@andrewheberle/serverless-ssh-ca 0.23.0 → 0.24.1

package/dist/db/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAAE,SAAS,IAAI,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEnE,MAAM,CAAC,MAAM,UAAU,GAAgB;IACtC,iBAAiB;IACjB,cAAc;CACd,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,IAAI,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAAE,SAAS,IAAI,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,SAAS,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAErE,MAAM,CAAC,MAAM,UAAU,GAAgB;IACtC,iBAAiB;IACjB,cAAc;IACd,eAAe;CACf,CAAA"}

package/dist/db/types.d.ts

@@ -28,6 +28,8 @@ export type KrlRecord = {
     version: number;
     digest: string | null;
     updated_at: Date;
+    /** Incremented whenever a certificate of this type is revoked */
+    revision: number;
 };
 /** The tables in the database, used to type queries made with workers-qb */
 export type DatabaseSchema = {

package/dist/db/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/db/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,0EAA0E;AAC1E,oBAAY,eAAe;IAC1B,IAAI,IAAA;IACJ,IAAI,IAAA;CACJ;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,IAAI,CAAA;IACjB,YAAY,EAAE,IAAI,CAAA;IAClB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,GAAG,EAAE,SAAS,CAAA;CACd,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/db/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,0EAA0E;AAC1E,oBAAY,eAAe;IAC1B,IAAI,IAAA;IACJ,IAAI,IAAA;CACJ;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,IAAI,CAAA;IACjB,YAAY,EAAE,IAAI,CAAA;IAClB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,IAAI,CAAA;IAChB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,GAAG,EAAE,SAAS,CAAA;CACd,CAAA"}

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 import type { ExecutionContext } from "hono";
+import { type SshCaOptions } from "./router.js";
 import type { SshCaBindings } from "./types.js";
-export type { CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaSecret, SshCaBindings } from "./types.js";
+export type { CaCache, CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaRateLimiter, CaSecret, SshCaBindings } from "./types.js";
+export { cloudflareClientIp, type RateLimitKey, type SshCaOptions } from "./router.js";
 /**
  * A runtime neutral instance of the CA, returned by {@link createSshCa}.
  */
@@ -25,9 +27,10 @@ export interface SshCa {
  * the runtime on each request.
  *
  * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @param options Options for the CA, such as the key requests are rate limited by, see {@link SshCaOptions}
  * @returns The CA's request handler and database cleanup task, see {@link SshCa}
  */
-export declare const createSshCa: (env: SshCaBindings) => SshCa;
+export declare const createSshCa: (env: SshCaBindings, options?: SshCaOptions) => SshCa;
 declare const _default: {
     fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext): Promise<Response> | Response;
     scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAQnI;;GAEG;AACH,MAAM,WAAW,KAAK;IAClB;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QAAS,aAAa,KAAG,KAOhD,CAAA;;eAKc,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAE5C,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC3J,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AAQtF;;GAEG;AACH,MAAM,WAAW,KAAK;IAClB;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QAAS,aAAa,YAAW,YAAY,KAAQ,KAO5E,CAAA;;eAKc,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { dbCleanup } from "./db/index.js";
 import { createApp } from "./router.js";
+export { cloudflareClientIp } from "./router.js";
 /**
  * Create an instance of the CA bound to a fixed set of bindings, for use on
  * runtimes other than Cloudflare Workers.
@@ -8,10 +9,11 @@ import { createApp } from "./router.js";
  * the runtime on each request.
  *
  * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @param options Options for the CA, such as the key requests are rate limited by, see {@link SshCaOptions}
  * @returns The CA's request handler and database cleanup task, see {@link SshCa}
  */
-export const createSshCa = (env) => {
-    const app = createApp(env);
+export const createSshCa = (env, options = {}) => {
+    const app = createApp(env, options);
     return {
         fetch: async (req) => await app.fetch(req, env),
         cleanup: async () => await dbCleanup(env),

