@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/dist/ssh/keys.js

@@ -0,0 +1,277 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+import { base64, base64nopad, base64urlnopad } from "@scure/base";
+import * as P from "micro-packed";
+import { toFixedWidth } from "../sshsig/sig_parser.js";
+import { decodePublicKey, SSHBytes, SSHText } from "./encoding.js";
+/**
+ * Thrown when a key cannot be parsed
+ */
+export class KeyParseError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = "KeyParseError";
+        this.cause = cause;
+        Object.setPrototypeOf(this, KeyParseError.prototype);
+    }
+}
+/**
+ * Thrown when a private key is of a type that cannot be used to sign
+ */
+export class UnsupportedKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsupportedKeyError";
+        Object.setPrototypeOf(this, UnsupportedKeyError.prototype);
+    }
+}
+const equalBytes = (a, b) => {
+    return a.length === b.length && a.every((v, i) => v === b[i]);
+};
+/**
+ * An SSH public key
+ */
+export class PublicKey {
+    /** The key type, for example "ssh-ed25519" */
+    type;
+    /** The wire encoding of the key (RFC 4253 section 6.6) */
+    blob;
+    /** The comment of the key, if any */
+    comment;
+    /**
+     * @param blob The wire encoding of the key
+     * @param comment The comment of the key
+     * @throws {@link KeyParseError} when the key cannot be decoded or its type is not supported
+     */
+    constructor(blob, comment) {
+        try {
+            this.type = decodePublicKey(blob).type;
+        }
+        catch (err) {
+            throw new KeyParseError(err instanceof Error ? err.message : "public key could not be decoded", err);
+        }
+        this.blob = blob;
+        this.comment = comment === "" ? undefined : comment;
+    }
+    /**
+     * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+     *
+     * @param text The public key
+     * @throws {@link KeyParseError} when the key cannot be parsed or its type is not supported
+     */
+    static parse(text) {
+        const [type, data, ...comment] = text.trim().split(/\s+/);
+        if (type === undefined || type === "" || data === undefined) {
+            throw new KeyParseError("public key was not in OpenSSH format");
+        }
+        let blob;
+        try {
+            blob = base64.decode(data);
+        }
+        catch (err) {
+            throw new KeyParseError("public key was not valid base64", err);
+        }
+        const key = new PublicKey(blob, comment.join(" "));
+        if (key.type !== type) {
+            throw new KeyParseError(`public key type ${type} did not match encoded type ${key.type}`);
+        }
+        return key;
+    }
+    /**
+     * Returns the SHA256 fingerprint of the key, as shown by `ssh-keygen -l`,
+     * for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs"
+     */
+    fingerprint() {
+        return `SHA256:${base64nopad.encode(sha256(this.blob))}`;
+    }
+    /**
+     * Returns whether this is the same key as another, ignoring comments
+     */
+    equals(other) {
+        return equalBytes(this.blob, other.blob);
+    }
+    /**
+     * Returns a copy of the key with a different comment
+     */
+    withComment(comment) {
+        return new PublicKey(this.blob, comment);
+    }
+    /**
+     * Returns the key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+     */
+    toString() {
+        const key = `${this.type} ${base64.encode(this.blob)}`;
+        return this.comment === undefined ? key : `${key} ${this.comment}`;
+    }
+}
+/**
+ * The smallest RSA key, in bits, that the CA will issue a certificate for.
+ * This matches the minimum accepted by ssh-ca-client.
+ */
+export const MinimumRsaKeyBits = 2048;
+/**
+ * Returns the size in bits of the modulus of an RSA public key, or undefined
+ * if the key is not an RSA key.
