@stage-labs/metro 0.1.0-beta.246 → 0.1.0-beta.248

package/dist/background.js

@@ -7,7 +7,7 @@ const STOP_MS = 30_000;
 const SETTLE_MS = 5_000;
 const POLL_MS = 250;
 const given = (value) => value !== undefined && value.trim() !== '' ? value.trim() : undefined;
-const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+export const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 export const keepInSession = (env) => given(env[AGENT_VIEW_OFF]) === undefined ? { ...env, [AGENT_VIEW_OFF]: '1' } : env;
 export const claudeDir = (env = process.env) => given(env.CLAUDE_CONFIG_DIR) ?? join(given(env.HOME) ?? homedir(), '.claude');
 export const projectDir = (dir, cwd) => join(dir, 'projects', cwd.replace(/[^A-Za-z0-9]/g, '-'));

package/dist/root-release-io.js

@@ -0,0 +1,161 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { X509Certificate } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { isRecord } from './background.js';
+import { ISSUER, isVersion, PUBLISHER, RELEASE_DIR } from './root-release.js';
+import { PACKAGE_NAME } from './version.js';
+const REGISTRY = 'https://registry.npmjs.org';
+const ENCODED = PACKAGE_NAME.replace('/', '%2F');
+const ROOT_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const SETUP = join('runtime', 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts');
+const MAX_TARBALL = 64 * 1024 * 1024;
+const TIMEOUT_MS = 60_000;
+const isSigstore = (mod) => isRecord(mod) && typeof mod.verify === 'function';
+export function rootOwned(path) {
+    let at = realpathSync(path);
+    for (;;) {
+        const st = statSync(at);
+        if (st.uid !== 0 || (st.mode & 0o022) !== 0)
+            return false;
+        if (at === dirname(at))
+            return true;
+        at = dirname(at);
+    }
+}
+function mustBeRootOwned(path, what) {
+    if (!existsSync(path) || !rootOwned(path))
+        throw new Error(`${what} at ${path} is missing or not owned by root alone; refused`);
+    return path;
+}
+async function getJson(url) {
+    const res = await fetch(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok)
+        throw new Error(`${url} answered ${String(res.status)}`);
+    return res.json();
+}
+async function published(version) {
+    const body = await getJson(`${REGISTRY}/${ENCODED}`);
+    const tags = isRecord(body) && isRecord(body['dist-tags']) ? body['dist-tags'] : {};
+    const entry = isRecord(body) && isRecord(body.versions) ? body.versions[version] : undefined;
+    const dist = isRecord(entry) && isRecord(entry.dist) ? entry.dist : {};
+    if (typeof dist.tarball !== 'string' || typeof dist.integrity !== 'string')
+        throw new Error(`npm has no ${PACKAGE_NAME}@${version}`);
+    return { tags, tarball: dist.tarball, integrity: dist.integrity };
+}
+async function download(url) {
+    const res = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok)
+        throw new Error(`${url} answered ${String(res.status)}`);
+    if (Number(res.headers.get('content-length') ?? 0) > MAX_TARBALL)
+        throw new Error(`${url} is too large`);
+    const bytes = Buffer.from(await res.arrayBuffer());
+    if (bytes.length > MAX_TARBALL)
+        throw new Error(`${url} is too large`);
+    return bytes;
+}
+function loadSigstore() {
+    const npm = mustBeRootOwned(join(dirname(dirname(process.execPath)), 'lib', 'node_modules', 'npm'), "npm's sigstore");
+    const mod = createRequire(join(npm, 'package.json'))('sigstore');
+    if (!isSigstore(mod))
+        throw new Error(`no sigstore verifier in ${npm}; refused`);
+    return mod;
+}
+function leafCertificate(bundle) {
+    const material = isRecord(bundle) && isRecord(bundle.verificationMaterial) ? bundle.verificationMaterial : {};
+    const chain = isRecord(material.x509CertificateChain) && Array.isArray(material.x509CertificateChain.certificates) ? material.x509CertificateChain.certificates : [];
+    const leaf = isRecord(material.certificate) ? material.certificate : chain[0];
+    return isRecord(leaf) && typeof leaf.rawBytes === 'string' ? leaf.rawBytes : null;
+}
+export function signedByPublisher(bundle) {
+    const raw = leafCertificate(bundle);
+    if (raw === null)
+        return false;
+    const names = new X509Certificate(Buffer.from(raw, 'base64')).subjectAltName?.split(', ') ?? [];
+    return names.includes(`URI:${PUBLISHER}`);
+}
+async function verifySignature(bundle) {
+    if (!signedByPublisher(bundle))
+        throw new Error(`the provenance was not signed for ${PUBLISHER}; refused`);
+    const sigstore = loadSigstore();
+    const tuf = mkdtempSync(join(tmpdir(), 'metro-tuf-'));
+    try {
+        await sigstore.verify(bundle, { certificateIdentityURI: PUBLISHER, certificateIssuer: ISSUER, tufCachePath: tuf });
+    }
+    catch (err) {
