@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/dist/proof.d.ts

@@ -1,7 +1,22 @@
-import type { Fingerprint, Key } from "sshpk";
+import { PublicKey } from "./ssh/keys.js";
 import { Sig } from "./sshsig/sig.js";
 import { Logger } from "@andrewheberle/ts-slog";
 export declare const Namespace = "proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * The namespace used for proofs of possession that are bound to a request,
+ * kept separate from {@link Namespace} so a proof made for one form can never
+ * be accepted as the other.
+ */
+export declare const RequestNamespace = "request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * Returns the request a proof of possession is bound to, which is appended to
+ * the signed data as `${timestamp}.${fingerprint}.${binding}`.
+ *
+ * @param method The HTTP method of the request, for example "DELETE"
+ * @param path The path of the request with any parameters filled in, for example "/api/v4/user/certificates/123"
+ * @returns The request binding, for example "DELETE /api/v4/user/certificates/123"
+ */
+export declare const requestBinding: (method: string, path: string) => string;
 export declare class PossessionParseError extends Error {
     constructor(message: string, cause?: unknown);
 }
@@ -21,9 +36,10 @@ export declare class PossessionParseError extends Error {
  */
 export declare class ProofOfPossession {
     readonly timestamp: number;
-    readonly fingerprint: Fingerprint;
+    /** The SHA256 fingerprint of the key, for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs" */
+    readonly fingerprint: string;
     readonly signature: Sig;
-    readonly signaturePubkey: Key;
+    readonly signaturePubkey: PublicKey;
     readonly logger: Logger;
     private readonly data;
     constructor(proof: string, options?: {
@@ -36,19 +52,32 @@ export declare class ProofOfPossession {
      * @returns true if signature is valid, false otherwise
      */
     verify(namespace?: string): Promise<boolean>;
+    /**
+     * Verifies the proof was made for a specific request, so it cannot be
+     * replayed against another endpoint or with other path parameters (such
+     * as a different certificate serial).
+     *
+     * The signed data is `${timestamp}.${fingerprint}.${METHOD} ${path}` using
+     * the {@link RequestNamespace} namespace.
+     *
+     * @param method The HTTP method of the request
+     * @param path The path of the request with any parameters filled in
+     * @returns true if signature is valid for the request, false otherwise
+     */
+    verifyRequest(method: string, path: string): Promise<boolean>;
     /**
      *
      * @param keys array of keys to verify finterprint against
      * @returns true if the proof of possession fingerprint matches any of the provided keys, false otherwise
      */
-    matches(key: Key): boolean;
-    matches(...keys: Key[]): boolean;
+    matches(key: PublicKey): boolean;
+    matches(...keys: PublicKey[]): boolean;
 }
 export declare class PossessionMatchError extends Error {
     constructor(message: string, cause?: unknown);
 }
 export declare class RenewalProofOfPossession extends ProofOfPossession {
-    matches(key: Key): never;
-    matches(...keys: Key[]): boolean;
+    matches(key: PublicKey): never;
+    matches(...keys: PublicKey[]): boolean;
 }
 //# sourceMappingURL=proof.d.ts.map

package/dist/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAG7C,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAS,MAAM,EAAY,MAAM,wBAAwB,CAAA;AAKhE,eAAO,MAAM,SAAS,mEAAmE,CAAA;AAEzF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAE9B,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAkEpF;IAED;;;OAGG;IACG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAA;IAC1B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;CAuBhC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED,qBAAa,wBAAyB,SAAQ,iBAAiB;IACrD,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAA;IACxB,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;CAwBzC"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,SAAS,EAAE,MAAM,eAAe,CAAA;AAGxD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAS,MAAM,EAAY,MAAM,wBAAwB,CAAA;AAKhE,eAAO,MAAM,SAAS,mEAAmE,CAAA;AAEzF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,2EAA2E,CAAA;AAExG;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,WAAY,MAAM,QAAQ,MAAM,KAAG,MAE7D,CAAA;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAE9B,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAiEpF;IAED;;;OAGG;IACG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElE;IAED;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAA;IAChC,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;CAuBtC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED,qBAAa,wBAAyB,SAAQ,iBAAiB;IACrD,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,KAAK,CAAA;IAC9B,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;CAwB/C"}

package/dist/proof.js

@@ -1,11 +1,28 @@
 import { ms } from "itty-time";
-import sshpk from "sshpk";
+import { KeyParseError, PublicKey } from "./ssh/keys.js";
 import { verify } from "./sshsig/index.js";
 import { parse } from "./sshsig/sig_parser.js";
 import { group, Logger, LogLevel } from "@andrewheberle/ts-slog";
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { FingerprintFormatError, parseFingerprint, parseKey } = sshpk;
+// a SHA256 fingerprint as shown by ssh-keygen -l, which is unpadded base64
+const FingerprintFormat = /^SHA256:[A-Za-z0-9+/]{43}$/;
 export const Namespace = "proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * The namespace used for proofs of possession that are bound to a request,
+ * kept separate from {@link Namespace} so a proof made for one form can never
+ * be accepted as the other.
+ */
+export const RequestNamespace = "request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * Returns the request a proof of possession is bound to, which is appended to
+ * the signed data as `${timestamp}.${fingerprint}.${binding}`.
+ *
+ * @param method The HTTP method of the request, for example "DELETE"
+ * @param path The path of the request with any parameters filled in, for example "/api/v4/user/certificates/123"
+ * @returns The request binding, for example "DELETE /api/v4/user/certificates/123"
+ */
+export const requestBinding = (method, path) => {
+    return `${method.toUpperCase()} ${path}`;
+};
 export class PossessionParseError extends Error {
     constructor(message, cause) {
         super(message);
@@ -31,6 +48,7 @@ export class PossessionParseError extends Error {
  */
 export class ProofOfPossession {
     timestamp;
+    /** The SHA256 fingerprint of the key, for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs" */
     fingerprint;
     signature;
     signaturePubkey;
@@ -58,10 +76,9 @@ export class ProofOfPossession {
             throw new PossessionParseError("timestamp was from the future");
         }
         try {
-            // parse fingerprint
-            const fingerprint = parseFingerprint(fingerprintString);
-            if (fingerprint === undefined) {
-                throw new PossessionParseError("fingerprint did not parse");
+            // check fingerprint
+            if (!FingerprintFormat.test(fingerprintString)) {
+                throw new PossessionParseError("proof of possession fingerprint was an invalid format");
             }
             // convert siganture from base64
             const signature = Buffer.from(signatureBase64, "base64").toString();
@@ -73,19 +90,19 @@ export class ProofOfPossession {
             catch (err) {
                 throw new PossessionParseError("proof of possession signature could not be parsed", err);
             }
-            this.fingerprint = fingerprint;
+            this.fingerprint = fingerprintString;
             this.data = `${timestamp}.${fingerprintString}`;
-            this.signaturePubkey = parseKey(this.signature.publickey.toString());
+            this.signaturePubkey = PublicKey.parse(this.signature.publickey.toString());
             // ensure the provided fingerprint matches the signature public key
-            if (!this.fingerprint.matches(this.signaturePubkey)) {
+            if (this.fingerprint !== this.signaturePubkey.fingerprint()) {
                 throw new PossessionParseError("proof of possession fingerprint does not match signature public key");
             }
-            this.logger.debug("constructor completed", ...group("this", "timestamp", this.timestamp, "fingerprint", this.fingerprint.toString("base64"), "signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint().toString("base64")));
+            this.logger.debug("constructor completed", ...group("this", "timestamp", this.timestamp, "fingerprint", this.fingerprint, "signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint()));
         }
         catch (err) {
             switch (true) {
-                case (err instanceof FingerprintFormatError):
-                    throw new PossessionParseError("proof of possession fingerprint was an invalid format", err);
+                case (err instanceof KeyParseError):
+                    throw new PossessionParseError(`proof of possession signature key could not be used: ${err.message}`, err);
                 default:
                     throw err;
             }
@@ -98,17 +115,32 @@ export class ProofOfPossession {
     async verify(namespace) {
         return await verify(this.signature, this.data, { namespace: namespace || Namespace });
     }
+    /**
+     * Verifies the proof was made for a specific request, so it cannot be
+     * replayed against another endpoint or with other path parameters (such
+     * as a different certificate serial).
+     *
+     * The signed data is `${timestamp}.${fingerprint}.${METHOD} ${path}` using
+     * the {@link RequestNamespace} namespace.
+     *
+     * @param method The HTTP method of the request
+     * @param path The path of the request with any parameters filled in
+     * @returns true if signature is valid for the request, false otherwise
+     */
+    async verifyRequest(method, path) {
+        return await verify(this.signature, `${this.data}.${requestBinding(method, path)}`, { namespace: RequestNamespace });
+    }
     matches(...keys) {
         this.logger.debug("matches() called", "in", "ProofOfPossession", "keys", keys.length);
         try {
             for (const key of keys) {
                 // confirm proof of possession fingerprint matches keys
-                this.logger.debug("this.fingerprint.matches()", "in", "ProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"));
-                if (!this.fingerprint.matches(key))
+                this.logger.debug("comparing fingerprint", "in", "ProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString());
+                if (this.fingerprint !== key.fingerprint())
                     return false;
                 // also confirm key used to sign proof of possession matches
-                this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"));
-                if (!this.signaturePubkey.fingerprint().matches(key))
+                this.logger.debug("comparing signature public key", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString());
+                if (!this.signaturePubkey.equals(key))
                     return false;
             }
             this.logger.debug("matches() completed", "in", "ProofOfPossession", "keys", keys.length);
@@ -137,11 +169,11 @@ export class RenewalProofOfPossession extends ProofOfPossession {
         }
         try {
             for (const key of keys) {
-                this.logger.debug("this.fingerprint.matches()", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"));
-                if (!this.fingerprint.matches(key))
+                this.logger.debug("comparing fingerprint", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString());
+                if (this.fingerprint !== key.fingerprint())
                     return false;
-                this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"));
-                if (!this.signaturePubkey.fingerprint().matches(key))
+                this.logger.debug("comparing signature public key", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString());
+                if (!this.signaturePubkey.equals(key))
                     return false;
             }
             this.logger.debug("matches() completed", "in", "RenewalProofOfPossession", "keys", keys.length);

