@zackbart/connecta 0.37.1 → 0.39.0

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.37.1",
+    "@zackbart/connecta": "0.39.0",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },

package/templates/node/src/connecta.config.ts

@@ -102,6 +102,7 @@ export default defineConfig((env: Env) => {
     // `npm run doctor` checks /agent/local-machine with its token. The starter
     // pool is the agent's base pool, its lowest tier (shared connectors, no
     // owner), named after the agent as the agent pool layout requires.
+    // Each pool lists only people or only agents; share tool lists across separate pools.
     pools: { "local-machine": { tools: ["time"], members: ["agent:local-machine"] } },
     // Machine clients are agents declared here by name, each with one cta_
     // token. Issue or rotate one locally with

package/dist/auth/oauth-v2-migration.js

@@ -1,135 +0,0 @@
-import { runEdge } from "../runtime/run.js";
-import { oauthV2Keys } from "../storage/keys.js";
-import { authAll, authCall, authFlow, authInvoke, authMap, authMethod, authProgram, authStorage, registerAuth, } from "./native.js";
-function plainObject(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function parse(raw) {
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}
-/** The issuer a discovery record names, as the SDK derives it. */
-export function discoveryIssuer(state) {
-    if (!plainObject(state) || typeof state.authorizationServerUrl !== "string")
-        return undefined;
-    const metadata = state.authorizationServerMetadata;
-    const issuer = plainObject(metadata) && typeof metadata.issuer === "string" ? metadata.issuer : state.authorizationServerUrl;
-    return issuer === "" ? undefined : issuer;
-}
-/**
- * Layout 2's grant in this namespace, or nothing when it holds none.
- *
- * Only issuer-stamped envelopes (`connectaOAuthVersion: 2`, written since
- * v0.9.0) of the active generation are read; anything older, and any value
- * the vault cannot open, is left behind, as layout 2's own flow entry would
- * have retired it. A grant is kept only when every credential carries a
- * stamp, the stamps agree, and they name the server the generation's
- * discovery names, if any; otherwise it migrates empty and needs consent.
- * One-shot consent state (pending URL, verifier, state) is not carried.
- */
-export function readV2Grant(storage, sealer) {
-    return runEdge(authProgram(readV2GrantNative, [storage, sealer]));
-}
-const readV2GrantNative = /* @__PURE__ */ registerAuth(readV2Grant, function (storage, sealer) {
-    return authFlow(function* () {
-        const keys = (yield authCall(listV2Keys, [storage]));
-        if (keys.length === 0)
-            return undefined;
-        const generation = (yield authStorage(storage, "get", [oauthV2Keys.generation])) ?? "legacy";
-        if (generation.startsWith("disconnected:"))
-            return { disconnected: true, body: {} };
-        if (!generation.startsWith("v2:") && generation !== "legacy") {
-            // An unfinished reset, or a numeric generation from before epochs.
-            return { disconnected: false, body: {} };
-        }
-        const epoch = generation === "legacy" ? null : generation;
-        const read = authMethod((field) => {
-            return authFlow(function* () {
-                const physicalKey = oauthV2Keys.value(field, epoch);
-                const raw = (yield authStorage(storage, "get", [physicalKey]));
-                if (raw === null)
-                    return undefined;
-                let parsed = parse(raw);
-                if (plainObject(parsed) && parsed.connectaOAuthSealed === 1 && typeof parsed.sealed === "string") {
-                    if (!sealer)
-                        return undefined;
-                    try {
-                        parsed = parse((yield authInvoke(sealer, "open", [physicalKey, parsed.sealed])));
-                    }
-                    catch {
-                        return undefined;
-                    }
-                }
-                if (plainObject(parsed) &&
-                    parsed.connectaOAuthVersion === 2 &&
-                    parsed.generation === generation &&
-                    (parsed.issuer === undefined || typeof parsed.issuer === "string") &&
-                    (parsed.binding === undefined || typeof parsed.binding === "string")) {
-                    return {
-                        value: parsed.value,
-                        ...(parsed.issuer !== undefined ? { issuer: parsed.issuer } : {}),
-                        ...(parsed.binding !== undefined ? { binding: parsed.binding } : {}),
-                        ...(parsed.carried === true ? { carried: true } : {}),
-                    };
-                }
-                // Layout 2 wrote discovery bare under the legacy generation.
-                return field === oauthV2Keys.field.discovery && epoch === null && discoveryIssuer(parsed)
-                    ? { value: parsed }
-                    : undefined;
-            });
-        });
-        const [client, tokens, discovery] = (yield authAll([
-            authCall(read, [oauthV2Keys.field.client]),
-            authCall(read, [oauthV2Keys.field.tokens]),
-            authCall(read, [oauthV2Keys.field.discovery]),
-        ], false));
-        const named = discovery ? discoveryIssuer(discovery.value) : undefined;
-        const credentials = [client, tokens].filter((value) => value !== undefined);
-        const issuer = credentials[0]?.issuer ?? named;
-        const consistent = credentials.every((value) => value.issuer !== undefined && value.issuer === issuer && plainObject(value.value)) &&
-            (named === undefined || named === issuer);
-        if (!consistent || issuer === undefined)
-            return { disconnected: false, body: {} };
-        return {
-            disconnected: false,
-            body: {
-                issuer,
-                ...(client
-                    ? {
-                        client: {
-                            value: client.value,
-                            ...(client.binding !== undefined ? { binding: client.binding } : {}),
-                            ...(client.carried ? { carried: true } : {}),
-                        },
-                    }
-                    : {}),
-                ...(tokens ? { tokens: tokens.value } : {}),
-                ...(discovery && named !== undefined ? { discovery: discovery.value } : {}),
-            },
-        };
-    });
-});
-/** Only historical families are removed, never grants, flows, or leases. */
-function listV2Keys(storage) {
-    return runEdge(authProgram(listV2KeysNative, [storage]));
-}
-const listV2KeysNative = /* @__PURE__ */ registerAuth(listV2Keys, function (storage) {
-    return authFlow(function* () {
-        return (yield authStorage(storage, "list", [oauthV2Keys.scan])).filter((key) => oauthV2Keys.family.prefixes.some((prefix) => key.startsWith(prefix)));
-    });
-});
-/** Return true only when every historical key was deleted. */
-export function deleteV2Keys(storage) {
-    return runEdge(authProgram(deleteV2KeysNative, [storage]));
-}
-const deleteV2KeysNative = /* @__PURE__ */ registerAuth(deleteV2Keys, function (storage) {
-    return authFlow(function* () {
-        const keys = (yield authCall(listV2Keys, [storage]));
-        const results = (yield authMap(keys, (key) => authStorage(storage, "delete", [key]), true));
-        return results.every((result) => result.status === "fulfilled");
-    });
-});

package/dist/provider-call-facts.d.ts

@@ -1,115 +0,0 @@
-import { ConnectorCallError } from "./errors.js";
-import type { Connector } from "./types.js";
-export interface ProviderRequest {
-    readonly dispatched: boolean;
-    readonly status?: number;
-    auxiliary: boolean;
-    /** A kit auxiliary declared as a read lacked physical GET/HEAD proof at dispatch. */
-    readonly blocksAuxiliaryProof?: true;
-    provider: string;
-    /** The HTTP method it was sent with, when its channel knows it. */
-    readonly method?: string;
-    /** Positive operation/tool evidence; an HTTP method alone proves no read. */
-    classification?: "read" | "write" | undefined;
-    /** Remote MCP's source class said write, recorded at physical dispatch. */
-    readonly sourceWrite?: true;
-    /** The genuine, legal idempotency key the vendor honors that it carried; nothing else. */
-    key?: string;
-    /**
-     * Its answer was a 401 that the transport's reviewed `authBeforeExecution`
-     * evidence covers: the vendor rejected the credential before it acted on
-     * the request. Only that makes a 401 a refusal (`servedRefusal`).
