@stage-labs/metro 0.1.0-beta.289 → 0.1.0-beta.290

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime.ts

@@ -1,10 +1,13 @@
 import { log } from '@metro-labs/core/log';
+import { agentsDir } from '../agents/files.js';
+import { assertMigrationOutcomeKnown, beginMigrationOperation, migrationRequestEffectful, type MigrationOperation } from './migration-operations.js';
 import type { FetchLike } from '@metro-labs/core/stations/oauth';
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import type { DeliveredConnector } from '@metro-labs/http/connector-delivery';
 import type { ApiError } from '@metro-labs/http/api-error';
 import { requestConnectorBlocker, type GateRow } from './gates.js';
 import { publishOrgConnectors } from './publication.js';
+import type { MigrationRuntimeMapping } from './migration-guard.js';
 import { isOrgRelayId, orgRelayId } from './relay-id.js';
 import type { RelaySession } from './relay-session.js';
 import type { RelayTarget } from './relay-target.js';
@@ -13,12 +16,20 @@ import { discoverOrgGroups, orgMissing, orgRuntimeError, orgSignin, orgUnavailab
 
 interface RuntimeDeps {
   enabled?: () => boolean;
+  mapping?: () => MigrationRuntimeMapping;
+  migrationDir?: string;
   publish?: (rows: readonly GateRow[]) => void;
   fetch?: FetchLike;
 }
 
+interface RuntimeRow extends DeliveredConnector {
+  relayId: string;
+  relayName: string;
+}
+
 interface Entry {
   id: string;
+  relayId: string;
   epoch: number;
   stamp: string;
   controller: AbortController;
@@ -30,13 +41,14 @@ interface Entry {
 
 interface Session {
   entry: Entry;
+  operation: MigrationOperation | null;
   controller: AbortController;
   revision: string | null;
   error: ApiError | null;
 }
 
-const stampOf = (row: DeliveredConnector): string => JSON.stringify([
-  row.name, row.url, row.auth, row.policy.read ?? 'allow', row.policy.write ?? 'allow',
+const stampOf = (row: RuntimeRow): string => JSON.stringify([
+  row.relayId, row.relayName, row.name, row.url, row.auth, row.policy.read ?? 'allow', row.policy.write ?? 'allow',
   Object.entries(row.policy.tools ?? {}).sort(([a], [b]) => a.localeCompare(b)),
 ]);
 
@@ -74,15 +86,14 @@ export class OrgConnectorRuntime {
     return !this.stopped && (this.deps.enabled?.() ?? process.env.METRO_CONNECTORS_LIVE_ENABLED === 'true');
   }
 
-  private abort(session: Session, error: ApiError): void {
+  private abort(session: Session, error: ApiError, drain = false): void {
     session.error ??= error;
-    session.controller.abort();
-    this.sessions.delete(session);
+    if (!drain) session.controller.abort();
   }
 
-  private publish(rows: DeliveredConnector[]): void {
+  private publish(rows: RuntimeRow[]): void {
     const metadata: GateRow[] = rows.filter((row) => row.state === 'ready').map((row) => ({
-      id: orgRelayId(row.id), name: row.name,
+      id: row.relayId, name: row.relayName,
       config: { policy: structuredClone(row.policy), toolGroups: { ...this.entries.get(row.id)?.groups } },
     }));
     const text = JSON.stringify(metadata);
@@ -97,33 +108,66 @@ export class OrgConnectorRuntime {
     }
   }
 
-  private invalidateEntries(rows: DeliveredConnector[], epoch: number, available: boolean): void {
+  private invalidateEntries(rows: RuntimeRow[], epoch: number, available: boolean): void {
     for (const [id, entry] of this.entries) {
       const row = rows.find((value) => value.id === id);
       const valid = available && entry.epoch === epoch;
       if (valid && row?.state === 'ready' && entry.stamp === stampOf(row)) continue;
       const error = valid ? rowError(row) ?? orgUnavailable() : orgUnavailable();
-      entry.controller.abort();
-      this.entries.delete(id);
-      this.abortEntry(entry, error);
+      this.invalidateEntry(entry, row, error);
     }
   }
 
-  private abortEntry(entry: Entry, error: ApiError): void {
-    for (const session of this.sessions) if (session.entry === entry) this.abort(session, error);
+  private invalidateEntry(entry: Entry, row: RuntimeRow | undefined, error: ApiError): void {
+    const drain = !isOrgRelayId(entry.relayId) && row?.relayId !== entry.relayId;
+    if (!drain) entry.controller.abort();
+    this.entries.delete(entry.id);
+    this.abortEntry(entry, error, drain);
+  }
+
+  private abortEntry(entry: Entry, error: ApiError, drain = false): void {
+    for (const session of this.sessions) if (session.entry === entry) this.abort(session, error, drain);
+  }
+
+  private mappedRows(rows: DeliveredConnector[], mapping: MigrationRuntimeMapping): RuntimeRow[] {
+    return rows.flatMap((row) => {
+      const alias = mapping.aliases.find((value) => value.destinationId === row.id);
+      if (alias !== undefined) return [{ ...row, relayId: alias.sourceId, relayName: alias.name }];
+      return this.enabled() && !mapping.reserved.includes(row.id) ? [{ ...row, relayId: orgRelayId(row.id), relayName: row.name }] : [];
+    });
   }
 
-  private update(): DeliveredConnector[] | null {
-    const snapshot = this.enabled() ? this.sync.read() : null;
-    const rows = snapshot?.connectors ?? [];
-    const epoch = this.sync.epoch();
-    this.invalidateEntries(rows, epoch, snapshot !== null);
-    for (const row of rows) {
-      if (row.state !== 'ready' || this.entries.has(row.id)) continue;
-      this.entries.set(row.id, { id: row.id, epoch, stamp: stampOf(row), controller: new AbortController(), groups: {}, scan: null, nextScan: 0, error: null });
+  private mapping(): MigrationRuntimeMapping {
+    if (this.stopped) return { aliases: [], reserved: [] };
+    return this.deps.mapping?.() ?? { aliases: [], reserved: [] };
+  }
+
+  private update(): RuntimeRow[] | null {
+    try {
+      const mapping = this.mapping();
+      const snapshot = this.enabled() || mapping.aliases.length > 0 ? this.sync.read() : null;
+      const rows = this.mappedRows(snapshot?.connectors ?? [], mapping);
+      const epoch = this.sync.epoch();
+      this.invalidateEntries(rows, epoch, snapshot !== null);
+      for (const row of rows) {
+        if (row.state !== 'ready' || this.entries.has(row.id)) continue;
+        this.entries.set(row.id, { id: row.id, relayId: row.relayId, epoch, stamp: stampOf(row), controller: new AbortController(), groups: {}, scan: null, nextScan: 0, error: null });
+      }
+      this.publish(rows);
+      return snapshot === null ? null : rows;
+    } catch {
+      this.invalidateEntries([], this.sync.epoch(), false);
+      this.publish([]);
+      throw orgUnavailable();
     }
-    this.publish(rows);
-    return snapshot === null ? null : rows;
+  }
+
+  refresh(): void {
+    this.update();
+  }
+
+  idle(id?: string): boolean {
+    return ![...this.sessions].some((session) => id === undefined || session.entry.relayId === id);
   }
 
   private currentEntry(entry: Entry): DeliveredConnector {
@@ -134,6 +178,7 @@ export class OrgConnectorRuntime {
     const error = rowError(row);
     if (error !== null) throw error;
     if (entry.controller.signal.aborted || this.entries.get(entry.id) !== entry) throw orgUnavailable();
+    if (!isOrgRelayId(entry.relayId)) assertMigrationOutcomeKnown(entry.relayId, this.deps.migrationDir);
     return row;
   }
 
@@ -156,21 +201,30 @@ export class OrgConnectorRuntime {
     return this.currentEntry(entry);
   }
 
+  private migrationOperation(entry: Entry): MigrationOperation | null {
+    return isOrgRelayId(entry.relayId) ? null : beginMigrationOperation(entry.relayId, this.deps.migrationDir ?? agentsDir(), true);
+  }
+
   private async scan(entry: Entry): Promise<void> {
     const row = this.currentEntry(entry);
     const signal = AbortSignal.any([entry.controller.signal, AbortSignal.timeout(45_000)]);
-    const groups = await discoverOrgGroups(row.url, {
-      fresh: (revision) => this.fresh(entry, revision === undefined ? undefined : { connectorId: entry.id, revision }),
-      current: () => this.currentEntry(entry), signal, fetch: this.deps.fetch ?? fetch,
-    });
-    this.currentEntry(entry);
-    if (JSON.stringify(groups) !== JSON.stringify(entry.groups)) {
-      for (const session of this.sessions) if (session.entry === entry && session.revision !== null) this.abort(session, orgUnavailable());
-    }
-    entry.groups = groups;
-    entry.error = null;
-    entry.nextScan = performance.now() + 60_000;
-    this.update();
+    const operation = this.migrationOperation(entry);
+    try {
+      const send = this.deps.fetch ?? fetch;
+      const groups = await discoverOrgGroups(row.url, {
+        fresh: (revision) => this.fresh(entry, revision === undefined ? undefined : { connectorId: entry.id, revision }),
+        current: () => this.currentEntry(entry), signal,
+        fetch: (input, init) => operation?.dispatch(() => send(input, init), { effectful: migrationRequestEffectful(init?.method, init?.body) }) ?? send(input, init),
+      });
+      this.currentEntry(entry);
+      if (JSON.stringify(groups) !== JSON.stringify(entry.groups)) {
+        for (const session of this.sessions) if (session.entry === entry && session.revision !== null) this.abort(session, orgUnavailable());
+      }
+      entry.groups = groups;
+      entry.error = null;
+      entry.nextScan = performance.now() + 60_000;
+      this.update();
+    } finally { operation?.close(); }
   }
 
   private discover(entry: Entry): Promise<void> | null {
@@ -209,18 +263,18 @@ export class OrgConnectorRuntime {
   }
 
   open(id: string): RelaySession {
-    if (!isOrgRelayId(id)) throw orgMissing();
     const rows = this.update();
     if (rows === null) throw orgUnavailable();
-    const rawId = id.slice(4);
-    const error = rowError(rows.find((row) => row.id === rawId));
+    const mapped = rows.find((row) => row.relayId === id);
+    const error = rowError(mapped);
     if (error !== null) throw error;
-    const entry = this.entries.get(rawId);
+    const entry = mapped === undefined ? undefined : this.entries.get(mapped.id);
     if (entry === undefined) throw orgUnavailable();
-    const session: Session = { entry, controller: new AbortController(), revision: null, error: null };
+    const session: Session = { entry, operation: this.migrationOperation(entry), controller: new AbortController(), revision: null, error: null };
     this.sessions.add(session);
     const blocker = requestConnectorBlocker();
     return {
+      dispatch: (send, effectful) => { this.currentSession(session); return session.operation?.dispatch(send, { effectful }) ?? send(); },
       target: (force) => this.target(session, force),
       current: () => {
         const row = this.currentSession(session);
@@ -232,7 +286,7 @@ export class OrgConnectorRuntime {
         return blocker();
       },
       signal: session.controller.signal,
-      close: () => { this.abort(session, orgUnavailable()); },
+      close: () => { this.abort(session, orgUnavailable()); session.operation?.close(); this.sessions.delete(session); },
     };
   }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-control.ts

@@ -8,6 +8,9 @@ import { OrgConnectorSync, type OrgSyncDeps } from './org-sync.js';
 import { OrgConnectorRuntime } from './org-runtime.js';
 import { connectorSyncScope, disableSavedSync, saveSyncSetting, syncOptedIn, syncSetting } from './org-sync-setting.js';
 import type { RelaySession } from './relay-session.js';
+import type { DeliverySnapshot } from '@metro-labs/http/connector-delivery';
+import { localMigrationIdle, migrationRuntimeMapping } from './migration-guard.js';
+import { publishConnectors } from './publication.js';
 
 type ControlDeps = Pick<OrgSyncDeps, 'owner' | 'key' | 'monotonic'> & { api?: MetroApi; dir?: string };
 type Context = Pick<ConnectorSyncStatus, 'owner' | 'agentId' | 'scope' | 'enrolled'>;
@@ -20,6 +23,7 @@ export class OrgConnectorControl {
   private readonly api: MetroApi;
   private sync: OrgConnectorSync | null = null;
   private runtime: OrgConnectorRuntime | null = null;
+  private readonly draining = new Set<OrgConnectorRuntime>();
   private scope: string | null = null;
   private operation = randomBytes(16).toString('hex');
   private timer: ReturnType<typeof setInterval> | null = null;
@@ -43,6 +47,8 @@ export class OrgConnectorControl {
     this.sync = null;
     const runtime = this.runtime;
     this.runtime = null;
+    for (const previous of this.draining) if (previous.idle()) this.draining.delete(previous);
+    if (runtime !== null && !runtime.idle()) this.draining.add(runtime);
     try {
       runtime?.stop();
     } catch {
@@ -64,11 +70,17 @@ export class OrgConnectorControl {
     else if (start && this.sync === null) {
       const scope = context.scope;
       this.sync = new OrgConnectorSync({ ...this.deps, api: this.api, enabled: () => this.context().scope === scope && syncSetting(this.dir, scope).enabled });
-      if (liveEnabled()) this.runtime = new OrgConnectorRuntime(this.sync, { enabled: liveEnabled });
     }
+    if (start) this.startRuntime();
     return { context, setting };
   }
 
+  private startRuntime(): void {
+    if (this.sync === null || this.runtime !== null) return;
+    const mapping = () => migrationRuntimeMapping(this.deps.owner(), this.deps.key(), this.dir);
+    if (liveEnabled() || mapping().aliases.length > 0) this.runtime = new OrgConnectorRuntime(this.sync, { enabled: liveEnabled, mapping, migrationDir: this.dir });
+  }
+
   status(): ConnectorSyncStatus {
     try {
       const { context, setting } = this.reconcile(false);
@@ -104,6 +116,28 @@ export class OrgConnectorControl {
     await this.sync?.sync();
   }
 
+  async fresh(): Promise<DeliverySnapshot> {
+    this.reconcile(true);
+    const sync = this.sync;
+    if (sync === null) throw new ApiError('Enable organization connector sync before moving this connector.', 409);
+    await sync.syncFresh();
+    this.reconcile(false);
+    const snapshot = this.sync === sync ? sync.read() : null;
+    if (snapshot === null) throw new ApiError('A fresh organization connector snapshot is unavailable.', 503);
+    return snapshot;
+  }
+
+  refreshRuntime(): void {
+    this.reconcile(true);
+    this.runtime?.refresh();
+    publishConnectors();
+  }
+
+  migrationIdle(id: string): boolean {
+    for (const runtime of this.draining) if (runtime.idle()) this.draining.delete(runtime);
+    return localMigrationIdle(id, this.dir) && (this.runtime?.idle(id) ?? true) && [...this.draining].every((runtime) => runtime.idle(id));
+  }
+
   private tick(): void {
     this.poll().catch(() => {
       log.warn('organization connectors: memory sync unavailable; cached credentials were cleared');
@@ -130,9 +164,9 @@ export class OrgConnectorControl {
   }
 
   open(id: string): RelaySession {
+    if (this.runtime === null && !syncOptedIn(this.dir)) throw new ApiError('Organization connectors are not available on this agent.', 503);
+    this.reconcile(true);
     if (this.runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
-    this.reconcile(false);
-    if (!liveEnabled() || this.runtime === null) throw new ApiError('Organization connectors are not available on this agent.', 503);
     return this.runtime.open(id);
   }
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-sync-watch.ts

@@ -3,6 +3,8 @@ import type { ConnectorSyncStatus } from '@metro-labs/core/connector-sync';
 import { OrgConnectorControl } from './org-sync-control.js';
 import { isOrgRelayId } from './relay-id.js';
 import type { RelaySession } from './relay-session.js';
+import type { DeliverySnapshot } from '@metro-labs/http/connector-delivery';
+import { migrationSource } from './migration-guard.js';
 
 let active: OrgConnectorControl | null = null;
 
@@ -12,7 +14,19 @@ function control(): OrgConnectorControl {
 }
 
 export function orgConnectorRelaySession(id: string): RelaySession | null {
-  return isOrgRelayId(id) ? control().open(id) : null;
+  return isOrgRelayId(id) || migrationSource(id)?.phase === 'active' ? control().open(id) : null;
+}
+
+export function freshOrgConnectors(): Promise<DeliverySnapshot> {
+  return control().fresh();
+}
+
+export function refreshOrgConnectorRuntime(): void {
+  control().refreshRuntime();
+}
+
+export function orgConnectorMigrationIdle(id: string): boolean {
+  return control().migrationIdle(id);
 }
 
 export function orgConnectorSyncStatus(): ConnectorSyncStatus {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -54,9 +54,10 @@ export function serverKeysOf(rows: PluginRow[]): Map<string, string> {
   return keys;
 }
 
-export function pluginServers(rows: PluginRow[], base: string): Record<string, PluginServer> {
+export function pluginServers(rows: PluginRow[], base: string, keys: ReadonlyMap<string, string> = serverKeysOf(rows)): Record<string, PluginServer> {
   const out: Record<string, PluginServer> = {};
-  for (const [id, key] of serverKeysOf(rows)) out[key] = { type: 'http', url: `${base}/relay/${id}`, headersHelper: HELPER };
+  const visible = new Set(rows.map((row) => row.id));
+  for (const [id, key] of keys) if (visible.has(id)) out[key] = { type: 'http', url: `${base}/relay/${id}`, headersHelper: HELPER };
   return out;
 }
 
@@ -112,6 +113,7 @@ export interface PluginSyncOptions {
   dir?: string;
   base?: string;
   staged?: string | null;
+  keys?: ReadonlyMap<string, string>;
 }
 
 function filesFor(opts: PluginSyncOptions): string[] {
@@ -122,7 +124,7 @@ function filesFor(opts: PluginSyncOptions): string[] {
 export function syncPluginServers(rows: PluginRow[], opts: PluginSyncOptions = {}): number {
   const files = filesFor(opts);
   if (files.length === 0) return 0;
-  const servers = pluginServers(rows, opts.base ?? loopbackBase());
+  const servers = pluginServers(rows, opts.base ?? loopbackBase(), opts.keys);
   const text = `${JSON.stringify(servers, null, 2)}\n`;
   let written = 0;
   for (const file of files) {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/publication.ts

@@ -1,6 +1,7 @@
 import { registerConnectors, type GateRow } from './gates.js';
-import { syncPluginServers } from './plugin-sync.js';
+import { serverKeysOf, syncPluginServers } from './plugin-sync.js';
 import { isOrgRelayId } from './relay-id.js';
+import { migrationRecords } from './migration-state.js';
 
 let local: GateRow[] = [];
 let organization: GateRow[] = [];
@@ -17,9 +18,23 @@ function metadata(rows: readonly GateRow[]): GateRow[] {
 }
 
 export function publishConnectors(): void {
-  const rows = [...local, ...organization];
-  registerConnectors(rows);
-  syncPluginServers(rows);
+  let records: ReturnType<typeof migrationRecords>;
+  try { records = migrationRecords().filter((record) => record.phase !== 'rolled_back'); }
+  catch (error) {
+    registerConnectors([], local.map((row) => row.id));
+    syncPluginServers([]);
+    throw error;
+  }
+  const retired = new Set(records.filter((record) => !['preparing', 'prepared'].includes(record.phase)).map((record) => record.sourceId));
+  const aliases = new Map(organization.filter((row) => records.some((record) => record.phase === 'active' && record.sourceId === row.id && record.name === row.name)).map((row) => [row.id, row]));
+  const rows = local.flatMap((row) => {
+    const alias = aliases.get(row.id);
+    return alias !== undefined ? [alias] : retired.has(row.id) ? [] : [row];
+  });
+  rows.push(...organization.filter((row) => isOrgRelayId(row.id) && !records.some((record) => row.id === `org-${record.destinationId ?? ''}`)));
+  const keys = serverKeysOf([...local, ...rows.filter((row) => isOrgRelayId(row.id))]);
+  registerConnectors(rows, [...retired, ...aliases.keys()], keys);
+  syncPluginServers(rows, { keys });
 }
 
 export function publishLocalConnectors(rows: readonly GateRow[]): void {
@@ -28,6 +43,6 @@ export function publishLocalConnectors(rows: readonly GateRow[]): void {
 }
 
 export function publishOrgConnectors(rows: readonly GateRow[]): void {
-  organization = metadata(rows.filter((row) => isOrgRelayId(row.id)));
+  organization = metadata(rows);
   publishConnectors();
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-session.ts

@@ -7,4 +7,5 @@ export interface RelaySession {
   blocker: () => BlockedReason;
   signal: AbortSignal;
   close: () => void;
+  dispatch?: (send: () => Promise<Response>, effectful?: boolean) => Promise<Response>;
 }

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -5,11 +5,15 @@ import type { RelayTarget } from './relay-target.js';
 import type { RelaySession } from './relay-session.js';
 import { isOrgRelayId } from './relay-id.js';
 import { exchangeOrg } from './org-relay.js';
+import { assertLocalMigrationUse, migrationSource, withLocalMigrationOperation } from './migration-guard.js';
+import { agentsDir } from '../agents/files.js';
+import { migrationRequestEffectful, type MigrationOperation } from './migration-operations.js';
 import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
 import { answerBlocked, mergeBlocked, screenCalls, type BlockedReason } from './relay-policy.js';
 
 export interface RelayApiDeps {
+  migrationDir?: string;
   target: (connectorId: string, force: boolean) => Promise<RelayTarget>;
   identify: (req: IncomingMessage) => { subject: string; agentId: string } | null;
   signedOut: (connectorId: string) => void;
@@ -223,15 +227,20 @@ async function exchange(
   deps: RelayApiDeps,
   body: Uint8Array<ArrayBuffer> | null,
   signal: AbortSignal,
+  dispatch: MigrationOperation['dispatch'],
 ): Promise<Exchanged> {
+  assertLocalMigrationUse(connectorId, deps.migrationDir);
   const target = await deps.target(connectorId, false);
+  assertLocalMigrationUse(connectorId, deps.migrationDir);
   if (target.kind !== 'ok') return { kind: target.kind };
-  let upstream = await forward(req, target, body, signal);
+  let upstream = await dispatch(() => forward(req, target, body, signal), { effectful: migrationRequestEffectful(req.method, body) });
   if (!authFailed(upstream.status)) return { kind: 'response', upstream };
   await upstream.body?.cancel();
+  assertLocalMigrationUse(connectorId, deps.migrationDir);
   const fresh = await deps.target(connectorId, true);
+  assertLocalMigrationUse(connectorId, deps.migrationDir);
   if (fresh.kind !== 'ok') return { kind: 'signin' };
-  upstream = await forward(req, fresh, body, signal);
+  upstream = await dispatch(() => forward(req, fresh, body, signal), { effectful: migrationRequestEffectful(req.method, body) });
   if (!authFailed(upstream.status)) return { kind: 'response', upstream };
   await upstream.body?.cancel();
   return { kind: 'signin' };
@@ -293,7 +302,10 @@ async function relayOrg(req: IncomingMessage, res: ServerResponse, id: string, d
   const session = deps.open?.(id);
   if (session === undefined || session === null) throw new ApiError('Organization connector tools are not switched on yet.', 503);
   try {
-    const out = await exchangeOrg(id, session, read, signal, (target, body, guard) => forward(req, target, body, guard, true));
+    const out = await exchangeOrg(id, session, read, signal, (target, body, guard) => {
+      const send = () => forward(req, target, body, guard, true);
+      return session.dispatch?.(send, migrationRequestEffectful(req.method, body)) ?? send();
+    });
     if (out.kind === 'blocked') answerBlocked(res, out.screened);
     else await deliver(res, id, deps, out, out.answers);
   } finally { session.close(); }
@@ -307,14 +319,17 @@ async function relayOnce(
   signal: AbortSignal,
 ): Promise<void> {
   const read = req.method === 'POST' ? await readCapped(req) : null;
-  if (isOrgRelayId(connectorId)) return relayOrg(req, res, connectorId, deps, read, signal);
-  const screened = read === null || deps.blocked === undefined ? null : screenCalls(read, connectorId, deps.blocked);
-  if (screened?.forward === null) {
-    answerBlocked(res, screened);
-    return;
-  }
-  const out = await exchange(req, connectorId, deps, screened === null ? read : screened.forward, signal);
-  await deliver(res, connectorId, deps, out, screened?.answers ?? []);
+  const dir = deps.migrationDir ?? agentsDir();
+  if (isOrgRelayId(connectorId) || migrationSource(connectorId, dir)?.phase === 'active') return relayOrg(req, res, connectorId, deps, read, signal);
+  await withLocalMigrationOperation(connectorId, dir, async (operation) => {
+    const screened = read === null || deps.blocked === undefined ? null : screenCalls(read, connectorId, deps.blocked);
+    if (screened?.forward === null) {
+      answerBlocked(res, screened);
+      return;
+    }
+    const out = await exchange(req, connectorId, deps, screened === null ? read : screened.forward, signal, operation.dispatch);
+    await deliver(res, connectorId, deps, out, screened?.answers ?? []);
+  });
 }
 
 function dispatch(