@andrewheberle/serverless-ssh-ca 0.22.0 → 0.23.0

package/dist/ssh/keys.js

@@ -0,0 +1,249 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+import { base64, base64nopad, base64urlnopad } from "@scure/base";
+import * as P from "micro-packed";
+import { toFixedWidth } from "../sshsig/sig_parser.js";
+import { decodePublicKey, SSHBytes, SSHText } from "./encoding.js";
+/**
+ * Thrown when a key cannot be parsed
+ */
+export class KeyParseError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = "KeyParseError";
+        this.cause = cause;
+        Object.setPrototypeOf(this, KeyParseError.prototype);
+    }
+}
+/**
+ * Thrown when a private key is of a type that cannot be used to sign
+ */
+export class UnsupportedKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsupportedKeyError";
+        Object.setPrototypeOf(this, UnsupportedKeyError.prototype);
+    }
+}
+const equalBytes = (a, b) => {
+    return a.length === b.length && a.every((v, i) => v === b[i]);
+};
+/**
+ * An SSH public key
+ */
+export class PublicKey {
+    /** The key type, for example "ssh-ed25519" */
+    type;
+    /** The wire encoding of the key (RFC 4253 section 6.6) */
+    blob;
+    /** The comment of the key, if any */
+    comment;
+    /**
+     * @param blob The wire encoding of the key
+     * @param comment The comment of the key
+     * @throws {@link KeyParseError} when the key cannot be decoded or its type is not supported
+     */
+    constructor(blob, comment) {
+        try {
+            this.type = decodePublicKey(blob).type;
+        }
+        catch (err) {
+            throw new KeyParseError(err instanceof Error ? err.message : "public key could not be decoded", err);
+        }
+        this.blob = blob;
+        this.comment = comment === "" ? undefined : comment;
+    }
+    /**
+     * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+     *
+     * @param text The public key
+     * @throws {@link KeyParseError} when the key cannot be parsed or its type is not supported
+     */
+    static parse(text) {
+        const [type, data, ...comment] = text.trim().split(/\s+/);
+        if (type === undefined || type === "" || data === undefined) {
+            throw new KeyParseError("public key was not in OpenSSH format");
+        }
+        let blob;
+        try {
+            blob = base64.decode(data);
+        }
+        catch (err) {
+            throw new KeyParseError("public key was not valid base64", err);
+        }
+        const key = new PublicKey(blob, comment.join(" "));
+        if (key.type !== type) {
+            throw new KeyParseError(`public key type ${type} did not match encoded type ${key.type}`);
+        }
+        return key;
+    }
+    /**
+     * Returns the SHA256 fingerprint of the key, as shown by `ssh-keygen -l`,
+     * for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs"
+     */
+    fingerprint() {
+        return `SHA256:${base64nopad.encode(sha256(this.blob))}`;
+    }
+    /**
+     * Returns whether this is the same key as another, ignoring comments
+     */
+    equals(other) {
+        return equalBytes(this.blob, other.blob);
+    }
+    /**
+     * Returns a copy of the key with a different comment
+     */
+    withComment(comment) {
+        return new PublicKey(this.blob, comment);
+    }
+    /**
+     * Returns the key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+     */
+    toString() {
+        const key = `${this.type} ${base64.encode(this.blob)}`;
+        return this.comment === undefined ? key : `${key} ${this.comment}`;
+    }
+}
+const EcdsaCurves = {
+    nistp256: { namedCurve: "P-256", size: 32 },
+    nistp384: { namedCurve: "P-384", size: 48 },
+    nistp521: { namedCurve: "P-521", size: 66 },
+};
+// "openssh-key-v1\0"
+const AUTH_MAGIC = new TextEncoder().encode("openssh-key-v1\0");
+/** The container of an OpenSSH private key (PROTOCOL.key) */
+const OpenSshPrivateKey = P.struct({
+    magic: P.magicBytes(AUTH_MAGIC),
+    cipherName: SSHText,
+    kdfName: SSHText,
+    kdfOptions: SSHBytes,
+    publicKeys: P.array(P.U32BE, SSHBytes),
+    privateKeys: SSHBytes,
+});
+/** The start of the (decrypted) private section of an OpenSSH private key */
+const PrivateSectionStart = P.struct({
+    check1: P.U32BE,
+    check2: P.U32BE,
+    type: SSHText,
+});
+const Ed25519PrivateKey = P.struct({
+    check1: P.U32BE,
+    check2: P.U32BE,
+    type: SSHText,
+    publicKey: SSHBytes,
+    // the seed followed by the public key
+    privateKey: SSHBytes,
+    comment: SSHText,
+});
+const EcdsaPrivateKey = P.struct({
+    check1: P.U32BE,
+    check2: P.U32BE,
+    type: SSHText,
+    curve: SSHText,
+    publicKey: SSHBytes,
+    // an mpint
+    privateKey: SSHBytes,
+    comment: SSHText,
