@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.210

package/runtime/node_modules/@metro-labs/mcp/src/daemon/collection-api.ts

@@ -1,202 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import {
-  apiFailure,
-  apiSession,
-  projectParam,
-  bodyField,
-  cors,
-  readJsonBody,
-  sendJson,
-  type ApiSession,
-} from './api-http.js';
-import { parseId } from '../db/ids.js';
-import { mintCliCode } from './cli-pair.js';
-import type { ConnectorApiDeps } from './connector-api.js';
-
-const PREFIX = '/api/collections';
-
-type Routable =
-  | { kind: 'index' }
-  | { kind: 'collection'; id: string }
-  | { kind: 'rename'; id: string }
-  | { kind: 'code'; id: string }
-  | { kind: 'items'; id: string }
-  | { kind: 'item'; id: string; connectorId: string };
-
-type Target = Routable | { kind: 'unknown' } | null;
-
-const ALLOWED: Record<Routable['kind'], string[]> = {
-  index: ['GET', 'POST'],
-  collection: ['GET', 'DELETE'],
-  rename: ['POST'],
-  code: ['POST'],
-  items: ['POST'],
-  item: ['DELETE'],
-};
-
-function itemTarget(id: string, rest: string[]): Target {
-  if (rest.length === 1) return { kind: 'items', id };
-  if (rest.length > 2) return { kind: 'unknown' };
-  const connectorId = parseId(rest[1] ?? '');
-  return connectorId === null
-    ? { kind: 'unknown' }
-    : { kind: 'item', id, connectorId };
-}
-
-function subTarget(id: string, rest: string[]): Target {
-  if (rest.length === 0) return { kind: 'collection', id };
-  const head = rest[0];
-  if (head === 'items') return itemTarget(id, rest);
-  if (rest.length > 1) return { kind: 'unknown' };
-  if (head === 'rename') return { kind: 'rename', id };
-  if (head === 'code') return { kind: 'code', id };
-  return { kind: 'unknown' };
-}
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const head = segments[0];
-  if (head === undefined) return { kind: 'index' };
-  const id = parseId(head);
-  return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
-}
-
-async function nameFrom(req: IncomingMessage): Promise<string | null> {
-  const name = bodyField(await readJsonBody(req), 'name');
-  return typeof name === 'string' ? name : null;
-}
-
-async function handleIndex(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  session: ApiSession,
-): Promise<void> {
-  const project = projectParam(req);
-  if (project === null) {
-    sendJson(req, res, 400, { error: 'a project is required' });
-    return;
-  }
-  if (req.method === 'GET') {
-    sendJson(req, res, 200, {
-      collections: await deps.listCollections(session.email, project),
-    });
-    return;
-  }
-  const name = await nameFrom(req);
-  if (name === null) {
-    sendJson(req, res, 400, { error: 'name is required' });
-    return;
-  }
-  const list = await deps.createCollection(session.email, project, name);
-  log.info({ id: list.id, name: list.name }, 'collection-api: created collection');
-  sendJson(req, res, 201, list);
-}
-
-async function handleRename(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  const name = await nameFrom(req);
-  if (name === null) {
-    sendJson(req, res, 400, { error: 'name is required' });
-    return;
-  }
-  sendJson(req, res, 200, await deps.renameCollection(session.email, id, name));
-}
-
-async function handleItems(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  const connectorId = bodyField(await readJsonBody(req), 'connectorId');
-  if (typeof connectorId !== 'string' || parseId(connectorId) === null) {
-    sendJson(req, res, 400, { error: 'connectorId is required' });
-    return;
-  }
-  sendJson(req, res, 200, await deps.addToCollection(session.email, id, connectorId));
-}
-
-async function handleCode(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  session: ApiSession,
-  id: string,
-): Promise<void> {
-  const collection = await deps.getCollection(session.email, id);
-  const minted = mintCliCode({ email: session.email, collectionId: collection.id });
-  log.info({ id: collection.id, email: session.email }, 'collection-api: minted cli code');
-  sendJson(req, res, 200, { ...minted, collection: collection.name });
-}
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  session: ApiSession,
-  tgt: Routable,
-): Promise<void> {
-  try {
-    if (tgt.kind === 'index')
-      await handleIndex(req, res, deps, session);
-    else if (tgt.kind === 'rename')
-      await handleRename(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'code')
-      await handleCode(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'items')
-      await handleItems(req, res, deps, session, tgt.id);
-    else if (tgt.kind === 'item')
-      sendJson(
-        req,
-        res,
-        200,
-        await deps.removeFromCollection(session.email, tgt.id, tgt.connectorId),
-      );
-    else if (req.method === 'DELETE')
-      sendJson(req, res, 200, await deps.deleteCollection(session.email, tgt.id));
-    else sendJson(req, res, 200, await deps.getCollection(session.email, tgt.id));
-  } catch (err) {
-    apiFailure(req, res, err, 'collection-api');
-  }
-}
-
-export function handleCollectionApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-): boolean {
-  const tgt = target((req.url ?? '').split('?')[0] ?? '');
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such collection' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  route(req, res, deps, session, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'list-api: unhandled error');
-    if (!res.headersSent) sendJson(req, res, 500, { error: 'list api failed' });
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-json.ts

