@andrewheberle/serverless-ssh-ca 0.19.1 → 0.20.0

package/dist/node/sqlite.js

@@ -0,0 +1,273 @@
+const isWordChar = (ch) => ch !== undefined && /[A-Za-z0-9_$]/.test(ch);
+/**
+ * Split SQL that may contain several statements into individual statements.
+ *
+ * `node:sqlite` only compiles the first statement passed to `prepare()`,
+ * whereas Cloudflare D1 runs them all, so queries are split here first. Quoted
+ * strings and identifiers, comments and `CREATE TRIGGER ... BEGIN ... END`
+ * bodies are not split. Statements containing nothing but whitespace or
+ * comments are dropped.
+ *
+ * @param sql The SQL to split
+ * @returns The statements found in `sql`, see {@link SqlStatement}
+ */
+export const splitStatements = (sql) => {
+    const statements = [];
+    let start = 0;
+    let parameters = 0;
+    let named = false;
+    let hasTokens = false;
+    let words = [];
+    let depth = 0;
+    const push = (end) => {
+        if (hasTokens) {
+            statements.push({ sql: sql.slice(start, end).trim(), parameters, named });
+        }
+        start = end + 1;
+        parameters = 0;
+        named = false;
+        hasTokens = false;
+        words = [];
+        depth = 0;
+    };
+    // true if the current statement is CREATE [TEMP|TEMPORARY] TRIGGER, whose body may contain ";"
+    const inTrigger = () => words[0] === "CREATE" && (words[1] === "TRIGGER" || words[2] === "TRIGGER");
+    let i = 0;
+    while (i < sql.length) {
+        const ch = sql[i];
+        const next = sql[i + 1];
+        // comments
+        if (ch === "-" && next === "-") {
+            const end = sql.indexOf("\n", i);
+            i = end === -1 ? sql.length : end + 1;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            const end = sql.indexOf("*/", i + 2);
+            i = end === -1 ? sql.length : end + 2;
+            continue;
+        }
+        // whitespace
+        if (ch === undefined || /\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        // end of statement
+        if (ch === ";" && depth === 0) {
+            push(i);
+            i++;
+            continue;
+        }
+        hasTokens = true;
+        // quoted strings and identifiers, where a doubled quote is an escaped quote
+        if (ch === "'" || ch === "\"" || ch === "`" || ch === "[") {
+            const close = ch === "[" ? "]" : ch;
+            let j = i + 1;
+            while (j < sql.length) {
+                if (sql[j] === close) {
+                    if (close !== "]" && sql[j + 1] === close) {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            i = j + 1;
+            continue;
+        }
+        // parameters
+        if (ch === "?") {
+            let j = i + 1;
+            while (j < sql.length && /[0-9]/.test(sql[j] ?? "")) {
+                j++;
+            }
+            if (j === i + 1) {
+                parameters++;
+            }
+            else {
+                named = true;
+            }
+            i = j;
+            continue;
+        }
+        if ((ch === ":" || ch === "@" || ch === "$") && isWordChar(next)) {
+            named = true;
+            i++;
+            while (isWordChar(sql[i])) {
+                i++;
+            }
+            continue;
+        }
+        // keywords and identifiers
+        if (isWordChar(ch)) {
+            let j = i;
+            while (isWordChar(sql[j])) {
+                j++;
+            }
+            const word = sql.slice(i, j).toUpperCase();
+            if (words.length < 3) {
+                words.push(word);
+            }
+            if (inTrigger()) {
+                if (word === "BEGIN" || word === "CASE") {
+                    depth++;
+                }
+                else if (word === "END" && depth > 0) {
+                    depth--;
+                }
+            }
+            i = j;
+            continue;
+        }
+        i++;
+    }
+    push(sql.length);
+    return statements;
+};
+/**
+ * Convert a value bound to a statement into one `node:sqlite` accepts, using
+ * the same conversions as Cloudflare D1.
+ */
+const toSqlValue = (value) => {
+    if (value === null || typeof value === "number" || typeof value === "bigint" || typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "boolean") {
+        return value ? 1 : 0;
+    }
+    if (value instanceof ArrayBuffer) {
+        return new Uint8Array(value);
+    }
+    if (ArrayBuffer.isView(value)) {
+        return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    }
+    throw new TypeError(`unsupported type for SQL parameter: ${value === undefined ? "undefined" : typeof value}`);
