@andrewheberle/serverless-ssh-ca 0.19.1 → 0.20.1

package/dist/node/secret.d.ts

@@ -0,0 +1,24 @@
+import type { CaSecret } from "../types.js";
+/**
+ * Use a string as the CA's private key secret.
+ *
+ * @example
+ * ```ts
+ * const PRIVATE_KEY = secretFromString(process.env.SSH_CA_PRIVATE_KEY ?? "")
+ * ```
+ *
+ * @param value The CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export declare const secretFromString: (value: string) => CaSecret;
+/**
+ * Use the contents of a file as the CA's private key secret.
+ *
+ * The file is read each time the key is needed, so replacing the file takes
+ * effect without a restart.
+ *
+ * @param path The path of a file containing the CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export declare const secretFromFile: (path: string) => CaSecret;
+//# sourceMappingURL=secret.d.ts.map

package/dist/node/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/node/secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,QAE/C,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,QAE5C,CAAA"}

package/dist/node/secret.js

@@ -0,0 +1,28 @@
+import { readFile } from "node:fs/promises";
+/**
+ * Use a string as the CA's private key secret.
+ *
+ * @example
+ * ```ts
+ * const PRIVATE_KEY = secretFromString(process.env.SSH_CA_PRIVATE_KEY ?? "")
+ * ```
+ *
+ * @param value The CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export const secretFromString = (value) => ({
+    get: async () => value,
+});
+/**
+ * Use the contents of a file as the CA's private key secret.
+ *
+ * The file is read each time the key is needed, so replacing the file takes
+ * effect without a restart.
+ *
+ * @param path The path of a file containing the CA private key in OpenSSH format
+ * @returns A secret for the `PRIVATE_KEY` binding, see {@link CaSecret}
+ */
+export const secretFromFile = (path) => ({
+    get: async () => await readFile(path, { encoding: "utf-8" }),
+});
+//# sourceMappingURL=secret.js.map

package/dist/node/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/node/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAG3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,CAAC;IAC7D,GAAG,EAAE,KAAK,IAAqB,EAAE,CAAC,KAAK;CACvC,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC;IAC1D,GAAG,EAAE,KAAK,IAAqB,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;CAC7E,CAAC,CAAA"}

package/dist/node/sqlite.d.ts

@@ -0,0 +1,47 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { CaDatabase } from "../types.js";
+/**
+ * A single SQL statement split from a larger query by {@link splitStatements}.
+ */
+export type SqlStatement = {
+    /** The SQL of the statement, without its trailing `;` */
+    sql: string;
+    /** The number of anonymous (`?`) parameters in the statement */
+    parameters: number;
+    /** Whether the statement uses numbered or named parameters (`?1`, `:name`, `@name` or `$name`) */
+    named: boolean;
+};
+/**
+ * Split SQL that may contain several statements into individual statements.
+ *
+ * `node:sqlite` only compiles the first statement passed to `prepare()`,
+ * whereas Cloudflare D1 runs them all, so queries are split here first. Quoted
+ * strings and identifiers, comments and `CREATE TRIGGER ... BEGIN ... END`
+ * bodies are not split. Statements containing nothing but whitespace or
+ * comments are dropped.
+ *
+ * @param sql The SQL to split
+ * @returns The statements found in `sql`, see {@link SqlStatement}
+ */
+export declare const splitStatements: (sql: string) => SqlStatement[];
+/**
+ * Use a Node.js `node:sqlite` database as the CA's database.
+ *
+ * The returned object behaves like a Cloudflare D1 binding: queries containing
+ * several statements are run in full (see {@link splitStatements}) and
+ * {@link CaDatabase.batch} is atomic. The database's schema is created and
+ * migrated automatically when the CA first uses it.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { fromNodeSqlite } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const DB = fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite"))
+ * ```
+ *
+ * @param db An open `node:sqlite` database
+ * @returns A database for the `DB` binding, see {@link CaDatabase}
+ */
+export declare const fromNodeSqlite: (db: DatabaseSync) => CaDatabase;
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/node/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/node/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAgE,MAAM,aAAa,CAAA;AAE3G;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAA;IACX,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,kGAAkG;IAClG,KAAK,EAAE,OAAO,CAAA;CACd,CAAA;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,YAAY,EA6HzD,CAAA;AA6HD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,OAAQ,YAAY,KAAG,UAgBhD,CAAA"}

