@andrewheberle/serverless-ssh-ca 0.19.1 → 0.20.1

package/README.md

@@ -15,8 +15,9 @@ import app from "@andrewheberle/serverless-ssh-ca"
 export default app
 ```
 
-This package is built for Cloudflare Workers, and Workers is the only runtime
-it is tested on. There are no plans to support other runtimes at this time.
+This package is built for Cloudflare Workers and can also run on Node.js 24
+(see [Running on Node.js](#running-on-nodejs)). These are the only runtimes it
+is tested on.
 
 The package doesn't use any Workers-specific APIs and doesn't depend on
 `@cloudflare/workers-types`. It needs:
@@ -30,6 +31,62 @@ Its exported types describe only these needs, so the `Env` generated by
 `wrangler types` (with `DB` as a `D1Database` and `PRIVATE_KEY` as a
 `SecretsStoreSecret`) can be passed directly as `SshCaBindings`.
 
+### Running on Node.js
+
+Node.js 24 or later is required. Helpers for Node.js are imported from
+`@andrewheberle/serverless-ssh-ca/node`:
+
+| Helper | Purpose |
+|---|---|
+| `fromNodeSqlite(db)` | Uses a built-in `node:sqlite` database as the `DB` binding |
+| `secretFromFile(path)` | Reads the CA private key from a file (re-read each time it is needed) |
+| `secretFromString(value)` | Uses a string as the CA private key |
+| `bindingsFromEnv({ DB, PRIVATE_KEY })` | Reads and validates the remaining configuration from `process.env` |
+
+`createSshCa(bindings)` returns a `fetch(request)` handler that takes a
+standard `Request` and returns a `Response`, and a `cleanup()` task that
+replaces the Workers cron trigger.
+
+The handler can be served by any server that works with `Request` and
+`Response`. For example, with [`@hono/node-server`](https://www.npmjs.com/package/@hono/node-server)
+(installed separately with `npm install @hono/node-server`):
+
+```ts
+import { DatabaseSync } from "node:sqlite"
+import { serve } from "@hono/node-server"
+import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+
+const ca = createSshCa(bindingsFromEnv({
+    DB: fromNodeSqlite(new DatabaseSync("/var/lib/ssh-ca/ssh-ca.sqlite")),
+    PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+}))
+
+// remove expired certificates once a day
+setInterval(() => void ca.cleanup(), 24 * 60 * 60 * 1000)
+
+serve({ fetch: (req) => ca.fetch(req), port: 8787 })
+```
+
+Notes:
+
+- The configuration environment variables have the same names and formats
+  as the `vars` in the Workers [`wrangler.jsonc`](https://github.com/andrewheberle/serverless-ssh-ca/blob/main/packages/workers-integration/wrangler.jsonc).
+  `bindingsFromEnv` validates them at start up and throws an
+  `InvalidConfigurationError` that lists every missing or invalid variable.
+- The database schema is created and migrated automatically on first use, as
+  on Workers. Use a file path for `DatabaseSync` (not `:memory:`) so issued
+  and revoked certificates survive restarts.
+- Only SQLite databases are supported. Other SQLite-compatible databases can
+  be used by implementing the `CaDatabase` interface.
+- The CA private key has the same requirements as on Workers (see
+  [CA Private Key](#ca-private-key)). Keep the key file readable only by the
+  user running the CA.
+- `cleanup()` can also be run on a schedule outside the process (for example
+  from a systemd timer or cron job) instead of using `setInterval`.
+- Put the CA behind a reverse proxy that terminates TLS, as clients send
+  identity tokens to it.
+
 See the following respositories for additional information:
 
 
@@ -193,7 +250,7 @@ must be an Ed25519 or ECDSA (`nistp256`, `nistp384` or `nistp521`) key:
 ssh-keygen -t ed25519 -N "" -C "" -f ssh-ca
 ```
 
-RSA CA keys are not supported on the Workers runtime. With an RSA CA key
+RSA CA keys are not supported. With an RSA CA key
 configured, every request that uses the CA key (including `/api/v3/ca` and
 the KRL endpoints) returns a `500` error, and the reason is logged:
 

package/dist/db/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,OAAO,CAAA;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,oBAAY,eAAe;IAC1B,IAAI,IAAA;IACJ,IAAI,IAAA;CACJ;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,IAAI,CAAA;IACjB,YAAY,EAAE,IAAI,CAAA;IAClB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,iBAAiB,CAAA;CAC/B,CAAA;AAqBD,eAAO,MAAM,SAAS,QAAe,aAAa,kBAsBjD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,eAAe,WAAW,SAAS,MAAM,oBAAmB,eAAe,kBA2BpI,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAYnF,CAAA;AAED,oBAAY,gBAAgB;IAC3B,QAAQ,IAAA;IACR,OAAO,IAAA;IACP,SAAS,IAAA;IACT,WAAW,IAAA;CACX;AAED,eAAO,MAAM,gBAAgB,QAAe,aAAa,UAAU,MAAM,aAAa,MAAM,mBAAmB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAwBxJ,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,EAAE,CAoB9G,CAAA;AAED,KAAK,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAE/D,eAAO,MAAM,iBAAiB,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAuBxG,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,OAAO,CAAA;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,oBAAY,eAAe;IAC1B,IAAI,IAAA;IACJ,IAAI,IAAA;CACJ;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,IAAI,CAAA;IACjB,YAAY,EAAE,IAAI,CAAA;IAClB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,eAAe,CAAA;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,iBAAiB,CAAA;CAC/B,CAAA;AAmBD,eAAO,MAAM,SAAS,QAAe,aAAa,kBAsBjD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,eAAe,WAAW,SAAS,MAAM,oBAAmB,eAAe,kBA2BpI,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAYnF,CAAA;AAED,oBAAY,gBAAgB;IAC3B,QAAQ,IAAA;IACR,OAAO,IAAA;IACP,SAAS,IAAA;IACT,WAAW,IAAA;CACX;AAED,eAAO,MAAM,gBAAgB,QAAe,aAAa,UAAU,MAAM,aAAa,MAAM,mBAAmB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAwBxJ,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,EAAE,CAoB9G,CAAA;AAED,KAAK,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAE/D,eAAO,MAAM,iBAAiB,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAuBxG,CAAA"}

package/dist/db/index.js

@@ -1,5 +1,6 @@
 import { logger } from "../logger.js";
 import { D1QB } from "workers-qb";
+import { migrateOnce } from "./migrate.js";
 import { migrations } from "./migrations/index.js";
 export var CertificateType;
 (function (CertificateType) {
@@ -10,11 +11,9 @@ const connect = async (env) => {
     const l = logger(env);
     try {
         l.debug("connecting to database");
-        const qb = new D1QB(env.DB);
-        const migrationBuilder = qb.migrations({ migrations });
-        const appliedMigrations = await migrationBuilder.apply();
+        const appliedMigrations = await migrateOnce(env.DB, migrations);
         l.debug("applied database migrations", "migrations", appliedMigrations.length, "migration_names", appliedMigrations.map(m => m.name));
-        return qb;
+        return new D1QB(env.DB);
     }
     catch (err) {
         l.error("error connecting to database", "error", err);

package/dist/db/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAElD,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IAC1B,qDAAI,CAAA;IACJ,qDAAI,CAAA;AACL,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAmBD,MAAM,OAAO,GAAG,KAAK,EAAE,GAAkB,EAAiC,EAAE;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAEjC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAiB,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QACtD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAA;QAExD,CAAC,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,EAAE,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAErI,OAAO,EAAE,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACrD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAErE,IAAI,GAAG,CAAC,wBAAwB,KAAK,UAAU,EAAE,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACnC,OAAM;IACP,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE;gBACN,UAAU,EAAE,0DAA0D;gBACtE,MAAM,EAAE,GAAG,CAAC,wBAAwB;aACpC;SACD,CAAC,CAAC,OAAO,EAAE,CAAA;QACZ,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,+BAA+B,EAAE,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,WAAwB,EAAE,KAAa,EAAE,eAAe,GAAoB,eAAe,CAAC,IAAI,EAAE,EAAE;IAC/J,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAU,EAAE;QACjE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;IACpB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAuD,EAAU,EAAE;QACtH,iDAAiD;QACjD,OAAO,CAAC,CAAC,IAAc,CAAA;IACxB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,MAAM,EAAE,GAAG,MAAM,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE;YAChD,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE;YAClD,gBAAgB,EAAE,eAAe;YACjC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SAClD;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAoB,EAAE;IACvF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAA;AACjC,CAAC,CAAA;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC3B,+DAAQ,CAAA;IACR,6DAAO,CAAA;IACP,iEAAS,CAAA;IACT,qEAAW,CAAA;AACZ,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAE,SAAiB,EAAE,eAAgC,EAA6B,EAAE;IAC5J,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACpC,KAAK,EAAE;YACN,UAAU,EAAE,wDAAwD;YACpE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;SACjD;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,QAAQ,CAAA;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC,OAAO,CAAA;IAChC,CAAC;IAED,IAAI,SAAS,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,gBAAgB,CAAC,SAAS,CAAA;IAClC,CAAC;IAED,OAAO,gBAAgB,CAAC,WAAW,CAAA;AACpC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,eAAgC,EAAqB,EAAE;IAClH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mHAAmH;YAC/H,MAAM,EAAE,eAAe;SACvB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC,CAAA;AAID,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAiC,EAAE;IAC5G,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAqB;QAC/C,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;SACpC;QACD,KAAK,EAAE;YACN,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;QACD,SAAS,EAAE,CAAC,YAAY,CAAC;KACzB,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAA;AACnB,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAElD,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IAC1B,qDAAI,CAAA;IACJ,qDAAI,CAAA;AACL,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAmBD,MAAM,OAAO,GAAG,KAAK,EAAE,GAAkB,EAAiC,EAAE;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAEjC,MAAM,iBAAiB,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAE/D,CAAC,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,EAAE,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAErI,OAAO,IAAI,IAAI,CAAiB,GAAG,CAAC,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACrD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAErE,IAAI,GAAG,CAAC,wBAAwB,KAAK,UAAU,EAAE,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACnC,OAAM;IACP,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE;gBACN,UAAU,EAAE,0DAA0D;gBACtE,MAAM,EAAE,GAAG,CAAC,wBAAwB;aACpC;SACD,CAAC,CAAC,OAAO,EAAE,CAAA;QACZ,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,+BAA+B,EAAE,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,WAAwB,EAAE,KAAa,EAAE,eAAe,GAAoB,eAAe,CAAC,IAAI,EAAE,EAAE;IAC/J,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAU,EAAE;QACjE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;IACpB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAuD,EAAU,EAAE;QACtH,iDAAiD;QACjD,OAAO,CAAC,CAAC,IAAc,CAAA;IACxB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,MAAM,EAAE,GAAG,MAAM,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE;YAChD,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE;YAClD,gBAAgB,EAAE,eAAe;YACjC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SAClD;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAoB,EAAE;IACvF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAA;AACjC,CAAC,CAAA;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC3B,+DAAQ,CAAA;IACR,6DAAO,CAAA;IACP,iEAAS,CAAA;IACT,qEAAW,CAAA;AACZ,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAE,SAAiB,EAAE,eAAgC,EAA6B,EAAE;IAC5J,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;QACpC,KAAK,EAAE;YACN,UAAU,EAAE,wDAAwD;YACpE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;SACjD;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,QAAQ,CAAA;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC,OAAO,CAAA;IAChC,CAAC;IAED,IAAI,SAAS,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,gBAAgB,CAAC,SAAS,CAAA;IAClC,CAAC;IAED,OAAO,gBAAgB,CAAC,WAAW,CAAA;AACpC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,eAAgC,EAAqB,EAAE;IAClH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;QAC7B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,KAAK,EAAE;YACN,UAAU,EAAE,mHAAmH;YAC/H,MAAM,EAAE,eAAe;SACvB;KACD,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC,CAAA;AAID,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAkB,EAAE,MAAc,EAAiC,EAAE;IAC5G,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAqB;QAC/C,SAAS,EAAE,cAAc;QACzB,IAAI,EAAE;YACL,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;SACpC;QACD,KAAK,EAAE;YACN,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,GAAG,MAAM,EAAE;SACnB;QACD,SAAS,EAAE,CAAC,YAAY,CAAC;KACzB,CAAC,CAAC,OAAO,EAAE,CAAA;IAEZ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACV,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAA;AACnB,CAAC,CAAA"}

