v0.10.0

Highlights

• 🔐 HMAC Request Signing — Optional per-request HMAC-SHA256 signatures for replay protection. Enable with CF_D1_HMAC=true.
• 🛡️ Security: Worker auth upgraded to timing-safe comparison (crypto.subtle.timingSafeEqual).
• 📐 D1ConnectorInterface — New interface contract decouples code from Saloon implementation.
• ⚙️ Config merge fix — Credentials missing from user config now properly trigger validation errors.

⚠️ Breaking Changes

• accountId and apiUrl on CloudflareConnector changed from public to protected. Use getAccountId() accessor.
• D1PdoStatement::execute($params) now merges with previously bound values (matching real PDO behavior).
• Worker error responses return HTTP 500 for D1 execution failures instead of 200.

Added

• databaseExec() and databaseRaw() methods on CloudflareWorkerConnector
• Input validation on all Worker endpoints (HTTP 400 for malformed requests)
• d1_driver config validation
• HMAC_REQUIRED and HMAC_WINDOW_SECONDS Worker env vars for HMAC enforcement
• R/W Splitting now configurable via CF_D1_RW_SPLITTING=true env var (no more uncommenting config blocks)
• CHANGELOG.md following Keep a Changelog format

Changed

• Config merge simplified — only operational defaults merged; missing credentials trigger errors
• CircuitBreaker uses now()->timestamp for deterministic testability
• Test Worker rewritten to match production switch-based routing; removed itty-router
• README latency claims replaced with relative descriptions
• Cleaned up composer.json keywords

Removed

• printStarReminder() from D1ServiceProvider
• Legacy tests/database/factories/UserFactory.php
• Dead code in tests/Pest.php

Fixed

• ✅ Laravel 10 CI fully green — all command tests converted to $this->artisan()
• Circuit breaker test flakiness on slow CI runners
• Fix package:discover crash when other packages (e.g. spatie/permission) reference d1 connection during boot
• README npm run start → npm run dev
• autoload-dev trailing slash (PSR-4)