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA2BvC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAS,EAAE;IACrD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAE1B,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,GAAY,EAAqB,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;QAC3E,OAAO,EAAE,KAAK,IAAmB,EAAE,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC;KAC3D,CAAA;AACL,CAAC,CAAA;AAED,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAwC,MAAM,aAAa,CAAA;AAyBtF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,OAAO,GAAiB,EAAE,EAAS,EAAE;IACjF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAEnC,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,GAAY,EAAqB,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;QAC3E,OAAO,EAAE,KAAK,IAAmB,EAAE,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC;KAC3D,CAAA;AACL,CAAC,CAAA;AAED,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}

package/dist/krl.d.ts

@@ -32,8 +32,9 @@ export declare class KRLBuilder {
      *
      * @param krlVersion  Optional KRL version number (default: 1).
      * @param comment     Optional comment string embedded in the header.
+     * @param generatedAt Optional time the KRL was generated (default: now).
      */
-    generate(krlVersion?: bigint, comment?: string): ArrayBuffer;
+    generate(krlVersion?: bigint, comment?: string, generatedAt?: Date): ArrayBuffer;
     /**
      * Return the SSHSIG signature of the KRL.
      *

package/dist/krl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"krl.d.ts","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAsF/C,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,IAAI,CAA2B;IAEvC,YAAY,KAAK,EAAE,UAAU,EAE5B;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAMlC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAMhC;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9B;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAE,MAAW,EAAE,OAAO,SAAK,GAAG,WAAW,CAgE3D;IAED;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAqDjC;CACJ"}
+{"version":3,"file":"krl.d.ts","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAsF/C,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,IAAI,CAA2B;IAEvC,YAAY,KAAK,EAAE,UAAU,EAE5B;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAMlC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAMhC;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAc9B;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,GAAE,MAAW,EAAE,OAAO,SAAK,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,WAAW,CAgE/E;IAED;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAqDjC;CACJ"}

package/dist/krl.js

@@ -121,13 +121,14 @@ export class KRLBuilder {
      *
      * @param krlVersion  Optional KRL version number (default: 1).
      * @param comment     Optional comment string embedded in the header.
+     * @param generatedAt Optional time the KRL was generated (default: now).
      */
-    generate(krlVersion = 1n, comment = "") {
+    generate(krlVersion = 1n, comment = "", generatedAt) {
         if (this._krl !== null) {
             return this._krl;
         }
         // ── Header ──────────────────────────────────────────────────────────────
-        const generatedDate = BigInt(Math.floor(Date.now() / 1000));
+        const generatedDate = BigInt(Math.floor((generatedAt?.getTime() ?? Date.now()) / 1000));
         const header = concat(encodeUint64(KRL_MAGIC), encodeUint32(KRL_FORMAT_VERSION), encodeUint64(krlVersion), encodeUint64(generatedDate), encodeUint64(0n), // flags — none defined
         encodeString(""), // reserved
         encodeString(comment));