package/dist/db/migrate.d.ts

@@ -0,0 +1,41 @@
+import type { CaDatabase } from "../types.js";
+/**
+ * A database schema migration.
+ *
+ * Migrations are applied in order and recorded by `name` in the `migrations`
+ * table, so a name must never change once released. Each statement must be a
+ * single SQL statement.
+ */
+export type Migration = {
+    /** Unique name recorded once the migration has been applied */
+    name: string;
+    /** The SQL statements to run, in order, as one transaction */
+    statements: string[];
+};
+/**
+ * Apply any migrations that have not yet been applied to the database.
+ *
+ * Each migration is run with {@link CaDatabase.batch} so it applies atomically,
+ * and its row in the `migrations` table is inserted first. When several callers
+ * race to apply the same migration only one succeeds; the others fail on that
+ * insert before running any of the migration's statements and their batch rolls
+ * back, so migrations that are not idempotent are safe to apply concurrently.
+ *
+ * @param db The database to migrate, see {@link CaDatabase}
+ * @param migrations The migrations to apply in order, see {@link Migration}
+ * @returns The migrations applied by this call, excluding any applied concurrently by another caller
+ */
+export declare const applyMigrations: (db: CaDatabase, migrations: readonly Migration[]) => Promise<Migration[]>;
+/**
+ * Apply migrations to a database at most once per database binding, see
+ * {@link applyMigrations}.
+ *
+ * Concurrent and later callers share the result of the first call, unless it
+ * fails, in which case the next call tries again.
+ *
+ * @param db The database to migrate, see {@link CaDatabase}
+ * @param migrations The migrations to apply in order, see {@link Migration}
+ * @returns The migrations applied, or an empty array if this database binding has already been migrated
+ */
+export declare const migrateOnce: (db: CaDatabase, migrations: readonly Migration[]) => Promise<Migration[]>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG;IACvB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAqBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,OAAc,UAAU,cAAc,SAAS,SAAS,EAAE,KAAG,OAAO,CAAC,SAAS,EAAE,CAyB3G,CAAA;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,OAAc,UAAU,cAAc,SAAS,SAAS,EAAE,KAAG,OAAO,CAAC,SAAS,EAAE,CAiBvG,CAAA"}

