@andrewheberle/serverless-ssh-ca-testing 0.0.0-stage → 0.20.2

package/dist/node.js

@@ -0,0 +1,98 @@
+import { createServer } from "node:http";
+import { DatabaseSync } from "node:sqlite";
+import { createSshCa } from "@andrewheberle/serverless-ssh-ca";
+import { bindingsFromEnv, fromNodeSqlite, secretFromString } from "@andrewheberle/serverless-ssh-ca/node";
+import { formatArgs } from "./format.js";
+const consoleMethods = ["debug", "info", "log", "warn", "error"];
+// convert a request received by the HTTP server into a Fetch API request
+const toRequest = async (req) => {
+    const chunks = [];
+    for await (const chunk of req) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+    }
+    const headers = new Headers();
+    for (const [name, values] of Object.entries(req.headersDistinct)) {
+        for (const value of values ?? []) {
+            headers.append(name, value);
+        }
+    }
+    const method = req.method ?? "GET";
+    return new Request(`http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`, {
+        method,
+        headers,
+        body: method === "GET" || method === "HEAD" ? undefined : Buffer.concat(chunks),
+    });
+};
+/**
+ * Run the CA on Node.js, created with the package's Node.js helpers and an
+ * in-memory `node:sqlite` database, behind an HTTP server on a random port.
+ *
+ * Output the CA writes with `console` is written to `log` until the server is
+ * closed.
+ *
+ * @param config The test server configuration
+ * @param log The log file for the CA and harness
+ * @returns The running server
+ * @throws InvalidConfigurationError if `config.bindings` is not a valid CA configuration
+ */
+export const startNode = async (config, log) => {
+    const db = new DatabaseSync(":memory:");
+    // bindingsFromEnv validates the configuration so a mistake fails at start up
+    const ca = createSshCa(bindingsFromEnv({
+        DB: fromNodeSqlite(db),
+        PRIVATE_KEY: secretFromString(config.private_key),
+    }, config.bindings));
+    // the CA logs JSON lines via console, so send them to the log file
+    const original = consoleMethods.map(level => [level, console[level]]);
+    for (const level of consoleMethods) {
+        console[level] = (...args) => log.write(formatArgs(args));
+    }
+    const restoreConsole = () => {
+        for (const [level, method] of original) {
+            console[level] = method;
+        }
+    };
+    const server = createServer(async (req, res) => {
+        try {
+            const request = await toRequest(req);
+            const response = await ca.fetch(request);
+            const body = Buffer.from(await response.arrayBuffer());
+            log.request(request.method, req.url ?? "/", response.status, body.toString());
+            res.writeHead(response.status, Object.fromEntries(response.headers));
+            res.end(body);
+        }
+        catch (err) {
+            log.fault("request failed", err);
+            res.writeHead(502);
+            res.end();
+        }
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", () => resolve());
+        });
+    }
+    catch (err) {
+        restoreConsole();
+        db.close();
+        throw err;
+    }
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+        restoreConsole();
+        server.close();
+        db.close();
+        throw new Error(`unexpected server address: ${String(address)}`);
+    }
+    return {
+        port: address.port,
+        close: async () => {
+            server.closeAllConnections();
+            await new Promise(resolve => server.close(() => resolve()));
+            restoreConsole();
+            db.close();
+        },
+    };
+};
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAwB,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAEzG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAU,CAAA;AAEzE,yEAAyE;AACzE,MAAM,SAAS,GAAG,KAAK,EAAE,GAAoB,EAAoB,EAAE;IAClE,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5B,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;IAElC,OAAO,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE;QAChF,MAAM;QACN,OAAO;QACP,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC/E,CAAC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,MAAwB,EAAE,GAAY,EAAuB,EAAE;IAC9F,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,CAAA;IAEvC,6EAA6E;IAC7E,MAAM,EAAE,GAAG,WAAW,CAAC,eAAe,CAAC;QACtC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACtB,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;KACjD,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEpB,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAU,CAAC,CAAA;IAC9E,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,cAAc,GAAG,GAAS,EAAE;QACjC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAA;QACxB,CAAC;IACF,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;YAEtD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAE7E,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAClB,GAAG,CAAC,GAAG,EAAE,CAAA;QACV,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC;QACJ,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,cAAc,EAAE,CAAA;QAChB,EAAE,CAAC,KAAK,EAAE,CAAA;QACV,MAAM,GAAG,CAAA;IACV,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrD,cAAc,EAAE,CAAA;QAChB,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,EAAE,CAAC,KAAK,EAAE,CAAA;QACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,OAAO;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,KAAK,IAAmB,EAAE;YAChC,MAAM,CAAC,mBAAmB,EAAE,CAAA;YAC5B,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACjE,cAAc,EAAE,CAAA;YAChB,EAAE,CAAC,KAAK,EAAE,CAAA;QACX,CAAC;KACD,CAAA;AACF,CAAC,CAAA"}

