@stage-labs/metro 0.1.0-beta.304 → 0.1.0-beta.306

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay.ts

@@ -1,287 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { RelaySession } from './relay-session.js';
-import { exchangeOrg } from './org-relay.js';
-import { ApiError } from '@metro-labs/http/api-error';
-import { log } from '@metro-labs/core/log';
-import { answerBlocked, mergeBlocked } from './relay-policy.js';
-
-export interface RelayApiDeps {
-  identify: (req: IncomingMessage) => { subject: string; agentId: string } | null;
-  open: (connectorId: string) => RelaySession | Promise<RelaySession>;
-}
-
-const ID_PATH_RE = /^\/relay\/(org-[A-Za-z0-9][A-Za-z0-9_-]{10})$/;
-const METHODS = new Set(['POST', 'GET', 'DELETE']);
-const RELAY_BODY_MAX = 8 * 1024 * 1024;
-const FIRST_BYTE_MS = 120_000;
-const PASS_REQ = [
-  'accept',
-  'content-type',
-  'mcp-session-id',
-  'mcp-protocol-version',
-  'last-event-id',
-] as const;
-const PASS_RES = [
-  'content-type',
-  'mcp-session-id',
-  'mcp-protocol-version',
-  'cache-control',
-] as const;
-
-const keepaliveMs = (): number =>
-  Number(process.env.METRO_RELAY_KEEPALIVE_MS) || 25_000;
-
-const isRelaySse = (contentType: string | undefined): boolean => /^text\/event-stream\s*(?:;|$)/i.test(contentType ?? '');
-
-function answer(
-  res: ServerResponse,
-  status: number,
-  body: Record<string, unknown>,
-): void {
-  if (res.headersSent) return;
-  res.writeHead(status, { 'content-type': 'application/json' });
-  res.end(JSON.stringify(body));
-}
-
-function closeIfBodyUnread(req: IncomingMessage, res: ServerResponse): void {
-  if (req.readableEnded) return;
-  const drop = (): void => {
-    req.socket?.destroy();
-  };
-  if (res.writableFinished) drop();
-  else res.once('finish', drop);
-}
-
-async function readCapped(req: IncomingMessage): Promise<Uint8Array<ArrayBuffer>> {
-  const declared = Number(req.headers['content-length']);
-  if (Number.isFinite(declared) && declared > RELAY_BODY_MAX)
-    throw new ApiError('relay body exceeds 8 MiB', 413);
-  const chunks: Buffer[] = [];
-  let total = 0;
-  for await (const chunk of req) {
-    const buf = chunk as Buffer;
-    total += buf.length;
-    if (total > RELAY_BODY_MAX)
-      throw new ApiError('relay body exceeds 8 MiB', 413);
-    chunks.push(buf);
-  }
-  const merged = Buffer.concat(chunks);
-  const out = new Uint8Array(new ArrayBuffer(merged.byteLength));
-  out.set(merged);
-  return out;
-}
-
-function upstreamHeaders(
-  req: IncomingMessage,
-  injected: Record<string, string>,
-): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const name of PASS_REQ) {
-    const value = req.headers[name];
-    if (typeof value === 'string') out[name] = value;
-  }
-  return { ...out, ...injected };
-}
-
-async function forward(
-  req: IncomingMessage,
-  target: { url: string; headers: Record<string, string> },
-  body: Uint8Array<ArrayBuffer> | null,
-  signal: AbortSignal,
-): Promise<Response> {
-  const firstByte = setTimeout(() => {
-    log.warn('relay: upstream sent no response in time');
-  }, FIRST_BYTE_MS);
-  firstByte.unref?.();
-  try {
-    return await fetch(target.url, {
-      method: req.method,
-      headers: upstreamHeaders(req, target.headers),
-      ...(body === null ? {} : { body }),
-      signal,
-      redirect: 'manual',
-    });
-  } finally {
-    clearTimeout(firstByte);
-  }
-}
-
-interface Keepalive {
-  touch: () => void;
-  stop: () => void;
-}
-
-function startKeepalive(res: ServerResponse): Keepalive {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const arm = (): void => {
-    timer = setTimeout(() => {
-      try {
