@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/dist/db/index.js

@@ -1,12 +1,10 @@
+import { PublicKey } from "../ssh/keys.js";
 import { logger } from "../logger.js";
 import { D1QB } from "workers-qb";
+import { z } from "zod";
 import { migrateOnce } from "./migrate.js";
 import { migrations } from "./migrations/index.js";
-export var CertificateType;
-(function (CertificateType) {
-    CertificateType[CertificateType["User"] = 0] = "User";
-    CertificateType[CertificateType["Host"] = 1] = "Host";
-})(CertificateType || (CertificateType = {}));
+import { CertificateType } from "./types.js";
 const connect = async (env) => {
     const l = logger(env);
     try {
@@ -43,26 +41,21 @@ export const dbCleanup = async (env) => {
     }
 };
 export const recordCertificate = async (env, certificate, keyid, certificateType = CertificateType.User) => {
-    const serial = certificate.serial.readBigUInt64BE(0);
-    const subjects = certificate.subjects.map((v) => {
-        return v.toString();
-    }).join(",");
-    const extensions = certificate.getExtensions().map((v) => {
-        // @ts-expect-error: the name property does exist
-        return v.name;
-    }).join(",");
+    // principals are recorded as distinguished names, as they were when
+    // certificates were created with sshpk
+    const principals = certificate.principals.map((p) => `${certificate.kind === "host" ? "CN" : "UID"}=${p}`).join(",");
     const qb = await connect(env);
     const res = await qb.insert({
         tableName: "certificates",
         data: {
-            serial: `${serial}`,
+            serial: `${certificate.serial}`,
             key_id: keyid,
-            principals: subjects,
-            extensions: extensions,
-            valid_after: certificate.validFrom.toISOString(),
-            valid_before: certificate.validUntil.toISOString(),
+            principals: principals,
+            extensions: certificate.extensions.join(","),
+            valid_after: certificate.validAfter.toISOString(),
+            valid_before: certificate.validBefore.toISOString(),
             certificate_type: certificateType,
-            public_key: certificate.subjectKey.toString("ssh")
+            public_key: certificate.publicKey.toString()
         },
     }).execute();
     if (!res.success) {
@@ -86,31 +79,53 @@ export var RevocationStatus;
     RevocationStatus[RevocationStatus["NotFound"] = 0] = "NotFound";
     RevocationStatus[RevocationStatus["Revoked"] = 1] = "Revoked";
     RevocationStatus[RevocationStatus["Revokable"] = 2] = "Revokable";
-    RevocationStatus[RevocationStatus["Unrevokable"] = 3] = "Unrevokable";
 })(RevocationStatus || (RevocationStatus = {}));
-export const revocationStatus = async (env, serial, publickey, certificateType) => {
+// whether a public key recorded in OpenSSH format is the same as another key,
+// treating a recorded key that cannot be parsed as a different key
+const isKey = (recorded, publicKey) => {
+    try {
+        return PublicKey.parse(recorded).equals(publicKey);
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export const revocationStatus = async (env, serial, publicKey, certificateType) => {
     const qb = await connect(env);
     const res = await qb.fetchOne({
         tableName: "certificates",
         fields: ["public_key", "revoked_at"],
         where: {
-            conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
-            params: [`${serial}`, publickey, certificateType]
+            conditions: "serial = ? AND certificate_type = ?",
+            params: [`${serial}`, certificateType]
         }
     }).execute();
-    if (res.results === undefined) {
+    // a certificate issued for another key is reported as not found, so
+    // requests cannot be used to discover which serials exist
+    if (res.results?.public_key == null || !isKey(res.results.public_key, publicKey)) {
         return RevocationStatus.NotFound;
     }
     if (res.results.revoked_at !== null) {
         return RevocationStatus.Revoked;
     }
-    if (publickey === res.results.public_key) {
-        return RevocationStatus.Revokable;
-    }
-    return RevocationStatus.Unrevokable;
+    return RevocationStatus.Revokable;
 };
 export const getRevocationList = async (env, certificateType) => {
     const qb = await connect(env);
+    // fetchAll cannot infer the table from its parameters, so it is given explicitly
+    // as otherwise the result is untyped once the schema has more than one table
     const res = await qb.fetchAll({
         tableName: "certificates",
         fields: ["serial"],
@@ -148,4 +163,62 @@ export const revokeCertificate = async (env, serial) => {
     }
     return res.results;
 };
+const KrlVersionRow = z.object({
+    version: z.number().int().nonnegative(),
+    digest: z.string().nullable(),
+});
+// the number of times to retry when another request updates the KRL version concurrently
+const KRL_VERSION_ATTEMPTS = 5;
+/**
+ * Get the version of the KRL for a certificate type, incrementing it if the
+ * content of the KRL has changed since the version was last returned.
+ *
+ * The version is only ever incremented, so clients can use it to detect a
+ * newer KRL. When several requests see the same change concurrently the
+ * version is incremented once.
+ *
+ * @param env The bindings for the CA, see {@link SshCaBindings}
+ * @param certificateType The type of certificates in the KRL, see {@link CertificateType}
+ * @param digest A digest of the content of the KRL, which changes whenever the content does
+ * @returns The version to use for the KRL
+ */
+export const getKrlVersion = async (env, certificateType, digest) => {
+    const qb = await connect(env);
+    for (let attempt = 0; attempt < KRL_VERSION_ATTEMPTS; attempt++) {
+        const res = await qb.fetchOne({
+            tableName: "krl",
+            fields: ["version", "digest"],
+            where: {
+                conditions: "certificate_type = ?",
+                params: certificateType
+            }
+        }).execute();
+        const current = KrlVersionRow.parse(res.results);
+        if (current.digest === digest) {
+            return BigInt(current.version);
+        }
+        // only update if the version has not been changed by another request
+        const next = current.version + 1;
+        const updated = await qb.update({
+            tableName: "krl",
+            data: {
+                version: next,
+                digest: digest,
+                updated_at: (new Date).toISOString()
+            },
+            where: {
+                conditions: "certificate_type = ? AND version = ?",
+                params: [certificateType, current.version]
+            },
+            returning: ["version"]
+        }).execute();
+        if (!updated.success) {
+            throw new Error("error during query");
+        }
+        if (updated.results !== undefined && updated.results.length > 0) {
+            return BigInt(next);
+        }
+    }
+    throw new Error("unable to update KRL version due to concurrent updates");
+};
 //# sourceMappingURL=index.js.map

