@stage-labs/metro 0.1.0-beta.304 → 0.1.0-beta.305

package/runtime/node_modules/@metro-labs/daemon/src/policy/policy.ts

@@ -13,9 +13,11 @@ export interface ToolPolicy {
   tools?: Record<string, Access>;
 }
 
-export type PolicyTarget =
-  | { kind: 'channel'; station: string; account: string }
-  | { kind: 'connector'; id: string };
+export interface PolicyTarget {
+  kind: 'channel';
+  station: string;
+  account: string;
+}
 
 export interface PolicyTool {
   name: string;
@@ -28,8 +30,7 @@ const RANK: Record<Access, number> = { allow: 0, ask: 1, deny: 2 };
 
 const isAccess = (value: unknown): value is Access => typeof value === 'string' && (ACCESS as readonly string[]).includes(value);
 
-export const targetKey = (target: PolicyTarget): string =>
-  target.kind === 'channel' ? `channel:${target.station}/${target.account}` : `connector:${target.id}`;
+export const targetKey = (target: PolicyTarget): string => `channel:${target.station}/${target.account}`;
 
 export function decide(policy: ToolPolicy | undefined, tool: PolicyTool): Access {
   const byTool = policy?.tools !== undefined && Object.hasOwn(policy.tools, tool.name) ? policy.tools[tool.name] : undefined;

package/runtime/node_modules/@metro-labs/daemon/src/routes/http.ts

@@ -1,6 +1,5 @@
 import { handleSessionApis, type SessionApis } from './session-apis.js';
 import { handleGatewayRequest } from '../gateway/gateway.js';
-import { handleRelayRequest } from '../connectors/relay.js';
 import { handleThreemaCallback } from './threema-callback.js';
 import { BodyTooLargeError, readBody, WEBHOOK_BODY_MAX } from './body.js';
 
@@ -346,7 +345,6 @@ async function handlePreMcpRoutes(
   if (handleEarlyRoutes(req, res, apis)) return true;
   if (handleUploadRequest(req, res)) return true;
   if (handleAttachRequest(req, res)) return true;
-  if (apis.relayApi && handleRelayRequest(req, res, apis.relayApi)) return true;
   if (await handleWebhookRoute(req, res, emit)) return true;
   if (await handleThreemaCallback(req, res)) return true;
   return monitor && handleMonitorRequest(req, res);

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -6,16 +6,12 @@ import { assertAttachOwner, finishGmailUpgrade, startGmailAttach } from './gmail
 import { detachWithGmailRevocation } from './gmail-detach.js';
 import { recentSenders } from '../agents/senders.js';
 import { forwardTrainCall } from '../stations/train-call.js';
-import { invalidateOrgConnectorSync, orgConnectorRelaySession, orgConnectorSyncStatus, setOrgConnectorSync } from '../connectors/org-sync-watch.js';
 import type { AgentApiDeps } from '../agents/api.js';
 import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
 import type { SessionApis } from './session-apis.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
 import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from '../agents/bundle.js';
 import { METRO_VERSION } from '@metro-labs/core/version';
-import { authenticate } from '../mcp/request-identity.js';
-import type { RelayApiDeps } from '../connectors/relay.js';
-import { connectorGates } from '../connectors/gates.js';
 import {
   setLocalOwner,
   localAttachAccount,
@@ -78,7 +74,6 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
     ...(deps.toolGroups === undefined ? {} : { toolGroups: deps.toolGroups }),
     attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
     features: ['gmail-managed'],
-    connectorIds: connectorIdsOfLocalAgents,
     prepareAccount: deps.prepareAccount,
     attachAccount: localAttachAccount,
     detachAccount: detachWithGmailRevocation,
@@ -93,20 +88,6 @@ function agentApi(deps: LocalModeDeps): AgentApiDeps {
   };
 }
 