+ *
+ * @param key The public key
+ */
+export const rsaKeyBits = (key) => {
+    if (key.type !== "ssh-rsa") {
+        return undefined;
+    }
+    // the fields of an RSA key are the exponent and the modulus, an mpint
+    // that may have a leading zero byte to keep it positive
+    const modulus = decodePublicKey(key.blob).fields[1];
+    if (modulus === undefined) {
+        return undefined;
+    }
+    const start = modulus.findIndex((byte) => byte !== 0);
+    const first = modulus[start];
+    if (start === -1 || first === undefined) {
+        return 0;
+    }
+    return (modulus.length - start - 1) * 8 + first.toString(2).length;
+};
+const EcdsaCurves = {
+    nistp256: { namedCurve: "P-256", size: 32 },
+    nistp384: { namedCurve: "P-384", size: 48 },
+    nistp521: { namedCurve: "P-521", size: 66 },
+};
+// "openssh-key-v1\0"
+const AUTH_MAGIC = new TextEncoder().encode("openssh-key-v1\0");
+/** The container of an OpenSSH private key (PROTOCOL.key) */
+const OpenSshPrivateKey = P.struct({
+    magic: P.magicBytes(AUTH_MAGIC),
+    cipherName: SSHText,
+    kdfName: SSHText,
+    kdfOptions: SSHBytes,
+    publicKeys: P.array(P.U32BE, SSHBytes),
+    privateKeys: SSHBytes,
+});
+/** The start of the (decrypted) private section of an OpenSSH private key */
+const PrivateSectionStart = P.struct({
+    check1: P.U32BE,
+    check2: P.U32BE,
+    type: SSHText,
+});
+const Ed25519PrivateKey = P.struct({
+    check1: P.U32BE,
+    check2: P.U32BE,
+    type: SSHText,
+    publicKey: SSHBytes,
+    // the seed followed by the public key
+    privateKey: SSHBytes,
+    comment: SSHText,
+});
+const EcdsaPrivateKey = P.struct({
+    check1: P.U32BE,
+    check2: P.U32BE,
+    type: SSHText,
+    curve: SSHText,
+    publicKey: SSHBytes,
+    // an mpint
+    privateKey: SSHBytes,
+    comment: SSHText,
+});
+/**
+ * Returns a short name for the type of a key, for example "rsa" for "ssh-rsa"
+ */
+const keyTypeName = (type) => {
+    return type.replace(/^ssh-/, "").replace(/^ecdsa-sha2-.*$/, "ecdsa");
+};
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
+ * created by `ssh-keygen`
+ *
+ * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----`
+ * @returns The private key
+ * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
+ * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
+ */
+export const parsePrivateKey = (text) => {
+    const match = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]*?)-----END OPENSSH PRIVATE KEY-----/.exec(text);
+    if (match === null) {
+        throw new KeyParseError("private key was not in OpenSSH format, as created by ssh-keygen (starting with -----BEGIN OPENSSH PRIVATE KEY-----)");
+    }
+    let container;
+    try {
+        container = OpenSshPrivateKey.decode(base64.decode(match[1].replace(/\s+/g, "")));
+    }
+    catch (err) {
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+    if (container.cipherName !== "none" || container.kdfName !== "none") {
+        throw new KeyParseError("encrypted private keys are not supported");
+    }
+    if (container.publicKeys.length !== 1) {
+        throw new KeyParseError(`private key must contain one key, not ${container.publicKeys.length}`);
+    }
+    // the private section is padded to a block size, so may have trailing bytes
+    const options = { allowUnreadBytes: true };
+    let start;
+    try {
+        start = PrivateSectionStart.decode(container.privateKeys, options);
+    }
+    catch (err) {
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+    if (start.check1 !== start.check2) {
+        throw new KeyParseError("private key check values did not match");
+    }
+    try {
+        if (start.type === "ssh-ed25519") {
+            const key = Ed25519PrivateKey.decode(container.privateKeys, options);
+            if (key.publicKey.length !== 32 || key.privateKey.length !== 64) {
+                throw new KeyParseError("Ed25519 private key was an unexpected length");
+            }
+            const publicKey = new PublicKey(container.publicKeys[0], key.comment);
+            if (!equalBytes(P.struct({ type: SSHText, key: SSHBytes }).encode({ type: start.type, key: key.publicKey }), publicKey.blob)) {
+                throw new KeyParseError("private key did not match its public key");
+            }
+            return {
+                type: "ed25519",
+                publicKey,