@@ -1,31 +0,0 @@
-import type { ConnectorTransport } from '../db/schema.js';
-
-export interface ConnectorEntry {
-  name: string;
-  url: string;
-  transport: ConnectorTransport;
-  header: string | null;
-  secret: string | null;
-  bearer: string | null;
-}
-
-function headersOf(entry: ConnectorEntry): Record<string, string> | null {
-  const { header, secret, bearer } = entry;
-  if (typeof header === 'string' && typeof secret === 'string')
-    return { [header]: secret };
-  if (typeof bearer === 'string' && bearer !== '')
-    return { Authorization: `Bearer ${bearer}` };
-  return null;
-}
-
-function serverOf(entry: ConnectorEntry): Record<string, unknown> {
-  const base = { type: entry.transport, url: entry.url };
-  const headers = headersOf(entry);
-  return headers === null ? base : { ...base, headers };
-}
-
-export function mcpServersJson(entries: ConnectorEntry[]): string {
-  const mcpServers: Record<string, unknown> = {};
-  for (const entry of entries) mcpServers[entry.name] = serverOf(entry);
-  return JSON.stringify({ mcpServers }, null, 2);
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-tools.ts

@@ -1,100 +0,0 @@
-export const TOOL_KINDS = ['read', 'write'] as const;
-
-export type ToolKind = (typeof TOOL_KINDS)[number];
-
-export interface ToolInfo {
-  name: string;
-  title: string;
-  description: string;
-  kind: ToolKind;
-  annotated: boolean;
-  destructive: boolean;
-  idempotent: boolean;
-  openWorld: boolean;
-}
-
-const MAX_TOOLS = 500;
-const MAX_DESCRIPTION = 400;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-const str = (value: unknown, cap: number): string =>
-  typeof value === 'string' ? value.slice(0, cap) : '';
-
-const flag = (value: unknown, fallback: boolean): boolean =>
-  typeof value === 'boolean' ? value : fallback;
-
-export function classifyTool(annotations: unknown): ToolKind {
-  return isRecord(annotations) && annotations.readOnlyHint === true
-    ? 'read'
-    : 'write';
-}
-
-export function isDestructive(annotations: unknown): boolean {
-  if (!isRecord(annotations)) return true;
-  if (annotations.readOnlyHint === true) return false;
-  return annotations.destructiveHint !== false;
-}
-
-export function toToolInfo(raw: unknown): ToolInfo | null {
-  if (!isRecord(raw)) return null;
-  const name = str(raw.name, 200);
-  if (name === '') return null;
-  const annotations = isRecord(raw.annotations) ? raw.annotations : undefined;
-  return {
-    name,
-    title: str(annotations?.title ?? raw.title, 200),
-    description: str(raw.description, MAX_DESCRIPTION),
-    kind: classifyTool(raw.annotations),
-    annotated: annotations !== undefined,
-    destructive: isDestructive(raw.annotations),
-    idempotent: flag(annotations?.idempotentHint, false),
-    openWorld: flag(annotations?.openWorldHint, true),
-  };
-}
-
-export function toToolList(raw: unknown): ToolInfo[] {
-  if (!Array.isArray(raw)) return [];
-  const out: ToolInfo[] = [];
-  for (const entry of raw) {
-    if (out.length >= MAX_TOOLS) break;
-    const tool = toToolInfo(entry);
-    if (tool !== null) out.push(tool);
-  }
-  return out;
-}