+};
+const toNumber = (value) => {
+    if (typeof value === "number") {
+        return value;
+    }
+    if (typeof value === "bigint") {
+        return Number(value);
+    }
+    throw new TypeError(`expected a number from SQLite but got ${typeof value}`);
+};
+// counters used to report D1 style metadata for any statement
+const counters = (db) => {
+    const row = db.prepare("SELECT total_changes() AS changes, last_insert_rowid() AS last_row_id").get();
+    return { changes: toNumber(row?.changes), lastRowId: toNumber(row?.last_row_id) };
+};
+let savepointId = 0;
+// run fn atomically, using a savepoint so it also works inside an existing transaction
+const atomically = (db, fn) => {
+    const name = `serverless_ssh_ca_${savepointId++}`;
+    db.exec(`SAVEPOINT ${name}`);
+    try {
+        const result = fn();
+        db.exec(`RELEASE ${name}`);
+        return result;
+    }
+    catch (err) {
+        db.exec(`ROLLBACK TO ${name}`);
+        db.exec(`RELEASE ${name}`);
+        throw err;
+    }
+};
+class NodeSqliteStatement {
+    db;
+    sql;
+    values;
+    constructor(db, sql, values = []) {
+        this.db = db;
+        this.sql = sql;
+        this.values = values;
+    }
+    bind(...values) {
+        return new NodeSqliteStatement(this.db, this.sql, values.map(toSqlValue));
+    }
+    async all() {
+        return this.execute();
+    }
+    async run() {
+        const { success, meta } = this.execute();
+        return { success, meta };
+    }
+    // executes synchronously so no other query can run part way through
+    execute() {
+        const started = performance.now();
+        const before = counters(this.db);
+        const results = this.query();
+        const after = counters(this.db);
+        return {
+            success: true,
+            results,
+            meta: {
+                changes: after.changes - before.changes,
+                last_row_id: after.lastRowId,
+                duration: performance.now() - started,
+            },
+        };
+    }
+    query() {
+        const statements = splitStatements(this.sql);
+        if (statements.length <= 1) {
+            return this.db.prepare(this.sql).all(...this.values);
+        }
+        if (statements.some(s => s.named)) {
+            throw new Error("queries containing more than one statement only support anonymous (?) parameters");
+        }
+        const expected = statements.reduce((total, s) => total + s.parameters, 0);
+        if (expected !== this.values.length) {
+            throw new RangeError(`query expects ${expected} parameters but ${this.values.length} were bound`);
+        }
+        // give each statement its share of the bound values, returning the rows of the last statement
+        return atomically(this.db, () => {
+            let offset = 0;
+            let results = [];
+            for (const statement of statements) {
+                const values = this.values.slice(offset, offset + statement.parameters);
+                offset += statement.parameters;
+                results = this.db.prepare(statement.sql).all(...values);
+            }
+            return results;
+        });
+    }
+}
+/**
+ * Use a Node.js `node:sqlite` database as the CA's database.
+ *
+ * The returned object behaves like a Cloudflare D1 binding: queries containing
+ * several statements are run in full (see {@link splitStatements}) and
+ * {@link CaDatabase.batch} is atomic. The database's schema is created and
+ * migrated automatically when the CA first uses it.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { fromNodeSqlite } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const DB = fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite"))
+ * ```
+ *
+ * @param db An open `node:sqlite` database
+ * @returns A database for the `DB` binding, see {@link CaDatabase}
+ */
+export const fromNodeSqlite = (db) => ({
+    prepare: (query) => new NodeSqliteStatement(db, query),
+    batch: async (statements) => {
+        const owned = statements.map(s => {
+            if (!(s instanceof NodeSqliteStatement) || s.db !== db) {
+                throw new TypeError("batch statements must be prepared by the same database");
+            }
+            return s;
+        });
+        return atomically(db, () => owned.map(s => s.execute()));
+    },
+    exec: async (query) => {
+        const started = performance.now();
+        db.exec(query);
+        return { count: splitStatements(query).length, duration: performance.now() - started };
+    },
+});
+//# sourceMappingURL=sqlite.js.map