+});
+/**
+ * Returns a short name for the type of a key, for example "rsa" for "ssh-rsa"
+ */
+const keyTypeName = (type) => {
+    return type.replace(/^ssh-/, "").replace(/^ecdsa-sha2-.*$/, "ecdsa");
+};
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
+ * created by `ssh-keygen`
+ *
+ * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----`
+ * @returns The private key
+ * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
+ * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
+ */
+export const parsePrivateKey = (text) => {
+    const match = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]*?)-----END OPENSSH PRIVATE KEY-----/.exec(text);
+    if (match === null) {
+        throw new KeyParseError("private key was not in OpenSSH format, as created by ssh-keygen (starting with -----BEGIN OPENSSH PRIVATE KEY-----)");
+    }
+    let container;
+    try {
+        container = OpenSshPrivateKey.decode(base64.decode(match[1].replace(/\s+/g, "")));
+    }
+    catch (err) {
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+    if (container.cipherName !== "none" || container.kdfName !== "none") {
+        throw new KeyParseError("encrypted private keys are not supported");
+    }
+    if (container.publicKeys.length !== 1) {
+        throw new KeyParseError(`private key must contain one key, not ${container.publicKeys.length}`);
+    }
+    // the private section is padded to a block size, so may have trailing bytes
+    const options = { allowUnreadBytes: true };
+    let start;
+    try {
+        start = PrivateSectionStart.decode(container.privateKeys, options);
+    }
+    catch (err) {
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+    if (start.check1 !== start.check2) {
+        throw new KeyParseError("private key check values did not match");
+    }
+    try {
+        if (start.type === "ssh-ed25519") {
+            const key = Ed25519PrivateKey.decode(container.privateKeys, options);
+            if (key.publicKey.length !== 32 || key.privateKey.length !== 64) {
+                throw new KeyParseError("Ed25519 private key was an unexpected length");
+            }
+            const publicKey = new PublicKey(container.publicKeys[0], key.comment);
+            if (!equalBytes(P.struct({ type: SSHText, key: SSHBytes }).encode({ type: start.type, key: key.publicKey }), publicKey.blob)) {
+                throw new KeyParseError("private key did not match its public key");
+            }
+            return {
+                type: "ed25519",
+                publicKey,
+                jwk: {
+                    kty: "OKP",
+                    crv: "Ed25519",
+                    d: base64urlnopad.encode(key.privateKey.subarray(0, 32)),
+                    x: base64urlnopad.encode(key.publicKey),
+                },
+            };
+        }
+        if (start.type.startsWith("ecdsa-sha2-")) {
+            const key = EcdsaPrivateKey.decode(container.privateKeys, options);
+            const curve = EcdsaCurves[key.curve];
+            if (curve === undefined || start.type !== `ecdsa-sha2-${key.curve}`) {
+                throw new UnsupportedKeyError(`ECDSA curve ${key.curve} is not supported`);
+            }
+            if (key.publicKey.length !== 1 + curve.size * 2 || key.publicKey[0] !== 0x04) {
+                throw new KeyParseError(`unexpected ECDSA public key encoding for ${key.curve}`);
+            }
+            const publicKey = new PublicKey(container.publicKeys[0], key.comment);
+            if (!equalBytes(P.struct({ type: SSHText, curve: SSHText, key: SSHBytes }).encode({ type: start.type, curve: key.curve, key: key.publicKey }), publicKey.blob)) {
+                throw new KeyParseError("private key did not match its public key");
+            }
+            return {
+                type: "ecdsa",
+                curve: key.curve,
+                publicKey,
+                jwk: {
+                    kty: "EC",
+                    crv: curve.namedCurve,
+                    // d is an mpint, so may be short or have a leading sign byte
+                    d: base64urlnopad.encode(toFixedWidth(key.privateKey, curve.size)),
+                    x: base64urlnopad.encode(key.publicKey.subarray(1, 1 + curve.size)),
+                    y: base64urlnopad.encode(key.publicKey.subarray(1 + curve.size)),
+                },
+            };
+        }
+    }
+    catch (err) {
+        if (err instanceof KeyParseError || err instanceof UnsupportedKeyError) {
+            throw err;
+        }
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+    throw new UnsupportedKeyError(`CA key type ${keyTypeName(start.type)} is not supported, the CA key must be Ed25519 or ECDSA`);
+};
+//# sourceMappingURL=keys.js.map

package/dist/ssh/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAElE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IACrB,8CAA8C;IACrC,IAAI,CAAQ;IACrB,0DAA0D;IACjD,IAAI,CAAY;IACzB,qCAAqC;IAC5B,OAAO,CAAoB;IAEpC;;;;OAIG;IACH,YAAY,IAAgB,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,mBAAmB,IAAI,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,OAAO,GAAG,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,OAAO,UAAU,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAA2B;QACtC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAEtD,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;CACD;AAKD,MAAM,WAAW,GAAuE;IACvF,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;CAC3C,CAAA;AAiBD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE/D,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACtC,WAAW,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,QAAQ;IACnB,sCAAsC;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW;IACX,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE;IAC3D,MAAM,KAAK,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,aAAa,CAAC,qHAAqH,CAAC,CAAA;IAC/I,CAAC;IAED,IAAI,SAAkD,CAAA;IACtD,IAAI,CAAC;QACJ,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,yCAAyC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,8CAA8C,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9H,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACvC;aACD,CAAA;QACF,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAA;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,4CAA4C,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChK,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,GAAG,CAAC,KAAmB;gBAC9B,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,KAAK,CAAC,UAAU;oBACrB,6DAA6D;oBAC7D,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChE;aACD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;AAC9H,CAAC,CAAA"}

package/dist/ssh/signer.d.ts

@@ -0,0 +1,35 @@
+import type { PrivateKey, PublicKey } from "./keys.js";
+/**
+ * Signs data with a CA key using WebCrypto, returning signatures in the SSH
+ * wire format
+ */
+export interface Signer {
+    /** The wire encoding of the public key of the signer */
+    readonly publicKey: Uint8Array;
+    /**
+     * Signs data
+     *
+     * @param data The data to sign
+     * @returns The signature in the SSH wire format (RFC 4253 section 6.6)
+     */
+    sign(data: Uint8Array<ArrayBuffer>): Promise<Uint8Array>;
+}
+/**
+ * Creates a {@link Signer} for an Ed25519 or ECDSA (P-256, P-384 or P-521)
+ * private key
+ *
+ * @param key The private key to sign with
+ * @returns The signer
+ */
+export declare const createSigner: (key: PrivateKey) => Promise<Signer>;
+/**
+ * Verifies a signature in the SSH wire format made with an Ed25519 or ECDSA
+ * key
+ *
+ * @param publicKey The key the signature must have been made with
+ * @param signature The signature in the SSH wire format
+ * @param data The data that was signed
+ * @returns true if the signature is valid, false if it is not or the key type is not supported
+ */
+export declare const verify: (publicKey: PublicKey, signature: Uint8Array, data: Uint8Array<ArrayBuffer>) => Promise<boolean>;
+//# sourceMappingURL=signer.d.ts.map

package/dist/ssh/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/ssh/signer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAc,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACxD;AAuBD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAe,UAAU,KAAG,OAAO,CAAC,MAAM,CAmClE,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,cAAqB,SAAS,aAAa,UAAU,QAAQ,UAAU,CAAC,WAAW,CAAC,KAAG,OAAO,CAAC,OAAO,CAiCxH,CAAA"}