+        throw new Error(`the provenance signature does not check out: ${err instanceof Error ? err.message : String(err)}; refused`);
+    }
+    finally {
+        rmSync(tuf, { recursive: true, force: true });
+    }
+}
+function checked(file, args, cwd = '/') {
+    const run = spawnSync(file, args, { cwd, env: { PATH: ROOT_PATH }, stdio: ['ignore', 'inherit', 'inherit'] });
+    if (run.error !== undefined)
+        throw run.error;
+    if (run.status !== 0)
+        throw new Error(`${file} ${args.join(' ')} failed (exit ${String(run.status)})`);
+}
+function manifestVersion(dir) {
+    const file = join(dir, 'package.json');
+    if (!existsSync(file))
+        return null;
+    const raw = JSON.parse(readFileSync(file, 'utf8'));
+    return isRecord(raw) && raw.name === PACKAGE_NAME && typeof raw.version === 'string' && isVersion(raw.version) ? raw.version : null;
+}
+function unpack(tarball, version) {
+    const work = mkdtempSync(join(tmpdir(), 'metro-release-'));
+    const staged = `${RELEASE_DIR}.new`;
+    try {
+        const file = join(work, 'metro.tgz');
+        writeFileSync(file, tarball, { mode: 0o600 });
+        rmSync(staged, { recursive: true, force: true });
+        mkdirSync(staged, { recursive: true, mode: 0o755 });
+        checked('tar', ['-xzf', file, '-C', staged, '--strip-components=1', '--no-same-owner', '--no-same-permissions']);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+    if (manifestVersion(staged) !== version)
+        throw new Error(`the unpacked package is not ${PACKAGE_NAME}@${version}; refused`);
+    return staged;
+}
+function findBun() {
+    const found = ROOT_PATH.split(':')
+        .map((dir) => join(dir, 'bun'))
+        .find((path) => existsSync(path));
+    if (found === undefined)
+        throw new Error(`no bun on ${ROOT_PATH}`);
+    return mustBeRootOwned(found, 'bun');
+}
+function setup(dir) {
+    const node = mustBeRootOwned(process.execPath, 'node');
+    checked(findBun(), ['--no-install', join(dir, SETUP), '--node', node]);
+}
+function swap(staged) {
+    const old = `${RELEASE_DIR}.old`;
+    rmSync(old, { recursive: true, force: true });
+    if (existsSync(RELEASE_DIR))
+        renameSync(RELEASE_DIR, old);
+    renameSync(staged, RELEASE_DIR);
+    rmSync(old, { recursive: true, force: true });
+}
+export function realReleaseDeps() {
+    process.umask(0o022);
+    mkdirSync(dirname(RELEASE_DIR), { recursive: true, mode: 0o755 });
+    return {
+        installed: () => manifestVersion(RELEASE_DIR),
+        published,
+        download,
+        attestations: (version) => getJson(`${REGISTRY}/-/npm/v1/attestations/${ENCODED}@${version}`),
+        verifySignature,
+        unpack,
+        setup,
+        swap,
+        out: (line) => {
+            process.stderr.write(`metro root: ${line}\n`);
+        },
+    };
+}

package/dist/root-release.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { isRecord } from './background.js';
+import { compareVersions, PACKAGE_NAME } from './version.js';
+export const RELEASE_DIR = '/usr/local/lib/metro/release';
+export const PUBLISHER = 'https://github.com/bonustrack/metro/.github/workflows/publish-cli.yml@refs/heads/main';
+export const ISSUER = 'https://token.actions.githubusercontent.com';
+const REGISTRY = 'https://registry.npmjs.org';
+const PROVENANCE = 'https://slsa.dev/provenance/v1';
+const IN_TOTO = 'application/vnd.in-toto+json';
+const VERSION_RE = /^\d{1,9}\.\d{1,9}\.\d{1,9}(?:-[0-9A-Za-z]{1,20}(?:\.[0-9A-Za-z]{1,20}){0,4})?$/;
+export const isVersion = (raw) => VERSION_RE.test(raw);
+export const tarballUrl = (version) => `${REGISTRY}/${PACKAGE_NAME}/-/metro-${version}.tgz`;
+const subjectName = (version) => `pkg:npm/${PACKAGE_NAME.replace('@', '%40')}@${version}`;
+function provenanceBundle(body, version) {
+    const list = isRecord(body) && Array.isArray(body.attestations) ? body.attestations : [];
+    const entry = list.find((a) => isRecord(a) && a.predicateType === PROVENANCE);
+    if (!isRecord(entry) || !isRecord(entry.bundle))
+        throw new Error(`${PACKAGE_NAME}@${version} has no build provenance on npm; refused`);
+    return entry.bundle;
+}
+function statementOf(bundle) {
+    const envelope = bundle.dsseEnvelope;
+    if (!isRecord(envelope) || envelope.payloadType !== IN_TOTO || typeof envelope.payload !== 'string')
+        throw new Error('the provenance is not a signed in-toto statement; refused');
+    const statement = JSON.parse(Buffer.from(envelope.payload, 'base64').toString('utf8'));
+    if (!isRecord(statement))
+        throw new Error('the provenance statement is unreadable; refused');
+    return statement;
+}
+export function provenanceNames(statement, version, sha512) {
+    const subjects = Array.isArray(statement.subject) ? statement.subject : [];
+    return (statement.predicateType === PROVENANCE &&