package/dist/node/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../src/node/sqlite.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,GAAG,CAAC,EAAsB,EAAW,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpG;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAkB,EAAE;IAC9D,MAAM,UAAU,GAAmB,EAAE,CAAA;IAErC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,KAAK,GAAa,EAAE,CAAA;IACxB,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,SAAS,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,KAAK,GAAG,GAAG,GAAG,CAAC,CAAA;QACf,UAAU,GAAG,CAAC,CAAA;QACd,KAAK,GAAG,KAAK,CAAA;QACb,SAAS,GAAG,KAAK,CAAA;QACjB,KAAK,GAAG,EAAE,CAAA;QACV,KAAK,GAAG,CAAC,CAAA;IACV,CAAC,CAAA;IAED,+FAA+F;IAC/F,MAAM,SAAS,GAAG,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAE5G,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAEvB,WAAW;QACX,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAChC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;YACrC,SAAQ;QACT,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACpC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;YACrC,SAAQ;QACT,CAAC;QAED,aAAa;QACb,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,CAAC,EAAE,CAAA;YACH,SAAQ;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,CAAA;YACP,CAAC,EAAE,CAAA;YACH,SAAQ;QACT,CAAC;QAED,SAAS,GAAG,IAAI,CAAA;QAEhB,4EAA4E;QAC5E,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACtB,IAAI,KAAK,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;wBAC3C,CAAC,IAAI,CAAC,CAAA;wBACN,SAAQ;oBACT,CAAC;oBACD,MAAK;gBACN,CAAC;gBACD,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACT,SAAQ;QACT,CAAC;QAED,aAAa;QACb,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrD,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,UAAU,EAAE,CAAA;YACb,CAAC;iBAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAA;YACb,CAAC;YACD,CAAC,GAAG,CAAC,CAAA;YACL,SAAQ;QACT,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,KAAK,GAAG,IAAI,CAAA;YACZ,CAAC,EAAE,CAAA;YACH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,SAAQ;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,CAAC;YACD,IAAI,SAAS,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzC,KAAK,EAAE,CAAA;gBACR,CAAC;qBAAM,IAAI,IAAI,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACxC,KAAK,EAAE,CAAA;gBACR,CAAC;YACF,CAAC;YACD,CAAC,GAAG,CAAC,CAAA;YACL,SAAQ;QACT,CAAC;QAED,CAAC,EAAE,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAEhB,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAiB,EAAE;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,uCAAuC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;AAC/G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,yCAAyC,OAAO,KAAK,EAAE,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,CAAC,EAAgB,EAA0C,EAAE;IAC7E,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,EAAE,CAAA;IACrG,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAA;AAClF,CAAC,CAAA;AAED,IAAI,WAAW,GAAG,CAAC,CAAA;AAEnB,uFAAuF;AACvF,MAAM,UAAU,GAAG,CAAI,EAAgB,EAAE,EAAW,EAAK,EAAE;IAC1D,MAAM,IAAI,GAAG,qBAAqB,WAAW,EAAE,EAAE,CAAA;IACjD,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,EAAE,EAAE,CAAA;QACnB,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC1B,OAAO,MAAM,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAA;QAC9B,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC1B,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA;AAED,MAAM,mBAAmB;IACf,EAAE,CAAc;IACR,GAAG,CAAQ;IACX,MAAM,CAA0B;IAEjD,YAAY,EAAgB,EAAE,GAAW,EAAE,MAAM,GAA6B,EAAE;QAC/E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACrB,CAAC;IAED,IAAI,CAAC,GAAG,MAAiB;QACxB,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,KAAK,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,GAAG;QACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,oEAAoE;IACpE,OAAO;QACN,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAE/B,OAAO;YACN,OAAO,EAAE,IAAI;YACb,OAAO;YACP,IAAI,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBACvC,WAAW,EAAE,KAAK,CAAC,SAAS;gBAC5B,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;aACrC;SACD,CAAA;IACF,CAAC;IAEO,KAAK;QACZ,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QACzE,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,iBAAiB,QAAQ,mBAAmB,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAA;QAClG,CAAC;QAED,8FAA8F;QAC9F,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,IAAI,OAAO,GAAc,EAAE,CAAA;YAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;gBACvE,MAAM,IAAI,SAAS,CAAC,UAAU,CAAA;gBAC9B,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;YACxD,CAAC;YACD,OAAO,OAAO,CAAA;QACf,CAAC,CAAC,CAAA;IACH,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAgB,EAAc,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,CAAC,KAAa,EAAuB,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC;IACnF,KAAK,EAAE,KAAK,EAAE,UAAiC,EAAoC,EAAE;QACpF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAChC,IAAI,CAAC,CAAC,CAAC,YAAY,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxD,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAA;YAC9E,CAAC;YACD,OAAO,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,OAAO,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,KAAa,EAAgD,EAAE;QAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;IACvF,CAAC;CACD,CAAC,CAAA"}

