@andrewheberle/serverless-ssh-ca 0.19.0 → 0.20.0

package/README.md

@@ -15,8 +15,9 @@ import app from "@andrewheberle/serverless-ssh-ca"
 export default app
 ```
 
-This package is built for Cloudflare Workers, and Workers is the only runtime
-it is tested on. There are no plans to support other runtimes at this time.
+This package is built for Cloudflare Workers and can also run on Node.js 24
+(see [Running on Node.js](#running-on-nodejs)). These are the only runtimes it
+is tested on.
 
 The package doesn't use any Workers-specific APIs and doesn't depend on
 `@cloudflare/workers-types`. It needs:
@@ -30,6 +31,62 @@ Its exported types describe only these needs, so the `Env` generated by
 `wrangler types` (with `DB` as a `D1Database` and `PRIVATE_KEY` as a
 `SecretsStoreSecret`) can be passed directly as `SshCaBindings`.
 
+### Running on Node.js
+
+Node.js 24 or later is required. Helpers for Node.js are imported from
+`@andrewheberle/serverless-ssh-ca/node`:
+
+| Helper | Purpose |
+|---|---|
+| `fromNodeSqlite(db)` | Uses a built-in `node:sqlite` database as the `DB` binding |
+| `secretFromFile(path)` | Reads the CA private key from a file (re-read each time it is needed) |
+| `secretFromString(value)` | Uses a string as the CA private key |
+| `bindingsFromEnv({ DB, PRIVATE_KEY })` | Reads and validates the remaining configuration from `process.env` |
+
+`createSshCa(bindings)` returns a `fetch(request)` handler that takes a
+standard `Request` and returns a `Response`, and a `cleanup()` task that
+replaces the Workers cron trigger.
+
+The handler can be served by any server that works with `Request` and
+`Response`. For example, with [`@hono/node-server`](https://www.npmjs.com/package/@hono/node-server)
+(installed separately with `npm install @hono/node-server`):
+
+```ts
+import { DatabaseSync } from "node:sqlite"
+import { serve } from "@hono/node-server"
+import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+
+const ca = createSshCa(bindingsFromEnv({
+    DB: fromNodeSqlite(new DatabaseSync("/var/lib/ssh-ca/ssh-ca.sqlite")),
+    PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+}))
+
+// remove expired certificates once a day
+setInterval(() => void ca.cleanup(), 24 * 60 * 60 * 1000)
+
+serve({ fetch: (req) => ca.fetch(req), port: 8787 })
+```
+
+Notes:
+
+- The configuration environment variables have the same names and formats
+  as the `vars` in the Workers [`wrangler.jsonc`](https://github.com/andrewheberle/serverless-ssh-ca/blob/main/packages/workers-integration/wrangler.jsonc).
+  `bindingsFromEnv` validates them at start up and throws an
+  `InvalidConfigurationError` that lists every missing or invalid variable.
+- The database schema is created and migrated automatically on first use, as
+  on Workers. Use a file path for `DatabaseSync` (not `:memory:`) so issued
+  and revoked certificates survive restarts.
+- Only SQLite databases are supported. Other SQLite-compatible databases can
+  be used by implementing the `CaDatabase` interface.
+- The CA private key has the same requirements as on Workers (see
+  [CA Private Key](#ca-private-key)). Keep the key file readable only by the
+  user running the CA.
+- `cleanup()` can also be run on a schedule outside the process (for example
+  from a systemd timer or cron job) instead of using `setInterval`.
+- Put the CA behind a reverse proxy that terminates TLS, as clients send
+  identity tokens to it.
+
 See the following respositories for additional information:
 
 
@@ -193,7 +250,7 @@ must be an Ed25519 or ECDSA (`nistp256`, `nistp384` or `nistp521`) key:
 ssh-keygen -t ed25519 -N "" -C "" -f ssh-ca
 ```
 
