@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.21

package/runtime/node_modules/@metro-labs/mcp/src/db/account-attach.ts

@@ -0,0 +1,91 @@
+import { isUniqueViolation } from './users.js';
+import { and, eq, sql } from 'drizzle-orm';
+import { newId } from './ids.js';
+import { getDb } from './client.js';
+import {  AgentAdminError,    ownedAgentOrThrow,  } from './agent-admin.js';
+import { stations, STATIONS, type StationName } from './schema.js';
+
+const ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const ID_ATTEMPTS = 5;
+
+export interface AccountRef {
+  agentId: string;
+  station: StationName;
+  accountId: string;
+}
+
+export function isStationName(raw: unknown): raw is StationName {
+  return (
+    typeof raw === 'string' && (STATIONS as readonly string[]).includes(raw)
+  );
+}
+
+export function parseAccountId(raw: string): string | null {
+  return ACCOUNT_ID_RE.test(raw) ? raw : null;
+}
+
+async function assertTokenFree(
+  station: StationName,
+  token: string,
+): Promise<void> {
+  const rows = await getDb()
+    .select({ id: stations.id })
+    .from(stations)
+    .where(
+      and(
+        eq(stations.station, station),
+        sql`${stations.config}->>'token' = ${token}`,
+      ),
+    );
+  if (rows.length > 0)
+    throw new AgentAdminError(
+      'that bot token is already attached to a Metro account',
+      409,
+    );
+}
+
+export async function attachAccountToAgent(
+  email: string,
+  agentId: string,
+  station: StationName,
+  config: Record<string, unknown>,
+): Promise<AccountRef> {
+  const { agent } = await ownedAgentOrThrow(email, agentId);
+  const token = config.token;
+  if (typeof token === 'string') await assertTokenFree(station, token);
+  const db = getDb();
+  for (let attempt = 0; attempt < ID_ATTEMPTS; attempt++) {
+    const accountId = newId();
+    try {
+      await db
+        .insert(stations)
+        .values({ id: accountId, agentId: agent.id, station, config });
+      return { agentId: agent.id, station, accountId };
+    } catch (err) {
+      if (!isUniqueViolation(err)) throw err;
+    }
+  }
+  throw new AgentAdminError('could not allocate a free account id', 500);
+}
+
+export async function detachAccountFromAgent(
+  email: string,
+  agentId: string,
+  station: StationName,
+  accountId: string,
+): Promise<AccountRef> {
+  const { agent } = await ownedAgentOrThrow(email, agentId);
+  const gone = await getDb()
+    .delete(stations)
+    .where(
+      and(
+        eq(stations.agentId, agent.id),
+        eq(stations.station, station),
+        eq(stations.id, accountId),
+      ),
+    )
+    .returning({ id: stations.id });
+  if (gone.length === 0)
+    throw new AgentAdminError('no such account on this agent', 404);
+  return { agentId: agent.id, station, accountId };
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-admin.ts

@@ -0,0 +1,215 @@
+import { randomBytes } from 'node:crypto';
+import { and, asc, eq, inArray } from 'drizzle-orm';
+import { ApiError } from '../daemon/api-error.js';
+import { getDb } from './client.js';
+import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
+import { newId, parseId } from './ids.js';
+import { agents, stations } from './schema.js';
+import { isUniqueViolation } from './users.js';
+import { projectIdOrThrow } from './projects.js';
+
+export const AGENT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{1,31}$/;
+const KEY_ATTEMPTS = 5;
+
+export class AgentAdminError extends ApiError {}
+
+export interface AgentSummary {
+  id: string;
+  name: string;
+  owned: boolean;
+  key: string | null;
+}
+
+export interface CreatedAgent {
+  id: string;
+  name: string;
+  key: string;
+}
+
+export interface OwnedAgent {
+  id: string;
+  name: string;
+}
+
+export type DeletedAgent = OwnedAgent;
+
+export interface ResetAgentKey extends OwnedAgent {
+  key: string;
+}
+
+export function normalizeAgentName(raw: unknown): string {
+  const name = typeof raw === 'string' ? raw.trim() : '';
+  if (!AGENT_NAME_RE.test(name))
+    throw new AgentAdminError(
+      'name must be 2-32 characters of A-Z, a-z, 0-9, - or _, starting with a letter or digit',
+      400,
+    );