-        res.write(': keepalive\n\n');
-      } catch {
-        log.debug('relay: keepalive write failed');
-      }
-      arm();
-    }, keepaliveMs());
-    timer.unref?.();
-  };
-  arm();
-  return {
-    touch: (): void => {
-      if (timer) clearTimeout(timer);
-      arm();
-    },
-    stop: (): void => {
-      if (timer) clearTimeout(timer);
-    },
-  };
-}
-
-function drainedOrClosed(res: ServerResponse): Promise<void> {
-  return new Promise((resolve) => {
-    const done = (): void => {
-      res.off('drain', done);
-      res.off('close', done);
-      resolve();
-    };
-    res.once('drain', done);
-    res.once('close', done);
-  });
-}
-
-async function pumpBody(
-  res: ServerResponse,
-  body: ReadableStream<Uint8Array>,
-  touch: () => void,
-): Promise<void> {
-  const reader = body.getReader();
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) return;
-    touch();
-    if (!res.write(value)) await drainedOrClosed(res);
-  }
-}
-
-function passedHeaders(upstream: Response): Record<string, string> {
-  const headers: Record<string, string> = {};
-  for (const name of PASS_RES) {
-    const value = upstream.headers.get(name);
-    if (value !== null) headers[name] = value;
-  }
-  return headers;
-}
-
-async function pipe(res: ServerResponse, upstream: Response, answers: Record<string, unknown>[]): Promise<void> {
-  const headers = passedHeaders(upstream);
-  if (answers.length > 0 && (upstream.status === 200 || upstream.status === 202)) {
-    await mergeBlocked(res, upstream, headers, answers);
-    return;
-  }
-  const sse = isRelaySse(headers['content-type']);
-  if (sse) headers['x-accel-buffering'] = 'no';
-  res.writeHead(upstream.status, headers);
-  if (sse) res.flushHeaders();
-  if (upstream.body === null) {
-    res.end();
-    return;
-  }
-  const keepalive = sse ? startKeepalive(res) : null;
-  try {
-    await pumpBody(res, upstream.body, () => keepalive?.touch());
-  } finally {
-    keepalive?.stop();
-  }
-  res.end();
-}
-
-async function deliver(res: ServerResponse, upstream: Response, answers: Record<string, unknown>[]): Promise<void> {
-  if (upstream.status >= 300 && upstream.status < 400) {
-    await upstream.body?.cancel();
-    answer(res, 502, { error: 'the connector redirected; metro does not follow' });
-    return;
-  }
-  await pipe(res, upstream, answers);
-}
-
-async function relayOnce(
-  req: IncomingMessage,
-  res: ServerResponse,
-  connectorId: string,
-  deps: RelayApiDeps,
-  signal: AbortSignal,
-): Promise<void> {
-  const read = req.method === 'POST' ? await readCapped(req) : null;
-  const session = await deps.open(connectorId);
-  try {
-    const out = await exchangeOrg(connectorId, session, read, signal, (target, body, guard) => forward(req, target, body, guard));
-    if (out.kind === 'blocked') answerBlocked(res, out.screened);
-    else await deliver(res, out.upstream, out.answers);
-  } finally { session.close(); }
-}
-
-async function relayExchange(
-  req: IncomingMessage,
-  res: ServerResponse,
-  connectorId: string,
-  deps: RelayApiDeps,
-): Promise<void> {
-  const control = new AbortController();
-  const bail = (): void => {
-    if (!res.writableEnded) control.abort();
-  };
-  res.once('close', bail);
-  res.socket?.once('close', bail);
-  res.once('finish', () => {
-    res.socket?.removeListener('close', bail);
-  });
-  try {
-    await relayOnce(req, res, connectorId, deps, control.signal);
-  } catch (err) {
-    if (!control.signal.aborted) throw err;
-    log.debug({ connector: connectorId }, 'relay: the client left before the answer ended');
-    if (!res.writableEnded) res.end();
-  }
-}
-
-function dispatch(