package/dist/db/migrate.js

@@ -0,0 +1,84 @@
+import z from "zod";
+// matches the table previously created by workers-qb so existing databases are not migrated again
+const createMigrationsTable = `CREATE TABLE IF NOT EXISTS migrations (
+	id         INTEGER PRIMARY KEY AUTOINCREMENT,
+	name       TEXT UNIQUE,
+	applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
+)`;
+const MigrationRows = z.array(z.object({ name: z.string() }));
+const appliedNames = async (db) => {
+    const { results } = await db.prepare("SELECT name FROM migrations").all();
+    return new Set(MigrationRows.parse(results).map(row => row.name));
+};
+const isApplied = async (db, name) => {
+    const { results } = await db.prepare("SELECT name FROM migrations WHERE name = ?").bind(name).all();
+    return results.length > 0;
+};
+/**
+ * Apply any migrations that have not yet been applied to the database.
+ *
+ * Each migration is run with {@link CaDatabase.batch} so it applies atomically,
+ * and its row in the `migrations` table is inserted first. When several callers
+ * race to apply the same migration only one succeeds; the others fail on that
+ * insert before running any of the migration's statements and their batch rolls
+ * back, so migrations that are not idempotent are safe to apply concurrently.
+ *
+ * @param db The database to migrate, see {@link CaDatabase}
+ * @param migrations The migrations to apply in order, see {@link Migration}
+ * @returns The migrations applied by this call, excluding any applied concurrently by another caller
+ */
+export const applyMigrations = async (db, migrations) => {
+    await db.prepare(createMigrationsTable).run();
+    const existing = await appliedNames(db);
+    const applied = [];
+    for (const migration of migrations) {
+        if (existing.has(migration.name)) {
+            continue;
+        }
+        try {
+            await db.batch([
+                db.prepare("INSERT INTO migrations (name) VALUES (?)").bind(migration.name),
+                ...migration.statements.map(sql => db.prepare(sql)),
+            ]);
+            applied.push(migration);
+        }
+        catch (err) {
+            // another caller applying the same migration is not an error
+            if (!(await isApplied(db, migration.name))) {
+                throw err;
+            }
+        }
+    }
+    return applied;
+};
+const migrated = new WeakMap();
+/**
+ * Apply migrations to a database at most once per database binding, see
+ * {@link applyMigrations}.
+ *
+ * Concurrent and later callers share the result of the first call, unless it
+ * fails, in which case the next call tries again.
+ *
+ * @param db The database to migrate, see {@link CaDatabase}
+ * @param migrations The migrations to apply in order, see {@link Migration}
+ * @returns The migrations applied, or an empty array if this database binding has already been migrated
+ */
+export const migrateOnce = async (db, migrations) => {
+    const pending = migrated.get(db);
+    if (pending !== undefined) {
+        await pending;
+        return [];
+    }
+    const result = applyMigrations(db, migrations);
+    migrated.set(db, result);
+    try {
+        return await result;
+    }
+    catch (err) {
+        if (migrated.get(db) === result) {
+            migrated.delete(db);
+        }
+        throw err;
+    }
+};
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAiBnB,kGAAkG;AAClG,MAAM,qBAAqB,GAAG;;;;EAI5B,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;AAE7D,MAAM,YAAY,GAAG,KAAK,EAAE,EAAc,EAAwB,EAAE;IACnE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAAE,CAAA;IACzE,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,KAAK,EAAE,EAAc,EAAE,IAAY,EAAoB,EAAE;IAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;IACnG,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,EAAc,EAAE,UAAgC,EAAwB,EAAE;IAC/G,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,CAAA;IAC7C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;IAEvC,MAAM,OAAO,GAAgB,EAAE,CAAA;IAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,SAAQ;QACT,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,EAAE,CAAC,KAAK,CAAC;gBACd,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3E,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;aACnD,CAAC,CAAA;YACF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,6DAA6D;YAC7D,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5C,MAAM,GAAG,CAAA;YACV,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAoC,CAAA;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,EAAc,EAAE,UAAgC,EAAwB,EAAE;IAC3G,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAA;QACb,OAAO,EAAE,CAAA;IACV,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACxB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;YACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpB,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA"}

package/dist/db/migrations/0001_initial_schema.d.ts

@@ -1,3 +1,3 @@
-import { type Migration } from "workers-qb";
+import type { Migration } from "../migrate.js";
 export declare const migration: Migration;
 //# sourceMappingURL=0001_initial_schema.d.ts.map

package/dist/db/migrations/0001_initial_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"0001_initial_schema.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/0001_initial_schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,SAAS,EAAE,SAsBvB,CAAA"}
+{"version":3,"file":"0001_initial_schema.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/0001_initial_schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9C,eAAO,MAAM,SAAS,EAAE,SAqBvB,CAAA"}

package/dist/db/migrations/0001_initial_schema.js

@@ -1,7 +1,7 @@
 export const migration = {
     name: "0001_initial_schema",
-    sql: `
-		CREATE TABLE IF NOT EXISTS certificates (
+    statements: [
+        `CREATE TABLE IF NOT EXISTS certificates (
 			id INTEGER PRIMARY KEY,
 			serial TEXT UNIQUE NOT NULL,
 			key_id TEXT NOT NULL,
@@ -12,13 +12,12 @@ export const migration = {
 			revoked_at TIMESTAMP,
 			certificate_type INTEGER NOT NULL DEFAULT 0,
 			public_key TEXT
-		);
-
-		CREATE INDEX IF NOT EXISTS idx_certificates_serial ON certificates(serial);
-		CREATE INDEX IF NOT EXISTS idx_certificates_valid_after ON certificates(valid_after);
-		CREATE INDEX IF NOT EXISTS idx_certificates_valid_before ON certificates(valid_before);
-		CREATE INDEX IF NOT EXISTS idx_certificates_revoked_at ON certificates(revoked_at);
-		CREATE INDEX IF NOT EXISTS idx_certificates_certificate_type ON certificates(certificate_type);
-	`
+		)`,
+        "CREATE INDEX IF NOT EXISTS idx_certificates_serial ON certificates(serial)",
+        "CREATE INDEX IF NOT EXISTS idx_certificates_valid_after ON certificates(valid_after)",
+        "CREATE INDEX IF NOT EXISTS idx_certificates_valid_before ON certificates(valid_before)",
+        "CREATE INDEX IF NOT EXISTS idx_certificates_revoked_at ON certificates(revoked_at)",
+        "CREATE INDEX IF NOT EXISTS idx_certificates_certificate_type ON certificates(certificate_type)",
+    ]
 };
 //# sourceMappingURL=0001_initial_schema.js.map

