@andrewheberle/serverless-ssh-ca 0.23.0 → 0.24.0

package/dist/index.js

@@ -1,5 +1,6 @@
 import { dbCleanup } from "./db/index.js";
 import { createApp } from "./router.js";
+export { cloudflareClientIp } from "./router.js";
 /**
  * Create an instance of the CA bound to a fixed set of bindings, for use on
  * runtimes other than Cloudflare Workers.
@@ -8,10 +9,11 @@ import { createApp } from "./router.js";
  * the runtime on each request.
  *
  * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @param options Options for the CA, such as the key requests are rate limited by, see {@link SshCaOptions}
  * @returns The CA's request handler and database cleanup task, see {@link SshCa}
  */
-export const createSshCa = (env) => {
-    const app = createApp(env);
+export const createSshCa = (env, options = {}) => {
+    const app = createApp(env, options);
     return {
         fetch: async (req) => await app.fetch(req, env),
         cleanup: async () => await dbCleanup(env),

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA2BvC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAS,EAAE;IACrD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAE1B,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,GAAY,EAAqB,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;QAC3E,OAAO,EAAE,KAAK,IAAmB,EAAE,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC;KAC3D,CAAA;AACL,CAAC,CAAA;AAED,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAwC,MAAM,aAAa,CAAA;AAyBtF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,OAAO,GAAiB,EAAE,EAAS,EAAE;IACjF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAEnC,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,GAAY,EAAqB,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;QAC3E,OAAO,EAAE,KAAK,IAAmB,EAAE,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC;KAC3D,CAAA;AACL,CAAC,CAAA;AAED,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}

package/dist/krl.d.ts

@@ -32,8 +32,9 @@ export declare class KRLBuilder {
      *
      * @param krlVersion  Optional KRL version number (default: 1).
      * @param comment     Optional comment string embedded in the header.
+     * @param generatedAt Optional time the KRL was generated (default: now).
      */
-    generate(krlVersion?: bigint, comment?: string): ArrayBuffer;
+    generate(krlVersion?: bigint, comment?: string, generatedAt?: Date): ArrayBuffer;
     /**
      * Return the SSHSIG signature of the KRL.
      *

package/dist/krl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"krl.d.ts","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAsF/C,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,IAAI,CAA2B;IAEvC,YAAY,KAAK,EAAE,UAAU,EAE5B;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAMlC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAMhC;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9B;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAE,MAAW,EAAE,OAAO,SAAK,GAAG,WAAW,CAgE3D;IAED;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAqDjC;CACJ"}
+{"version":3,"file":"krl.d.ts","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAsF/C,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,IAAI,CAA2B;IAEvC,YAAY,KAAK,EAAE,UAAU,EAE5B;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAMlC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAMhC;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9B;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,GAAE,MAAW,EAAE,OAAO,SAAK,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,WAAW,CAgE/E;IAED;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAqDjC;CACJ"}

package/dist/krl.js

@@ -121,13 +121,14 @@ export class KRLBuilder {
      *
      * @param krlVersion  Optional KRL version number (default: 1).
      * @param comment     Optional comment string embedded in the header.
+     * @param generatedAt Optional time the KRL was generated (default: now).
      */
-    generate(krlVersion = 1n, comment = "") {
+    generate(krlVersion = 1n, comment = "", generatedAt) {
         if (this._krl !== null) {
             return this._krl;
         }
         // ── Header ──────────────────────────────────────────────────────────────
-        const generatedDate = BigInt(Math.floor(Date.now() / 1000));
+        const generatedDate = BigInt(Math.floor((generatedAt?.getTime() ?? Date.now()) / 1000));
         const header = concat(encodeUint64(KRL_MAGIC), encodeUint32(KRL_FORMAT_VERSION), encodeUint64(krlVersion), encodeUint64(generatedDate), encodeUint64(0n), // flags — none defined
         encodeString(""), // reserved
         encodeString(comment));

package/dist/krl.js.map

@@ -1 +1 @@
-{"version":3,"file":"krl.js","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,gFAAgF;AAEhF,MAAM,SAAS,GAAG,mBAAmB,CAAA,CAAC,eAAe;AACrD,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,gFAAgF;AAEhF,kCAAkC;AAClC,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACtD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC5C,MAAM,KAAK,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAG,KAAmB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACvD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,SAAS,GAAG,gDAAgD,CAAA;AAClE,MAAM,cAAc,GAAG,QAAQ,CAAA;AAE/B;;GAEG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACH,+BAA+B;QAC/B,GAAG,KAAK;QACR,6BAA6B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACF,MAAM,CAAY;IAClB,QAAQ,GAAa,EAAE,CAAA;IACvB,OAAO,GAAa,EAAE,CAAA;IAC/B,IAAI,GAAuB,IAAI,CAAA;IAEvC,YAAY,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAiB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAgB;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAC1C,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAW,EAAE,EAAE,OAAO,GAAG,EAAE;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAE3D,MAAM,MAAM,GAAG,MAAM,CACjB,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,kBAAkB,CAAC,EAChC,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,EAAE,CAAC,EAAE,uBAAuB;QACzC,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,4EAA4E;QAE5E,MAAM,eAAe,GAAiB,EAAE,CAAA;QAExC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;YAC9D,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAC3D,CAAA;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CACrB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAChD,CAAA;YACD,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,uBAAuB,EAAE,UAAU,CAAC,CACrD,CAAA;QACL,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,mDAAmD;QACnD,mBAAmB;QACnB,qBAAqB;QACrB,oCAAoC;QACpC,EAAE;QACF,MAAM,eAAe,GAAG,MAAM,CAC1B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS;QACnD,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,GAAG,eAAe,CACrB,CAAA;QAED,MAAM,mBAAmB,GAAG,aAAa,CACrC,wBAAwB,EACxB,eAAe,CAClB,CAAA;QAED,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAE/C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAqB,CAAA;QAErC,OAAO,IAAI,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS;QACX,IAAI,GAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE9C,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAC7C,CAAA;QAED,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CACrB,YAAY,EACZ,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE5C,qCAAqC;QACrC,EAAE;QACF,sBAAsB;QACtB,6BAA6B;QAC7B,uBAAuB;QACvB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,EACZ,YAAY,CAAC,WAAW,CAAC,EACzB,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAC9B,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,CACvB,CAAA;QAED,uBAAuB;QACvB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;CACJ"}
+{"version":3,"file":"krl.js","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,gFAAgF;AAEhF,MAAM,SAAS,GAAG,mBAAmB,CAAA,CAAC,eAAe;AACrD,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,gFAAgF;AAEhF,kCAAkC;AAClC,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACtD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC5C,MAAM,KAAK,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAG,KAAmB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACvD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,SAAS,GAAG,gDAAgD,CAAA;AAClE,MAAM,cAAc,GAAG,QAAQ,CAAA;AAE/B;;GAEG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACH,+BAA+B;QAC/B,GAAG,KAAK;QACR,6BAA6B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACF,MAAM,CAAY;IAClB,QAAQ,GAAa,EAAE,CAAA;IACvB,OAAO,GAAa,EAAE,CAAA;IAC/B,IAAI,GAAuB,IAAI,CAAA;IAEvC,YAAY,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAiB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAgB;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAC1C,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,GAAW,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,WAAkB;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QAEvF,MAAM,MAAM,GAAG,MAAM,CACjB,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,kBAAkB,CAAC,EAChC,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,EAAE,CAAC,EAAE,uBAAuB;QACzC,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,4EAA4E;QAE5E,MAAM,eAAe,GAAiB,EAAE,CAAA;QAExC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;YAC9D,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAC3D,CAAA;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CACrB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAChD,CAAA;YACD,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,uBAAuB,EAAE,UAAU,CAAC,CACrD,CAAA;QACL,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,mDAAmD;QACnD,mBAAmB;QACnB,qBAAqB;QACrB,oCAAoC;QACpC,EAAE;QACF,MAAM,eAAe,GAAG,MAAM,CAC1B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS;QACnD,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,GAAG,eAAe,CACrB,CAAA;QAED,MAAM,mBAAmB,GAAG,aAAa,CACrC,wBAAwB,EACxB,eAAe,CAClB,CAAA;QAED,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAE/C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAqB,CAAA;QAErC,OAAO,IAAI,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS;QACX,IAAI,GAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE9C,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAC7C,CAAA;QAED,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CACrB,YAAY,EACZ,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE5C,qCAAqC;QACrC,EAAE;QACF,sBAAsB;QACtB,6BAA6B;QAC7B,uBAAuB;QACvB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,EACZ,YAAY,CAAC,WAAW,CAAC,EACzB,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAC9B,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,CACvB,CAAA;QAED,uBAAuB;QACvB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;CACJ"}