+        subjects.some((s) => isRecord(s) && s.name === subjectName(version) && isRecord(s.digest) && s.digest.sha512 === sha512));
+}
+async function checkProvenance(version, tarball, deps) {
+    const bundle = provenanceBundle(await deps.attestations(version), version);
+    await deps.verifySignature(bundle);
+    const sha512 = createHash('sha512').update(tarball).digest('hex');
+    if (!provenanceNames(statementOf(bundle), version, sha512))
+        throw new Error(`the signed provenance does not name this tarball of ${PACKAGE_NAME}@${version}; refused`);
+}
+async function fetchChecked(version, trigger, deps) {
+    const published = await deps.published(version);
+    if (trigger === 'metro' && published.tags.beta !== version && published.tags.latest !== version)
+        throw new Error(`${version} is not what the beta or latest tag of ${PACKAGE_NAME} points to now; refused`);
+    if (published.tarball !== tarballUrl(version))
+        throw new Error(`npm names an unexpected tarball for ${version}: ${published.tarball}; refused`);
+    const tarball = await deps.download(published.tarball);
+    if (`sha512-${createHash('sha512').update(tarball).digest('base64')}` !== published.integrity)
+        throw new Error(`the tarball of ${version} does not match the sha512 npm publishes for it; refused`);
+    await checkProvenance(version, tarball, deps);
+    return tarball;
+}
+export async function installRelease(version, trigger, deps) {
+    if (!isVersion(version))
+        throw new Error(`'${version}' is not a ${PACKAGE_NAME} version`);
+    const have = deps.installed();
+    if (have !== null && compareVersions(version, have) <= 0) {
+        if (trigger === 'metro') {
+            deps.out(`the root side is at ${have}, and ${version} is not newer: nothing to do`);
+            return 'current';
+        }
+        deps.setup(RELEASE_DIR);
+        deps.out(`the root side stays at ${have} (it never goes back) and its root setup ran again`);
+        return 'refreshed';
+    }
+    deps.out(`checking ${PACKAGE_NAME}@${version} (npm sha512 and the GitHub provenance of ${PUBLISHER})`);
+    const tarball = await fetchChecked(version, trigger, deps);
+    const staged = deps.unpack(tarball, version);
+    deps.setup(staged);
+    deps.swap(staged);
+    deps.out(`the root side is now ${PACKAGE_NAME}@${version}, verified, in ${RELEASE_DIR}`);
+    return 'installed';
+}

package/dist/service.js

@@ -3,9 +3,12 @@ import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, platform, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { serveLockedBy } from './control.js';
-import { findBun, runtimeDir } from './runtime.js';
+import { installRelease } from './root-release.js';
+import { realReleaseDeps } from './root-release-io.js';
+import { findBun } from './runtime.js';
 import { findTailscale, parseServeArgs, requireOwner } from './serve.js';
-const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] [--user metro] | uninstall | status';
+import { currentVersion } from './version.js';
+const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] [--user metro] | uninstall | status | root-upgrade <version> (root only)';
 const SERVICE = 'metro';
 const LABEL = 'box.metro.serve';
 const CARRIED = /^(METRO_.*|XDG_CACHE_HOME|PATH|HOME)$/;
@@ -110,7 +113,7 @@ function systemdPlan(host, serveArgs, runAs) {
         file,
         content: runAs === undefined ? systemdUnit(host, exec, system ? 'multi-user.target' : 'default.target') : runAsUnit(host, runAs, serveArgs),
         dirs: [],
-        install: [...(runAs === undefined ? [] : [{ args: ['bun', runAs.helper] }]), { args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
+        install: [{ args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
         uninstall: [{ args: [...ctl, 'disable', '--now', SERVICE], mayFail: true }],
         reload: [{ args: [...ctl, 'daemon-reload'], mayFail: true }],
         status: { args: [...ctl, 'is-active', SERVICE], mayFail: true },
@@ -176,18 +179,31 @@ function runAsOf(name, deps) {
     const account = deps.account(name);
     if (account === null)
         throw new Error(`there is no user ${name} on this machine; create it first (useradd --system --create-home --home-dir /var/lib/${name} ${name})`);
-    return { ...account, helper: deps.helperEntry() };
+    return account;
+}
+async function refreshRoot(plan, deps) {
+    await deps.release(deps.version, 'root');
+    deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}); its root side is current and follows every update by itself from now on, and the service keeps running`);
+    return 0;
+}
+function writeService(plan, deps) {
+    for (const dir of plan.dirs)
+        deps.mkdir(dir);
+    deps.write(plan.file, plan.content);
+    for (const command of plan.install)
+        deps.run(command);
