@zackbart/connecta 0.28.1 → 0.29.0

package/dist/storage/file.d.ts

@@ -1,15 +0,0 @@
-import type { KVStorage, Logger } from "../types.js";
-export interface FileStorageOptions {
-    /** Destination for the corrupt-state-file recovery report. Default console. */
-    logger?: Logger;
-}
-/**
- * JSON-file-backed KVStorage for Node. Loads once, persists on every write via
- * an exclusive temp-file + rename. Refuses a second holder of the same path.
- * Call close() when finished to release its lock; process exit also releases it.
- * Only reachable via the "@zackbart/connecta/node"
- * subpath so the main entry stays Workers-clean.
- */
-export declare function fileStorage(path: string, opts?: FileStorageOptions): KVStorage & {
-    close(): void;
-};

package/dist/storage/file.js

@@ -1,455 +0,0 @@
-import { chmodSync, closeSync, existsSync, futimesSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { hostname } from "node:os";
-import { dirname, resolve } from "node:path";
-function validEntry(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value) &&
-        "value" in value && typeof value.value === "string" &&
-        (!("exp" in value) || (typeof value.exp === "number" && Number.isFinite(value.exp)));
-}
-function makeEntry(value, ttlSeconds) {
-    if (ttlSeconds !== undefined && !Number.isFinite(ttlSeconds)) {
-        throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
-    }
-    if (!ttlSeconds)
-        return { value };
-    const exp = Date.now() + ttlSeconds * 1000;
-    if (!Number.isFinite(exp)) {
-        throw new RangeError("ttlSeconds must produce a finite expiration timestamp");
-    }
-    return { value, exp };
-}
-const HEARTBEAT_MS = 15_000;
-const STALE_LOCK_MS = 60_000;
-const localLocks = new Map();
-// A pid is meaningful only in its own host/namespace. Container hostnames may
-// be shared, so Linux uses the kernel boot id and the actual PID namespace.
-const pidScope = (() => {
-    if (process.platform !== "linux")
-        return hostname();
-    try {
-        return `${readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim()}:${readlinkSync("/proc/self/ns/pid")}`;
-    }
-    catch {
-        return undefined; // Without namespace evidence, rely on the heartbeat.
-    }
-})();
-function stale(path) {
-    return Date.now() - statSync(path).mtimeMs > STALE_LOCK_MS;
-}
-// One listener per module, removed when the last store closes. Node's listen()
-// drains requests before process.exit(), so the lock lasts through those writes.
-const openStores = new Set();
-const closeStores = () => {
-    for (const close of openStores) {
-        try {
-            close();
-        }
-        catch {
-            // A dead-pid or expired-heartbeat lock can be reclaimed next startup.
-        }
-    }
-};
-function hasCode(error, code) {
-    return error?.code === code;
-}
-function lockFile(path) {
-    const lockPath = `${path}.lock`;
-    const contents = JSON.stringify({
-        pid: process.pid,
-        pidScope,
-        createdAt: Date.now(),
-        id: randomUUID(),
-    });
-    const readLock = () => {
-        try {
-            return readFileSync(lockPath, "utf8");
-        }
-        catch (error) {
-            if (hasCode(error, "ENOENT"))
-                return null;
-            throw error;
-        }
-    };
-    const refuseLiveHolder = () => {
-        const raw = readLock();
-        if (raw === null)
-            return false;
-        try {
-            if (stale(lockPath))
-                return true;
-        }
-        catch (error) {
-            if (hasCode(error, "ENOENT"))
-                return false;
-            throw error;
-        }
-        let holder;
-        try {
-            holder = JSON.parse(raw);
-            if (!holder || !Number.isInteger(holder.pid) || holder.pid <= 0 ||
-                holder.pid > 2147483647 || !Number.isFinite(holder.createdAt)) {
-                throw new Error("Invalid lock holder");
-            }
-        }
-        catch {
-            throw new Error(`[connecta] state file ${path} has an unreadable lock at ${lockPath}. ` +
-                `Refusing to start. Retry after its heartbeat has been stale for 60 seconds.`);
-        }
-        if (pidScope !== undefined && holder.pidScope === pidScope) {
-            if (holder.pid === process.pid) {
-                // A new container process may inherit the old holder's pid. Only our
-                // own registry can distinguish that incarnation from a second opener.