package/dist/node/cache.d.ts

@@ -0,0 +1,21 @@
+import type { CaCache } from "../types.js";
+/**
+ * Create an in-memory cache for the `CACHE` binding, with the same shape as a
+ * Cloudflare Workers KV namespace (see {@link CaCache}).
+ *
+ * Entries are kept in memory by the process, so they are lost on restart and
+ * not shared between processes.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ *     CACHE: cacheInMemory(),
+ * })
+ * ```
+ *
+ * @returns A cache for the `CACHE` binding, see {@link CaCache}
+ */
+export declare const cacheInMemory: () => CaCache;
+//# sourceMappingURL=cache.d.ts.map

package/dist/node/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/node/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAQ1C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,QAAO,OAmChC,CAAA"}

package/dist/node/cache.js

@@ -0,0 +1,49 @@
+/**
+ * Create an in-memory cache for the `CACHE` binding, with the same shape as a
+ * Cloudflare Workers KV namespace (see {@link CaCache}).
+ *
+ * Entries are kept in memory by the process, so they are lost on restart and
+ * not shared between processes.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ *     CACHE: cacheInMemory(),
+ * })
+ * ```
+ *
+ * @returns A cache for the `CACHE` binding, see {@link CaCache}
+ */
+export const cacheInMemory = () => {
+    const entries = new Map();
+    const expired = (entry, now) => entry.expires !== undefined && now >= entry.expires;
+    return {
+        get: async (key) => {
+            const entry = entries.get(key);
+            if (entry === undefined) {
+                return null;
+            }
+            if (expired(entry, Date.now())) {
+                entries.delete(key);
+                return null;
+            }
+            return entry.value;
+        },
+        put: async (key, value, options) => {
+            const now = Date.now();
+            // remove entries that have expired, as they are not read again
+            for (const [k, entry] of entries) {
+                if (expired(entry, now)) {
+                    entries.delete(k);
+                }
+            }
+            entries.set(key, {
+                value,
+                expires: options?.expirationTtl === undefined ? undefined : now + options.expirationTtl * 1000,
+            });
+        },
+    };
+};
+//# sourceMappingURL=cache.js.map

package/dist/node/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/node/cache.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,EAAE;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;IAExC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,CAAA;IAE3G,OAAO;QACN,GAAG,EAAE,KAAK,EAAE,GAAW,EAA0B,EAAE;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAA;YACZ,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACnB,OAAO,IAAI,CAAA;YACZ,CAAC;YAED,OAAO,KAAK,CAAC,KAAK,CAAA;QACnB,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,OAAoC,EAAiB,EAAE;YAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAEtB,+DAA+D;YAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC;YACF,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,KAAK;gBACL,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI;aAC9F,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC,CAAA"}