package/dist/db/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAElD,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IAC1B,qDAAI,CAAA;IACJ,qDAAI,CAAA;AACL,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAmBD,MAAM,OAAO,GAAG,KAAK,EAAE,GAAkB,EAAiC,EAAE;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAEjC,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAE/D,CAAC,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,EAAE,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAErI,OAAO,IAAI,IAAI,CAAiB,GAAG,CAAC,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACrD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAErE,IAAI,GAAG,CAAC,wBAAwB,KAAK,UAAU,EAAE,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACnC,OAAM;IACP,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE;gBACN,UAAU,EAAE,0DAA0D;gBACtE,MAAM,EAAE,GAAG,CAAC,wBAAwB;aACpC;SACD,CAAC,CAAC,OAAO,EAAE,CAAA;QACZ,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,+BAA+B,EAAE,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,WAAwB,EAAE,KAAa,EAAE,eAAe,GAAoB,eAAe,CAAC,IAAI,EAAE,EAAE;IAC/J,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAU,EAAE;QACjE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;IACpB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAuD,EAAU,EAAE;QACtH,iDAAiD;QACjD,OAAO,CAAC,CAAC,IAAc,CAAA;IACxB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,MAAM,EAAE,GAAG,MAAM,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE;YAChD,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE;YAClD,gBAAgB,EAAE,eAAe;YACjC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SAClD;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAoB,EAAE;IACvF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAA;AACjC,CAAC,CAAA;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC3B,+DAAQ,CAAA;IACR,6DAAO,CAAA;IACP,iEAAS,CAAA;IACT,qEAAW,CAAA;AACZ,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAE,SAAiB,EAAE,eAAgC,EAA6B,EAAE;IAC5J,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACpC,KAAK,EAAE;YACN,UAAU,EAAE,wDAAwD;YACpE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;SACjD;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,QAAQ,CAAA;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC,OAAO,CAAA;IAChC,CAAC;IAED,IAAI,SAAS,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,gBAAgB,CAAC,SAAS,CAAA;IAClC,CAAC;IAED,OAAO,gBAAgB,CAAC,WAAW,CAAA;AACpC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,eAAgC,EAAqB,EAAE;IAClH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mHAAmH;YAC/H,MAAM,EAAE,eAAe;SACvB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC,CAAA;AAID,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAiC,EAAE;IAC5G,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAqB;QAC/C,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;SACpC;QACD,KAAK,EAAE;YACN,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;QACD,SAAS,EAAE,CAAC,YAAY,CAAC;KACzB,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAA;AACnB,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,eAAe,EAA+D,MAAM,YAAY,CAAA;AAEzG,MAAM,OAAO,GAAG,KAAK,EAAE,GAAkB,EAAiC,EAAE;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAEjC,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAE/D,CAAC,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,EAAE,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAErI,OAAO,IAAI,IAAI,CAAiB,GAAG,CAAC,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACrD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAErE,IAAI,GAAG,CAAC,wBAAwB,KAAK,UAAU,EAAE,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACnC,OAAM;IACP,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE;gBACN,UAAU,EAAE,0DAA0D;gBACtE,MAAM,EAAE,GAAG,CAAC,wBAAwB;aACpC;SACD,CAAC,CAAC,OAAO,EAAE,CAAA;QACZ,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,+BAA+B,EAAE,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,WAA2B,EAAE,KAAa,EAAE,eAAe,GAAoB,eAAe,CAAC,IAAI,EAAE,EAAE;IAClK,oEAAoE;IACpE,uCAAuC;IACvC,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE;YAC/B,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5C,WAAW,EAAE,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE;YACjD,YAAY,EAAE,WAAW,CAAC,WAAW,CAAC,WAAW,EAAE;YACnD,gBAAgB,EAAE,eAAe;YACjC,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE;SAC5C;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAoB,EAAE;IACvF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAA;AACjC,CAAC,CAAA;AAED,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC3B,+DAAQ,CAAA;IACR,6DAAO,CAAA;IACP,iEAAS,CAAA;AACV,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,SAAoB,EAAW,EAAE;IACjE,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAE,SAAoB,EAAE,eAAgC,EAA6B,EAAE;IAC/J,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACpC,KAAK,EAAE;YACN,UAAU,EAAE,qCAAqC;YACjD,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,eAAe,CAAC;SACtC;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,oEAAoE;IACpE,0DAA0D;IAC1D,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;QAClF,OAAO,gBAAgB,CAAC,QAAQ,CAAA;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC,OAAO,CAAA;IAChC,CAAC;IAED,OAAO,gBAAgB,CAAC,SAAS,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,eAAgC,EAAqB,EAAE;IAClH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA2B;QACvD,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mHAAmH;YAC/H,MAAM,EAAE,eAAe;SACvB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC,CAAA;AAID,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAiC,EAAE;IAC5G,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAqB;QAC/C,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;SACpC;QACD,KAAK,EAAE;YACN,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;QACD,SAAS,EAAE,CAAC,YAAY,CAAC;KACzB,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,eAAgC,EAAE,MAAc,EAAmB,EAAE;IAC5H,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAE7B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;YAC7B,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC7B,KAAK,EAAE;gBACN,UAAU,EAAE,sBAAsB;gBAClC,MAAM,EAAE,eAAe;aACvB;SACD,CAAC,CAAC,OAAO,EAAE,CAAA;QAEZ,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QAED,qEAAqE;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAA6B;YAC3D,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;aACpC;YACD,KAAK,EAAE;gBACN,UAAU,EAAE,sCAAsC;gBAClD,MAAM,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC;aAC1C;YACD,SAAS,EAAE,CAAC,SAAS,CAAC;SACtB,CAAC,CAAC,OAAO,EAAE,CAAA;QAEZ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACtC,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;IACF,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;AAC1E,CAAC,CAAA"}