-     */
-    authBeforeExecution?: true;
-    /**
-     * Its answer was a 401, and a renewal then replaced the credential it sent
-     * with a different one ({@link renewedAfterUnauthorized}). The 401 no
-     * longer needs the operator's recovery. The single `settleWrite` decider
-     * still reports unknown, without the handoff (Q8).
-     */
-    readonly renewed?: true;
-}
-export type CallTool = Connector["callTool"];
-interface Boundary {
-    /** The api() or remoteMcp() object whose own code enters the logical call. */
-    boundary: object;
-    own: CallTool;
-}
-export declare function originalCallIdentity(connector: object): object;
-export declare function boundaryFor(connector: object): Boundary | undefined;
-export declare function delegatorFor(connector: object): CallTool | undefined;
-/** A physical send owns its fields permanently; its own answer is recorded once. */
-export declare function recordRequestField(request: ProviderRequest, field: keyof ProviderRequest, value: unknown): void;
-export declare function recordProviderResponse(request: ProviderRequest, status: number): void;
-/**
- * Declare that every request the connector's handlers send goes through a
- * channel the call ledger records: a guarded transport, `ctx.fetch`, or
- * `ctx.oauth.fetch`. Only then does an empty ledger prove that a failed
- * write never left. Maintained providers declare it; an arbitrary `api()`
- * handler can reach the network some other way, so its ledger proves nothing.
- */
-export declare function tracksEveryRequest<T extends object>(connector: T): T;
-export declare function tracksRequests(connector: object): boolean;
-/**
- * Declare a maintained connector whose `callTool` hands each call to at most
- * one api() or remoteMcp() boundary and sends nothing else that could apply
- * it (GitHub). Only then may that boundary's verdict stand for the call. The
- * object and its function are recorded now, at construction: a later
- * assignment to the property, or a copy of the object, declares nothing.
- */
-export declare function delegatesEachCall<T extends Connector>(connector: T): T;
-/**
- * Record a just-built api() or remoteMcp() object as a boundary, with its
- * published `callTool`. Its own code then names the same object, from its
- * closure, in {@link enterProviderBoundary}.
- */
-export declare function providerBoundary(connector: Connector): void;
-/**
- * `alias` serves `base` itself (`defineProvider`'s inheriting stamp), so it
- * takes `base`'s recorded identities. Only construction code calls this.
- */
-export declare function aliasCallIdentity(alias: object, base: object): void;
-/**
- * Whether a served HTTP status says the request was refused, not applied: a
- * 4xx other than 408. A 408 is a timeout, whose request may have been acted
- * on; a 2xx or 5xx never proves a write unapplied. A 401 passes here, and
- * `servedRefusal` still asks for the vendor's reviewed evidence.
- */
-export declare function refusedStatus(status: number | undefined): boolean;
-/**
- * Refusal provenance, recorded where the answer is observed: the request was
- * served a refusing status (`refusedStatus`) and the mapper failed on it. An
- * error code alone is never this evidence.
- */
-export declare function vendorRefusal<T>(error: T, request: ProviderRequest): T;
-/** An authorization verdict, the kind that keeps the `authorize_connector` handoff. */
-export declare function authorizationFailure(error: unknown): error is ConnectorCallError;
-/**
- * The authorization verdict `request`'s own 401 answer was mapped to, as
- * {@link vendorRefusal} recorded it. Undefined when nothing mapped that
- * answer, such as a body past the ceiling.
- */
-export declare function unauthorizedAnswer(request: ProviderRequest): ConnectorCallError | undefined;
-/**
- * A renewal answered `request`'s own 401 (a refresh, a login, a fresh token
- * minted) with `fresh`, a credential other than `sent`, the one the request
- * carried: that 401 no longer needs the operator's recovery (Q8). It names
- * the one request it answered and never marks another. A renewal that hands
- * back the credential the request already sent (an earlier recovery reused)
- * renewed nothing.
