@hot-updater/cloudflare 0.36.7 → 1.0.0-rc.0

package/dist/iac/index.cjs

@@ -29,7 +29,11 @@ fs_promises = __toESM(fs_promises);
 let path = require("path");
 path = __toESM(path);
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
+let _hot_updater_server = require("@hot-updater/server");
 let cloudflare = require("cloudflare");
+cloudflare = __toESM(cloudflare);
+let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
+let _hot_updater_plugin_core_internal = require("@hot-updater/plugin-core/internal");
 let node_url = require("node:url");
 let node_child_process = require("node:child_process");
 let node_string_decoder = require("node:string_decoder");
@@ -53,6 +57,895 @@ let node_buffer = require("node:buffer");
 let cloudflare_error = require("cloudflare/error");
 let os = require("os");
 os = __toESM(os);
+//#region src/d1Rows.ts
+var InvalidD1RowError = class extends Error {
+	name = "InvalidD1RowError";
+	model;
+	constructor(model) {
+		super(`D1 returned an invalid ${model} row`);
+		this.model = model;
+	}
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringValue = (row, field, model) => {
+	const value = row[field];
+	if (typeof value !== "string") throw new InvalidD1RowError(model);
+	return value;
+};
+const nullableString = (row, field, model) => {
+	const value = row[field];
+	if (value === null) return null;
+	if (typeof value !== "string") throw new InvalidD1RowError(model);
+	return value;
+};
+const numberValue = (row, field, model) => {
+	const value = row[field];
+	if (typeof value !== "number") throw new InvalidD1RowError(model);
+	return value;
+};
+const byteSizeValue = (row, field, model) => {
+	const value = row[field];
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new InvalidD1RowError(model);
+	return value;
+};
+const booleanValue = (row, field, model) => {
+	const value = row[field];
+	if (value === true || value === 1) return true;
+	if (value === false || value === 0) return false;
+	throw new InvalidD1RowError(model);
+};
+const jsonValue = (value, model) => {
+	if (typeof value !== "string") throw new InvalidD1RowError(model);
+	try {
+		return JSON.parse(value);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new InvalidD1RowError(model);
+		throw error;
+	}
+};
+const metadata = (row) => {
+	const value = jsonValue(row["metadata"], "bundles");
+	if (!(0, _hot_updater_plugin_core.isDatabaseMetadataObject)(value)) throw new InvalidD1RowError("bundles");
+	return value;
+};
+const bundleRow = (row) => {
+	const platform = stringValue(row, "platform", "bundles");
+	if (platform !== "ios" && platform !== "android") throw new InvalidD1RowError("bundles");
+	return {
+		id: stringValue(row, "id", "bundles"),
+		platform,
+		file_hash: stringValue(row, "file_hash", "bundles"),
+		git_commit_hash: nullableString(row, "git_commit_hash", "bundles"),
+		storage_uri: stringValue(row, "storage_uri", "bundles"),
+		archive_byte_size: row["archive_byte_size"] === void 0 ? 0 : byteSizeValue(row, "archive_byte_size", "bundles"),
+		metadata: metadata(row),
+		manifest_storage_uri: nullableString(row, "manifest_storage_uri", "bundles"),
+		manifest_file_hash: nullableString(row, "manifest_file_hash", "bundles"),
+		asset_base_storage_uri: nullableString(row, "asset_base_storage_uri", "bundles")
+	};
+};
+const patchRow = (row) => ({
+	id: stringValue(row, "id", "bundle_patches"),
+	bundle_id: stringValue(row, "bundle_id", "bundle_patches"),
+	base_bundle_id: stringValue(row, "base_bundle_id", "bundle_patches"),
+	base_file_hash: stringValue(row, "base_file_hash", "bundle_patches"),
+	patch_file_hash: stringValue(row, "patch_file_hash", "bundle_patches"),
+	patch_storage_uri: stringValue(row, "patch_storage_uri", "bundle_patches"),
+	byte_size: byteSizeValue(row, "byte_size", "bundle_patches"),
+	order_index: numberValue(row, "order_index", "bundle_patches")
+});
+const channelRow = (row) => ({
+	id: stringValue(row, "id", "channels"),
+	name: stringValue(row, "name", "channels")
+});
+const eventRow = (row) => {
+	const type = stringValue(row, "type", "bundle_events");
+	const platform = stringValue(row, "platform", "bundle_events");
+	const fromBundleId = nullableString(row, "from_bundle_id", "bundle_events");
+	const updateStrategy = nullableString(row, "update_strategy", "bundle_events");
+	if (platform !== "ios" && platform !== "android" || !((type === "UPDATE_APPLIED" || type === "RECOVERED" || type === "RELEASE_ADOPTED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null)) throw new InvalidD1RowError("bundle_events");
+	return {
+		id: stringValue(row, "id", "bundle_events"),
+		type,
+		install_id: stringValue(row, "install_id", "bundle_events"),
+		user_id: nullableString(row, "user_id", "bundle_events"),
+		username: nullableString(row, "username", "bundle_events"),
+		from_release_id: nullableString(row, "from_release_id", "bundle_events"),
+		from_bundle_id: fromBundleId,
+		to_release_id: nullableString(row, "to_release_id", "bundle_events"),
+		to_bundle_id: stringValue(row, "to_bundle_id", "bundle_events"),
+		platform,
+		app_version: stringValue(row, "app_version", "bundle_events"),
+		channel: stringValue(row, "channel", "bundle_events"),
+		cohort: stringValue(row, "cohort", "bundle_events"),
+		update_strategy: updateStrategy,
+		fingerprint_hash: nullableString(row, "fingerprint_hash", "bundle_events"),
+		sdk_version: nullableString(row, "sdk_version", "bundle_events"),
+		received_at_ms: numberValue(row, "received_at_ms", "bundle_events")
+	};
+};
+const apiKeyRow = (row) => {
+	const role = stringValue(row, "role", "api_keys");
+	if (role !== "client") throw new InvalidD1RowError("api_keys");
+	const revokedAt = row["revoked_at_ms"];
+	return {
+		id: stringValue(row, "id", "api_keys"),
+		hash: stringValue(row, "hash", "api_keys"),
+		name: stringValue(row, "name", "api_keys"),
+		prefix: stringValue(row, "prefix", "api_keys"),
+		role,
+		created_at_ms: numberValue(row, "created_at_ms", "api_keys"),
+		revoked_at_ms: revokedAt === null ? null : numberValue(row, "revoked_at_ms", "api_keys")
+	};
+};
+const releaseTargetCohorts = (row) => {
+	const value = jsonValue(row["target_cohorts"], "releases");
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new InvalidD1RowError("releases");
+	return value.filter((item) => typeof item === "string");
+};
+const releaseRow = (row) => {
+	const platform = stringValue(row, "platform", "releases");
+	const kind = stringValue(row, "kind", "releases");
+	const strategy = stringValue(row, "strategy", "releases");
+	const operation = stringValue(row, "operation", "releases");
+	if (platform !== "ios" && platform !== "android" || kind !== "BUNDLE" && kind !== "EMBEDDED" || strategy !== "APP_VERSION" && strategy !== "FINGERPRINT" || operation !== "DEPLOY" && operation !== "PROMOTE" && operation !== "ROLLBACK") throw new InvalidD1RowError("releases");
+	return {
+		id: stringValue(row, "id", "releases"),
+		revision: numberValue(row, "revision", "releases"),
+		scope_key: stringValue(row, "scope_key", "releases"),
+		channel_id: stringValue(row, "channel_id", "releases"),
+		platform,
+		kind,
+		bundle_id: nullableString(row, "bundle_id", "releases"),
+		strategy,
+		target_app_version: nullableString(row, "target_app_version", "releases"),
+		fingerprint_hash: nullableString(row, "fingerprint_hash", "releases"),
+		enabled: booleanValue(row, "enabled", "releases"),
+		should_force_update: booleanValue(row, "should_force_update", "releases"),
+		message: nullableString(row, "message", "releases"),
+		rollout_cohort_count: numberValue(row, "rollout_cohort_count", "releases"),
+		target_cohorts: releaseTargetCohorts(row),
+		operation,
+		source_release_id: nullableString(row, "source_release_id", "releases"),
+		created_at_ms: numberValue(row, "created_at_ms", "releases"),
+		updated_at_ms: numberValue(row, "updated_at_ms", "releases")
+	};
+};
+const releaseCatalogRow = (row) => {
+	const platform = stringValue(row, "platform", "release_catalogs");
+	const strategy = stringValue(row, "strategy", "release_catalogs");
+	if (platform !== "ios" && platform !== "android" || strategy !== "APP_VERSION" && strategy !== "FINGERPRINT") throw new InvalidD1RowError("release_catalogs");
+	return {
+		scope_key: stringValue(row, "scope_key", "release_catalogs"),
+		catalog_id: stringValue(row, "catalog_id", "release_catalogs"),
+		strategy,
+		channel_id: stringValue(row, "channel_id", "release_catalogs"),
+		channel_key: stringValue(row, "channel_key", "release_catalogs"),
+		platform,
+		fingerprint_hash: nullableString(row, "fingerprint_hash", "release_catalogs"),
+		generation: numberValue(row, "generation", "release_catalogs"),
+		payload: stringValue(row, "payload", "release_catalogs"),
+		catalog_hash: stringValue(row, "catalog_hash", "release_catalogs"),
+		byte_size: numberValue(row, "byte_size", "release_catalogs"),
+		is_tombstone: booleanValue(row, "is_tombstone", "release_catalogs"),
+		updated_at_ms: numberValue(row, "updated_at_ms", "release_catalogs")
+	};
+};
+function parseD1Row(model, value) {
+	if (!isRecord(value)) throw new InvalidD1RowError(model);
+	switch (model) {
+		case "bundles": return bundleRow(value);
+		case "bundle_patches": return patchRow(value);
+		case "channels": return channelRow(value);
+		case "bundle_events": return eventRow(value);
+		case "api_keys": return apiKeyRow(value);
+		case "releases": return releaseRow(value);
+		case "release_catalogs": return releaseCatalogRow(value);
+	}
+}
+//#endregion
+//#region src/d1Sql.ts
+var InvalidD1PredicateError = class extends Error {
+	name = "InvalidD1PredicateError";
+};
+const encodeD1Value = (value) => {
+	const encoded = JSON.stringify(value);
+	if (encoded === void 0) throw new TypeError("D1 values must be JSON-serializable.");
+	return encoded;
+};
+const bind = (value) => ({
+	sql: "json_extract(?, '$')",
+	params: [encodeD1Value(value)]
+});
+const escapeLikePattern = (value) => value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+const stringPredicate = (condition, operator) => {
+	if (typeof condition.value !== "string") throw new InvalidD1PredicateError();
+	if (condition.mode !== "insensitive") {
+		const parameter = bind(condition.value);
+		const column = `${condition.field} COLLATE BINARY`;
+		const value = `${parameter.sql} COLLATE BINARY`;
+		if (operator === "contains" || operator === "starts_with") return {
+			sql: `instr(${column}, ${value}) ${operator === "contains" ? "> 0" : "= 1"}`,
+			params: parameter.params
+		};
+		return {
+			sql: `substr(${column}, length(${condition.field}) - length(${parameter.sql}) + 1) = ${value}`,
+			params: [...parameter.params, ...parameter.params]
+		};
+	}
+	const literal = escapeLikePattern(condition.value);
+	const parameter = bind(operator === "contains" ? `%${literal}%` : operator === "starts_with" ? `${literal}%` : `%${literal}`);
+	return {
+		sql: `lower(${condition.field}) LIKE lower(${parameter.sql}) ESCAPE '\\'`,
+		params: parameter.params
+	};
+};
+const predicate = (condition) => {
+	const operator = condition.operator ?? "eq";
+	switch (operator) {
+		case "eq":
+		case "ne": {
+			if (condition.value === null) return {
+				sql: `${condition.field} IS ${operator === "ne" ? "NOT " : ""}NULL`,
+				params: []
+			};
+			const parameter = bind(condition.value);
+			const insensitive = "mode" in condition && condition.mode === "insensitive";
+			const column = insensitive ? `lower(${condition.field})` : condition.field;
+			const value = insensitive ? `lower(${parameter.sql})` : parameter.sql;
+			return {
+				sql: `${column} ${operator === "eq" ? "=" : "<>"} ${value}`,
+				params: parameter.params
+			};
+		}
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const sqlOperator = {
+				gt: ">",
+				gte: ">=",
+				lt: "<",
+				lte: "<="
+			}[operator];
+			const parameter = bind(condition.value);
+			return {
+				sql: `${condition.field} ${sqlOperator} ${parameter.sql}`,
+				params: parameter.params
+			};
+		}
+		case "in":
+		case "not_in":
+			if (!Array.isArray(condition.value)) throw new InvalidD1PredicateError();
+			if (condition.value.length === 0) return {
+				sql: operator === "not_in" ? "1 = 1" : "1 = 0",
+				params: []
+			};
+			return {
+				sql: `${condition.field} ${operator === "not_in" ? "NOT " : ""}IN (SELECT value FROM json_each(?))`,
+				params: [encodeD1Value(condition.value)]
+			};
+		case "contains":
+		case "starts_with":
+		case "ends_with": return stringPredicate(condition, operator);
+	}
+};
+const buildD1Where = (where) => {
+	const [first, ...rest] = where ?? [];
+	if (first === void 0) return {
+		sql: "",
+		params: []
+	};
+	const initial = predicate(first);
+	let sql = initial.sql;
+	const params = [...initial.params];
+	for (const condition of rest) {
+		const next = predicate(condition);
+		sql = `(${sql} ${condition.connector === "OR" ? "OR" : "AND"} ${next.sql})`;
+		params.push(...next.params);
+	}
+	return {
+		sql: ` WHERE ${sql}`,
+		params
+	};
+};
+const buildD1Order = (orderBy) => orderBy === void 0 ? "" : ` ORDER BY ${orderBy.map((clause) => `${clause.field} ${clause.direction.toUpperCase()}${clause.nulls ? ` NULLS ${clause.nulls.toUpperCase()}` : ""}`).join(", ")}`;
+const d1Placeholders = (count) => Array.from({ length: count }, () => "json_extract(?, '$')").join(", ");
+const encodeD1Values = (values) => values.map(encodeD1Value);
+//#endregion
+//#region src/d1Query.ts
+const d1TableNames = {
+	bundles: "bundles",
+	bundle_patches: "bundle_patches",
+	channels: "channels",
+	bundle_events: "bundle_events",
+	api_keys: "api_keys",
+	release_catalogs: "release_catalogs",
+	releases: "releases"
+};
+var D1QueryResultError = class extends Error {
+	name = "D1QueryResultError";
+	operation = "count";
+	constructor(result) {
+		super("D1 count query returned a malformed first row");
+		this.result = result;
+	}
+};
+const countD1Rows = async (executor, input) => {
+	const where = buildD1Where(input.where);
+	const table = d1TableNames[input.model];
+	const source = input.distinct === void 0 ? `${table}${where.sql}` : `(SELECT DISTINCT ${input.distinct.join(", ")} FROM ${table}${where.sql}) AS distinct_rows`;
+	const row = (await executor.query(`SELECT COUNT(*) AS count FROM ${source}`, where.params))[0];
+	if (typeof row !== "object" || row === null || Array.isArray(row)) throw new D1QueryResultError(row);
+	const count = Reflect.get(row, "count");
+	if (typeof count !== "number" || !Number.isFinite(count)) throw new D1QueryResultError(row);
+	return count;
+};
+const findManyD1Rows = async (executor, input) => {
+	const where = buildD1Where(input.where);
+	const orderBy = input.orderBy;
+	const order = buildD1Order(orderBy);
+	const table = d1TableNames[input.model];
+	const source = input.distinctOn === void 0 ? `SELECT * FROM ${table}${where.sql}${order}` : `SELECT * FROM (SELECT *, ROW_NUMBER() OVER (PARTITION BY ${input.distinctOn.fields.join(", ")}${order}) AS __hot_updater_rank FROM ${table}${where.sql}) AS distinct_rows WHERE __hot_updater_rank = 1${order}`;
+	const pageParams = encodeD1Values([input.limit, input.offset]);
+	const rows = await executor.query(`${source} LIMIT json_extract(?, '$') OFFSET json_extract(?, '$')`, [...where.params, ...pageParams]);
+	switch (input.model) {
+		case "bundles": return rows.map((row) => parseD1Row("bundles", row));
+		case "bundle_patches": return rows.map((row) => parseD1Row("bundle_patches", row));
+		case "channels": return rows.map((row) => parseD1Row("channels", row));
+		case "bundle_events": return rows.map((row) => parseD1Row("bundle_events", row));
+		case "api_keys": return rows.map((row) => parseD1Row("api_keys", row));
+		case "releases": return rows.map((row) => parseD1Row("releases", row));
+		case "release_catalogs": return rows.map((row) => parseD1Row("release_catalogs", row));
+	}
+};
+//#endregion
+//#region src/d1Implementation.ts
+const EXPECTATION_CONFLICT_MARKER = "HOT_UPDATER_COMMIT_EXPECTATION_CONFLICT";
+const expectationGuard = (expectations) => {
+	const clauses = [];
+	const params = [];
+	for (const expectation of expectations) {
+		const isRelease = expectation.model === "releases";
+		const table = isRelease ? "releases" : "release_catalogs";
+		const keyField = isRelease ? "id" : "scope_key";
+		const versionField = isRelease ? "revision" : "generation";
+		const key = isRelease ? expectation.id : expectation.scopeKey;
+		const version = isRelease ? expectation.revision : expectation.generation;
+		if (version === null) {
+			clauses.push(`NOT EXISTS (SELECT 1 FROM ${table} WHERE ${keyField} = json_extract(?, '$'))`);
+			params.push(...encodeD1Values([key]));
+		} else {
+			clauses.push(`EXISTS (SELECT 1 FROM ${table} WHERE ${keyField} = json_extract(?, '$') AND ${versionField} = json_extract(?, '$'))`);
+			params.push(...encodeD1Values([key, version]));
+		}
+	}
+	return {
+		sql: clauses.join(" AND ") || "1",
+		params
+	};
+};
+const readVersion = (row, field) => {
+	if (typeof row !== "object" || row === null) return null;
+	const value = Reflect.get(row, field);
+	return typeof value === "number" ? value : null;
+};
+const expectationConflict = async (executor, expectations) => {
+	for (const expectation of expectations) {
+		const isRelease = expectation.model === "releases";
+		const table = isRelease ? "releases" : "release_catalogs";
+		const keyField = isRelease ? "id" : "scope_key";
+		const versionField = isRelease ? "revision" : "generation";
+		const key = isRelease ? expectation.id : expectation.scopeKey;
+		const expectedVersion = isRelease ? expectation.revision : expectation.generation;
+		const actualVersion = readVersion((await executor.query(`SELECT ${versionField} FROM ${table} WHERE ${keyField} = json_extract(?, '$') LIMIT 1`, encodeD1Values([key])))[0], versionField);
+		if (actualVersion !== expectedVersion) return {
+			committed: false,
+			conflict: {
+				actualVersion,
+				changeIndex: -1,
+				expectedVersion,
+				key,
+				model: expectation.model,
+				reason: "version_conflict"
+			}
+		};
+	}
+	return null;
+};
+const isExpectationConflictError = (error) => {
+	const message = error instanceof Error ? error.message : String(error);
+	return message.includes(EXPECTATION_CONFLICT_MARKER) || message.toLowerCase().includes("malformed json");
+};
+const bundleValues = (row) => [
+	row.id,
+	row.platform,
+	row.file_hash,
+	row.git_commit_hash,
+	row.storage_uri,
+	row.archive_byte_size,
+	row.metadata,
+	row.manifest_storage_uri,
+	row.manifest_file_hash,
+	row.asset_base_storage_uri
+];
+const patchValues = (row) => [
+	row.id,
+	row.bundle_id,
+	row.base_bundle_id,
+	row.base_file_hash,
+	row.patch_file_hash,
+	row.patch_storage_uri,
+	row.byte_size,
+	row.order_index
+];
+const channelValues = (row) => [row.id, row.name];
+const insertQuery = (input, guard, conflictMode = "returnExisting") => {
+	let columns;
+	let values;
+	switch (input.model) {
+		case "bundles":
+			columns = [
+				"id",
+				"platform",
+				"file_hash",
+				"git_commit_hash",
+				"storage_uri",
+				"archive_byte_size",
+				"metadata",
+				"manifest_storage_uri",
+				"manifest_file_hash",
+				"asset_base_storage_uri"
+			];
+			values = bundleValues(input.data);
+			break;
+		case "bundle_patches":
+			columns = [
+				"id",
+				"bundle_id",
+				"base_bundle_id",
+				"base_file_hash",
+				"patch_file_hash",
+				"patch_storage_uri",
+				"byte_size",
+				"order_index"
+			];
+			values = patchValues(input.data);
+			break;
+		case "channels":
+			columns = ["id", "name"];
+			values = channelValues(input.data);
+			break;
+		case "bundle_events":
+		case "api_keys":
+		case "release_catalogs":
+		case "releases":
+			columns = Object.keys(input.data);
+			values = Object.values(input.data);
+			break;
+	}
+	const conflict = input.onConflict !== "ignore" ? "" : input.model === "channels" ? conflictMode === "ignore" ? " ON CONFLICT(name) DO NOTHING" : " ON CONFLICT(name) DO UPDATE SET name = excluded.name" : input.model === "api_keys" ? conflictMode === "ignore" ? " ON CONFLICT(hash) DO NOTHING" : " ON CONFLICT(hash) DO UPDATE SET hash = excluded.hash" : "";
+	return {
+		sql: `INSERT INTO ${d1TableNames[input.model]} (${columns.join(", ")}) ${guard === void 0 ? `VALUES (${d1Placeholders(values.length)})` : `SELECT ${d1Placeholders(values.length)} WHERE ${guard.sql}`}${conflict} RETURNING *`,
+		params: [...encodeD1Values(values), ...guard?.params ?? []]
+	};
+};
+const updateEntries = (update) => Object.entries(update);
+const updateQuery = (input, guard) => {
+	const entries = updateEntries(input.update);
+	const where = buildD1Where(input.where);
+	if (entries.length === 0) return {
+		sql: `SELECT * FROM ${d1TableNames[input.model]}${where.sql}${guard ? ` AND ${guard.sql}` : ""} LIMIT 1`,
+		params: [...where.params, ...guard?.params ?? []]
+	};
+	const assignments = entries.map(([field]) => `${field} = json_extract(?, '$')`).join(", ");
+	return {
+		sql: `UPDATE ${d1TableNames[input.model]} SET ${assignments}${where.sql}${guard ? ` AND ${guard.sql}` : ""} RETURNING *`,
+		params: [
+			...encodeD1Values(entries.map(([, value]) => value)),
+			...where.params,
+			...guard?.params ?? []
+		]
+	};
+};
+const deleteQuery = (input, guard) => {
+	const where = buildD1Where(input.where);
+	return {
+		sql: `DELETE FROM ${d1TableNames[input.model]}${where.sql}${guard ? ` AND ${guard.sql}` : ""}`,
+		params: [...where.params, ...guard?.params ?? []]
+	};
+};
+const insertedKey = (change) => {
+	if (change.operation !== "insert") return void 0;
+	if (change.model === "bundles") return `bundles:${change.row.id}`;
+	if (change.model === "apiKeys") return `api_keys:${change.row.id}`;
+	if (change.model === "releases") return `releases:${change.row.id}`;
+};
+const requiredRow = (change, changeIndex) => {
+	if (change.operation !== "update") return void 0;
+	if (change.model === "bundles") return {
+		model: "bundles",
+		id: change.where.id,
+		changeIndex
+	};
+	if (change.model === "apiKeys") return {
+		model: "api_keys",
+		id: change.where.id,
+		changeIndex
+	};
+	if (change.model === "releases") return {
+		model: "releases",
+		id: change.where.id,
+		changeIndex
+	};
+};
+const channelDeletePrecondition = (changes, changeIndex, channelId) => {
+	const releaseEffects = /* @__PURE__ */ new Map();
+	for (const change of changes.slice(0, changeIndex)) {
+		if (change.model !== "releases") continue;
+		switch (change.operation) {
+			case "insert":
+				releaseEffects.set(change.row.id, change.row.channel_id);
+				break;
+			case "update": break;
+			case "delete":
+				releaseEffects.set(change.where.id, null);
+				break;
+		}
+	}
+	return {
+		id: channelId,
+		excludedReleaseIds: [...releaseEffects.keys()],
+		addedReferenceReleaseIds: [...releaseEffects].filter(([, finalChannelId]) => finalChannelId === channelId).map(([releaseId]) => releaseId)
+	};
+};
+const changeQuery = (change, guard) => {
+	switch (change.model) {
+		case "bundles": switch (change.operation) {
+			case "insert": return insertQuery({
+				model: "bundles",
+				data: change.row
+			}, guard);
+			case "update": return updateQuery({
+				model: "bundles",
+				where: [{
+					field: "id",
+					value: change.where.id
+				}],
+				update: change.update
+			}, guard);
+			case "delete": return deleteQuery({
+				model: "bundles",
+				where: [{
+					field: "id",
+					value: change.where.id
+				}]
+			}, guard);
+		}
+		case "bundlePatches": return change.operation === "insert" ? insertQuery({
+			model: "bundle_patches",
+			data: change.row
+		}, guard) : deleteQuery({
+			model: "bundle_patches",
+			where: [{
+				field: "bundle_id",
+				value: change.where.bundleId
+			}]
+		}, guard);
+		case "releases": switch (change.operation) {
+			case "insert": return insertQuery({
+				model: "releases",
+				data: change.row
+			}, guard);
+			case "update": return updateQuery({
+				model: "releases",
+				where: [{
+					field: "id",
+					value: change.where.id
+				}],
+				update: change.update
+			}, guard);
+			case "delete": return deleteQuery({
+				model: "releases",
+				where: [{
+					field: "id",
+					value: change.where.id
+				}]
+			}, guard);
+		}
+		case "releaseCatalogs": return {
+			sql: `INSERT INTO release_catalogs (${Object.keys(change.row).join(", ")}) SELECT ${d1Placeholders(Object.keys(change.row).length)} WHERE ${guard.sql} ON CONFLICT(scope_key) DO UPDATE SET ${Object.keys(change.row).filter((field) => field !== "scope_key").map((field) => `${field} = excluded.${field}`).join(", ")} RETURNING *`,
+			params: [...encodeD1Values(Object.values(change.row)), ...guard.params]
+		};
+		case "channels": return change.operation === "insert" ? insertQuery({
+			model: "channels",
+			data: change.row,
+			onConflict: change.onConflict
+		}, guard, "ignore") : {
+			sql: `DELETE FROM channels WHERE id = json_extract(?, '$') AND NOT EXISTS (SELECT 1 FROM releases WHERE channel_id = json_extract(?, '$')) AND ${guard.sql}`,
+			params: [...encodeD1Values([change.where.id, change.where.id]), ...guard.params]
+		};
+		case "analytics": return insertQuery({
+			model: "bundle_events",
+			data: change.row
+		}, guard);
+		case "apiKeys": return change.operation === "insert" ? insertQuery({
+			model: "api_keys",
+			data: change.row,
+			onConflict: change.onConflict
+		}, guard, "ignore") : updateQuery({
+			model: "api_keys",
+			where: [{
+				field: "id",
+				value: change.where.id
+			}],
+			update: { revoked_at_ms: change.update.revokedAtMs }
+		}, guard);
+	}
+};
+const createCommitPlan = (input) => {
+	const checks = [];
+	const statements = [];
+	const expectations = input.expectations ?? [];
+	if (expectations.length > 0) {
+		const guard = expectationGuard(expectations);
+		statements.push({
+			sql: `SELECT CASE WHEN ${guard.sql} THEN 1 ELSE json_extract('${EXPECTATION_CONFLICT_MARKER}', '$') END AS expectation_guard`,
+			params: guard.params
+		});
+	}
+	const requiredRows = [];
+	const channelDeletes = [];
+	const inserted = /* @__PURE__ */ new Set();
+	for (const [changeIndex, change] of input.changes.entries()) {
+		const required = requiredRow(change, changeIndex);
+		if (required !== void 0) {
+			if (!inserted.has(`${required.model}:${required.id}`)) {
+				requiredRows.push(required);
+				checks.push({
+					changeIndex,
+					resultIndex: statements.length,
+					conflictWhen: "empty",
+					reason: "not_found"
+				});
+				statements.push({
+					sql: `SELECT id FROM ${d1TableNames[required.model]} WHERE id = json_extract(?, '$') LIMIT 1`,
+					params: encodeD1Values([required.id])
+				});
+			}
+		}
+		if (change.model === "channels" && change.operation === "delete") {
+			const precondition = channelDeletePrecondition(input.changes, changeIndex, change.where.id);
+			channelDeletes.push(precondition);
+			checks.push({
+				changeIndex,
+				resultIndex: statements.length,
+				conflictWhen: "nonempty",
+				reason: "referenced"
+			});
+			statements.push({
+				sql: "SELECT id FROM releases WHERE channel_id = json_extract(?, '$') AND id NOT IN (SELECT value FROM json_each(?)) UNION ALL SELECT value AS id FROM json_each(?) LIMIT 1",
+				params: encodeD1Values([
+					precondition.id,
+					precondition.excludedReleaseIds,
+					precondition.addedReferenceReleaseIds
+				])
+			});
+		}
+		const key = insertedKey(change);
+		if (key !== void 0) inserted.add(key);
+	}
+	const guard = {
+		sql: `NOT EXISTS (
+      SELECT 1 FROM json_each(?) AS required
+      WHERE NOT EXISTS (
+        SELECT 1 FROM bundles
+        WHERE json_extract(required.value, '$.model') = 'bundles'
+          AND bundles.id = json_extract(required.value, '$.id')
+        UNION ALL
+        SELECT 1 FROM api_keys
+        WHERE json_extract(required.value, '$.model') = 'api_keys'
+          AND api_keys.id = json_extract(required.value, '$.id')
+        UNION ALL
+        SELECT 1 FROM channels
+        WHERE json_extract(required.value, '$.model') = 'channels'
+          AND channels.id = json_extract(required.value, '$.id')
+        UNION ALL
+        SELECT 1 FROM releases
+        WHERE json_extract(required.value, '$.model') = 'releases'
+          AND releases.id = json_extract(required.value, '$.id')
+      )
+    ) AND NOT EXISTS (
+      SELECT 1 FROM json_each(?) AS channel_delete
+      WHERE EXISTS (
+        SELECT 1 FROM releases
+        WHERE releases.channel_id = json_extract(channel_delete.value, '$.id')
+          AND releases.id NOT IN (
+            SELECT value FROM json_each(
+              json_extract(channel_delete.value, '$.excludedReleaseIds')
+            )
+          )
+        UNION ALL
+        SELECT value FROM json_each(
+          json_extract(channel_delete.value, '$.addedReferenceReleaseIds')
+        )
+      )
+    )`,
+		params: encodeD1Values([requiredRows.map(({ model, id }) => ({
+			model,
+			id
+		})), channelDeletes])
+	};
+	statements.push(...input.changes.map((change) => changeQuery(change, guard)));
+	return {
+		checks,
+		statements
+	};
+};
+const resultForPlan = (plan, results) => {
+	const missing = plan.checks.find(({ conflictWhen, resultIndex }) => conflictWhen === "empty" ? (results[resultIndex]?.length ?? 0) === 0 : (results[resultIndex]?.length ?? 0) > 0);
+	return missing === void 0 ? { committed: true } : {
+		committed: false,
+		conflict: {
+			changeIndex: missing.changeIndex,
+			reason: missing.reason
+		}
+	};
+};
+const insertChannel = async (executor, input) => {
+	const insert = insertQuery({
+		model: "channels",
+		data: input.row,
+		onConflict: "ignore"
+	}, void 0, "ignore");
+	const select = {
+		sql: "SELECT id, name FROM channels WHERE name = json_extract(?, '$') LIMIT 1",
+		params: encodeD1Values([input.row.name])
+	};
+	const [insertedRows = [], canonicalRows = []] = await executor.batch([insert, select]);
+	return {
+		row: parseD1Row("channels", canonicalRows[0]),
+		inserted: insertedRows.length > 0
+	};
+};
+const deleteChannel = async (executor, input) => {
+	const [channelRows = [], referenceRows = [], deletedRows = []] = await executor.batch([
+		{
+			sql: "SELECT id FROM channels WHERE id = json_extract(?, '$') LIMIT 1",
+			params: encodeD1Values([input.id])
+		},
+		{
+			sql: "SELECT id FROM releases WHERE channel_id = json_extract(?, '$') LIMIT 1",
+			params: encodeD1Values([input.id])
+		},
+		{
+			sql: "DELETE FROM channels WHERE id = json_extract(?, '$') AND NOT EXISTS (SELECT 1 FROM releases WHERE channel_id = json_extract(?, '$')) RETURNING id",
+			params: encodeD1Values([input.id, input.id])
+		}
+	]);
+	if (channelRows.length === 0) return {
+		deleted: false,
+		reason: "not_found"
+	};
+	if (referenceRows.length > 0) return {
+		deleted: false,
+		reason: "not_empty"
+	};
+	return deletedRows.length > 0 ? { deleted: true } : {
+		deleted: false,
+		reason: "not_empty"
+	};
+};
+const createD1Implementation = (executor) => ({
+	async create(input) {
+		const query = insertQuery(input);
+		const rows = await executor.query(query.sql, query.params);
+		switch (input.model) {
+			case "bundles": return parseD1Row("bundles", rows[0]);
+			case "bundle_patches": return parseD1Row("bundle_patches", rows[0]);
+			case "channels": return parseD1Row("channels", rows[0]);
+			case "bundle_events": return parseD1Row("bundle_events", rows[0]);
+			case "api_keys": return parseD1Row("api_keys", rows[0]);
+			case "releases": return parseD1Row("releases", rows[0]);
+			case "release_catalogs": return parseD1Row("release_catalogs", rows[0]);
+		}
+	},
+	async update(input) {
+		const query = updateQuery(input);
+		const rows = await executor.query(query.sql, query.params);
+		if (rows[0] === void 0) return null;
+		switch (input.model) {
+			case "bundles": return parseD1Row("bundles", rows[0]);
+			case "api_keys": return parseD1Row("api_keys", rows[0]);
+			case "releases": return parseD1Row("releases", rows[0]);
+			case "release_catalogs": return parseD1Row("release_catalogs", rows[0]);
+		}
+	},
+	async delete(input) {
+		const query = deleteQuery(input);
+		await executor.query(query.sql, query.params);
+	},
+	count: (input) => countD1Rows(executor, input),
+	async findOne(input) {
+		const where = buildD1Where(input.where);
+		const rows = await executor.query(`SELECT * FROM ${d1TableNames[input.model]}${where.sql} LIMIT 1`, where.params);
+		if (rows[0] === void 0) return null;
+		switch (input.model) {
+			case "bundles": return parseD1Row("bundles", rows[0]);
+			case "bundle_patches": return parseD1Row("bundle_patches", rows[0]);
+			case "channels": return parseD1Row("channels", rows[0]);
+			case "api_keys": return parseD1Row("api_keys", rows[0]);
+			case "releases": return parseD1Row("releases", rows[0]);
+			case "release_catalogs": return parseD1Row("release_catalogs", rows[0]);
+		}
+	},
+	findMany: (input) => findManyD1Rows(executor, input),
+	insertChannel: (input) => insertChannel(executor, input),
+	deleteChannel: (input) => deleteChannel(executor, input),
+	async commit(input) {
+		if (input.changes.length === 0) return { committed: true };
+		const expectations = input.expectations ?? [];
+		const conflict = await expectationConflict(executor, expectations);
+		if (conflict !== null) return conflict;
+		const plan = createCommitPlan(input);
+		try {
+			return resultForPlan(plan, await executor.batch(plan.statements));
+		} catch (error) {
+			if (expectations.length === 0 || !isExpectationConflictError(error)) throw error;
+			return await expectationConflict(executor, expectations) ?? {
+				committed: false,
+				conflict: {
+					actualVersion: expectations[0].model === "releases" ? expectations[0].revision : expectations[0].generation,
+					changeIndex: -1,
+					expectedVersion: expectations[0].model === "releases" ? expectations[0].revision : expectations[0].generation,
+					key: expectations[0].model === "releases" ? expectations[0].id : expectations[0].scopeKey,
+					model: expectations[0].model,
+					reason: "version_conflict"
+				}
+			};
+		}
+	}
+});
+//#endregion
+//#region src/d1Database.ts
+const d1Database = (config) => {
+	const cloudflare$1 = new cloudflare.default({ apiToken: config.cloudflareApiToken });
+	const execute = async (statements) => {
+		const first = statements[0];
+		if (first === void 0) return [];
+		const body = statements.length === 1 ? {
+			account_id: config.accountId,
+			sql: first.sql,
+			params: [...first.params]
+		} : {
+			account_id: config.accountId,
+			batch: statements.map(({ sql, params }) => ({
+				sql,
+				params: [...params]
+			}))
+		};
+		const page = await cloudflare$1.d1.database.query(config.databaseId, { ...body });
+		const results = [];
+		for await (const resultPage of page.iterPages()) for (const result of resultPage.result) results.push(result.results ?? []);
+		return results;
+	};
+	const adapter = (0, _hot_updater_plugin_core_internal.createDatabasePluginAdapter)("d1Database", createD1Implementation({
+		async query(sql, params) {
+			return (await execute([{
+				sql,
+				params
+			}])).flat();
+		},
+		batch: execute
+	}));
+	return (0, _hot_updater_plugin_core.createDatabasePlugin)({
+		name: "d1Database",
+		models: adapter.models,
+		commit: adapter.commit,
+		...adapter.dispose ? { dispose: adapter.dispose } : {}
+	});
+};
+//#endregion
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -11033,6 +11926,26 @@ const resolveCloudflareInfrastructureApiToken = async ({ cwd, nonInteractive })
 	return authenticatedToken;
 };
 //#endregion
+//#region iac/cloudflareInfrastructureState.ts
+const resolveCloudflareInfrastructureState = (tableNames) => {
+	if (tableNames.includes("release_catalogs")) return "v1";
+	if (tableNames.includes("bundles")) return "v0";
+	return "fresh";
+};
+const assertCloudflareInfrastructureCanInitialize = (tableNames, databaseName) => {
+	if (resolveCloudflareInfrastructureState(tableNames) === "v0") throw new _hot_updater_cli_tools.LegacyInfrastructureError("Cloudflare", `D1 database ${databaseName}`);
+};
+const assertCloudflareWorkerCanInitialize = async ({ fetchImpl, scriptNames, workerName, workersSubdomain }) => {
+	if (!scriptNames.includes(workerName)) return;
+	await (0, _hot_updater_cli_tools.assertInfrastructureGenerationAtUrl)({
+		fetchImpl,
+		legacyStatuses: [400, 404],
+		provider: "Cloudflare",
+		resource: `Worker ${workerName}`,
+		versionUrl: `https://${workerName}.${workersSubdomain}.workers.dev/version`
+	});
+};
+//#endregion
 //#region iac/init/index.ts
 const initProvider = {
 	label: "Cloudflare D1 + R2 + Worker",
@@ -11236,10 +12149,16 @@ function App() {
   return null; // Replace with your app root
 }
 
-export default HotUpdater.wrap({
+HotUpdater.init({
   baseURL: "%%source%%",
-  updateStrategy: "appVersion", // or "fingerprint"
-})(App);`;
+  requestHeaders: {
+    "x-api-key": %%apiKey%%,
+  },
+});
+
+// Call HotUpdater.checkForUpdate({ updateStrategy: "appVersion" })
+// when your app is ready to check.
+export default App;`;
 const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseId, d1DatabaseName, nonInteractive, r2BucketName, workerName }) => {
 	const cwd = (0, _hot_updater_cli_tools.getCwd)();
 	const cloudflarePackagePath = require.resolve("@hot-updater/cloudflare/package.json", { paths: [cwd] });
@@ -11256,7 +12175,7 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 			binding: "BUCKET",
 			bucket_name: r2BucketName
 		}];
-		wranglerConfig.vars = { JWT_SECRET: crypto.default.randomBytes(32).toString("hex") };
+		wranglerConfig.vars = { BUCKET_NAME: r2BucketName };
 		await fs_promises.default.writeFile(path.default.join(workerRoot, "wrangler.json"), JSON.stringify(wranglerConfig, null, 2));
 		const wrangler = await createWrangler({
 			stdio: "inherit",
@@ -11274,6 +12193,16 @@ const deployWorker = async (apiToken, accountId, { credentialSource, d1DatabaseI
 		}
 		await wrangler("d1", "migrations", "apply", d1DatabaseName, "--remote");
 		await wrangler("deploy", "--name", workerName);
+		const secretCommand = createWrangler({
+			stdio: "pipe",
+			cloudflareApiToken: apiToken,
+			cwd: workerRoot,
+			accountId,
+			nonInteractive
+		})("secret", "put", "STORAGE_DOWNLOAD_URL_SIGNING_KEY", "--name", workerName);
+		if (!secretCommand.stdin) throw new Error("Failed to open Wrangler secret input.");
+		secretCommand.stdin.end(crypto.default.randomBytes(32).toString("hex"));
+		await secretCommand;
 		return workerName;
 	} catch (error) {
 		if (error instanceof Error) throw toCloudflareDeploymentError(error, credentialSource);
@@ -11287,7 +12216,8 @@ const runInit = async ({ build, envFile }) => {
 	const nonInteractive = envFile !== void 0;
 	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile);
 	const { managedEnv } = initEnvSources;
-	const existingInputs = resolveCloudflareInitInputs((0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive));
+	const initInputEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
+	const existingInputs = resolveCloudflareInitInputs(initInputEnv);
 	assertCloudflareNonInteractiveInputs(existingInputs, nonInteractive);
 	const { accessKeyId: existingR2AccessKeyId, accountId: existingAccountId, apiToken: existingApiToken, bucketName: existingBucketName, d1DatabaseId: existingD1DatabaseId, d1DatabaseName: existingD1DatabaseName, r2Private: savedPrivateSetting, secretAccessKey: existingR2SecretAccessKey, workerName: existingWorkerName } = existingInputs;
 	const infrastructureCredentialSource = { kind: "wrangler-oauth" };
@@ -11492,6 +12422,37 @@ const runInit = async ({ build, envFile }) => {
 			verifyUserToken: () => credentialClient.user.tokens.verify()
 		})
 	});
+	const queryD1 = async (sql) => {
+		if (!selectedD1DatabaseId) return [];
+		const page = await cf.d1.database.query(selectedD1DatabaseId, {
+			account_id: accountId,
+			sql
+		});
+		const rows = [];
+		for await (const resultPage of page.iterPages()) for (const result of resultPage.result) rows.push(...result.results ?? []);
+		return rows;
+	};
+	if (!createD1Database) assertCloudflareInfrastructureCanInitialize((await queryD1(`
+      SELECT name
+      FROM sqlite_schema
+      WHERE type = 'table'
+        AND name IN ('bundles', 'release_catalogs')
+      ORDER BY name
+    `)).flatMap(({ name }) => typeof name === "string" ? [name] : []), d1DatabaseName);
+	const workerScripts = await runCloudflareApiRequest({
+		request: () => cf.workers.scripts.list({ account_id: accountId }),
+		source: infrastructureCredentialSource
+	});
+	const subdomains = await runCloudflareApiRequest({
+		request: () => cf.workers.subdomains.get({ account_id: accountId }),
+		source: infrastructureCredentialSource
+	});
+	if (!subdomains.subdomain) throw new Error("Cloudflare Workers subdomain is required to configure the storage download URL.");
+	await assertCloudflareWorkerCanInitialize({
+		scriptNames: workerScripts.result.flatMap(({ id }) => typeof id === "string" ? [id] : []),
+		workerName,
+		workersSubdomain: subdomains.subdomain
+	});
 	const resolvedInputs = {
 		...existingInputs,
 		accessKeyId,
@@ -11563,10 +12524,6 @@ const runInit = async ({ build, envFile }) => {
 		[initProvider.inputs.d1DatabaseId.envKey]: selectedD1DatabaseId,
 		[initProvider.inputs.d1DatabaseName.envKey]: d1DatabaseName
 	});
-	const subdomains = await runCloudflareApiRequest({
-		request: () => cf.workers.subdomains.get({ account_id: accountId }),
-		source: infrastructureCredentialSource
-	});
 	await deployWorker(infrastructureApiToken, accountId, {
 		credentialSource: infrastructureCredentialSource,
 		d1DatabaseId: selectedD1DatabaseId,
@@ -11575,12 +12532,33 @@ const runInit = async ({ build, envFile }) => {
 		r2BucketName: selectedBucketName,
 		workerName
 	});
+	const databasePlugin = d1Database({
+		accountId,
+		cloudflareApiToken: apiToken,
+		databaseId: selectedD1DatabaseId
+	});
+	let apiKey;
+	try {
+		apiKey = (await (0, _hot_updater_server.provisionApiKey)({
+			apiKeys: databasePlugin.models.apiKeys,
+			existingApiKey: initInputEnv.HOT_UPDATER_API_KEY,
+			name: "Cloudflare init"
+		})).apiKey;
+		await (0, _hot_updater_cli_tools.makeEnv)({ HOT_UPDATER_API_KEY: apiKey });
+	} finally {
+		await databasePlugin.dispose?.();
+	}
 	const configWriteResult = await (0, _hot_updater_cli_tools.writeHotUpdaterConfig)(getConfigScaffold(build));
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with Cloudflare settings.");
 	if (configWriteResult.status === "created") _hot_updater_cli_tools.p.log.success("Generated 'hot-updater.config.ts' file with Cloudflare settings.");
 	else if (configWriteResult.status === "merged") _hot_updater_cli_tools.p.log.success("Updated 'hot-updater.config.ts' file with Cloudflare settings.");
 	else _hot_updater_cli_tools.p.log.warn(`Kept existing 'hot-updater.config.ts' unchanged: ${configWriteResult.reason}`);
-	if (subdomains.subdomain) _hot_updater_cli_tools.p.note((0, _hot_updater_cli_tools.transformTemplate)(SOURCE_TEMPLATE, { source: `https://${workerName}.${subdomains.subdomain}.workers.dev/api/check-update` }));
+	if (subdomains.subdomain) _hot_updater_cli_tools.p.note((0, _hot_updater_cli_tools.transformTemplate)(SOURCE_TEMPLATE, {
+		apiKey: JSON.stringify(apiKey),
+		source: `https://${workerName}.${subdomains.subdomain}.workers.dev`
+	}));
+	_hot_updater_cli_tools.p.note((0, _hot_updater_cli_tools.formatApiKeyNote)(apiKey), "API Key");
+	_hot_updater_cli_tools.p.log.message("Store this API key separately in a secure place.");
 	_hot_updater_cli_tools.p.log.message(`Next step: ${(0, _hot_updater_cli_tools.link)("https://hot-updater.dev/docs/managed/cloudflare#step-4-add-hotupdater-to-your-project")}`);
 	_hot_updater_cli_tools.p.log.success("Done! 🎉");
 };