@stage-labs/metro 0.1.0-beta.286 → 0.1.0-beta.288

package/runtime/node_modules/@metro-labs/daemon/src/connectors/metro-api.ts

@@ -0,0 +1,92 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { ApiError } from '@metro-labs/http/api-error';
+import { signAgentRequest } from '@metro-labs/http/agent-signature';
+import type { AgentKey } from './agent-key.js';
+
+const TIMEOUT_MS = 15_000;
+const ANSWER_MAX = 64 * 1024;
+
+export type AgentFetch = (url: string, init: RequestInit) => Promise<Response>;
+
+export interface MetroApi {
+  base: string;
+  fetch: AgentFetch;
+  now: () => number;
+}
+
+export const METRO_API: MetroApi = {
+  base: 'https://api.metro.box',
+  fetch: (url, init) => fetch(url, init),
+  now: () => Date.now(),
+};
+
+const tooLarge = (): ApiError => new ApiError('api.metro.box sent an answer too large for Metro.', 503);
+const unreachable = (): ApiError => new ApiError('Metro could not reach api.metro.box. Try again.', 503);
+
+async function answerOf(response: Response, max: number): Promise<unknown> {
+  if (Number(response.headers.get('content-length') ?? '0') > max) throw tooLarge();
+  const reader = response.body?.getReader();
+  if (reader === undefined) return null;
+  const parts: Uint8Array[] = [];
+  let size = 0;
+  for (let part = await reader.read(); !part.done; part = await reader.read()) {
+    size += part.value.length;
+    if (size > max) {
+      await reader.cancel();
+      throw tooLarge();
+    }
+    parts.push(part.value);
+  }
+  try {
+    return JSON.parse(Buffer.concat(parts).toString('utf8')) as unknown;
+  } catch {
+    return null;
+  }
+}
+
+export class MetroApiRefusal extends ApiError {
+  constructor(message: string, readonly upstreamStatus: number, readonly code: string | null) {
+    super(message, upstreamStatus >= 500 ? 503 : 400);
+  }
+}
+
+function refusal(status: number, value: unknown): ApiError {
+  const said = isRecord(value) && typeof value.error === 'string' && value.error.length <= 300 ? value.error : `api.metro.box answered ${String(status)}`;
+  const code = isRecord(value) && typeof value.code === 'string' ? value.code : null;
+  return new MetroApiRefusal(said, status, code);
+}
+
+interface AgentCallOptions {
+  answerMax?: number;
+  timeoutMs?: number;
+}
+
+function signedCall(api: MetroApi, key: AgentKey, path: string, body: Record<string, unknown> | undefined): { url: URL; method: string; text: string; authorization: string } {
+  const url = new URL(path, api.base);
+  const method = body === undefined ? 'GET' : 'POST';
+  const text = body === undefined ? '' : JSON.stringify(body);
+  const authorization = signAgentRequest({ method, host: url.host, path: `${url.pathname}${url.search}`, body: Buffer.from(text, 'utf8') }, key.signing, key.keyId, api.now());
+  return { url, method, text, authorization };
+}
+
+export async function agentCall(api: MetroApi, key: AgentKey, path: string, body?: Record<string, unknown>, options: AgentCallOptions = {}): Promise<Record<string, unknown>> {
+  const { url, method, text, authorization } = signedCall(api, key, path, body);
+  let response: Response;
+  try {
+    response = await api.fetch(url.toString(), {
+      method,
+      headers: { authorization, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
+      ...(body === undefined ? {} : { body: text }),
+      redirect: 'error',
+      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+    });
+  } catch {
+    throw unreachable();
+  }
+  const value = await answerOf(response, options.answerMax ?? ANSWER_MAX).catch((err: unknown) => {
+    throw err instanceof ApiError ? err : unreachable();
+  });
+  if (!response.ok) throw refusal(response.status, value);
+  if (!isRecord(value)) throw new ApiError('api.metro.box sent an answer Metro cannot read.', 503);
+  return value;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-preview.ts

@@ -0,0 +1,200 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { ApiError } from '@metro-labs/http/api-error';
+import { bodyField } from '@metro-labs/http/api-http';
+import { connectorAuth, connectorClient, connectorName } from '@metro-labs/http/connector-input';
+import { parseConnectorUrl } from '@metro-labs/http/connector-url';
+import { agentsDir } from '../agents/files.js';
+import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
+import { readAgentKey } from './agent-key.js';
+import { migrationOrigin } from './migration-url.js';
+
+export type MigrationIssue = 'invalid_config' | 'unsupported_url' | 'custom_policy' | 'oauth_sign_in' | 'header_reentry';
+
+export interface MigrationConnector {
+  id: string;
+  name: string;
+  auth: 'none' | 'header' | 'oauth' | 'invalid';
+  origin: string | null;
+  policy: ToolPolicy;
+  policySupported: boolean;
+  issues: MigrationIssue[];
+}
+
+export interface ConnectorMigrationPreview {
+  enabled: boolean;
+  enrolled: boolean;
+  agentId: string | null;
+  owner: string | null;
+  liveEnabled: boolean;
+  connectors: MigrationConnector[];
+}
+
+const invalid = (): never => { throw new Error('Invalid local connector configuration.'); };
+const onlyKeys = (raw: Record<string, unknown>, keys: readonly string[]): boolean => Object.keys(raw).every((key) => keys.includes(key));
+const nonempty = (value: unknown): value is string => typeof value === 'string' && value.trim() !== '';
+
+function optionalStrings(raw: Record<string, unknown>, keys: readonly string[]): boolean {
+  return keys.every((key) => raw[key] === undefined || typeof raw[key] === 'string');
+}
+
+function validClient(raw: unknown): boolean {
+  if (raw === undefined || raw === null) return true;
+  if (!isRecord(raw) || !onlyKeys(raw, ['clientId', 'clientSecret'])) return false;
+  if (!nonempty(raw.clientId) || !optionalStrings(raw, ['clientSecret'])) return false;
+  return connectorClient(raw.clientId, raw.clientSecret) !== null;
+}
+
+function oauthTokensValid(raw: Record<string, unknown>): boolean {
+  const token = (value: unknown): boolean => typeof value === 'string' && /^[\x21-\x7e]+$/.test(value);
+  return token(raw.accessToken) && (raw.refreshToken === undefined || token(raw.refreshToken));
+}
+
+function oauthAuth(raw: Record<string, unknown>): 'oauth' {
+  if (!onlyKeys(raw, ['kind', 'accessToken', 'refreshToken', 'clientId', 'clientSecret', 'tokenEndpoint', 'issuer', 'scope', 'expiresAt'])) invalid();
+  if (!oauthTokensValid(raw) || ![raw.clientId, raw.tokenEndpoint, raw.issuer].every(nonempty)) invalid();
+  if (!optionalStrings(raw, ['refreshToken', 'clientSecret', 'scope'])) invalid();
+  if (raw.expiresAt !== undefined && (typeof raw.expiresAt !== 'number' || !Number.isFinite(raw.expiresAt) || raw.expiresAt < 0)) invalid();
+  connectorClient(raw.clientId, raw.clientSecret);
+  parseConnectorUrl(raw.tokenEndpoint);
+  parseConnectorUrl(raw.issuer);
+  return 'oauth';
+}
+
+function authKind(raw: unknown): Exclude<MigrationConnector['auth'], 'invalid'> {
+  if (!isRecord(raw)) return invalid();
+  if (raw.kind === 'oauth') return oauthAuth(raw);
+  if (raw.kind === 'none' && onlyKeys(raw, ['kind'])) return 'none';
+  if (raw.kind !== 'header' || !onlyKeys(raw, ['kind', 'name', 'value'])) return invalid();
+  if (!nonempty(raw.name) || !nonempty(raw.value)) return invalid();
+  const auth = connectorAuth(raw.name, raw.value);
+  return auth.kind === 'header' ? 'header' : invalid();
+}
+
+function metadataValid(config: Record<string, unknown>): boolean {
+  if (!optionalStrings(config, ['createdAt'])) return false;
+  const verified = config.verified;
+  if (verified !== undefined && (!isRecord(verified) || !optionalStrings(verified, ['at', 'server']))) return false;
+  if (config.oauth !== undefined && typeof config.oauth !== 'boolean') return false;
+  const groups = config.toolGroups;
+  if (groups === undefined) return true;
+  if (!isRecord(groups) || Object.keys(groups).length > 1000) return false;
+  return Object.entries(groups).every(([name, group]) => name.length > 0 && name.length <= 128 && (group === 'read' || group === 'write'));
+}
+
+function configAuth(config: unknown): MigrationConnector['auth'] {