package/dist/proof.js.map

@@ -1 +1 @@
-{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAE9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAEhE,+HAA+H;AAC/H,MAAM,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;AAEpE,MAAM,CAAC,MAAM,SAAS,GAAG,gEAAgE,CAAA;AAEzF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,SAAS,CAAQ;IACjB,WAAW,CAAa;IACxB,SAAS,CAAK;IACd,eAAe,CAAK;IACpB,MAAM,CAAQ;IACN,IAAI,CAAQ;IAE9B,YAAY,KAAa,EAAE,OAA2D;QACpF,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,eAAe,CAAC,GAAG,KAAK,CAAA;QAEhE,mBAAmB;QACnB,MAAM,SAAS,GAAW,QAAQ,CAAC,YAAa,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACpE,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,CAAC;YACJ,oBAAoB;YACpB,MAAM,WAAW,GAAG,gBAAgB,CAAC,iBAAkB,CAAC,CAAA;YACxD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAA;YAC5D,CAAC;YAED,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAgB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;YAEpE,aAAa;YACb,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC1B,IAAI,CAAC;gBACJ,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YAED,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;YAC9B,IAAI,CAAC,IAAI,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC/C,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;YAEpE,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,oBAAoB,CAAC,qEAAqE,CAAC,CAAA;YACtG,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EACxC,GAAG,KAAK,CAAC,MAAM,EACd,WAAW,EAAE,IAAI,CAAC,SAAS,EAC3B,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAClD,+BAA+B,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACtF,CACD,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,IAAI,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,YAAY,sBAAsB,CAAC;oBAC3C,MAAM,IAAI,oBAAoB,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAA;gBAC7F;oBACC,MAAM,GAAG,CAAA;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAkB;QAC9B,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC,CAAA;IACtF,CAAC;IAUD,OAAO,CAAC,GAAG,IAAW;QACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACrF,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,uDAAuD;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1J,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjC,OAAO,KAAK,CAAA;gBAEb,4DAA4D;gBAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBAClM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;oBACnD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACxF,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC7E,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAIrD,OAAO,CAAC,GAAG,IAAW;QAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,6CAA6C,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,EAAE,0BAA0B,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBACjK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjC,OAAO,KAAK,CAAA;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBACzM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;oBACnD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/F,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACvF,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAE9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAEhE,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,4BAA4B,CAAA;AAEtD,MAAM,CAAC,MAAM,SAAS,GAAG,gEAAgE,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wEAAwE,CAAA;AAExG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACtE,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,SAAS,CAAQ;IAC1B,0GAA0G;IACjG,WAAW,CAAQ;IACnB,SAAS,CAAK;IACd,eAAe,CAAW;IAC1B,MAAM,CAAQ;IACN,IAAI,CAAQ;IAE9B,YAAY,KAAa,EAAE,OAA2D;QACpF,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,eAAe,CAAC,GAAG,KAAK,CAAA;QAEhE,mBAAmB;QACnB,MAAM,SAAS,GAAW,QAAQ,CAAC,YAAa,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACpE,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,CAAC;YACJ,oBAAoB;YACpB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,oBAAoB,CAAC,uDAAuD,CAAC,CAAA;YACxF,CAAC;YAED,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAgB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;YAEpE,aAAa;YACb,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC1B,IAAI,CAAC;gBACJ,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YAED,IAAI,CAAC,WAAW,GAAG,iBAAkB,CAAA;YACrC,IAAI,CAAC,IAAI,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC/C,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;YAE3E,mEAAmE;YACnE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAI,oBAAoB,CAAC,qEAAqE,CAAC,CAAA;YACtG,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EACxC,GAAG,KAAK,CAAC,MAAM,EACd,WAAW,EAAE,IAAI,CAAC,SAAS,EAC3B,aAAa,EAAE,IAAI,CAAC,WAAW,EAC/B,+BAA+B,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CACnE,CACD,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,IAAI,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;oBAClC,MAAM,IAAI,oBAAoB,CAAC,wDAAwD,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC3G;oBACC,MAAM,GAAG,CAAA;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAkB;QAC9B,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC,CAAA;IACtF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY;QAC/C,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACrH,CAAC;IAUD,OAAO,CAAC,GAAG,IAAiB;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACrF,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,uDAAuD;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAC7H,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE;oBACzC,OAAO,KAAK,CAAA;gBAEb,4DAA4D;gBAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAC5J,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;oBACpC,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACxF,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC7E,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAIrD,OAAO,CAAC,GAAG,IAAiB;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,6CAA6C,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAI,EAAE,0BAA0B,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACpI,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE;oBACzC,OAAO,KAAK,CAAA;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACnK,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;oBACpC,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/F,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACvF,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD"}

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAIzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHA+B3C,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAKzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHAgC3C,CAAA"}

package/dist/router.js

@@ -1,6 +1,7 @@
 import { fromHono } from "chanfana";
 import { Hono } from "hono";
 import { createApi as apiv3 } from "./api/v3/index.js";
+import { BasePath as v4BasePath, createApi as apiv4 } from "./api/v4/index.js";
 import { HTTPException } from "hono/http-exception";
 import { logger } from "./logger.js";
 export const createApp = (env) => {
@@ -17,7 +18,7 @@ export const createApp = (env) => {
         schema: {
             info: {
                 title: "Serverless SSH CA API",
-                version: "3.0.0"
+                version: "4.0.0"
             },
         }
     });
@@ -27,6 +28,7 @@ export const createApp = (env) => {
         bearerFormat: 'JWT',
     });
     app.route("/api/v3", apiv3(env));
+    app.route(v4BasePath, apiv4(env));
     return app;
 };
 //# sourceMappingURL=router.js.map

package/dist/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEhC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}