package/dist/server.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A running test server, returned by {@link startTestServer}.
+ */
+export type TestServer = {
+    /** The port the CA is listening on at 127.0.0.1 */
+    port: number;
+    /** Stop the CA and release its resources */
+    close(): Promise<void>;
+};
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACxB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}

package/dist/server.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":""}

package/dist/worker.d.ts

@@ -0,0 +1,8 @@
+import ca from "@andrewheberle/serverless-ssh-ca";
+type FetchParameters = Parameters<typeof ca.fetch>;
+declare const _default: {
+    scheduled(controller: unknown, env: import("@andrewheberle/serverless-ssh-ca").SshCaBindings, ctx: import("hono").ExecutionContext): Promise<void>;
+    fetch(request: FetchParameters[0], env: FetchParameters[1], ctx: FetchParameters[2]): Promise<Response>;
+};
+export default _default;
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,kCAAkC,CAAA;AAGjD,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;;;mBAW5B,eAAe,CAAC,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC"}

package/dist/worker.js

@@ -0,0 +1,25 @@
+// Worker entry point used by startWorkerd, bundled by Wrangler when the test
+// server starts.
+//
+// The CA's default export is used as on Cloudflare Workers, wrapped only to
+// log each request and to write console output as JSON lines, as the Node.js
+// runtime does.
+import ca from "@andrewheberle/serverless-ssh-ca";
+import { formatArgs, formatRequest } from "./format.js";
+// workerd formats objects passed to console for display rather than as JSON,
+// so format them here
+for (const level of ["debug", "info", "log", "warn", "error"]) {
+    const write = console[level].bind(console);
+    console[level] = (...args) => write(formatArgs(args));
+}
+export default {
+    ...ca,
+    async fetch(request, env, ctx) {
+        const response = await ca.fetch(request, env, ctx);
+        const url = new URL(request.url);
+        const body = response.status >= 400 ? await response.clone().text() : "";
+        console.log(formatRequest(request.method, url.pathname + url.search, response.status, body));
+        return response;
+    },
+};
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iBAAiB;AACjB,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,gBAAgB;AAChB,OAAO,EAAE,MAAM,kCAAkC,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIvD,6EAA6E;AAC7E,sBAAsB;AACtB,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAU,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,eAAe;IACd,GAAG,EAAE;IACL,KAAK,CAAC,KAAK,CAAC,OAA2B,EAAE,GAAuB,EAAE,GAAuB;QACxF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAExE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAE5F,OAAO,QAAQ,CAAA;IAChB,CAAC;CACD,CAAA"}

package/dist/workerd.d.ts

@@ -0,0 +1,24 @@
+import type { TestServerConfig } from "./config.js";
+import type { LogFile } from "./log.js";
+import type { TestServer } from "./server.js";
+/**
+ * The Workers compatibility date the CA is run with, which matches the
+ * configuration the CA is tested with on Workers.
+ */
+export declare const COMPATIBILITY_DATE = "2026-03-13";
+/**
+ * Run the CA under workerd, the Cloudflare Workers runtime, using the Wrangler
+ * test harness as "wrangler dev" would, with a local D1 database and Secrets
+ * Store that are not persisted.
+ *
+ * The CA's output is copied to `log` every 100ms and when the server is
+ * closed. Errors from workerd itself, such as an uncaught exception, are
+ * logged as harness faults.
+ *
+ * @param config The test server configuration
+ * @param log The log file for the CA and harness
+ * @param root The directory Wrangler's working files are written to
+ * @returns The running server
+ */
+export declare const startWorkerd: (config: TestServerConfig, log: LogFile, root: string) => Promise<TestServer>;
+//# sourceMappingURL=workerd.d.ts.map

