Delete KV namespace when removing a worker

The remove command now deletes the associated KV namespace
(tokfresh-tokens-{name}) after deleting the worker script. KV cleanup
is best-effort — if the namespace is not found or deletion fails, the
worker removal still succeeds with a warning logged.

Author: stevejkang

cmd/remove.go

@@ -57,7 +57,19 @@ func runRemove(cmd *cobra.Command, args []string) error {
 	cfDeleteOK := false
 	if authErr == nil {
 		deleteErr := ui.RunWithSpinnerFullscreen("Deleting worker from Cloudflare...", func() error {
-			return cloudflare.DeleteWorker(auth.AccountID, auth.Token, name)
+			if err := cloudflare.DeleteWorker(auth.AccountID, auth.Token, name); err != nil {
+				return err
+			}
+			kvTitle := fmt.Sprintf("tokfresh-tokens-%s", name)
+			nsID, findErr := cloudflare.FindKV(auth.AccountID, auth.Token, kvTitle)
+			if findErr != nil {
+				log.Debug("KV namespace not found, skipping deletion", "title", kvTitle)
+				return nil
+			}
+			if delErr := cloudflare.DeleteKV(auth.AccountID, auth.Token, nsID); delErr != nil {
+				log.Warn("failed to delete KV namespace", "title", kvTitle, "error", delErr)
+			}
+			return nil
 		})
 		if deleteErr != nil {
 			log.Warn("failed to delete worker from Cloudflare", "error", deleteErr)

internal/cloudflare/api.go

@@ -412,6 +412,33 @@ func DeleteWorker(accountID, token, workerName string) error {
 	}
 }
 
+// DeleteKV deletes a KV namespace.
+func DeleteKV(accountID, token, namespaceID string) error {
+	url := fmt.Sprintf("%s/accounts/%s/storage/kv/namespaces/%s", cfAPIBase, accountID, namespaceID)
+
+	log.Debug("deleting KV namespace", "url", url)
+	start := time.Now()
+	resp, err := doRequest("DELETE", url, token, nil)
+	if err != nil {
+		return fmt.Errorf("KV delete request failed: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	log.Debug("KV delete response", "status", resp.StatusCode, "elapsed", time.Since(start))
+
+	switch resp.StatusCode {
+	case http.StatusOK:
+		return nil
+	case http.StatusNotFound:
+		return nil
+	case http.StatusForbidden, http.StatusUnauthorized:
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("%w: %s", ErrUnauthorized, string(body))
+	default:
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("KV delete failed (%d): %s", resp.StatusCode, string(body))
+	}
+}
+
 // parseCFErrorCode extracts the first error code from a CF API error response.
 // CF error responses: {"success":false,"errors":[{"code":10063,"message":"..."}]}
 func parseCFErrorCode(body []byte) int {

internal/cloudflare/api_test.go

@@ -585,3 +585,43 @@ func TestDeleteWorker_Forbidden_ReturnsUnauthorized(t *testing.T) {
 		t.Errorf("expected ErrUnauthorized, got: %v", err)
 	}
 }
+
+func TestDeleteKV(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.Method != "DELETE" {
+				t.Errorf("expected DELETE, got %s", r.Method)
+			}
+			if !strings.Contains(r.URL.Path, "/storage/kv/namespaces/ns-123") {
+				t.Errorf("wrong path: %s", r.URL.Path)
+			}
+			w.WriteHeader(http.StatusOK)
+		}))
+		defer server.Close()
+
+		origBase := cfAPIBase
+		cfAPIBase = server.URL
+		defer func() { cfAPIBase = origBase }()
+
+		err := DeleteKV("acc", "tok", "ns-123")
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+
+	t.Run("not found is not an error", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusNotFound)
+		}))
+		defer server.Close()
+
+		origBase := cfAPIBase
+		cfAPIBase = server.URL
+		defer func() { cfAPIBase = origBase }()
+
+		err := DeleteKV("acc", "tok", "ns-missing")
+		if err != nil {
+			t.Fatalf("expected nil for 404, got: %v", err)
+		}
+	})
+}