package/dist/krl.js.map

@@ -1 +1 @@
-{"version":3,"file":"krl.js","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,gFAAgF;AAEhF,MAAM,SAAS,GAAG,mBAAmB,CAAA,CAAC,eAAe;AACrD,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,gFAAgF;AAEhF,kCAAkC;AAClC,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACtD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC5C,MAAM,KAAK,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAG,KAAmB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACvD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,SAAS,GAAG,gDAAgD,CAAA;AAClE,MAAM,cAAc,GAAG,QAAQ,CAAA;AAE/B;;GAEG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACH,+BAA+B;QAC/B,GAAG,KAAK;QACR,6BAA6B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACF,MAAM,CAAY;IAClB,QAAQ,GAAa,EAAE,CAAA;IACvB,OAAO,GAAa,EAAE,CAAA;IAC/B,IAAI,GAAuB,IAAI,CAAA;IAEvC,YAAY,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAiB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAgB;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAC1C,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,GAAW,EAAE,EAAE,OAAO,GAAG,EAAE;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAE3D,MAAM,MAAM,GAAG,MAAM,CACjB,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,kBAAkB,CAAC,EAChC,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,EAAE,CAAC,EAAE,uBAAuB;QACzC,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,4EAA4E;QAE5E,MAAM,eAAe,GAAiB,EAAE,CAAA;QAExC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;YAC9D,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAC3D,CAAA;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CACrB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAChD,CAAA;YACD,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,uBAAuB,EAAE,UAAU,CAAC,CACrD,CAAA;QACL,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,mDAAmD;QACnD,mBAAmB;QACnB,qBAAqB;QACrB,oCAAoC;QACpC,EAAE;QACF,MAAM,eAAe,GAAG,MAAM,CAC1B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS;QACnD,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,GAAG,eAAe,CACrB,CAAA;QAED,MAAM,mBAAmB,GAAG,aAAa,CACrC,wBAAwB,EACxB,eAAe,CAClB,CAAA;QAED,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAE/C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAqB,CAAA;QAErC,OAAO,IAAI,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS;QACX,IAAI,GAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE9C,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAC7C,CAAA;QAED,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CACrB,YAAY,EACZ,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE5C,qCAAqC;QACrC,EAAE;QACF,sBAAsB;QACtB,6BAA6B;QAC7B,uBAAuB;QACvB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,EACZ,YAAY,CAAC,WAAW,CAAC,EACzB,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAC9B,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,CACvB,CAAA;QAED,uBAAuB;QACvB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;CACJ"}
+{"version":3,"file":"krl.js","sourceRoot":"","sources":["../src/krl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,gFAAgF;AAEhF,MAAM,SAAS,GAAG,mBAAmB,CAAA,CAAC,eAAe;AACrD,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,gFAAgF;AAEhF,kCAAkC;AAClC,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,gDAAgD;AAChD,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IACtD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA0B;IAC5C,MAAM,KAAK,GACP,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACjB,OAAO,GAAG,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAG,KAAmB;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACvD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,SAAS,GAAG,gDAAgD,CAAA;AAClE,MAAM,cAAc,GAAG,QAAQ,CAAA;AAE/B;;GAEG;AACH,SAAS,cAAc,CAAC,KAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACH,+BAA+B;QAC/B,GAAG,KAAK;QACR,6BAA6B;KAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACF,MAAM,CAAY;IAClB,QAAQ,GAAa,EAAE,CAAA;IACvB,OAAO,GAAa,EAAE,CAAA;IAC/B,IAAI,GAAuB,IAAI,CAAA;IAEvC,YAAY,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAiB;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAgB;QACtB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAC1C,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,GAAW,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,WAAkB;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,IAAI,CAAA;QACpB,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QAEvF,MAAM,MAAM,GAAG,MAAM,CACjB,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,kBAAkB,CAAC,EAChC,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,CAAC,EAC3B,YAAY,CAAC,EAAE,CAAC,EAAE,uBAAuB;QACzC,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,4EAA4E;QAE5E,MAAM,eAAe,GAAiB,EAAE,CAAA;QAExC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;YAC9D,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAC3D,CAAA;QACL,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CACrB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAChD,CAAA;YACD,eAAe,CAAC,IAAI,CAChB,aAAa,CAAC,uBAAuB,EAAE,UAAU,CAAC,CACrD,CAAA;QACL,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,mDAAmD;QACnD,mBAAmB;QACnB,qBAAqB;QACrB,oCAAoC;QACpC,EAAE;QACF,MAAM,eAAe,GAAG,MAAM,CAC1B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS;QACnD,YAAY,CAAC,EAAE,CAAC,EAAE,WAAW;QAC7B,GAAG,eAAe,CACrB,CAAA;QAED,MAAM,mBAAmB,GAAG,aAAa,CACrC,wBAAwB,EACxB,eAAe,CAClB,CAAA;QAED,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAE/C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAqB,CAAA;QAErC,OAAO,IAAI,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS;QACX,IAAI,GAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACJ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE9C,sCAAsC;QACtC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAC7C,CAAA;QAED,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,wBAAwB;QACxB,MAAM,UAAU,GAAG,MAAM,CACrB,YAAY,EACZ,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE5C,qCAAqC;QACrC,EAAE;QACF,sBAAsB;QACtB,6BAA6B;QAC7B,uBAAuB;QACvB,uBAAuB;QACvB,+BAA+B;QAC/B,4BAA4B;QAC5B,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,CAClB,YAAY,EACZ,YAAY,CAAC,WAAW,CAAC,EACzB,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAC9B,YAAY,CAAC,SAAS,CAAC,EACvB,YAAY,CAAC,EAAE,CAAC,EAAO,WAAW;QAClC,YAAY,CAAC,cAAc,CAAC,EAC5B,YAAY,CAAC,MAAM,CAAC,CACvB,CAAA;QAED,uBAAuB;QACvB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;CACJ"}