package/dist/ssh/signer.js

@@ -0,0 +1,99 @@
+import * as P from "micro-packed";
+import { toFixedWidth } from "../sshsig/sig_parser.js";
+import { decodePublicKey, SSHBytes, SSHText, SSHUnsignedMpint } from "./encoding.js";
+/** An Ed25519 signature: string algorithm, string signature */
+const Ed25519Signature = P.struct({
+    algorithm: SSHText,
+    signature: SSHBytes,
+});
+/** An ECDSA signature: string algorithm, string (mpint r, mpint s) */
+const EcdsaSignature = P.struct({
+    algorithm: SSHText,
+    signature: P.prefix(P.U32BE, P.struct({
+        r: SSHUnsignedMpint,
+        s: SSHUnsignedMpint,
+    })),
+});
+const EcdsaCurves = {
+    nistp256: { namedCurve: "P-256", hash: "SHA-256", size: 32 },
+    nistp384: { namedCurve: "P-384", hash: "SHA-384", size: 48 },
+    nistp521: { namedCurve: "P-521", hash: "SHA-512", size: 66 },
+};
+/**
+ * Creates a {@link Signer} for an Ed25519 or ECDSA (P-256, P-384 or P-521)
+ * private key
+ *
+ * @param key The private key to sign with
+ * @returns The signer
+ */
+export const createSigner = async (key) => {
+    const publicKey = key.publicKey.blob;
+    if (key.type === "ed25519") {
+        const cryptoKey = await crypto.subtle.importKey("jwk", key.jwk, { name: "Ed25519" }, false, ["sign"]);
+        return {
+            publicKey,
+            sign: async (data) => Ed25519Signature.encode({
+                algorithm: "ssh-ed25519",
+                signature: new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, cryptoKey, data)),
+            }),
+        };
+    }
+    const curve = EcdsaCurves[key.curve];
+    const cryptoKey = await crypto.subtle.importKey("jwk", key.jwk, { name: "ECDSA", namedCurve: curve.namedCurve }, false, ["sign"]);
+    return {
+        publicKey,
+        sign: async (data) => {
+            // WebCrypto returns r || s, each the size of the curve
+            const signature = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: { name: curve.hash } }, cryptoKey, data));
+            return EcdsaSignature.encode({
+                // the algorithm is named for the curve of the key, never
+                // worked out from the signature
+                algorithm: `ecdsa-sha2-${key.curve}`,
+                signature: {
+                    r: signature.subarray(0, curve.size),
+                    s: signature.subarray(curve.size),
+                },
+            });
+        },
+    };
+};
+/**
+ * Verifies a signature in the SSH wire format made with an Ed25519 or ECDSA
+ * key
+ *
+ * @param publicKey The key the signature must have been made with
+ * @param signature The signature in the SSH wire format
+ * @param data The data that was signed
+ * @returns true if the signature is valid, false if it is not or the key type is not supported
+ */
+export const verify = async (publicKey, signature, data) => {
+    try {
+        const { type, fields } = decodePublicKey(publicKey.blob);
+        if (type === "ssh-ed25519") {
+            const { algorithm, signature: raw } = Ed25519Signature.decode(signature);
+            if (algorithm !== type) {
+                return false;
+            }
+            const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(fields[0]), { name: "Ed25519" }, false, ["verify"]);
+            return await crypto.subtle.verify({ name: "Ed25519" }, cryptoKey, new Uint8Array(raw), data);
+        }
+        const curveName = type.replace(/^ecdsa-sha2-/, "");
+        const curve = EcdsaCurves[curveName];
+        if (curve !== undefined && type === `ecdsa-sha2-${curveName}`) {
+            const { algorithm, signature: { r, s } } = EcdsaSignature.decode(signature);
+            if (algorithm !== type || r.length > curve.size || s.length > curve.size) {
+                return false;
+            }
+            // fields are the curve name and the public point
+            const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(fields[1]), { name: "ECDSA", namedCurve: curve.namedCurve }, false, ["verify"]);
+            const raw = P.utils.concatBytes(toFixedWidth(r, curve.size), toFixedWidth(s, curve.size));
+            return await crypto.subtle.verify({ name: "ECDSA", hash: { name: curve.hash } }, cryptoKey, new Uint8Array(raw), data);
+        }
+        return false;
+    }
+    catch {
+        // a signature or key that cannot be decoded or imported is not valid
+        return false;
+    }
+};
+//# sourceMappingURL=signer.js.map

