@zintrust/cloudflare-d1-proxy 0.9.3 → 1.7.1

package/dist/build-manifest.json

@@ -1,15 +1,15 @@
 {
   "name": "@zintrust/cloudflare-d1-proxy",
-  "version": "0.9.3",
-  "buildDate": "2026-04-22T15:46:29.321Z",
+  "version": "1.7.1",
+  "buildDate": "2026-05-01T05:27:00.732Z",
   "buildEnvironment": {
-    "node": "v20.20.2",
-    "platform": "linux",
-    "arch": "x64"
+    "node": "v22.22.1",
+    "platform": "darwin",
+    "arch": "arm64"
   },
   "git": {
-    "commit": "552dfdf4",
-    "branch": "master"
+    "commit": "ef4e9bec",
+    "branch": "release"
   },
   "package": {
     "engines": {
@@ -29,13 +29,17 @@
       "size": 5398,
       "sha256": "5be1bc4b1ad88b1980c28e5ca45c1e564f44466bd5d0cda8bc07403031ce87a1"
     },
+    "build-manifest.json": {
+      "size": 1111,
+      "sha256": "dac012e6a59d0899a684705354daa40a65675000063df9d60cc09b033f3ad850"
+    },
     "index.d.ts": {
-      "size": 1510,
-      "sha256": "d67887da027057cab5a12e732cacd3b8c014c9ff5067734d82d946304c5f8cf5"
+      "size": 1493,
+      "sha256": "e6e9d8e5454450d7e1afd76783ea034920fecafc4f454f7f2d8c0dd4345668dc"
     },
     "index.js": {
-      "size": 14083,
-      "sha256": "343f60b4718b02d9601711b5587eb23a867c4652b531063740ef79c97cc8757c"
+      "size": 13008,
+      "sha256": "4e2969d0253583b5fcafde3a09501c7e9e7f09c6cc038d35088c9127023d13d4"
     }
   }
 }

package/dist/index.d.ts

@@ -5,9 +5,9 @@ type KVNamespacePutOptions = {
 type KVNamespace = {
     get: {
         (key: string): Promise<string | null>;
-        (key: string, type: 'json'): Promise<unknown | null>;
+        (key: string, type: 'json'): Promise<unknown>;
         (key: string, type: 'arrayBuffer'): Promise<ArrayBuffer | null>;
-        (key: string, type: KvGetType): Promise<unknown | ArrayBuffer | string | null>;
+        (key: string, type: KvGetType): Promise<ArrayBuffer | string | null>;
     };
     put: (key: string, value: string, options?: KVNamespacePutOptions) => Promise<void>;
 };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { ErrorHandler, RequestValidator, SigningService } from '@zintrust/core/proxy';
+import { ErrorHandler, RequestValidator, WorkerSigning } from '@zintrust/core/proxy';
 const DEFAULT_SIGNING_WINDOW_MS = 60_000;
 const DEFAULT_MAX_BODY_BYTES = 128 * 1024;
 const DEFAULT_MAX_SQL_BYTES = 32 * 1024;
@@ -105,15 +105,6 @@ const parseOptionalJson = (text) => {
     const successResult = parsed;
     return { ok: true, payload: successResult.value };
 };
-const loadSigningSecret = (env) => {
-    const direct = typeof env.D1_REMOTE_SECRET === 'string' ? env.D1_REMOTE_SECRET.trim() : '';
-    if (direct !== '')
-        return direct;
-    const fallback = typeof env.APP_KEY === 'string' ? env.APP_KEY.trim() : '';
-    if (fallback !== '')
-        return fallback;
-    return null;
-};
 const loadStatements = (env) => {
     const raw = env.ZT_D1_STATEMENTS_JSON;
     if (typeof raw !== 'string' || raw.trim() === '')
@@ -138,31 +129,12 @@ const isMutatingSql = (sql) => {
         s.startsWith('alter') ||
         s.startsWith('replace'));
 };
-const verifyNonceKv = async (kv, keyId, nonce, ttlMs) => {
-    const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1000));
-    const storageKey = `nonce:${keyId}:${nonce}`;
-    const existing = await kv.get(storageKey);
-    if (existing !== null)
-        return false;
-    await kv.put(storageKey, '1', { expirationTtl: ttlSeconds });
-    return true;
-};
 const verifySignedRequest = async (request, env, bodyBytes) => {
-    const secret = loadSigningSecret(env);
-    if (secret === null) {
-        return toErrorResponse(401, 'CONFIG_ERROR', 'Missing signing secret (D1_REMOTE_SECRET or APP_KEY)');
-    }
-    const windowMs = getEnvInt(env, 'ZT_PROXY_SIGNING_WINDOW_MS', DEFAULT_SIGNING_WINDOW_MS);
-    const verifyResult = await SigningService.verifyWithKeyProvider({
-        method: request.method,
-        url: request.url,
-        body: bodyBytes,
-        headers: request.headers,
-        windowMs,
-        getSecretForKeyId: async (_keyId) => secret,
-        verifyNonce: env.ZT_NONCES === undefined
-            ? undefined
-            : async (keyId, nonce, ttlMs) => verifyNonceKv(env.ZT_NONCES, keyId, nonce, ttlMs),
+    const verifyResult = await WorkerSigning.verifySignedRequest(request, env, bodyBytes, {
+        secretEnvVar: 'D1_REMOTE_SECRET',
+        missingSecretStatus: 401,
+        missingSecretMessage: 'Missing signing secret (D1_REMOTE_SECRET or APP_KEY)',
+        defaultSigningWindowMs: DEFAULT_SIGNING_WINDOW_MS,
     });
     if (verifyResult.ok === false) {
         return toErrorResponse(verifyResult.status, verifyResult.code, verifyResult.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/cloudflare-d1-proxy",
-  "version": "0.9.3",
+  "version": "1.7.1",
   "description": "Cloudflare D1 proxy package for ZinTrust.",
   "type": "module",
   "private": false,
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@zintrust/core": "^0.9.2"
+    "@zintrust/core": "*"
   },
   "keywords": [
     "zintrust",