+    deps.out(`Installed ${plan.file}: metro serve now starts at boot and after a crash, and the Server page on metro.box can stop, start and restart it.`);
+    for (const hint of plan.hints)
+        deps.out(hint);
+    return 0;
 }
 function install(argv, deps) {
     const { user, rest: serveArgs } = splitUser(argv);
     const args = parseServeArgs(serveArgs);
     const runAs = runAsOf(user, deps);
     const plan = servicePlan(deps.host, serveArgs, runAs);
-    if (deps.exists(plan.file) && runAs !== undefined) {
-        deps.run({ args: ['bun', runAs.helper] });
-        deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}); its root helper, sudo rules and metadata guard are now current, and the service keeps running`);
-        return 0;
-    }
+    if (deps.exists(plan.file) && runAs !== undefined)
+        return refreshRoot(plan, deps);
     if (deps.exists(plan.file)) {
         deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}) and restarts on its own; metro service status says whether it is running. To change its arguments: metro service uninstall, then install again`);
         return 0;
@@ -196,14 +212,14 @@ function install(argv, deps) {
     const pid = deps.running();
     if (pid !== null)
         throw new Error(`a metro serve is running on this machine (pid ${String(pid)}). Stop it first (metro stop), then install: the service takes over from there`);
-    for (const dir of plan.dirs)
-        deps.mkdir(dir);
-    deps.write(plan.file, plan.content);
-    for (const command of plan.install)
-        deps.run(command);
-    deps.out(`Installed ${plan.file}: metro serve now starts at boot and after a crash, and the Server page on metro.box can stop, start and restart it.`);
-    for (const hint of plan.hints)
-        deps.out(hint);
+    if (runAs === undefined)
+        return writeService(plan, deps);
+    return deps.release(deps.version, 'root').then(() => writeService(plan, deps));
+}
+async function rootUpgrade(version, deps) {
+    if (deps.host.platform !== 'linux' || deps.host.uid !== 0)
+        throw new Error('metro service root-upgrade is for root on Linux; the metro-root-upgrade unit runs it');
+    await deps.release(version, 'metro');
     return 0;
 }
 function uninstall(deps) {
@@ -275,7 +291,8 @@ function realDeps() {
         },
         running: serveLockedBy,
         account: lookupAccount,
-        helperEntry: () => join(runtimeDir(), 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts'),
+        version: currentVersion(),
+        release: (version, trigger) => installRelease(version, trigger, realReleaseDeps()),
         preflight: (args, agents) => {
             requireOwner(args, agents);
             findBun();
@@ -305,5 +322,7 @@ export function service(argv, deps = realDeps()) {
         return Promise.resolve(uninstall(deps));
     if (verb === 'status' && rest.length === 0)
         return Promise.resolve(status(deps));
+    if (verb === 'root-upgrade' && rest.length === 1)
+        return rootUpgrade(rest[0] ?? '', deps);
     throw new Error(USAGE);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.246",
+  "version": "0.1.0-beta.248",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.246",
+  "version": "0.1.0-beta.248",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/STAGE.md

@@ -1,6 +1,6 @@
 ---
 name: stage
-description: How to use Stage channels (XMTP groups, https://stage.box) through metro. Create a channel, rename it, add or remove members, set labels and assignees, read its info, and send, reply, react, unreact, delete and read messages, and post frames (interactive ChatKit widget views). Works only when this agent has an XMTP account in metro.
+description: How to use Stage channels (XMTP groups, https://stage.box) through metro. Create a channel, rename it, add or remove members, set labels and assignees, read its info, and send, reply, react, unreact, delete and read messages, and post frames (interactive ChatKit widget views) and wallet cards (payment and signature requests, receipts). Works only when this agent has an XMTP account in metro.
 ---
 
 Stage (https://stage.box) is a messenger built on XMTP. A Stage channel is an XMTP group. You use it with the metro tools below (`mcp__metro__<name>`).
@@ -73,3 +73,17 @@ Move it from Backlog or To-do to In progress, then In review, then Done. Use Blo
     ]}}
   }}}
   ```
+
+**Wallet cards.** The payment and signature cards Stage's own Request payment and Request signature send. Sending one moves nothing and signs nothing: the person taps Pay or Sign and confirms in Stage. Send one only when you were asked to.
+- Send: `send {"line": "…", "wallet": {"type": "<type>", "content": {…}}}`. With `text` or a `frame` as well, the card goes last, and the `message_id` you get back is the card's.
