@andrewheberle/serverless-ssh-ca 0.17.5 → 0.17.7

package/dist/src/api/v3/schema.js

@@ -1,216 +0,0 @@
-import z from "zod";
-import { split, refineCertificateRequest, transformAuthorizationHeader, transformProofOfPossession, transformPublicKey, transformRenewalProofOfPossession, refineHostCertificateRequest, transformCertificate, refineHostCertificateRenewal, refineRevokeCertificate, transformIdentityToken, } from "../../utils";
-import { ConflictException, contentJson, ForbiddenException, InputValidationException, InternalServerErrorException, UnauthorizedException, UnprocessableEntityException, } from "chanfana";
-import { env } from "cloudflare:workers";
-import { seconds } from "itty-time";
-const openapiStringByte = z.base64()
-    .transform((v) => {
-    const a = z.util.base64ToUint8Array(v);
-    return Buffer.from(a.buffer, a.byteOffset, a.length);
-})
-    .openapi({ format: "byte" });
-const proofOfPossession = z.string()
-    .meta({
-    description: "Proof of possession comprising of ${timestamp}.${fingerprint}.${signature}",
-    example: "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0KVTFOSVUwbEhBQUFBQVFBQUFHZ0FBQUFUWldOa2MyRXRjMmhoTWkxdWFYTjBjREkxTmdBQUFBaHVhWE4wY0RJMQpOZ0FBQUVFRUR6Ymk4OE10alBYSDFCb1JURU9HaS96aEc4QnhQNVZUUW5OQkFNMGZtMExtekErUUZkUlNVYVRFCkdNN2l0QjhINmZNZFAydlAxcElQcGUyOWVLQkJZd0FBQUFSbWFXeGxBQUFBQUFBQUFBWnphR0UxTVRJQUFBQmsKQUFBQUUyVmpaSE5oTFhOb1lUSXRibWx6ZEhBeU5UWUFBQUJKQUFBQUlHdmZVZGNDQkRXa3ZwL0ZHS3NkakgrRQpKZzZXN0EvWUJVZng2Z0srQ01raEFBQUFJUUQxOFd5cDNZejZ0eXNvdllXbEJHTXprRnlYbFRrSHM5blVVRXJqCkczNWVPQT09Ci0tLS0tRU5EIFNTSCBTSUdOQVRVUkUtLS0tLQo="
-});
-const publicKey = openapiStringByte
-    .transform(transformPublicKey)
-    .meta({
-    description: "SSH public key to sign",
-    example: "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
-});
-const identityToken = z.string()
-    .meta({
-    description: "Identity Token JWT from OIDC IdP",
-    example: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
-})
-    .transform(transformIdentityToken);
-const accessToken = z.string()
-    .meta({
-    description: "Access Token JWT from OIDC IdP",
-    example: "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
-})
-    .startsWith("Bearer ")
-    .transform(transformAuthorizationHeader);
-const krl = openapiStringByte
-    .meta({ description: "Key Revocation List" });
-const HeaderSchema = z.object({
-    "Authorization": accessToken
-});
-const certificate = openapiStringByte
-    .meta({ description: "Issued Certificate" });
-export const CaPublicKeyEndpointSchema = {
-    responses: {
-        "200": {
-            content: {
-                "text/plain": {
-                    schema: z.string()
-                }
-            },
-            description: "Returns SSH Certificate Authority Public Key",
-        },
-        ...InternalServerErrorException.schema(),
-    }
-};
-export const UserCertificateRequestEndpointSchema = {
-    security: [
-        {
-            oidcAuth: []
-        }
-    ],
-    request: {
-        headers: HeaderSchema,
-        body: contentJson(z.object({
-            public_key: publicKey,
-            proof: proofOfPossession
-                .transform(transformProofOfPossession),
-            identity: identityToken,
-            extensions: z.array(z.string())
-                .default(split(env.SSH_CERTIFICATE_EXTENSIONS))
-                .meta({ description: "Extensions to include in the issued SSH certificate" }),
-            lifetime: z.int()
-                .min(seconds("5 minutes"))
-                .max(seconds(env.SSH_CERTIFICATE_LIFETIME))
-                .default(seconds(env.SSH_CERTIFICATE_LIFETIME))
-                .meta({ description: "Lifetime of issued SSH certificate" }),
-        })
-            .superRefine(refineCertificateRequest)
-            .openapi("User Certificate Request"))
-    },
-    responses: {
-        "200": {
-            description: "SSH User Certificate issued successfully",
-            ...contentJson(z.object({
-                certificate: certificate,
-            })
-                .openapi("Certificate Response"))
-        },
-        ...UnauthorizedException.schema(),
-        ...ForbiddenException.schema(),
-        ...InputValidationException.schema(),
-        ...UnprocessableEntityException.schema(),
-        ...InternalServerErrorException.schema(),
-    }
-};
-export const RevocationListEndpointSchema = {
-    request: {