package/dist/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAY,MAAM,wBAAwB,CAAA;AAEzD,eAAO,MAAM,MAAM,QAAS,aAAa,KAAG,MAY3C,CAAA"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAY,MAAM,wBAAwB,CAAA;AAuBzD,eAAO,MAAM,MAAM,QAAS,aAAa,KAAG,MAe3C,CAAA"}

package/dist/logger.js

@@ -1,4 +1,22 @@
 import { Logger, LogLevel } from "@andrewheberle/ts-slog";
+// how many causes of an error are logged, in case a chain of causes loops
+const MaxCauseDepth = 5;
+/**
+ * Returns a value to log, with an error converted to a plain object. Errors
+ * have no enumerable properties, so are otherwise logged as little more than
+ * their name.
+ */
+const logValue = (value, depth = 0) => {
+    if (!(value instanceof Error)) {
+        return value;
+    }
+    return {
+        name: value.name,
+        message: value.message,
+        ...(value.cause === undefined || depth >= MaxCauseDepth ? {} : { cause: logValue(value.cause, depth + 1) }),
+        stack: value.stack,
+    };
+};
 export const logger = (env) => {
     const level = env.LOG_LEVEL === "none"
         ? LogLevel.None
@@ -9,6 +27,9 @@ export const logger = (env) => {
                 : env.LOG_LEVEL == "debug"
                     ? LogLevel.Debug
                     : LogLevel.Info;
-    return new Logger({ minLevel: level });
+    return new Logger({
+        minLevel: level,
+        logHandler: (output) => console.log(Object.fromEntries(Object.entries(output).map(([key, value]) => [key, logValue(value)]))),
+    });
 };
 //# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAEzD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAkB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,KAAK,MAAM;QACrC,CAAC,CAAC,QAAQ,CAAC,IAAI;QACf,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO;YAC1B,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAE,QAAQ,CAAC,OAAO;gBACnB,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO;oBACzB,CAAC,CAAC,QAAQ,CAAC,KAAK;oBAChB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;IAEnB,OAAO,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;AACvC,CAAC,CAAA"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAEzD,0EAA0E;AAC1E,MAAM,aAAa,GAAG,CAAC,CAAA;AAEvB;;;;GAIG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAW,EAAE;IACvD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACb,CAAC;IAED,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3G,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAkB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,KAAK,MAAM;QACrC,CAAC,CAAC,QAAQ,CAAC,IAAI;QACf,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO;YAC1B,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAE,QAAQ,CAAC,OAAO;gBACnB,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO;oBACzB,CAAC,CAAC,QAAQ,CAAC,KAAK;oBAChB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;IAEnB,OAAO,IAAI,MAAM,CAAC;QACjB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KAC7H,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/node/cache.d.ts

@@ -0,0 +1,21 @@
+import type { CaCache } from "../types.js";
+/**
+ * Create an in-memory cache for the `CACHE` binding, with the same shape as a
+ * Cloudflare Workers KV namespace (see {@link CaCache}).
+ *
+ * Entries are kept in memory by the process, so they are lost on restart and
+ * not shared between processes.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ *     CACHE: cacheInMemory(),
+ * })
+ * ```
+ *
+ * @returns A cache for the `CACHE` binding, see {@link CaCache}
+ */
+export declare const cacheInMemory: () => CaCache;
+//# sourceMappingURL=cache.d.ts.map