package/dist/types.d.ts

@@ -19,15 +19,58 @@ export type SSHExtension = {
     name: string;
     data: Buffer<ArrayBuffer>;
 };
+/**
+ * The result of executing a statement via {@link CaPreparedStatement.run} or
+ * {@link CaDatabase.batch}, modelled on a Cloudflare D1 result.
+ */
+export interface CaDatabaseResult {
+    /** Whether the statement executed successfully */
+    success: boolean;
+    meta?: {
+        /** The number of rows changed by the statement */
+        changes?: number;
+        /** The rowid of the last row inserted */
+        last_row_id?: number;
+        /** How long the statement took to execute in milliseconds */
+        duration?: number;
+    };
+}
+/**
+ * The result of executing a statement that returns rows via
+ * {@link CaPreparedStatement.all}.
+ */
+export interface CaDatabaseQueryResult extends CaDatabaseResult {
+    /** The rows returned, one object per row keyed by column name */
+    results: unknown[];
+}
+/**
+ * The subset of a Cloudflare D1 prepared statement used by the CA.
+ */
+export interface CaPreparedStatement {
+    /** Bind positional (`?`) parameters, returning a statement to execute */
+    bind(...values: unknown[]): CaPreparedStatement;
+    /** Execute the statement and return all rows */
+    all(): Promise<CaDatabaseQueryResult>;
+    /** Execute the statement without returning rows */
+    run(): Promise<CaDatabaseResult>;
+}
 /**
  * The subset of a Cloudflare D1 database binding used by the CA.
  *
  * A Workers `D1Database` binding satisfies this structurally, so the package
- * does not need to depend on `@cloudflare/workers-types`.
+ * does not need to depend on `@cloudflare/workers-types`. Any other SQLite
+ * compatible database may be used by implementing this interface.
+ *
+ * The SQL the CA runs is SQLite dialect, and statements passed to
+ * {@link CaDatabase.prepare} may contain more than one SQL statement (as used
+ * when applying schema migrations).
  */
 export interface CaDatabase {
-    prepare(query: string): unknown;
-    batch(statements: never[]): Promise<unknown>;
+    /** Prepare a SQL query for execution, see {@link CaPreparedStatement} */
+    prepare(query: string): CaPreparedStatement;
+    /** Execute several prepared statements atomically, returning a result for each */
+    batch(statements: CaPreparedStatement[]): Promise<CaDatabaseResult[]>;
+    /** Execute one or more SQL statements without parameters */
     exec(query: string): Promise<unknown>;
 }
 /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACvB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@andrewheberle/serverless-ssh-ca",
-	"version": "0.19.1",
-	"description": "A serverless SSH CA built on Cloudflare Workers",
+	"version": "0.20.0",
+	"description": "A serverless SSH CA built for Cloudflare Workers that can also run on Node.js",
 	"type": "module",
 	"types": "./dist/index.d.ts",
 	"files": [
@@ -14,6 +14,10 @@
 			"types": "./dist/index.d.ts",
 			"default": "./dist/index.js"
 		},
+		"./node": {
+			"types": "./dist/node/index.d.ts",
+			"default": "./dist/node/index.js"
+		},
 		"./openapi.json": "./openapi.json"
 	},
 	"scripts": {