package/dist/node/sqlite.js

@@ -0,0 +1,273 @@
+const isWordChar = (ch) => ch !== undefined && /[A-Za-z0-9_$]/.test(ch);
+/**
+ * Split SQL that may contain several statements into individual statements.
+ *
+ * `node:sqlite` only compiles the first statement passed to `prepare()`,
+ * whereas Cloudflare D1 runs them all, so queries are split here first. Quoted
+ * strings and identifiers, comments and `CREATE TRIGGER ... BEGIN ... END`
+ * bodies are not split. Statements containing nothing but whitespace or
+ * comments are dropped.
+ *
+ * @param sql The SQL to split
+ * @returns The statements found in `sql`, see {@link SqlStatement}
+ */
+export const splitStatements = (sql) => {
+    const statements = [];
+    let start = 0;
+    let parameters = 0;
+    let named = false;
+    let hasTokens = false;
+    let words = [];
+    let depth = 0;
+    const push = (end) => {
+        if (hasTokens) {
+            statements.push({ sql: sql.slice(start, end).trim(), parameters, named });
+        }
+        start = end + 1;
+        parameters = 0;
+        named = false;
+        hasTokens = false;
+        words = [];
+        depth = 0;
+    };
+    // true if the current statement is CREATE [TEMP|TEMPORARY] TRIGGER, whose body may contain ";"
+    const inTrigger = () => words[0] === "CREATE" && (words[1] === "TRIGGER" || words[2] === "TRIGGER");
+    let i = 0;
+    while (i < sql.length) {
+        const ch = sql[i];
+        const next = sql[i + 1];
+        // comments
+        if (ch === "-" && next === "-") {
+            const end = sql.indexOf("\n", i);
+            i = end === -1 ? sql.length : end + 1;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            const end = sql.indexOf("*/", i + 2);
+            i = end === -1 ? sql.length : end + 2;
+            continue;
+        }
+        // whitespace
+        if (ch === undefined || /\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        // end of statement
+        if (ch === ";" && depth === 0) {
+            push(i);
+            i++;
+            continue;
+        }
+        hasTokens = true;
+        // quoted strings and identifiers, where a doubled quote is an escaped quote
+        if (ch === "'" || ch === "\"" || ch === "`" || ch === "[") {
+            const close = ch === "[" ? "]" : ch;
+            let j = i + 1;
+            while (j < sql.length) {
+                if (sql[j] === close) {
+                    if (close !== "]" && sql[j + 1] === close) {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            i = j + 1;
+            continue;
+        }
+        // parameters
+        if (ch === "?") {
+            let j = i + 1;
+            while (j < sql.length && /[0-9]/.test(sql[j] ?? "")) {
+                j++;
+            }
+            if (j === i + 1) {
+                parameters++;
+            }
+            else {
+                named = true;
+            }
+            i = j;
+            continue;
+        }
+        if ((ch === ":" || ch === "@" || ch === "$") && isWordChar(next)) {
+            named = true;
+            i++;
+            while (isWordChar(sql[i])) {
+                i++;
+            }
+            continue;
+        }
+        // keywords and identifiers
+        if (isWordChar(ch)) {
+            let j = i;
+            while (isWordChar(sql[j])) {
+                j++;
+            }
+            const word = sql.slice(i, j).toUpperCase();
+            if (words.length < 3) {
+                words.push(word);
+            }
+            if (inTrigger()) {
+                if (word === "BEGIN" || word === "CASE") {
+                    depth++;
+                }
+                else if (word === "END" && depth > 0) {
+                    depth--;
+                }
+            }
+            i = j;
+            continue;
+        }
+        i++;
+    }
+    push(sql.length);
+    return statements;
+};
+/**
+ * Convert a value bound to a statement into one `node:sqlite` accepts, using
+ * the same conversions as Cloudflare D1.
+ */
+const toSqlValue = (value) => {
+    if (value === null || typeof value === "number" || typeof value === "bigint" || typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "boolean") {
+        return value ? 1 : 0;
+    }
+    if (value instanceof ArrayBuffer) {
+        return new Uint8Array(value);
+    }
+    if (ArrayBuffer.isView(value)) {
+        return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    }
+    throw new TypeError(`unsupported type for SQL parameter: ${value === undefined ? "undefined" : typeof value}`);
+};
+const toNumber = (value) => {
+    if (typeof value === "number") {
+        return value;
+    }
+    if (typeof value === "bigint") {
+        return Number(value);
+    }
+    throw new TypeError(`expected a number from SQLite but got ${typeof value}`);
+};
+// counters used to report D1 style metadata for any statement
+const counters = (db) => {
+    const row = db.prepare("SELECT total_changes() AS changes, last_insert_rowid() AS last_row_id").get();
+    return { changes: toNumber(row?.changes), lastRowId: toNumber(row?.last_row_id) };
+};
+let savepointId = 0;
+// run fn atomically, using a savepoint so it also works inside an existing transaction
+const atomically = (db, fn) => {
+    const name = `serverless_ssh_ca_${savepointId++}`;
+    db.exec(`SAVEPOINT ${name}`);
+    try {
+        const result = fn();
+        db.exec(`RELEASE ${name}`);
+        return result;
+    }
+    catch (err) {
+        db.exec(`ROLLBACK TO ${name}`);
+        db.exec(`RELEASE ${name}`);
+        throw err;
+    }
+};
+class NodeSqliteStatement {
+    db;
+    sql;
+    values;
+    constructor(db, sql, values = []) {
+        this.db = db;
+        this.sql = sql;
+        this.values = values;
+    }
+    bind(...values) {
+        return new NodeSqliteStatement(this.db, this.sql, values.map(toSqlValue));
+    }
+    async all() {
+        return this.execute();
+    }
+    async run() {
+        const { success, meta } = this.execute();
+        return { success, meta };
+    }
+    // executes synchronously so no other query can run part way through
+    execute() {
+        const started = performance.now();
+        const before = counters(this.db);
+        const results = this.query();
+        const after = counters(this.db);
+        return {
+            success: true,
+            results,
+            meta: {
+                changes: after.changes - before.changes,
+                last_row_id: after.lastRowId,
+                duration: performance.now() - started,
+            },
+        };
+    }
+    query() {
+        const statements = splitStatements(this.sql);
+        if (statements.length <= 1) {
+            return this.db.prepare(this.sql).all(...this.values);
+        }
+        if (statements.some(s => s.named)) {
+            throw new Error("queries containing more than one statement only support anonymous (?) parameters");
+        }
+        const expected = statements.reduce((total, s) => total + s.parameters, 0);
+        if (expected !== this.values.length) {
+            throw new RangeError(`query expects ${expected} parameters but ${this.values.length} were bound`);
+        }
+        // give each statement its share of the bound values, returning the rows of the last statement
+        return atomically(this.db, () => {
+            let offset = 0;
+            let results = [];
+            for (const statement of statements) {
+                const values = this.values.slice(offset, offset + statement.parameters);
+                offset += statement.parameters;
+                results = this.db.prepare(statement.sql).all(...values);
+            }
+            return results;
+        });
+    }
+}
+/**
+ * Use a Node.js `node:sqlite` database as the CA's database.
+ *
+ * The returned object behaves like a Cloudflare D1 binding: queries containing
+ * several statements are run in full (see {@link splitStatements}) and
+ * {@link CaDatabase.batch} is atomic. The database's schema is created and
+ * migrated automatically when the CA first uses it.
+ *
+ * @example
+ * ```ts
+ * import { DatabaseSync } from "node:sqlite"
+ * import { fromNodeSqlite } from "@andrewheberle/serverless-ssh-ca/node"
+ *
+ * const DB = fromNodeSqlite(new DatabaseSync("ssh-ca.sqlite"))
+ * ```
+ *
+ * @param db An open `node:sqlite` database
+ * @returns A database for the `DB` binding, see {@link CaDatabase}
+ */
+export const fromNodeSqlite = (db) => ({
+    prepare: (query) => new NodeSqliteStatement(db, query),
+    batch: async (statements) => {
+        const owned = statements.map(s => {
+            if (!(s instanceof NodeSqliteStatement) || s.db !== db) {
+                throw new TypeError("batch statements must be prepared by the same database");
+            }
+            return s;
+        });
+        return atomically(db, () => owned.map(s => s.execute()));
+    },
+    exec: async (query) => {
+        const started = performance.now();
+        db.exec(query);
+        return { count: splitStatements(query).length, duration: performance.now() - started };
+    },
+});
+//# sourceMappingURL=sqlite.js.map

package/dist/node/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../src/node/sqlite.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,GAAG,CAAC,EAAsB,EAAW,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpG;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAkB,EAAE;IAC9D,MAAM,UAAU,GAAmB,EAAE,CAAA;IAErC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,KAAK,GAAa,EAAE,CAAA;IACxB,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,SAAS,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,KAAK,GAAG,GAAG,GAAG,CAAC,CAAA;QACf,UAAU,GAAG,CAAC,CAAA;QACd,KAAK,GAAG,KAAK,CAAA;QACb,SAAS,GAAG,KAAK,CAAA;QACjB,KAAK,GAAG,EAAE,CAAA;QACV,KAAK,GAAG,CAAC,CAAA;IACV,CAAC,CAAA;IAED,+FAA+F;IAC/F,MAAM,SAAS,GAAG,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAE5G,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAEvB,WAAW;QACX,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAChC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;YACrC,SAAQ;QACT,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACpC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;YACrC,SAAQ;QACT,CAAC;QAED,aAAa;QACb,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,CAAC,EAAE,CAAA;YACH,SAAQ;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,CAAA;YACP,CAAC,EAAE,CAAA;YACH,SAAQ;QACT,CAAC;QAED,SAAS,GAAG,IAAI,CAAA;QAEhB,4EAA4E;QAC5E,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACtB,IAAI,KAAK,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;wBAC3C,CAAC,IAAI,CAAC,CAAA;wBACN,SAAQ;oBACT,CAAC;oBACD,MAAK;gBACN,CAAC;gBACD,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACT,SAAQ;QACT,CAAC;QAED,aAAa;QACb,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrD,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,UAAU,EAAE,CAAA;YACb,CAAC;iBAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAA;YACb,CAAC;YACD,CAAC,GAAG,CAAC,CAAA;YACL,SAAQ;QACT,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,KAAK,GAAG,IAAI,CAAA;YACZ,CAAC,EAAE,CAAA;YACH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,SAAQ;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,CAAC,EAAE,CAAA;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,CAAC;YACD,IAAI,SAAS,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzC,KAAK,EAAE,CAAA;gBACR,CAAC;qBAAM,IAAI,IAAI,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACxC,KAAK,EAAE,CAAA;gBACR,CAAC;YACF,CAAC;YACD,CAAC,GAAG,CAAC,CAAA;YACL,SAAQ;QACT,CAAC;QAED,CAAC,EAAE,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAEhB,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAiB,EAAE;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,uCAAuC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;AAC/G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,yCAAyC,OAAO,KAAK,EAAE,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,CAAC,EAAgB,EAA0C,EAAE;IAC7E,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,EAAE,CAAA;IACrG,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAA;AAClF,CAAC,CAAA;AAED,IAAI,WAAW,GAAG,CAAC,CAAA;AAEnB,uFAAuF;AACvF,MAAM,UAAU,GAAG,CAAI,EAAgB,EAAE,EAAW,EAAK,EAAE;IAC1D,MAAM,IAAI,GAAG,qBAAqB,WAAW,EAAE,EAAE,CAAA;IACjD,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,EAAE,EAAE,CAAA;QACnB,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC1B,OAAO,MAAM,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAA;QAC9B,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC1B,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC,CAAA;AAED,MAAM,mBAAmB;IACf,EAAE,CAAc;IACR,GAAG,CAAQ;IACX,MAAM,CAA0B;IAEjD,YAAY,EAAgB,EAAE,GAAW,EAAE,MAAM,GAA6B,EAAE;QAC/E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACrB,CAAC;IAED,IAAI,CAAC,GAAG,MAAiB;QACxB,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,KAAK,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,GAAG;QACR,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,oEAAoE;IACpE,OAAO;QACN,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAE/B,OAAO;YACN,OAAO,EAAE,IAAI;YACb,OAAO;YACP,IAAI,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;gBACvC,WAAW,EAAE,KAAK,CAAC,SAAS;gBAC5B,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;aACrC;SACD,CAAA;IACF,CAAC;IAEO,KAAK;QACZ,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QACzE,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,iBAAiB,QAAQ,mBAAmB,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAA;QAClG,CAAC;QAED,8FAA8F;QAC9F,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,IAAI,OAAO,GAAc,EAAE,CAAA;YAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;gBACvE,MAAM,IAAI,SAAS,CAAC,UAAU,CAAA;gBAC9B,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;YACxD,CAAC;YACD,OAAO,OAAO,CAAA;QACf,CAAC,CAAC,CAAA;IACH,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAgB,EAAc,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,CAAC,KAAa,EAAuB,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC;IACnF,KAAK,EAAE,KAAK,EAAE,UAAiC,EAAoC,EAAE;QACpF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAChC,IAAI,CAAC,CAAC,CAAC,YAAY,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxD,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAA;YAC9E,CAAC;YACD,OAAO,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,OAAO,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,KAAa,EAAgD,EAAE;QAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;IACvF,CAAC;CACD,CAAC,CAAA"}

package/dist/types.d.ts

@@ -19,15 +19,59 @@ export type SSHExtension = {
     name: string;
     data: Buffer<ArrayBuffer>;
 };
+/**
+ * The result of executing a statement via {@link CaPreparedStatement.run} or
+ * {@link CaDatabase.batch}, modelled on a Cloudflare D1 result.
+ */
+export interface CaDatabaseResult {
+    /** Whether the statement executed successfully */
+    success: boolean;
+    meta?: {
+        /** The number of rows changed by the statement */
+        changes?: number;
+        /** The rowid of the last row inserted */
+        last_row_id?: number;
+        /** How long the statement took to execute in milliseconds */
+        duration?: number;
+    };
+}
+/**
+ * The result of executing a statement that returns rows via
+ * {@link CaPreparedStatement.all}.
+ */
+export interface CaDatabaseQueryResult extends CaDatabaseResult {
+    /** The rows returned, one object per row keyed by column name */
+    results: unknown[];
+}
+/**
+ * The subset of a Cloudflare D1 prepared statement used by the CA.
+ */
+export interface CaPreparedStatement {
+    /** Bind positional (`?`) parameters, returning a statement to execute */
+    bind(...values: unknown[]): CaPreparedStatement;
+    /** Execute the statement and return all rows */
+    all(): Promise<CaDatabaseQueryResult>;
+    /** Execute the statement without returning rows */
+    run(): Promise<CaDatabaseResult>;
+}
 /**
  * The subset of a Cloudflare D1 database binding used by the CA.
  *
  * A Workers `D1Database` binding satisfies this structurally, so the package
- * does not need to depend on `@cloudflare/workers-types`.
+ * does not need to depend on `@cloudflare/workers-types`. Any other SQLite
+ * compatible database may be used by implementing this interface.
+ *
+ * The SQL the CA runs is SQLite dialect, and statements passed to
+ * {@link CaDatabase.prepare} may contain more than one SQL statement.
+ * Schema migrations rely on {@link CaDatabase.batch} being atomic so they can
+ * be applied safely by concurrent requests.
  */
 export interface CaDatabase {
-    prepare(query: string): unknown;
-    batch(statements: never[]): Promise<unknown>;
+    /** Prepare a SQL query for execution, see {@link CaPreparedStatement} */
+    prepare(query: string): CaPreparedStatement;
+    /** Execute several prepared statements atomically, returning a result for each */
+    batch(statements: CaPreparedStatement[]): Promise<CaDatabaseResult[]>;
+    /** Execute one or more SQL statements without parameters */
     exec(query: string): Promise<unknown>;
 }
 /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACvB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,QAAQ,CAAA;IACrB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@andrewheberle/serverless-ssh-ca",
-	"version": "0.19.1",
-	"description": "A serverless SSH CA built on Cloudflare Workers",
+	"version": "0.20.1",
+	"description": "A serverless SSH CA built for Cloudflare Workers that can also run on Node.js",
 	"type": "module",
 	"types": "./dist/index.d.ts",
 	"files": [
@@ -14,6 +14,10 @@
 			"types": "./dist/index.d.ts",
 			"default": "./dist/index.js"
 		},
+		"./node": {
+			"types": "./dist/node/index.d.ts",
+			"default": "./dist/node/index.js"
+		},
 		"./openapi.json": "./openapi.json"
 	},
 	"scripts": {

package/src/db/index.ts

@@ -2,6 +2,7 @@ import type { Certificate, Format, Identity } from "sshpk"
 import { logger } from "../logger.js"
 import type { SshCaBindings } from "../types.js"
 import { D1QB } from "workers-qb"
+import { migrateOnce } from "./migrate.js"
 import { migrations } from "./migrations/index.js"
 
 export enum CertificateType {
@@ -32,13 +33,11 @@ const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
 	try {
 		l.debug("connecting to database")
 
-		const qb = new D1QB<DatabaseSchema>(env.DB)
-		const migrationBuilder = qb.migrations({ migrations })
-		const appliedMigrations = await migrationBuilder.apply()
+		const appliedMigrations = await migrateOnce(env.DB, migrations)
 
 		l.debug("applied database migrations", "migrations", appliedMigrations.length, "migration_names", appliedMigrations.map(m => m.name))
 
-		return qb
+		return new D1QB<DatabaseSchema>(env.DB)
 	} catch (err) {
 		l.error("error connecting to database", "error", err)
 		throw err

package/src/db/migrate.ts

@@ -0,0 +1,107 @@
+import z from "zod"
+import type { CaDatabase } from "../types.js"
+
+/**
+ * A database schema migration.
+ *
+ * Migrations are applied in order and recorded by `name` in the `migrations`
+ * table, so a name must never change once released. Each statement must be a
+ * single SQL statement.
+ */
+export type Migration = {
+	/** Unique name recorded once the migration has been applied */
+	name: string
+	/** The SQL statements to run, in order, as one transaction */
+	statements: string[]
+}
+
+// matches the table previously created by workers-qb so existing databases are not migrated again
+const createMigrationsTable = `CREATE TABLE IF NOT EXISTS migrations (
+	id         INTEGER PRIMARY KEY AUTOINCREMENT,
+	name       TEXT UNIQUE,
+	applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
+)`
+
+const MigrationRows = z.array(z.object({ name: z.string() }))
+
+const appliedNames = async (db: CaDatabase): Promise<Set<string>> => {
+	const { results } = await db.prepare("SELECT name FROM migrations").all()
+	return new Set(MigrationRows.parse(results).map(row => row.name))
+}
+
+const isApplied = async (db: CaDatabase, name: string): Promise<boolean> => {
+	const { results } = await db.prepare("SELECT name FROM migrations WHERE name = ?").bind(name).all()
+	return results.length > 0
+}
+
+/**
+ * Apply any migrations that have not yet been applied to the database.
+ *
+ * Each migration is run with {@link CaDatabase.batch} so it applies atomically,
+ * and its row in the `migrations` table is inserted first. When several callers
+ * race to apply the same migration only one succeeds; the others fail on that
+ * insert before running any of the migration's statements and their batch rolls
+ * back, so migrations that are not idempotent are safe to apply concurrently.
+ *
+ * @param db The database to migrate, see {@link CaDatabase}
+ * @param migrations The migrations to apply in order, see {@link Migration}
+ * @returns The migrations applied by this call, excluding any applied concurrently by another caller
+ */
+export const applyMigrations = async (db: CaDatabase, migrations: readonly Migration[]): Promise<Migration[]> => {
+	await db.prepare(createMigrationsTable).run()
+	const existing = await appliedNames(db)
+
+	const applied: Migration[] = []
+	for (const migration of migrations) {
+		if (existing.has(migration.name)) {
+			continue
+		}
+
+		try {
+			await db.batch([
+				db.prepare("INSERT INTO migrations (name) VALUES (?)").bind(migration.name),
+				...migration.statements.map(sql => db.prepare(sql)),
+			])
+			applied.push(migration)
+		} catch (err) {
+			// another caller applying the same migration is not an error
+			if (!(await isApplied(db, migration.name))) {
+				throw err
+			}
+		}
+	}
+
+	return applied
+}
+
+const migrated = new WeakMap<CaDatabase, Promise<Migration[]>>()
+
+/**
+ * Apply migrations to a database at most once per database binding, see
+ * {@link applyMigrations}.
+ *
+ * Concurrent and later callers share the result of the first call, unless it
+ * fails, in which case the next call tries again.
+ *
+ * @param db The database to migrate, see {@link CaDatabase}
+ * @param migrations The migrations to apply in order, see {@link Migration}
+ * @returns The migrations applied, or an empty array if this database binding has already been migrated
+ */
+export const migrateOnce = async (db: CaDatabase, migrations: readonly Migration[]): Promise<Migration[]> => {
+	const pending = migrated.get(db)
+	if (pending !== undefined) {
+		await pending
+		return []
+	}
+
+	const result = applyMigrations(db, migrations)
+	migrated.set(db, result)
+	try {
+		return await result
+	} catch (err) {
+		if (migrated.get(db) === result) {
+			migrated.delete(db)
+		}
+		throw err
+	}
+}

package/src/db/migrations/0001_initial_schema.ts

@@ -1,9 +1,9 @@
-import { type Migration } from "workers-qb";
+import type { Migration } from "../migrate.js"
 
 export const migration: Migration = {
 	name: "0001_initial_schema",
-	sql: `
-		CREATE TABLE IF NOT EXISTS certificates (
+	statements: [
+		`CREATE TABLE IF NOT EXISTS certificates (
 			id INTEGER PRIMARY KEY,
 			serial TEXT UNIQUE NOT NULL,
 			key_id TEXT NOT NULL,
@@ -14,12 +14,11 @@ export const migration: Migration = {
 			revoked_at TIMESTAMP,
 			certificate_type INTEGER NOT NULL DEFAULT 0,
 			public_key TEXT
-		);
-
-		CREATE INDEX IF NOT EXISTS idx_certificates_serial ON certificates(serial);
-		CREATE INDEX IF NOT EXISTS idx_certificates_valid_after ON certificates(valid_after);
-		CREATE INDEX IF NOT EXISTS idx_certificates_valid_before ON certificates(valid_before);
-		CREATE INDEX IF NOT EXISTS idx_certificates_revoked_at ON certificates(revoked_at);
-		CREATE INDEX IF NOT EXISTS idx_certificates_certificate_type ON certificates(certificate_type);
-	`
+		)`,
+		"CREATE INDEX IF NOT EXISTS idx_certificates_serial ON certificates(serial)",
+		"CREATE INDEX IF NOT EXISTS idx_certificates_valid_after ON certificates(valid_after)",
+		"CREATE INDEX IF NOT EXISTS idx_certificates_valid_before ON certificates(valid_before)",
+		"CREATE INDEX IF NOT EXISTS idx_certificates_revoked_at ON certificates(revoked_at)",
+		"CREATE INDEX IF NOT EXISTS idx_certificates_certificate_type ON certificates(certificate_type)",
+	]
 }