-  req: IncomingMessage,
-  res: ServerResponse,
-  connectorId: string,
-  deps: RelayApiDeps,
-): void {
-  const who = deps.identify(req);
-  if (who === null) {
-    answer(res, 401, { error: 'unauthorized' });
-    return;
-  }
-  relayExchange(req, res, connectorId, deps)
-    .catch((err: unknown) => {
-      if (err instanceof ApiError) answer(res, err.status, { error: err.message });
-      else {
-        log.warn({ connector: connectorId }, 'organization relay: request failed');
-        answer(res, 503, { error: 'The organization connector is unavailable. Try again.' });
-      }
-      if (!res.writableEnded) res.end();
-      closeIfBodyUnread(req, res);
-    });
-}
-
-export function handleRelayRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: RelayApiDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  if (path !== '/relay' && !path.startsWith('/relay/')) return false;
-  const match = ID_PATH_RE.exec(path);
-  if (match?.[1] === undefined) {
-    answer(res, 404, { error: 'no such connector' });
-    return true;
-  }
-  if (!METHODS.has(req.method ?? '')) {
-    answer(res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  dispatch(req, res, match[1], deps);
-  return true;
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/server-keys.ts

@@ -1,59 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { isRecord } from '@metro-labs/core/is-record';
-import { writeSecure } from '@metro-labs/core/secure-fs';
-import { agentsDir } from '../agents/files.js';
-import { serverKeysOf, type PluginRow } from './plugin-sync.js';
-
-const invalid = (): Error => new Error('Invalid connector server keys. Restore the saved namespace mapping and initialization marker.');
-
-function readKeys(path: string, marker: string): Map<string, string> | undefined {
-  try {
-    const marked = existsSync(marker);
-    if (marked && readFileSync(marker, 'utf8') !== '1\n') throw invalid();
-    if (!existsSync(path)) {
-      if (marked) throw invalid();
-      return undefined;
-    }
-    if (!marked) throw invalid();
-    return parseKeys(readFileSync(path, 'utf8'));
-  } catch { throw invalid(); }
-}
-
-function parseKeys(text: string): Map<string, string> {
-  const raw: unknown = JSON.parse(text);
-  if (!isRecord(raw) || raw.version !== 1 || !isRecord(raw.keys)) throw invalid();
-  const keys = new Map<string, string>();
-  const reserved = new Set<string>();
-  for (const [id, key] of Object.entries(raw.keys)) {
-    if (typeof key !== 'string' || !/^[a-z0-9-]+$/.test(key) || reserved.has(key)) throw invalid();
-    reserved.add(key);
-    keys.set(id, key);
-  }
-  return keys;
-}
-
-const sameKeys = (a: ReadonlyMap<string, string>, b: ReadonlyMap<string, string>): boolean =>
-  a.size === b.size && [...a].every(([id, key]) => b.get(id) === key);
-
-function serverKeyFiles(dir = agentsDir()): { path: string; marker: string } {
-  return { path: join(dir, 'connector-server-keys.json'), marker: join(dir, 'connector-server-keys.initialized') };
-}
-
-export function readServerKeys(dir = agentsDir()): Map<string, string> | undefined {
-  const { path, marker } = serverKeyFiles(dir);
-  return readKeys(path, marker);
-}
-
-export function writeServerKeys(keys: ReadonlyMap<string, string>, dir = agentsDir()): void {
-  const { path, marker } = serverKeyFiles(dir);
-  if (!existsSync(marker)) writeSecure(marker, '1\n');
-  writeSecure(path, `${JSON.stringify({ version: 1, keys: Object.fromEntries(keys) }, null, 2)}\n`);
-}
-
-export function persistentServerKeys(rows: PluginRow[], dir = agentsDir()): Map<string, string> {
-  const saved = readServerKeys(dir);
-  const keys = serverKeysOf(rows, saved);