-                if (localLocks.get(path) !== raw)
-                    return true;
-            }
-            else {
-                try {
-                    process.kill(holder.pid, 0);
-                }
-                catch (error) {
-                    if (hasCode(error, "ESRCH"))
-                        return true;
-                    // Permission errors do not establish that the holder is dead.
-                }
-            }
-        }
-        throw new Error(`[connecta] state file ${path} is held by pid ${holder.pid} ` +
-            `(lock timestamp ${holder.createdAt}). Close that store before opening another.`);
-    };
-    const acquire = () => {
-        let fd;
-        try {
-            fd = openSync(lockPath, "wx", 0o600);
-        }
-        catch (error) {
-            if (hasCode(error, "EEXIST"))
-                return false;
-            throw error;
-        }
-        try {
-            writeFileSync(fd, contents);
-            const now = new Date();
-            futimesSync(fd, now, now);
-        }
-        catch (error) {
-            unlinkSync(lockPath);
-            throw error;
-        }
-        finally {
-            closeSync(fd);
-        }
-        return true;
-    };
-    if (!acquire()) {
-        refuseLiveHolder();
-        // Serialize stale-lock removal. Without this guard, two reclaimers could
-        // both observe the dead pid and the slower one unlink the new live lock.
-        // Recovery is synchronous. A guard older than the lease is from a crashed
-        // or paused reclaimer, which must recheck its ownership before continuing.
-        const reclaimPath = `${lockPath}.reclaim`;
-        const recoveryError = () => new Error(`[connecta] state file ${path} has a lock recovery in progress at ${reclaimPath}. ` +
-            `Retry after its 60-second lease expires.`);
-        try {
-            const expired = statSync(reclaimPath);
-            if (Date.now() - expired.mtimeMs > STALE_LOCK_MS) {
-                const markers = readdirSync(reclaimPath);
-                const current = statSync(reclaimPath);
-                if (current.dev !== expired.dev || current.ino !== expired.ino ||
-                    current.birthtimeMs !== expired.birthtimeMs || !stale(reclaimPath)) {
-                    throw recoveryError();
-                }
-                // Delete only the expired owner's unique marker. A competing cleanup
-                // cannot empty a replacement guard by deleting these old filenames.
-                for (const marker of markers)
-                    rmSync(`${reclaimPath}/${marker}`, { force: true });
-                rmdirSync(reclaimPath);
-            }
-        }
-        catch (error) {
-            if (hasCode(error, "ENOTEMPTY") || hasCode(error, "EEXIST"))
-                throw recoveryError();
-            if (!hasCode(error, "ENOENT"))
-                throw error;
-        }
-        try {
-            mkdirSync(reclaimPath, { mode: 0o700 });
-        }
-        catch (error) {
-            if (!hasCode(error, "EEXIST"))
-                throw error;
-            throw recoveryError();
-        }
-        const guard = statSync(reclaimPath);
-        const markerPath = `${reclaimPath}/${randomUUID()}`;
-        const ownsGuard = () => {
-            try {
-                const current = statSync(reclaimPath);
-                return current.dev === guard.dev && current.ino === guard.ino &&
-                    existsSync(markerPath);
-            }
-            catch (error) {
-                if (hasCode(error, "ENOENT"))
-                    return false;
-                throw error;
-            }
-        };
-        const assertGuard = () => {
-            if (!ownsGuard() || stale(reclaimPath))
-                throw recoveryError();
-        };
-        try {
-            writeFileSync(markerPath, "", { flag: "wx", mode: 0o600 });
-            if (!ownsGuard())
-                throw recoveryError();
-            const now = new Date();
-            utimesSync(reclaimPath, now, now);
-            const removeStale = refuseLiveHolder();
-            assertGuard();
-            if (removeStale)
-                unlinkSync(lockPath);
-            if (!acquire()) {
-                refuseLiveHolder();
-                throw new Error(`[connecta] state file ${path} lock changed during recovery. Retry opening it.`);
-            }
-        }
-        finally {
-            const owned = ownsGuard();
-            rmSync(markerPath, { force: true });
-            if (owned)
-                rmdirSync(reclaimPath);
-        }
-    }
-    const assertHeld = () => {
-        if (readLock() !== contents) {
-            throw new Error(`[connecta] state file ${path} lock was lost. Refusing to write a stale snapshot.`);
-        }
-    };
-    localLocks.set(path, contents);
-    const heartbeat = setInterval(() => {
-        try {
-            assertHeld();
-            const now = new Date();
-            utimesSync(lockPath, now, now);
-        }
-        catch {
-            // A replaced lock belongs to its new holder. Failed refreshes let the
-            // lease expire; subsequent writes still have to prove ownership.
-            clearInterval(heartbeat);
-        }
-    }, HEARTBEAT_MS);
-    heartbeat.unref();
-    return {
-        assertHeld,
-        release() {
-            clearInterval(heartbeat);
-            if (localLocks.get(path) === contents)
-                localLocks.delete(path);
-            if (readLock() === contents)
-                unlinkSync(lockPath);
-        },
-    };
-}
-/**
- * JSON-file-backed KVStorage for Node. Loads once, persists on every write via
- * an exclusive temp-file + rename. Refuses a second holder of the same path.
- * Call close() when finished to release its lock; process exit also releases it.
- * Only reachable via the "@zackbart/connecta/node"
- * subpath so the main entry stays Workers-clean.
- */
-export function fileStorage(path, opts = {}) {
-    path = resolve(path);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const lock = lockFile(path);
-    let closed = false;
-    const close = () => {
-        if (closed)
-            return;
-        closed = true;
-        openStores.delete(close);
-        if (!openStores.size)
-            process.removeListener("exit", closeStores);
-        lock.release();
-    };
-    const assertOpen = () => {
-        if (closed)
-            throw new Error(`[connecta] state file ${path} is closed.`);
-    };
-    const logger = opts.logger ?? console;
-    // With a sealing vault, downstream OAuth tokens here are ciphertext; without
-    // one they are cleartext, and OAuth flow state is plaintext either way. Keep
-    // the file owner-only regardless. Repair is best-effort: chmod is a no-op or throws on
-    // non-POSIX filesystems, and a loose mode must never keep the store from
-    // starting.
-    const tighten = () => {
-        try {
-            chmodSync(path, 0o600);
-        }
-        catch {
-            // Non-POSIX filesystem or a race on the file — leave the mode as-is.
-        }
-    };
-    let data = Object.create(null);
-    try {
-        if (existsSync(path)) {
-            tighten();
-            try {
-                const loaded = JSON.parse(readFileSync(path, "utf8"));
-                if (loaded === null || typeof loaded !== "object" || Array.isArray(loaded)) {
-                    throw new TypeError("Expected a state object");
-                }
-                if (!Object.values(loaded).every(validEntry)) {
-                    throw new TypeError("Expected string values and finite expiry timestamps");
-                }
-                data = Object.assign(Object.create(null), loaded);
-            }
-            catch (error) {
-                // Never let a damaged state file be silently replaced by an empty one:
-                // the next set() would persist {} over irreplaceable downstream OAuth
-                // tokens and credential-vault entries. Quarantine the bytes so they
-                // survive for manual recovery, and refuse to start if even that fails —
-                // losing the file loudly beats losing it quietly.
-                const quarantine = `${path}.corrupt-${Date.now()}`;
-                try {
-                    renameSync(path, quarantine);
-                }
-                catch (renameError) {
-                    throw new Error(`[connecta] state file ${path} is not valid JSON and could not be ` +
-                        `moved aside (${String(renameError)}). Refusing to start rather ` +
-                        `than overwrite it. Move or repair the file, then restart.`);
-                }
-                logger.error(`[connecta] state file ${path} is not valid JSON ` +
-                    `(${error instanceof Error ? error.message : String(error)}) — ` +
-                    `moved to ${quarantine}, starting from empty state. Downstream ` +
-                    `OAuth connectors must be re-authorized and stored credentials ` +
-                    `re-entered.`);
-                data = Object.create(null);
-            }
-        }
-    }
-    catch (error) {
-        close();
-        throw error;
-    }
-    if (!openStores.size)
-        process.on("exit", closeStores);
-    openStores.add(close);
-    const persist = () => {
-        // Physical expiry rides on an operation that was already going to write.
-        // Reads only prune memory; they do not rewrite the state file.
-        const now = Date.now();
-        for (const [key, entry] of Object.entries(data)) {
-            if (entry.exp !== undefined && now >= entry.exp)
-                delete data[key];
-        }
-        const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
-        // 0o600 on the tmp file; the atomic rename below preserves it, so the live
-        // state file is never briefly world-readable.
-        const fd = openSync(tmp, "wx", 0o600);
-        let committed = false;
-        try {
-            try {
-                writeFileSync(fd, JSON.stringify(data));
-            }
-            finally {
-                closeSync(fd);
-            }
-            lock.assertHeld();
-            renameSync(tmp, path);
-            committed = true;
-        }
-        finally {
-            // A successful rename already removed the temp path. Cleanup must not
-            // turn a committed snapshot into a failure that callers roll back.
-            if (!committed)
-                rmSync(tmp, { force: true });
-        }
-        tighten();
-    };
-    const fresh = (key) => {
-        const e = data[key];
-        if (!e)
-            return null;
-        if (e.exp !== undefined && Date.now() >= e.exp) {
-            delete data[key];
-            return null;
-        }
-        return e;
-    };
-    return {
-        close,
-        async get(key) {
-            // Reads use the loaded snapshot; only writes need filesystem ownership
-            // checks to prevent a reclaimed holder from overwriting newer state.
-            assertOpen();
-            return fresh(key)?.value ?? null;
-        },
-        async set(key, value, opts) {
-            assertOpen();
-            lock.assertHeld();
-            const previous = fresh(key);
-            data[key] = makeEntry(value, opts?.ttlSeconds);
-            try {
-                persist();
-            }
-            catch (error) {
-                if (previous)
-                    data[key] = previous;
-                else
-                    delete data[key];
-                throw error;
-            }
-        },
-        async delete(key) {
-            assertOpen();
-            lock.assertHeld();
-            const previous = fresh(key);
-            delete data[key];
-            try {
-                persist();
-            }
-            catch (error) {
-                if (previous)
-                    data[key] = previous;
-                throw error;
-            }
-        },
-        async list(prefix) {
-            assertOpen();
-            return Object.keys(data)
-                .filter((key) => Boolean(fresh(key)) && key.startsWith(prefix))
-                .sort();
-        },
-        // Atomic twice over: the lock makes this process the only writer of the
-        // file, and nothing between the comparison and the persisted rename
-        // yields, so no other call on this store can interleave. A write that
-        // cannot be persisted is rolled back so memory never claims a value the
-        // file does not hold.
-        async compareAndSet(key, expected, next, opts) {
-            assertOpen();
-            lock.assertHeld();
-            const previous = fresh(key);
-            if ((previous?.value ?? null) !== expected)
-                return false;
-            if (next === null) {
-                if (!previous)
-                    return true;
-                delete data[key];
-            }
-            else {
-                data[key] = makeEntry(next, opts?.ttlSeconds);
-            }
-            try {
-                persist();
-            }
-            catch (error) {
-                if (previous)
-                    data[key] = previous;
-                else
-                    delete data[key];
-                throw error;
-            }
-            return true;
-        },
-    };
-}

package/ethos.md

@@ -1,93 +0,0 @@
-# connecta — ethos
-
-Connecta’s scope, refusals, and invariants. Contradictions require a design decision.
-
-## What this is
-
-- **One MCP endpoint.** Agents reach configured connectors through JavaScript,
-  a required executor, and seven meta-tools.
-- **Config-as-code.** One tenant and connector set; identities get
-  config-derived views. Maintained providers, `remoteMcp()`, and `api()` share
-  one connector contract.
-- **Safe by default.** Programs run only read-only or config-exempt tools;
-  every other write crosses `call_destructive_tool`. The host owns approval.
-- **One fetch-native core.** Web APIs on Node and Workers; platform code and
-  optional features behind explicit subpaths; Effect inside, Promises outside.
-- **Human auth management.** Optional pages show status and payload-free history.
-  Explicit permissions allow credential changes and OAuth. Capabilities stay in code.
-
-## What this isn't
-
-No runtime registration, admin-editable capabilities, or policy engine; config
-may only exempt a tool from asking. No schema ingestion, accounts, or groups;
-personal state remains within one tenant. Breaking changes remain acceptable;
-version numbers signal change, not stability.
-
-## Decisions
-
-Revisiting a verdict requires a new argument. Accepted designs live in
-subsystem guides and the CHANGELOG; `planned` ones bind review before either
-carries them.
-
-| Decision | Verdict | Why |
-| --- | --- | --- |
-| OpenAPI / GraphQL ingestion | refused | the disease is a document-authored tool nobody chose; hand-written literals, even through a shared factory, are still authorship |
-| Multi-tenancy / account model | refused | one deployment per tenant; inbound auth owns identity |
-| Approvals and pauses | removed | hosts approve per call, so under always-allow the resume prompt was a rubber stamp that cost a round trip and a replay ([#672](https://github.com/zackbart/connecta/issues/672), superseding [#565](https://github.com/zackbart/connecta/issues/565)) |
-| Approval exemptions | accepted | config-only, program-only, never read-only elsewhere ([#566](https://github.com/zackbart/connecta/issues/566)) |
-| Runtime connector registration | refused | config-as-code is the security model |
-| Optional deployment modules | accepted | typed slots select UI, activity, vault, and inbound auth; core keeps discovery, execution, invocation, and enforcement |
-| Artifacts module | accepted | a built-in connector for team-only sandboxed pages over stored JSON; immutable versions let writes skip approval. Supersedes [#287](https://github.com/zackbart/connecta/issues/287) |
-| Plugin lifecycle, provider registry, or marketplace | refused | modules are deployment code, not runtime installs; prebuilt connections are imports, discovered in docs ([#297](https://github.com/zackbart/connecta/issues/297)) |
-| OAuth on `api()` | accepted | OAuth-only APIs; static grants reuse `remoteMcp()` machinery, core's callback route |
-| Connecta-issued access tokens | accepted | optional /auth/access-tokens preserves v0.23 secrets; config owns grants, interactive management needs explicit permission ([#619](https://github.com/zackbart/connecta/issues/619)) |
-| Expanded Notion page create/update options | refused | different workflows, not missing fields; use `api()` ([#408](https://github.com/zackbart/connecta/issues/408)) |
-| Resources, prompts, and downstream MCP Apps templates | refused | tools only; clients own presentation ([#266](https://github.com/zackbart/connecta/issues/266)) |
-| Protocol sessions, server push, elicitation passthrough | refused | stateless per request; elicitation has no route |
-| Repository formatter | refused | style is authored, not enforced |
-| Host-side projection or paging of program results | refused | a program projects: heuristics drop fields invisibly, paging rewards unprojected returns ([#223](https://github.com/zackbart/connecta/issues/223)) |
-| Native Tasks for oversized results | refused | tasks solve duration, `get_result` solves size ([#176](https://github.com/zackbart/connecta/issues/176)) |
-| Widening the `Executor` result contract | refused | `{ result, error?, logs? }` is the `@cloudflare/codemode` parity guarantee ([#267](https://github.com/zackbart/connecta/issues/267)) |
-| Erasable TypeScript in `execute_code` | refused | a 24 MB core dependency, no measured agent benefit ([#419](https://github.com/zackbart/connecta/issues/419)) |
-| Guest-minted `resource` / `resource_link` blocks | refused | no program mints a URI a client may dereference ([#266](https://github.com/zackbart/connecta/issues/266)) |
-| Provenance tracking for emitted content | refused | everything a program emits is program output ([#267](https://github.com/zackbart/connecta/issues/267)) |
-| Result sampling on the catalog surface | refused | sampling is execution, not a catalog read ([#282](https://github.com/zackbart/connecta/issues/282)) |
-| Legacy embedded `UIResource` delivery | refused | superseded upstream, rendered by no client we face ([#266](https://github.com/zackbart/connecta/issues/266)) |
-| Effect as the core effect system | accepted | lifetimes held the bugs: the rewrite closed leaked permits, hung waits, and cross-request races. Overturns [#470](https://github.com/zackbart/connecta/issues/470) |
-| Shared bounded queue under both admission controllers | refused | built: −17 lines bought a hook-parameterised abstraction ([#453](https://github.com/zackbart/connecta/issues/453)) |
-| MCP Apps rendering and `connecta.ui` | removed | clients render returned data |
-| Connector shortcut globals | removed | canonical addresses need no sanitization |
-| `connecta.batch` | removed | JavaScript promises suffice |
-| Automatic direct-call retries | removed | callers own retry timing |
-| Connector HTTP routes | removed | deployments own custom routes; the operator UI's artifact viewer is the exception |
-| Caller-selected toolkits | removed | config derives every view, grant-gated `/mcp/<pool>` pools included ([#178](https://github.com/zackbart/connecta/issues/178), [#531](https://github.com/zackbart/connecta/issues/531)) |
-| Proactive credential liveness | removed | fail-at-use is enough ([#179](https://github.com/zackbart/connecta/issues/179)) |
-| Classic (executor-free) surface | removed | an executor is mandatory ([#273](https://github.com/zackbart/connecta/issues/273)) |
-| Per-result lexical query coverage | removed | failed a precommitted response-bytes gate ([#323](https://github.com/zackbart/connecta/issues/323)) |
-| Stabilized workflows | accepted | only as artifact refresh: deployment-triggered read-only programs, shared credentials ([#225](https://github.com/zackbart/connecta/issues/225), [#564](https://github.com/zackbart/connecta/issues/564)) |
-| Semantic tool search | gated | keyword search has not been shown to fail ([#27](https://github.com/zackbart/connecta/issues/27)) |
-| MRTR / `input_required` passthrough | gated | relayable statelessly; no host or downstream emits it yet ([#176](https://github.com/zackbart/connecta/issues/176)) |
-| Downstream `ttlMs` cache hints | gated | needs refresh-churn evidence ([#206](https://github.com/zackbart/connecta/issues/206)) |
-| Worker Access inbound auth | provisional | Managed OAuth and Clerk migration need production evidence ([#506](https://github.com/zackbart/connecta/issues/506)) |
-| Program UI tool calls | removed | duplicated calls without improving retrieval ([#287](https://github.com/zackbart/connecta/issues/287), [#484](https://github.com/zackbart/connecta/issues/484)) |
-
-## Invariants
-
-Tests beside subsystem documentation enforce these.
-
-- **Fail-closed read-only.** A missing, false, or contradictory annotation never gets the benefit of the doubt.
-- **Generated code cannot mint capabilities.** Admission, credentials, and classification are enforced below the sandbox.
-- **Only explicitly read-only or config-exempt work runs in the sandbox.** Every other write crosses `call_destructive_tool`.
-- **Nothing request-bound survives a request.** No transport, stream, signal, or awaited promise outlives it.
-- **A downstream catalog is complete or it is a failure.** A partial one is never cached, persisted, or served.
-- **Activity is payload-free by construction.** The event type has nowhere to put arguments, results, code, or raw errors.
-- **An observed shape is never a declaration.** Names and broad types only, labeled, and gone behind any declared schema.
-- **Credentials never leave the host.** Encrypted at rest, readable only by the owning connector (and principal, for personal auth), rendered by nothing.
-- **Import-graph purity.** Nothing reachable from the root entry imports a `node:` builtin or `effect/testing`.
-- **The published surface is a boundary.** Heavyweight or platform-bound code goes behind an optional-peer subpath; Effect is the one hard dependency, named by no published type.
-- **Human routes manage auth, never capability.** Visibility grants use, not administration. Auth mutations need separate config-derived permissions, denied by default; activity reads its own. Artifact viewing respects connector grants and cannot invoke tools.
-- **Omitted modules do no work.** Core imports no UI bundle, vault, activity, artifacts, or bearer implementation. OAuth callbacks work without UI.
-- **Status reads do not start authorization.** Only an explicit authorized action starts OAuth, never a page load.
-- **Structural mistakes throw at construction.** Booting into the wrong shape is worse than not booting.
-
-Connecta simplifies [executor](https://github.com/UsefulSoftwareCo/executor).

package/examples/worker/src/cloudflare-kv.ts

@@ -1,43 +0,0 @@
-import type { KVStorage } from "@zackbart/connecta";
-
-/**
- * KVStorage backed by a Cloudflare Workers KV namespace binding.
- * Note: Workers KV enforces a 60s minimum TTL; shorter TTLs are dropped
- * (stored without expiry) rather than rejected.
- *
- * Workers KV is eventually consistent across locations. It is suitable for
- * this example's durable state, but cannot promise immediate global OAuth
- * disconnect, credential rotation, or access-token issuance/revocation; use a
- * strongly consistent adapter when that is required.
- */
-export function cloudflareKvStorage(namespace: KVNamespace): KVStorage {
-  return {
-    async get(key) {
-      return namespace.get(key);
-    },
-    async set(key, value, opts) {
-      const ttl = opts?.ttlSeconds;
-      await namespace.put(
-        key,
-        value,
-        ttl && ttl >= 60 ? { expirationTtl: ttl } : undefined,
-      );
-    },
-    async delete(key) {
-      await namespace.delete(key);
-    },
-    async list(prefix) {
-      const keys: string[] = [];
-      let cursor: string | undefined;
-      do {
-        const page = await namespace.list({
-          prefix,
-          ...(cursor ? { cursor } : {}),
-        });
-        keys.push(...page.keys.map((key) => key.name));
-        cursor = page.list_complete ? undefined : page.cursor;
-      } while (cursor);
-      return keys.sort();
-    },
-  };
-}