package/dist/workerd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerd.d.ts","sourceRoot":"","sources":["../src/workerd.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAc7C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,eAAe,CAAA;AAE9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,WAAkB,gBAAgB,OAAO,OAAO,QAAQ,MAAM,KAAG,OAAO,CAAC,UAAU,CAwE3G,CAAA"}

package/dist/workerd.js

@@ -0,0 +1,91 @@
+import { fileURLToPath } from "node:url";
+import { createTestHarness } from "wrangler";
+/**
+ * The Workers compatibility date the CA is run with, which matches the
+ * configuration the CA is tested with on Workers.
+ */
+export const COMPATIBILITY_DATE = "2026-03-13";
+/**
+ * Run the CA under workerd, the Cloudflare Workers runtime, using the Wrangler
+ * test harness as "wrangler dev" would, with a local D1 database and Secrets
+ * Store that are not persisted.
+ *
+ * The CA's output is copied to `log` every 100ms and when the server is
+ * closed. Errors from workerd itself, such as an uncaught exception, are
+ * logged as harness faults.
+ *
+ * @param config The test server configuration
+ * @param log The log file for the CA and harness
+ * @param root The directory Wrangler's working files are written to
+ * @returns The running server
+ */
+export const startWorkerd = async (config, log, root) => {
+    // use placeholder request.cf data rather than downloading it from
+    // Cloudflare and caching it in the working directory
+    process.env.CLOUDFLARE_CF_FETCH_ENABLED = "false";
+    const server = createTestHarness({
+        root,
+        workers: [{
+                config: {
+                    name: "serverless-ssh-ca",
+                    main: fileURLToPath(new URL("./worker.js", import.meta.url)),
+                    compatibility_date: COMPATIBILITY_DATE,
+                    compatibility_flags: ["nodejs_compat"],
+                    vars: config.bindings,
+                    d1_databases: [{
+                            binding: "DB",
+                            database_name: "ssh-ca-database",
+                            database_id: "00000000-0000-0000-0000-000000000000",
+                        }],
+                    secrets_store_secrets: [{
+                            binding: "PRIVATE_KEY",
+                            store_id: "test",
+                            secret_name: "ssh-ca-private-key",
+                        }],
+                },
+            }],
+    });
+    // copy the runtime logs to the log file. Errors that are not JSON lines
+    // from the CA are from workerd, such as an uncaught exception, so are
+    // logged as a harness fault.
+    const flushLogs = () => {
+        for (const entry of server.getLogs()) {
+            let json = true;
+            try {
+                JSON.parse(entry.message);
+            }
+            catch {
+                json = false;
+            }
+            if (json || entry.level !== "error") {
+                log.write(entry.message);
+            }
+            else {
+                log.fault("runtime error", entry.message);
+            }
+        }
+        server.clearLogs();
+    };
+    try {
+        const { url } = await server.listen();
+        // the secret must exist before the port is reported and requests are made
+        const env = await server.getWorker().getEnv();
+        const secrets = await env.PRIVATE_KEY["SecretsStoreSecret::admin_api"]();
+        await secrets.create(config.private_key);
+        const timer = setInterval(flushLogs, 100);
+        return {
+            port: Number(url.port),
+            close: async () => {
+                clearInterval(timer);
+                flushLogs();
+                await server.close();
+            },
+        };
+    }
+    catch (err) {
+        flushLogs();
+        await server.close();
+        throw err;
+    }
+};
+//# sourceMappingURL=workerd.js.map