package/dist/ssh/certificate.d.ts

@@ -0,0 +1,93 @@
+import { PublicKey } from "./keys.js";
+import { type Signer } from "./signer.js";
+/**
+ * Encoding, decoding and signing of OpenSSH certificates as described in
+ * PROTOCOL.certkeys from OpenSSH
+ */
+/** Whether a certificate is for a user or a host */
+export type CertificateKind = "user" | "host";
+/** The fields of a certificate that are set by the CA */
+export type CertificateFields = {
+    /** Whether the certificate is for a user or a host */
+    kind: CertificateKind;
+    /** The public key being certified */
+    publicKey: PublicKey;
+    /** The serial number of the certificate */
+    serial: bigint;
+    /** The key ID of the certificate, which is logged by sshd when it is used */
+    keyId: string;
+    /** The users or hosts the certificate is valid for */
+    principals: string[];
+    /** The time from which the certificate is valid, to the second */
+    validAfter: Date;
+    /** The time until which the certificate is valid, to the second */
+    validBefore: Date;
+    /** The names of the extensions to include, which have no data */
+    extensions: string[];
+};
+/**
+ * Thrown when a certificate cannot be parsed
+ */
+export declare class CertificateParseError extends Error {
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * A signed OpenSSH certificate
+ */
+export declare class SshCertificate {
+    /** The wire encoding of the certificate */
+    readonly bytes: Uint8Array;
+    /** The certificate type, for example "ssh-ed25519-cert-v01@openssh.com" */
+    readonly type: string;
+    readonly kind: CertificateKind;
+    /** The public key being certified */
+    readonly publicKey: PublicKey;
+    readonly serial: bigint;
+    readonly keyId: string;
+    readonly principals: string[];
+    readonly validAfter: Date;
+    readonly validBefore: Date;
+    /** The names of the extensions on the certificate */
+    readonly extensions: string[];
+    /** The wire encoding of the public key of the CA that signed the certificate */
+    readonly signatureKey: Uint8Array;
+    /** The signature of the CA in the SSH wire format */
+    readonly signature: Uint8Array;
+    /**
+     * Decodes a certificate from its wire encoding. This does not verify the
+     * signature on the certificate.
+     *
+     * @param bytes The wire encoding of the certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be decoded or its type is not supported
+     */
+    constructor(bytes: Uint8Array);
+    /**
+     * Parses a certificate in OpenSSH format, `${type} ${base64}[ ${comment}]`,
+     * as found in `-cert.pub` files. This does not verify the signature on the
+     * certificate.
+     *
+     * @param text The certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be parsed or its type is not supported
+     */
+    static parse(text: string): SshCertificate;
+    /**
+     * Returns whether the certificate was signed by a CA key
+     *
+     * @param ca The public key of the CA
+     */
+    isSignedBy(ca: PublicKey): Promise<boolean>;
+    /**
+     * Returns the certificate in OpenSSH format, as used for `-cert.pub` files
+     */
+    toString(): string;
+}
+/**
+ * Creates and signs an OpenSSH certificate
+ *
+ * @param fields The fields of the certificate
+ * @param signer The CA key to sign the certificate with
+ * @returns The signed certificate
+ * @throws Error when the type of the public key being certified is not supported
+ */
+export declare const signCertificate: (fields: CertificateFields, signer: Signer) => Promise<SshCertificate>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/ssh/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../src/ssh/certificate.ts"],"names":[],"mappings":"AAUA,OAAO,EAAiB,SAAS,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AAEH,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAA;AAO7C,yDAAyD;AACzD,MAAM,MAAM,iBAAiB,GAAG;IAC/B,sDAAsD;IACtD,IAAI,EAAE,eAAe,CAAA;IACrB,qCAAqC;IACrC,SAAS,EAAE,SAAS,CAAA;IACpB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,sDAAsD;IACtD,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,kEAAkE;IAClE,UAAU,EAAE,IAAI,CAAA;IAChB,mEAAmE;IACnE,WAAW,EAAE,IAAI,CAAA;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AA+BD;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,cAAc;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;IACjC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAE9B;;;;;;OAMG;IACH,YAAY,KAAK,EAAE,UAAU,EA+B5B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAmBzC;IAED;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAShD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAEjB;CACD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,WAAkB,iBAAiB,UAAU,MAAM,KAAG,OAAO,CAAC,cAAc,CAuBvG,CAAA"}