package/dist/db/migrations/0001_initial_schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"0001_initial_schema.js","sourceRoot":"","sources":["../../../src/db/migrations/0001_initial_schema.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAc;IACnC,IAAI,EAAE,qBAAqB;IAC3B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;EAmBJ;CACD,CAAA"}
+{"version":3,"file":"0001_initial_schema.js","sourceRoot":"","sources":["../../../src/db/migrations/0001_initial_schema.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAc;IACnC,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE;QACX;;;;;;;;;;;IAWE;QACF,4EAA4E;QAC5E,sFAAsF;QACtF,wFAAwF;QACxF,oFAAoF;QACpF,gGAAgG;KAChG;CACD,CAAA"}

package/dist/db/migrations/index.d.ts

@@ -1,3 +1,3 @@
-import { type Migration } from "workers-qb";
+import type { Migration } from "../migrate.js";
 export declare const migrations: Migration[];
 //# sourceMappingURL=index.d.ts.map

package/dist/db/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAG3C,eAAO,MAAM,UAAU,EAAE,SAAS,EAEjC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAG9C,eAAO,MAAM,UAAU,EAAE,SAAS,EAEjC,CAAA"}

package/dist/index.d.ts

@@ -1,6 +1,33 @@
 import type { ExecutionContext } from "hono";
 import type { SshCaBindings } from "./types.js";
-export type { CaDatabase, CaSecret, SshCaBindings } from "./types.js";
+export type { CaDatabase, CaDatabaseQueryResult, CaDatabaseResult, CaPreparedStatement, CaSecret, SshCaBindings } from "./types.js";
+/**
+ * A runtime neutral instance of the CA, returned by {@link createSshCa}.
+ */
+export interface SshCa {
+    /**
+     * Handle a request to the CA's API, suitable for any server that speaks
+     * the Fetch API `Request` and `Response` types.
+     */
+    fetch(req: Request): Promise<Response>;
+    /**
+     * Remove expired certificates from the database according to
+     * `DB_CERTIFICATE_RETENTION`. This should be run periodically (for example
+     * once a day), as the `scheduled` handler does on Cloudflare Workers.
+     */
+    cleanup(): Promise<void>;
+}
+/**
+ * Create an instance of the CA bound to a fixed set of bindings, for use on
+ * runtimes other than Cloudflare Workers.
+ *
+ * On Workers use the default export instead, which receives its bindings from
+ * the runtime on each request.
+ *
+ * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @returns The CA's request handler and database cleanup task, see {@link SshCa}
+ */
+export declare const createSshCa: (env: SshCaBindings) => SshCa;
 declare const _default: {
     fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext): Promise<Response> | Response;
     scheduled(controller: unknown, env: SshCaBindings, ctx: ExecutionContext): Promise<void>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;;eAWtD,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAG5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAQnI;;GAEG;AACH,MAAM,WAAW,KAAK;IAClB;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QAAS,aAAa,KAAG,KAOhD,CAAA;;eAKc,OAAO,OAAO,aAAa,OAAO,gBAAgB;0BAMjC,OAAO,OAAO,aAAa,OAAO,gBAAgB"}

package/dist/index.js

@@ -1,5 +1,22 @@
 import { dbCleanup } from "./db/index.js";
 import { createApp } from "./router.js";
+/**
+ * Create an instance of the CA bound to a fixed set of bindings, for use on
+ * runtimes other than Cloudflare Workers.
+ *
+ * On Workers use the default export instead, which receives its bindings from
+ * the runtime on each request.
+ *
+ * @param env The bindings (configuration, database and private key) for the CA, see {@link SshCaBindings}
+ * @returns The CA's request handler and database cleanup task, see {@link SshCa}
+ */
+export const createSshCa = (env) => {
+    const app = createApp(env);
+    return {
+        fetch: async (req) => await app.fetch(req, env),
+        cleanup: async () => await dbCleanup(env),
+    };
+};
 let app;
 export default {
     fetch(req, env, ctx) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAUvC,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA2BvC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAS,EAAE;IACrD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAE1B,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,GAAY,EAAqB,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;QAC3E,OAAO,EAAE,KAAK,IAAmB,EAAE,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC;KAC3D,CAAA;AACL,CAAC,CAAA;AAED,IAAI,GAA6C,CAAA;AAEjD,eAAe;IACX,KAAK,CAAC,GAAY,EAAE,GAAkB,EAAE,GAAqB;QACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAmB,EAAE,GAAkB,EAAE,GAAqB;QAC1E,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IACjC,CAAC;CACmB,CAAA"}

package/dist/node/env.d.ts

@@ -0,0 +1,72 @@
+import z from "zod";
+import type { CaDatabase, CaSecret, SshCaBindings } from "../types.js";
+/**
+ * The environment variables read by {@link bindingsFromEnv}, which match the
+ * Workers vars documented for the CA.
+ */
+export declare const EnvSchema: z.ZodObject<{
+    DB_CERTIFICATE_RETENTION: z.ZodUnion<readonly [z.ZodLiteral<"infinite">, z.ZodString]>;
+    SSH_CERTIFICATE_EXTENSIONS: z.ZodString;
+    SSH_CERTIFICATE_LIFETIME: z.ZodString;
+    SSH_CERTIFICATE_INCLUDE_SELF: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    SSH_CERTIFICATE_INCLUDE_SELF_EMAIL: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    SSH_CERTIFICATE_PRINCIPALS: z.ZodOptional<z.ZodString>;
+    SSH_HOST_CERTIFICATE_LIFETIME: z.ZodString;
+    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: z.ZodOptional<z.ZodString>;
+    SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.ZodOptional<z.ZodString>;
+    ISSUER_DN: z.ZodString;
+    JWT_JWKS_URL: z.ZodURL;
+    JWT_AUD: z.ZodOptional<z.ZodString>;
+    JWT_ISSUER: z.ZodString;
+    JWT_ALGORITHMS: z.ZodString;
+    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: z.ZodString;
+    CERTIFICATE_REQUEST_TIME_SKEW_MAX: z.ZodString;
+    LOG_LEVEL: z.ZodOptional<z.ZodEnum<{
+        debug: "debug";
+        error: "error";
+        info: "info";
+        none: "none";
+        warning: "warning";
+    }>>;
+}, z.core.$strip>;
+/**
+ * The CA's configuration as read from environment variables, see {@link EnvSchema}.
+ */
+export type CaEnv = z.infer<typeof EnvSchema>;
+/**
+ * Thrown by {@link bindingsFromEnv} when the environment is not a valid configuration.
+ */
+export declare class InvalidConfigurationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Build the CA's bindings from environment variables, for runtimes where
+ * configuration is not supplied as Workers bindings.
+ *
+ * The variables have the same names and formats as the Workers vars, and are
+ * validated before use so that misconfiguration is reported at start up.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * })
+ * ```
+ *
+ * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param source The environment variables to read, `process.env` by default
+ * @returns The bindings to pass to `createSshCa`
+ * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
+ */
+export declare const bindingsFromEnv: (bindings: {
+    DB: CaDatabase;
+    PRIVATE_KEY: CaSecret;
+}, source?: Record<string, string | undefined>) => SshCaBindings;
+//# sourceMappingURL=env.d.ts.map

package/dist/node/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAYtE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAA;CAAE,WAC3C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}

package/dist/node/env.js

@@ -0,0 +1,74 @@
+import { seconds } from "itty-time";
+import z from "zod";
+const required = z.string().trim().min(1, { message: "must be set" });
+// a duration in the format accepted by itty-time, such as "24 hours"
+const duration = (opts) => required.refine(v => {
+    const s = seconds(v);
+    return Number.isFinite(s) && (opts.allowZero ? s >= 0 : s > 0);
+}, { message: opts.allowZero ? "must be a duration such as \"90 seconds\"" : "must be a positive duration such as \"24 hours\"" });
+const boolean = z.enum(["true", "false"], { message: "must be \"true\" or \"false\"" });
+/**
+ * The environment variables read by {@link bindingsFromEnv}, which match the
+ * Workers vars documented for the CA.
+ */
+export const EnvSchema = z.object({
+    DB_CERTIFICATE_RETENTION: z.union([
+        z.literal("infinite"),
+        // an SQLite date modifier such as "1 year" or "90 days"
+        z.string().regex(/^[+-]?\d+(\.\d+)? (second|minute|hour|day|month|year)s?$/),
+    ], { message: "must be \"infinite\" or a period such as \"1 year\"" }),
+    SSH_CERTIFICATE_EXTENSIONS: z.string(),
+    SSH_CERTIFICATE_LIFETIME: duration({ allowZero: false }),
+    SSH_CERTIFICATE_INCLUDE_SELF: boolean.optional(),
+    SSH_CERTIFICATE_INCLUDE_SELF_EMAIL: boolean.optional(),
+    SSH_CERTIFICATE_PRINCIPALS: z.string().optional(),
+    SSH_HOST_CERTIFICATE_LIFETIME: duration({ allowZero: false }),
+    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: z.string().optional(),
+    SSH_HOST_CERTIFICATE_ALLOWED_ROLES: z.string().optional(),
+    ISSUER_DN: required,
+    JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
+    JWT_AUD: z.string().optional(),
+    JWT_ISSUER: required,
+    JWT_ALGORITHMS: required,
+    JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
+    CERTIFICATE_REQUEST_TIME_SKEW_MAX: duration({ allowZero: true }),
+    LOG_LEVEL: z.enum(["none", "error", "warning", "info", "debug"]).optional(),
+});
+/**
+ * Thrown by {@link bindingsFromEnv} when the environment is not a valid configuration.
+ */
+export class InvalidConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InvalidConfigurationError";
+        Object.setPrototypeOf(this, InvalidConfigurationError.prototype);
+    }
+}
+/**
+ * Build the CA's bindings from environment variables, for runtimes where
+ * configuration is not supplied as Workers bindings.
+ *
+ * The variables have the same names and formats as the Workers vars, and are
+ * validated before use so that misconfiguration is reported at start up.
+ *
+ * @example
+ * ```ts
+ * const env = bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * })
+ * ```
+ *
+ * @param bindings The database and private key, see {@link CaDatabase} and {@link CaSecret}
+ * @param source The environment variables to read, `process.env` by default
+ * @returns The bindings to pass to `createSshCa`
+ * @throws {@link InvalidConfigurationError} if a variable is missing or invalid
+ */
+export const bindingsFromEnv = (bindings, source = process.env) => {
+    const result = EnvSchema.safeParse(source);
+    if (!result.success) {
+        throw new InvalidConfigurationError(`invalid configuration:\n${z.prettifyError(result.error)}`);
+    }
+    return { ...result.data, DB: bindings.DB, PRIVATE_KEY: bindings.PRIVATE_KEY };
+};
+//# sourceMappingURL=env.js.map

package/dist/node/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAmD,EACnD,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;AAC9E,CAAC,CAAA"}

package/dist/node/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Helpers for running the CA on Node.js, imported from
+ * `@andrewheberle/serverless-ssh-ca/node`.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+ * import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const ca = createSshCa(bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * }))
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
+export type { CaEnv } from "./env.js";
+export { secretFromFile, secretFromString } from "./secret.js";
+export { fromNodeSqlite } from "./sqlite.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/node/index.js

@@ -0,0 +1,22 @@
+/**
+ * Helpers for running the CA on Node.js, imported from
+ * `@andrewheberle/serverless-ssh-ca/node`.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { createSshCa } from "@andrewheberle/serverless-ssh-ca"
+ * import { bindingsFromEnv, fromNodeSqlite, secretFromFile } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const ca = createSshCa(bindingsFromEnv({
+ *     DB: fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite")),
+ *     PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+ * }))
+ * ```
+ *
+ * @packageDocumentation
+ */
+export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
+export { secretFromFile, secretFromString } from "./secret.js";
+export { fromNodeSqlite } from "./sqlite.js";
+//# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}