package/dist/ssh/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/ssh/signer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAmBpF,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,QAAQ;CACnB,CAAC,CAAA;AAEF,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC,EAAE,gBAAgB;QACnB,CAAC,EAAE,gBAAgB;KACnB,CAAC,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,WAAW,GAAqF;IACrG,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC5D,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC5D,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;CAC5D,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,GAAe,EAAmB,EAAE;IACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAA;IAEpC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QAErG,OAAO;YACN,SAAS;YACT,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC7C,SAAS,EAAE,aAAa;gBACxB,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;aACzF,CAAC;SACF,CAAA;IACF,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAEjI,OAAO;QACN,SAAS;QACT,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,uDAAuD;YACvD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YAE1H,OAAO,cAAc,CAAC,MAAM,CAAC;gBAC5B,yDAAyD;gBACzD,gCAAgC;gBAChC,SAAS,EAAE,cAAc,GAAG,CAAC,KAAK,EAAE;gBACpC,SAAS,EAAE;oBACV,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;oBACpC,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;iBACjC;aACD,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,SAAoB,EAAE,SAAqB,EAAE,IAA6B,EAAoB,EAAE;IAC5H,IAAI,CAAC;QACJ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAExD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAE1H,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAe,CAAA;QAChE,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,SAAS,EAAE,EAAE,CAAC;YAC/D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC3E,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAA;YACb,CAAC;YACD,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YACtJ,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAEzF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;QACvH,CAAC;QAED,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;QACrE,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC,CAAA"}

package/dist/types.d.ts

@@ -14,11 +14,6 @@ export type CertificateRequestJWTPayload = {
     sub: string;
     [key: string]: string | string[];
 } & JWTPayload;
-export type SSHExtension = {
-    critical: boolean;
-    name: string;
-    data: Buffer<ArrayBuffer>;
-};
 /**
  * The result of executing a statement via {@link CaPreparedStatement.run} or
  * {@link CaDatabase.batch}, modelled on a Cloudflare D1 result.
@@ -87,24 +82,24 @@ export interface CaSecret {
  * {@link CaSecret} for the non-string bindings.
  */
 export interface SshCaBindings {
-    DB: CaDatabase;
+    CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
+    JWT_ALGORITHMS: string | string[];
+    JWT_AUD?: string | string[];
+    JWT_ISSUER: string;
+    JWT_JWKS_URL: string;
+    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
+    LOG_LEVEL?: string;
     DB_CERTIFICATE_RETENTION: string;
+    DB: CaDatabase;
+    ISSUER_DN: string;
     PRIVATE_KEY: CaSecret;
     SSH_CERTIFICATE_EXTENSIONS: string;
-    SSH_CERTIFICATE_LIFETIME: string;
-    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;
     SSH_CERTIFICATE_INCLUDE_SELF_EMAIL?: string | boolean;
+    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;
+    SSH_CERTIFICATE_LIFETIME: string;
     SSH_CERTIFICATE_PRINCIPALS?: string | string[];
-    SSH_HOST_CERTIFICATE_LIFETIME: string;
     SSH_HOST_CERTIFICATE_ALLOWED_EMAILS?: string | string[];
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES?: string | string[];
-    ISSUER_DN: string;
-    JWT_JWKS_URL: string;
-    JWT_AUD?: string | string[];
-    JWT_ISSUER: string;
-    JWT_ALGORITHMS: string | string[];
-    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
-    CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
-    LOG_LEVEL?: string;
+    SSH_HOST_CERTIFICATE_LIFETIME: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}