+                jwk: {
+                    kty: "OKP",
+                    crv: "Ed25519",
+                    d: base64urlnopad.encode(key.privateKey.subarray(0, 32)),
+                    x: base64urlnopad.encode(key.publicKey),
+                },
+            };
+        }
+        if (start.type.startsWith("ecdsa-sha2-")) {
+            const key = EcdsaPrivateKey.decode(container.privateKeys, options);
+            const curve = EcdsaCurves[key.curve];
+            if (curve === undefined || start.type !== `ecdsa-sha2-${key.curve}`) {
+                throw new UnsupportedKeyError(`ECDSA curve ${key.curve} is not supported`);
+            }
+            if (key.publicKey.length !== 1 + curve.size * 2 || key.publicKey[0] !== 0x04) {
+                throw new KeyParseError(`unexpected ECDSA public key encoding for ${key.curve}`);
+            }
+            const publicKey = new PublicKey(container.publicKeys[0], key.comment);
+            if (!equalBytes(P.struct({ type: SSHText, curve: SSHText, key: SSHBytes }).encode({ type: start.type, curve: key.curve, key: key.publicKey }), publicKey.blob)) {
+                throw new KeyParseError("private key did not match its public key");
+            }
+            return {
+                type: "ecdsa",
+                curve: key.curve,
+                publicKey,
+                jwk: {
+                    kty: "EC",
+                    crv: curve.namedCurve,
+                    // d is an mpint, so may be short or have a leading sign byte
+                    d: base64urlnopad.encode(toFixedWidth(key.privateKey, curve.size)),
+                    x: base64urlnopad.encode(key.publicKey.subarray(1, 1 + curve.size)),
+                    y: base64urlnopad.encode(key.publicKey.subarray(1 + curve.size)),
+                },
+            };
+        }
+    }
+    catch (err) {
+        if (err instanceof KeyParseError || err instanceof UnsupportedKeyError) {
+            throw err;
+        }
+        throw new KeyParseError("private key could not be decoded", err);
+    }
+    throw new UnsupportedKeyError(`CA key type ${keyTypeName(start.type)} is not supported, the CA key must be Ed25519 or ECDSA`);
+};
+//# sourceMappingURL=keys.js.map

package/dist/ssh/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAElE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IACrB,8CAA8C;IACrC,IAAI,CAAQ;IACrB,0DAA0D;IACjD,IAAI,CAAY;IACzB,qCAAqC;IAC5B,OAAO,CAAoB;IAEpC;;;;OAIG;IACH,YAAY,IAAgB,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,mBAAmB,IAAI,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,OAAO,GAAG,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,OAAO,UAAU,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAA2B;QACtC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAEtD,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAc,EAAsB,EAAE;IAChE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,CAAA;IACT,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACnE,CAAC,CAAA;AAKD,MAAM,WAAW,GAAuE;IACvF,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;CAC3C,CAAA;AAiBD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE/D,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACtC,WAAW,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,QAAQ;IACnB,sCAAsC;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW;IACX,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE;IAC3D,MAAM,KAAK,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,aAAa,CAAC,qHAAqH,CAAC,CAAA;IAC/I,CAAC;IAED,IAAI,SAAkD,CAAA;IACtD,IAAI,CAAC;QACJ,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,yCAAyC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,8CAA8C,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9H,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACvC;aACD,CAAA;QACF,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAA;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,4CAA4C,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChK,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,GAAG,CAAC,KAAmB;gBAC9B,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,KAAK,CAAC,UAAU;oBACrB,6DAA6D;oBAC7D,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChE;aACD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;AAC9H,CAAC,CAAA"}

package/dist/ssh/signer.d.ts

@@ -0,0 +1,35 @@
+import type { PrivateKey, PublicKey } from "./keys.js";
+/**