package/dist/ssh/certificate.js

@@ -0,0 +1,178 @@
+import * as P from "micro-packed";
+import { decodePublicKey, PublicKeyFieldCounts, SSHBytes, SSHOptions, SSHText, SSHTextList, } from "./encoding.js";
+import { base64 } from "@scure/base";
+import { KeyParseError, PublicKey } from "./keys.js";
+import { verify } from "./signer.js";
+const CertificateKinds = {
+    user: 1,
+    host: 2,
+};
+// the fields of a certificate that follow its type, which are given the
+// number of fields in the public key of the certificate
+const fields = (keyFields) => ({
+    nonce: SSHBytes,
+    key: P.array(keyFields, SSHBytes),
+    serial: P.U64BE,
+    kind: P.U32BE,
+    keyId: SSHText,
+    principals: SSHTextList,
+    validAfter: P.U64BE,
+    validBefore: P.U64BE,
+    criticalOptions: SSHOptions,
+    extensions: SSHOptions,
+    reserved: SSHBytes,
+    signatureKey: SSHBytes,
+});
+const certificateType = (keyType) => `${keyType}-cert-v01@openssh.com`;
+// a certificate without and with its signature, tagged by the certificate type
+const ToBeSigned = P.tag(SSHText, Object.fromEntries(Object.entries(PublicKeyFieldCounts).map(([keyType, count]) => [certificateType(keyType), P.struct(fields(count))])));
+const Certificate = P.tag(SSHText, Object.fromEntries(Object.entries(PublicKeyFieldCounts).map(([keyType, count]) => [certificateType(keyType), P.struct({ ...fields(count), signature: SSHBytes })])));
+const toSeconds = (date) => BigInt(Math.floor(date.getTime() / 1000));
+/**
+ * Thrown when a certificate cannot be parsed
+ */
+export class CertificateParseError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = "CertificateParseError";
+        this.cause = cause;
+        Object.setPrototypeOf(this, CertificateParseError.prototype);
+    }
+}
+/**
+ * A signed OpenSSH certificate
+ */
+export class SshCertificate {
+    /** The wire encoding of the certificate */
+    bytes;
+    /** The certificate type, for example "ssh-ed25519-cert-v01@openssh.com" */
+    type;
+    kind;
+    /** The public key being certified */
+    publicKey;
+    serial;
+    keyId;
+    principals;
+    validAfter;
+    validBefore;
+    /** The names of the extensions on the certificate */
+    extensions;
+    /** The wire encoding of the public key of the CA that signed the certificate */
+    signatureKey;
+    /** The signature of the CA in the SSH wire format */
+    signature;
+    /**
+     * Decodes a certificate from its wire encoding. This does not verify the
+     * signature on the certificate.
+     *
+     * @param bytes The wire encoding of the certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be decoded or its type is not supported
+     */
+    constructor(bytes) {
+        let decoded;
+        try {
+            decoded = Certificate.decode(bytes);
+        }
+        catch (err) {
+            throw new CertificateParseError("certificate could not be decoded", err);
+        }
+        const { TAG, data } = decoded;
+        const kind = Object.keys(CertificateKinds).find((k) => CertificateKinds[k] === data.kind);
+        if (kind === undefined) {
+            throw new CertificateParseError(`unknown certificate kind: ${data.kind}`);
+        }
+        const publicKeyType = TAG.replace(/-cert-v01@openssh\.com$/, "");
+        try {
+            this.publicKey = new PublicKey(P.struct({ type: SSHText, key: P.array(data.key.length, SSHBytes) }).encode({ type: publicKeyType, key: data.key }));
+        }
+        catch (err) {
+            throw new CertificateParseError(err instanceof KeyParseError ? err.message : "certificate public key could not be decoded", err);