+  return name;
+}
+
+export function newApiKey(): string {
+  return `mk_${randomBytes(32).toString('base64url')}`;
+}
+
+const agentPin = (): string => process.env.METRO_AGENT?.trim() ?? '';
+
+export function servesEveryAgent(): boolean {
+  return agentPin() === '';
+}
+
+export function daemonServesAgent(id: string): boolean {
+  const pin = agentPin();
+  return pin === '' || pin === id;
+}
+
+interface AgentRow {
+  id: string;
+  name: string;
+  projectId: string;
+}
+
+interface KeyRow {
+  agentId: string;
+  key: string | null;
+}
+
+export function toAgentSummaries(
+  rows: AgentRow[],
+  keyRows: KeyRow[],
+): AgentSummary[] {
+  return rows.map((r) => ({
+    id: r.id,
+    name: r.name,
+    owned: true,
+    key: keyRows.find((k) => k.agentId === r.id)?.key ?? null,
+  }));
+}
+
+async function selectKeyRows(ids: string[]): Promise<KeyRow[]> {
+  if (ids.length === 0) return [];
+  return getDb()
+    .select({ agentId: agents.id, key: agents.key })
+    .from(agents)
+    .where(inArray(agents.id, ids));
+}
+
+export async function listAgentsForEmail(
+  email: string,
+  project: string,
+): Promise<AgentSummary[]> {
+  const projectId = await projectIdOrThrow(email, project);
+  const rows = await getDb()
+    .select({ id: agents.id, name: agents.name, projectId: agents.projectId })
+    .from(agents)
+    .where(eq(agents.projectId, projectId))
+    .orderBy(asc(agents.name), asc(agents.id));
+  if (rows.length === 0) return [];
+  const keyRows = await selectKeyRows(rows.map((r) => r.id));
+  return toAgentSummaries(rows, keyRows);
+}
+
+async function insertAgent(
+  projectId: string,
+  name: string,
+  key: string,
+): Promise<string> {
+  const inserted = await getDb()
+    .insert(agents)
+    .values({ id: newId(), name, projectId, key })
+    .returning({ id: agents.id });
+  const id = inserted[0]?.id;
+  if (id === undefined)
+    throw new AgentAdminError('agent insert returned no id', 500);
+  return id;
+}
+
+export async function createAgentForEmail(
+  email: string,
+  project: string,
+  rawName: string,
+): Promise<CreatedAgent> {
+  const name = normalizeAgentName(rawName);
+  const key = newApiKey();
+  const id = await insertAgent(await projectIdOrThrow(email, project), name, key);
+  if (servesEveryAgent()) registerKey(key, id);
+  return { id, name, key };
+}
+
+export function parseAgentId(raw: string): string | null {
+  return parseId(raw);
+}
+
+interface Deletable {
+  agent: DeletedAgent;
+  projectId: string;
+}
+
+export async function ownedAgentOrThrow(
+  email: string,
+  id: string,
+): Promise<Deletable> {
+  const rows = await getDb().select().from(agents).where(eq(agents.id, id));
+  const row = rows[0];
+  const missing = new AgentAdminError('no such agent', 404);
+  if (!row) throw missing;
+  try {
+    await projectIdOrThrow(email, row.projectId);
+  } catch {
+    throw missing;
+  }
+  return { agent: { id: row.id, name: row.name }, projectId: row.projectId };
+}
+
+async function writeNewKey(id: string, projectId: string): Promise<string> {
+  for (let attempt = 0; attempt < KEY_ATTEMPTS; attempt += 1) {
+    const key = newApiKey();
+    try {
+      const changed = await getDb()
+        .update(agents)
+        .set({ key })
+        .where(and(eq(agents.id, id), eq(agents.projectId, projectId)))
+        .returning({ id: agents.id });
+      if (changed.length === 0)
+        throw new AgentAdminError('no such agent', 404);
+      return key;
+    } catch (err) {
+      if (!isUniqueViolation(err)) throw err;
+    }
+  }
+  throw new AgentAdminError('could not allocate a free api key', 500);
+}
+
+export async function resetAgentKeyForEmail(
+  email: string,
+  id: string,
+): Promise<ResetAgentKey> {
+  const { agent, projectId } = await ownedAgentOrThrow(email, id);
+  const key = await writeNewKey(agent.id, projectId);
+  rotateAgentKey(agent.id, daemonServesAgent(agent.id) ? key : null);
+  return { id: agent.id, name: agent.name, key };
+}
+
+export async function deleteAgentForEmail(
+  email: string,
+  id: string,
+): Promise<DeletedAgent> {
+  const { agent, projectId } = await ownedAgentOrThrow(email, id);