package/dist/workerd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerd.js","sourceRoot":"","sources":["../src/workerd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAiB5C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAwB,EAAE,GAAY,EAAE,IAAY,EAAuB,EAAE;IAC/G,kEAAkE;IAClE,qDAAqD;IACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,OAAO,CAAA;IAEjD,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,CAAC;gBACT,MAAM,EAAE;oBACP,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC5D,kBAAkB,EAAE,kBAAkB;oBACtC,mBAAmB,EAAE,CAAC,eAAe,CAAC;oBACtC,IAAI,EAAE,MAAM,CAAC,QAAQ;oBACrB,YAAY,EAAE,CAAC;4BACd,OAAO,EAAE,IAAI;4BACb,aAAa,EAAE,iBAAiB;4BAChC,WAAW,EAAE,sCAAsC;yBACnD,CAAC;oBACF,qBAAqB,EAAE,CAAC;4BACvB,OAAO,EAAE,aAAa;4BACtB,QAAQ,EAAE,MAAM;4BAChB,WAAW,EAAE,oBAAoB;yBACjC,CAAC;iBACF;aACD,CAAC;KACF,CAAC,CAAA;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,SAAS,GAAG,GAAS,EAAE;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,GAAG,IAAI,CAAA;YACf,IAAI,CAAC;gBACJ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,GAAG,KAAK,CAAA;YACb,CAAC;YAED,IAAI,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACzB,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC1C,CAAC;QACF,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,CAAA;IACnB,CAAC,CAAA;IAED,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;QAErC,0EAA0E;QAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,EAAa,CAAC,MAAM,EAAE,CAAA;QACxD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,+BAA+B,CAAC,EAAE,CAAA;QACxE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAExC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAEzC,OAAO;YACN,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACtB,KAAK,EAAE,KAAK,IAAmB,EAAE;gBAChC,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,SAAS,EAAE,CAAA;gBACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACrB,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,EAAE,CAAA;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,73 @@
 {
-  "name": "@andrewheberle/serverless-ssh-ca-testing",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@andrewheberle/serverless-ssh-ca-testing",
+	"version": "0.20.2",
+	"description": "Runs the Serverless SSH CA under Node.js or workerd for end-to-end tests of clients",
+	"type": "module",
+	"types": "./dist/index.d.ts",
+	"bin": {
+		"serverless-ssh-ca-test-server": "dist/cli.js"
+	},
+	"files": [
+		"dist",
+		"src"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"scripts": {
+		"build": "tsc",
+		"lint": "eslint",
+		"release": "release-it",
+		"release:ci": "npm run release:patch",
+		"release:ci:major": "release-it major --ci",
+		"release:ci:minor": "release-it minor --ci",
+		"release:ci:patch": "release-it patch --ci",
+		"release:dryrun": "release-it --dry-run",
+		"test": "vitest run",
+		"test:workers": "vitest run --config vitest.integration.config.mts"
+	},
+	"dependencies": {
+		"wrangler": "^4.95.0",
+		"zod": "^4.0.0"
+	},
+	"peerDependencies": {
+		"@andrewheberle/serverless-ssh-ca": ">=0.20.0"
+	},
+	"devDependencies": {
+		"@andrewheberle/serverless-ssh-ca": "*",
+		"@eslint/js": "^10.0.1",
+		"@types/node": "^24.19.1",
+		"eslint": "^10.4.1",
+		"typescript": "^7.0.0",
+		"typescript-eslint": "^8.61.0",
+		"vitest": "^4.1.7"
+	},
+	"engines": {
+		"node": ">=24.0.0"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/andrewheberle/serverless-ssh-ca.git",
+		"directory": "packages/testing"
+	},
+	"homepage": "https://github.com/andrewheberle/serverless-ssh-ca/tree/main/packages/testing#readme",
+	"bugs": {
+		"url": "https://github.com/andrewheberle/serverless-ssh-ca/issues"
+	},
+	"author": "Andrew Heberle",
+	"license": "Apache-2.0",
+	"release-it": {
+		"git": false,
+		"npm": {
+			"publish": true,
+			"skipChecks": true
+		}
+	}
+}