+ * Signs data with a CA key using WebCrypto, returning signatures in the SSH
+ * wire format
+ */
+export interface Signer {
+    /** The wire encoding of the public key of the signer */
+    readonly publicKey: Uint8Array;
+    /**
+     * Signs data
+     *
+     * @param data The data to sign
+     * @returns The signature in the SSH wire format (RFC 4253 section 6.6)
+     */
+    sign(data: Uint8Array<ArrayBuffer>): Promise<Uint8Array>;
+}
+/**
+ * Creates a {@link Signer} for an Ed25519 or ECDSA (P-256, P-384 or P-521)
+ * private key
+ *
+ * @param key The private key to sign with
+ * @returns The signer
+ */
+export declare const createSigner: (key: PrivateKey) => Promise<Signer>;
+/**
+ * Verifies a signature in the SSH wire format made with an Ed25519 or ECDSA
+ * key
+ *
+ * @param publicKey The key the signature must have been made with
+ * @param signature The signature in the SSH wire format
+ * @param data The data that was signed
+ * @returns true if the signature is valid, false if it is not or the key type is not supported
+ */
+export declare const verify: (publicKey: PublicKey, signature: Uint8Array, data: Uint8Array<ArrayBuffer>) => Promise<boolean>;
+//# sourceMappingURL=signer.d.ts.map

package/dist/ssh/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/ssh/signer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAc,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,MAAM;IACtB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACxD;AAuBD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAe,UAAU,KAAG,OAAO,CAAC,MAAM,CAmClE,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,cAAqB,SAAS,aAAa,UAAU,QAAQ,UAAU,CAAC,WAAW,CAAC,KAAG,OAAO,CAAC,OAAO,CAiCxH,CAAA"}

package/dist/ssh/signer.js

@@ -0,0 +1,99 @@
+import * as P from "micro-packed";
+import { toFixedWidth } from "../sshsig/sig_parser.js";
+import { decodePublicKey, SSHBytes, SSHText, SSHUnsignedMpint } from "./encoding.js";
+/** An Ed25519 signature: string algorithm, string signature */
+const Ed25519Signature = P.struct({
+    algorithm: SSHText,
+    signature: SSHBytes,
+});
+/** An ECDSA signature: string algorithm, string (mpint r, mpint s) */
+const EcdsaSignature = P.struct({
+    algorithm: SSHText,
+    signature: P.prefix(P.U32BE, P.struct({
+        r: SSHUnsignedMpint,
+        s: SSHUnsignedMpint,
+    })),
+});
+const EcdsaCurves = {
+    nistp256: { namedCurve: "P-256", hash: "SHA-256", size: 32 },
+    nistp384: { namedCurve: "P-384", hash: "SHA-384", size: 48 },
+    nistp521: { namedCurve: "P-521", hash: "SHA-512", size: 66 },
+};
+/**
+ * Creates a {@link Signer} for an Ed25519 or ECDSA (P-256, P-384 or P-521)
+ * private key
+ *
+ * @param key The private key to sign with
+ * @returns The signer
+ */
+export const createSigner = async (key) => {
+    const publicKey = key.publicKey.blob;
+    if (key.type === "ed25519") {
+        const cryptoKey = await crypto.subtle.importKey("jwk", key.jwk, { name: "Ed25519" }, false, ["sign"]);
+        return {
+            publicKey,
+            sign: async (data) => Ed25519Signature.encode({
+                algorithm: "ssh-ed25519",
+                signature: new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, cryptoKey, data)),
+            }),
+        };
+    }
+    const curve = EcdsaCurves[key.curve];
+    const cryptoKey = await crypto.subtle.importKey("jwk", key.jwk, { name: "ECDSA", namedCurve: curve.namedCurve }, false, ["sign"]);
+    return {
+        publicKey,
+        sign: async (data) => {
+            // WebCrypto returns r || s, each the size of the curve
+            const signature = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: { name: curve.hash } }, cryptoKey, data));
+            return EcdsaSignature.encode({
+                // the algorithm is named for the curve of the key, never
+                // worked out from the signature
+                algorithm: `ecdsa-sha2-${key.curve}`,
+                signature: {
+                    r: signature.subarray(0, curve.size),
+                    s: signature.subarray(curve.size),
+                },
+            });
+        },
+    };
+};
+/**
+ * Verifies a signature in the SSH wire format made with an Ed25519 or ECDSA
+ * key
+ *
+ * @param publicKey The key the signature must have been made with
+ * @param signature The signature in the SSH wire format
+ * @param data The data that was signed