-RSA CA keys are not supported on the Workers runtime. With an RSA CA key
+RSA CA keys are not supported. With an RSA CA key
 configured, every request that uses the CA key (including `/api/v3/ca` and
 the KRL endpoints) returns a `500` error, and the reason is logged:
 

package/dist/index.d.ts

@@ -1,6 +1,33 @@
 import type { ExecutionContext } from "hono";
 import type { SshCaBindings } from "./types.js";
-export type { CaDatabase, CaSecret, SshCaBindings } from "./types.js";
+export type { CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaSecret, SshCaBindings } from "./types.js";
+/**
+ * A runtime neutral instance of the CA, returned by {@link createSshCa}.
+ */
+export interface SshCa {
+    /**
+     * Handle a request to the CA's API, suitable for any server that speaks
+     * the Fetch API `Request` and `Response` types.
+     */
+    fetch(req: Request): Promise<Response>;
+    /**
+     * Remove expired certificates from the database according to
+     * `DB_CERTIFICATE_RETENTION`. This should be run periodically (for example
+     * once a day), as the `scheduled` handler does on Cloudflare Workers.
+     */
+    cleanup(): Promise<void>;
+}
+/**
+ * Create an instance of the CA bound to a fixed set of bindings, for use on
+ * runtimes other than Cloudflare Workers.
+ *
+ * On Workers use the default export instead, which receives its bindings from
+ * the runtime on each request.
+ *
+ * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @returns The CA's request handler and database cleanup task, see {@link SshCa}
+ */
+export declare const createSshCa: (env: SshCaBindings) => SshCa;
 declare const _default: {
     fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext): Promise<Response> | Response;
     scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;;eAWtD,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAQnI;;GAEG;AACH,MAAM,WAAW,KAAK;IAClB;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QAAS,aAAa,KAAG,KAOhD,CAAA;;eAKc,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}

package/dist/index.js

@@ -1,5 +1,22 @@
 import { dbCleanup } from "./db/index.js";
 import { createApp } from "./router.js";
+/**
+ * Create an instance of the CA bound to a fixed set of bindings, for use on
+ * runtimes other than Cloudflare Workers.
+ *
+ * On Workers use the default export instead, which receives its bindings from
+ * the runtime on each request.
+ *
+ * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @returns The CA's request handler and database cleanup task, see {@link SshCa}
+ */
+export const createSshCa = (env) => {
+    const app = createApp(env);
+    return {
+        fetch: async (req) => await app.fetch(req, env),
+        cleanup: async () => await dbCleanup(env),
+    };
+};
 let app;
 export default {
     fetch(req, env, ctx) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAUvC,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA2BvC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAS,EAAE;IACrD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAE1B,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,GAAY,EAAqB,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;QAC3E,OAAO,EAAE,KAAK,IAAmB,EAAE,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC;KAC3D,CAAA;AACL,CAAC,CAAA;AAED,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}

package/dist/node/env.d.ts

@@ -0,0 +1,72 @@
+import z from "zod";
+import type { CaDatabase, CaSecret, SshCaBindings } from "../types.js";
+/**
+ * The environment variables read by {@link bindingsFromEnv}, which match the
+ * Workers vars documented for the CA.
+ */
+export declare const EnvSchema: z.ZodObject<{
+    DB_CERTIFICATE_RETENTION: z.ZodUnion<readonly [z.ZodLiteral<"infinite">, z.ZodString]>;
+    SSH_CERTIFICATE_EXTENSIONS: z.ZodString;
+    SSH_CERTIFICATE_LIFETIME: z.ZodString;
+    SSH_CERTIFICATE_INCLUDE_SELF: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    SSH_CERTIFICATE_INCLUDE_SELF_EMAIL: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    SSH_CERTIFICATE_PRINCIPALS: z.ZodOptional<z.ZodString>;
+    SSH_HOST_CERTIFICATE_LIFETIME: z.ZodString;
+    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: z.ZodOptional<z.ZodString>;
+    SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.ZodOptional<z.ZodString>;
+    ISSUER_DN: z.ZodString;
+    JWT_JWKS_URL: z.ZodURL;
+    JWT_AUD: z.ZodOptional<z.ZodString>;
+    JWT_ISSUER: z.ZodString;
+    JWT_ALGORITHMS: z.ZodString;
+    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: z.ZodString;
+    CERTIFICATE_REQUEST_TIME_SKEW_MAX: z.ZodString;
+    LOG_LEVEL: z.ZodOptional<z.ZodEnum<{
+        debug: "debug";
+        error: "error";
+        info: "info";
+        none: "none";
+        warning: "warning";
+    }>>;
+}, z.core.$strip>;
+/**
+ * The CA's configuration as read from environment variables, see {@link EnvSchema}.
+ */
+export type CaEnv = z.infer<typeof EnvSchema>;
+/**
+ * Thrown by {@link bindingsFromEnv} when the environment is not a valid configuration.
+ */
+export declare class InvalidConfigurationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Build the CA's bindings from environment variables, for runtimes where
+ * configuration is not supplied as Workers bindings.
+ *
+ * The variables have the same names and formats as the Workers vars, and are
+ * validated before use so that misconfiguration is reported at start up.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * })
+ * ```
+ *
+ * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param source The environment variables to read, `process.env` by default
+ * @returns The bindings to pass to `createSshCa`
+ * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
+ */
+export declare const bindingsFromEnv: (bindings: {
+    DB: CaDatabase;
+    PRIVATE_KEY: CaSecret;
+}, source?: Record<string, string | undefined>) => SshCaBindings;
+//# sourceMappingURL=env.d.ts.map