+        }
+        this.bytes = bytes;
+        this.type = TAG;
+        this.kind = kind;
+        this.serial = data.serial;
+        this.keyId = data.keyId;
+        this.principals = data.principals;
+        this.validAfter = new Date(Number(data.validAfter) * 1000);
+        this.validBefore = new Date(Number(data.validBefore) * 1000);
+        this.extensions = data.extensions.map((e) => e.name);
+        this.signatureKey = data.signatureKey;
+        this.signature = data.signature;
+    }
+    /**
+     * Parses a certificate in OpenSSH format, `${type} ${base64}[ ${comment}]`,
+     * as found in `-cert.pub` files. This does not verify the signature on the
+     * certificate.
+     *
+     * @param text The certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be parsed or its type is not supported
+     */
+    static parse(text) {
+        const [type, data] = text.trim().split(/\s+/);
+        if (type === undefined || type === "" || data === undefined) {
+            throw new CertificateParseError("certificate was not in OpenSSH format");
+        }
+        let bytes;
+        try {
+            bytes = base64.decode(data);
+        }
+        catch (err) {
+            throw new CertificateParseError("certificate was not valid base64", err);
+        }
+        const certificate = new SshCertificate(bytes);
+        if (certificate.type !== type) {
+            throw new CertificateParseError(`certificate type ${type} did not match encoded type ${certificate.type}`);
+        }
+        return certificate;
+    }
+    /**
+     * Returns whether the certificate was signed by a CA key
+     *
+     * @param ca The public key of the CA
+     */
+    async isSignedBy(ca) {
+        if (!ca.equals(new PublicKey(this.signatureKey))) {
+            return false;
+        }
+        // the signature is the last field, so everything before it is signed
+        const signed = this.bytes.subarray(0, this.bytes.length - 4 - this.signature.length);
+        return await verify(ca, this.signature, new Uint8Array(signed));
+    }
+    /**
+     * Returns the certificate in OpenSSH format, as used for `-cert.pub` files
+     */
+    toString() {
+        return `${this.type} ${base64.encode(this.bytes)}`;
+    }
+}
+/**
+ * Creates and signs an OpenSSH certificate
+ *
+ * @param fields The fields of the certificate
+ * @param signer The CA key to sign the certificate with
+ * @returns The signed certificate
+ * @throws Error when the type of the public key being certified is not supported
+ */
+export const signCertificate = async (fields, signer) => {
+    const { type, fields: key } = decodePublicKey(fields.publicKey.blob);
+    const value = {
+        nonce: crypto.getRandomValues(new Uint8Array(32)),
+        key,
+        serial: fields.serial,
+        kind: CertificateKinds[fields.kind],
+        keyId: fields.keyId,
+        principals: fields.principals,
+        validAfter: toSeconds(fields.validAfter),
+        validBefore: toSeconds(fields.validBefore),
+        criticalOptions: [],
+        // options must be in lexical order and may each appear only once
+        extensions: [...new Set(fields.extensions)].sort().map((name) => ({ name, data: new Uint8Array(0) })),
+        reserved: new Uint8Array(0),
+        signatureKey: signer.publicKey,
+    };
+    const tbs = ToBeSigned.encode({ TAG: certificateType(type), data: value });
+    const signature = await signer.sign(new Uint8Array(tbs));
+    return new SshCertificate(Certificate.encode({ TAG: certificateType(type), data: { ...value, signature } }));
+};
+//# sourceMappingURL=certificate.js.map

