@andrewheberle/serverless-ssh-ca 0.18.2 → 0.19.0

package/README.md

@@ -15,8 +15,20 @@ import app from "@andrewheberle/serverless-ssh-ca"
 export default app
 ```
 
-This package **only** works with Cloudflare Workers and there are no plans to make
-this a generic solution at this time.
+This package is built for Cloudflare Workers, and Workers is the only runtime
+it is tested on. There are no plans to support other runtimes at this time.
+
+The package doesn't use any Workers-specific APIs and doesn't depend on
+`@cloudflare/workers-types`. It needs:
+
+- Web standard APIs (`Request`, `Response` and WebCrypto)
+- Node.js compatibility (`nodejs_compat` on Workers), because `sshpk` uses Node APIs
+- A database binding compatible with Cloudflare D1
+- A secret binding with an async `get()` method that returns the CA private key
+
+Its exported types describe only these needs, so the `Env` generated by
+`wrangler types` (with `DB` as a `D1Database` and `PRIVATE_KEY` as a
+`SecretsStoreSecret`) can be passed directly as `SshCaBindings`.
 
 See the following respositories for additional information:
 

package/dist/index.d.ts

@@ -1,8 +1,9 @@
+import type { ExecutionContext } from "hono";
 import type { SshCaBindings } from "./types.js";
-export type { SshCaBindings } from "./types.js";
+export type { CaDatabase, CaSecret, SshCaBindings } from "./types.js";
 declare const _default: {
     fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext): Promise<Response> | Response;
-    scheduled(controller: ScheduledController, env: SshCaBindings, ctx: ExecutionContext): Promise<void>;
+    scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>;
 };
 export default _default;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;;eAKhC,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,mBAAmB,OAAO,aAAa,OAAO,gBAAgB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;;eAWtD,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIvC,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAA+B,EAAE,GAAkB,EAAE,GAAqB;QACtF,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACqC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAUvC,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}

package/dist/router.d.ts

@@ -1,6 +1,5 @@
 import { type Context } from "hono";
 import type { SshCaBindings } from "./types.js";
-export type CFArgs = [SshCaBindings, ExecutionContext];
 export type AppContext = Context<{
     Bindings: SshCaBindings;
 }>;

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAIzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;AACtD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHA+B3C,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAIzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHA+B3C,CAAA"}

package/dist/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAMpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEhC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEhC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}

package/dist/types.d.ts

@@ -19,10 +19,33 @@ export type SSHExtension = {
     name: string;
     data: Buffer<ArrayBuffer>;
 };
+/**
+ * The subset of a Cloudflare D1 database binding used by the CA.
+ *
+ * A Workers `D1Database` binding satisfies this structurally, so the package
+ * does not need to depend on `@cloudflare/workers-types`.
+ */
+export interface CaDatabase {
+    prepare(query: string): unknown;
+    batch(statements: never[]): Promise<unknown>;
+    exec(query: string): Promise<unknown>;
+}
+/**
+ * The subset of a Cloudflare Secrets Store binding used to load the CA private key.
+ *
+ * A Workers `SecretsStoreSecret` binding satisfies this structurally.
+ */
+export interface CaSecret {
+    get(): Promise<string>;
+}
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase} and
+ * {@link CaSecret} for the non-string bindings.