+- Payment request, `walletSendCalls`, a card with a Pay button. Stage pays a request with one call; a Stage wallet pays on Base only.
+  ```json
+  {"type": "walletSendCalls", "content": {"version": "1.0", "chainId": "0x2105", "from": "0x<your address>", "calls": [
+    {"to": "0x<who gets paid>", "value": "0x38d7ea4c68000", "metadata": {"description": "Dinner", "transactionType": "transfer",
+      "currency": "ETH", "amount": 0.001, "decimals": 18, "toAddress": "0x<who gets paid>"}}
+  ]}}
+  ```
+  `chainId` is a hex string (`0x2105` is Base) and `value` is in wei, hex. For a token, `to` is the token contract, `data` its `transfer(address,uint256)` call data, `value` is left out, and `metadata` has `currency`, `amount` and `toAddress` (who gets paid).
+- Receipt, `transactionReference`: `{"networkId": 8453, "reference": "0x<tx hash>", "metadata": {"currency": "USDC", "amount": 5}}`. Stage shows "Payment sent · 5 USDC" (or "Transaction sent" without an amount) and a link to the explorer. Only post a real transaction hash.
+- Signature request, `signatureRequest`, a card with a Sign button: `{"id": "<any id>", "kind": "personal", "message": "The text to sign", "description": "Why"}`, or `"kind": "eip712"` with `"eip712": {"domain", "types", "primaryType", "message"}` instead of `message`.
+- Signature, `signatureReference`: `{"requestId": "<message_id of the request>", "signature": "0x…", "signer": "0x…"}`. Stage shows it as Signed.

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -27,6 +27,7 @@ import { runningAsRoot } from '../metro-user/privilege.js';
 import { provisionAgentUser } from '../agent-user/provision.js';
 import { applyVault } from '../vault/index.js';
 import { blockImds } from '../metro-user/imds.js';
+import { followRelease } from '../metro-user/root-follow.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
 import { liveEvents, memoryRoutine, tryClaudeSetup } from '../claude/setup.js';
 import { tryMemoryJob } from '../claude/memory-routine.js';
@@ -174,6 +175,7 @@ async function startClaude(): Promise<void> {
   if (agentUser === 'failed') return;
   if (agentUser === 'ready') {
     blockImds();
+    followRelease();
     const vault = (await applyVault()).status;
     if (vault.enabled) log.info({ running: vault.running, problem: vault.problem }, 'vault: the agent reaches the internet through the vault');
   }

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -166,6 +166,7 @@ const PRIOR_STAGE: ReadonlySet<string> = new Set([
   'e3b8f9bbdb205311bc643aaf91d9d903a91204fd5b55ca949b85cdfa6fd00136',
   '08a30f5cd5cf8013ab70c1fa9e1109018c0337552296a8efe5c0cf543b284991',
   'f87e9494ea6151d140b742c1b88b4f435ae653559be641fddc2160cd24dd4e1b',
+  'cb4307b016855c1a09d48bc8b3924a3080bd78b205963df3d6f20401d0486df9',
 ]);
 const PRIOR_MEMORY: ReadonlySet<string> = new Set(['08795399635c8cdec2b50cb4e336f89ae880f3997ae52560ef647a9cdc8f1b08']);
 

package/runtime/node_modules/@metro-labs/daemon/src/mcp/call-tools.ts

@@ -60,16 +60,20 @@ function assertDelivered(
     );
 }
 
-const frameOf = (m: MessageArgs): Record<string, unknown> =>
-  m.a.frame === undefined ? {} : { frame: m.a.frame };
+const STAGE_PARTS = ['frame', 'wallet'] as const;
+
+const stagePartsIn = (m: MessageArgs): string[] => STAGE_PARTS.filter((key) => m.a[key] !== undefined);
+
+const stagePartArgs = (m: MessageArgs): Record<string, unknown> =>
+  Object.fromEntries(stagePartsIn(m).map((key) => [key, m.a[key]]));
 
 const sentLabels = (m: MessageArgs, text: string | undefined): string[] => [
   ...(text ? ['text'] : []),
-  ...(m.a.frame === undefined ? [] : ['frame']),
+  ...stagePartsIn(m),
 ];
 
 function nativeBody(m: MessageArgs, text: string | undefined, replyTo: string | undefined): Record<string, unknown> {
-  const body: Record<string, unknown> = { line: m.line, ...frameOf(m) };
+  const body: Record<string, unknown> = { line: m.line, ...stagePartArgs(m) };
   if (text) body.text = text;
   if (text && replyTo) body.replyTo = replyTo;
   return body;
@@ -101,7 +105,7 @@ async function sendForwarded(
   atts: ResolvedAttachment[],
 ): Promise<Sent> {
   const { line, ctx, station } = m;
-  const args: Record<string, unknown> = { line, ...frameOf(m) };