package/dist/db/migrations/0002_krl_version.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const migration: Migration;
+//# sourceMappingURL=0002_krl_version.d.ts.map

package/dist/db/migrations/0002_krl_version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0002_krl_version.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/0002_krl_version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9C,eAAO,MAAM,SAAS,EAAE,SAavB,CAAA"}

package/dist/db/migrations/0002_krl_version.js

@@ -0,0 +1,15 @@
+export const migration = {
+    name: "0002_krl_version",
+    statements: [
+        `CREATE TABLE IF NOT EXISTS krl (
+			certificate_type INTEGER PRIMARY KEY,
+			version INTEGER NOT NULL,
+			digest TEXT,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
+		)`,
+        // KRLs were previously always version 1 and have no digest, so the
+        // first KRL generated after this migration is version 2
+        "INSERT OR IGNORE INTO krl (certificate_type, version, digest) VALUES (0, 1, NULL), (1, 1, NULL)",
+    ]
+};
+//# sourceMappingURL=0002_krl_version.js.map

package/dist/db/migrations/0002_krl_version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0002_krl_version.js","sourceRoot":"","sources":["../../../src/db/migrations/0002_krl_version.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAc;IACnC,IAAI,EAAE,kBAAkB;IACxB,UAAU,EAAE;QACX;;;;;IAKE;QACF,mEAAmE;QACnE,wDAAwD;QACxD,iGAAiG;KACjG;CACD,CAAA"}

package/dist/db/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAG9C,eAAO,MAAM,UAAU,EAAE,SAAS,EAEjC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAI9C,eAAO,MAAM,UAAU,EAAE,SAAS,EAGjC,CAAA"}

package/dist/db/migrations/index.js

@@ -1,5 +1,7 @@
 import { migration as initialSchema0001 } from "./0001_initial_schema.js";
+import { migration as krlVersion0002 } from "./0002_krl_version.js";
 export const migrations = [
-    initialSchema0001
+    initialSchema0001,
+    krlVersion0002,
 ];
 //# sourceMappingURL=index.js.map

package/dist/db/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEzE,MAAM,CAAC,MAAM,UAAU,GAAgB;IACtC,iBAAiB;CACjB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAAE,SAAS,IAAI,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEnE,MAAM,CAAC,MAAM,UAAU,GAAgB;IACtC,iBAAiB;IACjB,cAAc;CACd,CAAA"}

package/dist/db/types.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Database types used by workers-qb to type queries.
+ *
+ * These must match the schema created by the migrations in `./migrations`, so
+ * update them with any change to the database.
+ */
+/** The type of certificate, as stored in the `certificate_type` column */
+export declare enum CertificateType {
+    User = 0,
+    Host = 1
+}
+/** A row in the `certificates` table */
+export type CertificateRecord = {
+    id: number;
+    serial: string;
+    key_id: string;
+    principals: string;
+    extensions: string | null;
+    valid_after: Date;
+    valid_before: Date;
+    revoked_at: Date | null;
+    certificate_type: CertificateType;
+    public_key: string | null;
+};
+/** A row in the `krl` table, holding the current version of the KRL for a {@link CertificateType} */
+export type KrlRecord = {
+    certificate_type: CertificateType;
+    version: number;
+    digest: string | null;
+    updated_at: Date;
+};
+/** The tables in the database, used to type queries made with workers-qb */
+export type DatabaseSchema = {
+    certificates: CertificateRecord;
+    krl: KrlRecord;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/db/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/db/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,0EAA0E;AAC1E,oBAAY,eAAe;IAC1B,IAAI,IAAA;IACJ,IAAI,IAAA;CACJ;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,IAAI,CAAA;IACjB,YAAY,EAAE,IAAI,CAAA;IAClB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,GAAG,EAAE,SAAS,CAAA;CACd,CAAA"}

package/dist/db/types.js

@@ -0,0 +1,13 @@
+/**
+ * Database types used by workers-qb to type queries.
+ *
+ * These must match the schema created by the migrations in `./migrations`, so
+ * update them with any change to the database.
+ */
+/** The type of certificate, as stored in the `certificate_type` column */
+export var CertificateType;
+(function (CertificateType) {
+    CertificateType[CertificateType["User"] = 0] = "User";
+    CertificateType[CertificateType["Host"] = 1] = "Host";
+})(CertificateType || (CertificateType = {}));
+//# sourceMappingURL=types.js.map

package/dist/db/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/db/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,0EAA0E;AAC1E,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IAC1B,qDAAI,CAAA;IACJ,qDAAI,CAAA;AACL,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B"}

package/dist/krl.d.ts

@@ -1,4 +1,4 @@
-import type { PrivateKey } from "sshpk";
+import type { PrivateKey } from "./ssh/keys.js";
 export declare class KRLBuilder {
     private readonly _caKey;
     private readonly _serials;
@@ -19,6 +19,14 @@ export declare class KRLBuilder {
      * This must not be called after generate() has been called
      */
     addKeyIds(keyIds: string[]): this;
+    /**
+     * Return a hex encoded SHA-256 digest of the content of the KRL.
+     *
+     * The digest covers the CA public key and the revoked serials and key IDs,
+     * but not the order they were added in or the header, so it only changes
+     * when the set of revoked certificates or the CA does.
+     */
+    digest(): Promise<string>;
     /**
      * Generate the binary KRL
      *

package/dist/krl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"krl.d.ts","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,OAAO,CAAA;AAsQtD,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,IAAI,CAA2B;IAEvC,YAAY,KAAK,EAAE,UAAU,EAE5B;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAMlC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAMhC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAE,MAAW,EAAE,OAAO,SAAK,GAAG,WAAW,CAgE3D;IAED;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CA8DjC;CACJ"}
+{"version":3,"file":"krl.d.ts","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAsF/C,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,IAAI,CAA2B;IAEvC,YAAY,KAAK,EAAE,UAAU,EAE5B;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAMlC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAMhC;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9B;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAE,MAAW,EAAE,OAAO,SAAK,GAAG,WAAW,CAgE3D;IAED;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAqDjC;CACJ"}

