feat: receive the collector runtime, authoring contract, and collector CLI from the pdpp monorepo

[tnunamak]

This repository is becoming the home of the machinery that runs data connectors — the scripts that log into a provider (Gmail, Slack, Amazon) and export a user's data — because an external security review of the planned repository split established that the repository publishing connector code must not also own the code that launches it, supplies its credentials, and ingests its output. This PR is the arrival: three packages extracted from the pdpp monorepo with their full history, integrated to build and test here, and nothing else — wiring the desktop app to actually use them is deliberately a later change, so this PR can be judged purely on faithful arrival and buildability.

The three packages, extracted with git filter-repo so every commit that ever touched them comes along: @pdpp/collector-runtime (launches a connector as a child process, checks the capabilities its manifest declares, feeds it credentials, collects its output records), @pdpp/connector-protocol (the small contract connectors are written against — message types, output helpers, scope filtering), and @pdpp/local-collector (the command-line tool users run on their own device to execute connectors locally and deliver results to their personal data server). History is real, not cosmetic: git log --follow on the moved files walks back to pdpp's initial-contribution commit, and docs/migration/collector-commit-map.txt maps every old commit hash to its new one for advisory and audit traceability.

The honest disclosure to read before anything else: the collector bundles six connectors, so their source code arrives here too, vendored as build input — which means this repository temporarily holds a second copy of connector content whose canonical home will be the connector-library repository after the next planned move. That duplication is transitional by design; its removal trigger is the distribution pipeline supplying bundled connectors as signed published artifacts instead of vendored source. Until then, this is a pinned duplicate with no active cross-repository drift test: the in-monorepo drift test that would compare the checked-in definitions snapshot against its source of truth is skipped here because its generator imports source that lives only in the pdpp monorepo (see the skip in test/collector-definitions-snapshot-drift.test.ts), so drift is bounded only by the pinned commit map (docs/migration/collector-commit-map.txt) — a required cross-repository drift check is a named second-tranche obligation, not something this PR provides. Two smaller stand-ins follow the same pattern, each announcing itself in a README: a minimal private @pdpp/reference-contract package (keeps the real import name working so that when the actual contract package publishes from the pdpp repository, the stand-in is deleted and zero import sites change), and a resolution-anchor manifest for the vendored connector sources (npm resolves dependencies by physical directory, unlike the source monorepo's package manager, so the vendored tree needs its own dependency declaration to see the right version of its schema library — pinning it at the root would have forced a major-version change onto this whole app).

Adaptation from the monorepo's conventions was mechanical: npm workspaces added to the root manifest, package-manager-specific scripts converted, and the monorepo's 3,340-line cross-package test-coordination wrapper dropped (it coordinates concurrent package suites against shared scratch directories; these are the only packages with tests here — a comment marks the decision and it gets revisited if this repo grows more suites).

Proof, from a fresh clone of this branch on this repo's pinned Node version: install succeeds; all three packages build and typecheck; tests pass 156/156 (runtime), 104/104 (contract), 184/184 with 5 explicit skips (collector). Each skip is a test whose subject genuinely lives in the not-yet-moved connector library — for example the drift test comparing the definitions snapshot against its source of truth, which becomes cross-repository CI once both repos exist — and each carries a comment naming that reinstatement mechanism. One pre-existing note: this repo's own postinstall connector-fetch check prints an unrelated warning in scratch clones; install still exits clean.

What I did not verify: the desktop app's behavior is untouched and untested by this PR (no app code changed beyond the root workspaces entry), and the five skipped tests are asserted-out-of-scope rather than passing — their subjects return with the connector-library move.

Full extraction transcript, path list including pre-move historical locations, and per-decision rationale: the Move R work report accompanying the review bundle.

Assisted-by: AI