- */
-export declare function renewedAfterUnauthorized(request: ProviderRequest | undefined, sent: string, fresh: string): void;
-export declare function refusalRequest(error: unknown): ProviderRequest | undefined;
-export declare function knownProviderFailure<T>(error: T): T;
-export declare function isKnownProviderFailure(error: unknown): boolean;
-/** Withdraw a verdict that does not hold for the call that reports it. */
-export declare function forgetProviderFailure(error: object): void;
-/** Preserve internal verdicts and resend advice through redaction and provider recovery wording. */
-export declare function carryProviderFailure<T>(from: unknown, to: T): T;
-/** Mark a verdict that already accounts for a write's 401 in its own words. */
-export declare function explainedUnauthorizedVerdict<T>(error: T): T;
-export declare function explainsUnauthorized(error: unknown): boolean;
-/** Mark a verdict the Q8 decision made, final for every step after it. */
-export declare function settledWrite<T>(error: T): T;
-export declare function isSettledWrite(error: unknown): boolean;
-export {};

package/dist/provider-call.d.ts

@@ -1,112 +0,0 @@
-import { type ProviderRequest, type CallTool } from "./provider-call-facts.js";
-import type { ConnectorContext } from "./types.js";
-export interface ProviderCall {
-    requests: ProviderRequest[];
-    classification?: "read" | "write" | undefined;
-    /** The handler settled: its outcome may be reported, so nothing more leaves. */
-    closed: boolean;
-    /** The calls of api() boundaries entered beneath this one's handler. */
-    nested: ProviderCall[];
-    /** The call whose handler entered this one; undefined for the outermost. */
-    parent?: ProviderCall;
-}
-export interface LogicalCall {
-    target: object;
-    entered: CallTool;
-    boundaries: object[];
-    /** Every resource request dispatched under it, once per dispatch, from any ledger. */
-    sent: ProviderRequest[];
-    /** Auxiliary GET/HEAD dispatches without method overrides, apart from resource writes and auth POSTs. */
-    auxiliaryReads: ProviderRequest[];
-    /** A kit auxiliary declared as a read dispatched without physical read proof. */
-    nonReadAuxiliaryDispatched: boolean;
-}
-export declare function providerCallContext(ctx: ConnectorContext, classification?: "read" | "write"): ConnectorContext;
-/** Whether `ctx`'s call was entered by another api() boundary's handler. */
-export declare function nestedProviderCall(ctx: ConnectorContext): boolean;
-export declare function providerRequests(ctx: ConnectorContext): readonly ProviderRequest[] | undefined;
-/**
- * Every request the ledgers of api() boundaries nested beneath `ctx`'s call
- * recorded, at any depth: an inner call's 401 still decides the outer's
- * write (Q8), whatever the outer handler made of the inner's failure.
- */
-export declare function nestedProviderRequests(ctx: ConnectorContext): ProviderRequest[];
-/**
- * End the call's ledger before its outcome is decided. A request still in
- * flight already counts as dispatched; one that has not left yet (a sibling
- * still reading its credential, say) is refused by {@link dispatchProviderRequest}
- * and never leaves after the failure is reported.
- */
-export declare function closeProviderCall(ctx: ConnectorContext): void;
-/**
- * Refuse every request after its request scope ends, before credential reads
- * and again immediately before dispatch. Resource requests also require an
- * open call. Auxiliary requests (token mints, lookups) may outlive that call,
- * but never their request.
- */
-export declare function assertProviderCallOpen(ctx: ConnectorContext, provider: string, auxiliary: boolean): void;
-/** Record that a request leaves now; synchronous with the send that follows it. */
-export declare function dispatchProviderRequest(ctx: ConnectorContext | undefined, request: ProviderRequest, headers?: HeadersInit, method?: string | undefined): void;
-export declare function recordingFetch<T extends object>(send: T): T;
-export declare function isRecordingFetch(send: object | undefined): boolean;
-export declare function handoffProviderRequest(init: RequestInit, request: ProviderRequest): void;
-export declare function takeProviderHandoff(init: RequestInit): ProviderRequest | undefined;
-export declare function bindProviderResponse(response: object, request: ProviderRequest, owner: ProviderRequest | undefined): void;
-export declare function responseProviderRequest(response: object, owner: ProviderRequest): ProviderRequest | undefined;
-export declare function providerRequest(ctx: ConnectorContext, auxiliary: boolean, provider: string, sent?: {
-    method?: string;
-    key?: string;
-    classification?: "read" | "write";
-}): ProviderRequest;
-/**
- * The invocation opens one logical call on the context it hands a connector,
- * naming the exact object and `callTool` function it is about to invoke.