-function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
-  const all = connectorGates().map((gate) => gate.id);
-  return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
-}
-
-const relayApi: RelayApiDeps = {
-  open: orgConnectorRelaySession,
-  identify: (req) => {
-    const who = authenticate(req);
-    return who?.kind === 'agent' ? { subject: 'agent-key', agentId: who.agentId } : null;
-  },
-};
-
-
 function bundleApi(deps: LocalModeDeps): BundleApiDeps {
   return {
     bundle: (agentId) => {
@@ -155,17 +136,11 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
   return {
     agentApi: agentApi(deps),
     bundleApi: bundleApi(deps),
-    connectorSyncApi: { status: orgConnectorSyncStatus, set: setOrgConnectorSync },
-    enrollApi: { owner: () => localOwner(), invalidate: invalidateOrgConnectorSync },
-    relayApi,
+    enrollApi: { owner: () => localOwner() },
     claudeApi: { liveEvents: deps.liveEvents },
     updateApi: { restart: deps.restart },
     controlApi: { restart: deps.restart, stop: deps.stop },
-    ownerApi: { setOwner: (owner) => {
-      const saved = setLocalOwner(owner);
-      invalidateOrgConnectorSync();
-      return saved;
-    } },
+    ownerApi: { setOwner: setLocalOwner },
     machineApi: {},
     modelApi: { switchModel: deps.switchModel, owner: localOwner },
     gateway: { config: readModelConfig },

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -2,8 +2,6 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { handleSessionApiRequest } from './session.js';
 import { handleApprovalsRequest } from '../approvals/api.js';
 import { handleAgentApiRequest, type AgentApiDeps } from '../agents/api.js';
-import type { RelayApiDeps } from '../connectors/relay.js';
-import { handleConnectorSyncRequest, type ConnectorSyncApiDeps } from '../connectors/org-sync-api.js';
 import { handleEnrollRequest, type EnrollApiDeps } from '../connectors/enroll-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
 import type { ModeInfo } from '@metro-labs/http/mode-api';
@@ -33,8 +31,6 @@ export interface SessionApis {
   terminalApi?: TerminalApiDeps;
   claudeApi?: ClaudeApiDeps;
   enrollApi?: EnrollApiDeps;
-  connectorSyncApi?: ConnectorSyncApiDeps;
-  relayApi?: RelayApiDeps;
   mode?: () => ModeInfo;
 }
 
@@ -51,7 +47,6 @@ export function handleSessionApis(
     () => handleRunEventsRequest(req, res),
     () => handleApprovalsRequest(req, res),
     ...when(apis.enrollApi, (d) => handleEnrollRequest(req, res, d)),
-    ...when(apis.connectorSyncApi, (d) => handleConnectorSyncRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/http/package.json

@@ -22,8 +22,7 @@
     "./connector-discovery": "./src/connector-discovery.ts",
     "./connector-oauth": "./src/connector-oauth.ts",
     "./connector-input": "./src/connector-input.ts",
-    "./connector-delivery": "./src/connector-delivery.ts",
-    "./connector-migration": "./src/connector-migration.ts",
+    "./connector-policy": "./src/connector-policy.ts",
     "./connector-grant": "./src/connector-grant.ts",
     "./mcp-server-protocol": "./src/mcp-server-protocol.ts"
   },

package/runtime/node_modules/@metro-labs/http/src/connector-grant.ts

@@ -1,59 +1,8 @@
-import { deliveryRecord } from './connector-delivery-validation.js';
-import type { OAuthAuth } from './connector-mcp.js';
 import { boundOAuthResource, parsePublicConnectorUrl } from './connector-public-url.js';
 
-export interface PortableGrant extends OAuthAuth {
-  resource: string;
-  tokenEndpointAuthMethod: 'none' | 'client_secret_post';
-}
-
-const invalid = (): never => { throw new Error('This OAuth grant cannot be transferred. Its client authentication or provider binding is unsupported. Sign in separately.'); };
-
-function text(raw: unknown, max = 16384): string {
-  if (typeof raw !== 'string' || raw.length === 0 || raw.length > max || /[^\x21-\x7e]/.test(raw)) return invalid();
-  return raw;
-}
-
-function endpoint(raw: unknown): string {
-  const value = text(raw, 2048);
-  parsePublicConnectorUrl(value);
-  return value;
-}
-
 export function grantResource(target: string, raw: unknown): string {
   const transport = parsePublicConnectorUrl(target);
   const resource = parsePublicConnectorUrl(raw);
   if (resource.toString() === transport.toString() && typeof raw === 'string') return raw;
   return boundOAuthResource(target, raw);
 }
-
-function binding(value: Record<string, unknown>): Pick<PortableGrant, 'clientId' | 'clientSecret' | 'tokenEndpointAuthMethod'> {
-  const clientSecret = value.clientSecret === undefined ? undefined : text(value.clientSecret);
-  const method = value.tokenEndpointAuthMethod ?? (clientSecret === undefined ? 'none' : 'client_secret_post');
-  if (method !== 'none' && method !== 'client_secret_post') return invalid();
-  if ((method === 'client_secret_post') !== (clientSecret !== undefined)) return invalid();
-  return { clientId: text(value.clientId), tokenEndpointAuthMethod: method, ...(clientSecret === undefined ? {} : { clientSecret }) };
-}
-
-function expiry(raw: unknown): Pick<PortableGrant, 'expiresAt'> {
-  if (raw === undefined) return {};
-  if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < 0) return invalid();
-  return { expiresAt: raw };
-}
-
-function scopeOf(raw: unknown): Pick<PortableGrant, 'scope'> {
-  if (raw === undefined) return {};
-  if (typeof raw !== 'string' || raw.length > 16384 || /[^\x20-\x7e]/.test(raw)) return invalid();
-  return { scope: raw };
-}
-
-export function portableGrant(raw: unknown, target: string): PortableGrant {
-  const value = deliveryRecord(raw, ['kind', 'accessToken', 'refreshToken', 'expiresAt', 'clientId', 'clientSecret', 'issuer', 'tokenEndpoint', 'scope', 'resource', 'tokenEndpointAuthMethod']);
-  if (value.kind !== 'oauth') return invalid();
-  return {
-    kind: 'oauth', accessToken: text(value.accessToken, 16377), issuer: endpoint(value.issuer), tokenEndpoint: endpoint(value.tokenEndpoint),
-    resource: grantResource(target, value.resource ?? parsePublicConnectorUrl(target).toString()),
-    ...binding(value), ...expiry(value.expiresAt), ...scopeOf(value.scope),
-    ...(value.refreshToken === undefined ? {} : { refreshToken: text(value.refreshToken) }),
-  };
-}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.304"
+  "version": "0.1.0-beta.305"
 }

package/runtime/sdk-runner/node_modules/@metro-labs/core/package.json

@@ -6,7 +6,6 @@
   "type": "module",
   "exports": {
     "./log": "./src/log.ts",
-    "./connector-sync": "./src/connector-sync.ts",
     "./events": "./src/events.ts",
     "./is-record": "./src/is-record.ts",
     "./runner-activity": "./src/runner-activity.ts",

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.304",
+  "version": "0.1.0-beta.305",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",

package/runtime/node_modules/@metro-labs/core/src/connector-sync.ts

@@ -1,17 +0,0 @@
-export interface ConnectorSyncReceipt {
-  state: 'waiting' | 'received' | 'expired' | 'unavailable';
-  lastReceivedAt: number | null;
-  leaseExpiresAt: number | null;
-  counts: { total: number; ready: number; unavailable: number } | null;
-}
-
-export interface ConnectorSyncStatus extends Omit<ConnectorSyncReceipt, 'state'> {
-  enabled: boolean;
-  source: 'saved' | 'environment' | 'default' | 'invalid' | 'scope_changed';
-  enrolled: boolean;
-  owner: string | null;
-  agentId: string | null;
-  scope: string;
-  liveEnabled: boolean;
-  state: 'off' | 'not_enrolled' | ConnectorSyncReceipt['state'];
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,104 +0,0 @@
-import type { ToolGroup } from '@metro-labs/core/stations/types';
-import { decide, policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
-import { serverKeysOf } from './plugin-sync.js';
-import { NEEDS_APPROVAL, revokeToolPrompts, settlePrompts, takeGrant } from '../approvals/pending.js';
-import type { BlockedReason } from './relay-policy.js';
-
-export interface GateRow {
-  id: string;
-  name: string;
-  config: { policy?: ToolPolicy; toolGroups?: Record<string, ToolGroup> };
-}
-
-export interface ConnectorGate {
-  id: string;
-  name: string;
-  server: string;
-  policy: ToolPolicy;
-  tools: Record<string, ToolGroup>;
-}
-
-let gates: ConnectorGate[] = [];
-
-const normalized = (name: string): string => name.replace(/[^a-zA-Z0-9_-]/g, '_');
-
-function approvalChanged(gate: ConnectorGate, tool: string, next: GateRow | undefined, keys: ReadonlyMap<string, string>): boolean {
-  if (next === undefined || gate.server !== keys.get(gate.id) || JSON.stringify([gate.name, gate.policy]) !== JSON.stringify([next.name, next.config.policy ?? {}])) return true;
-  const before = decide(gate.policy, { name: tool, group: toolGroupOf(gate, tool) });
-  const after = decide(next.config.policy, { name: tool, group: next.config.toolGroups?.[tool] === 'read' ? 'read' : 'write' });
-  return before !== after;
-}
-
-export function registerConnectors(rows: readonly GateRow[], keys: ReadonlyMap<string, string> = serverKeysOf([...rows])): void {
-  const next = rows.map((row) => ({
-    id: row.id,
-    name: row.name,
-    server: keys.get(row.id) ?? '',
-    policy: row.config.policy ?? {},
-    tools: row.config.toolGroups ?? {},
-  }));
-  revokeToolPrompts((tool) => {
-    const before = connectorToolOf(tool);
-    const after = connectorToolOf(tool, next);
-    if (before?.gate.id !== after?.gate.id) return true;
-    return before !== undefined && approvalChanged(before.gate, before.tool, rows.find((row) => row.id === before.gate.id), keys);
-  });
-  gates = next;
-  const entries = rows.flatMap((row): [PolicyTarget, ToolPolicy][] =>
-    row.config.policy === undefined ? [] : [[{ kind: 'connector', id: row.id }, row.config.policy]],
-  );
-  setPolicies('connector', entries);
-}
-
-export const connectorGates = (): readonly ConnectorGate[] => gates;
-
-export const toolGroupOf = (gate: ConnectorGate, tool: string): ToolGroup => (gate.tools[tool] === 'read' ? 'read' : 'write');
-
-const promptFor = (connectorId: string, tool: string) => (asked: string): boolean => {
-  const found = connectorToolOf(asked);
-  return found?.gate.id === connectorId && found.tool === tool;
-};
-
-export function blockedReason(connectorId: string, tool: string, args: Record<string, unknown> = {}): string | null {
-  const gate = gates.find((g) => g.id === connectorId);
-  if (gate === undefined) return 'This connector is not available.';
-  settlePrompts(promptFor(connectorId, tool), args);
-  const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
-  if (access === 'deny') return `Blocked by the owner's policy for ${gate.name} (${tool}).`;
-  if (access === 'allow' || takeGrant(promptFor(connectorId, tool), args)) return null;
-  return NEEDS_APPROVAL(gate.name, tool);
-}
-
-export function requestConnectorBlocker(): () => BlockedReason {
-  const permits = new Map<string, number>();
-  return () => {
-    const seen = new Map<string, number>();
-    return (id, tool, args) => {
-      const gate = gates.find((entry) => entry.id === id);
-      if (gate === undefined) return 'This organization connector is not available.';
-      const group = toolGroupOf(gate, tool);
-      const access = policyFor({ kind: 'connector', id }, { name: tool, group });
-      if (access !== 'ask') return blockedReason(id, tool, args);
-      const key = JSON.stringify([id, gate.server, gate.policy, group, tool, args]);
-      const occurrence = seen.get(key) ?? 0;
-      seen.set(key, occurrence + 1);
-      if (occurrence < (permits.get(key) ?? 0)) return null;
-      const reason = blockedReason(id, tool, args);
-      if (reason === null) permits.set(key, (permits.get(key) ?? 0) + 1);
-      return reason;
-    };
-  };
-}
-
-function resolvedTool(gate: ConnectorGate, called: string): { gate: ConnectorGate; tool: string } {
-  const known = [...Object.keys(gate.tools), ...Object.keys(gate.policy.tools ?? {})];
-  return { gate, tool: known.find((name) => name === called) ?? known.find((name) => normalized(name) === called) ?? called };
-}
-
-export function connectorToolOf(toolName: string, entries: readonly ConnectorGate[] = gates): { gate: ConnectorGate; tool: string } | undefined {
-  if (toolName.startsWith('mcp__metro__')) return undefined;
-  for (const gate of entries)
-    for (const prefix of [`mcp__plugin_metro_${gate.server}__`, `mcp__${gate.server}__`])
-      if (toolName.startsWith(prefix) && toolName.length > prefix.length) return resolvedTool(gate, toolName.slice(prefix.length));
-  return undefined;
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-adopt.ts

@@ -1,57 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
-import { agentsDir } from '../agents/files.js';
-import { isOrgRelayId, orgRelayId } from './relay-id.js';
-import { readServerKeys, writeServerKeys } from './server-keys.js';
-
-interface Alias {
-  sourceId: string;
-  relayId: string;
-}
-
-function recordsOf(dir: string): unknown[] {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(readFileSync(join(dir, 'connector-migrations.json'), 'utf8'));
-  } catch (err) {
-    if (isRecord(err) && err.code === 'ENOENT') return [];
-    log.warn({ err: errMsg(err) }, 'connectors: the old migration records could not be read; server keys left as they are');
-    return [];
-  }
-  if (isRecord(raw) && raw.version === 1 && Array.isArray(raw.records)) return raw.records;
-  log.warn('connectors: the old migration records are not valid; server keys left as they are');
-  return [];
-}
-
-function aliasOf(record: unknown): Alias[] {
-  if (!isRecord(record) || record.phase !== 'active' || typeof record.sourceId !== 'string' || typeof record.destinationId !== 'string') return [];
-  const relayId = orgRelayId(record.destinationId);
-  return isOrgRelayId(relayId) && record.sourceId !== relayId ? [{ sourceId: record.sourceId, relayId }] : [];
-}
-
-export function adoptOrgServerKeys(dir = agentsDir()): number {
-  try {
-    const aliases = recordsOf(dir).flatMap(aliasOf);
-    if (aliases.length === 0) return 0;
-    const keys = readServerKeys(dir);
-    if (keys === undefined) return 0;
-    let moved = 0;
-    for (const { sourceId, relayId } of aliases) {
-      const key = keys.get(sourceId);
-      if (key === undefined || keys.has(relayId)) continue;
-      keys.delete(sourceId);
-      keys.set(relayId, key);
-      moved += 1;
-    }
-    if (moved > 0) {
-      writeServerKeys(keys, dir);
-      log.info({ moved }, 'connectors: server keys moved to organization connector ids, tool names unchanged');
-    }
-    return moved;
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'connectors: the server keys could not be moved to organization connector ids');
-    return 0;
-  }
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-relay.ts

@@ -1,61 +0,0 @@
-import { isRecord } from '@metro-labs/core/is-record';
-import { ApiError } from '@metro-labs/http/api-error';
-import { screenCalls, type Screened } from './relay-policy.js';
-import type { RelaySession } from './relay-session.js';
-import type { RelayTarget } from './relay-target.js';
-
-type Ready = Extract<RelayTarget, { kind: 'ok' }>;
-type Forward = (target: Ready, body: Uint8Array<ArrayBuffer> | null, signal: AbortSignal) => Promise<Response>;
-type OrgExchange =
-  | { kind: 'response'; upstream: Response; answers: Record<string, unknown>[] }
-  | { kind: 'blocked'; screened: Screened };
-
-const METHODS = new Set(['initialize', 'ping', 'tools/list', 'tools/call', 'notifications/initialized', 'notifications/cancelled']);
-
-function requestBatch(body: Uint8Array | null): boolean {
-  if (body === null) return false;
-  let parsed: unknown;
-  try { parsed = JSON.parse(new TextDecoder().decode(body)); }
-  catch { throw new ApiError('Invalid organization connector request.', 400); }
-  const batch = Array.isArray(parsed);
-  const entries: unknown[] = Array.isArray(parsed) ? parsed : [parsed];
-  if (entries.length === 0 || entries.some((item) => !validMessage(item))) throw new ApiError('This organization connector accepts MCP tool requests only.', 400);
-  return batch;
-}
-
-function validMessage(item: unknown): boolean {
-  if (!isRecord(item) || item.jsonrpc !== '2.0' || typeof item.method !== 'string' || !METHODS.has(item.method)) return false;
-  if (item.method !== 'tools/call') return true;
-  if (!isRecord(item.params) || typeof item.params.name !== 'string' || item.params.name === '') return false;
-  return item.params.arguments === undefined || isRecord(item.params.arguments);
-}
-
-function ready(session: RelaySession, signal: AbortSignal): Ready {
-  if (signal.aborted) throw new ApiError('This organization connector is no longer available.', 503);
-  const target = session.current();
-  if (target.kind === 'missing') throw new ApiError('No such organization connector.', 404);
-  if (target.kind === 'signin') throw new ApiError('This organization connector needs signing in again.', 424);
-  return target;
-}
-
-export async function exchangeOrg(id: string, session: RelaySession, body: Uint8Array<ArrayBuffer> | null, clientSignal: AbortSignal, forward: Forward): Promise<OrgExchange> {
-  const signal = AbortSignal.any([clientSignal, session.signal]);
-  const batch = requestBatch(body);
-  let pending = body;
-  const answers: Record<string, unknown>[] = [];
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    await session.target(attempt > 0);
-    ready(session, signal);
-    const screened = pending === null ? null : screenCalls(pending, id, session.blocker());
-    if (screened !== null) {
-      answers.push(...screened.answers);
-      pending = screened.forward;
-      if (pending === null) return { kind: 'blocked', screened: { forward: null, answers, batch } };
-    }
-    const target = ready(session, signal);
-    const upstream = await forward(target, pending, signal);
-    if (upstream.status !== 401 && upstream.status !== 403) return { kind: 'response', upstream, answers };
-    await upstream.body?.cancel();
-  }
-  throw new ApiError('The organization connector rejected its credential. Check its sign-in in the organization settings.', 424);
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/org-runtime-discovery.ts

@@ -1,115 +0,0 @@
-import type { FetchLike } from '@metro-labs/core/stations/oauth';
-import type { ToolGroup } from '@metro-labs/core/stations/types';
-import { ApiError } from '@metro-labs/http/api-error';
-import { validConnectorToolName, type DeliveredConnector } from '@metro-labs/http/connector-delivery';
-import { MetroApiRefusal } from './metro-api.js';
-import { listRemoteTools } from './tools.js';
-
-export const orgUnavailable = (): ApiError => new ApiError('This organization connector is not available. Try again.', 503);
-export const orgSignin = (): ApiError => new ApiError('This organization connector needs sign-in again.', 424);
-export const orgMissing = (): ApiError => new ApiError('No such organization connector is assigned to this agent.', 404);
-
-export function orgRuntimeError(error: unknown): ApiError {
-  if (error instanceof MetroApiRefusal) return error.upstreamStatus === 401 || error.upstreamStatus === 403 ? orgSignin() : orgUnavailable();
-  const status = error instanceof ApiError ? error.status : 503;
-  if (status === 401 || status === 403 || status === 424) return orgSignin();
-  if (status === 404) return orgMissing();
-  if (status === 502) return new ApiError('The organization connector could not complete the request.', 502);
-  return orgUnavailable();
-}
-
-interface DiscoveryGuard {
-  fresh: (revision?: string) => Promise<DeliveredConnector>;
-  current: () => DeliveredConnector;
-  signal: AbortSignal;
-  fetch: FetchLike;
-}
-
-const MAX_BYTES = 2 * 1024 * 1024;
-const MAX_TOOLS = 2000;
-
-async function boundedResponse(response: Response, signal: AbortSignal): Promise<Response> {
-  const reader = response.body?.getReader();
-  if (reader === undefined) return response;
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  try {
-    for (let part = await reader.read(); !part.done; part = await reader.read()) {
-      signal.throwIfAborted();
-      size += part.value.length;
-      if (size > MAX_BYTES) throw orgUnavailable();
-      chunks.push(part.value);
-    }
-    return new Response(Buffer.concat(chunks), { status: response.status, headers: response.headers });
-  } finally {
-    await reader.cancel();
-  }
-}
-
-function requestInit(row: DeliveredConnector, init: RequestInit | undefined, scanSignal: AbortSignal): RequestInit & { signal: AbortSignal } {
-  const headers = new Headers(init?.headers);
-  for (const [name, value] of Object.entries(row.headers)) headers.set(name, value);
-  const signals = [scanSignal, AbortSignal.timeout(15_000)];
-  if (init?.signal !== undefined && init.signal !== null) signals.push(init.signal);
-  return { ...init, headers, redirect: 'manual', signal: AbortSignal.any(signals) };
-}
-
-async function discoveryResponse(response: Response, init: RequestInit | undefined, signal: AbortSignal): Promise<Response> {
-  if (response.status >= 300) throw new ApiError('The organization connector refused tool discovery.', 502);
-  if (init?.method === 'DELETE') {
-    await boundedResponse(response, signal);
-    return new Response(null, { status: response.status });
-  }
-  return boundedResponse(response, signal);
-}
-
-async function guardedRequest(input: string, init: RequestInit | undefined, guard: DiscoveryGuard, budget: { refreshed: boolean }): Promise<Response> {
-  let revision: string | undefined;
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    guard.signal.throwIfAborted();
-    await guard.fresh(revision);
-    guard.signal.throwIfAborted();
-    const row = guard.current();
-    if (input !== new URL(row.url).toString()) throw orgUnavailable();
-    const options = requestInit(row, init, guard.signal);
-    const response = await guard.fetch(input, options);
-    try {
-      guard.current();
-      options.signal.throwIfAborted();
-      if (response.status === 401 || response.status === 403) {
-        if (row.auth !== 'oauth' || budget.refreshed) throw orgSignin();
-        budget.refreshed = true;
-        revision = row.revision;
-        continue;
-      }
-      return await discoveryResponse(response, init, options.signal);
-    } finally {
-      if (!response.bodyUsed) await response.body?.cancel();
-    }
-  }
-  throw orgSignin();
-}
-
-export async function discoverOrgGroups(url: string, guard: DiscoveryGuard): Promise<Record<string, ToolGroup>> {
-  try {
-    const failure: { error: ApiError | null } = { error: null };
-    const budget = { refreshed: false };
-    const send: FetchLike = async (input, init) => {
-      try {
-        return await guardedRequest(input, init, guard, budget);
-      } catch (error) {
-        const safe = orgRuntimeError(error);
-        if (init?.method !== 'DELETE' || safe.status !== 502) failure.error = safe;
-        throw safe;
-      }
-    };
-    const tools = await listRemoteTools(new URL(url), { kind: 'none' }, send);
-    if (failure.error !== null) throw failure.error;
-    guard.current();
-    guard.signal.throwIfAborted();
-    if (tools.length > MAX_TOOLS || tools.some((tool) => !validConnectorToolName(tool.name))) throw orgUnavailable();
-    return Object.fromEntries(tools.map((tool) => [tool.name, tool.readOnly ? 'read' : 'write']));
-  } catch (error) {
-    throw orgRuntimeError(error);
-  }
-}