@stage-labs/metro 0.1.0-beta.30 → 0.1.0-beta.301

package/runtime/node_modules/@metro-labs/daemon/src/connectors/store.ts

@@ -0,0 +1,393 @@
+import { join } from 'node:path';
+import { closeSync, fsyncSync, openSync } from 'node:fs';
+import { publishLocalConnectors } from './publication.js';
+import { persistentServerKeys } from './server-keys.js';
+import { assertLocalMigrationEdit, localMigrationEnabled, localMigrationIdle, migrationSource, withLocalMigrationOperation } from './migration-guard.js';
+import type { FetchLike } from '@metro-labs/core/stations/oauth';
+import type { RelayTarget } from './relay-target.js';
+export type { RelayTarget } from './relay-target.js';
+import type { ToolPolicy } from '../policy/policy.js';
+import type { ToolGroup } from '@metro-labs/core/stations/types';
+import { listRemoteTools, type RemoteTool } from './tools.js';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { errMsg, log } from '@metro-labs/core/log';
+import {
+  authHeaders,
+  verifyRemoteMcp,
+  type ConnectorAuth,
+  type OAuthAuth,
+  type VerifiedRecord,
+} from '@metro-labs/http/connector-mcp';
+import { connectorUrlText, ConnectorVerifyError, parseConnectorUrl } from '@metro-labs/http/connector-url';
+import { oauthExpired, refreshOAuth } from './oauth.js';
+import { advertisesOAuth } from '@metro-labs/http/connector-discovery';
+import { ConnectorError, connectorAuth, connectorClient, connectorName } from '@metro-labs/http/connector-input';
+import {
+  readConfig,
+  signInState,
+  stamp,
+  type ConnectorConfig,
+  type ConnectorSignIn,
+} from './config.js';
+import type { OAuthClient } from '@metro-labs/http/connector-oauth';
+import { agentsDir } from '../agents/files.js';
+import { newId } from '@metro-labs/core/ids';
+import type { LoadedConnector } from '../stations/materialize.js';
+
+export interface LocalConnectorRow {
+  id: string;
+  name: string;
+  url: string;
+  config: ConnectorConfig;
+}
+
+export interface Connector {
+  id: string;
+  name: string;
+  url: string;
+  auth: ConnectorAuth['kind'];
+  header: string | null;
+  signIn: ConnectorSignIn;
+  verified: VerifiedRecord;
+  client: OAuthClient | null;
+  policy: ToolPolicy;
+}
+
+export interface PendingConnectorInput {
+  name: unknown;
+  url: unknown;
+  clientId: unknown;
+  clientSecret: unknown;
+}
+
+export interface ConnectorInput extends PendingConnectorInput {
+  header: unknown;
+  value: unknown;
+}
+
+export type ConnectorCheck =
+  | { id: string; name: string; ok: true; verified: VerifiedRecord }
+  | { id: string; name: string; ok: false; reason: string };
+
+export interface DeletedConnector {
+  id: string;
+  name: string;
+}
+
+const UNVERIFIED = { at: '', server: '' };
+
+function connectorFromRow(row: LocalConnectorRow): Connector {
+  const auth = row.config.auth;
+  return {
+    id: row.id,
+    name: row.name,
+    url: row.url,
+    auth: auth.kind,
+    header: auth.kind === 'header' ? auth.name : null,
+    signIn: signInState(row.config),
+    verified: row.config.verified,
+    client: row.config.client,
+    policy: row.config.policy ?? {},
+  };
+}
+
+const FILE = 'connectors.json';
+const filePath = (dir: string): string => join(dir, FILE);
+
+const isRow = (v: unknown): v is { id: string; name: string; url: string; config?: unknown } =>
+  typeof v === 'object' &&
+  v !== null &&
+  typeof (v as { id?: unknown }).id === 'string' &&
+  typeof (v as { name?: unknown }).name === 'string' &&
+  typeof (v as { url?: unknown }).url === 'string';
+
+const asList = (value: unknown): unknown[] =>
+  Array.isArray(value) ? value.map((item: unknown) => item) : [];
+
+export function readLocalConnectors(dir = agentsDir()): LocalConnectorRow[] {
+  const raw = readJson<{ connectors?: unknown }>(filePath(dir), {}, {
+    warn: 'connectors.json: malformed, ignoring',
+  });
+  return asList(raw.connectors).filter(isRow).map((r) => ({
+    id: r.id,
+    name: r.name,
+    url: r.url,
+    config: readConfig(r.config),
+  }));
+}
+
+function writeRows(dir: string, rows: LocalConnectorRow[]): void {
+  persistentServerKeys(readLocalConnectors(dir), dir);
+  persistentServerKeys(rows, dir);
+  writeSecure(filePath(dir), `${JSON.stringify({ version: 1, connectors: rows }, null, 2)}\n`);
+  if (dir !== agentsDir()) return;
+  publishLocalConnectors(rows);
+}
+
+const missing = (): ConnectorError => new ConnectorError('no such connector', 404);
+
+function rowOrThrow(id: string, dir: string): LocalConnectorRow {
+  const row = readLocalConnectors(dir).find((r) => r.id === id);
+  if (row === undefined) throw missing();
+  return row;
+}
+
+function replace(dir: string, row: LocalConnectorRow, refresh = false): Connector {
+  if (!refresh) assertLocalMigrationEdit(row.id, dir);
+  writeRows(dir, readLocalConnectors(dir).map((r) => (r.id === row.id ? row : r)));
+  return connectorFromRow(row);
+}
+
+async function oauthCapable(url: URL, auth: ConnectorAuth, send: FetchLike): Promise<boolean> {
+  if (auth.kind === 'oauth') return true;
+  if (auth.kind === 'header') return false;
+  return advertisesOAuth(url, send);
+}
+
+export function localImportConnectors(
+  rows: LoadedConnector[],
+  dir = agentsDir(),
+  mode: 'append' | 'overwrite' = 'overwrite',
+): number {
+  const current = readLocalConnectors(dir);
+  const fresh =
+    mode === 'overwrite'
+      ? rows
+      : rows.filter((row) => !current.some((r) => r.id === row.id));
+  const imported: LocalConnectorRow[] = fresh.map((row) => ({
+    id: row.id,
+    name: row.name,
+    url: row.url,
+    config: readConfig(row.config),
+  }));
+  for (const row of imported) assertLocalMigrationEdit(row.id, dir);
+  const ids = new Set(imported.map((r) => r.id));
+  if (ids.size !== imported.length) throw new ConnectorError('The import contains duplicate connector IDs.', 400);
+  writeRows(dir, [...current.filter((r) => !ids.has(r.id)), ...imported]);
+  return imported.length;
+}
+
+export async function localListConnectors(dir = agentsDir()): Promise<Connector[]> {
+  return Promise.resolve(readLocalConnectors(dir).map(connectorFromRow));
+}
+
+export async function localGetConnector(id: string, dir = agentsDir()): Promise<Connector> {
+  return Promise.resolve(connectorFromRow(rowOrThrow(id, dir)));
+}
+
+function insert(dir: string, name: string, url: URL, config: ConnectorConfig): Connector {
+  const row: LocalConnectorRow = { id: newId(), name, url: connectorUrlText(url), config };
+  writeRows(dir, [...readLocalConnectors(dir), row]);
+  return connectorFromRow(row);
+}
+
+export async function localCreateConnector(input: ConnectorInput, dir = agentsDir()): Promise<Connector> {
+  const name = connectorName(input.name);
+  const url = parseConnectorUrl(input.url);
+  const auth = connectorAuth(input.header, input.value);
+  const client = connectorClient(input.clientId, input.clientSecret);
+  return withLocalMigrationOperation('', dir, async (operation) => {
+    const verified = stamp(await verifyRemoteMcp(url, auth, operation.fetch));
+    return insert(dir, name, url, { auth, createdAt: new Date().toISOString(), verified, oauth: await oauthCapable(url, auth, operation.fetch), client });
+  }, true);
+}
+
+export async function localCreatePendingConnector(input: PendingConnectorInput, dir = agentsDir()): Promise<Connector> {
+  const name = connectorName(input.name);
+  const url = parseConnectorUrl(input.url);
+  const client = connectorClient(input.clientId, input.clientSecret);
+  return Promise.resolve(
+    insert(dir, name, url, { auth: { kind: 'none' }, createdAt: new Date().toISOString(), verified: UNVERIFIED, oauth: true, client }),
+  );
+}
+
+export async function localReconnectConnector(
+  id: string,
+  auth: OAuthAuth,
+  dir = agentsDir(),
+): Promise<Connector> {
+  return withLocalMigrationOperation(id, dir, async (operation) => {
+    const row = rowOrThrow(id, dir);
+    const verified = stamp(await verifyRemoteMcp(parseConnectorUrl(row.url), auth, operation.fetch));
+    return replace(dir, { ...row, config: { ...row.config, auth, verified, oauth: true } });
+  }, true);
+}
+
+const signedOut = (row: LocalConnectorRow): LocalConnectorRow => ({ ...row, config: { ...row.config, auth: { kind: 'none' }, oauth: true } });
+
+export async function localDisconnectConnector(id: string, dir = agentsDir()): Promise<Connector> {
+  const row = rowOrThrow(id, dir);
+  if (row.config.auth.kind !== 'oauth') throw new ConnectorError('that connector is not signed in', 400);
+  return Promise.resolve(replace(dir, signedOut(row)));
+}
+
+export function localMarkSignedOut(id: string, dir = agentsDir()): void {
+  const row = readLocalConnectors(dir).find((r) => r.id === id);
+  if (row?.config.auth.kind !== 'oauth') return;
+  log.info({ id, name: row.name }, 'local relay: the vendor refused the token after a refresh; the connector is signed out');
+  replace(dir, signedOut(row));
+}
+
+async function freshAuth(row: LocalConnectorRow, dir: string): Promise<ConnectorAuth> {
+  const auth = row.config.auth;
+  if (auth.kind !== 'oauth' || !oauthExpired(auth)) return auth;
+  return refreshOnce(row, auth, dir);
+}
+
+function updateRow(dir: string, id: string, config: Partial<LocalConnectorRow['config']>, refresh = false): void {
+  if (!refresh && migrationSource(id, dir) !== null) return;
+  const now = readLocalConnectors(dir).find((r) => r.id === id);
+  if (now !== undefined) replace(dir, { ...now, config: { ...now.config, ...config } }, refresh);
+}
+
+export async function localVerifyConnector(id: string, dir = agentsDir()): Promise<ConnectorCheck> {
+  return withLocalMigrationOperation(id, dir, async (operation) => {
+    const row = rowOrThrow(id, dir);
+    try {
+      const url = parseConnectorUrl(row.url);
+      const auth = await freshAuth(row, dir);
+      const verified = stamp(await verifyRemoteMcp(url, auth, operation.fetch));
+      const oauth = row.config.oauth || (await oauthCapable(url, auth, operation.fetch));
+      updateRow(dir, row.id, { auth, verified, oauth });
+      return { id: row.id, name: row.name, ok: true, verified };
+    } catch (err) {
+      if (!(err instanceof ConnectorVerifyError)) throw err;
+      return { id: row.id, name: row.name, ok: false, reason: err.message };
+    }
+  });
+}
+
+const groupsOf = (tools: RemoteTool[]): Record<string, ToolGroup> =>
+  Object.fromEntries(tools.map((tool) => [tool.name, tool.readOnly ? 'read' : 'write'] as const));
+
+function keepGroups(dir: string, id: string, tools: RemoteTool[]): void {
+  if (migrationSource(id, dir) !== null) return;
+  const now = readLocalConnectors(dir).find((r) => r.id === id);
+  const groups = groupsOf(tools);
+  if (now === undefined || JSON.stringify(now.config.toolGroups ?? {}) === JSON.stringify(groups)) return;
+  const config = { ...now.config };
+  delete config.toolGroups;
+  replace(dir, { ...now, config: Object.keys(groups).length > 0 ? { ...config, toolGroups: groups } : config });
+}
+
+export async function localConnectorTools(id: string, dir = agentsDir()): Promise<RemoteTool[]> {
+  return withLocalMigrationOperation(id, dir, async (operation) => {
+    const row = rowOrThrow(id, dir);
+    const tools = await listRemoteTools(parseConnectorUrl(row.url), await freshAuth(row, dir), operation.fetch);
+    keepGroups(dir, id, tools);
+    return tools;
+  });
+}
+
+async function refreshGroups(id: string, dir: string): Promise<void> {
+  try {
+    await localConnectorTools(id, dir);
+  } catch (err) {
+    log.warn({ id, err: errMsg(err) }, 'connector policy: could not list the tools; the last known read and write groups stay');
+  }
+}
+
+export async function localSetConnectorPolicy(id: string, policy: ToolPolicy, dir = agentsDir()): Promise<Connector> {
+  const row = rowOrThrow(id, dir);
+  const config = { ...row.config };
+  delete config.policy;
+  const saved = replace(dir, { ...row, config: Object.keys(policy).length > 0 ? { ...config, policy } : config });
+  await refreshGroups(id, dir);
+  return saved;
+}
+
+export async function loadConnectorPolicies(dir = agentsDir()): Promise<void> {
+  const rows = readLocalConnectors(dir);
+  publishLocalConnectors(rows);
+  for (const row of rows) if (row.config.policy !== undefined && localMigrationEnabled(row.id, dir)) await refreshGroups(row.id, dir);
+}
+
+export async function localRenameConnector(id: string, raw: string, dir = agentsDir()): Promise<Connector> {
+  const name = connectorName(raw);
+  const row = rowOrThrow(id, dir);
+  return Promise.resolve(replace(dir, { ...row, name }));
+}
+
+export async function localDeleteConnector(id: string, dir = agentsDir()): Promise<DeletedConnector> {
+  const row = rowOrThrow(id, dir);
+  assertLocalMigrationEdit(id, dir);
+  writeRows(dir, readLocalConnectors(dir).filter((r) => r.id !== id));
+  return Promise.resolve({ id: row.id, name: row.name });
+}
+
+const inflight = new Map<string, Promise<OAuthAuth>>();
+
+function refreshOnce(row: LocalConnectorRow, auth: OAuthAuth, dir: string): Promise<OAuthAuth> {
+  const key = JSON.stringify([dir, row.id]);
+  const running = inflight.get(key);
+  if (running !== undefined) return running;
+  const job = withLocalMigrationOperation(row.id, dir, async (operation) => {
+    const fresh = await refreshOAuth(auth, parseConnectorUrl(row.url).toString(), (input, init) => operation.dispatch(() => fetch(input, init), { refresh: true }));
+    updateRow(dir, row.id, { auth: fresh }, true);
+    flushMigrationSource(dir);
+    operation.persistedRefresh();
+    return fresh;
+  }).finally(() => { inflight.delete(key); });
+  inflight.set(key, job);
+  return job;
+}
+
+function staleUsable(auth: OAuthAuth, now = Date.now()): boolean {
+  return auth.expiresAt === undefined || auth.expiresAt > now;
+}
+
+function unrefreshedTarget(
+  url: string,
+  auth: OAuthAuth,
+  force: boolean,
+  now = Date.now(),
+): RelayTarget {
+  if (force) return { kind: 'signin' };
+  return { kind: 'ok', url, headers: staleUsable(auth, now) ? authHeaders(auth) : {} };
+}
+
+function fixedTarget(
+  url: string,
+  auth: Exclude<ConnectorAuth, OAuthAuth>,
+  force: boolean,
+): RelayTarget {
+  if (force) return { kind: 'signin' };
+  return { kind: 'ok', url, headers: authHeaders(auth) };
+}
+
+async function oauthTarget(row: LocalConnectorRow, auth: OAuthAuth, force: boolean, dir: string): Promise<RelayTarget> {
+  if (!force && !oauthExpired(auth)) return { kind: 'ok', url: row.url, headers: authHeaders(auth) };
+  try {
+    const fresh = await refreshOnce(row, auth, dir);
+    return { kind: 'ok', url: row.url, headers: authHeaders(fresh) };
+  } catch (err) {
+    log.warn({ id: row.id, err: errMsg(err) }, 'local relay: token refresh failed');
+    return unrefreshedTarget(row.url, auth, force);
+  }
+}
+
+export async function localRelayTarget(connectorId: string, force: boolean, dir = agentsDir()): Promise<RelayTarget> {
+  return withLocalMigrationOperation(connectorId, dir, async (operation) => {
+    const row = readLocalConnectors(dir).find((r) => r.id === connectorId);
+    if (row === undefined) return { kind: 'missing' };
+    parseConnectorUrl(row.url);
+    const auth = row.config.auth;
+    const target = auth.kind === 'oauth' ? await oauthTarget(row, auth, force, dir) : fixedTarget(row.url, auth, force);
+    operation.check();
+    return target;
+  });
+}
+
+export function localRollbackMigrationSource(id: string, signOutOAuth: boolean, dir = agentsDir(), discardUncertain = false): void {
+  if (!['rollback', 'recovering'].includes(migrationSource(id, dir)?.phase ?? '') || !localMigrationIdle(id, dir, discardUncertain && signOutOAuth)) throw new ConnectorError('The connector migration is not ready to roll back.', 409);
+  const row = rowOrThrow(id, dir);
+  if (signOutOAuth) replace(dir, signedOut(row), true);
+  if (signOutOAuth) flushMigrationSource(dir);
+}
+
+export function flushMigrationSource(dir = agentsDir()): void {
+  for (const path of [filePath(dir), dir]) {
+    const fd = openSync(path, 'r');
+    try { fsyncSync(fd); } finally { closeSync(fd); }
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/tools.ts

@@ -0,0 +1 @@
+export { listRemoteTools, type RemoteTool } from '@metro-labs/http/connector-tools';

package/runtime/node_modules/@metro-labs/daemon/src/connectors/transfer-api.ts

@@ -0,0 +1,116 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { randomUUID, type KeyObject } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { parseId } from '@metro-labs/core/ids';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { apiSession, cors, readJsonBody, requireAdmin, sendJson } from '@metro-labs/http/api-http';
+import { openTransfer, sealTransfer, transferKeys } from './transfer-crypto.js';
+import type { LocalConnectorRow } from './store.js';
+import type { ConnectorCopyResult } from './transfer-store.js';
+
+const PREFIX = '/api/connectors/transfer';
+const MAX_BODY = 4 * 1024 * 1024 + 4096;
+const TTL = 5 * 60_000;
+
+export interface ConnectorTransferDeps {
+  read: () => LocalConnectorRow[];
+  copy: (value: unknown) => ConnectorCopyResult[];
+  now?: () => number;
+}
+
+interface Ticket {
+  privateKey: KeyObject;
+  organization: string;
+  expiresAt: number;
+}
+
+function selectedIds(raw: unknown): string[] | null {
+  if (raw === null) return null;
+  if (!Array.isArray(raw) || raw.length === 0 || raw.length > 500) throw new ApiError('choose connectors to copy', 400);
+  return [...new Set(raw.map((id: unknown) => {
+    if (typeof id !== 'string' || parseId(id) === null) throw new ApiError('choose connectors to copy', 400);
+    return id;
+  }))];
+}
+
+export class ConnectorTransfers {
+  private readonly tickets = new Map<string, Ticket>();
+
+  constructor(private readonly deps: ConnectorTransferDeps) {}
+
+  private prepare(organization: string): unknown {
+    const now = (this.deps.now ?? Date.now)();
+    for (const [id, ticket] of this.tickets) if (ticket.expiresAt <= now) this.tickets.delete(id);
+    if (this.tickets.size >= 64) throw new ApiError('too many pending connector copies, try again later', 429);
+    const { publicKey, privateKey } = transferKeys();
+    const ticket = randomUUID();
+    this.tickets.set(ticket, { privateKey, organization, expiresAt: now + TTL });
+    return { ticket, publicKey };
+  }
+
+  private export(body: Record<string, unknown>): unknown {
+    if (typeof body.publicKey !== 'string') throw new ApiError('invalid transfer key', 400);
+    const ids = selectedIds(body.ids);
+    const all = this.deps.read();
+    const rows = ids === null ? all : all.filter((row) => ids.includes(row.id));
+    const expected = ids?.length ?? rows.length;
+    if (rows.length !== expected) throw new ApiError('a selected connector no longer exists', 409);
+    if (rows.length > 500) throw new ApiError('copy at most 500 connectors at once', 413);
+    try {
+      return sealTransfer({ version: 1, connectors: rows }, body.publicKey);
+    } catch (err) {
+      if (err instanceof ApiError) throw err;
+      throw new ApiError('invalid transfer key', 400);
+    }
+  }
+
+  private receive(body: Record<string, unknown>, organization: string): unknown {
+    const id = typeof body.ticket === 'string' ? body.ticket : '';
+    const ticket = this.tickets.get(id);
+    if (ticket?.organization !== organization || ticket.expiresAt <= (this.deps.now ?? Date.now)()) {
+      this.tickets.delete(id);
+      throw new ApiError('this connector copy has expired, start again', 410);
+    }
+    let value: unknown;
+    try {
+      value = openTransfer(body.envelope, ticket.privateKey);
+    } catch {
+      throw new ApiError('invalid encrypted connector copy', 400);
+    }
+    const results = this.deps.copy(value);
+    this.tickets.delete(id);
+    return { results };
+  }
+
+  private async answer(req: IncomingMessage, path: string): Promise<unknown> {
+    const session = await apiSession(req);
+    if (session === null) throw new ApiError('unauthorized', 401);
+    requireAdmin(session);
+    const body = await readJsonBody(req, MAX_BODY);
+    if (!isRecord(body) || body.confirmed !== true) throw new ApiError('confirm copying saved logins and settings', 400);
+    if (path === `${PREFIX}/prepare`) return this.prepare(session.subject);
+    if (path === `${PREFIX}/export`) return this.export(body);
+    return this.receive(body, session.subject);
+  }
+
+  handle(req: IncomingMessage, res: ServerResponse): boolean {
+    const path = (req.url ?? '').split('?')[0] ?? '';
+    if (![`${PREFIX}/prepare`, `${PREFIX}/export`, `${PREFIX}/receive`].includes(path)) return false;
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, cors(req)).end();
+      return true;
+    }
+    if (req.method !== 'POST') {
+      sendJson(req, res, 405, { error: 'method not allowed' });
+      return true;
+    }
+    this.answer(req, path).then((body) => {
+      sendJson(req, res, 200, body);
+    }).catch((err: unknown) => {
+      if (!(err instanceof ApiError)) log.warn('connector-transfer: request failed');
+      sendJson(req, res, err instanceof ApiError ? err.status : 500, { error: err instanceof ApiError ? err.message : 'connector copy failed' });
+    });
+    return true;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/transfer-crypto.ts

@@ -0,0 +1,44 @@
+import { createCipheriv, createDecipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, type KeyObject } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { ApiError } from '@metro-labs/http/api-error';
+
+export interface TransferEnvelope {
+  key: string;
+  iv: string;
+  tag: string;
+  data: string;
+}
+
+export const transferKeys = (): { publicKey: string; privateKey: KeyObject } => {
+  const pair = generateKeyPairSync('x25519');
+  return { publicKey: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString(), privateKey: pair.privateKey };
+};
+
+function sharedKey(privateKey: KeyObject, pem: string): ArrayBuffer {
+  if (pem.length > 1024) throw new ApiError('invalid transfer key', 400);
+  const publicKey = createPublicKey(pem);
+  if (publicKey.asymmetricKeyType !== 'x25519') throw new ApiError('invalid transfer key', 400);
+  return hkdfSync('sha256', diffieHellman({ privateKey, publicKey }), '', 'metro-connector-copy-v1', 32);
+}
+
+export function sealTransfer(value: unknown, publicKey: string): TransferEnvelope {
+  const pair = transferKeys();
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', Buffer.from(sharedKey(pair.privateKey, publicKey)), iv);
+  const plain = JSON.stringify(value);
+  if (Buffer.byteLength(plain) > 3 * 1024 * 1024) throw new ApiError('too many connector settings for one copy', 413);
+  const data = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+  return { key: pair.publicKey, iv: iv.toString('base64'), tag: cipher.getAuthTag().toString('base64'), data: data.toString('base64') };
+}
+
+export function openTransfer(raw: unknown, privateKey: KeyObject): unknown {
+  if (!isRecord(raw) || typeof raw.key !== 'string' || typeof raw.iv !== 'string' || typeof raw.tag !== 'string' || typeof raw.data !== 'string')
+    throw new ApiError('invalid encrypted transfer', 400);
+  const iv = Buffer.from(raw.iv, 'base64');
+  const tag = Buffer.from(raw.tag, 'base64');
+  if (iv.length !== 12 || tag.length !== 16) throw new ApiError('invalid encrypted transfer', 400);
+  const decipher = createDecipheriv('aes-256-gcm', Buffer.from(sharedKey(privateKey, raw.key)), iv);
+  decipher.setAuthTag(tag);
+  const plain = Buffer.concat([decipher.update(Buffer.from(raw.data, 'base64')), decipher.final()]);
+  return JSON.parse(plain.toString('utf8')) as unknown;
+}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/transfer-store.ts

@@ -0,0 +1,46 @@
+import { isDeepStrictEqual } from 'node:util';
+import { isRecord } from '@metro-labs/core/is-record';
+import { newId, parseId } from '@metro-labs/core/ids';
+import { ApiError } from '@metro-labs/http/api-error';
+import { connectorAuth, connectorName } from '@metro-labs/http/connector-input';
+import { readConfig } from './config.js';
+import { parseConnectorUrl } from '@metro-labs/http/connector-url';
+import { normalizePolicy } from '../policy/policy.js';
+import { localImportConnectors, type LocalConnectorRow } from './store.js';
+
+export interface ConnectorCopyResult {
+  sourceId: string | null;
+  id?: string;
+  status: 'copied' | 'skipped' | 'invalid';
+}
+
+function copyRow(raw: unknown): LocalConnectorRow {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || parseId(raw.id) === null || !isRecord(raw.config)) throw new ApiError('invalid connector', 400);
+  const name = connectorName(raw.name);
+  const url = parseConnectorUrl(raw.url).toString();
+  if (raw.config.policy !== undefined) normalizePolicy(raw.config.policy);
+  const config = readConfig(raw.config);
+  if (!isDeepStrictEqual(config, raw.config)) throw new ApiError('invalid connector settings', 400);
+  if (config.auth.kind === 'header') connectorAuth(config.auth.name, config.auth.value);
+  return { id: raw.id, name, url, config };
+}
+
+export function copyConnectorRows(value: unknown, dir?: string): ConnectorCopyResult[] {
+  if (!isRecord(value) || value.version !== 1 || !Array.isArray(value.connectors) || value.connectors.length > 500)
+    throw new ApiError('invalid connector transfer', 400);
+  const imported: LocalConnectorRow[] = [];
+  const results: ConnectorCopyResult[] = value.connectors.map((raw: unknown) => {
+    const sourceId = isRecord(raw) && typeof raw.id === 'string' ? parseId(raw.id) : null;
+    let row: LocalConnectorRow;
+    try {
+      row = copyRow(raw);
+    } catch {
+      return { sourceId, status: 'invalid' };
+    }
+    const id = newId();
+    imported.push({ ...row, id });
+    return { sourceId, id, status: 'copied' };
+  });
+  if (imported.length > 0) localImportConnectors(imported.map((row) => ({ ...row, config: { ...row.config } })), dir, 'append');
+  return results;
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-grant.ts

@@ -1,8 +1,8 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { ID_RE } from '../db/ids.js';
+import { ID_RE } from '@metro-labs/core/ids';
 import { readFileSync } from 'node:fs';
-import { resolveCachedAttachment } from '../stations/attachments.js';
-import { writeSecure } from './secure-fs.js';
+import { resolveCachedAttachment } from '@metro-labs/core/stations/attachments';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 
 const GRANT_SUFFIX = '.grant';
 
@@ -34,7 +34,7 @@ function parseGrant(raw: string): AttachmentGrant | undefined {
   };
 }
 
-export function readGrant(path: string): AttachmentGrant | undefined {
+function readGrant(path: string): AttachmentGrant | undefined {
   try {
     return parseGrant(readFileSync(`${path}${GRANT_SUFFIX}`, 'utf8'));
   } catch {

package/runtime/node_modules/@metro-labs/{mcp/src/daemon → daemon/src/files}/attach-owner.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
-import { ID_RE } from '../db/ids.js';
-import { resolveCachedAttachment } from '../stations/attachments.js';
-import { writeSecure } from './secure-fs.js';
+import { ID_RE } from '@metro-labs/core/ids';
+import { resolveCachedAttachment } from '@metro-labs/core/stations/attachments';
+import { writeSecure } from '@metro-labs/core/secure-fs';
 
 const OWNER_SUFFIX = '.owner';