-  if (saved === undefined ? keys.size > 0 : !sameKeys(saved, keys)) writeServerKeys(keys, dir);
-  return keys;
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/tools.ts

@@ -1 +0,0 @@
-export { listRemoteTools, type RemoteTool } from '@metro-labs/http/connector-tools';

package/runtime/node_modules/@metro-labs/http/src/connector-delivery-validation.ts

@@ -1,116 +0,0 @@
-import { parseId } from '@metro-labs/core/ids';
-import { isRecord } from '@metro-labs/core/is-record';
-import { connectorName } from './connector-input.js';
-import { connectorPolicyLayersOf, connectorPolicyOf, type ConnectorPolicy, type ConnectorPolicyLayers } from './connector-policy.js';
-import { parsePublicConnectorUrl } from './connector-public-url.js';
-import { isOrganizationId } from './workos-token.js';
-
-export const CONNECTOR_DELIVERY_LEASE_MS = 90_000;
-export const CONNECTOR_DELIVERY_MAX_BYTES = 1024 * 1024;
-export const DELIVERY_PLAINTEXT_MAX = Math.floor((CONNECTOR_DELIVERY_MAX_BYTES - 1024) * 3 / 4);
-
-export interface DeliveryContext {
-  owner: string;
-  agent: string;
-  keyId: string;
-  requestId: string;
-}
-
-export interface DeliveredConnector {
-  id: string;
-  name: string;
-  url: string;
-  auth: 'none' | 'header' | 'oauth';
-  headers: Record<string, string>;
-  policy: ConnectorPolicy;
-  policyLayers?: ConnectorPolicyLayers;
-  revision: string;
-  state: 'ready' | 'signin' | 'unavailable';
-  expiresAt?: number;
-}
-
-export interface DeliverySnapshot {
-  version: 1;
-  issuedAt: number;
-  expiresAt: number;
-  connectors: DeliveredConnector[];
-}
-
-export function deliveryBytes(value: unknown, length?: number): Buffer {
-  if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error('Invalid connector delivery encoding.');
-  const bytes = Buffer.from(value, 'base64url');
-  if (bytes.toString('base64url') !== value || (length !== undefined && bytes.length !== length)) throw new Error('Invalid connector delivery encoding.');
-  return bytes;
-}
-
-export function deliveryRecord(value: unknown, fields: string[]): Record<string, unknown> {
-  if (!isRecord(value) || Object.keys(value).some((key) => !fields.includes(key))) throw new Error('Invalid connector delivery.');
-  return value;
-}
-
-export function deliveryContextBytes(context: DeliveryContext): Buffer {
-  const value = deliveryRecord(context, ['owner', 'agent', 'keyId', 'requestId']);
-  if (typeof value.owner !== 'string' || !isOrganizationId(value.owner) || parseId(value.agent) === null) throw new Error('Invalid connector delivery context.');
-  deliveryBytes(value.keyId, 32);
-  deliveryBytes(value.requestId, 32);
-  return Buffer.from(JSON.stringify(['metro-connector-delivery/v1', value.owner, value.agent, value.keyId, value.requestId]));
-}
-
-const timestamp = (value: unknown): value is number => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
-
-function headerValue(name: string, text: unknown, auth: DeliveredConnector['auth']): string {
-  if (!/^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/.test(name) || ['__proto__', 'constructor', 'prototype'].includes(name) || typeof text !== 'string' || !/^[\x20-\x7e]{1,16384}$/.test(text)) throw new Error('Invalid connector delivery headers.');
-  if (auth === 'oauth' && (name !== 'Authorization' || !/^Bearer [\x21-\x7e]+$/.test(text))) throw new Error('Invalid connector delivery access token.');
-  return text;
-}
-
-function headersOf(value: unknown, auth: DeliveredConnector['auth'], state: DeliveredConnector['state']): Record<string, string> {
-  if (!isRecord(value)) throw new Error('Invalid connector delivery headers.');
-  const entries = Object.entries(value);