package/dist/node/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/node/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAQ1C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,QAAO,OAmChC,CAAA"}

package/dist/node/cache.js

@@ -0,0 +1,49 @@
+/**
+ * Create an in-memory cache for the `CACHE` binding, with the same shape as a
+ * Cloudflare Workers KV namespace (see {@link CaCache}).
+ *
+ * Entries are kept in memory by the process, so they are lost on restart and
+ * not shared between processes.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ *     CACHE: cacheInMemory(),
+ * })
+ * ```
+ *
+ * @returns A cache for the `CACHE` binding, see {@link CaCache}
+ */
+export const cacheInMemory = () => {
+    const entries = new Map();
+    const expired = (entry, now) => entry.expires !== undefined && now >= entry.expires;
+    return {
+        get: async (key) => {
+            const entry = entries.get(key);
+            if (entry === undefined) {
+                return null;
+            }
+            if (expired(entry, Date.now())) {
+                entries.delete(key);
+                return null;
+            }
+            return entry.value;
+        },
+        put: async (key, value, options) => {
+            const now = Date.now();
+            // remove entries that have expired, as they are not read again
+            for (const [k, entry] of entries) {
+                if (expired(entry, now)) {
+                    entries.delete(k);
+                }
+            }
+            entries.set(key, {
+                value,
+                expires: options?.expirationTtl === undefined ? undefined : now + options.expirationTtl * 1000,
+            });
+        },
+    };
+};
+//# sourceMappingURL=cache.js.map

package/dist/node/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/node/cache.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,EAAE;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;IAExC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,CAAA;IAE3G,OAAO;QACN,GAAG,EAAE,KAAK,EAAE,GAAW,EAA0B,EAAE;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAA;YACZ,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACnB,OAAO,IAAI,CAAA;YACZ,CAAC;YAED,OAAO,KAAK,CAAC,KAAK,CAAA;QACnB,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,OAAoC,EAAiB,EAAE;YAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAEtB,+DAA+D;YAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC;YACF,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,KAAK;gBACL,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI;aAC9F,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC,CAAA"}

package/dist/node/env.d.ts

@@ -1,5 +1,5 @@
 import z from "zod";
-import type { CaDatabase, CaSecret, SshCaBindings } from "../types.js";
+import type { CaCache, CaDatabase, CaRateLimiter, CaSecret, SshCaBindings } from "../types.js";
 /**
  * The environment variables read by {@link bindingsFromEnv}, which match the
  * Workers vars documented for the CA.
@@ -22,7 +22,8 @@ export declare const EnvSchema: z.ZodObject<{
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.ZodOptional<z.ZodString>;
     ISSUER_DN: z.ZodString;
     JWT_JWKS_URL: z.ZodURL;
-    JWT_AUD: z.ZodOptional<z.ZodString>;
+    JWT_AUD: z.ZodString;
+    JWT_ACCESS_TOKEN_AUD: z.ZodOptional<z.ZodString>;
     JWT_ISSUER: z.ZodString;
     JWT_ALGORITHMS: z.ZodString;
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: z.ZodString;
@@ -60,7 +61,7 @@ export declare class InvalidConfigurationError extends Error {
  * })
  * ```
  *
- * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param bindings The database, private key, optional rate limiter and optional cache, see {@link CaDatabase}, {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache}
  * @param source The environment variables to read, `process.env` by default
  * @returns The bindings to pass to `createSshCa`
  * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
@@ -68,5 +69,7 @@ export declare class InvalidConfigurationError extends Error {
 export declare const bindingsFromEnv: (bindings: {
     DB: CaDatabase;
     PRIVATE_KEY: CaSecret;
+    RATE_LIMITER?: CaRateLimiter;
+    CACHE?: CaCache;
 }, source?: Record<string, string | undefined>) => SshCaBindings;
 //# sourceMappingURL=env.d.ts.map

package/dist/node/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAYtE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAA;CAAE,WAC3C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAY9F;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,WAC1F,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}

package/dist/node/env.js

@@ -27,7 +27,8 @@ export const EnvSchema = z.object({
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.string().optional(),
     ISSUER_DN: required,
     JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
-    JWT_AUD: z.string().optional(),
+    JWT_AUD: required,
+    JWT_ACCESS_TOKEN_AUD: z.string().optional(),
     JWT_ISSUER: required,
     JWT_ALGORITHMS: required,
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
@@ -59,7 +60,7 @@ export class InvalidConfigurationError extends Error {
  * })
  * ```
  *
- * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param bindings The database, private key, optional rate limiter and optional cache, see {@link CaDatabase}, {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache}
  * @param source The environment variables to read, `process.env` by default
  * @returns The bindings to pass to `createSshCa`
  * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
@@ -69,6 +70,6 @@ export const bindingsFromEnv = (bindings, source = process.env) => {
     if (!result.success) {
         throw new InvalidConfigurationError(`invalid configuration:\n${z.prettifyError(result.error)}`);
     }
-    return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY };
+    return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY, RATE_LIMITER: bindings.RATE_LIMITER, CACHE: bindings.CACHE };
 };
 //# sourceMappingURL=env.js.map

