@stage-labs/metro 0.1.0-beta.289 → 0.1.0-beta.290

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-preview.ts

@@ -6,13 +6,16 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { bodyField } from '@metro-labs/http/api-http';
 import { connectorAuth, connectorClient, connectorName } from '@metro-labs/http/connector-input';
 import { parseConnectorUrl } from '@metro-labs/http/connector-url';
+import { connectorPolicyOf } from '@metro-labs/http/connector-delivery';
+import { readConfig } from './config.js';
+import type { LocalConnectorRow } from './store.js';
 import { agentsDir } from '../agents/files.js';
 import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
 import { connectorSyncScope, syncOptedIn, syncSetting } from './org-sync-setting.js';
 import { readAgentKey } from './agent-key.js';
 import { migrationOrigin } from './migration-url.js';
 
-export type MigrationIssue = 'invalid_config' | 'unsupported_url' | 'custom_policy' | 'oauth_sign_in' | 'header_reentry';
+export type MigrationIssue = 'invalid_config' | 'unsupported_url' | 'custom_policy' | 'oauth_sign_in' | 'header_reentry' | 'unused_oauth_client' | 'oauth_private_resource';
 
 export interface MigrationConnector {
   id: string;
@@ -25,6 +28,7 @@ export interface MigrationConnector {
 }
 
 export interface ConnectorMigrationPreview {
+  migrationSupported: true;
   enabled: boolean;
   enrolled: boolean;
   agentId: string | null;
@@ -45,7 +49,8 @@ function validClient(raw: unknown): boolean {
   if (raw === undefined || raw === null) return true;
   if (!isRecord(raw) || !onlyKeys(raw, ['clientId', 'clientSecret'])) return false;
   if (!nonempty(raw.clientId) || !optionalStrings(raw, ['clientSecret'])) return false;
-  return connectorClient(raw.clientId, raw.clientSecret) !== null;
+  const client = connectorClient(raw.clientId, raw.clientSecret);
+  return client !== null && client.clientId === raw.clientId && client.clientSecret === raw.clientSecret;
 }
 
 function oauthTokensValid(raw: Record<string, unknown>): boolean {
@@ -64,14 +69,18 @@ function oauthAuth(raw: Record<string, unknown>): 'oauth' {
   return 'oauth';
 }
 
+function headerAuth(raw: Record<string, unknown>): 'header' {
+  if (raw.kind !== 'header' || !onlyKeys(raw, ['kind', 'name', 'value'])) return invalid();
+  if (!nonempty(raw.name) || !nonempty(raw.value)) return invalid();
+  const auth = connectorAuth(raw.name, raw.value);
+  return auth.kind === 'header' && auth.name === raw.name && auth.value === raw.value ? 'header' : invalid();
+}
+
 function authKind(raw: unknown): Exclude<MigrationConnector['auth'], 'invalid'> {
   if (!isRecord(raw)) return invalid();
   if (raw.kind === 'oauth') return oauthAuth(raw);
   if (raw.kind === 'none' && onlyKeys(raw, ['kind'])) return 'none';
-  if (raw.kind !== 'header' || !onlyKeys(raw, ['kind', 'name', 'value'])) return invalid();
-  if (!nonempty(raw.name) || !nonempty(raw.value)) return invalid();
-  const auth = connectorAuth(raw.name, raw.value);
-  return auth.kind === 'header' ? 'header' : invalid();
+  return headerAuth(raw);
 }
 
 function metadataValid(config: Record<string, unknown>): boolean {
@@ -120,7 +129,13 @@ function strictPolicy(raw: unknown): ToolPolicy {
 function policyPreview(raw: unknown): Pick<MigrationConnector, 'policy' | 'policySupported'> & { valid: boolean } {
   try {
     const policy = strictPolicy(raw);
-    const policySupported = (policy.read ?? 'allow') === 'allow' && policy.write !== 'ask' && Object.keys(policy.tools ?? {}).length === 0;
+    let policySupported = false;
+    try {
+      connectorPolicyOf(policy);
+      policySupported = true;
+    } catch {
+      policySupported = false;
+    }
     return { policy, policySupported, valid: true };
   } catch {
     return { policy: {}, policySupported: false, valid: false };
@@ -141,6 +156,18 @@ function rowIdentity(row: Record<string, unknown>, index: number): { id: string;
   return { id: id ?? `invalid-${String(index + 1)}`, name: name ?? `Connector ${String(index + 1)}`, valid: id !== null && name !== null };
 }
 
+function authIssues(row: Record<string, unknown>, auth: MigrationConnector['auth'], origin: string | null): MigrationIssue[] {
+  if (auth === 'oauth') {
+    const issues: MigrationIssue[] = ['oauth_sign_in'];
+    if (origin === null) return issues;
+    const url = parseConnectorUrl(row.url);
+    if (![url.origin, `${url.origin}/`, `${url.origin}/mcp`].includes(String(row.url))) issues.push('oauth_private_resource');
+    return issues;
+  }
+  const client = bodyField(row.config, 'client');
+  return (auth === 'none' || auth === 'header') && client !== undefined && client !== null ? ['unused_oauth_client'] : [];
+}
+
 function previewRow(raw: unknown, index: number): MigrationConnector {
   const row = isRecord(raw) ? raw : {};
   const identity = rowIdentity(row, index);
@@ -151,8 +178,7 @@ function previewRow(raw: unknown, index: number): MigrationConnector {
   if (!identity.valid || auth === 'invalid' || !valid) issues.push('invalid_config');
   if (origin === null) issues.push('unsupported_url');
   if (valid && !policySupported) issues.push('custom_policy');
-  if (auth === 'oauth') issues.push('oauth_sign_in');
-  if (auth === 'header') issues.push('header_reentry');
+  issues.push(...authIssues(row, auth, origin));
   return { id: identity.id, name: identity.name, auth, origin, policy, policySupported, issues };
 }
 
@@ -191,11 +217,20 @@ function previewRows(dir: string): MigrationConnector[] {
   return rows;
 }
 
+export function migrationSource(id: string, dir = agentsDir()): LocalConnectorRow {
+  const source = previewRows(dir).find((row) => row.id === id);
+  if (source === undefined) throw new ApiError('The local connector is missing.', 404);
+  if (source.issues.some((issue) => issue !== 'oauth_sign_in')) throw new ApiError('This connector cannot be migrated without changing its settings or permissions. Resolve the preview blockers first.', 409);
+  const raw = readRows(dir).find((row) => isRecord(row) && row.id === id);
+  if (!isRecord(raw) || typeof raw.url !== 'string') throw unavailable();
+  return { id, name: source.name, url: raw.url, config: { ...readConfig(raw.config), policy: source.policy } };
+}
+
 export function connectorMigrationPreview(owner: string | null, dir = agentsDir()): ConnectorMigrationPreview {
   const enabled = syncOptedIn(dir) && syncSetting(dir, connectorSyncScope(owner, readAgentKey(dir))).enabled;
   const liveEnabled = process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true';
-  if (!enabled) return { enabled, enrolled: false, agentId: null, owner, liveEnabled, connectors: [] };
+  if (!enabled) return { migrationSupported: true, enabled, enrolled: false, agentId: null, owner, liveEnabled, connectors: [] };
   const enrollment = owner === null ? null : readAgentKey(dir)?.enrollment;
   const agentId = enrollment?.organization === owner ? enrollment?.server ?? null : null;
-  return { enabled, enrolled: agentId !== null, agentId, owner, liveEnabled, connectors: previewRows(dir) };
+  return { migrationSupported: true, enabled, enrolled: agentId !== null, agentId, owner, liveEnabled, connectors: previewRows(dir) };
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-source.ts