-  const expected = auth !== 'none' && state === 'ready' ? 1 : 0;
-  if (entries.length !== expected) throw new Error('Invalid connector delivery headers.');
-  const out: Record<string, string> = {};
-  for (const [name, text] of entries) out[name] = headerValue(name, text, auth);
-  return out;
-}
-
-function authenticationOf(value: unknown): DeliveredConnector['auth'] {
-  if (value !== 'none' && value !== 'header' && value !== 'oauth') throw new Error('Invalid delivered connector authentication.');
-  return value;
-}
-
-function stateOf(value: unknown, auth: DeliveredConnector['auth']): DeliveredConnector['state'] {
-  if (value !== 'ready' && value !== 'signin' && value !== 'unavailable') throw new Error('Invalid delivered connector state.');
-  if (value === 'signin' && auth !== 'oauth') throw new Error('Invalid delivered connector state.');
-  return value;
-}
-
-function urlOf(value: unknown): string {
-  parsePublicConnectorUrl(value);
-  if (typeof value !== 'string') throw new Error('Invalid delivered connector URL.');
-  return value;
-}
-
-function connectorOf(raw: unknown): DeliveredConnector {
-  const value = deliveryRecord(raw, ['id', 'name', 'url', 'auth', 'headers', 'policy', 'policyLayers', 'revision', 'state', 'expiresAt']);
-  const id = parseId(value.id);
-  if (id === null || typeof value.name !== 'string' || connectorName(value.name) !== value.name) throw new Error('Invalid delivered connector.');
-  const url = urlOf(value.url);
-  const auth = authenticationOf(value.auth);
-  const state = stateOf(value.state, auth);
-  deliveryBytes(value.revision, 32);
-  if (Object.hasOwn(value, 'expiresAt') && !timestamp(value.expiresAt)) throw new Error('Invalid delivered connector expiry.');
-  return { id, name: value.name, url, auth, state, revision: String(value.revision), headers: headersOf(value.headers, auth, state), policy: connectorPolicyOf(value.policy), ...(Object.hasOwn(value, 'policyLayers') ? { policyLayers: connectorPolicyLayersOf(value.policyLayers) } : {}), ...(timestamp(value.expiresAt) ? { expiresAt: value.expiresAt } : {}) };
-}
-
-export function deliverySnapshotOf(raw: unknown): DeliverySnapshot {
-  const value = deliveryRecord(raw, ['version', 'issuedAt', 'expiresAt', 'connectors']);
-  if (value.version !== 1 || !timestamp(value.issuedAt) || !timestamp(value.expiresAt) || value.expiresAt <= value.issuedAt || value.expiresAt - value.issuedAt > CONNECTOR_DELIVERY_LEASE_MS || !Array.isArray(value.connectors)) throw new Error('Invalid connector delivery snapshot.');
-  const issuedAt = value.issuedAt;
-  const connectors = value.connectors.map((entry: unknown) => connectorOf(entry));
-  if (new Set(connectors.map((connector) => connector.id)).size !== connectors.length) throw new Error('Duplicate delivered connector.');
-  if (connectors.some((connector) => connector.state === 'ready' && connector.expiresAt !== undefined && connector.expiresAt <= issuedAt)) throw new Error('Expired delivered connector.');
-  const snapshot: DeliverySnapshot = { version: 1, issuedAt: value.issuedAt, expiresAt: value.expiresAt, connectors };
-  if (Buffer.byteLength(JSON.stringify(snapshot)) > DELIVERY_PLAINTEXT_MAX) throw new Error('Connector delivery is too large.');
-  return snapshot;
-}

package/runtime/node_modules/@metro-labs/http/src/connector-delivery.ts

@@ -1,19 +0,0 @@
-import type { KeyObject } from 'node:crypto';
-import { CONNECTOR_DELIVERY_MAX_BYTES, DELIVERY_PLAINTEXT_MAX, deliveryContextBytes, deliverySnapshotOf, type DeliveryContext, type DeliverySnapshot } from './connector-delivery-validation.js';
-import { openTransfer, sealTransfer, type SealedTransfer } from './transfer-crypto.js';