package/src/index.ts

@@ -2,7 +2,7 @@ import type { ExecutionContext } from "hono"
 import { dbCleanup } from "./db/index.js"
 import { createApp } from "./router.js"
 import type { SshCaBindings } from "./types.js"
-export type { CaDatabase, CaSecret, SshCaBindings } from "./types.js"
+export type { CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaSecret, SshCaBindings } from "./types.js"
 
 // the handlers the CA exposes, compatible with a Cloudflare Workers ExportedHandler
 type SshCaHandler = {
@@ -10,6 +10,42 @@ type SshCaHandler = {
     scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>
 }
 
+/**
+ * A runtime neutral instance of the CA, returned by {@link createSshCa}.
+ */
+export interface SshCa {
+    /**
+     * Handle a request to the CA's API, suitable for any server that speaks
+     * the Fetch API `Request` and `Response` types.
+     */
+    fetch(req: Request): Promise<Response>
+    /**
+     * Remove expired certificates from the database according to
+     * `DB_CERTIFICATE_RETENTION`. This should be run periodically (for example
+     * once a day), as the `scheduled` handler does on Cloudflare Workers.
+     */
+    cleanup(): Promise<void>
+}
+
+/**
+ * Create an instance of the CA bound to a fixed set of bindings, for use on
+ * runtimes other than Cloudflare Workers.
+ *
+ * On Workers use the default export instead, which receives its bindings from
+ * the runtime on each request.
+ *
+ * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @returns The CA's request handler and database cleanup task, see {@link SshCa}
+ */
+export const createSshCa = (env: SshCaBindings): SshCa => {
+    const app = createApp(env)
+
+    return {
+        fetch: async (req: Request): Promise<Response> => await app.fetch(req, env),
+        cleanup: async (): Promise<void> => await dbCleanup(env),
+    }
+}
+
 let app: ReturnType<typeof createApp> | undefined
 