@@ -0,0 +1,23 @@
+import { createHash } from 'node:crypto';
+import type { MigrationPayload } from '@metro-labs/http/connector-migration';
+import { connectorPolicyOf } from '@metro-labs/http/connector-delivery';
+import type { LocalConnectorRow } from './store.js';
+
+export function migrationPayload(row: LocalConnectorRow): MigrationPayload {
+  const oauth = row.config.oauth || row.config.auth.kind === 'oauth';
+  const auth = oauth ? { kind: 'oauth' as const } : row.config.auth;
+  if (auth.kind === 'oauth') {
+    return stamped({ name: row.name, url: row.url, auth: { kind: 'oauth' }, client: row.config.client, policy: connectorPolicyOf(row.config.policy ?? {}) });
+  }
+  return stamped({ name: row.name, url: row.url, auth, client: row.config.client, policy: connectorPolicyOf(row.config.policy ?? {}) });
+}
+
+function stamped(value: Omit<MigrationPayload, 'sourceStamp'>): MigrationPayload {
+  const policy = value.policy;
+  const canonical = {
+    ...value,
+    policy: { read: policy.read ?? 'allow', write: policy.write ?? 'allow', tools: Object.entries(policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)) },
+  };
+  const sourceStamp = createHash('sha256').update(JSON.stringify(canonical)).digest('base64url');
+  return { ...value, sourceStamp };
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-state.ts

@@ -0,0 +1,122 @@
+import { randomBytes } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { parseId } from '@metro-labs/core/ids';
+import { ensureSecureDir } from '@metro-labs/core/secure-fs';
+import { ApiError } from '@metro-labs/http/api-error';
+import { connectorPolicyOf, type ConnectorPolicy } from '@metro-labs/http/connector-delivery';
+import { agentsDir } from '../agents/files.js';
+import { captureMigrationOperations } from './migration-operations.js';
+
+export type MigrationPhase = 'preparing' | 'prepared' | 'cutover' | 'active' | 'rollback' | 'rolled_back';
+export type MigrationAuth = 'none' | 'header' | 'oauth';
+
+export interface MigrationRecord {
+  id: string;
+  owner: string;
+  agentId: string;
+  keyId: string;
+  sourceId: string;
+  name: string;
+  destinationId: string | null;
+  phase: MigrationPhase;
+  auth: MigrationAuth;
+  sourceStamp: string;
+  policy: ConnectorPolicy;
+  reason: string | null;
+}
+
+const phases: readonly MigrationPhase[] = ['preparing', 'prepared', 'cutover', 'active', 'rollback', 'rolled_back'];
+const auths: readonly MigrationAuth[] = ['none', 'header', 'oauth'];
+const fields = ['id', 'owner', 'agentId', 'keyId', 'sourceId', 'name', 'destinationId', 'phase', 'auth', 'sourceStamp', 'policy', 'reason'];
+const unavailable = (): ApiError => new ApiError('Protected connector migration records cannot be read. Restore their file or permissions before using connectors.', 503);
+const DIGEST = /^[A-Za-z0-9_-]{43}$/;
+const pathOf = (dir: string): string => join(dir, 'connector-migrations.json');
+const markerOf = (dir: string): string => join(dir, 'connector-migrations.initialized');
+
+function requiredId(value: unknown): string {
+  const id = parseId(value);
+  if (id === null) throw unavailable();
+  return id;
+}
+
+function field(value: unknown, pattern: RegExp): string {
+  if (typeof value !== 'string' || !pattern.test(value)) throw unavailable();
+  return value;
+}
+
+function recordOf(value: unknown): MigrationRecord {
+  if (!isRecord(value) || Object.keys(value).some((key) => !fields.includes(key))) throw unavailable();
+  const phase = phases.find((item) => item === value.phase);
+  const auth = auths.find((item) => item === value.auth);
+  if (phase === undefined || auth === undefined) throw unavailable();
+  return {
+    id: requiredId(value.id), sourceId: requiredId(value.sourceId), agentId: requiredId(value.agentId),
+    owner: field(value.owner, /^org_[A-Za-z0-9]{1,128}$/), keyId: field(value.keyId, DIGEST), sourceStamp: field(value.sourceStamp, DIGEST),
+    name: field(value.name, /^.{1,200}$/), destinationId: value.destinationId === null ? null : requiredId(value.destinationId),
+    phase, auth, policy: connectorPolicyOf(value.policy), reason: value.reason === null ? null : field(value.reason, /^[a-z_]{1,64}$/),
+  };
+}
+
+function recordsOf(text: string): MigrationRecord[] {
+  const value: unknown = JSON.parse(text);
+  if (!isRecord(value) || value.version !== 1 || !Array.isArray(value.records) || value.records.length > 500) throw unavailable();
+  const records = value.records.map(recordOf);
+  if (new Set(records.map((record) => record.sourceId)).size !== records.length) throw unavailable();
+  return records;
+}
+
+export function migrationRecords(dir = agentsDir()): MigrationRecord[] {
+  try {
+    const marked = existsSync(markerOf(dir));
+    if (marked && readFileSync(markerOf(dir), 'utf8') !== '1\n') throw unavailable();
+    if (!existsSync(pathOf(dir))) {
+      if (marked) throw unavailable();
+      return [];
+    }
+    if (!marked) throw unavailable();
+    return recordsOf(readFileSync(pathOf(dir), 'utf8'));
+  } catch {
+    throw unavailable();
+  }
+}
+
+export function migrationRecord(id: string, dir = agentsDir()): MigrationRecord | null {
+  return migrationRecords(dir).find((record) => record.sourceId === id) ?? null;
+}
+
+function flush(path: string): void {
+  const fd = openSync(path, 'r');
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+}
+
+function markInitialized(dir: string): void {
+  const path = markerOf(dir);
+  if (existsSync(path)) return;
+  writeFileSync(path, '1\n', { flag: 'wx', mode: 0o600 });
+  flush(path);
+  flush(dir);
+}
+
+export function saveMigration(record: MigrationRecord, dir = agentsDir()): void {
+  const valid = recordOf(record);
+  const previous = migrationRecords(dir);
+  const rows = previous.filter((row) => row.sourceId !== valid.sourceId);
+  if (rows.length >= 500) throw new ApiError('There are too many connector migrations on this agent.', 409);
+  rows.push(valid);
+  ensureSecureDir(dir);
+  markInitialized(dir);
+  captureMigrationOperations(valid.sourceId, dir, !previous.some((row) => row.sourceId === valid.sourceId));
+  const path = pathOf(dir);
+  const temporary = `${path}.${randomBytes(12).toString('hex')}.tmp`;
+  const fd = openSync(temporary, 'wx', 0o600);
+  try {
+    try {
+      writeFileSync(fd, `${JSON.stringify({ version: 1, records: rows })}\n`);
+      fsyncSync(fd);
+    } finally { closeSync(fd); }
+    renameSync(temporary, path);
+    flush(dir);
+  } finally { rmSync(temporary, { force: true }); }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-routes.ts

@@ -8,10 +8,14 @@ import {
   takePending,
   type PendingAuth,
 } from './oauth.js';
-import { connectorClient } from '@metro-labs/http/connector-input';
+import { connectorClient, connectorName } from '@metro-labs/http/connector-input';
 import { parseConnectorUrl } from '@metro-labs/http/connector-url';
 import type { OAuthAuth } from '@metro-labs/http/connector-mcp';
 import type { Connector, PendingConnectorInput } from './store.js';
+import { agentsDir } from '../agents/files.js';
+import { withLocalMigrationOperation } from './migration-guard.js';
+import { migrationRecord } from './migration-state.js';
+import { ApiError } from '@metro-labs/http/api-error';
 
 export function hostOf(url: string): string {
   try {
@@ -22,6 +26,7 @@ export function hostOf(url: string): string {
 }
 
 export interface OAuthRouteDeps {
+  migrationDir?: string;
   createPendingConnector: (input: PendingConnectorInput) => Promise<Connector>;
   reconnectConnector: (id: string, auth: OAuthAuth) => Promise<Connector>;
   getConnector: (id: string) => Promise<Connector>;
@@ -34,32 +39,37 @@ export async function startOAuth(
   body: unknown,
   payload: (row: Connector) => Record<string, unknown>,
 ): Promise<void> {
-  const url = parseConnectorUrl(bodyField(body, 'url'));
-  const returnTo = stringOf(bodyField(body, 'returnTo'));
-  const clientId = bodyField(body, 'clientId');
-  const clientSecret = bodyField(body, 'clientSecret');
-  const prepared = await prepareOAuth({
-    url,
-    client: connectorClient(clientId, clientSecret),
-    returnTo,
-  });
-  const row = await deps.createPendingConnector({
-    name: bodyField(body, 'name'),
-    url: bodyField(body, 'url'),
-    clientId,
-    clientSecret,
-  });
-  const authorize = beginOAuth(prepared, {
-    name: row.name,
-    url,
-    returnTo,
-    connectorId: row.id,
-  });
-  log.info(
-    { id: row.id, host: url.hostname },
-    'connector-api: stored unconnected, sending the user to sign in',
-  );
-  sendJson(req, res, 201, { ...payload(row), authorizeUrl: authorize });
+  const name = connectorName(bodyField(body, 'name'));
+  await withLocalMigrationOperation('', deps.migrationDir ?? agentsDir(), async (operation) => {
+    const url = parseConnectorUrl(bodyField(body, 'url'));
+    const returnTo = stringOf(bodyField(body, 'returnTo'));
+    const clientId = bodyField(body, 'clientId');
+    const clientSecret = bodyField(body, 'clientSecret');
+    const prepared = await prepareOAuth({
+      url,
+      client: connectorClient(clientId, clientSecret),
+      returnTo,
+    }, operation.fetch);
+    const row = await deps.createPendingConnector({
+      name: bodyField(body, 'name'),
+      url: bodyField(body, 'url'),
+      clientId,
+      clientSecret,
+    });
+    operation.check();
+    const authorize = beginOAuth(prepared, {
+      name: row.name,
+      url,
+      returnTo,
+      connectorId: row.id,
+      migrationId: migrationRecord(row.id, deps.migrationDir)?.id ?? null,
+    });
+    log.info(
+      { id: row.id, host: url.hostname },
+      'connector-api: stored unconnected, sending the user to sign in',
+    );
+    sendJson(req, res, 201, { ...payload(row), authorizeUrl: authorize });
+  }, true, name);
 }
 
 export async function handleConnect(
@@ -68,22 +78,26 @@ export async function handleConnect(
   deps: OAuthRouteDeps,
   id: string,
 ): Promise<void> {
-  const row = await deps.getConnector(id);
-  const url = parseConnectorUrl(row.url);
-  const body = await readJsonBody(req);
-  const returnTo = stringOf(bodyField(body, 'returnTo'));
-  const prepared = await prepareOAuth({ url, client: row.client, returnTo });
-  const authorize = beginOAuth(prepared, {
-    name: row.name,
-    url,
-    returnTo,
-    connectorId: row.id,
-  });
-  log.info(
-    { id: row.id, host: url.hostname },
-    'connector-api: sending the user back to sign in',
-  );
-  sendJson(req, res, 202, { status: 'oauth', authorizeUrl: authorize });
+  await withLocalMigrationOperation(id, deps.migrationDir ?? agentsDir(), async (operation) => {
+    const row = await deps.getConnector(id);
+    const url = parseConnectorUrl(row.url);
+    const body = await readJsonBody(req);
+    const returnTo = stringOf(bodyField(body, 'returnTo'));
+    const prepared = await prepareOAuth({ url, client: row.client, returnTo }, operation.fetch);
+    operation.check();
+    const authorize = beginOAuth(prepared, {
+      name: row.name,
+      url,
+      returnTo,
+      connectorId: row.id,
+      migrationId: migrationRecord(row.id, deps.migrationDir)?.id ?? null,
+    });
+    log.info(
+      { id: row.id, host: url.hostname },
+      'connector-api: sending the user back to sign in',
+    );
+    sendJson(req, res, 202, { status: 'oauth', authorizeUrl: authorize });
+  }, true);
 }
 
 function landing(entry: PendingAuth, id?: string): string {
@@ -111,6 +125,10 @@ async function saveOAuth(
   return deps.reconnectConnector(entry.connectorId, auth);
 }
 
+function checkGeneration(entry: PendingAuth, dir: string | undefined): void {
+  if ((entry.migrationId ?? null) !== (migrationRecord(entry.connectorId, dir)?.id ?? null)) throw new ApiError('This sign-in predates the connector migration. Start a fresh sign-in.', 409);
+}
+
 async function settleCallback(
   res: ServerResponse,
   deps: OAuthRouteDeps,
@@ -118,8 +136,13 @@ async function settleCallback(
   code: string,
 ): Promise<void> {
   try {
-    const auth = await completeOAuth(entry, code);
-    const saved = await saveOAuth(deps, entry, auth);
+    const saved = await withLocalMigrationOperation(entry.connectorId, deps.migrationDir ?? agentsDir(), async (operation) => {
+      checkGeneration(entry, deps.migrationDir);
+      const auth = await completeOAuth(entry, code, operation.fetch);
+      operation.check();
+      checkGeneration(entry, deps.migrationDir);
+      return saveOAuth(deps, entry, auth);
+    }, true);
     log.info(
       { id: saved.id, name: saved.name, host: hostOf(saved.url) },
       'connector-api: oauth sign-in completed',

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth.ts

@@ -12,6 +12,7 @@ import {
 } from '@metro-labs/http/connector-oauth';
 import { discoverOAuth, type OAuthServer } from '@metro-labs/http/connector-discovery';
 import { ticketStore } from '@metro-labs/core/tickets';
+import type { FetchLike } from '@metro-labs/core/stations/oauth';
 
 export interface PendingAuth {
   name: string;
@@ -22,6 +23,7 @@ export interface PendingAuth {
   server: OAuthServer;
   client: OAuthClient;
   connectorId: string;
+  migrationId?: string | null;
 }
 
 const pending = ticketStore<PendingAuth>(10 * 60_000, 100);
@@ -53,17 +55,18 @@ export interface PreparedOAuth {
   redirectUri: string;
 }
 
-export async function prepareOAuth(input: PrepareInput): Promise<PreparedOAuth> {
+export async function prepareOAuth(input: PrepareInput, send: FetchLike = fetch): Promise<PreparedOAuth> {
   if (!validateReturnTo(input.returnTo))
     throw refused('that return address is not one Metro will send you back to');
-  const server = await discoverOAuth(input.url);
+  const server = await discoverOAuth(input.url, send);
   const redirectUri = callbackUri();
-  const client = input.client ?? (await registerClient(server, redirectUri));
+  const client = input.client ?? (await registerClient(server, redirectUri, send));
   return { server, client, redirectUri };
 }
 
 export interface BeginInput {
   connectorId: string;
+  migrationId?: string | null;
   name: string;
   url: URL;
   returnTo: string;
@@ -82,6 +85,7 @@ export function beginOAuth(prepared: PreparedOAuth, input: BeginInput): string {
     server,
     client,
     connectorId: input.connectorId,
+    migrationId: input.migrationId ?? null,
   });
   return authorizeUrl({
     server,
@@ -112,13 +116,14 @@ function authOf(pendingAuth: PendingAuth, tokens: OAuthTokens): OAuthAuth {
 export async function completeOAuth(
   entry: PendingAuth,
   code: string,
+  send: FetchLike = fetch,
 ): Promise<OAuthAuth> {
   const tokens = await exchangeCode(entry.server, entry.client, {
     code,
     redirectUri: callbackUri(),
     verifier: entry.verifier,
     resource: entry.resource,
-  });
+  }, send);
   return authOf(entry, tokens);
 }
 
@@ -129,6 +134,7 @@ export function oauthExpired(auth: OAuthAuth, now = Date.now()): boolean {
 export async function refreshOAuth(
   auth: OAuthAuth,
   resource: string,
+  send: FetchLike = fetch,
 ): Promise<OAuthAuth> {
   if (auth.refreshToken === undefined)
     throw refused('that connector needs signing in again');
@@ -152,6 +158,7 @@ export async function refreshOAuth(
     auth.refreshToken,
     resource,
     auth.scope,
+    send,
   );
   return {
     ...auth,

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime-discovery.ts

@@ -56,7 +56,10 @@ function requestInit(row: DeliveredConnector, init: RequestInit | undefined, sca
 
 async function discoveryResponse(response: Response, init: RequestInit | undefined, signal: AbortSignal): Promise<Response> {
   if (response.status >= 300) throw new ApiError('The organization connector refused tool discovery.', 502);
-  if (init?.method === 'DELETE') return new Response(null, { status: response.status });
+  if (init?.method === 'DELETE') {
+    await boundedResponse(response, signal);
+    return new Response(null, { status: response.status });
+  }
   return boundedResponse(response, signal);
 }