+  await getDb().transaction(async (tx) => {
+    const attached = await tx
+      .select({ id: stations.id })
+      .from(stations)
+      .where(eq(stations.agentId, id));
+    if (attached.length > 0)
+      throw new AgentAdminError(
+        `agent '${agent.name}' still has ${attached.length} station account(s) attached — an operator must remove them first`,
+        409,
+      );
+    const gone = await tx
+      .delete(agents)
+      .where(and(eq(agents.id, id), eq(agents.projectId, projectId)))
+      .returning({ id: agents.id });
+    if (gone.length === 0) throw new AgentAdminError('no such agent', 404);
+  });
+  unregisterAgentKey(id);
+  return agent;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-map.ts

@@ -0,0 +1,71 @@
+export type AgentMap = Record<string, string>;
+export type AgentNameMap = Record<string, string>;
+export type AllowlistMap = Record<string, string[]>;
+
+const mapKey = (station: string, accountId: string): string =>
+  `${station}/${accountId}`;
+
+let agentMap: AgentMap = {};
+let agentNames: AgentNameMap = {};
+let allowlistMap: AllowlistMap = {};
+
+export function setAgentMap(map: AgentMap, names: AgentNameMap): void {
+  agentMap = map;
+  agentNames = names;
+}
+
+export function setAllowlistMap(map: AllowlistMap): void {
+  allowlistMap = map;
+}
+
+export function accountFromLine(
+  line: string,
+): { station: string; accountId: string } | undefined {
+  const parts = line.split('/');
+  const station = parts[2];
+  const accountId = parts[3];
+  if (!station || !accountId) return undefined;
+  return { station, accountId };
+}
+
+export function agentIdForAccount(
+  station: string,
+  accountId: string,
+): string | undefined {
+  return agentMap[mapKey(station, accountId)];
+}
+
+export function agentIdForLine(line: string): string | undefined {
+  const a = accountFromLine(line);
+  return a ? agentIdForAccount(a.station, a.accountId) : undefined;
+}
+
+export function agentForLine(line: string): string | undefined {
+  const id = agentIdForLine(line);
+  return id === undefined ? undefined : agentNames[id];
+}
+
+export function stationAgentIds(station: string): string[] {
+  const prefix = `${station}/`;
+  return Object.entries(agentMap)
+    .filter(([key]) => key.startsWith(prefix))
+    .map(([, id]) => id);
+}
+
+export function allowlistForLine(line: string): string[] | undefined {
+  const a = accountFromLine(line);
+  return a ? allowlistMap[mapKey(a.station, a.accountId)] : undefined;
+}
+
+export function senderMatchesAllowlist(
+  allowlist: string[],
+  from: string,
+): boolean {
+  if (allowlist.length === 0 || allowlist.includes('*')) return true;
+  const f = (from ?? '').toLowerCase();
+  const id = f.split('/').pop() ?? f;
+  return allowlist.some((a) => {
+    const v = a.toLowerCase();
+    return v === f || v === id;
+  });
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-scope.ts

@@ -0,0 +1,64 @@
+import {
+  accountFromLine,
+  agentIdForAccount,
+  stationAgentIds,
+} from './agent-map.js';
+import { STATIONS } from './schema.js';
+
+const ACCOUNT_STATIONS = new Set<string>(STATIONS);
+
+const stationHasAccounts = (station: string): boolean =>
+  ACCOUNT_STATIONS.has(station);
+
+const accountInScope = (
+  allowed: Set<string>,
+  station: string,
+  accountId: string,
+): boolean => {
+  const agentId = agentIdForAccount(station, accountId);
+  return agentId !== undefined && allowed.has(agentId);
+};
+
+export function lineTargetDenied(
+  allowed: Set<string>,
+  args: Record<string, unknown>,
+  station?: string,
+): boolean {
+  const line = typeof args.line === 'string' ? args.line : undefined;
+  if (line === undefined) return false;
+  const acct = accountFromLine(line);
+  if (!acct) return true;
+  if (station !== undefined && acct.station !== station) return true;
+  if (!accountInScope(allowed, acct.station, acct.accountId)) return true;
+  const override = typeof args.account === 'string' ? args.account : undefined;
+  return override !== undefined
+    ? !accountInScope(allowed, acct.station, override)
+    : false;
+}
+
+export function stationFullyScoped(
+  allowed: Set<string>,
+  station: string,
+): boolean {