+  try {
+    if (!isRecord(config) || !onlyKeys(config, ['auth', 'oauth', 'client', 'createdAt', 'verified', 'policy', 'toolGroups'])) return 'invalid';
+    if (!metadataValid(config) || !validClient(config.client)) return 'invalid';
+    const kind = authKind(config.auth);
+    if (kind === 'header' && config.oauth === true) return 'invalid';
+    return kind === 'none' && config.oauth === true ? 'oauth' : kind;
+  } catch {
+    return 'invalid';
+  }
+}
+
+function policyShape(raw: Record<string, unknown>): boolean {
+  if (!onlyKeys(raw, ['read', 'write', 'tools'])) return false;
+  for (const key of ['read', 'write']) if (Object.hasOwn(raw, key) && typeof raw[key] !== 'string') return false;
+  return raw.tools === undefined || (isRecord(raw.tools) && Object.values(raw.tools).every((value) => typeof value === 'string'));
+}
+
+function strictPolicy(raw: unknown): ToolPolicy {
+  if (raw === undefined) return {};
+  if (!isRecord(raw) || !policyShape(raw)) return invalid();
+  const policy = normalizePolicy(raw);
+  if (isRecord(raw.tools)) {
+    policy.tools = Object.fromEntries(Object.entries(raw.tools).map(([name, value]) => {
+      const { read } = normalizePolicy({ read: value });
+      if (read === undefined) return invalid();
+      return [name, read];
+    }));
+  }
+  return policy;
+}
+
+function policyPreview(raw: unknown): Pick<MigrationConnector, 'policy' | 'policySupported'> & { valid: boolean } {
+  try {
+    const policy = strictPolicy(raw);
+    const policySupported = (policy.read ?? 'allow') === 'allow' && policy.write !== 'ask' && Object.keys(policy.tools ?? {}).length === 0;
+    return { policy, policySupported, valid: true };
+  } catch {
+    return { policy: {}, policySupported: false, valid: false };
+  }
+}
+
+function nameOf(raw: unknown): string | null {
+  try {
+    return connectorName(raw);
+  } catch {
+    return null;
+  }
+}
+
+function rowIdentity(row: Record<string, unknown>, index: number): { id: string; name: string; valid: boolean } {
+  const id = parseId(row.id);
+  const name = nameOf(row.name);
+  return { id: id ?? `invalid-${String(index + 1)}`, name: name ?? `Connector ${String(index + 1)}`, valid: id !== null && name !== null };
+}
+
+function previewRow(raw: unknown, index: number): MigrationConnector {
+  const row = isRecord(raw) ? raw : {};
+  const identity = rowIdentity(row, index);
+  const auth = configAuth(row.config);
+  const { policy, policySupported, valid } = policyPreview(bodyField(row.config, 'policy'));
+  const origin = migrationOrigin(row.url);
+  const issues: MigrationIssue[] = [];
+  if (!identity.valid || auth === 'invalid' || !valid) issues.push('invalid_config');
+  if (origin === null) issues.push('unsupported_url');
+  if (valid && !policySupported) issues.push('custom_policy');
+  if (auth === 'oauth') issues.push('oauth_sign_in');
+  if (auth === 'header') issues.push('header_reentry');
+  return { id: identity.id, name: identity.name, auth, origin, policy, policySupported, issues };
+}
+
+const unavailable = (): ApiError => new ApiError('Local connector configuration cannot be previewed. Restore its file or permissions first.', 503);
+
+function readRows(dir: string): unknown[] {
+  let text: string;
+  try {
+    text = readFileSync(join(dir, 'connectors.json'), 'utf8');
+  } catch (err) {
+    if (isRecord(err) && err.code === 'ENOENT') return [];
+    throw unavailable();
+  }
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw unavailable();
+  }
+  if (!isRecord(raw) || raw.version !== 1 || !Array.isArray(raw.connectors)) throw unavailable();
+  return raw.connectors;
+}
+
+function previewRows(dir: string): MigrationConnector[] {
+  const rows = readRows(dir).map(previewRow);
+  const seen = new Map<string, MigrationConnector>();
+  for (const row of rows) {
+    for (const key of [`id:${row.id}`, `name:${row.name}`]) {
+      const prior = seen.get(key);
+      if (prior !== undefined) {
+        for (const duplicate of [prior, row]) if (!duplicate.issues.includes('invalid_config')) duplicate.issues.push('invalid_config');
+      }
+      seen.set(key, row);
+    }
+  }
+  return rows;
+}
+
+export function connectorMigrationPreview(owner: string | null, dir = agentsDir()): ConnectorMigrationPreview {
+  const enabled = process.env.METRO_CONNECTORS_SYNC_ENABLED === 'true';
+  const liveEnabled = process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
+  if (!enabled) return { enabled, enrolled: false, agentId: null, owner, liveEnabled, connectors: [] };
+  const enrollment = owner === null ? null : readAgentKey(dir)?.enrollment;
+  const agentId = enrollment?.organization === owner ? enrollment?.server ?? null : null;
+  return { enabled, enrolled: agentId !== null, agentId, owner, liveEnabled, connectors: previewRows(dir) };
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-url.ts

@@ -0,0 +1,32 @@
+import { BlockList, isIP } from 'node:net';
+import { parseConnectorUrl } from '@metro-labs/http/connector-url';
+
+const blocked = new BlockList();
+for (const [address, prefix] of [
+  ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
+  ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+  ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+] as const) blocked.addSubnet(address, prefix, 'ipv4');
+for (const [address, prefix] of [
+  ['2001::', 32], ['2001:10::', 28], ['2001:20::', 28], ['2001:db8::', 32], ['2002::', 16],
+] as const) blocked.addSubnet(address, prefix, 'ipv6');
+const globalV6 = new BlockList();
+globalV6.addSubnet('2000::', 3, 'ipv6');
+
+function publicHost(host: string): boolean {
+  if (isIP(host) === 4) return !blocked.check(host, 'ipv4');
+  if (isIP(host) === 6) return globalV6.check(host, 'ipv6') && !blocked.check(host, 'ipv6');
+  const name = host.replace(/\.$/, '');
+  if (/(^|\.)(localhost|local|internal|lan|home|invalid|test|onion)$/.test(name)) return false;
+  return name.includes('.') && name.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+}
+
+export function migrationOrigin(raw: unknown): string | null {
+  try {
+    const url = parseConnectorUrl(raw);
+    if (url.protocol !== 'https:' || !publicHost(url.hostname.replace(/^\[|\]$/g, ''))) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-routes.ts

@@ -8,9 +8,9 @@ import {
   takePending,
   type PendingAuth,
 } from './oauth.js';
-import { connectorClient } from './config.js';
-import { parseConnectorUrl } from './verify.js';
-import type { OAuthAuth } from './verify.js';
+import { connectorClient } from '@metro-labs/http/connector-input';
+import { parseConnectorUrl } from '@metro-labs/http/connector-url';
+import type { OAuthAuth } from '@metro-labs/http/connector-mcp';
 import type { Connector, PendingConnectorInput } from './store.js';
 
 export function hostOf(url: string): string {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth.ts

@@ -1,9 +1,6 @@
 import { publicBaseOrDefault } from '../files/attach-serve.js';
-import {
-  refused,
-  type OAuthAuth,
-  type OAuthTokens,
-} from './verify.js';
+import { refused } from '@metro-labs/http/connector-url';
+import type { OAuthAuth, OAuthTokens } from '@metro-labs/http/connector-mcp';
 import { validateReturnTo } from '@metro-labs/http/return-to';
 import {
   authorizeUrl,
@@ -12,8 +9,8 @@ import {
   refreshTokens,
   registerClient,
   type OAuthClient,
-} from './oauth-client.js';
-import { discoverOAuth, type OAuthServer } from './oauth-discovery.js';
+} from '@metro-labs/http/connector-oauth';
+import { discoverOAuth, type OAuthServer } from '@metro-labs/http/connector-discovery';
 import { ticketStore } from '@metro-labs/core/tickets';
 
 export interface PendingAuth {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-relay.ts

@@ -0,0 +1,61 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { ApiError } from '@metro-labs/http/api-error';
+import { screenCalls, type Screened } from './relay-policy.js';
+import type { RelaySession } from './relay-session.js';
+import type { RelayTarget } from './relay-target.js';
+
+type Ready = Extract<RelayTarget, { kind: 'ok' }>;
+type Forward = (target: Ready, body: Uint8Array<ArrayBuffer> | null, signal: AbortSignal) => Promise<Response>;
+type OrgExchange =
+  | { kind: 'response'; upstream: Response; answers: Record<string, unknown>[] }
+  | { kind: 'blocked'; screened: Screened };
+
+const METHODS = new Set(['initialize', 'ping', 'tools/list', 'tools/call', 'notifications/initialized', 'notifications/cancelled']);
+
+function requestBatch(body: Uint8Array | null): boolean {
+  if (body === null) return false;
+  let parsed: unknown;
+  try { parsed = JSON.parse(new TextDecoder().decode(body)); }
+  catch { throw new ApiError('Invalid organization connector request.', 400); }
+  const batch = Array.isArray(parsed);
+  const entries: unknown[] = Array.isArray(parsed) ? parsed : [parsed];
+  if (entries.length === 0 || entries.some((item) => !validMessage(item))) throw new ApiError('This organization connector accepts MCP tool requests only.', 400);
+  return batch;
+}
+
+function validMessage(item: unknown): boolean {
+  if (!isRecord(item) || item.jsonrpc !== '2.0' || typeof item.method !== 'string' || !METHODS.has(item.method)) return false;
+  if (item.method !== 'tools/call') return true;
+  if (!isRecord(item.params) || typeof item.params.name !== 'string' || item.params.name === '') return false;
+  return item.params.arguments === undefined || isRecord(item.params.arguments);
+}
+
+function ready(session: RelaySession, signal: AbortSignal): Ready {
+  if (signal.aborted) throw new ApiError('This organization connector is no longer available.', 503);
+  const target = session.current();
+  if (target.kind === 'missing') throw new ApiError('No such organization connector.', 404);
+  if (target.kind === 'signin') throw new ApiError('This organization connector needs signing in again.', 424);
+  return target;
+}
+
+export async function exchangeOrg(id: string, session: RelaySession, body: Uint8Array<ArrayBuffer> | null, clientSignal: AbortSignal, forward: Forward): Promise<OrgExchange> {
+  const signal = AbortSignal.any([clientSignal, session.signal]);
+  const batch = requestBatch(body);
+  let pending = body;
+  const answers: Record<string, unknown>[] = [];
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    await session.target(attempt > 0);
+    ready(session, signal);
+    const screened = pending === null ? null : screenCalls(pending, id, session.blocker());
+    if (screened !== null) {
+      answers.push(...screened.answers);
+      pending = screened.forward;
+      if (pending === null) return { kind: 'blocked', screened: { forward: null, answers, batch } };
+    }
+    const target = ready(session, signal);
+    const upstream = await forward(target, pending, signal);
+    if (upstream.status !== 401 && upstream.status !== 403) return { kind: 'response', upstream, answers };
+    await upstream.body?.cancel();
+  }
+  throw new ApiError('The organization connector rejected its credential. Check its sign-in in the organization settings.', 424);
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime-discovery.ts

@@ -0,0 +1,111 @@
+import type { FetchLike } from '@metro-labs/core/stations/oauth';
+import type { ToolGroup } from '@metro-labs/core/stations/types';
+import { ApiError } from '@metro-labs/http/api-error';
+import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
+import { MetroApiRefusal } from './metro-api.js';
+import { listRemoteTools } from './tools.js';
+
+export const orgUnavailable = (): ApiError => new ApiError('This organization connector is not available. Try again.', 503);
+export const orgSignin = (): ApiError => new ApiError('This organization connector needs sign-in again.', 424);
+export const orgMissing = (): ApiError => new ApiError('No such organization connector is assigned to this agent.', 404);
+
+export function orgRuntimeError(error: unknown): ApiError {
+  if (error instanceof MetroApiRefusal) return error.upstreamStatus === 401 || error.upstreamStatus === 403 ? orgSignin() : orgUnavailable();
+  const status = error instanceof ApiError ? error.status : 503;
+  if (status === 401 || status === 403 || status === 424) return orgSignin();
+  if (status === 404) return orgMissing();
+  if (status === 502) return new ApiError('The organization connector could not complete the request.', 502);
+  return orgUnavailable();
+}
+
+interface DiscoveryGuard {
+  fresh: (revision?: string) => Promise<DeliveredConnector>;
+  current: () => DeliveredConnector;
+  signal: AbortSignal;
+  fetch: FetchLike;
+}
+
+const MAX_BYTES = 2 * 1024 * 1024;
+const MAX_TOOLS = 2000;
+
+async function boundedResponse(response: Response, signal: AbortSignal): Promise<Response> {
+  const reader = response.body?.getReader();
+  if (reader === undefined) return response;
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (let part = await reader.read(); !part.done; part = await reader.read()) {
+      signal.throwIfAborted();
+      size += part.value.length;
+      if (size > MAX_BYTES) throw orgUnavailable();
+      chunks.push(part.value);
+    }
+    return new Response(Buffer.concat(chunks), { status: response.status, headers: response.headers });
+  } finally {
+    await reader.cancel();
+  }
+}
+
+function requestInit(row: DeliveredConnector, init: RequestInit | undefined, scanSignal: AbortSignal): RequestInit & { signal: AbortSignal } {
+  const headers = new Headers(init?.headers);
+  for (const [name, value] of Object.entries(row.headers)) headers.set(name, value);
+  const signals = [scanSignal, AbortSignal.timeout(15_000)];
+  if (init?.signal !== undefined && init.signal !== null) signals.push(init.signal);
+  return { ...init, headers, redirect: 'manual', signal: AbortSignal.any(signals) };
+}
+
+async function discoveryResponse(response: Response, init: RequestInit | undefined, signal: AbortSignal): Promise<Response> {
+  if (response.status >= 300) throw new ApiError('The organization connector refused tool discovery.', 502);
+  if (init?.method === 'DELETE') return new Response(null, { status: response.status });
+  return boundedResponse(response, signal);
+}
+
+async function guardedRequest(input: string, init: RequestInit | undefined, guard: DiscoveryGuard, budget: { refreshed: boolean }): Promise<Response> {
+  let revision: string | undefined;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    guard.signal.throwIfAborted();
+    await guard.fresh(revision);
+    guard.signal.throwIfAborted();
+    const row = guard.current();
+    if (input !== new URL(row.url).toString()) throw orgUnavailable();
+    const options = requestInit(row, init, guard.signal);
+    const response = await guard.fetch(input, options);
+    try {
+      guard.current();
+      options.signal.throwIfAborted();
+      if (response.status === 401 || response.status === 403) {
+        if (row.auth !== 'oauth' || budget.refreshed) throw orgSignin();
+        budget.refreshed = true;
+        revision = row.revision;
+        continue;
+      }
+      return await discoveryResponse(response, init, options.signal);
+    } finally {
+      if (!response.bodyUsed) await response.body?.cancel();
+    }
+  }
+  throw orgSignin();
+}
+
+export async function discoverOrgGroups(url: string, guard: DiscoveryGuard): Promise<Record<string, ToolGroup>> {
+  try {
+    const failure: { error: ApiError | null } = { error: null };
+    const budget = { refreshed: false };
+    const send: FetchLike = async (input, init) => {
+      try {
+        return await guardedRequest(input, init, guard, budget);
+      } catch (error) {
+        failure.error = orgRuntimeError(error);
+        throw failure.error;
+      }
+    };
+    const tools = await listRemoteTools(new URL(url), { kind: 'none' }, send);
+    if (failure.error !== null) throw failure.error;
+    guard.current();
+    guard.signal.throwIfAborted();
+    if (tools.length > MAX_TOOLS) throw orgUnavailable();
+    return Object.fromEntries(tools.filter((tool) => /^[A-Za-z0-9_.-]{1,128}$/.test(tool.name)).map((tool) => [tool.name, tool.readOnly ? 'read' : 'write']));
+  } catch (error) {
+    throw orgRuntimeError(error);
+  }
+}