- */
-export declare function openLogicalCall(ctx: ConnectorContext, target: object, entered: CallTool): LogicalCall;
-/**
- * An api() or remoteMcp() boundary was entered under `ctx`'s logical call.
- * `boundary` is the object it was built as, from its own closure, never `this`.
- */
-export declare function enterProviderBoundary(ctx: ConnectorContext, boundary: object): void;
-/**
- * Whether a failure's known mark holds for its whole logical call (INV-9).
- * A boundary marks a write known only when every request it dispatched is
- * proven unapplied, so the mark stands when that boundary owned the call
- * ({@link ownsLogicalCall}) and at most one boundary was entered. A wrapper
- * that composed several calls, or could send around them, never inherits an
- * inner verdict.
- */
-export declare function knownCallFailure(call: LogicalCall | undefined, error: unknown): boolean;
-/**
- * Positive proof that a complete tracked call dispatched only auxiliaries,
- * including a recorded resource read (positive GET/HEAD evidence). An
- * authentication POST alone is not evidence of that call's resource work:
- * token mints can be shared with callers whose ledgers did not send them.
- * An empty resource ledger is not this proof: even a declared api() entry
- * can report a timeout and recovery facts without recording any dispatch.
- * Keep those calls conservative rather than inferring an auxiliary failure
- * from the absence of a resource request. Wrappers and untracked boundaries
- * cannot borrow an inner call's observations.
- */
-export declare function onlyAuxiliaryRequests(call: LogicalCall | undefined): boolean;
-/**
- * Whether reusing `key` with the exact original arguments cannot repeat any
- * write of `ctx`'s logical call, the one basis for key-reuse advice (INV-9).
- * It holds only when the call entered exactly one boundary, which owned it
- * and tracks every request, and sent exactly one write, carrying `key`. A
- * request counts as a read only with positive classification and a recorded
- * GET or HEAD ({@link readRequest}). An inner request's key never speaks for a composite,
- * a wrapper, a second write, or an earlier unrelated request.
- */
-export declare function keyProtectsCall(call: LogicalCall | undefined, key: string | undefined): boolean;
-/** Positive read evidence, with GET/HEAD as #902's additional conservative bound. */
-export declare function readRequest(request: Pick<ProviderRequest, "classification" | "method">, headers?: HeadersInit): boolean;
-export declare function providerFetch(ctx: ConnectorContext, provider: string, auxiliary: boolean, send: typeof fetch): typeof fetch;
-/** Whether an invocation opened the logical call `ctx` belongs to; it then settles Q8 itself. */
-export declare function inLogicalCall(ctx: object): boolean;
-/**
- * Every resource request dispatched under `ctx`'s logical call, from any
- * ledger, nested ones included; undefined outside one.
- */
-export declare function logicalCallRequests(ctx: object | undefined): readonly ProviderRequest[] | undefined;
-export { recordProviderResponse, tracksEveryRequest, tracksRequests, delegatesEachCall, providerBoundary, refusedStatus, vendorRefusal, authorizationFailure, unauthorizedAnswer, renewedAfterUnauthorized, refusalRequest, knownProviderFailure, isKnownProviderFailure, forgetProviderFailure, explainedUnauthorizedVerdict, explainsUnauthorized, settledWrite, isSettledWrite, type ProviderRequest, } from "./provider-call-facts.js";

package/dist/storage/d1-copy.js

@@ -1,255 +0,0 @@
-// Native copy orchestration. Only Workers KV and Web Crypto are Promise leaves.
-import { Effect } from "effect";
-import { errorLabel } from "../operator-record.js";
-import { KvToD1CopyError } from "../d1.js";
-import { familyOfKey, KEY_FAMILIES, KV_COPY_CURSOR_TTL_SECONDS, kvCopyKeys, kvCutoverKeys } from "./keys.js";
-import { copyIntoSqlEffect, nativeSqlStorage } from "./sql-native.js";
-import { nativeSqlDriver } from "./sql-driver.js";
-import { d1Driver } from "./d1-driver.js";
-const leaf = (operation) => Effect.tryPromise({ try: operation, catch: (error) => error });
-// A native equivalent of a Promise try/catch. Synchronous parser/validation
-// throws keep their original identity too; interruption is never recovered.
-const attempt = (effect) => Effect.result(effect.pipe(Effect.catchDefect((error) => Effect.fail(error))));
-/** D1 string and row limit, in UTF-8 bytes.
- * https://developers.cloudflare.com/d1/platform/limits/
- */
-const D1_MAX_ROW_BYTES = 2000000;
-/** Buffered entries, excluding the single value currently being read. */
-const COPY_BUFFER_BYTES = 4 * 1024 * 1024;
-const COPY_GROUP_KEYS = 50;
-const KV_LIST_LIMIT = 1000;
-const encoder = new TextEncoder();
-// SQLite record header, two TEXT serial types, and an eight-byte expiry.
-// Reserve the worst-case header rather than accepting a row at the boundary.
-const ROW_OVERHEAD_BYTES = 32;
-const emptyCounts = () => ({
-    copied: 0,
-    unchanged: 0,
-    conflicts: 0,
-    overwritten: 0,
-    expired: 0,
-    invalid: 0,
-    verified: 0,
-    mismatches: 0,
-});
-const OUTCOME_COUNT = {
-    copied: "copied",
-    unchanged: "unchanged",
-    conflict: "conflicts",
-    overwritten: "overwritten",
-};
-function errorClass(error) {
-    const label = errorLabel(error);
-    return label ? ` (${label})` : "";
-}
-const valueHash = (value) => Effect.gen(function* () {
-    const hash = yield* leaf(() => crypto.subtle.digest("SHA-256", encoder.encode(value)));
-    return Array.from(new Uint8Array(hash), (byte) => byte.toString(16).padStart(2, "0")).join("");
-});
-/** Mark cutover before reopening traffic. The marker stays in D1 permanently. */
-export function markKvToD1LiveEffect(db, source) {
-    return Effect.gen(function* () {
-        if (typeof source !== "string" || !source || source.includes("\0")) {
-            throw new TypeError("copyKvToD1 source must be a namespace id");
-        }
-        const cutover = yield* attempt(nativeSqlStorage(nativeSqlDriver(d1Driver(db))).set(kvCutoverKeys.source(source), "live"));
-        if (cutover._tag === "Failure") {
-            const error = cutover.failure;
-            throw new KvToD1CopyError(`Workers KV to D1 copy stopped: recording cutover failed${errorClass(error)}`, undefined);
-        }
-    });
-}
-/**
- * Copy live KV entries verbatim while all writers and traffic are stopped.
- * A live D1 row is kept unless its family is explicitly allowed to overwrite.
- * `verify` reads hashes and absolute expiries without changing copied entries.
- * Results contain counts only. Resume tokens are source-bound atomic claims.
- */
-export function copyKvToD1Effect(kv, db, options) {
-    return Effect.gen(function* () {
-        if (!options?.source || typeof options.source !== "string" || options.source.includes("\0")) {
-            throw new TypeError("copyKvToD1 source must be a namespace id");
-        }
-        const maxKeys = options.maxKeys ?? 500;
-        if (!Number.isSafeInteger(maxKeys) || maxKeys < 1) {
-            throw new TypeError("copyKvToD1 maxKeys must be a positive integer");
-        }
-        const allowed = new Set([...KEY_FAMILIES.map((family) => family.name), "connector-owned", "unclassified"]);
-        if (options.overwriteFamilies?.some((family) => !allowed.has(family))) {
-            throw new TypeError("copyKvToD1 overwriteFamilies contains an unknown family");
-        }
-        const overwrite = new Set(options.overwriteFamilies ?? []);
-        const driver = nativeSqlDriver(d1Driver(db));
-        const storage = nativeSqlStorage(driver);
-        const remember = (kvCursor) => Effect.gen(function* () {
-            const token = crypto.randomUUID();
-            yield* storage.set(kvCopyKeys.cursor(token), JSON.stringify({ source: options.source, cursor: kvCursor }), {
-                ttlSeconds: KV_COPY_CURSOR_TTL_SECONDS,
-            });
-            return token;
-        });
-        let cursor;
-        let pageCursor;
-        const families = {};
-        const count = (key, field) => {
-            (families[familyOfKey(key)] ??= emptyCounts())[field] += 1;
-        };
-        const unknown = new TypeError("copyKvToD1 cursor is unknown, expired, spent, or belongs to another source; restart under maintenance");
-        const stale = new TypeError("copyKvToD1 refuses stale KV after cutover");
-        // Validate before any D1 access so a failing binding cannot return raw input
-        // as an error's resume point.
-        if (options.cursor !== undefined &&
-            !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(options.cursor)) {
-            throw unknown;
-        }
-        const failures = new WeakSet();
-        const failure = (message) => {
-            const error = new KvToD1CopyError(message, undefined);
-            failures.add(error);
-            return error;
-        };
-        const claim = yield* attempt(Effect.gen(function* () {
-            if (!options.allowStale && (yield* storage.get(kvCutoverKeys.source(options.source))) !== null) {
-                throw stale;
-            }
-            if (options.cursor !== undefined) {
-                const key = kvCopyKeys.cursor(options.cursor);
-                const stored = yield* storage.get(key);
-                let record = null;
-                try {
-                    record = stored === null ? null : JSON.parse(stored);
-                }
-                catch {
-                    /* refused below */
-                }
-                if (!record || record.source !== options.source || typeof record.cursor !== "string") {
-                    throw unknown;
-                }
-                // Delete only the exact record read: concurrent consumers cannot both win.
-                if (!(yield* storage.compareAndSet(key, stored, null)))
-                    throw unknown;
-                cursor = record.cursor;
-            }
-        }));
-        if (claim._tag === "Failure") {
-            const error = claim.failure;
-            if (error === unknown || error === stale)
-                throw error;
-            throw new KvToD1CopyError(`Workers KV to D1 copy stopped: claiming the resume point in D1 failed${errorClass(error)}`, options.cursor);
-        }
-        const flush = (buffer) => Effect.gen(function* () {
-            const entries = buffer.filter((entry) => {
-                if (entry.expiresAtMs !== null && entry.expiresAtMs <= Date.now()) {
-                    count(entry.key, "expired");
-                    return false;
-                }
-                return true;
-            });
-            if (!entries.length)
-                return;
-            const flushed = yield* attempt(Effect.gen(function* () {
-                if (options.verify) {
-                    for (const entry of entries) {
-                        const [row] = yield* driver.all({
-                            // Read bytes, including NUL, and hash in JS. D1 has no SHA-256 function.
-                            sql: "SELECT CAST(value AS BLOB) AS value_bytes, expires_at_ms FROM connecta_kv WHERE key = ?",
-                            params: [entry.key],
-                        });
-                        const bytes = row ? Uint8Array.from(row.value_bytes) : undefined;
-                        const hash = bytes ? yield* leaf(() => crypto.subtle.digest("SHA-256", bytes)) : undefined;
-                        const hex = hash
-                            ? Array.from(new Uint8Array(hash), (byte) => byte.toString(16).padStart(2, "0")).join("")
-                            : undefined;
-                        count(entry.key, row && row.expires_at_ms === entry.expiresAtMs && hex === (yield* valueHash(entry.value))
-                            ? "verified"
-                            : "mismatches");
-                    }
-                }
-                else {
-                    // Partition only this bounded buffer by overwrite permission.
-                    for (const replace of [false, true]) {
-                        const group = entries.filter((entry) => overwrite.has(familyOfKey(entry.key)) === replace);
-                        if (!group.length)
-                            continue;
-                        const outcomes = yield* copyIntoSqlEffect(driver, group, { overwrite: replace, now: Date.now() });
-                        for (const [index, outcome] of outcomes.entries())
-                            count(group[index].key, OUTCOME_COUNT[outcome]);
-                    }
-                }
-            }));
-            if (flushed._tag === "Failure") {
-                const error = flushed.failure;
-                throw failure(`Workers KV to D1 copy stopped: ${options.verify ? "verifying" : "writing to"} D1 failed${errorClass(error)}`);
-            }
-        });
-        let read = 0;
-        const copied = yield* attempt(Effect.gen(function* () {
-            for (;;) {
-                pageCursor = cursor;
-                const listed = yield* attempt(leaf(() => kv.list({ limit: Math.min(KV_LIST_LIMIT, maxKeys - read), ...(cursor ? { cursor } : {}) })));
-                if (listed._tag === "Failure") {
-                    const error = listed.failure;
-                    throw failure(`Workers KV to D1 copy stopped: listing Workers KV failed${errorClass(error)}`);
-                }
-                const page = listed.success;
-                read += page.keys.length;
-                let entries = [];
-                let bufferedBytes = 0;
-                for (const key of page.keys) {
-                    const keyBytes = encoder.encode(key.name).byteLength;
-                    if (key.name.includes("\0") || keyBytes + ROW_OVERHEAD_BYTES > D1_MAX_ROW_BYTES) {
-                        count(key.name, "invalid");
-                        continue;
-                    }
-                    const expiresAtMs = key.expiration === undefined ? null : key.expiration * 1000;
-                    if (expiresAtMs !== null && expiresAtMs <= Date.now()) {
-                        count(key.name, "expired");
-                        continue;
-                    }
-                    const readValue = yield* attempt(leaf(() => kv.get(key.name, "text")));
-                    if (readValue._tag === "Failure") {
-                        const error = readValue.failure;
-                        throw failure(`Workers KV to D1 copy stopped: reading an entry of the ${familyOfKey(key.name)} family from Workers KV failed${errorClass(error)}`);
-                    }
-                    const value = readValue.success;
-                    if (value === null || (expiresAtMs !== null && expiresAtMs <= Date.now())) {
-                        count(key.name, "expired");
-                        continue;
-                    }
-                    const valueBytes = encoder.encode(value).byteLength;
-                    const bytes = keyBytes + valueBytes + ROW_OVERHEAD_BYTES;
-                    if (valueBytes > D1_MAX_ROW_BYTES || bytes > D1_MAX_ROW_BYTES) {
-                        count(key.name, "invalid");
-                        continue;
-                    }
-                    if (entries.length >= COPY_GROUP_KEYS || bufferedBytes + bytes > COPY_BUFFER_BYTES) {
-                        yield* flush(entries);
-                        entries = [];
-                        bufferedBytes = 0;
-                    }
-                    entries.push({ key: key.name, value, expiresAtMs });
-                    bufferedBytes += bytes;
-                }
-                yield* flush(entries);
-                if (page.list_complete || !page.cursor)
-                    return { done: true, families };
-                cursor = page.cursor;
-                if (read >= maxKeys)
-                    return { done: false, cursor: yield* remember(cursor), families };
-            }
-        }));
-        if (copied._tag === "Failure") {
-            const error = copied.failure;
-            // The old token was claimed atomically. Replace it on failure, if D1 works.
-            const resume = pageCursor === undefined
-                ? undefined
-                : yield* attempt(remember(pageCursor)).pipe(Effect.map((result) => (result._tag === "Success" ? result.success : undefined)));
-            throw new KvToD1CopyError(error instanceof KvToD1CopyError && failures.has(error)
-                ? error.message
-                : `Workers KV to D1 copy stopped: recording the resume point in D1 failed${errorClass(error)}`, resume);
-        }
-        else {
-            return copied.success;
-        }
-    });
-}

package/dist/storage/sql-schema.d.ts

@@ -1,6 +0,0 @@
-/**
- * The key-value table. Its shape is the one the 0.28 Worker example's
- * `d1-storage.ts` documented, so a D1 database that already holds it is read
- * as is.
- */
-export declare const KV_SCHEMA: readonly string[];