package/dist/node/env.d.ts

@@ -1,5 +1,5 @@
 import z from "zod";
-import type { CaDatabase, CaSecret, SshCaBindings } from "../types.js";
+import type { CaCache, CaDatabase, CaRateLimiter, CaSecret, SshCaBindings } from "../types.js";
 /**
  * The environment variables read by {@link bindingsFromEnv}, which match the
  * Workers vars documented for the CA.
@@ -22,7 +22,8 @@ export declare const EnvSchema: z.ZodObject<{
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.ZodOptional<z.ZodString>;
     ISSUER_DN: z.ZodString;
     JWT_JWKS_URL: z.ZodURL;
-    JWT_AUD: z.ZodOptional<z.ZodString>;
+    JWT_AUD: z.ZodString;
+    JWT_ACCESS_TOKEN_AUD: z.ZodOptional<z.ZodString>;
     JWT_ISSUER: z.ZodString;
     JWT_ALGORITHMS: z.ZodString;
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: z.ZodString;
@@ -60,7 +61,7 @@ export declare class InvalidConfigurationError extends Error {
  * })
  * ```
  *
- * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param bindings The database, private key, optional rate limiter and optional cache, see {@link CaDatabase}, {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache}
  * @param source The environment variables to read, `process.env` by default
  * @returns The bindings to pass to `createSshCa`
  * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
@@ -68,5 +69,7 @@ export declare class InvalidConfigurationError extends Error {
 export declare const bindingsFromEnv: (bindings: {
     DB: CaDatabase;
     PRIVATE_KEY: CaSecret;
+    RATE_LIMITER?: CaRateLimiter;
+    CACHE?: CaCache;
 }, source?: Record<string, string | undefined>) => SshCaBindings;
 //# sourceMappingURL=env.d.ts.map

package/dist/node/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAYtE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAA;CAAE,WAC3C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAY9F;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,WAC1F,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}

package/dist/node/env.js

@@ -27,7 +27,8 @@ export const EnvSchema = z.object({
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.string().optional(),
     ISSUER_DN: required,
     JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
-    JWT_AUD: z.string().optional(),
+    JWT_AUD: required,
+    JWT_ACCESS_TOKEN_AUD: z.string().optional(),
     JWT_ISSUER: required,
     JWT_ALGORITHMS: required,
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
@@ -59,7 +60,7 @@ export class InvalidConfigurationError extends Error {
  * })
  * ```
  *
- * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param bindings The database, private key, optional rate limiter and optional cache, see {@link CaDatabase}, {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache}
  * @param source The environment variables to read, `process.env` by default
  * @returns The bindings to pass to `createSshCa`
  * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
@@ -69,6 +70,6 @@ export const bindingsFromEnv = (bindings, source = process.env) => {
     if (!result.success) {
         throw new InvalidConfigurationError(`invalid configuration:\n${z.prettifyError(result.error)}`);
     }
-    return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY };
+    return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY, RATE_LIMITER: bindings.RATE_LIMITER, CACHE: bindings.CACHE };
 };
 //# sourceMappingURL=env.js.map

package/dist/node/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAmD,EACnD,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;AAC9E,CAAC,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,QAAQ;IACjB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAkG,EAClG,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;AAC1I,CAAC,CAAA"}

package/dist/node/index.d.ts

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js";
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
 export type { CaEnv } from "./env.js";
 export { secretFromFile, secretFromString } from "./secret.js";

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/node/index.js

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js";
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
 export { secretFromFile, secretFromString } from "./secret.js";
 export { fromNodeSqlite } from "./sqlite.js";

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/router.d.ts

@@ -3,5 +3,29 @@ import type { SshCaBindings } from "./types.js";
 export type AppContext = Context<{
     Bindings: SshCaBindings;
 }>;
-export declare const createApp: (env: SshCaBindings) => import("chanfana").HonoOpenAPIRouterType<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+/**
+ * Returns the key a request is rate limited by, or undefined if the request
+ * should not be rate limited.
+ */
+export type RateLimitKey = (req: Request) => string | undefined;
+/**
+ * Options for the CA that are not part of its bindings.
+ */
+export interface SshCaOptions {
+    /**
+     * Returns the key requests are rate limited by when `RATE_LIMITER` is
+     * set. Defaults to the client IP address in the `CF-Connecting-IP` header,
+     * which is set by Cloudflare, so other runtimes should provide one that
+     * suits their limiter, for example using a header set by a reverse proxy.
+     */
+    rateLimitKey?: RateLimitKey;
+}
+/**
+ * Returns the client IP address set by Cloudflare in the `CF-Connecting-IP`
+ * header, which is the default key requests are rate limited by.
+ */
+export declare const cloudflareClientIp: RateLimitKey;
+export declare const createApp: (env: SshCaBindings, options?: SshCaOptions) => import("chanfana").HonoOpenAPIRouterType<{
+    Bindings: SshCaBindings;
+}, import("hono/types").BlankSchema, "/">;
 //# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAKzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHAgC3C,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,YAAwE,CAAA;AAKzG,eAAO,MAAM,SAAS,QAAS,aAAa,YAAW,YAAY;cAC7B,aAAa;yCAgElD,CAAA"}

