@sproutboat/wire 0.9.3 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @sproutboat/wire
 
+## 0.11.0
+
+### Minor Changes
+
+- 4dd16b7: `fetch()` reaches any public address and never a private or reserved one (baronunread/sproutboat#174). The `outbound` allowlist is gone.
+  
+  - Both backends, the broker and the standalone client, check the address they resolved, not the hostname, so DNS rebinding can't get past the check. The broker connects to the vetted address and verifies TLS against the name.
+  - Blocked: loopback, RFC 1918, link-local and cloud metadata, CGNAT, benchmarking, documentation, multicast and reserved ranges, IPv6 ULA and link-local, and the IPv4 address inside IPv4-mapped, NAT64 and 6to4 addresses.
+  - An operator can let addresses through with `SB_EGRESS_ALLOW` (`*` or exact addresses) in the broker's or the binary's environment. Handler code can't.
+  - `@sproutboat/runtime`: `URL.hostname` and `URL.port` handle IPv6 literals (`[::1]:9` used to give hostname `[`). Every sprout gets `fetch()`, with no binding needed. `validateHttpSyncSource` no longer takes an `outboundAllowed` argument, and `Bindings` loses `outbound`.
+  - `@sproutboat/wire`: `Bindings` loses `outbound`.
+  - `@sproutboat/config`: `outbound` is accepted but ignored, with a warning in the new `warnings` field of a successful parse (`OUTBOUND_IGNORED`). It will be refused in a later minor release.
+
+### Patch Changes
+
+- Updated dependencies [4dd16b7]
+  - @sproutboat/runtime@0.14.0
+
+## 0.10.0
+
+### Minor Changes
+
+- 276fd90: New `doDb` option and `--do-db` flag: Durable Object storage and alarms can live in their own SQLite file instead of the per-deployment database (baronunread/sproutboat#207). The platform points it at a per-project file so an object's state survives redeploys, as on Workers. Without it, behaviour is unchanged.
+
 ## 0.9.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/wire",
-  "version": "0.9.3",
+  "version": "0.11.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -11,7 +11,8 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "dependencies": {
-    "@sproutboat/assets": "^0.3.0"
+    "@sproutboat/assets": "^0.3.0",
+    "@sproutboat/runtime": "^0.14.0"
   },
   "exports": {
     ".": "./src/index.ts",

package/src/broker.test.ts

@@ -29,7 +29,8 @@ afterEach(() => {
 });
 
 function make(opts: Parameters<typeof createBroker>[0] = {}): Broker {
-  const b = createBroker(opts);
+  // A public address, so fetch tests are about fetch and not about DNS (#174).
+  const b = createBroker({ resolveImpl: async () => [{ address: "93.184.216.34" }], ...opts });
   brokers.push(b);
   return b;
 }
@@ -151,20 +152,70 @@ test("secrets resolve only when both bound and present", async () => {
   await expect(b.dispatch({ op: "secret.get", name: "UNBOUND" })).rejects.toThrow("not bound");
 });
 
-test("fetch is gated by the exact-host allowlist", async () => {
+test("fetch reaches any public host, with no allowlist (#174)", async () => {
   const calls: string[] = [];
   const fetchImpl: FetchLike = async (url) => {
     calls.push(String(url));
     return new Response("body", { status: 200, headers: { "x-mark": "1" } });
   };
-  const b = make({ bindings: { outbound: ["api.example.com"] }, fetchImpl });
-
-  await expect(b.dispatch({ op: "fetch", url: "https://evil.example.com/x" })).rejects.toThrow("allowlist");
-  expect(calls).toEqual([]);
+  const b = make({ fetchImpl });
 
+  await expect(b.dispatch({ op: "fetch", url: "ftp://api.example.com/x" })).rejects.toThrow("unsupported protocol");
   const res = await b.dispatch({ op: "fetch", url: "https://api.example.com/x" });
   expect(res).toMatchObject({ ok: true, status: 200, body: "body" });
-  expect(calls).toEqual(["https://api.example.com/x"]);
+  expect(calls).toEqual(["https://93.184.216.34/x"]);
+});
+
+test("#174: fetch never connects to a private address, whatever the name says", async () => {
+  const calls: string[] = [];
+  const fetchImpl: FetchLike = async (url) => {
+    calls.push(String(url));
+    return new Response("ok");
+  };
+  const resolving = (addresses: string[]) => async () => addresses.map((address) => ({ address }));
+
+  // A public-looking name that resolves somewhere private is refused before connect.
+  for (const address of ["127.0.0.1", "169.254.169.254", "10.0.0.7", "::1", "64:ff9b::7f00:1"]) {
+    const b = make({ fetchImpl, resolveImpl: resolving([address]), egressAllow: [] });
+    await expect(b.dispatch({ op: "fetch", url: "https://api.example.com/x" })).rejects.toThrow(
+      `api.example.com resolves to ${address}, a private or reserved address`,
+    );
+  }
+  expect(calls).toEqual([]);
+
+  // A mixed answer connects to the public address, not the first one.
+  const mixed = make({ fetchImpl, resolveImpl: resolving(["10.0.0.7", "2606:4700::1111"]), egressAllow: [] });
+  await mixed.dispatch({ op: "fetch", url: "https://api.example.com/x" });
+  expect(calls).toEqual(["https://[2606:4700::1111]/x"]);
+
+  // The operator, not the handler, can let one address through.
+  const allowed = make({ fetchImpl, resolveImpl: resolving(["10.0.0.7"]), egressAllow: ["10.0.0.7"] });
+  expect(await allowed.dispatch({ op: "fetch", url: "https://api.example.com/x" })).toMatchObject({ status: 200 });
+});
+
+test("#174: the pinned connection still sends the name as Host and verifies TLS against it", async () => {
+  const inits: RequestInit[] = [];
+  const fetchImpl: FetchLike = async (_url, init) => {
+    inits.push(init ?? {});
+    return new Response("ok");
+  };
+  const b = make({ fetchImpl });
+  await b.dispatch({ op: "fetch", url: "https://api.example.com/x" });
+  expect(new Headers(inits[0].headers).get("host")).toBe("api.example.com");
+  expect(inits[0]).toMatchObject({ tls: { serverName: "api.example.com" } });
+});
+
+test("#174: a real request reaches an allowed local upstream through the pinned address", async () => {
+  const upstream = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: (req) => new Response(req.headers.get("host")) });
+  try {
+    const host = `localhost:${upstream.port}`;
+    const b = make({ resolveImpl: undefined, egressAllow: ["127.0.0.1"] });
+    expect(await b.dispatch({ op: "fetch", url: `http://${host}/` })).toMatchObject({ status: 200, body: host });
+    const blocked = make({ resolveImpl: undefined, egressAllow: [] });
+    await expect(blocked.dispatch({ op: "fetch", url: `http://${host}/` })).rejects.toThrow("SB_EGRESS_ALLOW=");
+  } finally {
+    upstream.stop(true);
+  }
 });
 
 test("#232: a binary fetch request body is sent as its bytes, a text body as UTF-8", async () => {
@@ -173,7 +224,7 @@ test("#232: a binary fetch request body is sent as its bytes, a text body as UTF
     seen.push(new Uint8Array(await new Response(init?.body).arrayBuffer()));
     return new Response("ok");
   };
-  const b = make({ bindings: { outbound: ["api.example.com"] }, fetchImpl });
+  const b = make({ fetchImpl });
   // The runtime sends a binary body one char per byte, flagged bodyBinary.
   const raw = Array.from({ length: 256 }, (_, i) => String.fromCharCode(i)).join("");
   await b.dispatch({ op: "fetch", url: "https://api.example.com/up", method: "POST", body: raw, bodyBinary: true });
@@ -186,7 +237,7 @@ test("#232: a v1 fetch returns the upstream body as raw bytes; v0 keeps decoded
   const binary = Uint8Array.from({ length: 256 }, (_, i) => i);
   const fetchImpl: FetchLike = async (url) =>
     new Response(String(url).endsWith("/bin") ? binary : "café", { status: 200 });
-  const b = make({ bindings: { outbound: ["api.example.com"] }, fetchImpl });
+  const b = make({ fetchImpl });
 
   const raw = decodeV1Frame(
     await b.handleFrame(encodeV1({ v: 1, token: "tok", op: "fetch", url: "https://api.example.com/bin" })),
@@ -706,6 +757,40 @@ test("cronMatches: fields, steps, ranges, lists (UTC)", () => {
 // #74 — a binding wired to an account-level resource stores in its own file
 // under resourceDir, keyed by id, so the data outlives a "redeploy" (a new
 // broker with a fresh per-deployment db but the same resourceDir).
+test("#207: Durable Object storage and alarms in doDb outlive a redeploy", async () => {
+  const root = mkdtempSync(join(tmpdir(), "sb-broker-do-"));
+  try {
+    mkdirSync(join(root, "dep-a"), { recursive: true });
+    mkdirSync(join(root, "dep-b"), { recursive: true });
+    const doDb = join(root, "do_0123456789abcdef01234567.sqlite");
+    const bindings = { do: [{ binding: "COUNTER", className: "Counter" }] };
+
+    const first = createBroker({ db: join(root, "dep-a", "state.sqlite"), doDb, bindings });
+    await first.dispatch({ op: "do.storage.put", cls: "Counter", id: "global", key: "n", value: "41" });
+    await first.dispatch({ op: "do.alarm.set", cls: "Counter", id: "global", at: 1234 });
+    first.close();
+
+    // A redeploy: new per-deployment state.sqlite, same per-project doDb.
+    const second = createBroker({ db: join(root, "dep-b", "state.sqlite"), doDb, bindings });
+    expect(await second.dispatch({ op: "do.storage.get", cls: "Counter", id: "global", key: "n" })).toEqual({
+      ok: true,
+      found: true,
+      value: "41",
+    });
+    expect(await second.dispatch({ op: "do.alarm.get", cls: "Counter", id: "global" })).toMatchObject({ at: 1234 });
+    second.close();
+
+    // Without doDb the state stays per deployment, as before.
+    const third = createBroker({ db: join(root, "dep-a", "state.sqlite"), bindings });
+    expect(await third.dispatch({ op: "do.storage.get", cls: "Counter", id: "global", key: "n" })).toMatchObject({
+      found: false,
+    });
+    third.close();
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("resource-backed KV persists across brokers and is shared by id", async () => {
   const root = mkdtempSync(join(tmpdir(), "sb-broker-res-"));
   try {
@@ -1077,21 +1162,21 @@ test("service: declared but not deployed says so, instead of a bare 502", async
   );
 });
 
-test("service: a call is not subject to the outbound allowlist", async () => {
-  // The target is reached internally through the edge, so a project with no
-  // `outbound` hosts can still call a service binding.
+test("service: a call reaches the edge on loopback, which plain fetch() may not", async () => {
+  // The target is reached internally through the edge, so the private-address
+  // block (#174) does not apply to it.
   const fetchImpl: FetchLike = async () => new Response("ok", { status: 200 });
   const b = make({
-    bindings: { ...svcBindings, outbound: [] },
+    bindings: svcBindings,
     services: { AUTH: "auth-api.andrea.example.com" },
     edgeUrl: "http://127.0.0.1:8080/",
     fetchImpl,
+    resolveImpl: async () => [{ address: "127.0.0.1" }],
+    egressAllow: [],
   });
   expect((await b.dispatch({ op: "service.fetch", binding: "AUTH", url: "https://service/" })).status).toBe(200);
-  // ...while real egress to the same host is still refused.
-  await expect(b.dispatch({ op: "fetch", url: "https://auth-api.andrea.example.com/" })).rejects.toThrow(
-    /outbound allowlist/,
-  );
+  // ...while real egress to the same place is refused.
+  await expect(b.dispatch({ op: "fetch", url: "http://127.0.0.1:8080/" })).rejects.toThrow("private or reserved");
 });
 
 // --- v1 frames (#63) --------------------------------------------------------

package/src/broker.ts

@@ -13,9 +13,9 @@
  *   reply payload   : "<json>"
  *
  * ponytail: one SQLite file for KV, secrets from a plain JSON file, fetch
- * allowlisted by exact host. Encryption at rest, per-key TTLs, redirect
- * re-validation and private-IP blocking are v2 — the exact-host allowlist is
- * the only SSRF control today.
+ * to any public address, never a private one (#174).
+ * Encryption at rest and per-key TTLs are v2; redirects are never followed,
+ * so there is nothing to re-validate.
  */
 import { Database, type Statement } from "bun:sqlite";
 import { createHash, randomBytes } from "node:crypto";
@@ -24,13 +24,15 @@ import { open } from "node:fs/promises";
 import { dirname, join, normalize, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { resolveAssetKey, type AssetManifest } from "@sproutboat/assets";
+import { egressAllowList, egressRefusal } from "@sproutboat/runtime";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { isSafeInteger } from "./json";
 import { isBoolean, isString, jsonObject, parseJsonValue, type JsonObject, type JsonValue } from "./json";
 
 export type Bindings = {
   kv: string[];
   secrets: string[];
-  outbound: string[];
   d1: string[];
   r2: string[];
   queues: string[];
@@ -85,6 +87,12 @@ export type BrokerOptions = {
    * data outlives a redeploy.
    */
   resourceDir?: string;
+  /**
+   * #207 — SQLite file for Durable Object storage and alarms. The supervisor
+   * points this at a per-project path, so an object's state outlives a
+   * redeploy as it does on Workers. Defaults to the per-broker `db`.
+   */
+  doDb?: string;
   /** Account whose R2 resources this broker may mutate. */
   ownerId?: string;
   /** Account-wide R2 byte ceiling. Zero disables the ceiling for local development. */
@@ -111,6 +119,11 @@ export type BrokerOptions = {
   assetsDir?: string;
   /** Injected in tests; defaults to the global `fetch`. */
   fetchImpl?: FetchLike;
+  /** Injected in tests; defaults to `dns.lookup` with every address. */
+  resolveImpl?: (hostname: string) => Promise<Array<{ address: string }>>;
+  /** #174 — private addresses `fetch()` may reach anyway. Defaults to
+   *  `SB_EGRESS_ALLOW` (`*` or comma-separated exact addresses). */
+  egressAllow?: string[];
 };
 
 type SqlParam = string | number | null;
@@ -208,7 +221,6 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   const bindings: Bindings = {
     kv: [],
     secrets: [],
-    outbound: [],
     d1: [],
     r2: [],
     queues: [],
@@ -249,6 +261,8 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   const replayed = new Map<string, Frame>();
   const serviceHosts = opts.services ?? {};
   const doFetch = opts.fetchImpl ?? fetch;
+  const resolveHost = opts.resolveImpl ?? ((hostname: string) => lookup(hostname, { all: true }));
+  const egressAllow = opts.egressAllow ?? egressAllowList(process.env.SB_EGRESS_ALLOW);
 
   const dbPath = opts.db ?? ":memory:";
   const inMemory = dbPath === ":memory:" || dbPath === "";
@@ -312,9 +326,14 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   };
 
   const db = openStore(dbPath);
-  // Durable Object storage and Analytics Engine rows stay in the per-broker db —
-  // neither is an account-level resource (#74).
-  db.exec(
+  // #207 — Durable Object state lives in its own file when the supervisor gives
+  // one (per project, stable across deploys); otherwise in the per-broker db.
+  const doDb = opts.doDb ? new Database(opts.doDb, { create: true }) : db;
+  if (doDb !== db) {
+    doDb.exec("PRAGMA journal_mode = WAL");
+    doDb.exec("PRAGMA synchronous = NORMAL");
+  }
+  doDb.exec(
     "CREATE TABLE IF NOT EXISTS do_storage (cls TEXT NOT NULL, id TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, " +
       "PRIMARY KEY (cls, id, key))",
   );
@@ -324,12 +343,12 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   );
   // #125 — at most one pending alarm per object, which is the Workers rule: a
   // later setAlarm replaces the earlier one rather than queueing beside it.
-  db.exec(
+  doDb.exec(
     "CREATE TABLE IF NOT EXISTS do_alarm (cls TEXT NOT NULL, id TEXT NOT NULL, at INTEGER NOT NULL, " +
       "attempts INTEGER NOT NULL DEFAULT 0, PRIMARY KEY (cls, id))",
   );
   // Alarm polling reads the earliest due objects across classes.
-  db.exec("CREATE INDEX IF NOT EXISTS do_alarm_due ON do_alarm (at)");
+  doDb.exec("CREATE INDEX IF NOT EXISTS do_alarm_due ON do_alarm (at)");
   // #69 — fixed-window rate-limiter counters, per binding name + key.
   db.exec(
     "CREATE TABLE IF NOT EXISTS ratelimit (name TEXT NOT NULL, key TEXT NOT NULL, window_start INTEGER NOT NULL, " +
@@ -1118,7 +1137,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
    *
    * The size is the remote host's choice, and the body is held whole: measured
    * on a standalone binary, a 100 MB response took resident memory from 43 MB
-   * to 321 MB. One allowlisted upstream having a bad day should not be able to
+   * to 321 MB. One upstream having a bad day should not be able to
    * end the process. 32 MiB by default, and the same variable the embedded
    * transport reads so both backends agree.
    */
@@ -1168,7 +1187,6 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       throw new Error(`invalid url: ${str(msg.url)}`);
     }
     if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`unsupported protocol: ${url.protocol}`);
-    if (!bindings.outbound.includes(url.host)) throw new Error(`host not in outbound allowlist: ${url.host}`);
 
     const headers = new Headers();
     if (Array.isArray(msg.headers)) {
@@ -1176,13 +1194,37 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         if (Array.isArray(pair) && pair.length === 2) headers.set(str(pair[0]), str(pair[1]));
       }
     }
+    // #174 — resolve, vet every address, then connect to the vetted one, never
+    // the name: handing the name to fetch() would resolve it again, and DNS
+    // rebinding lives in that gap. TLS still verifies against the name.
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    let addresses: Array<{ address: string }>;
+    try {
+      addresses = await resolveHost(hostname);
+    } catch {
+      throw new Error(`could not resolve ${url.hostname}`);
+    }
+    let refusal: string | null = null;
+    const vetted = addresses.find(({ address }) => {
+      const why = egressRefusal(url.hostname, address, egressAllow);
+      refusal ??= why;
+      return why === null;
+    });
+    if (!vetted) throw new Error(refusal ?? `could not resolve ${url.hostname}`);
+    const pinned = new URL(url);
+    pinned.hostname = isIP(vetted.address) === 6 ? `[${vetted.address}]` : vetted.address;
+    headers.set("host", url.host);
+
     const method = str(msg.method || "GET").toUpperCase();
-    const res = await doFetch(url, {
+    const init: RequestInit & { tls?: { serverName: string } } = {
       method,
       headers,
       body: method === "GET" || method === "HEAD" ? undefined : upstreamBody(msg),
       redirect: "manual",
-    });
+    };
+    // Bun's TLS option: SNI and certificate checks against the name, not the address.
+    if (url.protocol === "https:" && !isIP(hostname)) init.tls = { serverName: hostname };
+    const res = await doFetch(pinned, init);
     const outHeaders: Array<[string, string]> = [];
     res.headers.forEach((v, k) => outHeaders.push([k, v]));
     return { reply: { ok: true, status: res.status, headers: outHeaders }, bytes: await readCapped(res, url.host) };
@@ -1564,7 +1606,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
 
       case "do.storage.get": {
         const cls = requireDoClass(msg.cls);
-        const row = db
+        const row = doDb
           .query<{ value: string }, [string, string, string]>(
             "SELECT value FROM do_storage WHERE cls = ? AND id = ? AND key = ?",
           )
@@ -1572,24 +1614,24 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         return row ? { ok: true, found: true, value: row.value } : { ok: true, found: false };
       }
       case "do.storage.put":
-        db.query(
+        doDb.query(
           "INSERT INTO do_storage (cls, id, key, value) VALUES (?1,?2,?3,?4) " +
             "ON CONFLICT (cls, id, key) DO UPDATE SET value = ?4",
         ).run(requireDoClass(msg.cls), str(msg.id), str(msg.key), str(msg.value));
         return { ok: true };
       case "do.storage.delete": {
-        const r = db
+        const r = doDb
           .query("DELETE FROM do_storage WHERE cls = ? AND id = ? AND key = ?")
           .run(requireDoClass(msg.cls), str(msg.id), str(msg.key));
         return { ok: true, deleted: r.changes > 0 };
       }
       case "do.storage.delete_all":
-        db.query("DELETE FROM do_storage WHERE cls = ? AND id = ?").run(requireDoClass(msg.cls), str(msg.id));
+        doDb.query("DELETE FROM do_storage WHERE cls = ? AND id = ?").run(requireDoClass(msg.cls), str(msg.id));
         return { ok: true };
       case "do.storage.list": {
         const cls = requireDoClass(msg.cls);
         const limit = Math.min(Math.max(Number(msg.limit) || 1000, 1), 10000);
-        const rows = db
+        const rows = doDb
           .query<{ key: string; value: string }, [string, string, string, number]>(
             "SELECT key, value FROM do_storage WHERE cls = ? AND id = ? AND key LIKE ? || '%' ORDER BY key LIMIT ?",
           )
@@ -1600,19 +1642,19 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       // #125 — alarms. `at` is epoch ms; setting one replaces any pending alarm
       // for that object, and attempts resets because this is a fresh schedule.
       case "do.alarm.set":
-        db.query(
+        doDb.query(
           "INSERT INTO do_alarm (cls, id, at, attempts) VALUES (?1,?2,?3,0) " +
             "ON CONFLICT (cls, id) DO UPDATE SET at = ?3, attempts = 0",
         ).run(requireDoClass(msg.cls), str(msg.id), Math.trunc(Number(msg.at) || 0));
         return { ok: true };
       case "do.alarm.get": {
-        const row = db
+        const row = doDb
           .query<{ at: number }, [string, string]>("SELECT at FROM do_alarm WHERE cls = ? AND id = ?")
           .get(requireDoClass(msg.cls), str(msg.id));
         return { ok: true, at: row ? row.at : null };
       }
       case "do.alarm.delete": {
-        const r = db.query("DELETE FROM do_alarm WHERE cls = ? AND id = ?").run(requireDoClass(msg.cls), str(msg.id));
+        const r = doDb.query("DELETE FROM do_alarm WHERE cls = ? AND id = ?").run(requireDoClass(msg.cls), str(msg.id));
         return { ok: true, deleted: r.changes > 0 };
       }
 
@@ -1930,14 +1972,14 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   function fireAlarmsOnce(): void {
     if (!opts.sproutUrl || !dispatchEnabled() || bindings.do.length === 0) return;
     const now = Date.now();
-    const due = db
+    const due = doDb
       .query<{ cls: string; id: string; at: number; attempts: number }, [number]>(
         "SELECT cls, id, at, attempts FROM do_alarm WHERE at <= ? ORDER BY at LIMIT 10",
       )
       .all(now);
     if (due.length === 0) return;
-    const claim = db.query("DELETE FROM do_alarm WHERE cls = ? AND id = ?");
-    const rearm = db.query(
+    const claim = doDb.query("DELETE FROM do_alarm WHERE cls = ? AND id = ?");
+    const rearm = doDb.query(
       "INSERT INTO do_alarm (cls, id, at, attempts) VALUES (?1,?2,?3,?4) ON CONFLICT (cls, id) DO NOTHING",
     );
     for (const row of due) {
@@ -1980,6 +2022,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       for (const t of timers) clearInterval(t);
       for (const conn of d1Conns.values()) conn.close();
       for (const conn of resourceDbs.values()) conn.close();
+      if (doDb !== db) doDb.close();
       db.close();
     },
   };
@@ -2086,6 +2129,7 @@ if (import.meta.main) {
       db: { type: "string" },
       "data-dir": { type: "string" },
       "resource-dir": { type: "string" },
+      "do-db": { type: "string" },
       "owner-id": { type: "string" },
       "r2-quota-bytes": { type: "string" },
       "r2-resource-ids": { type: "string" },
@@ -2138,6 +2182,7 @@ if (import.meta.main) {
     db: values.db,
     dataDir: values["data-dir"],
     resourceDir: values["resource-dir"],
+    doDb: values["do-db"],
     ownerId: values["owner-id"],
     r2QuotaBytes: Number(values["r2-quota-bytes"] ?? process.env.SPROUTBOAT_R2_QUOTA_BYTES) || undefined,
     r2ResourceIds: values["r2-resource-ids"] ? String(values["r2-resource-ids"]).split(",").filter(Boolean) : undefined,