package/dist/ssh/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../src/ssh/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EACN,eAAe,EACf,oBAAoB,EACpB,QAAQ,EACR,UAAU,EACV,OAAO,EACP,WAAW,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAE,MAAM,EAAe,MAAM,aAAa,CAAA;AAUjD,MAAM,gBAAgB,GAA8C;IACnE,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACP,CAAA;AAsBD,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC;IACtC,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,CAAC,CAAC,KAAK;IACb,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,CAAC,CAAC,KAAK;IACnB,WAAW,EAAE,CAAC,CAAC,KAAK;IACpB,eAAe,EAAE,UAAU;IAC3B,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,QAAQ;IAClB,YAAY,EAAE,QAAQ;CACtB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,OAAO,uBAAuB,CAAA;AAEtF,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CACnD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACnH,CAAC,CAAA;AACF,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CACpD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC/I,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;AAEnF;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAC1B,2CAA2C;IAClC,KAAK,CAAY;IAC1B,2EAA2E;IAClE,IAAI,CAAQ;IACZ,IAAI,CAAiB;IAC9B,qCAAqC;IAC5B,SAAS,CAAW;IACpB,MAAM,CAAQ;IACd,KAAK,CAAQ;IACb,UAAU,CAAU;IACpB,UAAU,CAAM;IAChB,WAAW,CAAM;IAC1B,qDAAqD;IAC5C,UAAU,CAAU;IAC7B,gFAAgF;IACvE,YAAY,CAAY;IACjC,qDAAqD;IAC5C,SAAS,CAAY;IAE9B;;;;;;OAMG;IACH,YAAY,KAAiB;QAC5B,IAAI,OAA0C,CAAA;QAC9C,IAAI,CAAC;YACJ,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QAC7B,MAAM,IAAI,GAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;QAChH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC;YACJ,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAA;QACjI,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAA;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACJ,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,IAAI,+BAA+B,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,WAAW,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,EAAa;QAC7B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACb,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAEpF,OAAO,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAChE,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,CAAC;CACD;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAyB,EAAE,MAAc,EAA2B,EAAE;IAC3G,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG;QACb,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjD,GAAG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QACxC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;QAC1C,eAAe,EAAE,EAAE;QACnB,iEAAiE;QACjE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,QAAQ,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,MAAM,CAAC,SAAS;KAC9B,CAAA;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAExD,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;AAC7G,CAAC,CAAA"}