+ * @returns true if the signature is valid, false if it is not or the key type is not supported
+ */
+export const verify = async (publicKey, signature, data) => {
+    try {
+        const { type, fields } = decodePublicKey(publicKey.blob);
+        if (type === "ssh-ed25519") {
+            const { algorithm, signature: raw } = Ed25519Signature.decode(signature);
+            if (algorithm !== type) {
+                return false;
+            }
+            const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(fields[0]), { name: "Ed25519" }, false, ["verify"]);
+            return await crypto.subtle.verify({ name: "Ed25519" }, cryptoKey, new Uint8Array(raw), data);
+        }
+        const curveName = type.replace(/^ecdsa-sha2-/, "");
+        const curve = EcdsaCurves[curveName];
+        if (curve !== undefined && type === `ecdsa-sha2-${curveName}`) {
+            const { algorithm, signature: { r, s } } = EcdsaSignature.decode(signature);
+            if (algorithm !== type || r.length > curve.size || s.length > curve.size) {
+                return false;
+            }
+            // fields are the curve name and the public point
+            const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(fields[1]), { name: "ECDSA", namedCurve: curve.namedCurve }, false, ["verify"]);
+            const raw = P.utils.concatBytes(toFixedWidth(r, curve.size), toFixedWidth(s, curve.size));
+            return await crypto.subtle.verify({ name: "ECDSA", hash: { name: curve.hash } }, cryptoKey, new Uint8Array(raw), data);
+        }
+        return false;
+    }
+    catch {
+        // a signature or key that cannot be decoded or imported is not valid
+        return false;
+    }
+};
+//# sourceMappingURL=signer.js.map

package/dist/ssh/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/ssh/signer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAmBpF,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,QAAQ;CACnB,CAAC,CAAA;AAEF,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC,EAAE,gBAAgB;QACnB,CAAC,EAAE,gBAAgB;KACnB,CAAC,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,WAAW,GAAqF;IACrG,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC5D,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC5D,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;CAC5D,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,GAAe,EAAmB,EAAE;IACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAA;IAEpC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QAErG,OAAO;YACN,SAAS;YACT,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC7C,SAAS,EAAE,aAAa;gBACxB,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;aACzF,CAAC;SACF,CAAA;IACF,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAEjI,OAAO;QACN,SAAS;QACT,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,uDAAuD;YACvD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YAE1H,OAAO,cAAc,CAAC,MAAM,CAAC;gBAC5B,yDAAyD;gBACzD,gCAAgC;gBAChC,SAAS,EAAE,cAAc,GAAG,CAAC,KAAK,EAAE;gBACpC,SAAS,EAAE;oBACV,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;oBACpC,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;iBACjC;aACD,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,SAAoB,EAAE,SAAqB,EAAE,IAA6B,EAAoB,EAAE;IAC5H,IAAI,CAAC;QACJ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAExD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAE1H,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAe,CAAA;QAChE,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,SAAS,EAAE,EAAE,CAAC;YAC/D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC3E,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAA;YACb,CAAC;YACD,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YACtJ,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAEzF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;QACvH,CAAC;QAED,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;QACrE,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC,CAAA"}

package/dist/types.d.ts

@@ -14,11 +14,6 @@ export type CertificateRequestJWTPayload = {
     sub: string;
     [key: string]: string | string[];
 } & JWTPayload;
-export type SSHExtension = {
-    critical: boolean;
-    name: string;
-    data: Buffer<ArrayBuffer>;
-};
 /**
  * The result of executing a statement via {@link CaPreparedStatement.run} or
  * {@link CaDatabase.batch}, modelled on a Cloudflare D1 result.
@@ -83,28 +78,78 @@ export interface CaSecret {
     get(): Promise<string>;
 }
 /**
- * The bindings (environment) the CA expects, see {@link CaDatabase} and
- * {@link CaSecret} for the non-string bindings.
+ * A rate limiter, with the same shape as a Cloudflare Workers rate limit
+ * binding.
+ *
+ * A Workers `RateLimit` binding satisfies this structurally. On other
+ * runtimes any limiter with the same shape may be used.
+ */
+export interface CaRateLimiter {
+    /**
+     * Counts a request against the limit for a key
+     *
+     * @param options The key the request is counted against, for example the client IP address
+     * @returns Whether the request is within the limit
+     */
+    limit(options: {
+        key: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+}
+/**
+ * A key-value cache, with the subset of a Cloudflare Workers KV namespace
+ * binding used by the CA.
+ *
+ * A Workers `KVNamespace` binding satisfies this structurally. On other
+ * runtimes any cache with the same shape may be used, such as the in-memory
+ * cache returned by `cacheInMemory` from `@andrewheberle/serverless-ssh-ca/node`.
+ */
+export interface CaCache {
+    /** Returns the value for a key, or null if there is none */
+    get(key: string): Promise<string | null>;
+    /** Sets the value for a key, which may expire after `expirationTtl` seconds */
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+}
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase},
+ * {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache} for the non-string
+ * bindings.
  */
 export interface SshCaBindings {
-    DB: CaDatabase;
+    CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
+    JWT_ALGORITHMS: string | string[];
+    /** The audience the identity token, and unless {@link SshCaBindings.JWT_ACCESS_TOKEN_AUD} is set the access token, must be issued for */
+    JWT_AUD: string | string[];
+    /** The audience the access token must be issued for, when it differs from {@link SshCaBindings.JWT_AUD} */
+    JWT_ACCESS_TOKEN_AUD?: string | string[];
+    JWT_ISSUER: string;
+    JWT_JWKS_URL: string;
+    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
+    LOG_LEVEL?: string;
     DB_CERTIFICATE_RETENTION: string;
+    DB: CaDatabase;
+    ISSUER_DN: string;
     PRIVATE_KEY: CaSecret;
+    /**
+     * Limits requests to issue, renew and revoke certificates, see
+     * {@link CaRateLimiter}. Requests are not limited when this is not set.
+     */
+    RATE_LIMITER?: CaRateLimiter;
+    /**
+     * Caches KRLs until a certificate is revoked, see {@link CaCache}. KRLs
+     * are generated for every request when this is not set.
+     */
+    CACHE?: CaCache;
     SSH_CERTIFICATE_EXTENSIONS: string;
-    SSH_CERTIFICATE_LIFETIME: string;
-    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;
     SSH_CERTIFICATE_INCLUDE_SELF_EMAIL?: string | boolean;
+    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;
+    SSH_CERTIFICATE_LIFETIME: string;
     SSH_CERTIFICATE_PRINCIPALS?: string | string[];
-    SSH_HOST_CERTIFICATE_LIFETIME: string;
     SSH_HOST_CERTIFICATE_ALLOWED_EMAILS?: string | string[];
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES?: string | string[];
-    ISSUER_DN: string;
-    JWT_JWKS_URL: string;
-    JWT_AUD?: string | string[];
-    JWT_ISSUER: string;
-    JWT_ALGORITHMS: string | string[];
-    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
-    CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
-    LOG_LEVEL?: string;
+    SSH_HOST_CERTIFICATE_LIFETIME: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACpB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,yIAAyI;IACzI,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC1B,2GAA2G;IAC3G,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}