+  const ids = stationAgentIds(station);
+  return ids.length > 0 && ids.every((id) => allowed.has(id));
+}
+
+export function callTargetDenied(
+  allowed: Set<string>,
+  station: string,
+  args: Record<string, unknown>,
+): boolean {
+  if (typeof args.line === 'string')
+    return lineTargetDenied(allowed, args, station);
+  if (typeof args.account === 'string')
+    return !accountInScope(allowed, station, args.account);
+  return !stationFullyScoped(allowed, station);
+}
+
+export function eventInScope(allowed: Set<string>, line: string): boolean {
+  const acct = accountFromLine(line);
+  if (!acct) return false;
+  if (!stationHasAccounts(acct.station)) return true;
+  return accountInScope(allowed, acct.station, acct.accountId);
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/client.ts

@@ -0,0 +1,37 @@
+import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import postgres from 'postgres';
+import { log } from '../daemon/log.js';
+import * as schema from './schema.js';
+
+export type Db = PostgresJsDatabase<typeof schema>;
+
+let sql: ReturnType<typeof postgres> | null = null;
+let db: Db | null = null;
+
+export function databaseUrl(): string | undefined {
+  const url = process.env.DATABASE_URL?.trim();
+  if (!url) return undefined;
+  return url;
+}
+
+export function getDb(): Db {
+  const url = databaseUrl();
+  if (!url) throw new Error('DATABASE_URL is not set');
+  if (!db) {
+    sql = postgres(url, {
+      max: 4,
+      prepare: false,
+      onnotice: (notice) => {
+        log.debug({ notice: notice.message }, 'postgres notice');
+      },
+    });
+    db = drizzle(sql, { schema });
+  }
+  return db;
+}
+
+export async function closeDb(): Promise<void> {
+  if (sql) await sql.end({ timeout: 5 });
+  sql = null;
+  db = null;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-collections.ts

@@ -0,0 +1,218 @@
+import { isUniqueViolation } from './users.js';
+import { projectIdOrThrow } from './projects.js';
+import { and, asc, eq, inArray, ne } from 'drizzle-orm';
+import { getDb } from './client.js';
+import { newId } from './ids.js';
+import { ConnectorError, connectorName } from './connector-config.js';
+import { collectionItems, collections, connectors } from './schema.js';
+
+export interface ConnectorCollectionRow {
+  id: string;
+  name: string;
+  connectorIds: string[];
+}
+
+interface CollectionRow {
+  id: string;
+  projectId: string;
+  name: string;
+}
+
+const missing = (): ConnectorError =>
+  new ConnectorError('no such collection', 404);
+
+const duplicate = (name: string): ConnectorError =>
+  new ConnectorError(`you already have a collection named '${name}'`, 409);
+
+const nameClash = (name: string, collection: string): ConnectorError =>
+  new ConnectorError(
+    `the collection '${collection}' already has a connector named '${name}'`,
+    409,
+  );
+
+async function collidingCollection(
+  collectionIds: string[],
+  name: string,
+  exceptConnectorId: string,
+): Promise<string | null> {
+  if (collectionIds.length === 0) return null;
+  const rows = await getDb()
+    .select({ collection: collections.name })
+    .from(collectionItems)
+    .innerJoin(connectors, eq(connectors.id, collectionItems.connectorId))
+    .innerJoin(collections, eq(collections.id, collectionItems.collectionId))
+    .where(
+      and(
+        inArray(collectionItems.collectionId, collectionIds),
+        eq(connectors.name, name),
+        ne(connectors.id, exceptConnectorId),
+      ),
+    )
+    .limit(1);
+  return rows[0]?.collection ?? null;
+}
+
+export async function assertRenameFreeOfClash(
+  connectorId: string,
+  name: string,
+): Promise<void> {
+  const rows = await getDb()
+    .select({ collectionId: collectionItems.collectionId })
+    .from(collectionItems)
+    .where(eq(collectionItems.connectorId, connectorId));
+  const clash = await collidingCollection(
+    rows.map((r) => r.collectionId),
+    name,
+    connectorId,
+  );
+  if (clash !== null) throw nameClash(name, clash);
+}
+
+async function ownedCollectionOrThrow(
+  email: string,
+  id: string,
+): Promise<CollectionRow> {
+  const rows = await getDb()
+    .select()