-
-export function toStoredTool(raw: unknown): ToolInfo | null {
-  if (!isRecord(raw)) return null;
-  const name = str(raw.name, 200);
-  if (name === '') return null;
-  return {
-    name,
-    title: str(raw.title, 200),
-    description: str(raw.description, MAX_DESCRIPTION),
-    kind: raw.kind === 'read' ? 'read' : 'write',
-    annotated: raw.annotated === true,
-    destructive: raw.destructive !== false,
-    idempotent: raw.idempotent === true,
-    openWorld: raw.openWorld !== false,
-  };
-}
-
-export function readStoredTools(raw: unknown): ToolInfo[] {
-  if (!Array.isArray(raw)) return [];
-  const out: ToolInfo[] = [];
-  for (const entry of raw) {
-    if (out.length >= MAX_TOOLS) break;
-    const tool = toStoredTool(entry);
-    if (tool !== null) out.push(tool);
-  }
-  return out;
-}
-
-export function countByKind(tools: ToolInfo[]): Record<ToolKind, number> {
-  const counts: Record<ToolKind, number> = { read: 0, write: 0 };
-  for (const tool of tools) counts[tool.kind] += 1;
-  return counts;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-url.ts

@@ -1,57 +0,0 @@
-import { ApiError } from './api-error.js';
-
-export class ConnectorVerifyError extends ApiError {}
-
-export class ConnectorUnauthorized extends ConnectorVerifyError {}
-
-export class ConnectorNotMcp extends ConnectorVerifyError {}
-
-export const POLICY_MESSAGE =
-  'Metro connects from its own server, so it cannot reach a URL on your machine. localhost and private addresses are not usable as connectors.';
-
-const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
-const PRIVATE_SUFFIX = /(?:^|\.)(?:localhost|local|internal|flycast)$/;
-
-export function refused(message: string): ConnectorVerifyError {
-  return new ConnectorVerifyError(message, 400);
-}
-
-function hostAllowed(host: string): boolean {
-  if (host === '' || host.startsWith('[')) return false;
-  if (IPV4.test(host) || !host.includes('.')) return false;
-  return !PRIVATE_SUFFIX.test(host);
-}
-
-export function parseConnectorUrl(raw: unknown): URL {
-  const text = typeof raw === 'string' ? raw.trim() : '';
-  if (text === '') throw refused('a connector url is required');
-  let url: URL;
-  try {
-    url = new URL(text);
-  } catch {
-    throw refused('that is not a valid url');
-  }
-  if (url.protocol !== 'https:')
-    throw refused('a connector url must start with https://');
-  if (url.username !== '' || url.password !== '')
-    throw refused('a connector url must not carry a user:password');
-  if (url.hash !== '')
-    throw refused('a connector url must not carry a #fragment');
-  if (!hostAllowed(url.hostname.toLowerCase())) throw refused(POLICY_MESSAGE);
-  return url;
-}
-
-export function connectorUrlText(url: URL): string {
-  const text = url.toString();
-  if (url.pathname !== '/' || url.search !== '') return text;
-  return text.endsWith('/') ? text.slice(0, -1) : text;
-}
-
-export function safeIconSrc(raw: unknown): string {
-  if (typeof raw !== 'string' || raw === '') return '';
-  try {
-    return new URL(raw).protocol === 'https:' ? raw.slice(0, 500) : '';
-  } catch {
-    return '';
-  }
-}