-        params: z.object({
-            certificateType: z.enum(["user", "host"])
-        }),
-    },
-    responses: {
-        "200": {
-            description: "Returns an Open SSH Key Revocation List as BASE64 and an SSHSIG signature for verification",
-            ...contentJson(z.object({
-                krl: krl,
-                signature: z.string()
-            })
-                .openapi("Key Revocation List Response"))
-        },
-        ...InternalServerErrorException.schema(),
-    }
-};
-export const HostCertificateRequestEndpointSchema = {
-    security: [
-        {
-            oidcAuth: []
-        }
-    ],
-    request: {
-        headers: HeaderSchema,
-        body: contentJson(z.object({
-            public_key: publicKey,
-            proof: proofOfPossession
-                .transform(transformProofOfPossession),
-            identity: identityToken,
-            principals: z.array(z.string()).min(1)
-                .meta({ description: "List of principals to include on the issued certificate" }),
-            lifetime: z.int()
-                .min(seconds("24 hours"))
-                .max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
-                .default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
-                .meta({ description: "Lifetime of issued Host SSH certificate" }),
-        })
-            .superRefine(refineHostCertificateRequest)
-            .openapi("Host Certificate Request"))
-    },
-    responses: {
-        "200": {
-            description: "SSH Host Certificate issued successfully",
-            ...contentJson(z.object({
-                certificate: certificate,
-            })
-                .openapi("Certificate Response"))
-        },
-        ...UnauthorizedException.schema(),
-        ...ForbiddenException.schema(),
-        ...InputValidationException.schema(),
-        ...UnprocessableEntityException.schema(),
-        ...InternalServerErrorException.schema(),
-    }
-};
-export const HostCertificateRenewEndpointSchema = {
-    request: {
-        body: contentJson(z.object({
-            certificate: openapiStringByte
-                .transform(transformCertificate)
-                .meta({ description: "SSH certificate to renew" }),
-            public_key: publicKey,
-            proof: proofOfPossession
-                .transform(transformRenewalProofOfPossession),
-            lifetime: z.int()
-                .min(seconds("24 hours"))
-                .max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
-                .default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
-                .meta({ description: "Lifetime of renewed Host SSH certificate" }),
-        })
-            .superRefine(refineHostCertificateRenewal)
-            .openapi("Host Certificate Renew"))
-    },
-    responses: {
-        "200": {
-            description: "SSH Host Certificate renewed successfully",
-            ...contentJson(z.object({
-                certificate: certificate
-            })
-                .openapi("Certificate Response")),
-        },
-        ...UnauthorizedException.schema(),
-        ...ForbiddenException.schema(),
-        ...InputValidationException.schema(),
-        ...UnprocessableEntityException.schema(),
-        ...InternalServerErrorException.schema(),
-    }
-};
-export const RevokeCertificateEndpointSchema = {
-    request: {
-        params: z.object({
-            certificateType: z.enum(["user", "host"])
-        }),
-        body: contentJson(z.object({
-            serial: z.bigint()
-                .meta({ description: "Serial number of certificate to revoke" }),
-            public_key: publicKey,
-            proof: proofOfPossession
-                .transform(transformProofOfPossession),
-        })
-            .openapi("Certificate Revocation")
-            .superRefine(refineRevokeCertificate))
-    },
-    responses: {
-        "200": {
-            description: "SSH certificate revoked successfully",
-            ...contentJson(z.object({
-                revoked_at: z.iso.datetime(),
-            })
-                .openapi("Revocation Response")),
-        },
-        ...UnauthorizedException.schema(),
-        ...ForbiddenException.schema(),
-        ...InputValidationException.schema(),
-        ...UnprocessableEntityException.schema(),
-        ...InternalServerErrorException.schema(),
-        ...ConflictException.schema()
-    }
-};

package/dist/src/certificate.d.ts

@@ -1,30 +0,0 @@
-import { Certificate, Identity, Key, PrivateKey } from "sshpk";
-import { SshCaBindings } from "./types";
-export type CreateCertificateOptions = {
-    lifetime?: number;
-    principals?: string[];
-    extensions?: string[];
-};
-export declare class CertificateError extends Error {
-    constructor(message: string);
-}
-export type GenerateCertificateOptions = {
-    /**
-     * @internal
-     * Override the certificate serial number.
-     * Should only be set in tests.
-     */
-    serial?: bigint;
-} & CreateCertificateOptions;
-export declare const generateCertificate: (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions) => Certificate;
-export declare function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate>;
-export type CreateHostCertificateOptions = {
-    lifetime?: number;
-    principals?: string[];
-    subjects?: Identity[];
-};
-export declare class BadIssuerError extends Error {
-    constructor(message: string);
-}
-export declare function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate>;
-export declare const generateSerial: (serial?: bigint) => Buffer<ArrayBuffer>;

package/dist/src/certificate.js

@@ -1,154 +0,0 @@
-import { seconds } from "itty-time";
-import { createCertificate, identityForHost, identityForUser, identityFromDN, parsePrivateKey } from "sshpk";
-import { split } from "./utils";
-/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
-    lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
-    principals: [],
-    extensions: sshCertificateExtensions
-} */
-export class CertificateError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "CertificateError";
-        // This is necessary for proper stack trace in TypeScript
-        Object.setPrototypeOf(this, CertificateError.prototype);
-    }
-}
-export const generateCertificate = (env, email, key, public_key, options) => {
-    let { lifetime, principals, extensions, serial } = options ?? {};
-    // add identities
-    const identity = env.SSH_CERTIFICATE_INCLUDE_SELF === "true"
-        ? [identityForUser(email.split("@")[0])]
-        : [];
-    if (principals !== undefined) {
-        for (const p of principals) {
-            identity.push(identityForUser(p));
-        }
-    }
-    if (env.SSH_CERTIFICATE_PRINCIPALS !== "") {
-        for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
-            identity.push(identityForUser(p));
-        }
-    }
-    // lifetime is the smaller of what was provided in the options or the default
-    lifetime = lifetime !== undefined
-        ? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
-        : seconds(env.SSH_CERTIFICATE_LIFETIME);
-    // generate value for serial of certificate
-    const s = generateSerial(serial);
-    // set issuer of certificate based on ISSUER_DN
-    const issuer = identityFromDN(env.ISSUER_DN);
-    // create certificate
-    const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s });
-    // ensure openssh info is included in certificate (should not occur)
-    if (certificate.signatures.openssh === undefined) {
-        throw new CertificateError("missing openssh information in certificate");
-    }
-    const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS);
-    // add usage extensions
-    const sshextensions = [];
-    if (extensions !== undefined) {
-        // if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
-        for (const ext of extensions) {
-            if (!sshCertificateExtensions.includes(ext)) {
-                throw new CertificateError(`${ext} is not allowed`);
-            }
-            // add to list of allowed extensions
-            sshextensions.push({
-                critical: false,
-                name: ext,
-                data: Buffer.alloc(0)
-            });
-        }
-    }
-    else {
-        // use defaults if not provided
-        sshCertificateExtensions.forEach((ext) => {
-            sshextensions.push({
-                critical: false,
-                name: ext,
-                data: Buffer.alloc(0)
-            });
-        });
-    }
-    // add info to certificate
-    certificate.signatures = {
-        openssh: {
-            nonce: certificate.signatures.openssh.nonce,
-            keyId: email,