package/dist/ssh/encoding.d.ts

@@ -0,0 +1,41 @@
+import * as P from "micro-packed";
+/**
+ * Coders for the SSH wire format (RFC 4251 section 5)
+ */
+/** A string of bytes, prefixed by its length as a uint32 */
+export declare const SSHBytes: P.CoderType<P.Bytes>;
+/** A UTF-8 string, prefixed by its length as a uint32 */
+export declare const SSHText: P.CoderType<string>;
+/** A list of strings packed into a string, as used for certificate principals */
+export declare const SSHTextList: P.CoderType<string[]>;
+/**
+ * A list of named options packed into a string, as used for certificate
+ * critical options and extensions
+ */
+export declare const SSHOptions: P.CoderType<P.StructInput<{
+    name: string;
+    data: P.Bytes;
+}>[]>;
+/**
+ * An mpint holding an unsigned integer, decoded to and encoded from its
+ * big-endian bytes without leading zeros.
+ *
+ * An mpint has no leading zero bytes, other than one to keep the value
+ * positive when the high bit of the first byte is set.
+ */
+export declare const SSHUnsignedMpint: P.CoderType<Uint8Array<ArrayBufferLike>>;
+/** The number of fields that follow the type in the wire encoding of a public key of each type */
+export declare const PublicKeyFieldCounts: Readonly<Record<string, number>>;
+/**
+ * Splits the wire encoding of a public key into its type and the encoded
+ * fields that follow it
+ *
+ * @param blob The wire encoding of the public key
+ * @returns The key type and its fields
+ * @throws Error when the key type is not supported or the encoding is invalid
+ */
+export declare const decodePublicKey: (blob: Uint8Array) => {
+    type: string;
+    fields: Uint8Array[];
+};
+//# sourceMappingURL=encoding.d.ts.map

package/dist/ssh/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/ssh/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAEjC;;GAEG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,sBAAmB,CAAA;AAExC,yDAAyD;AACzD,eAAO,MAAM,OAAO,qBAAoB,CAAA;AAExC,iFAAiF;AACjF,eAAO,MAAM,WAAW,uBAA4C,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,UAAU;;;KAGnB,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,0CAoB3B,CAAA;AAEF,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMjE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,SAAU,UAAU,KAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,EAAE,CAAA;CAUtF,CAAA"}