@andrewheberle/serverless-ssh-ca 0.18.2 → 0.19.1

package/package.json

@@ -1,24 +1,26 @@
 {
 	"name": "@andrewheberle/serverless-ssh-ca",
-	"version": "0.18.2",
+	"version": "0.19.1",
 	"description": "A serverless SSH CA built on Cloudflare Workers",
 	"type": "module",
 	"types": "./dist/index.d.ts",
 	"files": [
 		"dist",
-		"src"
+		"src",
+		"openapi.json"
 	],
 	"exports": {
 		".": {
 			"types": "./dist/index.d.ts",
 			"default": "./dist/index.js"
-		}
+		},
+		"./openapi.json": "./openapi.json"
 	},
 	"scripts": {
 		"build": "tsc",
 		"coverage": "vitest run --coverage",
 		"lint": "eslint",
-		"prepublishOnly": "npm run build",
+		"prepublishOnly": "npm run build && npm run schema",
 		"release": "release-it",
 		"release:ci": "npm run release:patch",
 		"release:ci:major": "release-it major --ci",
@@ -31,17 +33,17 @@
 	},
 	"dependencies": {
 		"@andrewheberle/ts-slog": "^1.3.0",
-		"@cloudflare/workers-types": "^5.0.0",
 		"chanfana": "^3.0.0",
 		"hono": "^4.10.6",
 		"itty-time": "^2.0.2",
 		"jose": "^6.0.12",
-		"workers-qb": "^1.14.0",
 		"sshpk": "^1.18.0",
+		"workers-qb": "^1.14.0",
 		"zod": "^4.0.0"
 	},
 	"devDependencies": {
 		"@eslint/js": "^10.0.1",
+		"@types/node": "^24.19.1",
 		"@types/sshpk": "^1.17.4",
 		"@vitest/coverage-v8": "^4.1.7",
 		"eslint": "^10.4.1",

package/src/index.ts

@@ -1,7 +1,14 @@
+import type { ExecutionContext } from "hono"
 import { dbCleanup } from "./db/index.js"
 import { createApp } from "./router.js"
 import type { SshCaBindings } from "./types.js"
-export type { SshCaBindings } from "./types.js"
+export type { CaDatabase, CaSecret, SshCaBindings } from "./types.js"
+
+// the handlers the CA exposes, compatible with a Cloudflare Workers ExportedHandler
+type SshCaHandler = {
+    fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext): Response | Promise<Response>
+    scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>
+}
 
 let app: ReturnType<typeof createApp> | undefined
 
@@ -12,7 +19,7 @@ export default {
         }
         return app.fetch(req, env, ctx)
     },
-    async scheduled(controller: ScheduledController, env: SshCaBindings, ctx: ExecutionContext) {
+    async scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext) {
         ctx.waitUntil(dbCleanup(env))
     },
-} satisfies ExportedHandler<SshCaBindings>
+} satisfies SshCaHandler

package/src/krl.ts

@@ -123,7 +123,7 @@ function base64url(bytes: Uint8Array): string {
 async function importPrivateKey(caKey: PrivateKey): Promise<{
     cryptoKey: CryptoKey
     sigAlgo: string // SSH signature algorithm name
-    webCryptoAlgo: SubtleCryptoSignAlgorithm
+    webCryptoAlgo: Parameters<SubtleCrypto["sign"]>[0]
 }> {
     const type = caKey.type // "ed25519" | "ecdsa" | etc.
     const curve = (caKey as unknown as { curve?: string }).curve

package/src/router.ts

@@ -5,7 +5,6 @@ import { HTTPException } from "hono/http-exception"
 import { logger } from "./logger.js"
 import type { SshCaBindings } from "./types.js"
 
-export type CFArgs = [SshCaBindings, ExecutionContext]
 export type AppContext = Context<{ Bindings: SshCaBindings }>
 
 export const createApp = (env: SshCaBindings) => {

package/src/types.ts

@@ -26,10 +26,35 @@ export type SSHExtension = {
     data: Buffer<ArrayBuffer>
 }
 
+/**
+ * The subset of a Cloudflare D1 database binding used by the CA.
+ *
+ * A Workers `D1Database` binding satisfies this structurally, so the package
+ * does not need to depend on `@cloudflare/workers-types`.
+ */
+export interface CaDatabase {
+    prepare(query: string): unknown
+    batch(statements: never[]): Promise<unknown>
+    exec(query: string): Promise<unknown>
+}
+
+/**
+ * The subset of a Cloudflare Secrets Store binding used to load the CA private key.
+ *
+ * A Workers `SecretsStoreSecret` binding satisfies this structurally.
+ */
+export interface CaSecret {
+    get(): Promise<string>
+}
+
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase} and
+ * {@link CaSecret} for the non-string bindings.
+ */
 export interface SshCaBindings {
-    DB: D1Database
+    DB: CaDatabase
     DB_CERTIFICATE_RETENTION: string
-    PRIVATE_KEY: SecretsStoreSecret
+    PRIVATE_KEY: CaSecret
     SSH_CERTIFICATE_EXTENSIONS: string
     SSH_CERTIFICATE_LIFETIME: string
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean