@stage-labs/metro 0.1.0-beta.26 → 0.1.0-beta.261

package/runtime/node_modules/@metro-labs/daemon/src/connectors/tools.ts

@@ -0,0 +1,81 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { authHeaders, INITIALIZE, mcpPost, payloadOf, refused, type ConnectorAuth } from './verify.js';
+
+export interface RemoteTool {
+  name: string;
+  title: string;
+  description: string;
+  readOnly: boolean;
+}
+
+const TIMEOUT_MS = 15_000;
+const MAX_PAGES = 10;
+
+function resultOf(text: string, contentType: string): Record<string, unknown> | null {
+  let parsed: unknown = null;
+  try {
+    parsed = JSON.parse(payloadOf(text, contentType));
+  } catch {
+    return null;
+  }
+  return isRecord(parsed) && isRecord(parsed.result) ? parsed.result : null;
+}
+
+async function rpc(url: URL, auth: ConnectorAuth, session: Map<string, string>, body: unknown): Promise<Record<string, unknown> | null> {
+  const res = await mcpPost(url, auth, body, { timeoutMs: TIMEOUT_MS, headers: Object.fromEntries(session) });
+  const id = res.headers.get('mcp-session-id');
+  if (id !== null && id !== '') session.set('mcp-session-id', id);
+  const text = await res.text().catch(() => '');
+  if (res.status === 401 || res.status === 403) throw refused(`${url.hostname} rejected the credential; connect it again`);
+  if (!res.ok) throw refused(`${url.hostname} answered ${String(res.status)}`);
+  return resultOf(text, res.headers.get('content-type') ?? '');
+}
+
+function toTool(raw: unknown): RemoteTool | null {
+  if (!isRecord(raw) || typeof raw.name !== 'string') return null;
+  const annotations = isRecord(raw.annotations) ? raw.annotations : {};
+  const title = typeof raw.title === 'string' && raw.title !== '' ? raw.title : raw.name;
+  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true };
+}
+
+async function endSession(url: URL, auth: ConnectorAuth, session: Map<string, string>): Promise<void> {
+  if (!session.has('mcp-session-id')) return;
+  try {
+    const res = await fetch(url, { method: 'DELETE', redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT_MS), headers: { ...authHeaders(auth), ...Object.fromEntries(session) } });
+    await res.body?.cancel();
+  } catch (err) {
+    log.debug({ host: url.hostname, err: errMsg(err) }, 'connector-tools: the remote declined to end the session');
+  }
+}
+
+const toolsOf = (result: Record<string, unknown>): RemoteTool[] =>
+  Array.isArray(result.tools) ? result.tools.flatMap((raw: unknown) => toTool(raw) ?? []) : [];
+
+function nextCursor(result: Record<string, unknown>, current: string): string | null {
+  const next = result.nextCursor;
+  return typeof next !== 'string' || next === '' || next === current ? null : next;
+}
+
+async function walkTools(url: URL, auth: ConnectorAuth, session: Map<string, string>): Promise<RemoteTool[]> {
+  const tools: RemoteTool[] = [];
+  let cursor: string | null = '';
+  for (let page = 0; page < MAX_PAGES && cursor !== null; page += 1) {
+    const result = await rpc(url, auth, session, { jsonrpc: '2.0', id: 2 + page, method: 'tools/list', params: cursor === '' ? {} : { cursor } });
+    if (result === null) break;
+    tools.push(...toolsOf(result));
+    cursor = nextCursor(result, cursor);
+  }
+  return tools;
+}
+
+export async function listRemoteTools(url: URL, auth: ConnectorAuth): Promise<RemoteTool[]> {
+  const session = new Map<string, string>();
+  const init = await rpc(url, auth, session, INITIALIZE);
+  if (init === null || typeof init.protocolVersion !== 'string') throw refused(`${url.hostname} answered, but it does not speak MCP.`);
+  session.set('mcp-protocol-version', init.protocolVersion);
+  await rpc(url, auth, session, { jsonrpc: '2.0', method: 'notifications/initialized' });
+  const tools = await walkTools(url, auth, session);
+  await endSession(url, auth, session);
+  return tools;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/transfer-api.ts

@@ -0,0 +1,116 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { randomUUID, type KeyObject } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { parseId } from '@metro-labs/core/ids';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiSession, cors, readJsonBody, requireAdmin, sendJson } from '@metro-labs/http/api-http';
+import { openTransfer, sealTransfer, transferKeys } from './transfer-crypto.js';
+import type { LocalConnectorRow } from './store.js';
+import type { ConnectorCopyResult } from './transfer-store.js';
+
+const PREFIX = '/api/connectors/transfer';
+const MAX_BODY = 4 * 1024 * 1024 + 4096;
+const TTL = 5 * 60_000;
+
+export interface ConnectorTransferDeps {
+  read: () => LocalConnectorRow[];
+  copy: (value: unknown) => ConnectorCopyResult[];
+  now?: () => number;
+}
+
+interface Ticket {
+  privateKey: KeyObject;
+  organization: string;
+  expiresAt: number;
+}
+
+function selectedIds(raw: unknown): string[] | null {
+  if (raw === null) return null;
+  if (!Array.isArray(raw) || raw.length === 0 || raw.length > 500) throw new ApiError('choose connectors to copy', 400);
+  return [...new Set(raw.map((id: unknown) => {
+    if (typeof id !== 'string' || parseId(id) === null) throw new ApiError('choose connectors to copy', 400);
+    return id;
+  }))];
+}
+
+export class ConnectorTransfers {
+  private readonly tickets = new Map<string, Ticket>();
+
+  constructor(private readonly deps: ConnectorTransferDeps) {}
+
+  private prepare(organization: string): unknown {
+    const now = (this.deps.now ?? Date.now)();
+    for (const [id, ticket] of this.tickets) if (ticket.expiresAt <= now) this.tickets.delete(id);
+    if (this.tickets.size >= 64) throw new ApiError('too many pending connector copies, try again later', 429);
+    const { publicKey, privateKey } = transferKeys();
+    const ticket = randomUUID();
+    this.tickets.set(ticket, { privateKey, organization, expiresAt: now + TTL });
+    return { ticket, publicKey };
+  }
+
+  private export(body: Record<string, unknown>): unknown {
+    if (typeof body.publicKey !== 'string') throw new ApiError('invalid transfer key', 400);
+    const ids = selectedIds(body.ids);
+    const all = this.deps.read();
+    const rows = ids === null ? all : all.filter((row) => ids.includes(row.id));
+    const expected = ids?.length ?? rows.length;
+    if (rows.length !== expected) throw new ApiError('a selected connector no longer exists', 409);
+    if (rows.length > 500) throw new ApiError('copy at most 500 connectors at once', 413);
+    try {
+      return sealTransfer({ version: 1, connectors: rows }, body.publicKey);
+    } catch (err) {
+      if (err instanceof ApiError) throw err;
+      throw new ApiError('invalid transfer key', 400);
+    }
+  }
+
+  private receive(body: Record<string, unknown>, organization: string): unknown {
+    const id = typeof body.ticket === 'string' ? body.ticket : '';
+    const ticket = this.tickets.get(id);
+    if (ticket?.organization !== organization || ticket.expiresAt <= (this.deps.now ?? Date.now)()) {
+      this.tickets.delete(id);
+      throw new ApiError('this connector copy has expired, start again', 410);
+    }
+    let value: unknown;
+    try {
+      value = openTransfer(body.envelope, ticket.privateKey);
+    } catch {
+      throw new ApiError('invalid encrypted connector copy', 400);
+    }
+    const results = this.deps.copy(value);
+    this.tickets.delete(id);
+    return { results };
+  }
+
+  private async answer(req: IncomingMessage, path: string): Promise<unknown> {
+    const session = await apiSession(req);
+    if (session === null) throw new ApiError('unauthorized', 401);
+    requireAdmin(session);
+    const body = await readJsonBody(req, MAX_BODY);
+    if (!isRecord(body) || body.confirmed !== true) throw new ApiError('confirm copying saved logins and settings', 400);
+    if (path === `${PREFIX}/prepare`) return this.prepare(session.subject);
+    if (path === `${PREFIX}/export`) return this.export(body);
+    return this.receive(body, session.subject);
+  }
+
+  handle(req: IncomingMessage, res: ServerResponse): boolean {
+    const path = (req.url ?? '').split('?')[0] ?? '';
+    if (![`${PREFIX}/prepare`, `${PREFIX}/export`, `${PREFIX}/receive`].includes(path)) return false;
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, cors(req)).end();
+      return true;
+    }
+    if (req.method !== 'POST') {
+      sendJson(req, res, 405, { error: 'method not allowed' });
+      return true;
+    }
+    this.answer(req, path).then((body) => {
+      sendJson(req, res, 200, body);
+    }).catch((err: unknown) => {
+      if (!(err instanceof ApiError)) log.warn('connector-transfer: request failed');
+      sendJson(req, res, err instanceof ApiError ? err.status : 500, { error: err instanceof ApiError ? err.message : 'connector copy failed' });
+    });
+    return true;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/transfer-crypto.ts

@@ -0,0 +1,44 @@
+import { createCipheriv, createDecipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, type KeyObject } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { ApiError } from '@metro-labs/http/api-error';
+
+export interface TransferEnvelope {
+  key: string;
+  iv: string;
+  tag: string;
+  data: string;
+}
+
+export const transferKeys = (): { publicKey: string; privateKey: KeyObject } => {
+  const pair = generateKeyPairSync('x25519');
+  return { publicKey: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString(), privateKey: pair.privateKey };
+};
+
+function sharedKey(privateKey: KeyObject, pem: string): ArrayBuffer {
+  if (pem.length > 1024) throw new ApiError('invalid transfer key', 400);
+  const publicKey = createPublicKey(pem);
+  if (publicKey.asymmetricKeyType !== 'x25519') throw new ApiError('invalid transfer key', 400);
+  return hkdfSync('sha256', diffieHellman({ privateKey, publicKey }), '', 'metro-connector-copy-v1', 32);
+}
+
+export function sealTransfer(value: unknown, publicKey: string): TransferEnvelope {
+  const pair = transferKeys();
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', Buffer.from(sharedKey(pair.privateKey, publicKey)), iv);
+  const plain = JSON.stringify(value);
+  if (Buffer.byteLength(plain) > 3 * 1024 * 1024) throw new ApiError('too many connector settings for one copy', 413);
+  const data = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+  return { key: pair.publicKey, iv: iv.toString('base64'), tag: cipher.getAuthTag().toString('base64'), data: data.toString('base64') };
+}
+
+export function openTransfer(raw: unknown, privateKey: KeyObject): unknown {
+  if (!isRecord(raw) || typeof raw.key !== 'string' || typeof raw.iv !== 'string' || typeof raw.tag !== 'string' || typeof raw.data !== 'string')
+    throw new ApiError('invalid encrypted transfer', 400);
+  const iv = Buffer.from(raw.iv, 'base64');
+  const tag = Buffer.from(raw.tag, 'base64');
+  if (iv.length !== 12 || tag.length !== 16) throw new ApiError('invalid encrypted transfer', 400);
+  const decipher = createDecipheriv('aes-256-gcm', Buffer.from(sharedKey(privateKey, raw.key)), iv);
+  decipher.setAuthTag(tag);
+  const plain = Buffer.concat([decipher.update(Buffer.from(raw.data, 'base64')), decipher.final()]);
+  return JSON.parse(plain.toString('utf8')) as unknown;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/transfer-store.ts

@@ -0,0 +1,48 @@
+import { isDeepStrictEqual } from 'node:util';
+import { isRecord } from '@metro-labs/core/is-record';
+import { newId, parseId } from '@metro-labs/core/ids';
+import { ApiError } from '@metro-labs/http/api-error';
+import { connectorAuth, connectorName, readConfig } from './config.js';
+import { parseConnectorUrl } from './url.js';
+import { normalizePolicy } from '../policy/policy.js';
+import { localImportConnectors, readLocalConnectors, type LocalConnectorRow } from './store.js';
+
+export interface ConnectorCopyResult {
+  sourceId: string | null;
+  id?: string;
+  status: 'copied' | 'skipped' | 'invalid';
+}
+
+function copyRow(raw: unknown): LocalConnectorRow {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || parseId(raw.id) === null || !isRecord(raw.config)) throw new ApiError('invalid connector', 400);
+  const name = connectorName(raw.name);
+  const url = parseConnectorUrl(raw.url).toString();
+  if (raw.config.policy !== undefined) normalizePolicy(raw.config.policy);
+  const config = readConfig(raw.config);
+  if (!isDeepStrictEqual(config, raw.config)) throw new ApiError('invalid connector settings', 400);
+  if (config.auth.kind === 'header') connectorAuth(config.auth.name, config.auth.value);
+  return { id: raw.id, name, url, config };
+}
+
+export function copyConnectorRows(value: unknown, dir?: string): ConnectorCopyResult[] {
+  if (!isRecord(value) || value.version !== 1 || !Array.isArray(value.connectors) || value.connectors.length > 500)
+    throw new ApiError('invalid connector transfer', 400);
+  const names = new Set(readLocalConnectors(dir).map((row) => row.name));
+  const imported: LocalConnectorRow[] = [];
+  const results: ConnectorCopyResult[] = value.connectors.map((raw: unknown) => {
+    const sourceId = isRecord(raw) && typeof raw.id === 'string' ? parseId(raw.id) : null;
+    let row: LocalConnectorRow;
+    try {
+      row = copyRow(raw);
+    } catch {
+      return { sourceId, status: 'invalid' };
+    }
+    if (names.has(row.name)) return { sourceId, status: 'skipped' };
+    names.add(row.name);
+    const id = newId();
+    imported.push({ ...row, id });
+    return { sourceId, id, status: 'copied' };
+  });
+  if (imported.length > 0) localImportConnectors(imported.map((row) => ({ ...row, config: { ...row.config } })), dir, 'append');
+  return results;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/url.ts

@@ -0,0 +1,37 @@
+import { ApiError } from '@metro-labs/http/api-error';
+
+export class ConnectorVerifyError extends ApiError {}
+
+export class ConnectorUnauthorized extends ConnectorVerifyError {}
+
+export function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+function refuseShape(url: URL): void {
+  if (url.protocol !== 'https:' && url.protocol !== 'http:')
+    throw refused('a connector url must start with https:// or http://');
+  if (url.username !== '' || url.password !== '')
+    throw refused('a connector url must not carry a user:password');
+  if (url.hash !== '')
+    throw refused('a connector url must not carry a #fragment');
+}
+
+export function parseConnectorUrl(raw: unknown): URL {
+  const text = typeof raw === 'string' ? raw.trim() : '';
+  if (text === '') throw refused('a connector url is required');
+  let url: URL;
+  try {
+    url = new URL(text);
+  } catch {
+    throw refused('that is not a valid url');
+  }
+  refuseShape(url);
+  return url;
+}
+
+export function connectorUrlText(url: URL): string {
+  const text = url.toString();
+  if (url.pathname !== '/' || url.search !== '') return text;
+  return text.endsWith('/') ? text.slice(0, -1) : text;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/verify.ts

@@ -0,0 +1,106 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { whyUnreachable } from './reach.js';
+import { ConnectorUnauthorized, refused } from './url.js';
+
+export {
+  ConnectorUnauthorized,
+  ConnectorVerifyError,
+  connectorUrlText,
+  parseConnectorUrl,
+  refused,
+} from './url.js';
+
+export interface OAuthTokens {
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: number;
+}
+
+export interface OAuthAuth extends OAuthTokens {
+  kind: 'oauth';
+  issuer: string;
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret?: string;
+  scope?: string;
+}
+
+export type ConnectorAuth =
+  | { kind: 'none' }
+  | { kind: 'header'; name: string; value: string }
+  | OAuthAuth;
+
+export interface VerifiedServer {
+  server: string;
+}
+
+export interface VerifiedRecord extends VerifiedServer {
+  at: string;
+}
+
+const PROBE_TIMEOUT_MS = 10_000;
+
+export const INITIALIZE = {
+  jsonrpc: '2.0',
+  id: 1,
+  method: 'initialize',
+  params: { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'metro', version: '0.1.0' } },
+};
+
+export function authHeaders(auth: ConnectorAuth): Record<string, string> {
+  if (auth.kind === 'header') return { [auth.name]: auth.value };
+  if (auth.kind === 'oauth') return { Authorization: `Bearer ${auth.accessToken}` };
+  return {};
+}
+
+export function payloadOf(text: string, contentType: string): string {
+  if (!contentType.includes('text/event-stream')) return text;
+  for (const line of text.replace(/\r\n/g, '\n').split('\n')) if (line.startsWith('data:')) return line.slice(5).trim();
+  return '';
+}
+
+export async function mcpPost(
+  url: URL,
+  auth: ConnectorAuth,
+  body: unknown,
+  opts: { timeoutMs: number; headers?: Record<string, string> },
+): Promise<Response> {
+  try {
+    return await fetch(url, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(opts.timeoutMs),
+      headers: { 'content-type': 'application/json', accept: 'application/json, text/event-stream', ...authHeaders(auth), ...opts.headers },
+      body: JSON.stringify(body),
+    });
+  } catch (err) {
+    throw refused(`Metro could not reach ${url.hostname}: ${whyUnreachable(err)}`);
+  }
+}
+
+function serverNameOf(url: URL, text: string, contentType: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(payloadOf(text, contentType));
+  } catch {
+    throw refused(`${url.hostname} answered, but it does not speak MCP.`);
+  }
+  const result = isRecord(parsed) && isRecord(parsed.result) ? parsed.result : null;
+  if (result === null || typeof result.protocolVersion !== 'string') throw refused(`${url.hostname} answered, but it does not speak MCP.`);
+  const info = isRecord(result.serverInfo) ? result.serverInfo : {};
+  const title = typeof info.title === 'string' ? info.title : '';
+  if (title !== '') return title;
+  return typeof info.name === 'string' ? info.name : url.hostname;
+}
+
+export async function verifyRemoteMcp(url: URL, auth: ConnectorAuth): Promise<VerifiedServer> {
+  const res = await mcpPost(url, auth, INITIALIZE, { timeoutMs: PROBE_TIMEOUT_MS });
+  const text = await res.text().catch(() => '');
+  if (res.status >= 300 && res.status < 400) throw refused('that url redirects — use the url it redirects to');
+  if (res.status === 401 || res.status === 403)
+    throw new ConnectorUnauthorized(auth.kind === 'none' ? `${url.hostname} requires authorization.` : `${url.hostname} rejected that credential.`, 400);
+  if (res.status === 404 || res.status === 405)
+    throw refused(`${url.hostname} did not accept an MCP initialize over HTTP POST. If it is a legacy SSE server, Metro cannot verify it yet.`);
+  if (!res.ok) throw refused(`${url.hostname} answered ${String(res.status)} instead of an MCP initialize.`);
+  return { server: serverNameOf(url, text, res.headers.get('content-type') ?? '') };
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-grant.ts

@@ -1,8 +1,8 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { ID_RE } from '../db/ids.js';
+import { ID_RE } from '@metro-labs/core/ids';
 import { readFileSync } from 'node:fs';
-import { resolveCachedAttachment } from '../stations/attachments.js';
-import { writeSecure } from './secure-fs.js';
+import { resolveCachedAttachment } from '@metro-labs/core/stations/attachments';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 
 const GRANT_SUFFIX = '.grant';
 
@@ -34,7 +34,7 @@ function parseGrant(raw: string): AttachmentGrant | undefined {
   };
 }
 
-export function readGrant(path: string): AttachmentGrant | undefined {
+function readGrant(path: string): AttachmentGrant | undefined {
   try {
     return parseGrant(readFileSync(`${path}${GRANT_SUFFIX}`, 'utf8'));
   } catch {

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-owner.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
-import { ID_RE } from '../db/ids.js';
-import { resolveCachedAttachment } from '../stations/attachments.js';
-import { writeSecure } from './secure-fs.js';
+import { ID_RE } from '@metro-labs/core/ids';
+import { resolveCachedAttachment } from '@metro-labs/core/stations/attachments';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 
 const OWNER_SUFFIX = '.owner';
 

package/runtime/node_modules/@metro-labs/daemon/src/files/attach-reaper.ts

@@ -0,0 +1,174 @@
+import { readdirSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  attachDir,
+  resolveCachedAttachment,
+} from '@metro-labs/core/stations/attachments';
+import { errMsg, log } from '@metro-labs/core/log';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MB = 1024 * 1024;
+const DEFAULT_TTL_DAYS = 7;
+const DEFAULT_MAX_MB = 2048;
+const PART_TTL_MS = 60 * 60 * 1000;
+const SWEEP_MS = 10 * 60 * 1000;
+const SIDECARS = ['.owner', '.grant'] as const;
+
+export interface AttachSweepOptions {
+  dir?: string;
+  now?: number;
+  ttlMs?: number;
+  maxBytes?: number;
+}
+
+export interface AttachSweepResult {
+  expired: number;
+  capped: number;
+  orphans: number;
+  parts: number;
+  freedBytes: number;
+}
+
+interface Entry {
+  name: string;
+  mtime: number;
+  size: number;
+}
+
+const positive = (raw: string | undefined, fallback: number): number => {
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? value : fallback;
+};
+
+export const attachTtlMs = (): number =>
+  positive(process.env.METRO_ATTACH_TTL_DAYS, DEFAULT_TTL_DAYS) * DAY_MS;
+
+export const attachMaxBytes = (): number =>
+  positive(process.env.METRO_ATTACH_MAX_MB, DEFAULT_MAX_MB) * MB;
+
+const cacheShaped = (name: string): boolean =>
+  resolveCachedAttachment(name) !== null;
+
+function stripSuffix(name: string, suffixes: readonly string[]): string | undefined {
+  const suffix = suffixes.find((s) => name.endsWith(s));
+  if (suffix === undefined) return undefined;
+  const base = name.slice(0, -suffix.length);
+  return cacheShaped(base) ? base : undefined;
+}
+
+function listEntries(dir: string): Entry[] {
+  let names: string[];
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const entries: Entry[] = [];
+  for (const name of names) {
+    try {
+      const stat = statSync(join(dir, name));
+      if (stat.isFile()) entries.push({ name, mtime: stat.mtimeMs, size: stat.size });
+    } catch {
+      continue;
+    }
+  }
+  return entries;
+}
+
+function removeEntry(dir: string, name: string): void {
+  rmSync(join(dir, name), { force: true });
+}
+
+function removeWithSidecars(dir: string, name: string): void {
+  removeEntry(dir, name);
+  for (const suffix of SIDECARS) removeEntry(dir, `${name}${suffix}`);
+}
+
+interface Sweep {
+  dir: string;
+  now: number;
+  entries: Entry[];
+  result: AttachSweepResult;
+}
+
+function sweepParts(sweep: Sweep): Set<string> {
+  const fresh = new Set<string>();
+  for (const entry of sweep.entries) {
+    const base = stripSuffix(entry.name, ['.part']);
+    if (base === undefined) continue;
+    if (sweep.now - entry.mtime <= PART_TTL_MS) {
+      fresh.add(base);
+      continue;
+    }
+    removeEntry(sweep.dir, entry.name);
+    sweep.result.parts += 1;
+    sweep.result.freedBytes += entry.size;
+  }
+  return fresh;
+}
+
+function sweepExpired(sweep: Sweep, ttlMs: number): Entry[] {
+  const kept: Entry[] = [];
+  for (const entry of sweep.entries) {
+    if (!cacheShaped(entry.name)) continue;
+    if (sweep.now - entry.mtime <= ttlMs) {
+      kept.push(entry);
+      continue;
+    }
+    removeWithSidecars(sweep.dir, entry.name);
+    sweep.result.expired += 1;
+    sweep.result.freedBytes += entry.size;
+  }
+  return kept;
+}
+
+function sweepOrphans(sweep: Sweep, busy: Set<string>): void {
+  const present = new Set(sweep.entries.map((e) => e.name));
+  for (const entry of sweep.entries) {
+    const base = stripSuffix(entry.name, SIDECARS);
+    if (base === undefined || present.has(base) || busy.has(base)) continue;
+    removeEntry(sweep.dir, entry.name);
+    sweep.result.orphans += 1;
+  }
+}
+
+function capSize(sweep: Sweep, kept: Entry[], maxBytes: number): void {
+  let total = kept.reduce((sum, e) => sum + e.size, 0);
+  for (const entry of [...kept].sort((a, b) => a.mtime - b.mtime)) {
+    if (total <= maxBytes) return;
+    removeWithSidecars(sweep.dir, entry.name);
+    total -= entry.size;
+    sweep.result.capped += 1;
+    sweep.result.freedBytes += entry.size;
+  }
+}
+
+export function sweepAttachments(options: AttachSweepOptions = {}): AttachSweepResult {
+  const dir = options.dir ?? attachDir();
+  const sweep: Sweep = {
+    dir,
+    now: options.now ?? Date.now(),
+    entries: listEntries(dir),
+    result: { expired: 0, capped: 0, orphans: 0, parts: 0, freedBytes: 0 },
+  };
+  const busy = sweepParts(sweep);
+  const kept = sweepExpired(sweep, options.ttlMs ?? attachTtlMs());
+  sweepOrphans(sweep, busy);
+  capSize(sweep, kept, options.maxBytes ?? attachMaxBytes());
+  return sweep.result;
+}
+
+export function startAttachReaper(): void {
+  const run = (): void => {
+    try {
+      const swept = sweepAttachments();
+      if (swept.expired + swept.capped + swept.orphans + swept.parts > 0) {
+        log.info(swept, 'attachments: reaped the cache');
+      }
+    } catch (err) {
+      log.warn({ err: errMsg(err) }, 'attachments: sweep failed');
+    }
+  };
+  run();
+  setInterval(run, SWEEP_MS).unref?.();
+}