+ */
 export interface SshCaBindings {
-    DB: D1Database;
+    DB: CaDatabase;
     DB_CERTIFICATE_RETENTION: string;
-    PRIVATE_KEY: SecretsStoreSecret;
+    PRIVATE_KEY: CaSecret;
     SSH_CERTIFICATE_EXTENSIONS: string;
     SSH_CERTIFICATE_LIFETIME: string;
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACvB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@andrewheberle/serverless-ssh-ca",
-	"version": "0.18.2",
+	"version": "0.19.0",
 	"description": "A serverless SSH CA built on Cloudflare Workers",
 	"type": "module",
 	"types": "./dist/index.d.ts",
@@ -31,17 +31,17 @@
 	},
 	"dependencies": {
 		"@andrewheberle/ts-slog": "^1.3.0",
-		"@cloudflare/workers-types": "^5.0.0",
 		"chanfana": "^3.0.0",
 		"hono": "^4.10.6",
 		"itty-time": "^2.0.2",
 		"jose": "^6.0.12",
-		"workers-qb": "^1.14.0",
 		"sshpk": "^1.18.0",
+		"workers-qb": "^1.14.0",
 		"zod": "^4.0.0"
 	},
 	"devDependencies": {
 		"@eslint/js": "^10.0.1",
+		"@types/node": "^24.19.1",
 		"@types/sshpk": "^1.17.4",
 		"@vitest/coverage-v8": "^4.1.7",
 		"eslint": "^10.4.1",

package/src/index.ts

@@ -1,7 +1,14 @@
+import type { ExecutionContext } from "hono"
 import { dbCleanup } from "./db/index.js"
 import { createApp } from "./router.js"
 import type { SshCaBindings } from "./types.js"
-export type { SshCaBindings } from "./types.js"
+export type { CaDatabase, CaSecret, SshCaBindings } from "./types.js"
+
+// the handlers the CA exposes, compatible with a Cloudflare Workers ExportedHandler
+type SshCaHandler = {
+    fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext): Response | Promise<Response>
+    scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>
+}
 
 let app: ReturnType<typeof createApp> | undefined
 
@@ -12,7 +19,7 @@ export default {
         }
         return app.fetch(req, env, ctx)
     },
-    async scheduled(controller: ScheduledController, env: SshCaBindings, ctx: ExecutionContext) {
+    async scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext) {
         ctx.waitUntil(dbCleanup(env))
     },
-} satisfies ExportedHandler<SshCaBindings>
+} satisfies SshCaHandler

package/src/krl.ts

@@ -123,7 +123,7 @@ function base64url(bytes: Uint8Array): string {
 async function importPrivateKey(caKey: PrivateKey): Promise<{
     cryptoKey: CryptoKey
     sigAlgo: string // SSH signature algorithm name
-    webCryptoAlgo: SubtleCryptoSignAlgorithm
+    webCryptoAlgo: Parameters<SubtleCrypto["sign"]>[0]
 }> {
     const type = caKey.type // "ed25519" | "ecdsa" | etc.
     const curve = (caKey as unknown as { curve?: string }).curve

package/src/router.ts

@@ -5,7 +5,6 @@ import { HTTPException } from "hono/http-exception"
 import { logger } from "./logger.js"
 import type { SshCaBindings } from "./types.js"
 
-export type CFArgs = [SshCaBindings, ExecutionContext]
 export type AppContext = Context<{ Bindings: SshCaBindings }>
 
 export const createApp = (env: SshCaBindings) => {

package/src/types.ts

@@ -26,10 +26,35 @@ export type SSHExtension = {
     data: Buffer<ArrayBuffer>
 }
 
+/**
+ * The subset of a Cloudflare D1 database binding used by the CA.
+ *
+ * A Workers `D1Database` binding satisfies this structurally, so the package
+ * does not need to depend on `@cloudflare/workers-types`.
+ */
+export interface CaDatabase {
+    prepare(query: string): unknown
+    batch(statements: never[]): Promise<unknown>
+    exec(query: string): Promise<unknown>
+}
+
+/**
+ * The subset of a Cloudflare Secrets Store binding used to load the CA private key.
+ *
+ * A Workers `SecretsStoreSecret` binding satisfies this structurally.
+ */
+export interface CaSecret {
+    get(): Promise<string>
+}
+
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase} and
+ * {@link CaSecret} for the non-string bindings.
+ */
 export interface SshCaBindings {
-    DB: D1Database
+    DB: CaDatabase
     DB_CERTIFICATE_RETENTION: string
-    PRIVATE_KEY: SecretsStoreSecret
+    PRIVATE_KEY: CaSecret
     SSH_CERTIFICATE_EXTENSIONS: string
     SSH_CERTIFICATE_LIFETIME: string
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean