@zackbart/connecta 0.37.1 → 0.39.0

package/dist/sqlite.js

@@ -4,12 +4,11 @@
 // install. `sqliteStorage` is the deployment's `KVStorage` and
 // `sqliteActivityStore` its activity history; both create their tables on
 // first use. Node-only: nothing reachable from the root entry imports this.
-import { chmodSync, closeSync, mkdirSync, openSync, readFileSync } from "node:fs";
+import { chmodSync, closeSync, mkdirSync, openSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { effectSqlDriver, sqlDriverEdge, sqlSync } from "./storage/sql-driver.js";
-import { validateStorageKey } from "./storage/keys.js";
-import { KV_SCHEMA, sqlActivityStore, sqlStorage, } from "./storage/sql.js";
+import { sqlActivityStore, sqlStorage, } from "./storage/sql.js";
 /** Milliseconds a write waits for another process's write lock. */
 const BUSY_TIMEOUT_MS = 5_000;
 /**
@@ -100,83 +99,3 @@ export function sqliteStorage(database) {
 export function sqliteActivityStore(database, options) {
     return sqlActivityStore(sqliteDriver(database), "sqlite", options);
 }
-/**
- * One-shot migration from the 0.28 `fileStorage` JSON state file: copy every
- * live entry, with its expiry, into the database's key-value table. Run it
- * once, with the old deployment stopped, before the first start on SQLite.
- *
- * Keys the database already holds are kept, so a second run copies nothing
- * twice and never overwrites state written since. The file is read, never
- * changed; delete it once the deployment is verified. A file that is not a
- * state file throws before anything is written.
- */
-export function importStateFile(database, statePath, now = Date.now()) {
-    const text = readFileSync(statePath, "utf8");
-    // The file holds stored state (tokens, sealed credentials), and these
-    // errors reach the operator's terminal, so they name the file and an entry's
-    // position, never a key or the parser's account, which quotes the text.
-    let loaded;
-    try {
-        loaded = JSON.parse(text);
-    }
-    catch {
-        throw new TypeError(`${statePath} is not a connecta state file: it is not valid JSON`);
-    }
-    if (loaded === null || typeof loaded !== "object" || Array.isArray(loaded)) {
-        throw new TypeError(`${statePath} is not a connecta state file`);
-    }
-    const entries = Object.entries(loaded);
-    for (const [index, [key, entry]] of entries.entries()) {
-        validateStorageKey(key);
-        const valid = entry !== null &&
-            typeof entry === "object" &&
-            typeof entry.value === "string" &&
-            (!("exp" in entry) || Number.isFinite(entry.exp));
-        if (!valid) {
-            throw new TypeError(`${statePath} is not a connecta state file: entry ${index + 1} has no string value`);
-        }
-    }
-    let db;
-    let transaction = false;
-    let step = "open the SQLite database";
-    const result = { imported: 0, kept: 0, expired: 0 };
-    try {
-        db = typeof database === "string" ? openSqlite(database) : database;
-        step = "begin the import transaction";
-        db.exec("BEGIN IMMEDIATE");
-        transaction = true;
-        step = "prepare the key-value table";
-        for (const statement of KV_SCHEMA)
-            db.exec(statement);
-        const insert = db.prepare(`INSERT INTO connecta_kv (key, value, expires_at_ms) VALUES (?, ?, ?)
-       ON CONFLICT (key) DO NOTHING`);
-        for (const [index, [key, entry]] of entries.entries()) {
-            step = `import entry ${index + 1} into the key-value table`;
-            const { value, exp } = entry;
-            if (exp !== undefined && exp <= now) {
-                result.expired += 1;
-                continue;
-            }
-            if (Number(insert.run(key, value, exp === undefined ? null : Math.ceil(exp)).changes) > 0) {
-                result.imported += 1;
-            }
-            else {
-                result.kept += 1;
-            }
-        }
-        step = "commit the import transaction";
-        db.exec("COMMIT");
-    }
-    catch {
-        if (transaction) {
-            try {
-                db.exec("ROLLBACK");
-            }
-            catch {
-                // Rollback errors can contain stored text too. Report the failed step.
-            }
-        }
-        throw new Error(`State import failed: could not ${step}`);
-    }
-    return result;
-}

package/dist/storage/keys.js

@@ -141,7 +141,7 @@ export const catalogKeys = {
         name: "catalog",
         scope: "root",
         prefixes: ["catalog:"],
-        // Retired v2/v3 listings are inventoried for migration; no runtime reads them.
+        // Retired v2/v3 listings expire on their original TTL; no runtime reads them.
         version: { number: 3, in: "value" },
         codec: textCodec,
         ttl: {
@@ -153,7 +153,33 @@ export const catalogKeys = {
     manifest: (connectorId) => validateStorageKey(`catalog:${connectorId}`),
     chunk: (connectorId, revision, index) => validateStorageKey(`catalog:${connectorId}:chunk:${revision}:${index}`),
 };
-/** SDK catalog response cache, complete manifests published after their chunks. */
+/** How long a connector-health record outlives its retry time, fencing the next probe's claim. */
+export const CONNECTOR_HEALTH_LINGER_MS = 60_000;
+/**
+ * Bounded connector health by connector id and a digest of the owner
+ * partition and described configuration. `discovery` holds the latest failed
+ * discovery's typed code, observation time, retry time and the catalog
+ * generation it saw; `status` the operator page's latest status observation
+ * (state, problem code, tool count, observation time, generation). Values
+ * never carry downstream text, tools or credentials.
+ */
+export const connectorHealthKeys = {
+    family: {
+        name: "connector-health",
+        scope: "root",
+        prefixes: ["connector-health:v1:"],
+        version: { number: 1, in: "key" },
+        codec: jsonCodec,
+        ttl: { kind: "configured", by: "discovery: retry time plus 60 seconds; status: 120 seconds" },
+        durable: false,
+    },
+    discovery: (connectorId, partitionDigest) => validateStorageKey(`connector-health:v1:${connectorId}:${partitionDigest}:discovery`),
+    status: (connectorId, partitionDigest) => validateStorageKey(`connector-health:v1:${connectorId}:${partitionDigest}:status`),
+};
+/**
+ * SDK catalog response cache, complete manifests published after their chunks.
+ * Secret-bearing inputs reach these keys only through `secretDigest`.
+ */
 export const responseCacheKeys = {
     family: {
         name: "response-cache",
@@ -242,38 +268,6 @@ export const credentialKeys = {
     },
     credential: (connectorId, owner) => `${owner ? scopes.principal(owner) : ""}${scopes.connector(connectorId)}credential:v1`,
 };
-/** Seconds a Workers KV → D1 copy's resume point stays usable. */
-export const KV_COPY_CURSOR_TTL_SECONDS = 7 * 24 * 60 * 60;
-/**
- * Where a one-shot Workers KV → D1 copy (`copyKvToD1` in `src/d1.ts`) resumes,
- * held in D1 under a random token. Workers KV's own list cursor can spell the
- * last key it listed, so the caller holds the token and never the cursor.
- */
-export const kvCopyKeys = {
-    family: {
-        name: "kv-copy",
-        scope: "root",
-        prefixes: ["kv-copy:v1:"],
-        version: { number: 1, in: "key" },
-        codec: textCodec,
-        ttl: { kind: "fixed", seconds: KV_COPY_CURSOR_TTL_SECONDS },
-        durable: false,
-    },
-    cursor: (token) => validateStorageKey(`kv-copy:v1:cursor:${token}`),
-};
-/** Once traffic uses D1, copying stale KV state is refused. */
-export const kvCutoverKeys = {
-    family: {
-        name: "kv-cutover",
-        scope: "root",
-        prefixes: ["kv-cutover:v1:"],
-        version: { number: 1, in: "key" },
-        codec: textCodec,
-        ttl: { kind: "durable" },
-        durable: true,
-    },
-    source: (source) => validateStorageKey(`kv-cutover:v1:${encodeURIComponent(source)}`),
-};
 // --- connector families ---------------------------------------------------
 /** Seconds a consent's flow record stays claimable, the same as its link. */
 export const OAUTH_FLOW_TTL_SECONDS = 15 * 60;
@@ -356,38 +350,6 @@ export const oauthRefreshActiveKeys = {
     prefix: "oauth:refresh-active:",
     holder: (epoch, holder) => validateStorageKey(`oauth:refresh-active:${epoch}:${holder}`),
 };
-/** The values layout 2 stored, each under its historical key. */
-const oauthV2Field = {
-    client: "oauth:client",
-    tokens: "oauth:tokens",
-    pending: "oauth:pending",
-    verifier: "oauth:verifier",
-    state: "oauth:state",
-    discovery: "oauth:discovery",
-};
-/**
- * Layout 2, read once to migrate it into a grant record and then deleted:
- * each value at its field key, suffixed `:epoch:<generation>` once a modern
- * generation owned it; the active generation at `oauth:generation`; a reset's
- * cleanup lineage at `oauth:cleanup:` and `oauth:cleanup-at:`.
- */
-export const oauthV2Keys = {
-    family: {
-        name: "oauth-v2",
-        scope: "connector",
-        prefixes: [...Object.values(oauthV2Field), "oauth:generation", "oauth:cleanup:", "oauth:cleanup-at:"],
-        version: { number: 2, in: "value" },
-        codec: textCodec,
-        ttl: { kind: "durable" },
-        durable: true,
-    },
-    field: oauthV2Field,
-    /** One listing covers every layout 2 key; the reader keeps those above. */
-    scan: "oauth:",
-    /** A value's physical key; `epoch` null is the historical unsuffixed name. */
-    value: (key, epoch) => validateStorageKey(epoch === null ? key : `${key}:epoch:${epoch}`),
-    generation: "oauth:generation",
-};
 /** Single-use browser links (`used`/`started`/`failed`/`closed`) and MRTR rounds. */
 export const oauthConnectKeys = {
     family: {
@@ -403,8 +365,31 @@ export const oauthConnectKeys = {
     used: (nonce) => validateStorageKey(`oauth:connect-used:${nonce}`),
     retry: (nonce) => validateStorageKey(`oauth:request-used:${nonce}`),
 };
-/** A bounded, credential-partitioned downstream protocol verdict. */
+/**
+ * The last verification of a connector's operator-managed credential:
+ * `verification:v1`, holding an outcome class, its time and the vault
+ * revision of the save it observed. Payload-free and long-lived; a lost
+ * record only makes the operator page say "not verified".
+ */
+export const verificationKeys = {
+    family: {
+        name: "verification",
+        scope: "connector",
+        prefixes: ["verification:v1"],
+        version: { number: 1, in: "key" },
+        codec: jsonCodec,
+        ttl: { kind: "durable" },
+        durable: false,
+    },
+    record: "verification:v1",
+};
+/** A bounded, credential-partitioned downstream protocol verdict, keyed through `secretDigest`. */
 export const NEGOTIATION_TTL_SECONDS = 300;
+/**
+ * A legacy verdict lives longer: a server that upgrades still answers the
+ * legacy handshake, and one that stops answering it is renegotiated at once.
+ */
+export const LEGACY_NEGOTIATION_TTL_SECONDS = 6 * 60 * 60;
 export const negotiationKeys = {
     family: {
         name: "negotiation",
@@ -412,7 +397,8 @@ export const negotiationKeys = {
         prefixes: ["negotiation:v1:"],
         version: { number: 1, in: "key" },
         codec: jsonCodec,
-        ttl: { kind: "fixed", seconds: NEGOTIATION_TTL_SECONDS },
+        // The longest verdict lifetime; a modern verdict expires sooner.
+        ttl: { kind: "fixed", seconds: LEGACY_NEGOTIATION_TTL_SECONDS },
         durable: false,
     },
     verdict: (partitionDigest) => validateStorageKey(`negotiation:v1:${partitionDigest}`),
@@ -430,63 +416,18 @@ export const inputRetryKeys = {
     },
     used: (nonce) => validateStorageKey(`input-retry:v1:${nonce}`),
 };
-/**
- * Every family, for the overlap and coverage checks and for migrations that
- * copy only what a deployment cannot recreate. Keys a custom connector writes
- * through its own `ctx.storage` belong to that connector, inside its
- * namespace, and are not listed here.
- */
-export const KEY_FAMILIES = [
-    continuationKeys.family,
-    operatorViewerKeys.family,
-    resultKeys.family,
-    stashLedgerKeys.family,
-    stashExpiryKeys.family,
-    catalogKeys.family,
-    responseCacheKeys.family,
-    oauthHandoffKeys.family,
-    accessTokenKeys.family,
-    agentObservationKeys.family,
-    credentialKeys.family,
-    oauthGrantKeys.family,
-    oauthFlowKeys.family,
-    oauthRefreshKeys.family,
-    oauthRefreshSpentKeys.family,
-    oauthRefreshActiveKeys.family,
-    oauthV2Keys.family,
-    oauthConnectKeys.family,
-    negotiationKeys.family,
-    inputRetryKeys.family,
-    kvCopyKeys.family,
-    kvCutoverKeys.family,
-];
-// Principal, connector, and subject segments are hex digests and connector
-// ids, so none holds a colon.
-const PRINCIPAL_SCOPE = /^principal:[^:]*:/;
-const CONNECTOR_SCOPE = /^conn:[^:]*:/;
-const PARTITION_SCOPE = /^(?:results:|subject:[^:]*:)/;
-/**
- * The family a physical key belongs to, for reports that count keys without
- * naming them: one-shot migrations report per family, never per key. A key
- * no family claims is `connector-owned` when a custom connector wrote it
- * through its own `ctx.storage`, and `unclassified` otherwise (a key an older release wrote).
- */
-export function familyOfKey(key) {
-    let rest = key.replace(PRINCIPAL_SCOPE, "");
-    let scope = "root";
-    for (const [pattern, nested] of [
-        [CONNECTOR_SCOPE, "connector"],
-        [PARTITION_SCOPE, "partition"],
-    ]) {
-        const match = pattern.exec(rest);
-        if (match) {
-            rest = rest.slice(match[0].length);
-            scope = nested;
-            break;
-        }
-    }
-    const family = KEY_FAMILIES.find((candidate) => candidate.scope === scope && candidate.prefixes.some((prefix) => rest.startsWith(prefix)));
-    if (family)
-        return family.name;
-    return scope === "connector" ? "connector-owned" : "unclassified";
-}
+/** Retired OAuth names are inspected only to report that fresh consent is required. */
+export const retiredOAuthKeys = {
+    scan: "oauth:",
+    prefixes: [
+        "oauth:client",
+        "oauth:tokens",
+        "oauth:pending",
+        "oauth:verifier",
+        "oauth:state",
+        "oauth:discovery",
+        "oauth:generation",
+        "oauth:cleanup:",
+        "oauth:cleanup-at:",
+    ],
+};

package/dist/storage/memory.js

@@ -1,4 +1,5 @@
 import { validateStorageKey } from "./keys.js";
+import { noteStorageWrite, observeStorageWrites } from "../runtime/request-reads.js";
 /** In-memory KV store with expiry. The default for dev and Node. */
 export function memoryStorage() {
     const map = new Map();
@@ -40,7 +41,9 @@ export function memoryStorage() {
             ...(exp !== undefined ? { exp } : {}),
         });
     };
-    return {
+    // Each write settles synchronously, so one note covers it (request-reads.ts).
+    const root = {};
+    return observeStorageWrites({
         capabilities: { absoluteExpiry: true },
         describe: () => ({ kind: "memory" }),
         async get(key) {
@@ -49,10 +52,12 @@ export function memoryStorage() {
         },
         async set(key, value, opts) {
             validateStorageKey(key);
+            noteStorageWrite(root, key);
             write(key, value, opts);
         },
         async delete(key) {
             validateStorageKey(key);
+            noteStorageWrite(root, key);
             map.delete(key);
         },
         async list(prefix) {
@@ -68,6 +73,7 @@ export function memoryStorage() {
         // runs to completion before any other call on this map can start.
         async compareAndSet(key, expected, next, opts) {
             validateStorageKey(key);
+            noteStorageWrite(root, key);
             if ((fresh(key)?.value ?? null) !== expected)
                 return false;
             if (next === null)
@@ -76,5 +82,5 @@ export function memoryStorage() {
                 write(key, next, opts);
             return true;
         },
-    };
+    }, { root });
 }

package/dist/storage/sql-native.js

@@ -61,6 +61,8 @@ function schemaOnce(driver, ddl) {
     });
 }
 // --- key-value ----------------------------------------------------------
+/** Keys one `getMany` statement binds. */
+const GET_MANY_KEYS = 64;
 /** Expired rows one write removes on its way. */
 const SWEEP_ROWS = 16;
 function ttlMillis(ttlSeconds) {
@@ -105,6 +107,31 @@ export function nativeSqlStorage(driver) {
                 return yield* current(key);
             });
         },
+        getMany(keys) {
+            return Effect.gen(function* () {
+                for (const key of keys)
+                    validateStorageKey(key);
+                if (keys.length === 0)
+                    return [];
+                yield* ensure();
+                // One statement for every key: a chunked value costs one round trip.
+                // Rows answer by position, never by the key text a driver returns.
+                // Bound parameters stay under D1's per-statement limit of 100.
+                const values = keys.map(() => null);
+                for (let offset = 0; offset < keys.length; offset += GET_MANY_KEYS) {
+                    const batch = keys.slice(offset, offset + GET_MANY_KEYS);
+                    const rows = yield* driver.all({
+                        sql: `WITH wanted (position, key) AS (VALUES ${batch.map((_, i) => `(${offset + i}, ?)`).join(", ")})
+             SELECT wanted.position AS position, ${textColumn("value")}
+             FROM wanted JOIN connecta_kv ON connecta_kv.key = wanted.key AND ${live}`,
+                        params: batch,
+                    });
+                    for (const row of rows)
+                        values[row.position] = textOf(row.value, row.value_bytes, `the stored value of ${JSON.stringify(keys[row.position])}`);
+                }
+                return values;
+            });
+        },
         set(key, value, opts) {
             return Effect.gen(function* () {
                 validateStorageKey(key);
@@ -177,107 +204,6 @@ export function nativeSqlStorage(driver) {
         },
     };
 }
-/** Keys one read compares: D1 binds at most 100 parameters, one is `now`. */
-const COPY_READ_KEYS = 99;
-/** Writes one transaction carries, by count and by UTF-8 bytes. */
-const COPY_BATCH_STATEMENTS = 50;
-const COPY_BATCH_BYTES = 4 * 1024 * 1024;
-/**
- * Copy entries into the key-value table, verbatim: same key, same value,
- * same absolute expiry. A live row holding a different value is kept unless
- * `overwrite` is set, so a second copy of the same entries writes nothing.
- * Writes go out in bounded transactions; the outcomes follow `entries`.
- */
-export function copyIntoSqlEffect(driver, entries, options) {
-    return Effect.gen(function* () {
-        const { overwrite, now } = options;
-        for (const entry of entries)
-            validateStorageKey(entry.key);
-        yield* driver.batch(KV_SCHEMA.map((statement) => sql(statement)));
-        const live = "(expires_at_ms IS NULL OR expires_at_ms > ?)";
-        const currentValues = (keys) => Effect.gen(function* () {
-            const values = new Map();
-            for (let start = 0; start < keys.length; start += COPY_READ_KEYS) {
-                const chunk = keys.slice(start, start + COPY_READ_KEYS);
-                const rows = yield* driver.all(sql(`SELECT key, ${textColumn("value")}, expires_at_ms FROM connecta_kv
-         WHERE key IN (${chunk.map(() => "?").join(", ")}) AND ${live}`, ...chunk, now));
-                // The message names no key: a copy's errors reach operator output.
-                for (const row of rows) {
-                    values.set(row.key, {
-                        value: textOf(row.value, row.value_bytes, "a stored value") ?? "",
-                        expiresAtMs: row.expires_at_ms,
-                    });
-                }
-            }
-            return values;
-        });
-        const outcomes = Array.from({ length: entries.length });
-        const writes = [];
-        const existing = yield* currentValues(entries.map((entry) => entry.key));
-        for (const [index, entry] of entries.entries()) {
-            const current = existing.get(entry.key);
-            if (current?.value === entry.value && current.expiresAtMs === entry.expiresAtMs) {
-                outcomes[index] = "unchanged";
-            }
-            else if (current !== undefined && !overwrite) {
-                outcomes[index] = "conflict";
-            }
-            else {
-                outcomes[index] = current === undefined ? "copied" : "overwritten";
-                writes.push({
-                    index,
-                    bytes: new TextEncoder().encode(entry.key).byteLength + new TextEncoder().encode(entry.value).byteLength + 32,
-                    statement: overwrite
-                        ? sql(`INSERT INTO connecta_kv (key, value, expires_at_ms)
-               VALUES (?, ?, ?)
-               ON CONFLICT (key) DO UPDATE SET
-                 value = excluded.value, expires_at_ms = excluded.expires_at_ms`, entry.key, entry.value, entry.expiresAtMs)
-                        : // Absent when read; a live row written since is kept, not replaced.
-                            sql(`INSERT INTO connecta_kv (key, value, expires_at_ms)
-               VALUES (?, ?, ?)
-               ON CONFLICT (key) DO UPDATE SET
-                 value = excluded.value, expires_at_ms = excluded.expires_at_ms
-               WHERE connecta_kv.expires_at_ms IS NOT NULL
-                 AND connecta_kv.expires_at_ms <= ?`, entry.key, entry.value, entry.expiresAtMs, now),
-                });
-            }
-        }
-        const raced = [];
-        let batch = [];
-        let batchBytes = 0;
-        const flush = () => Effect.gen(function* () {
-            if (batch.length === 0)
-                return;
-            const changes = yield* driver.batch(batch.map((write) => write.statement));
-            for (const [position, write] of batch.entries()) {
-                if (!(changes[position] > 0))
-                    raced.push(write.index);
-            }
-            batch = [];
-            batchBytes = 0;
-        });
-        for (const write of writes) {
-            if (batch.length > 0 && (batch.length >= COPY_BATCH_STATEMENTS || batchBytes + write.bytes > COPY_BATCH_BYTES)) {
-                yield* flush();
-            }
-            batch.push(write);
-            batchBytes += write.bytes;
-        }
-        yield* flush();
-        // A row another writer added between the read and the write: report what
-        // it holds, and leave it.
-        if (raced.length > 0) {
-            const after = yield* currentValues(raced.map((index) => entries[index].key));
-            for (const index of raced) {
-                const entry = entries[index];
-                const current = after.get(entry.key);
-                outcomes[index] =
-                    current?.value === entry.value && current.expiresAtMs === entry.expiresAtMs ? "unchanged" : "conflict";
-            }
-        }
-        return outcomes;
-    });
-}
 // --- activity -----------------------------------------------------------
 /**
  * The activity table, with keyset paging on `(occurred_at_ms, id)`. Its shape

package/dist/storage/sql.d.ts

@@ -1,7 +1,5 @@
 import type { ActivityStore } from "../activity.js";
 import type { KVStorage } from "../types.js";
-/** The 0.28-compatible key-value table and expiry index. */
-export { KV_SCHEMA } from "./sql-schema.js";
 type SqlValue = string | number | null;
 export interface SqlStatement {
     readonly sql: string;
@@ -21,18 +19,6 @@ export interface SqlDriver {
 }
 /** The two drivers, as `describe()` names them. */
 export type SqlKind = "d1" | "sqlite";
-export interface SqlCopyEntry {
-    readonly key: string;
-    readonly value: string;
-    /** Epoch milliseconds; null never expires. */
-    readonly expiresAtMs: number | null;
-}
-/**
- * What a copy did with one entry: written where no live row was, left alone
- * because the live row already held the value, refused because it held
- * another (`conflict`), or replaced under `overwrite` (`overwritten`).
- */
-export type SqlCopyOutcome = "copied" | "unchanged" | "conflict" | "overwritten";
 export interface SqlActivityOptions {
     /**
      * Days of history kept. Each write removes a bounded batch of older rows,
@@ -48,13 +34,4 @@ export declare function sqlStorage(driver: SqlDriver, kind: SqlKind): KVStorage;
  * payload to leak.
  */
 export declare function sqlActivityStore(driver: SqlDriver, kind: SqlKind, options?: SqlActivityOptions): ActivityStore;
-/**
- * Copy entries into the key-value table, verbatim: same key, same value,
- * same absolute expiry. A live row holding a different value is kept unless
- * `overwrite` is set, so a second copy of the same entries writes nothing.
- * Writes go out in bounded transactions; the outcomes follow `entries`.
- */
-export declare function copyIntoSql(driver: SqlDriver, entries: readonly SqlCopyEntry[], options: {
-    overwrite: boolean;
-    now: number;
-}): Promise<SqlCopyOutcome[]>;
+export {};

package/dist/storage/sql.js

@@ -1,13 +1,20 @@
 import { runEdge } from "../runtime/run.js";
 import { registerNativeStorage, registerNativeActivity } from "../runtime/native-storage.js";
+import { observedWrite, observeStorageWrites } from "../runtime/request-reads.js";
 import { nativeSqlDriver } from "./sql-driver.js";
-import { nativeSqlStorage, nativeSqlActivityStore, copyIntoSqlEffect } from "./sql-native.js";
-/** The 0.28-compatible key-value table and expiry index. */
-export { KV_SCHEMA } from "./sql-schema.js";
+import { nativeSqlStorage, nativeSqlActivityStore } from "./sql-native.js";
 /** `KVStorage` over one `connecta_kv` table. */
 export function sqlStorage(driver, kind) {
-    const native = nativeSqlStorage(nativeSqlDriver(driver));
-    return registerNativeStorage({
+    const store = nativeSqlStorage(nativeSqlDriver(driver));
+    // Request read memos see every write begin and settle (request-reads.ts).
+    const root = {};
+    const native = {
+        ...store,
+        set: (key, value, options) => observedWrite(root, key, store.set(key, value, options)),
+        delete: (key) => observedWrite(root, key, store.delete(key)),
+        compareAndSet: (key, expected, next, options) => observedWrite(root, key, store.compareAndSet(key, expected, next, options)),
+    };
+    const edge = registerNativeStorage({
         capabilities: { absoluteExpiry: true },
         describe: () => ({ kind }),
         get: (key) => runEdge(native.get(key)),
@@ -16,6 +23,7 @@ export function sqlStorage(driver, kind) {
         list: (prefix) => runEdge(native.list(prefix)),
         compareAndSet: (key, expected, next, options) => runEdge(native.compareAndSet(key, expected, next, options)),
     }, native);
+    return observeStorageWrites(edge, { root });
 }
 /**
  * One append-only row per completed downstream call. Rows carry no arguments,
@@ -30,12 +38,3 @@ export function sqlActivityStore(driver, kind, options = {}) {
         list: (options) => runEdge(native.list(options)),
     }, native);
 }
-/**
- * Copy entries into the key-value table, verbatim: same key, same value,
- * same absolute expiry. A live row holding a different value is kept unless
- * `overwrite` is set, so a second copy of the same entries writes nothing.
- * Writes go out in bounded transactions; the outcomes follow `entries`.
- */
-export function copyIntoSql(driver, entries, options) {
-    return runEdge(copyIntoSqlEffect(nativeSqlDriver(driver), entries, options));
-}

package/dist/storage-digest.js

@@ -0,0 +1,32 @@
+import { Context } from "effect";
+import { bytesToHex } from "./bytes.js";
+import { serviceFor, setViewService } from "./runtime/call.js";
+class StorageDigestKey extends Context.Service()("connecta/operation/StorageDigestKey") {
+}
+const importHmac = (raw) => crypto.subtle.importKey("raw", new Uint8Array(raw), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+// Drawn synchronously on first use, so concurrent first digests share one key.
+let processBytes;
+let processKey;
+const fallbackKey = () => (processKey ??= importHmac((processBytes ??= crypto.getRandomValues(new Uint8Array(32)))));
+const vaultKeys = new WeakMap();
+/** Bind the vault's storage digest key to a registry-built context, when it has one. */
+export function attachStorageDigestKey(ctx, vault) {
+    const derive = vault?.storageDigestKey;
+    if (typeof derive !== "function")
+        return;
+    let key = vaultKeys.get(vault);
+    if (!key) {
+        let pending;
+        key = () => (pending ??= derive.call(vault));
+        vaultKeys.set(vault, key);
+    }
+    setViewService(ctx, StorageDigestKey, key);
+}
+/**
+ * `hmac:<hex>` of a secret-bearing value, for a stored key only. Stable for one
+ * deployment key, so equal inputs still address the same entry.
+ */
+export async function secretDigest(ctx, value) {
+    const key = await (serviceFor(ctx, StorageDigestKey) ?? fallbackKey)();
+    return `hmac:${bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value))))}`;
+}

package/dist/timeout.js

@@ -9,6 +9,14 @@ import { runEdge, withDeadlineEffect } from "./runtime/run.js";
  * to trip only on a pathological hang, not a realistically slow probe.
  */
 export const DEFAULT_PROBE_TIMEOUT_MS = CONFIG_DEFAULTS.discovery.probeTimeoutMs;
+/**
+ * Each connector's probe deadline in an unscoped search, or
+ * `discovery.probeTimeoutMs` when that is shorter. Scoped search, describe
+ * and calls keep the full probe deadline.
+ */
+export const UNSCOPED_PROBE_TIMEOUT_MS = 5_000;
+/** One unscoped search's whole discovery fan-out ends within this many ms. */
+export const UNSCOPED_DISCOVERY_BUDGET_MS = 9_000;
 /** A finite, positive integer number of milliseconds, or undefined. */
 export function normalizeTimeoutMs(value) {
     if (value === undefined || !Number.isFinite(value) || !(value > 0)) {

package/dist/tool-error.js

@@ -0,0 +1,4 @@
+export function toolError(error, fields = {}) {
+    const structuredContent = { ...fields, error };
+    return { content: [{ type: "text", text: JSON.stringify(structuredContent) }], structuredContent, isError: true };
+}