === "ecdsa-sha2-nistp384" ||
-        sig_algo === "ecdsa-sha2-nistp512" ||
-        sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
-        let r = new Uint8Array(sig_bytes.readString().bytes());
-        if (r.length === 0) {
-            throw new Error("invalid ECDSA signature component");
-        }
-        if (r[0] === 0x00 && r.length % 2 == 1) {
-            r = r.slice(1);
-        }
-        let s = new Uint8Array(sig_bytes.readString().bytes());
-        if (s.length === 0) {
-            throw new Error("invalid ECDSA signature component");
-        }
-        if (s[0] === 0x00 && s.length % 2 == 1) {
-            s = s.slice(1);
-        }
-        bytes = new Uint8Array([...r, ...s]);
-    }
-    else {
-        bytes = sig_bytes.bytes();
-    }
-    let flags, counter;
-    if (sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com" ||
-        sig_algo == "sk-ssh-ed25519@openssh.com") {
-        flags = new Uint8Array(raw_signature.readBytes(1).bytes())[0];
-        counter = raw_signature.readUint32();
-    }
-    if (!reader.isAtEnd) {
-        throw new Error("Signature was parsed but there were still bytes in the stream.");
-    }
-    return {
-        publickey: pubkey,
-        namespace,
-        reserved,
-        hash_algorithm,
-        signature: {
-            sig_algo,
-            raw_signature: bytes,
-            flags,
-            counter,
-        },
-    };
-}

package/dist/src/sshsig/verifier.d.ts

@@ -1,2 +0,0 @@
-import { Sig } from "./sig";
-export declare function verify(subtle: SubtleCrypto, signature: Sig, signed_data: Uint8Array): Promise<boolean>;

package/dist/src/sshsig/verifier.js

@@ -1,37 +0,0 @@
-import { convertAlgorithm, convertHash, convertPublicKey } from "./formats";
-import { Writer } from "./writer";
-export async function verify(subtle, signature, signed_data) {
-    //https://nodejs.org/api/webcrypto.html#subtleimportkeyformat-keydata-algorithm-extractable-keyusages
-    // for 'RSASSA-PKCS1-v1_5' only spki, pkcs8 and jwk are supported
-    // https://stackoverflow.com/questions/46232571/webcrypto-importing-rsa-public-key-with-modulus-and-exponent-using-crypto-subtl
-    const { keyData, format } = convertPublicKey(signature.publickey);
-    const algorithm = convertAlgorithm(signature.signature.sig_algo);
-    const key = await subtle.importKey(format, keyData, algorithm, false, [
-        "verify",
-    ]);
-    const writer = new Writer(96 + signature.namespace.length);
-    // https://github.com/openssh/openssh-portable/blob/d575cf44895104e0fcb0629920fb645207218129/PROTOCOL.sshsig
-    // MAGIC_PREAMBLE
-    writer.writeBytes("SSHSIG");
-    // namespace
-    writer.writeString(signature.namespace);
-    // reserved
-    writer.writeUint32(0);
-    // hash_algorithm
-    const hash = signature.hash_algorithm;
-    writer.writeString(hash);
-    const digest = new Uint8Array(await subtle.digest(convertHash(hash), signed_data));
-    writer.writeString(digest);
-    const data = writer.bytes();
-    if (signature.publickey.pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com" ||
-        signature.publickey.pk_algo === "sk-ssh-ed25519@openssh.com") {
-        // https://fuchsia.googlesource.com/third_party/openssh-portable/+/refs/heads/main/PROTOCOL.u2f#176
-        const u2f_data = new Writer(100);
-        u2f_data.writeBytes(await subtle.digest("SHA-256", Uint8Array.from(Array.prototype.map.call(signature.publickey.application, (x) => x.charCodeAt(0)))));
-        u2f_data.writeByte(signature.signature.flags || 0);
-        u2f_data.writeUint32(signature.signature.counter || 0);
-        u2f_data.writeBytes(await subtle.digest("SHA-256", data));
-        return await subtle.verify(algorithm, key, signature.signature.raw_signature, u2f_data.bytes());
-    }
-    return await subtle.verify(algorithm, key, signature.signature.raw_signature, data);
-}

package/dist/src/sshsig/writer.d.ts

@@ -1,17 +0,0 @@
-/**
- * Byte stream writer helper.
- *
- * This class exposes several helper functions for writing bytes into a buffer.
- */
-export declare class Writer {
-    private pos;
-    private buffer;
-    private view;
-    constructor(maxByteLength: number);
-    private addResize;
-    writeUint32(num: number): void;
-    writeString(bytes: ArrayLike<number> | string): void;
-    writeBytes(bytes: ArrayLike<number> | string | ArrayBuffer): void;
-    writeByte(byte: number): void;
-    bytes(): Uint8Array<ArrayBuffer>;
-}

package/dist/src/sshsig/writer.js

@@ -1,51 +0,0 @@
-/**
- * Byte stream writer helper.
- *
- * This class exposes several helper functions for writing bytes into a buffer.
- */
-export class Writer {
-    pos = 0;
-    buffer;
-    view;
-    constructor(maxByteLength) {
-        this.buffer = new ArrayBuffer(0, { maxByteLength });
-        this.view = new DataView(this.buffer);
-    }
-    addResize(num) {
-        this.buffer.resize(this.buffer.byteLength + num);
-    }
-    writeUint32(num) {
-        this.addResize(4);
-        this.view.setUint32(this.pos, num);
-        this.pos += 4;
-    }
-    writeString(bytes) {
-        this.writeUint32(bytes.length);
-        this.writeBytes(bytes);
-    }
-    writeBytes(bytes) {
-        let uint8bytes;
-        if (typeof bytes === "string") {
-            uint8bytes = Array.prototype.map.call(bytes, (x) => x.charCodeAt(0));
-        }
-        else if (bytes instanceof ArrayBuffer) {
-            uint8bytes = new Uint8Array(bytes);
-        }
-        else {
-            uint8bytes = bytes;
-        }
-        // it's more efficient to resize once and write all bytes
-        // instead of calling `writeByte` in each iteration
-        this.addResize(uint8bytes.length);
-        for (let i = 0; i < uint8bytes.length; i++) {
-            this.view.setUint8(this.pos++, uint8bytes[i]);
-        }
-    }
-    writeByte(byte) {
-        this.addResize(1);
-        this.view.setUint8(this.pos++, byte);
-    }
-    bytes() {
-        return new Uint8Array(this.buffer);
-    }
-}

package/dist/src/types.d.ts

@@ -1,42 +0,0 @@
-import { JWTPayload } from "jose";
-export type CertificateSignerPayload = {
-    public_key: string;
-    identity: string;
-    extensions?: string[];
-    lifetime?: number;
-    nonce?: string;
-};
-export type CertificateSignerResponse = {
-    certificate: string;
-};
-export type CertificateRequestJWTPayload = {
-    email: string;
-    sub: string;
-    [key: string]: string | string[];
-} & JWTPayload;
-export type SSHExtension = {
-    critical: boolean;
-    name: string;
-    data: Buffer<ArrayBuffer>;
-};
-export interface SshCaBindings {
-    DB: D1Database;
-    DB_CERTIFICATE_RETENTION: string;
-    PRIVATE_KEY: SecretsStoreSecret;
-    SSH_CERTIFICATE_EXTENSIONS: string;
-    SSH_CERTIFICATE_LIFETIME: string;
-    SSH_CERTIFICATE_INCLUDE_SELF: string;
-    SSH_CERTIFICATE_PRINCIPALS: string;
-    SSH_HOST_CERTIFICATE_LIFETIME: string;
-    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: string;
-    SSH_HOST_CERTIFICATE_ALLOWED_ROLES: string;
-    ISSUER_DN: string;
-    JWT_JWKS_URL: string;
-    JWT_AUD: string;
-    JWT_ISSUER: string;
-    JWT_ALGORITHMS: string;
-    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
-    SSH_HOST_CERTIFICATE_ALLOWED_ROLES_CLAIM: string;
-    CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
-    LOG_LEVEL: string;
-}

package/dist/src/types.js

@@ -1,20 +0,0 @@
-export {};
-/*
-ISSUER_DN: "CN=SSH CA,O=Internet Widgets Pty Ltd,C=US";
-        JWT_JWKS_URL: "https://idp.example.com/.well-known/jwks.json";
-        JWT_AUD: "audience";
-        JWT_ISSUER: "https://idp.example.com";
-        JWT_ALGORITHMS: "RS256";
-        JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: "groups";
-        SSH_CERTIFICATE_LIFETIME: "24 hours";
-        SSH_CERTIFICATE_PRINCIPALS: "ssh-admin";
-        SSH_CERTIFICATE_INCLUDE_SELF: "false";
-        SSH_CERTIFICATE_EXTENSIONS: "permit-X11-forwarding,permit-agent-forwarding,permit-port-forwarding,permit-pty,permit-user-rc";
-        SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: "";
-        SSH_HOST_CERTIFICATE_ALLOWED_ROLES: "";
-        SSH_HOST_CERTIFICATE_ALLOWED_ROLES_CLAIM: "groups";
-        SSH_HOST_CERTIFICATE_LIFETIME: "30 days";
-        CERTIFICATE_REQUEST_TIME_SKEW_MAX: "90 seconds";
-        DB_CERTIFICATE_RETENTION: "1 year";
-        LOG_LEVEL: "info"
-        */

package/dist/src/utils.d.ts

@@ -1,76 +0,0 @@
-import { Certificate, Key, PrivateKey } from "sshpk";
-import z from "zod";
-import { CertificateRequestJWTPayload } from "./types";
-import { RenewalProofOfPossession, ProofOfPossession } from "./proof";
-export declare const fatalIssue: (ctx: z.RefinementCtx, message: string, val: unknown) => never;
-export declare const transformProofOfPossession: (val: string, ctx: z.core.$RefinementCtx<string>) => ProofOfPossession | never;
-type AccessToken = {
-    email: string;
-    sub: string;
-};
-export declare const transformAuthorizationHeader: (val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
-export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Key | never;
-export declare const identityPrincipals: (payload: CertificateRequestJWTPayload, claim?: string) => string[];
-type IdentityToken = {
-    sub: string;
-    principals: string[];
-};
-export declare const parseIdentity: (jwt: string | undefined, claim?: string) => Promise<IdentityToken>;
-export declare const transformIdentityToken: (val: string, ctx: z.RefinementCtx) => Promise<IdentityToken | never>;
-/**
- *
- * @param val A SSH certificate either a base64 encoded "string" or a "Buffer\<ArrayBufferLike\>"
- * @param ctx The Zod context for any errors
- * @returns
- */
-export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Certificate | never;
-type ParsedCertificateRequest = {
-    proof: ProofOfPossession;
-    public_key: Key;
-    lifetime: number;
-    identity: IdentityToken;
-    extensions: string[];
-};
-export declare const refineCertificateRequest: (val: ParsedCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
-type LegacyParsedCertificateRequest = {
-    nonce: ProofOfPossession;
-    public_key: Key;
-    lifetime: number;
-    identity: string;
-    extensions: string[];
-};
-export declare const refineLegacyCertificateRequest: (val: LegacyParsedCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
-export declare const transformRenewalProofOfPossession: (val: string, ctx: z.RefinementCtx) => RenewalProofOfPossession | never;
-type HostCertificateRequest = {
-    public_key: Key;
-    lifetime: number;
-};
-type ParsedHostCertificateRequest = {
-    principals: string[];
-    proof: ProofOfPossession;
-} & HostCertificateRequest;
-export declare const refineHostCertificateRequest: (val: ParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
-type LegacyParsedHostCertificateRequest = {
-    principals: string[];
-    nonce: ProofOfPossession;
-} & HostCertificateRequest;
-export declare const refineLegacyHostCertificateRequest: (val: LegacyParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
-type ParsedHostCertificateRenewal = {
-    certificate: Certificate;
-    proof: RenewalProofOfPossession;
-} & HostCertificateRequest;
-export declare const refineHostCertificateRenewal: (val: ParsedHostCertificateRenewal, ctx: z.RefinementCtx) => Promise<never>;
-type ParsedRevokeCertificate = {
-    serial: bigint;
-    public_key: Key;
-    proof: ProofOfPossession;
-};
-export declare const refineRevokeCertificate: (val: ParsedRevokeCertificate, ctx: z.RefinementCtx) => Promise<never>;
-type LegacyParsedHostCertificateRenewal = {
-    certificate: Certificate;
-    nonce: ProofOfPossession;
-} & HostCertificateRequest;
-export declare const refineLegacyHostCertificateRenewal: (val: LegacyParsedHostCertificateRenewal, ctx: z.RefinementCtx) => Promise<never>;
-export declare const split: (v: string) => string[];
-export declare const getPublic: (key?: PrivateKey) => Promise<Key>;
-export {};