package/dist/router.js

@@ -4,8 +4,45 @@ import { createApi as apiv3 } from "./api/v3/index.js";
 import { BasePath as v4BasePath, createApi as apiv4 } from "./api/v4/index.js";
 import { HTTPException } from "hono/http-exception";
 import { logger } from "./logger.js";
-export const createApp = (env) => {
+import { TooManyRequestsException } from "chanfana";
+/**
+ * Returns the client IP address set by Cloudflare in the `CF-Connecting-IP`
+ * header, which is the default key requests are rate limited by.
+ */
+export const cloudflareClientIp = (req) => req.headers.get("CF-Connecting-IP") ?? undefined;
+// requests that only read from the CA, which are not rate limited
+const ReadMethods = new Set(["GET", "HEAD", "OPTIONS"]);
+export const createApp = (env, options = {}) => {
     const hono = new Hono();
+    const rateLimitKey = options.rateLimitKey ?? cloudflareClientIp;
+    // limit requests to issue, renew and revoke certificates
+    hono.use("/api/*", async (c, next) => {
+        const limiter = c.env.RATE_LIMITER;
+        if (limiter === undefined || ReadMethods.has(c.req.method)) {
+            return await next();
+        }
+        const l = logger(env).with("in", "rateLimit");
+        const key = rateLimitKey(c.req.raw);
+        if (key === undefined) {
+            l.debug("no rate limit key for request");
+            return await next();
+        }
+        let success;
+        try {
+            success = (await limiter.limit({ key })).success;
+        }
+        catch (err) {
+            // a failing limiter must not stop certificates being issued or revoked
+            l.error("rate limiter failed", "error", err);
+            return await next();
+        }
+        if (!success) {
+            l.warn("request was rate limited", "key", key, "method", c.req.method, "path", c.req.path);
+            const err = new TooManyRequestsException();
+            return c.json({ success: false, errors: err.buildResponse(), result: {} }, 429);
+        }
+        return await next();
+    });
     // add error handling
     hono.onError((err, c) => {
         if (err instanceof HTTPException) {

package/dist/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AAwBnD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAA;AAEzG,kEAAkE;AAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,OAAO,GAAiB,EAAE,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,EAA+B,CAAA;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAA;IAE/D,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;YACxC,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,uEAAuE;YACvE,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC5C,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC1F,MAAM,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAED,OAAO,MAAM,IAAI,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}

package/dist/ssh/keys.d.ts

@@ -51,6 +51,18 @@ export declare class PublicKey {
      */
     toString(): string;
 }
+/**
+ * The smallest RSA key, in bits, that the CA will issue a certificate for.
+ * This matches the minimum accepted by ssh-ca-client.
+ */
+export declare const MinimumRsaKeyBits = 2048;
+/**
+ * Returns the size in bits of the modulus of an RSA public key, or undefined
+ * if the key is not an RSA key.
+ *
+ * @param key The public key
+ */
+export declare const rsaKeyBits: (key: PublicKey) => number | undefined;
 /** The ECDSA curves that can be used to sign */
 export type EcdsaCurve = "nistp256" | "nistp384" | "nistp521";
 /**

package/dist/ssh/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAMD;;GAEG;AACH,qBAAa,SAAS;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAEpC;;;;OAIG;IACH,YAAY,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAQ7C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAmBpC;IAED;;;OAGG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAEhC;IAED;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAIjB;CACD;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAA;AAQ7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,GAAG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,CAAA;AAkDD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,UA2F9C,CAAA"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAMD;;GAEG;AACH,qBAAa,SAAS;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAEpC;;;;OAIG;IACH,YAAY,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAQ7C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAmBpC;IAED;;;OAGG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAEhC;IAED;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAIjB;CACD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAA;AAErC;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAS,SAAS,KAAG,MAAM,GAAG,SAmBpD,CAAA;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAA;AAQ7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,GAAG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,CAAA;AAkDD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,UA2F9C,CAAA"}

package/dist/ssh/keys.js

@@ -103,6 +103,34 @@ export class PublicKey {
         return this.comment === undefined ? key : `${key} ${this.comment}`;
     }
 }
+/**
+ * The smallest RSA key, in bits, that the CA will issue a certificate for.
+ * This matches the minimum accepted by ssh-ca-client.
+ */
+export const MinimumRsaKeyBits = 2048;
+/**
+ * Returns the size in bits of the modulus of an RSA public key, or undefined
+ * if the key is not an RSA key.
+ *
+ * @param key The public key
+ */
+export const rsaKeyBits = (key) => {
+    if (key.type !== "ssh-rsa") {
+        return undefined;
+    }
+    // the fields of an RSA key are the exponent and the modulus, an mpint
+    // that may have a leading zero byte to keep it positive
+    const modulus = decodePublicKey(key.blob).fields[1];
+    if (modulus === undefined) {
+        return undefined;
+    }
+    const start = modulus.findIndex((byte) => byte !== 0);
+    const first = modulus[start];
+    if (start === -1 || first === undefined) {
+        return 0;
+    }
+    return (modulus.length - start - 1) * 8 + first.toString(2).length;
+};
 const EcdsaCurves = {
     nistp256: { namedCurve: "P-256", size: 32 },
     nistp384: { namedCurve: "P-384", size: 48 },

package/dist/ssh/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAElE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IACrB,8CAA8C;IACrC,IAAI,CAAQ;IACrB,0DAA0D;IACjD,IAAI,CAAY;IACzB,qCAAqC;IAC5B,OAAO,CAAoB;IAEpC;;;;OAIG;IACH,YAAY,IAAgB,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,mBAAmB,IAAI,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,OAAO,GAAG,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,OAAO,UAAU,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAA2B;QACtC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAEtD,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;CACD;AAKD,MAAM,WAAW,GAAuE;IACvF,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;CAC3C,CAAA;AAiBD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE/D,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACtC,WAAW,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,QAAQ;IACnB,sCAAsC;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW;IACX,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE;IAC3D,MAAM,KAAK,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,aAAa,CAAC,qHAAqH,CAAC,CAAA;IAC/I,CAAC;IAED,IAAI,SAAkD,CAAA;IACtD,IAAI,CAAC;QACJ,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,yCAAyC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,8CAA8C,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9H,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACvC;aACD,CAAA;QACF,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAA;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,4CAA4C,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChK,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,GAAG,CAAC,KAAmB;gBAC9B,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,KAAK,CAAC,UAAU;oBACrB,6DAA6D;oBAC7D,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChE;aACD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;AAC9H,CAAC,CAAA"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAElE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IACrB,8CAA8C;IACrC,IAAI,CAAQ;IACrB,0DAA0D;IACjD,IAAI,CAAY;IACzB,qCAAqC;IAC5B,OAAO,CAAoB;IAEpC;;;;OAIG;IACH,YAAY,IAAgB,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAY;QACxB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,mBAAmB,IAAI,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,OAAO,GAAG,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,OAAO,UAAU,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACtB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAA2B;QACtC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAEtD,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAc,EAAsB,EAAE;IAChE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,CAAA;IACT,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACnE,CAAC,CAAA;AAKD,MAAM,WAAW,GAAuE;IACvF,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAC3C,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;CAC3C,CAAA;AAiBD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAE/D,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACtC,WAAW,EAAE,QAAQ;CACrB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,QAAQ;IACnB,sCAAsC;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,KAAK;IACf,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,QAAQ;IACnB,WAAW;IACX,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE;IAC3D,MAAM,KAAK,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,aAAa,CAAC,qHAAqH,CAAC,CAAA;IAC/I,CAAC;IAED,IAAI,SAAkD,CAAA;IACtD,IAAI,CAAC;QACJ,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,yCAAyC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1C,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACJ,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,8CAA8C,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9H,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,SAAS;oBACd,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxD,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACvC;aACD,CAAA;QACF,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAA;YAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAAC,eAAe,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9E,MAAM,IAAI,aAAa,CAAC,4CAA4C,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACtE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChK,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACN,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,GAAG,CAAC,KAAmB;gBAC9B,SAAS;gBACT,GAAG,EAAE;oBACJ,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,KAAK,CAAC,UAAU;oBACrB,6DAA6D;oBAC7D,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAClE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChE;aACD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,eAAe,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;AAC9H,CAAC,CAAA"}