package/dist/node/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAYtE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAA;CAAE,WAC3C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}

package/dist/node/env.js

@@ -0,0 +1,74 @@
+import { seconds } from "itty-time";
+import z from "zod";
+const required = z.string().trim().min(1, { message: "must be set" });
+// a duration in the format accepted by itty-time, such as "24 hours"
+const duration = (opts) => required.refine(v => {
+    const s = seconds(v);
+    return Number.isFinite(s) && (opts.allowZero ? s >= 0 : s > 0);
+}, { message: opts.allowZero ? "must be a duration such as \"90 seconds\"" : "must be a positive duration such as \"24 hours\"" });
+const boolean = z.enum(["true", "false"], { message: "must be \"true\" or \"false\"" });
+/**
+ * The environment variables read by {@link bindingsFromEnv}, which match the
+ * Workers vars documented for the CA.
+ */
+export const EnvSchema = z.object({
+    DB_CERTIFICATE_RETENTION: z.union([
+        z.literal("infinite"),
+        // an SQLite date modifier such as "1 year" or "90 days"
+        z.string().regex(/^[+-]?\d+(\.\d+)? (second|minute|hour|day|month|year)s?$/),
+    ], { message: "must be \"infinite\" or a period such as \"1 year\"" }),
+    SSH_CERTIFICATE_EXTENSIONS: z.string(),
+    SSH_CERTIFICATE_LIFETIME: duration({ allowZero: false }),
+    SSH_CERTIFICATE_INCLUDE_SELF: boolean.optional(),
+    SSH_CERTIFICATE_INCLUDE_SELF_EMAIL: boolean.optional(),
+    SSH_CERTIFICATE_PRINCIPALS: z.string().optional(),
+    SSH_HOST_CERTIFICATE_LIFETIME: duration({ allowZero: false }),
+    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: z.string().optional(),
+    SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.string().optional(),
+    ISSUER_DN: required,
+    JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
+    JWT_AUD: z.string().optional(),
+    JWT_ISSUER: required,
+    JWT_ALGORITHMS: required,
+    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
+    CERTIFICATE_REQUEST_TIME_SKEW_MAX: duration({ allowZero: true }),
+    LOG_LEVEL: z.enum(["none", "error", "warning", "info", "debug"]).optional(),
+});
+/**
+ * Thrown by {@link bindingsFromEnv} when the environment is not a valid configuration.
+ */
+export class InvalidConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InvalidConfigurationError";
+        Object.setPrototypeOf(this, InvalidConfigurationError.prototype);
+    }
+}
+/**
+ * Build the CA's bindings from environment variables, for runtimes where
+ * configuration is not supplied as Workers bindings.
+ *
+ * The variables have the same names and formats as the Workers vars, and are
+ * validated before use so that misconfiguration is reported at start up.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * })
+ * ```
+ *
+ * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param source The environment variables to read, `process.env` by default
+ * @returns The bindings to pass to `createSshCa`
+ * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
+ */
+export const bindingsFromEnv = (bindings, source = process.env) => {
+    const result = EnvSchema.safeParse(source);
+    if (!result.success) {
+        throw new InvalidConfigurationError(`invalid configuration:\n${z.prettifyError(result.error)}`);
+    }
+    return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY };
+};
+//# sourceMappingURL=env.js.map

package/dist/node/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAmD,EACnD,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;AAC9E,CAAC,CAAA"}

package/dist/node/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Helpers for running the CA on Node.js, imported from
+ * `@andrewheberle/serverless-ssh-ca/node`.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+ * import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const ca = createSshCa(bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * }))
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
+export type { CaEnv } from "./env.js";
+export { secretFromFile, secretFromString } from "./secret.js";
+export { fromNodeSqlite } from "./sqlite.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/node/index.js