package/dist/krl.js

@@ -1,4 +1,4 @@
-import { toFixedWidth } from "./sshsig/sig_parser.js";
+import { createSigner } from "./ssh/signer.js";
 // ── Constants ────────────────────────────────────────────────────────────────
 const KRL_MAGIC = 0x5353484b524c0a00n; // "SSHKRL\n\0"
 const KRL_FORMAT_VERSION = 1;
@@ -47,160 +47,11 @@ function concat(...parts) {
 function encodeSection(sectionType, data) {
     return concat(new Uint8Array([sectionType]), encodeString(data));
 }
-// ── CA public-key extraction ─────────────────────────────────────────────────
-/**
- * Extract the SSH wire-format public key bytes from an sshpk PrivateKey.
- *
- * sshpk's "ssh" format produces a string like:
- *   ssh-ed25519 AAAA...base64... [comment]
- *
- * The base64 blob *is* the SSH wire encoding of the public key, so we just
- * decode it.  This works for both Ed25519 and ECDSA keys.
- */
-function caKeyWireBytes(caKey) {
-    const sshString = caKey.toPublic().toString("ssh");
-    // Format: "<type> <base64> [<comment>]"  — we want the second token.
-    const base64 = sshString.trim().split(/\s+/)[1];
-    if (!base64) {
-        throw new Error("Unexpected sshpk 'ssh' format output: " + sshString);
-    }
-    const binary = atob(base64);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
-}
 // ── Constants ────────────────────────────────────────────────────────────────
 const SSHSIG_MAGIC = new TextEncoder().encode("SSHSIG");
 const SIG_VERSION = 1;
 const NAMESPACE = "krl@com.github.serverless-ssh-ca.andrewheberle";
 const HASH_ALGORITHM = "sha512";
-// ── Helpers ──────────────────────────────────────────────────────────────────
-/**
- * Get the raw bytes of a named part of an sshpk key.
- */
-function keyPart(key, name) {
-    const part = key.parts.find((p) => p.name === name);
-    if (part === undefined) {
-        throw new Error(`Missing ${name} part in ${key.type} key`);
-    }
-    return part.data;
-}
-/**
- * Base64url-encode bytes without padding, as used for JWK values.
- */
-function base64url(bytes) {
-    let binary = "";
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte);
-    }
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/**
- * Import an sshpk PrivateKey into a WebCrypto CryptoKey.
- * Supports Ed25519 and ECDSA (P-256 / P-384 / P-521).
- */
-async function importPrivateKey(caKey) {
-    const type = caKey.type; // "ed25519" | "ecdsa" | etc.
-    const curve = caKey.curve;
-    if (type === "ed25519") {
-        // import from the raw key parts as a JWK rather than via sshpk's PKCS#8
-        // output, which drops a leading zero byte from the seed (about 1 key in
-        // 512) and is then rejected by WebCrypto
-        const seed = keyPart(caKey, "k");
-        const publicKey = keyPart(caKey, "A");
-        if (seed.length !== 32 || publicKey.length !== 32) {
-            throw new Error(`Unexpected Ed25519 key part lengths: k=${seed.length} A=${publicKey.length}`);
-        }
-        const cryptoKey = await crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", d: base64url(seed), x: base64url(publicKey) }, { name: "Ed25519" }, false, ["sign"]);
-        return {
-            cryptoKey,
-            sigAlgo: "ssh-ed25519",
-            webCryptoAlgo: { name: "Ed25519" },
-        };
-    }
-    else if (type === "ecdsa") {
-        let namedCurve;
-        let sigAlgo;
-        let hash;
-        let size; // bytes in each coordinate and the private key
-        if (curve === "nistp256") {
-            namedCurve = "P-256";
-            sigAlgo = "ecdsa-sha2-nistp256";
-            hash = "SHA-256";
-            size = 32;
-        }
-        else if (curve === "nistp384") {
-            namedCurve = "P-384";
-            sigAlgo = "ecdsa-sha2-nistp384";
-            hash = "SHA-384";
-            size = 48;
-        }
-        else if (curve === "nistp521") {
-            namedCurve = "P-521";
-            sigAlgo = "ecdsa-sha2-nistp521";
-            hash = "SHA-512";
-            size = 66;
-        }
-        else {
-            throw new Error(`Unsupported ECDSA curve: ${curve}`);
-        }
-        // import from the raw key parts as a JWK rather than via sshpk's PKCS#8
-        // output, which drops leading zero bytes from the private key so it is
-        // shorter than RFC 5915 requires (about half of P-521 keys)
-        const point = keyPart(caKey, "Q");
-        if (point.length !== 1 + size * 2 || point[0] !== 0x04) {
-            throw new Error(`Unexpected ECDSA public key encoding for ${curve}`);
-        }
-        // d is an SSH mpint, so may be short or have a leading sign byte
-        const d = toFixedWidth(keyPart(caKey, "d"), size);
-        const cryptoKey = await crypto.subtle.importKey("jwk", {
-            kty: "EC",
-            crv: namedCurve,
-            d: base64url(d),
-            x: base64url(point.subarray(1, 1 + size)),
-            y: base64url(point.subarray(1 + size)),
-        }, { name: "ECDSA", namedCurve }, false, ["sign"]);
-        return {
-            cryptoKey,
-            sigAlgo,
-            webCryptoAlgo: { name: "ECDSA", hash: { name: hash } },
-        };
-    }
-    else {
-        throw new Error(`Unsupported key type: ${type}`);
-    }
-}
-/**
- * Convert a WebCrypto ECDSA signature (IEEE P1363: raw r||s) to the SSH wire
- * encoding: string(algo) + string(mpint(r) + mpint(s)).
- *
- * SSH mpints are big-endian, with a leading 0x00 byte if the high bit is set.
- */
-function p1363ToSshEcdsaSig(p1363, sigAlgo) {
-    const half = p1363.length / 2;
-    const r = p1363.slice(0, half);
-    const s = p1363.slice(half);
-    function encodeMpint(n) {
-        // Strip leading zero bytes, then re-pad if high bit set.
-        let start = 0;
-        while (start < n.length - 1 && n[start] === 0)
-            start++;
-        const trimmed = n.slice(start);
-        const padded = trimmed[0] & 0x80 ? concat(new Uint8Array([0x00]), trimmed) : trimmed;
-        return encodeString(padded);
-    }
-    const innerSig = concat(encodeMpint(r), encodeMpint(s));
-    return concat(encodeString(sigAlgo), encodeString(innerSig));
-}
-/**
- * Wrap an Ed25519 WebCrypto signature into SSH wire encoding:
- * string(algo) + string(sig_bytes)
- */
-function wrapEd25519Sig(sig) {
-    return concat(encodeString("ssh-ed25519"), encodeString(sig));
-}
 /**
  * Base64-encode bytes and wrap in SSH signature armor at 76 chars per line.
  */
@@ -251,6 +102,20 @@ export class KRLBuilder {
         this._keyIds.push(...keyIds);
         return this;
     }
+    /**
+     * Return a hex encoded SHA-256 digest of the content of the KRL.
+     *
+     * The digest covers the CA public key and the revoked serials and key IDs,
+     * but not the order they were added in or the header, so it only changes
+     * when the set of revoked certificates or the CA does.
+     */
+    async digest() {
+        const serials = [...this._serials].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        const keyIds = [...this._keyIds].sort();
+        const content = concat(encodeString(this._caKey.publicKey.blob), encodeUint32(serials.length), ...serials.map(encodeUint64), encodeUint32(keyIds.length), ...keyIds.map((id) => encodeString(id)));
+        const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", content));
+        return Array.from(hash, (b) => b.toString(16).padStart(2, "0")).join("");
+    }
     /**
      * Generate the binary KRL
      *
@@ -285,7 +150,7 @@ export class KRLBuilder {
         //   string  reserved
         //   <one or more cert sub-sections>
         //
-        const certSectionData = concat(encodeString(caKeyWireBytes(this._caKey)), // ca_key
+        const certSectionData = concat(encodeString(this._caKey.publicKey.blob), // ca_key
         encodeString(""), // reserved
         ...certSubSections);
         const certificatesSection = encodeSection(KRL_SECTION_CERTIFICATES, certSectionData);
@@ -311,7 +176,7 @@ export class KRLBuilder {
         else {
             krl = this._krl;
         }
-        const { cryptoKey, sigAlgo, webCryptoAlgo } = await importPrivateKey(this._caKey);
+        const signer = await createSigner(this._caKey);
         // 1. Hash the KRL bytes with SHA-512.
         const krlHash = new Uint8Array(await crypto.subtle.digest("SHA-512", krl));
         // 2. Build the signed data blob.
@@ -323,13 +188,9 @@ export class KRLBuilder {
         //   string   H(message)
         const signedData = concat(SSHSIG_MAGIC, encodeString(NAMESPACE), encodeString(""), // reserved
         encodeString(HASH_ALGORITHM), encodeString(krlHash));
-        // 3. Sign the blob.
-        const rawSig = new Uint8Array(await crypto.subtle.sign(webCryptoAlgo, cryptoKey, signedData));
-        // 4. Encode the signature into SSH wire format.
-        const sshSig = sigAlgo === "ssh-ed25519"
-            ? wrapEd25519Sig(rawSig)
-            : p1363ToSshEcdsaSig(rawSig, sigAlgo);
-        // 5. Assemble the outer SSHSIG blob.
+        // 3. Sign the blob, which returns the signature in SSH wire format.
+        const sshSig = await signer.sign(signedData);
+        // 4. Assemble the outer SSHSIG blob.
         //
         //   byte[6]  "SSHSIG"
         //   uint32   SIG_VERSION (1)
@@ -338,10 +199,9 @@ export class KRLBuilder {
         //   string   reserved  (empty)
         //   string   hash_algorithm
         //   string   signature
-        const publicKeyWire = caKeyWireBytes(this._caKey);
-        const sigBlob = concat(SSHSIG_MAGIC, encodeUint32(SIG_VERSION), encodeString(publicKeyWire), encodeString(NAMESPACE), encodeString(""), // reserved
+        const sigBlob = concat(SSHSIG_MAGIC, encodeUint32(SIG_VERSION), encodeString(signer.publicKey), encodeString(NAMESPACE), encodeString(""), // reserved
         encodeString(HASH_ALGORITHM), encodeString(sshSig));
-        // 6. Armor and return.
+        // 5. Armor and return.
         return armorSignature(sigBlob);
     }
 }