package/src/cli.ts

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+// Runs the Serverless SSH CA for end-to-end tests of clients.
+//
+// Usage: serverless-ssh-ca-test-server [--runtime node|workerd] <config.json>
+//
+// The process exits when its stdin is closed, so it does not outlive the test
+// that started it.
+import { parseArgs } from "node:util"
+import z from "zod"
+import { readConfig, RuntimeSchema } from "./config.js"
+import { startTestServer } from "./index.js"
+import { LogFile } from "./log.js"
+
+const usage = "usage: serverless-ssh-ca-test-server [--runtime node|workerd] <config.json>"
+
+const main = async (): Promise<void> => {
+	const { values, positionals } = parseArgs({
+		options: {
+			runtime: { type: "string", default: "node" },
+		},
+		allowPositionals: true,
+	})
+
+	const runtime = RuntimeSchema.safeParse(values.runtime)
+	if (!runtime.success) {
+		throw new Error(`--runtime ${z.prettifyError(runtime.error)}\n${usage}`)
+	}
+
+	const [configFile, ...extra] = positionals
+	if (configFile === undefined || extra.length > 0) {
+		throw new Error(usage)
+	}
+
+	// faults after start up are written to the log file, where the test
+	// reading it will find them
+	const config = await readConfig(configFile)
+	const log = new LogFile(config.log_file)
+	process.on("uncaughtException", (err) => {
+		log.fault("uncaught exception", err)
+		process.exit(1)
+	})
+
+	const server = await startTestServer(runtime.data, configFile)
+
+	process.stdin.on("end", () => {
+		server.close().then(() => process.exit(0), (err: unknown) => {
+			log.fault("close failed", err)
+			process.exit(1)
+		})
+	})
+	process.stdin.resume()
+}
+
+main().catch((err: unknown) => {
+	console.error(err instanceof Error ? err.message : err)
+	process.exit(1)
+})

package/src/config.ts

@@ -0,0 +1,59 @@
+import { readFile } from "node:fs/promises"
+import z from "zod"
+
+/**
+ * The runtimes the CA can be run under by {@link startTestServer}: `node` uses
+ * the package's Node.js helpers with an in-memory `node:sqlite` database, and
+ * `workerd` uses the Cloudflare Workers runtime with a local D1 database and
+ * Secrets Store.
+ */
+export const RuntimeSchema = z.enum(["node", "workerd"])
+
+/**
+ * A runtime the CA can be run under, see {@link RuntimeSchema}.
+ */
+export type Runtime = z.infer<typeof RuntimeSchema>
+
+/**
+ * The configuration file read by {@link readConfig}.
+ */
+export const ConfigSchema = z.object({
+	/** The CA private key in OpenSSH format */
+	private_key: z.string().min(1),
+	/** The CA configuration, as the Workers vars (environment variables) */
+	bindings: z.record(z.string(), z.string()),
+	/** Path the listening port is written to once the CA is ready */
+	port_file: z.string().min(1),
+	/** Path that log output from the CA and harness is appended to */
+	log_file: z.string().min(1),
+})
+
+/**
+ * The configuration of a test server, see {@link ConfigSchema}.
+ */
+export type TestServerConfig = z.infer<typeof ConfigSchema>
+
+/**
+ * Read and validate a test server configuration file.
+ *
+ * @param path The path of a JSON file matching {@link ConfigSchema}
+ * @returns The validated configuration
+ * @throws Error if the file cannot be read, is not JSON or is not a valid configuration
+ */
+export const readConfig = async (path: string): Promise<TestServerConfig> => {
+	const text = await readFile(path, { encoding: "utf-8" })
+
+	let json: unknown
+	try {
+		json = JSON.parse(text)
+	} catch (err) {
+		throw new Error(`parsing ${path}: ${err instanceof Error ? err.message : String(err)}`, { cause: err })
+	}
+
+	const result = ConfigSchema.safeParse(json)
+	if (!result.success) {
+		throw new Error(`invalid configuration in ${path}:\n${z.prettifyError(result.error)}`)
+	}
+
+	return result.data
+}