 export default {

package/src/node/env.ts

@@ -0,0 +1,90 @@
+import { seconds } from "itty-time"
+import z from "zod"
+import type { CaDatabase, CaSecret, SshCaBindings } from "../types.js"
+
+const required = z.string().trim().min(1, { message: "must be set" })
+
+// a duration in the format accepted by itty-time, such as "24 hours"
+const duration = (opts: { allowZero: boolean }) => required.refine(v => {
+	const s = seconds(v)
+	return Number.isFinite(s) && (opts.allowZero ? s >= 0 : s > 0)
+}, { message: opts.allowZero ? "must be a duration such as \"90 seconds\"" : "must be a positive duration such as \"24 hours\"" })
+
+const boolean = z.enum(["true", "false"], { message: "must be \"true\" or \"false\"" })
+
+/**
+ * The environment variables read by {@link bindingsFromEnv}, which match the
+ * Workers vars documented for the CA.
+ */
+export const EnvSchema = z.object({
+	DB_CERTIFICATE_RETENTION: z.union([
+		z.literal("infinite"),
+		// an SQLite date modifier such as "1 year" or "90 days"
+		z.string().regex(/^[+-]?\d+(\.\d+)? (second|minute|hour|day|month|year)s?$/),
+	], { message: "must be \"infinite\" or a period such as \"1 year\"" }),
+	SSH_CERTIFICATE_EXTENSIONS: z.string(),
+	SSH_CERTIFICATE_LIFETIME: duration({ allowZero: false }),
+	SSH_CERTIFICATE_INCLUDE_SELF: boolean.optional(),
+	SSH_CERTIFICATE_INCLUDE_SELF_EMAIL: boolean.optional(),
+	SSH_CERTIFICATE_PRINCIPALS: z.string().optional(),
+	SSH_HOST_CERTIFICATE_LIFETIME: duration({ allowZero: false }),
+	SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: z.string().optional(),
+	SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.string().optional(),
+	ISSUER_DN: required,
+	JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
+	JWT_AUD: z.string().optional(),
+	JWT_ISSUER: required,
+	JWT_ALGORITHMS: required,
+	JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
+	CERTIFICATE_REQUEST_TIME_SKEW_MAX: duration({ allowZero: true }),
+	LOG_LEVEL: z.enum(["none", "error", "warning", "info", "debug"]).optional(),
+})
+
+/**
+ * The CA's configuration as read from environment variables, see {@link EnvSchema}.
+ */
+export type CaEnv = z.infer<typeof EnvSchema>
+
+/**
+ * Thrown by {@link bindingsFromEnv} when the environment is not a valid configuration.
+ */
+export class InvalidConfigurationError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "InvalidConfigurationError"
+
+		Object.setPrototypeOf(this, InvalidConfigurationError.prototype)
+	}
+}
+
+/**
+ * Build the CA's bindings from environment variables, for runtimes where
+ * configuration is not supplied as Workers bindings.
+ *
+ * The variables have the same names and formats as the Workers vars, and are
+ * validated before use so that misconfiguration is reported at start up.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * })
+ * ```
+ *
+ * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param source The environment variables to read, `process.env` by default
+ * @returns The bindings to pass to `createSshCa`
+ * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
+ */
+export const bindingsFromEnv = (
+	bindings: { DB: CaDatabase, PRIVATE_KEY: CaSecret },
+	source: Record<string, string | undefined> = process.env,
+): SshCaBindings => {
+	const result = EnvSchema.safeParse(source)
+	if (!result.success) {
+		throw new InvalidConfigurationError(`invalid configuration:\n${z.prettifyError(result.error)}`)
+	}
+
+	return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY }
+}

package/src/node/index.ts

@@ -0,0 +1,22 @@
+/**
+ * Helpers for running the CA on Node.js, imported from
+ * `@andrewheberle/serverless-ssh-ca/node`.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+ * import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const ca = createSshCa(bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * }))
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js"
+export type { CaEnv } from "./env.js"
+export { secretFromFile, secretFromString } from "./secret.js"
+export { fromNodeSqlite } from "./sqlite.js"

package/src/node/secret.ts

@@ -0,0 +1,30 @@
+import { readFile } from "node:fs/promises"
+import type { CaSecret } from "../types.js"
+
+/**
+ * Use a string as the CA's private key secret.
+ *
+ * @example
+ * ```ts
+ * const PRIVATE_KEY = secretFromString(process.env.SSH_CA_PRIVATE_KEY ?? "")
+ * ```
+ *
+ * @param value The CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export const secretFromString = (value: string): CaSecret => ({
+	get: async (): Promise<string> => value,
+})
+
+/**
+ * Use the contents of a file as the CA's private key secret.
+ *
+ * The file is read each time the key is needed, so replacing the file takes
+ * effect without a restart.
+ *
+ * @param path The path of a file containing the CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export const secretFromFile = (path: string): CaSecret => ({
+	get: async (): Promise<string> => await readFile(path, { encoding: "utf-8" }),
+})