-            signature: certificate.signatures.openssh.signature,
-            exts: sshextensions
-        }
-    };
-    // re-sign after changes
-    certificate.signWith(key);
-    return certificate;
-};
-export async function createSignedCertificate(env, email, public_key, options) {
-    // grab private key from secret store
-    const secret = await env.PRIVATE_KEY.get();
-    // parse key
-    const key = parsePrivateKey(secret);
-    if (options === undefined) {
-        options = {
-            lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
-            principals: [],
-            extensions: split(env.SSH_CERTIFICATE_EXTENSIONS)
-        };
-    }
-    return generateCertificate(env, email, key, public_key, options);
-}
-/* const DefaultCreateHostertificateOptions: CreateHostCertificateOptions = {
-    lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
-    principals: [],
-} */
-export class BadIssuerError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "BadIssuerError";
-        Object.setPrototypeOf(this, BadIssuerError.prototype);
-    }
-}
-export async function createSignedHostCertificate(env, public_key, options) {
-    if (options === undefined) {
-        options = {
-            lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
-            principals: []
-        };
-    }
-    // generate list of identities for host key
-    const identity = [];
-    if (options.principals !== undefined) {
-        for (const p of options.principals) {
-            identity.push(identityForHost(p));
-        }
-    }
-    // add any already provided subjects (for renewals only)
-    if (options.subjects !== undefined) {
-        identity.push(...options.subjects);
-    }
-    // grab private key from secret store
-    const secret = await env.PRIVATE_KEY.get();
-    // parse private key
-    const key = parsePrivateKey(secret);
-    // lifetime is the smaller of what was provided in the options or the default
-    const lifetime = options.lifetime !== undefined
-        ? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
-        : seconds(env.SSH_HOST_CERTIFICATE_LIFETIME);
-    // generate value for serial of certificate
-    const serial = generateSerial();
-    // set issuer of certificate based on ISSUER_DN
-    const issuer = identityFromDN(env.ISSUER_DN);
-    // create certificate
-    const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial });
-    return certificate;
-}
-export const generateSerial = (serial) => {
-    if (serial !== undefined) {
-        const s = Buffer.alloc(8);
-        s.writeBigUInt64BE(serial);
-        return s;
-    }
-    const randomBytes = crypto.getRandomValues(new Uint8Array(8));
-    return Buffer.from(randomBytes);
-};

package/dist/src/db.d.ts

@@ -1,36 +0,0 @@
-import { Certificate } from "sshpk";
-import { SshCaBindings } from "./types";
-export declare enum CertificateType {
-    User = 0,
-    Host = 1
-}
-export type CertificateRecord = {
-    id: number;
-    serial: string;
-    key_id: string;
-    principals: string;
-    extensions: string | null;
-    valid_after: Date;
-    valid_before: Date;
-    revoked_at: Date | null;
-    certificate_type: CertificateType;
-    public_key: string | null;
-};
-export declare const runStatement: <T = Record<string, unknown>>(stmt: D1PreparedStatement) => Promise<D1Result<T>>;
-export declare const shouldRetry: (err: unknown, nextAttempt: number) => boolean;
-export declare const dbCleanup: (env: SshCaBindings) => Promise<void>;
-export declare const recordCertificate: (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType?: CertificateType) => Promise<void>;
-export declare const isRevoked: (env: SshCaBindings, serial: bigint) => Promise<boolean>;
-export declare enum RevocationStatus {
-    NotFound = 0,
-    Revoked = 1,
-    Revokable = 2,
-    Unrevokable = 3
-}
-export declare const revocationStatus: (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType) => Promise<RevocationStatus>;
-export declare const getRevocationList: (env: SshCaBindings, certificateType: CertificateType) => Promise<string[]>;
-type RevokedCertificate = {
-    revoked_at: string;
-};
-export declare const revokeCertificate: (env: SshCaBindings, serial: bigint) => Promise<RevokedCertificate[]>;
-export {};

package/dist/src/db.js

@@ -1,111 +0,0 @@
-import { tryWhile } from "@cloudflare/actors";
-import { logger } from "./logger";
-export var CertificateType;
-(function (CertificateType) {
-    CertificateType[CertificateType["User"] = 0] = "User";
-    CertificateType[CertificateType["Host"] = 1] = "Host";
-})(CertificateType || (CertificateType = {}));
-export const runStatement = async (stmt) => {
-    return await tryWhile(async () => {
-        return await stmt.run();
-    }, shouldRetry);
-};
-export const shouldRetry = (err, nextAttempt) => {
-    const errMsg = String(err);
-    const isRetryableError = errMsg.includes("Network connection lost") ||
-        errMsg.includes("storage caused object to be reset") ||
-        errMsg.includes("reset because its code was updated") ||
-        errMsg.includes("stream because client disconnected");
-    if (nextAttempt <= 5 && isRetryableError) {
-        return true;
-    }
-    return false;
-};
-export const dbCleanup = async (env) => {
-    const l = logger.with("retention", env.DB_CERTIFICATE_RETENTION);
-    if (env.DB_CERTIFICATE_RETENTION === "infinite") {
-        l.info("skipping database cleanup");
-    }
-    l.info("starting database cleanup");
-    try {
-        const stmt = env.DB.prepare("DELETE FROM certificates WHERE unixepoch('subsec') > unixepoch(valid_before,'subsec',?)")
-            .bind(env.DB_CERTIFICATE_RETENTION);
-        const res = await stmt.run();
-        l.info("completed database cleanup", "changes", res.meta.changes);
-    }
-    catch (err) {
-        l.error("error during database cleanup", "retention", env.DB_CERTIFICATE_RETENTION);
-    }
-};
-export const recordCertificate = async (env, certificate, keyid, certificateType = CertificateType.User) => {
-    const serial = certificate.serial.readBigUInt64BE(0);
-    const subjects = certificate.subjects.map((v) => {
-        return v.toString();
-    }).join(",");
-    const extensions = certificate.getExtensions().map((v) => {
-        // @ts-ignore: the name property does exist
-        return v.name;
-    }).join(",");
-    const stmt = env.DB
-        .prepare("INSERT INTO certificates (serial, key_id, principals, extensions, valid_after, valid_before, certificate_type, public_key) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
-        .bind(`${serial}`, keyid, subjects, extensions, certificate.validFrom.toISOString(), certificate.validUntil.toISOString(), certificateType, certificate.subjectKey.toString("ssh"));
-    const res = await runStatement(stmt);
-    if (!res.success) {
-        if (res.error !== undefined) {
-            throw new Error(res.error);
-        }
-        throw new Error("error during query");
-    }
-};
-export const isRevoked = async (env, serial) => {
-    const stmt = env.DB
-        .prepare("SELECT serial FROM certificates WHERE serial = ? AND revoked_at NOTNULL")
-        .bind(`${serial}`);
-    const res = await runStatement(stmt);
-    return res.results.length > 0;
-};
-export var RevocationStatus;
-(function (RevocationStatus) {
-    RevocationStatus[RevocationStatus["NotFound"] = 0] = "NotFound";
-    RevocationStatus[RevocationStatus["Revoked"] = 1] = "Revoked";
-    RevocationStatus[RevocationStatus["Revokable"] = 2] = "Revokable";
-    RevocationStatus[RevocationStatus["Unrevokable"] = 3] = "Unrevokable";
-})(RevocationStatus || (RevocationStatus = {}));
-export const revocationStatus = async (env, serial, publickey, certificateType) => {
-    const stmt = env.DB
-        .prepare("SELECT public_key, revoked_at as count FROM certificates WHERE serial = ? AND public_key = ? AND certificate_type = ?")
-        .bind(`${serial}`, publickey, certificateType);
-    const res = await runStatement(stmt);
-    if (res.results.length === 0) {
-        return RevocationStatus.NotFound;
-    }
-    const row = res.results?.[0];
-    if (!row) {
-        return RevocationStatus.NotFound;
-    }
-    if (row.revoked_at !== null) {
-        return RevocationStatus.Revoked;
-    }
-    if (publickey === row.public_key) {
-        return RevocationStatus.Revokable;
-    }
-    return RevocationStatus.Unrevokable;
-};
-export const getRevocationList = async (env, certificateType) => {
-    const stmt = env.DB
-        .prepare("SELECT serial FROM certificates WHERE revoked_at NOTNULL AND certificate_type = ? AND unixepoch('subsec') < unixepoch(valid_before,'subsec','24 hours')")
-        .bind(certificateType);
-    const res = await runStatement(stmt);
-    const result = [];
-    for (const item of res.results) {
-        result.push(item.serial);
-    }
-    return result;
-};
-export const revokeCertificate = async (env, serial) => {
-    const stmt = env.DB
-        .prepare("UPDATE certificates SET revoked_at = ? WHERE serial = ? RETURNING revoked_at")
-        .bind((new Date).toISOString(), `${serial}`);
-    const res = await runStatement(stmt);
-    return res.results;
-};