package/src/format.ts

@@ -0,0 +1,33 @@
+/**
+ * Format a value logged by the CA as text, with objects as JSON so log lines
+ * from the CA's logger are written as JSON lines.
+ *
+ * @param value A value passed to a `console` method
+ * @returns The value as a string
+ */
+export const formatValue = (value: unknown): string => typeof value === "string"
+	? value
+	: JSON.stringify(value, (_, x: unknown) => x instanceof Error
+		? { name: x.name, message: x.message, stack: x.stack }
+		: typeof x === "bigint" ? x.toString() : x)
+
+/**
+ * Format the arguments to a `console` method as a single line.
+ *
+ * @param args The arguments passed to a `console` method
+ * @returns The arguments formatted with {@link formatValue}, separated by spaces
+ */
+export const formatArgs = (args: readonly unknown[]): string => args.map(formatValue).join(" ")
+
+/**
+ * Format a request handled by the CA as a log line, including the response
+ * body when the request was rejected.
+ *
+ * @param method The request method
+ * @param url The path and query of the request
+ * @param status The response status code
+ * @param body The response body
+ * @returns A JSON line with the message "harness request"
+ */
+export const formatRequest = (method: string, url: string, status: number, body: string): string =>
+	formatValue({ level: "info", message: "harness request", method, url, status, ...(status >= 400 ? { body } : {}) })

package/src/index.ts

@@ -0,0 +1,74 @@
+/**
+ * Runs the Serverless SSH CA for end-to-end tests of clients, under Node.js or
+ * workerd, configured from a file and reporting what it does through a log
+ * file of JSON lines (see {@link LogFile}).
+ *
+ * Most clients run the `serverless-ssh-ca-test-server` command rather than
+ * using this module directly.
+ *
+ * @example
+ * ```ts
+ * import { startTestServer } from "@andrewheberle/serverless-ssh-ca-testing"
+ *
+ * const server = await startTestServer("node", "config.json")
+ * // make requests to http://127.0.0.1:${server.port}
+ * await server.close()
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { writeFile } from "node:fs/promises"
+import { dirname, resolve } from "node:path"
+import { readConfig, type Runtime } from "./config.js"
+import { LogFile } from "./log.js"
+import { startNode } from "./node.js"
+import type { TestServer } from "./server.js"
+
+export { ConfigSchema, readConfig, RuntimeSchema } from "./config.js"
+export type { Runtime, TestServerConfig } from "./config.js"
+export { FAULT_MESSAGE, FAULT_MESSAGES, isFault, LogFile } from "./log.js"
+export type { TestServer } from "./server.js"
+
+/**
+ * Start the CA under `runtime` using the configuration in `configFile` (see
+ * {@link ConfigSchema}), then write the port it is listening on to the
+ * configuration's `port_file`.
+ *
+ * Output from the CA and harness is appended to the configuration's
+ * `log_file`, see {@link LogFile}. Under workerd, Wrangler's working files are
+ * written to the directory containing `configFile`.
+ *
+ * @param runtime The runtime to run the CA under, see {@link Runtime}
+ * @param configFile The path of the configuration file
+ * @returns The running server, see {@link TestServer}
+ */
+export const startTestServer = async (runtime: Runtime, configFile: string): Promise<TestServer> => {
+	const config = await readConfig(configFile)
+	const log = new LogFile(config.log_file)
+
+	let server: TestServer
+	switch (runtime) {
+		case "node":
+			server = await startNode(config, log)
+			break
+		case "workerd": {
+			// loaded on demand as importing Wrangler is slow
+			const { startWorkerd } = await import("./workerd.js")
+			server = await startWorkerd(config, log, dirname(resolve(configFile)))
+			break
+		}
+		default: {
+			const unknown: never = runtime
+			throw new Error(`unknown runtime: ${String(unknown)}`)
+		}
+	}
+
+	try {
+		await writeFile(config.port_file, String(server.port))
+	} catch (err) {
+		await server.close()
+		throw err
+	}
+
+	return server
+}