+  const args: Record<string, unknown> = { line, ...stagePartArgs(m) };
   if (text) args.text = text;
   if (typeof m.a.subject === 'string' && m.a.subject.trim() !== '') args.subject = m.a.subject;
   if (replyTo) args.replyTo = replyTo;
@@ -123,12 +127,13 @@ const unsupported = (station: Station, atts: CanonicalAttachment[]): string =>
     .map((a) => kindOf(a.mime ?? '', a.path ?? a.url ?? a.name ?? ''))
     .join(', ')}); send a link in \`text\` instead`;
 
-const NOTHING_TO_SEND = 'send requires `text`, `attachments` or `frame`';
+const NOTHING_TO_SEND = 'send requires `text`, `attachments`, `frame` or `wallet`';
 
 function refusal(m: MessageArgs, text: string | undefined, requested: CanonicalAttachment[]): string | undefined {
-  if (!text && !requested.length && m.a.frame === undefined) return NOTHING_TO_SEND;
-  if (m.a.frame !== undefined && m.station.sendsFrames !== true)
-    return `${m.station.name} cannot send a frame; frames are Stage (XMTP) only`;
+  const stageOnly = stagePartsIn(m);
+  if (!text && !requested.length && !stageOnly.length) return NOTHING_TO_SEND;
+  if (stageOnly.length && m.station.sendsFrames !== true)
+    return `${m.station.name} cannot send \`${stageOnly.join('` or `')}\`; that is Stage (XMTP) only`;
   if (requested.length && m.station.attachmentMode === 'none') return unsupported(m.station, requested);
   return undefined;
 }

package/runtime/node_modules/@metro-labs/daemon/src/mcp/permission-prompt.ts

@@ -45,7 +45,7 @@ function argText(value: unknown): string | undefined {
 
 function fieldText(key: string, value: unknown): string | undefined {
   if (key === 'attachments' && Array.isArray(value)) return `${String(value.length)} file(s)`;
-  return key === 'frame' ? argText(value) : valueText(value);
+  return key === 'frame' || key === 'wallet' ? argText(value) : valueText(value);
 }
 
 function metroLines(tool: string, input: Record<string, unknown>): string[] {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/tool-schemas.ts

@@ -34,7 +34,7 @@ export const COMMON_TOOLS: ToolDef[] = [
     group: 'write',
     description:
       'Send a message (and/or media) to a Metro conversation. Args: line, text?, reply_to?, ' +
-      'subject?, attachments?, frame?. The station is derived from the line. Outlook and Gmail: send to ' +
+      'subject?, attachments?, frame?, wallet?. The station is derived from the line. Outlook and Gmail: send to ' +
       'metro://<outlook|gmail>/<account>/<email address> to start a new email (subject defaults to the ' +
       'first line of text); the result names the new thread line. Each attachment names EXACTLY ONE ' +
       'source, and the choice matters: `upload` (an `upload_id` from `create_upload`, the ' +
@@ -42,8 +42,8 @@ export const COMMON_TOOLS: ToolDef[] = [
       '`data` (base64 inline -- TINY FILES ONLY, a few KB, because the base64 has to be ' +
       'written out verbatim in the call and longer than that it corrupts); `url` (the daemon ' +
       'fetches it, so the file must already be public); `path` (resolved on the DAEMON host, ' +
-      'which is not your machine). Stage (XMTP) only: `frame` posts an interactive view. At least one ' +
-      'of text/attachments/frame is required. ' +
+      'which is not your machine). Stage (XMTP) only: `frame` posts an interactive view, `wallet` a payment ' +
+      'or signature card. At least one of text/attachments/frame/wallet is required. ' +
       'The success line names each attachment the station actually delivered; a station that ' +
       'cannot carry a file errors instead of reporting success.',
     inputSchema: {
@@ -99,6 +99,23 @@ export const COMMON_TOOLS: ToolDef[] = [
             description: { type: 'string', description: 'Card description in the chat (1000 characters at most).' },
           },
         },
+        wallet: {
+          type: 'object',
+          description:
+            'Stage (XMTP) only: a wallet card. `type` walletSendCalls is a payment request with a Pay button, ' +
+            'transactionReference a payment receipt with an explorer link, signatureRequest a Sign button, ' +
+            'signatureReference a signed proof. `content` is that type\'s JSON as Stage reads it; the stage skill ' +