package/dist/utils.d.ts

@@ -1,9 +1,11 @@
 import type { SshCaBindings } from "./types.js";
-import type { Certificate, Key, PrivateKey } from "sshpk";
+import { SshCertificate } from "./ssh/certificate.js";
+import { PublicKey, UnsupportedKeyError, type PrivateKey } from "./ssh/keys.js";
 import z from "zod";
 import { CertificateRequestJWTPayload } from "./types.js";
 import { RenewalProofOfPossession, ProofOfPossession } from "./proof.js";
 import type { isRevoked as IsRevokedFn } from "./db/index.js";
+export { UnsupportedKeyError };
 export declare const fatalIssue: (ctx: z.RefinementCtx, message: string, val: unknown) => never;
 export declare const transformProofOfPossession: (env: SshCaBindings, val: string, ctx: z.core.$RefinementCtx<string>) => ProofOfPossession | never;
 type AccessToken = {
@@ -11,7 +13,13 @@ type AccessToken = {
     sub: string;
 };
 export declare const transformAuthorizationHeader: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
-export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Key | never;
+/**
+ * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+ *
+ * @param val The public key, either base64 encoded or as bytes
+ * @param ctx The Zod context for any errors
+ */
+export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => PublicKey | never;
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -32,10 +40,10 @@ export declare const transformIdentityToken: (env: SshCaBindings, val: string, c
  * @param ctx The Zod context for any errors
  * @returns
  */
-export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Certificate | never;
+export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => SshCertificate | never;
 type ParsedCertificateRequest = {
     proof: ProofOfPossession;
-    public_key: Key;
+    public_key: PublicKey;
     lifetime: number;
     identity: IdentityToken;
     extensions: string[];
@@ -43,7 +51,7 @@ type ParsedCertificateRequest = {
 export declare const refineCertificateRequest: (env: SshCaBindings, val: ParsedCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
 export declare const transformRenewalProofOfPossession: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => RenewalProofOfPossession | never;
 type HostCertificateRequest = {
-    public_key: Key;
+    public_key: PublicKey;
     lifetime: number;
 };
 type ParsedHostCertificateRequest = {
@@ -52,36 +60,47 @@ type ParsedHostCertificateRequest = {
 } & HostCertificateRequest;
 export declare const refineHostCertificateRequest: (env: SshCaBindings, val: ParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
 type ParsedHostCertificateRenewal = {
-    certificate: Certificate;
+    certificate: SshCertificate;
     proof: RenewalProofOfPossession;
 } & HostCertificateRequest;
+/**
+ * Checks a certificate presented for renewal was issued by this CA, is a host
+ * certificate, is within its validity period and has not been revoked.
+ *
+ * @param env The CA bindings
+ * @param isRevoked Returns whether a serial has been revoked
+ * @param certificate The certificate presented for renewal
+ * @returns The reason the certificate cannot be renewed, or undefined if it can be
+ * @throws {@link UnsupportedKeyError} when the CA key is not supported
+ */
+export declare const checkRenewableCertificate: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, certificate: SshCertificate) => Promise<string | undefined>;
+/**
+ * Refines a host certificate renewal so only a certificate that can be
+ * renewed (see {@link checkRenewableCertificate}) is accepted.
+ */
+export declare const refineRenewableCertificate: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: {
+    certificate: SshCertificate;
+}, ctx: z.RefinementCtx) => Promise<never>;
 export declare const refineHostCertificateRenewal: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: ParsedHostCertificateRenewal, ctx: z.RefinementCtx) => Promise<never>;
 type ParsedRevokeCertificate = {
     serial: bigint;
-    public_key: Key;
+    public_key: PublicKey;
     proof: ProofOfPossession;
 };
 export declare const refineRevokeCertificate: (env: SshCaBindings, val: ParsedRevokeCertificate, ctx: z.RefinementCtx) => Promise<never>;
 export declare const split: (v?: string | string[]) => string[];
-/**
- * Thrown by {@link getPrivateKey} when the CA private key is of a type that
- * cannot be used.
- */
-export declare class UnsupportedKeyError extends Error {
-    constructor(message: string);
-}
 /**
  * Load and parse the CA private key from the `PRIVATE_KEY` secret.
  *
- * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
- * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
- * later refuse by default, and because RSA keys in OpenSSH format are
- * converted with invalid CRT parameters that the Workers runtime rejects.
+ * Only Ed25519 and ECDSA keys are supported, as these are the key types that
+ * certificates and KRLs are signed with (see `createSigner` in `ssh/signer.ts`).
  *
- * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link KeyParseError} when the secret cannot be parsed.
  * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
  */
 export declare const getPrivateKey: (env: SshCaBindings) => Promise<PrivateKey>;
-export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<Key>;
-export {};
+/**
+ * Returns the public key of the CA, with `ISSUER_DN` as its comment
+ */
+export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<PublicKey>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AACzD,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAQ7D,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,GAAG,GAAG,KA+BtG,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,WAAW,GAAG,KA+BhH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA+C5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAY1E,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,GAAG,CAWjF,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAkC,SAAS,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/G,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8B1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}