@@ -0,0 +1,22 @@
+/**
+ * Helpers for running the CA on Node.js, imported from
+ * `@andrewheberle/serverless-ssh-ca/node`.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+ * import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const ca = createSshCa(bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * }))
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
+export { secretFromFile, secretFromString } from "./secret.js";
+export { fromNodeSqlite } from "./sqlite.js";
+//# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/node/secret.d.ts

@@ -0,0 +1,24 @@
+import type { CaSecret } from "../types.js";
+/**
+ * Use a string as the CA's private key secret.
+ *
+ * @example
+ * ```ts
+ * const PRIVATE_KEY = secretFromString(process.env.SSH_CA_PRIVATE_KEY ?? "")
+ * ```
+ *
+ * @param value The CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export declare const secretFromString: (value: string) => CaSecret;
+/**
+ * Use the contents of a file as the CA's private key secret.
+ *
+ * The file is read each time the key is needed, so replacing the file takes
+ * effect without a restart.
+ *
+ * @param path The path of a file containing the CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export declare const secretFromFile: (path: string) => CaSecret;
+//# sourceMappingURL=secret.d.ts.map

package/dist/node/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/node/secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,QAE/C,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,QAE5C,CAAA"}

package/dist/node/secret.js

@@ -0,0 +1,28 @@
+import { readFile } from "node:fs/promises";
+/**
+ * Use a string as the CA's private key secret.
+ *
+ * @example
+ * ```ts
+ * const PRIVATE_KEY = secretFromString(process.env.SSH_CA_PRIVATE_KEY ?? "")
+ * ```
+ *
+ * @param value The CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export const secretFromString = (value) => ({
+    get: async () => value,
+});
+/**
+ * Use the contents of a file as the CA's private key secret.
+ *
+ * The file is read each time the key is needed, so replacing the file takes
+ * effect without a restart.
+ *
+ * @param path The path of a file containing the CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export const secretFromFile = (path) => ({
+    get: async () => await readFile(path, { encoding: "utf-8" }),
+});
+//# sourceMappingURL=secret.js.map

package/dist/node/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/node/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAG3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,CAAC;IAC7D,GAAG,EAAE,KAAK,IAAqB,EAAE,CAAC,KAAK;CACvC,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC;IAC1D,GAAG,EAAE,KAAK,IAAqB,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;CAC7E,CAAC,CAAA"}

package/dist/node/sqlite.d.ts

@@ -0,0 +1,47 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { CaDatabase } from "../types.js";
+/**
+ * A single SQL statement split from a larger query by {@link splitStatements}.
+ */
+export type SqlStatement = {
+    /** The SQL of the statement, without its trailing `;` */
+    sql: string;
+    /** The number of anonymous (`?`) parameters in the statement */
+    parameters: number;
+    /** Whether the statement uses numbered or named parameters (`?1`, `:name`, `@name` or `$name`) */
+    named: boolean;
+};
+/**
+ * Split SQL that may contain several statements into individual statements.
+ *
+ * `node:sqlite` only compiles the first statement passed to `prepare()`,
+ * whereas Cloudflare D1 runs them all, so queries are split here first. Quoted
+ * strings and identifiers, comments and `CREATE TRIGGER ... BEGIN ... END`
+ * bodies are not split. Statements containing nothing but whitespace or
+ * comments are dropped.
+ *
+ * @param sql The SQL to split
+ * @returns The statements found in `sql`, see {@link SqlStatement}
+ */
+export declare const splitStatements: (sql: string) => SqlStatement[];
+/**
+ * Use a Node.js `node:sqlite` database as the CA's database.
+ *
+ * The returned object behaves like a Cloudflare D1 binding: queries containing
+ * several statements are run in full (see {@link splitStatements}) and
+ * {@link CaDatabase.batch} is atomic. The database's schema is created and
+ * migrated automatically when the CA first uses it.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { fromNodeSqlite } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const DB = fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite"))
+ * ```
+ *
+ * @param db An open `node:sqlite` database
+ * @returns A database for the `DB` binding, see {@link CaDatabase}
+ */
+export declare const fromNodeSqlite: (db: DatabaseSync) => CaDatabase;
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/node/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/node/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAgE,MAAM,aAAa,CAAA;AAE3G;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAA;IACX,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,kGAAkG;IAClG,KAAK,EAAE,OAAO,CAAA;CACd,CAAA;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,YAAY,EA6HzD,CAAA;AA6HD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,OAAQ,YAAY,KAAG,UAgBhD,CAAA"}