-
-export { CONNECTOR_DELIVERY_LEASE_MS, CONNECTOR_DELIVERY_MAX_BYTES, DELIVERY_PLAINTEXT_MAX, deliverySnapshotOf, type DeliveryContext, type DeliverySnapshot, type DeliveredConnector } from './connector-delivery-validation.js';
-export { combineConnectorPolicies, connectorPolicyOf, effectiveConnectorPolicy, connectorPoliciesBlocked, validConnectorToolName, type ConnectorPolicy, type ConnectorPolicyLayers } from './connector-policy.js';
-export type SealedDelivery = SealedTransfer;
-
-export function sealConnectorDelivery(publicKey: string, context: DeliveryContext, snapshot: DeliverySnapshot): SealedDelivery {
-  const sealed = sealTransfer(publicKey, deliveryContextBytes(context), Buffer.from(JSON.stringify(deliverySnapshotOf(snapshot))));
-  if (Buffer.byteLength(JSON.stringify({ sealed })) > CONNECTOR_DELIVERY_MAX_BYTES) throw new Error('Connector delivery is too large.');
-  return sealed;
-}
-
-export function openConnectorDelivery(privateKey: KeyObject, context: DeliveryContext, envelope: unknown): DeliverySnapshot {
-  if (Buffer.byteLength(JSON.stringify({ sealed: envelope })) > CONNECTOR_DELIVERY_MAX_BYTES) throw new Error('Connector delivery is too large.');
-  const plaintext = openTransfer(privateKey, deliveryContextBytes(context), envelope, DELIVERY_PLAINTEXT_MAX);
-  return deliverySnapshotOf(JSON.parse(plaintext.toString('utf8')) as unknown);
-}

package/runtime/node_modules/@metro-labs/http/src/connector-migration.ts

@@ -1,178 +0,0 @@
-import type { KeyObject } from 'node:crypto';
-import { parseId } from '@metro-labs/core/ids';
-import { sealingKeyOf } from './agent-signature.js';
-import { deliveryBytes, deliveryRecord } from './connector-delivery-validation.js';
-import { connectorAuth, connectorClient, connectorName } from './connector-input.js';
-import type { OAuthClient } from './connector-oauth.js';
-import { portableGrant, type PortableGrant } from './connector-grant.js';
-import { connectorPolicyOf, type ConnectorPolicy } from './connector-policy.js';
-import { boundOAuthResource, parsePublicConnectorUrl } from './connector-public-url.js';
-import { openTransfer, sealTransfer, type SealedTransfer } from './transfer-crypto.js';
-import { isOrganizationId } from './workos-token.js';
-
-export const CONNECTOR_MIGRATION_MAX_BYTES = 96 * 1024;
-const PAYLOAD_MAX = 60 * 1024;
-
-export interface MigrationContext {
-  owner: string;
-  agent: string;
-  keyId: string;
-  operationId: string;
-  sourceId: string;
-  destinationId: string;
-}
-
-export interface MigrationPayload {
-  name: string;
-  url: string;
-  auth: { kind: 'none' } | { kind: 'header'; name: string; value: string } | { kind: 'oauth'; grant?: PortableGrant };
-  client: OAuthClient | null;
-  oauthResource?: string;
-  policy: ConnectorPolicy;
-  sourceStamp: string;
-}
-
-export interface MigrationView {
-  operationId: string;
-  sourceId: string;
-  destinationId: string;
-  phase: 'preparing' | 'prepared' | 'active' | 'rolled_back';
-  readiness: 'pending' | 'ready' | 'signin' | 'changed' | 'unavailable' | 'refresh_uncertain';
-  grantImported?: boolean;
-  name: string | null;
-  auth: 'none' | 'header' | 'oauth' | null;
-  policy: ConnectorPolicy | null;
-  sourceStamp: string | null;
-}
-
-export interface MigrationResponse {
-  migration: MigrationView;
-  receiving?: { publicKey: string; context: MigrationContext };
-}
-
-export type MigrationRequest = { action: 'begin' | 'status' | 'activate' | 'rollback'; operationId: string; sourceId: string } | { action: 'prepare' | 'handover'; operationId: string; sourceId: string; sealed: unknown };
-
-const invalid = (): Error => new Error('Invalid connector migration.');
-const idOf = (value: unknown): string => {
-  const id = parseId(value);
-  if (id === null) throw invalid();
-  return id;
-};
-
-export function migrationRequestOf(raw: unknown): MigrationRequest {
-  const value = deliveryRecord(raw, ['action', 'operationId', 'sourceId', 'sealed']);
-  const operationId = idOf(value.operationId);
-  const sourceId = idOf(value.sourceId);
-  if ((value.action === 'prepare' || value.action === 'handover') && Object.hasOwn(value, 'sealed')) return { action: value.action, operationId, sourceId, sealed: value.sealed };
-  if (Object.hasOwn(value, 'sealed')) throw invalid();
-  if (value.action !== 'begin' && value.action !== 'status' && value.action !== 'activate' && value.action !== 'rollback') throw invalid();
-  return { action: value.action, operationId, sourceId };
-}
-
-function contextOf(raw: unknown): MigrationContext {
-  const value = deliveryRecord(raw, ['owner', 'agent', 'keyId', 'operationId', 'sourceId', 'destinationId']);
-  if (typeof value.owner !== 'string' || !isOrganizationId(value.owner) || typeof value.keyId !== 'string') throw invalid();
-  deliveryBytes(value.keyId, 32);
-  return { owner: value.owner, agent: idOf(value.agent), keyId: value.keyId, operationId: idOf(value.operationId), sourceId: idOf(value.sourceId), destinationId: idOf(value.destinationId) };
-}
-
-function contextBytes(context: MigrationContext): Buffer {
-  const value = contextOf(context);
-  return Buffer.from(JSON.stringify(['metro-connector-migration/v1', value.owner, value.agent, value.keyId, value.operationId, value.sourceId, value.destinationId]));
-}
-
-function headerOf(value: Record<string, unknown>): MigrationPayload['auth'] {
-  const auth = connectorAuth(value.name, value.value);
-  if (auth.kind !== 'header' || auth.name !== value.name || auth.value !== value.value || ['__proto__', 'constructor', 'prototype'].includes(auth.name)) throw invalid();
-  return auth;
-}
-
-function authOf(raw: unknown, target: string): MigrationPayload['auth'] {
-  const value = deliveryRecord(raw, ['kind', 'name', 'value', 'grant']);
-  if (value.kind !== 'oauth' && Object.hasOwn(value, 'grant')) throw invalid();
-  if (value.kind === 'header') return headerOf(value);
-  if ((value.kind !== 'none' && value.kind !== 'oauth') || Object.hasOwn(value, 'name') || Object.hasOwn(value, 'value')) throw invalid();
-  if (value.kind === 'none' || value.grant === undefined) return { kind: value.kind };
-  return { kind: 'oauth', grant: portableGrant(value.grant, target) };
-}
-
-function clientOf(raw: unknown): OAuthClient | null {
-  if (raw === null) return null;
-  const value = deliveryRecord(raw, ['clientId', 'clientSecret']);
-  const client = connectorClient(value.clientId, value.clientSecret);
-  if (client === null || client.clientId !== value.clientId || client.clientSecret !== value.clientSecret) throw invalid();
-  return client;
-}
-
-function migrationClient(auth: MigrationPayload['auth'], input: Record<string, unknown>): OAuthClient | null {
-  const client = clientOf(input.client);
-  if (auth.kind !== 'oauth' && (client !== null || Object.hasOwn(input, 'oauthResource'))) throw invalid();
-  return client;
-}
-
-export function migrationPayloadOf(raw: unknown): MigrationPayload {
-  const value = deliveryRecord(raw, ['name', 'url', 'auth', 'client', 'oauthResource', 'policy', 'sourceStamp']);
-  if (typeof value.name !== 'string' || connectorName(value.name) !== value.name || typeof value.url !== 'string' || typeof value.sourceStamp !== 'string') throw invalid();
-  parsePublicConnectorUrl(value.url);
-  deliveryBytes(value.sourceStamp, 32);
-  const auth = authOf(value.auth, value.url);
-  const client = migrationClient(auth, value);
-  const payload = { name: value.name, url: value.url, auth, client, ...(Object.hasOwn(value, 'oauthResource') ? { oauthResource: boundOAuthResource(value.url, value.oauthResource) } : {}), policy: connectorPolicyOf(value.policy), sourceStamp: value.sourceStamp };
-  if (Buffer.byteLength(JSON.stringify(payload)) > PAYLOAD_MAX) throw invalid();
-  return payload;
-}
-
-function phaseOf(value: unknown): MigrationView['phase'] {
-  if (value !== 'preparing' && value !== 'prepared' && value !== 'active' && value !== 'rolled_back') throw invalid();
-  return value;
-}
-
-function readinessOf(value: unknown): MigrationView['readiness'] {
-  if (value !== 'pending' && value !== 'ready' && value !== 'signin' && value !== 'changed' && value !== 'unavailable' && value !== 'refresh_uncertain') throw invalid();
-  return value;
-}
-
-function authKindOf(value: unknown): MigrationView['auth'] {
-  if (value !== null && value !== 'none' && value !== 'header' && value !== 'oauth') throw invalid();
-  return value;
-}
-
-function nullableName(value: unknown): string | null {
-  if (value === null) return null;
-  if (typeof value !== 'string' || connectorName(value) !== value) throw invalid();
-  return value;
-}
-
-function nullableStamp(value: unknown): string | null {
-  if (value === null) return null;
-  if (typeof value !== 'string') throw invalid();
-  deliveryBytes(value, 32);
-  return value;
-}
-
-function viewOf(raw: unknown): MigrationView {
-  const view = deliveryRecord(raw, ['operationId', 'sourceId', 'destinationId', 'phase', 'readiness', 'name', 'auth', 'policy', 'sourceStamp', 'grantImported']);
-  if (view.grantImported !== undefined && typeof view.grantImported !== 'boolean') throw invalid();
-  return { ...(view.grantImported === undefined ? {} : { grantImported: view.grantImported }), operationId: idOf(view.operationId), sourceId: idOf(view.sourceId), destinationId: idOf(view.destinationId), phase: phaseOf(view.phase), readiness: readinessOf(view.readiness), name: nullableName(view.name), auth: authKindOf(view.auth), policy: view.policy === null ? null : connectorPolicyOf(view.policy), sourceStamp: nullableStamp(view.sourceStamp) };
-}
-
-export function migrationResponseOf(raw: unknown): MigrationResponse {
-  const value = deliveryRecord(raw, ['migration', 'receiving']);
-  const migration = viewOf(value.migration);
-  if (!Object.hasOwn(value, 'receiving')) return { migration };
-  const receiving = deliveryRecord(value.receiving, ['publicKey', 'context']);
-  if (typeof receiving.publicKey !== 'string' || sealingKeyOf(receiving.publicKey) === null) throw invalid();
-  const context = contextOf(receiving.context);
-  if (context.operationId !== migration.operationId || context.sourceId !== migration.sourceId || context.destinationId !== migration.destinationId) throw invalid();
-  return { migration, receiving: { publicKey: receiving.publicKey, context } };
-}
-
-export function sealConnectorMigration(publicKey: string, context: MigrationContext, payload: MigrationPayload): SealedTransfer {
-  return sealTransfer(publicKey, contextBytes(context), Buffer.from(JSON.stringify(migrationPayloadOf(payload))));
-}
-
-export function openConnectorMigration(privateKey: KeyObject, context: MigrationContext, sealed: unknown): MigrationPayload {
-  if (Buffer.byteLength(JSON.stringify(sealed)) > CONNECTOR_MIGRATION_MAX_BYTES) throw invalid();
-  const plain = openTransfer(privateKey, contextBytes(context), sealed, PAYLOAD_MAX);
-  return migrationPayloadOf(JSON.parse(plain.toString('utf8')) as unknown);
-}