package/dist/node/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAmD,EACnD,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;AAC9E,CAAC,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,QAAQ;IACjB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAkG,EAClG,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;AAC1I,CAAC,CAAA"}

package/dist/node/index.d.ts

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js";
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
 export type { CaEnv } from "./env.js";
 export { secretFromFile, secretFromString } from "./secret.js";

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/node/index.js

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js";
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
 export { secretFromFile, secretFromString } from "./secret.js";
 export { fromNodeSqlite } from "./sqlite.js";

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/router.d.ts

@@ -3,5 +3,29 @@ import type { SshCaBindings } from "./types.js";
 export type AppContext = Context<{
     Bindings: SshCaBindings;
 }>;
-export declare const createApp: (env: SshCaBindings) => import("chanfana").HonoOpenAPIRouterType<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+/**
+ * Returns the key a request is rate limited by, or undefined if the request
+ * should not be rate limited.
+ */
+export type RateLimitKey = (req: Request) => string | undefined;
+/**
+ * Options for the CA that are not part of its bindings.
+ */
+export interface SshCaOptions {
+    /**
+     * Returns the key requests are rate limited by when `RATE_LIMITER` is
+     * set. Defaults to the client IP address in the `CF-Connecting-IP` header,
+     * which is set by Cloudflare, so other runtimes should provide one that
+     * suits their limiter, for example using a header set by a reverse proxy.
+     */
+    rateLimitKey?: RateLimitKey;
+}
+/**
+ * Returns the client IP address set by Cloudflare in the `CF-Connecting-IP`
+ * header, which is the default key requests are rate limited by.
+ */
+export declare const cloudflareClientIp: RateLimitKey;
+export declare const createApp: (env: SshCaBindings, options?: SshCaOptions) => import("chanfana").HonoOpenAPIRouterType<{
+    Bindings: SshCaBindings;
+}, import("hono/types").BlankSchema, "/">;
 //# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAKzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHAgC3C,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,YAAwE,CAAA;AAKzG,eAAO,MAAM,SAAS,QAAS,aAAa,YAAW,YAAY;cAC7B,aAAa;yCAgElD,CAAA"}

