Cloudflare D1 Database Laravel Package

Added

• HMAC nonce support for Worker requests. Signed requests now include X-D1-Nonce and sign timestamp.nonce.body to make replay detection practical.
• Per-isolate Worker nonce tracking for HMAC replay detection, with timestamp-window pruning to avoid unbounded memory growth.
• Configurable D1 transaction behavior via transaction_mode / CF_D1_TRANSACTION_MODE, including silent, log, and exception modes.
• D1TransactionException for explicit transaction-usage failures when transaction_mode=exception.
• --strict support for d1:info, allowing CI workflows to fail when health checks fail.
• Session reset hooks for Worker connections in long-lived runtimes.
• Worker request body size limits and JSON parsing validation for malformed payloads.

Changed

• DB::transaction(), manual beginTransaction(), commit(), and rollBack() now consistently respect transaction_mode.
• transaction_mode=log now logs only once per connection/request to avoid noisy duplicate warnings during a single transaction lifecycle.
• commit() delegates to Laravel's parent commit lifecycle while keeping D1 commit behavior as a no-op.
• Query logger timing is reported in milliseconds.
• Schema dump and import upload paths now stream large SQL files instead of loading them fully into memory.
• Retry classification better detects retryable SELECT / WITH statements.
• HMAC and transaction documentation now reflects nonce signing, replay detection, and manual transaction method behavior.

Fixed

• Malformed JSON responses from D1 query, PDO, PDOStatement, batch, and query logger paths are normalized into typed driver errors instead of leaking raw JsonException in supported paths.
• Worker batch endpoints validate statement shape before preparing SQL.
• Query logger records malformed JSON responses as failed query logs without throwing.
• Circuit breaker failure accounting records one failure per call even when retries are involved.
• Required PDO extensions are declared in composer.json.

Added

• D1ConnectorInterface contract for type-hinting connectors without coupling to Saloon (#2)
• databaseExec() and databaseRaw() methods on CloudflareWorkerConnector (#12)
• Input validation on all Worker endpoints — returns HTTP 400 for malformed requests (#14)
• d1_driver config validation — throws InvalidArgumentException for invalid values (#19)
• HMAC request signing — optional CF_D1_HMAC=true config adds per-request HMAC-SHA256 signatures for replay protection (#30)
• Worker supports HMAC_REQUIRED and HMAC_WINDOW_SECONDS env vars for enforcement
• CHANGELOG.md following Keep a Changelog format (#42)

Changed

• SECURITY: Worker secret comparison now uses constant-time crypto.subtle.timingSafeEqual (#10)
• Worker error responses now return HTTP 500 for D1 execution failures instead of 200 (#13)
• $accountId and $apiUrl on CloudflareConnector changed from public to protected — use getAccountId() accessor (#9)
• D1PdoStatement::execute($params) now merges params with previously bound values (matching real PDO behavior) instead of replacing (#23)
• Replaced Cache facade with $this->app['cache'] in ServiceProvider for safer resolution (#21)
• Config merge simplified — only operational defaults are merged; credentials missing from user config now trigger validation errors (#4)
• CircuitBreaker uses now()->timestamp instead of time() for testability
• Test Worker rewritten to use switch-based routing matching production Worker; removed itty-router dependency (#15)
• README latency claims replaced with relative descriptions instead of specific ms ranges (#36)
• Cleaned up composer.json keywords — removed unrelated kv, r2, workers terms (#20)

Removed

• printStarReminder() method and star reminder behavior from D1ServiceProvider (#5)
• Legacy tests/database/factories/UserFactory.php (#7)
• Dead code in tests/Pest.php (toBeOne expectation, something() function) (#8)

Fixed

• Laravel 10 test compatibility — all command tests use $this->artisan() instead of BufferedOutput
• Circuit breaker test flakiness on slow CI runners — replaced sleep() with Carbon::setTestNow()
• README npm run start → npm run dev to match Worker package.json scripts (#37)
• README CONTRIBUTING.md link replaced with inline contribution note (#38)

Fixed

• Byte formatting constants updated for clarity and consistency

Added

• FormatsBytes trait for byte formatting utility
• D1 Export request refactored to consolidate dump options
• Time Travel feature: d1:time-travel command for point-in-time recovery
• D1ImportCommand for importing SQL files into D1
• D1InfoCommand for displaying database metadata and connection status
• Read/Write splitting support with sticky reads
• databaseInfo() and databaseImport() methods on REST connector

Added

• bulkInsert() column validation and name escaping
• Circuit breaker enable flag in configuration
• SQL dump download retry mechanism

Changed

• Streamlined D1ServiceProvider Worker connector handling

Added

• bulkInsert() method on D1Connection with D1 100-statement batch chunking
• Circuit breaker pattern for fault tolerance
• Query logger support on connectors
• D1 Sessions API support for Worker driver (read replication)

Added

• d1:schema-dump command for exporting D1 database schema
• d1:health command for connection diagnostics
• Batch query support via D1Connection::batch()
• Documentation for batch queries and circuit breaker

Added

• Worker driver (CloudflareWorkerConnector) for low-latency queries via Cloudflare Workers
• Worker template project in Worker/ directory
• Retry with exponential backoff and jitter (sendWithRetry)

Changed

• Minimum PHP version requirement: 8.2
• Improved exception handling in tests

Added

• D1SchemaGrammar with cross-version Laravel compatibility (10/11/12+)
• MapsSqlState trait for SQLSTATE error code mapping

Fixed

• compileTableExists compatibility with SQLiteGrammar

Added

• Initial release
• REST driver (CloudflareD1Connector) using Cloudflare D1 REST API via Saloon
• PDO extension pattern (D1Pdo, D1PdoStatement) for full Laravel compatibility
• Eloquent and Query Builder support
• Laravel 10/11/12 support, PHP 8.2+
• Transaction no-ops (D1 is stateless)
• Basic test suite with MockCloudflareD1Connector