package/dist/krl.js.map

@@ -1 +1 @@
-{"version":3,"file":"krl.js","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,gFAAgF;AAEhF,MAAM,SAAS,GAAG,mBAAmB,CAAA,CAAC,eAAe;AACrD,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,gFAAgF;AAEhF,kCAAkC;AAClC,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACtD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC5C,MAAM,KAAK,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAG,KAAmB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAClD,qEAAqE;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,SAAS,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACvD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,SAAS,GAAG,gDAAgD,CAAA;AAClE,MAAM,cAAc,GAAG,QAAQ,CAAA;AAE/B,gFAAgF;AAEhF;;GAEG;AACH,SAAS,OAAO,CAAC,GAAe,EAAE,IAAmB;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAA;AACpB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAiB;IAChC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAClF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IAK7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA,CAAC,6BAA6B;IACrD,MAAM,KAAK,GAAI,KAAuC,CAAC,KAAK,CAAA;IAE5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,wEAAwE;QACxE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,MAAM,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;QAClG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,EAC3E,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,MAAM,CAAC,CACX,CAAA;QACD,OAAO;YACH,SAAS;YACT,OAAO,EAAE,aAAa;YACtB,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SACrC,CAAA;IACL,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,UAAkB,CAAA;QACtB,IAAI,OAAe,CAAA;QACnB,IAAI,IAAY,CAAA;QAChB,IAAI,IAAY,CAAA,CAAC,+CAA+C;QAEhE,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACvB,UAAU,GAAG,OAAO,CAAA;YACpB,OAAO,GAAG,qBAAqB,CAAA;YAC/B,IAAI,GAAG,SAAS,CAAA;YAChB,IAAI,GAAG,EAAE,CAAA;QACb,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,OAAO,CAAA;YACpB,OAAO,GAAG,qBAAqB,CAAA;YAC/B,IAAI,GAAG,SAAS,CAAA;YAChB,IAAI,GAAG,EAAE,CAAA;QACb,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,OAAO,CAAA;YACpB,OAAO,GAAG,qBAAqB,CAAA;YAC/B,IAAI,GAAG,SAAS,CAAA;YAChB,IAAI,GAAG,EAAE,CAAA;QACb,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAA;QACxD,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,CAAA;QACxE,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL;YACI,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,UAAU;YACf,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YACf,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACzC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;SACzC,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAC7B,KAAK,EACL,CAAC,MAAM,CAAC,CACX,CAAA;QACD,OAAO;YACH,SAAS;YACT,OAAO;YACP,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SACzD,CAAA;IACL,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACvB,KAAiB,EACjB,OAAe;IAEf,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE3B,SAAS,WAAW,CAAC,CAAa;QAC9B,yDAAyD;QACzD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,KAAK,EAAE,CAAA;QACtD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,MAAM,GACR,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QAC1E,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAe;IACnC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACH,+BAA+B;QAC/B,GAAG,KAAK;QACR,6BAA6B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACF,MAAM,CAAY;IAClB,QAAQ,GAAa,EAAE,CAAA;IACvB,OAAO,GAAa,EAAE,CAAA;IAC/B,IAAI,GAAuB,IAAI,CAAA;IAEvC,YAAY,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAiB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAgB;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAW,EAAE,EAAE,OAAO,GAAG,EAAE;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAE3D,MAAM,MAAM,GAAG,MAAM,CACjB,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,kBAAkB,CAAC,EAChC,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,EAAE,CAAC,EAAE,uBAAuB;QACzC,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,4EAA4E;QAE5E,MAAM,eAAe,GAAiB,EAAE,CAAA;QAExC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;YAC9D,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAC3D,CAAA;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CACrB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAChD,CAAA;YACD,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