+            'has an example of each. Sending it moves nothing: the person taps Pay or Sign and confirms in Stage. ' +
+            "It is sent after the text and any frame, and the message_id returned is the card's.",
+          properties: {
+            type: {
+              type: 'string',
+              enum: ['walletSendCalls', 'transactionReference', 'signatureRequest', 'signatureReference'],
+            },
+            content: { type: 'object', description: 'The JSON of that content type.', additionalProperties: true },
+          },
+          required: ['type', 'content'],
+        },
       },
       required: ['line'],
     },

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -1,10 +1,16 @@
-export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
-const HELPER_VERSION = 2;
+const ROOT_DIR = '/usr/local/lib/metro';
+export const HELPER_PATH = `${ROOT_DIR}/root-helper`;
+const HELPER_VERSION = 3;
 export const SUDOERS_PATH = '/etc/sudoers.d/metro';
 export const IMDS_UNIT = 'metro-imds.service';
 export const IMDS_UNIT_PATH = `/etc/systemd/system/${IMDS_UNIT}`;
+export const UPGRADE_UNIT = 'metro-root-upgrade@.service';
+export const UPGRADE_UNIT_PATH = `/etc/systemd/system/${UPGRADE_UNIT}`;
+const RELEASE_DIR = `${ROOT_DIR}/release`;
 export const METRO_USER = 'metro';
 const METRO_HOME = '/var/lib/metro';
+const VAULT_DROP_IN = '11-metro-vault.conf';
+const PRIVILEGED_EXEC = ['ExecConditionEx', 'ExecStartPreEx', 'ExecStartEx', 'ExecStartPostEx', 'ExecReloadEx', 'ExecStopEx', 'ExecStopPostEx'];
 
 export const sudoersText = (agent: string): string =>
   [
@@ -22,31 +28,23 @@ const CHECKS = lines(
   'die() { echo "root-helper: $*" >&2; exit 2; }',
   'agent_uid() { id -u "$AGENT" 2>/dev/null || die "no agent user"; }',
   'service_ok() {',
-  '  printf %s "$1" | grep -Eq "^[A-Za-z0-9@_.-]+\\.service$" || die "bad service name"',
+  '  case "$1" in [!A-Za-z0-9]*|*[!A-Za-z0-9@_.-]*|"") die "bad service name";; esac',
+  '  case "$1" in *.service) ;; *) die "bad service name";; esac',
   '  case "$1" in metro*) die "not a metro unit";; esac',
   '  frag=$(systemctl show "$1" -p FragmentPath --value)',
   '  case "$frag" in "$UNITS"/*) ;; *) die "not a unit under $UNITS";; esac',
   '  systemctl show "$1" -p TriggeredBy --value | grep -q "\\.timer" || die "not started by a timer"',
   '}',
+  'agent_only() {',
+  '  [ "$(systemctl show "$1" -p User --value)" = "$AGENT" ] || die "that job does not run as $AGENT"',
+  '  [ "$(systemctl show "$1" -p PermissionsStartOnly --value)" != yes ] || die "that job runs commands as root"',
+  '  [ -n "$(systemctl show "$1" -p ExecStartEx --value)" ] || die "cannot read the commands of that job"',
+  `  if systemctl show "$1" ${PRIVILEGED_EXEC.map((p) => `-p ${p}`).join(' ')} --value | grep -Eq "flags=[^;]*(privileged|no-setuid|ambient)"; then die "that job runs commands as root"; fi`,
+  '}',
   'dropin_ok() {',
-  '  case "$1" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  `  [ "$1" = ${VAULT_DROP_IN} ] || die "bad drop-in name"`,
   '  home=$(getent passwd "$AGENT" | cut -d: -f6)',
-  '  saw_user=0',
-  '  while IFS= read -r line; do',
-  '    case "$line" in',
-  '      "[Service]"|"") ;;',
-  '      "User=$AGENT") saw_user=1 ;;',
-  '      Group=*) printf %s "${line#Group=}" | grep -Eq "^[0-9]+$" || die "bad group" ;;',
-  '      "WorkingDirectory=$home"|"WorkingDirectory=$home"/*) ;;',
-  '      Environment=*) ;;',
-  '      "EnvironmentFile=-$home/.metro/vault.env") ;;',
-  '      "ExecStart=") ;;',
-  '      ExecStart=[+!@]*) die "privileged ExecStart refused" ;;',
-  '      ExecStart=*) ;;',
-  '      *) die "line not allowed: $line" ;;',
-  '    esac',
-  '  done < "$2"',
-  '  if [ "$1" = 10-metro-agent.conf ] && [ "$saw_user" != 1 ]; then die "the drop-in must set User=$AGENT"; fi',
+  '  printf \'[Service]\\nEnvironmentFile=-%s/.metro/vault.env\\n\' "$home" | cmp -s - "$2" || die "only the vault environment file may be added"',
   '}',
 );
 
@@ -112,6 +110,20 @@ export const imdsUnitText = (): string =>
     '',
   );
 
+export const upgradeUnitText = (node: string): string =>
+  lines(
+    '[Unit]',
+    'Description=Metro: bring the root side to Metro %i, checked against npm and its GitHub provenance',
+    'After=network-online.target',