package/dist/types.d.ts

@@ -78,13 +78,53 @@ export interface CaSecret {
     get(): Promise<string>;
 }
 /**
- * The bindings (environment) the CA expects, see {@link CaDatabase} and
- * {@link CaSecret} for the non-string bindings.
+ * A rate limiter, with the same shape as a Cloudflare Workers rate limit
+ * binding.
+ *
+ * A Workers `RateLimit` binding satisfies this structurally. On other
+ * runtimes any limiter with the same shape may be used.
+ */
+export interface CaRateLimiter {
+    /**
+     * Counts a request against the limit for a key
+     *
+     * @param options The key the request is counted against, for example the client IP address
+     * @returns Whether the request is within the limit
+     */
+    limit(options: {
+        key: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+}
+/**
+ * A key-value cache, with the subset of a Cloudflare Workers KV namespace
+ * binding used by the CA.
+ *
+ * A Workers `KVNamespace` binding satisfies this structurally. On other
+ * runtimes any cache with the same shape may be used, such as the in-memory
+ * cache returned by `cacheInMemory` from `@andrewheberle/serverless-ssh-ca/node`.
+ */
+export interface CaCache {
+    /** Returns the value for a key, or null if there is none */
+    get(key: string): Promise<string | null>;
+    /** Sets the value for a key, which may expire after `expirationTtl` seconds */
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+}
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase},
+ * {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache} for the non-string
+ * bindings.
  */
 export interface SshCaBindings {
     CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
     JWT_ALGORITHMS: string | string[];
-    JWT_AUD?: string | string[];
+    /** The audience the identity token, and unless {@link SshCaBindings.JWT_ACCESS_TOKEN_AUD} is set the access token, must be issued for */
+    JWT_AUD: string | string[];
+    /** The audience the access token must be issued for, when it differs from {@link SshCaBindings.JWT_AUD} */
+    JWT_ACCESS_TOKEN_AUD?: string | string[];
     JWT_ISSUER: string;
     JWT_JWKS_URL: string;
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
@@ -93,6 +133,16 @@ export interface SshCaBindings {
     DB: CaDatabase;
     ISSUER_DN: string;
     PRIVATE_KEY: CaSecret;
+    /**
+     * Limits requests to issue, renew and revoke certificates, see
+     * {@link CaRateLimiter}. Requests are not limited when this is not set.
+     */
+    RATE_LIMITER?: CaRateLimiter;
+    /**
+     * Caches KRLs until a certificate is revoked, see {@link CaCache}. KRLs
+     * are generated for every request when this is not set.
+     */
+    CACHE?: CaCache;
     SSH_CERTIFICATE_EXTENSIONS: string;
     SSH_CERTIFICATE_INCLUDE_SELF_EMAIL?: string | boolean;
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACpB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,yIAAyI;IACzI,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC1B,2GAA2G;IAC3G,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}