+    .from(collections)
+    .where(eq(collections.id, id));
+  const row = rows[0];
+  if (row === undefined) throw missing();
+  try {
+    await projectIdOrThrow(email, row.projectId);
+  } catch {
+    throw missing();
+  }
+  return row;
+}
+
+async function itemsOf(collectionId: string): Promise<string[]> {
+  const rows = await getDb()
+    .select({ connectorId: collectionItems.connectorId })
+    .from(collectionItems)
+    .where(eq(collectionItems.collectionId, collectionId))
+    .orderBy(asc(collectionItems.id));
+  return rows.map((r) => r.connectorId);
+}
+
+async function withItems(row: CollectionRow): Promise<ConnectorCollectionRow> {
+  return { id: row.id, name: row.name, connectorIds: await itemsOf(row.id) };
+}
+
+export async function listCollectionsForEmail(
+  email: string,
+  project: string,
+): Promise<ConnectorCollectionRow[]> {
+  const projectId = await projectIdOrThrow(email, project);
+  const rows = await getDb()
+    .select()
+    .from(collections)
+    .where(eq(collections.projectId, projectId))
+    .orderBy(asc(collections.id));
+  return Promise.all(rows.map(withItems));
+}
+
+export async function getCollectionForEmail(
+  email: string,
+  id: string,
+): Promise<ConnectorCollectionRow> {
+  return withItems(await ownedCollectionOrThrow(email, id));
+}
+
+export async function createCollectionForEmail(
+  email: string,
+  project: string,
+  raw: string,
+): Promise<ConnectorCollectionRow> {
+  const name = connectorName(raw);
+  const projectId = await projectIdOrThrow(email, project);
+  try {
+    const rows = await getDb()
+      .insert(collections)
+      .values({ id: newId(), projectId, name })
+      .returning();
+    const row = rows[0];
+    if (row === undefined)
+      throw new ConnectorError('collection insert returned no row', 500);
+    return { id: row.id, name: row.name, connectorIds: [] };
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+    throw duplicate(name);
+  }
+}
+
+export async function renameCollectionForEmail(
+  email: string,
+  id: string,
+  raw: string,
+): Promise<ConnectorCollectionRow> {
+  const name = connectorName(raw);
+  const row = await ownedCollectionOrThrow(email, id);
+  try {
+    await getDb()
+      .update(collections)
+      .set({ name })
+      .where(eq(collections.id, row.id));
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+    throw duplicate(name);
+  }
+  return withItems({ ...row, name });
+}
+
+export async function deleteCollectionForEmail(
+  email: string,
+  id: string,
+): Promise<{ id: string; name: string }> {
+  const row = await ownedCollectionOrThrow(email, id);
+  await getDb().delete(collections).where(eq(collections.id, row.id));
+  return { id: row.id, name: row.name };
+}
+
+async function connectorNameIn(
+  projectId: string,
+  connectorId: string,
+): Promise<string | null> {
+  const rows = await getDb()
+    .select({ name: connectors.name })
+    .from(connectors)
+    .where(and(eq(connectors.id, connectorId), eq(connectors.projectId, projectId)));
+  return rows[0]?.name ?? null;
+}
+
+export async function addToCollectionForEmail(
+  email: string,
+  id: string,
+  connectorId: string,
+): Promise<ConnectorCollectionRow> {
+  const row = await ownedCollectionOrThrow(email, id);
+  const name = await connectorNameIn(row.projectId, connectorId);
+  if (name === null) throw new ConnectorError('no such connector', 404);
+  const clash = await collidingCollection([row.id], name, connectorId);
+  if (clash !== null) throw nameClash(name, clash);
+  try {
+    await getDb()
+      .insert(collectionItems)
+      .values({ id: newId(), collectionId: row.id, connectorId });
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+  }
+  return withItems(row);
+}
+
+export async function removeFromCollectionForEmail(
+  email: string,
+  id: string,
+  connectorId: string,
+): Promise<ConnectorCollectionRow> {
+  const row = await ownedCollectionOrThrow(email, id);
+  await getDb()
+    .delete(collectionItems)
+    .where(
+      and(
+        eq(collectionItems.collectionId, row.id),
+        eq(collectionItems.connectorId, connectorId),
+      ),
+    );
+  return withItems(row);
+}