package/dist/router.js

@@ -4,8 +4,45 @@ import { createApi as apiv3 } from "./api/v3/index.js";
 import { BasePath as v4BasePath, createApi as apiv4 } from "./api/v4/index.js";
 import { HTTPException } from "hono/http-exception";
 import { logger } from "./logger.js";
-export const createApp = (env) => {
+import { TooManyRequestsException } from "chanfana";
+/**
+ * Returns the client IP address set by Cloudflare in the `CF-Connecting-IP`
+ * header, which is the default key requests are rate limited by.
+ */
+export const cloudflareClientIp = (req) => req.headers.get("CF-Connecting-IP") ?? undefined;
+// requests that only read from the CA, which are not rate limited
+const ReadMethods = new Set(["GET", "HEAD", "OPTIONS"]);
+export const createApp = (env, options = {}) => {
     const hono = new Hono();
+    const rateLimitKey = options.rateLimitKey ?? cloudflareClientIp;
+    // limit requests to issue, renew and revoke certificates
+    hono.use("/api/*", async (c, next) => {
+        const limiter = c.env.RATE_LIMITER;
+        if (limiter === undefined || ReadMethods.has(c.req.method)) {
+            return await next();
+        }
+        const l = logger(env).with("in", "rateLimit");
+        const key = rateLimitKey(c.req.raw);
+        if (key === undefined) {
+            l.debug("no rate limit key for request");
+            return await next();
+        }
+        let success;
+        try {
+            success = (await limiter.limit({ key })).success;
+        }
+        catch (err) {
+            // a failing limiter must not stop certificates being issued or revoked
+            l.error("rate limiter failed", "error", err);
+            return await next();
+        }
+        if (!success) {
+            l.warn("request was rate limited", "key", key, "method", c.req.method, "path", c.req.path);
+            const err = new TooManyRequestsException();
+            return c.json({ success: false, errors: err.buildResponse(), result: {} }, 429);
+        }
+        return await next();
+    });
     // add error handling
     hono.onError((err, c) => {
         if (err instanceof HTTPException) {

package/dist/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AAwBnD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAA;AAEzG,kEAAkE;AAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,OAAO,GAAiB,EAAE,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,EAA+B,CAAA;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAA;IAE/D,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;YACxC,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,uEAAuE;YACvE,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC5C,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC1F,MAAM,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAED,OAAO,MAAM,IAAI,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}

package/dist/ssh/keys.d.ts

@@ -51,6 +51,18 @@ export declare class PublicKey {
      */
     toString(): string;
 }
+/**
+ * The smallest RSA key, in bits, that the CA will issue a certificate for.
+ * This matches the minimum accepted by ssh-ca-client.
+ */
+export declare const MinimumRsaKeyBits = 2048;
+/**
+ * Returns the size in bits of the modulus of an RSA public key, or undefined
+ * if the key is not an RSA key.
+ *
+ * @param key The public key
+ */
+export declare const rsaKeyBits: (key: PublicKey) => number | undefined;
 /** The ECDSA curves that can be used to sign */
 export type EcdsaCurve = "nistp256" | "nistp384" | "nistp521";
 /**
@@ -68,13 +80,14 @@ export type PrivateKey = {
     readonly jwk: JsonWebKey;
 };
 /**
- * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
- * created by `ssh-keygen`
+ * Parses an unencrypted Ed25519 or ECDSA private key, either in OpenSSH
+ * format, as created by `ssh-keygen`, or in PKCS#8 format, as created by
+ * `ssh-keygen -m PKCS8` or `openssl genpkey`
  *
- * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----`
- * @returns The private key
+ * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----` or `-----BEGIN PRIVATE KEY-----`
+ * @returns The private key. A PKCS#8 key has no comment.
  * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
  * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
  */
-export declare const parsePrivateKey: (text: string) => PrivateKey;
+export declare const parsePrivateKey: (text: string) => Promise<PrivateKey>;
 //# sourceMappingURL=keys.d.ts.map

package/dist/ssh/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAMD;;GAEG;AACH,qBAAa,SAAS;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAEpC;;;;OAIG;IACH,YAAY,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAQ7C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAmBpC;IAED;;;OAGG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAEhC;IAED;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAIjB;CACD;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAA;AAQ7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,GAAG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,CAAA;AAkDD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,UA2F9C,CAAA"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/ssh/keys.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAMD;;GAEG;AACH,qBAAa,SAAS;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAEpC;;;;OAIG;IACH,YAAY,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAQ7C;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAmBpC;IAED;;;OAGG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAEhC;IAED;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAIjB;CACD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAA;AAErC;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAS,SAAS,KAAG,MAAM,GAAG,SAmBpD,CAAA;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAA;AAQ7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,GAAG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB,CAAA;AAiOD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,SAAgB,MAAM,KAAG,OAAO,CAAC,UAAU,CAgBtE,CAAA"}