,uBAAuB,EAAE,UAAU,CAAC,CACrD,CAAA;QACL,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,mDAAmD;QACnD,mBAAmB;QACnB,qBAAqB;QACrB,oCAAoC;QACpC,EAAE;QACF,MAAM,eAAe,GAAG,MAAM,CAC1B,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS;QACpD,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,GAAG,eAAe,CACrB,CAAA;QAED,MAAM,mBAAmB,GAAG,aAAa,CACrC,wBAAwB,EACxB,eAAe,CAClB,CAAA;QAED,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAE/C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAqB,CAAA;QAErC,OAAO,IAAI,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS;QACX,IAAI,GAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAEjF,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAC7C,CAAA;QAED,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CACrB,YAAY,EACZ,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,UAAU,CACzB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CACjE,CAAA;QAED,gDAAgD;QAChD,MAAM,MAAM,GACR,OAAO,KAAK,aAAa;YACrB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAE7C,qCAAqC;QACrC,EAAE;QACF,sBAAsB;QACtB,6BAA6B;QAC7B,uBAAuB;QACvB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,uBAAuB;QACvB,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,EACZ,YAAY,CAAC,WAAW,CAAC,EACzB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,CACvB,CAAA;QAED,uBAAuB;QACvB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;CACJ"}
+{"version":3,"file":"krl.js","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,gFAAgF;AAEhF,MAAM,SAAS,GAAG,mBAAmB,CAAA,CAAC,eAAe;AACrD,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,gFAAgF;AAEhF,kCAAkC;AAClC,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACtD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC5C,MAAM,KAAK,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAG,KAAmB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACvD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,SAAS,GAAG,gDAAgD,CAAA;AAClE,MAAM,cAAc,GAAG,QAAQ,CAAA;AAE/B;;GAEG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACH,+BAA+B;QAC/B,GAAG,KAAK;QACR,6BAA6B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACF,MAAM,CAAY;IAClB,QAAQ,GAAa,EAAE,CAAA;IACvB,OAAO,GAAa,EAAE,CAAA;IAC/B,IAAI,GAAuB,IAAI,CAAA;IAEvC,YAAY,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAiB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAgB;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAC1C,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAW,EAAE,EAAE,OAAO,GAAG,EAAE;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAE3D,MAAM,MAAM,GAAG,MAAM,CACjB,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,kBAAkB,CAAC,EAChC,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,EAAE,CAAC,EAAE,uBAAuB;QACzC,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,4EAA4E;QAE5E,MAAM,eAAe,GAAiB,EAAE,CAAA;QAExC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;YAC9D,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAC3D,CAAA;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CACrB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAChD,CAAA;YACD,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,uBAAuB,EAAE,UAAU,CAAC,CACrD,CAAA;QACL,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,mDAAmD;QACnD,mBAAmB;QACnB,qBAAqB;QACrB,oCAAoC;QACpC,EAAE;QACF,MAAM,eAAe,GAAG,MAAM,CAC1B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS;QACnD,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,GAAG,eAAe,CACrB,CAAA;QAED,MAAM,mBAAmB,GAAG,aAAa,CACrC,wBAAwB,EACxB,eAAe,CAClB,CAAA;QAED,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAE/C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAqB,CAAA;QAErC,OAAO,IAAI,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS;QACX,IAAI,GAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE9C,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAC7C,CAAA;QAED,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CACrB,YAAY,EACZ,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE5C,qCAAqC;QACrC,EAAE;QACF,sBAAsB;QACtB,6BAA6B;QAC7B,uBAAuB;QACvB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,EACZ,YAAY,CAAC,WAAW,CAAC,EACzB,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAC9B,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,CACvB,CAAA;QAED,uBAAuB;QACvB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;CACJ"}