package/dist/src/index.d.ts

@@ -1,6 +0,0 @@
-import { SshCaBindings } from "./types";
-declare const _default: {
-    fetch: (request: Request, Env?: unknown, executionCtx?: import("hono").ExecutionContext) => Response | Promise<Response>;
-    scheduled(controller: ScheduledController, env: SshCaBindings, ctx: ExecutionContext): Promise<void>;
-};
-export default _default;

package/dist/src/index.js

@@ -1,8 +0,0 @@
-import { dbCleanup } from "./db";
-import { app } from "./router";
-export default {
-    fetch: app.fetch,
-    async scheduled(controller, env, ctx) {
-        ctx.waitUntil(dbCleanup(env));
-    },
-};

package/dist/src/krl.d.ts

@@ -1,39 +0,0 @@
-import type { PrivateKey } from "sshpk";
-export declare class KRLBuilder {
-    private readonly _caKey;
-    private readonly _serials;
-    private readonly _keyIds;
-    private _krl;
-    constructor(caKey: PrivateKey);
-    /**
-     * Add certificate serial numbers to be revoked.
-     * May be called multiple times all serials are merged into one section.
-     *
-     * This must not be called after generate() has been called
-     */
-    addSerials(serials: bigint[]): this;
-    /**
-     * Add certificate key ID strings to be revoked.
-     * May be called multiple times all key IDs are merged into one section.
-     *
-     * This must not be called after generate() has been called
-     */
-    addKeyIds(keyIds: string[]): this;
-    /**
-     * Generate the binary KRL
-     *
-     * @param krlVersion  Optional KRL version number (default: 1).
-     * @param comment     Optional comment string embedded in the header.
-     */
-    generate(krlVersion?: bigint, comment?: string): ArrayBuffer;
-    /**
-     * Return the SSHSIG signature of the KRL.
-     *
-     * This must be called after generate()
-     *
-     * The returned string can be verified with ssh-keygen:
-     *   echo -n "$KRL_BYTES" | ssh-keygen -Y verify -f allowed_signers \
-     *     -I <identity> -n file -s <sig_file>
-     */
-    signature(): Promise<string>;
-}