+    'Wants=network-online.target',
+    '',
+    '[Service]',
+    'Type=oneshot',
+    `ExecStart=/usr/bin/flock ${ROOT_DIR} ${node} ${RELEASE_DIR}/dist/cli.js service root-upgrade %i`,
+    'TimeoutStartSec=900',
+    '',
+  );
+
 const ACTIONS = lines(
   'action="${1:-}"; [ "$#" -gt 0 ] && shift',
   'case "$action" in',
@@ -126,10 +138,10 @@ const ACTIONS = lines(
   '    uid=$(agent_uid); gid=$(id -g "$AGENT")',
   '    exec systemd-run --scope --quiet --collect --unit="metro-claude-$(date +%s%N)" -p MemoryMax="$max" -p MemoryHigh="$high" -p OOMPolicy=continue -- setpriv --reuid="$uid" --regid="$gid" --init-groups -- "$@" ;;',
   '  dropin-write)',
-  '    service_ok "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; cat > "$tmp"; dropin_ok "$2" "$tmp"',
+  '    service_ok "$1"; agent_only "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; head -c 4096 > "$tmp"; dropin_ok "$2" "$tmp"',
   '    mkdir -p "$UNITS/$1.d"; install -m 644 "$tmp" "$UNITS/$1.d/$2" ;;',
   '  dropin-remove)',
-  '    service_ok "$1"; case "$2" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  `    service_ok "$1"; [ "$2" = ${VAULT_DROP_IN} ] || die "bad drop-in name"`,
   '    rm -f "$UNITS/$1.d/$2" ;;',
   '  daemon-reload) systemctl daemon-reload ;;',
   '  start-job)',
@@ -149,6 +161,11 @@ const ACTIONS = lines(
   '    install -m 600 "$cur" "$backups/crontab-root.$(date +%Y-%m-%dT%H-%M-%S).bak"',
   '    crontab -u root "$kept"; rm -f "$cur" "$kept" ;;',
   '  imds-block) imds_block ;;',
+  '  upgrade)',
+  '    [ "$#" -eq 1 ] || die "usage: upgrade <version>"',
+  '    case "$1" in *[!0-9A-Za-z.-]*|"") die "bad version";; esac',
+  '    printf %s "$1" | grep -Eqx "[0-9]{1,9}\\.[0-9]{1,9}\\.[0-9]{1,9}(-[0-9A-Za-z]{1,20}(\\.[0-9A-Za-z]{1,20}){0,4})?" || die "bad version"',
+  `    systemctl start --no-block "${UPGRADE_UNIT.replace('@.', '@$1.')}" ;;`,
   '  firewall-on) firewall_on ;;',
   '  firewall-off) firewall_off ;;',
   '  trust-ca)',

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/imds.ts

@@ -1,7 +1,6 @@
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import { log } from '@metro-labs/core/log';
-import { rootHelper, type HelperResult } from './privilege.js';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { rootHelper, rootStepHint, type HelperResult } from './privilege.js';
 
 export function blockImds(run: (args: string[]) => HelperResult = rootHelper): boolean {
   const result = run(['imds-block']);
@@ -10,7 +9,7 @@ export function blockImds(run: (args: string[]) => HelperResult = rootHelper): b
     return true;
   }
   log.warn(
-    { err: result.stderr.trim(), fix: `as root: ${join(homedir(), '.npm-global', 'bin', 'metro')} service install --user metro` },
+    { err: result.stderr.trim(), fix: rootStepHint(METRO_VERSION) },
     'imds: the agent can still read the instance metadata (setup data, instance role), since the root helper on this box predates the guard',
   );
   return false;

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/install.ts

@@ -2,7 +2,17 @@ import { spawnSync } from 'node:child_process';
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { HELPER_PATH, helperScript, IMDS_UNIT, IMDS_UNIT_PATH, imdsUnitText, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import {
+  HELPER_PATH,
+  helperScript,
+  IMDS_UNIT,
+  IMDS_UNIT_PATH,
+  imdsUnitText,
+  SUDOERS_PATH,
+  sudoersText,
+  UPGRADE_UNIT_PATH,
+  upgradeUnitText,
+} from './helper-script.js';
 import { AGENT_NAME } from '../agent-user/user.js';
 
 interface InstallPaths {
@@ -41,8 +51,28 @@ export function installImdsGuard(unit: string = IMDS_UNIT_PATH, run: Run = check
   run('systemctl', ['restart', IMDS_UNIT]);
 }
 
+const PLAIN_PATH = /^\/[A-Za-z0-9_./+-]+$/;
+
+export function installUpgradeUnit(node: string, unit: string = UPGRADE_UNIT_PATH, run: Run = checked): void {
+  if (!PLAIN_PATH.test(node)) throw new Error(`the root upgrade needs node by a plain absolute path, not '${node}'`);
+  writeFileSync(unit, upgradeUnitText(node), { mode: 0o644 });
+  chmodSync(unit, 0o644);
+  run('systemctl', ['daemon-reload']);
+}
+
+export function nodeArg(argv: string[]): string {
+  const at = argv.indexOf('--node');
+  const node = at < 0 ? undefined : argv[at + 1];
+  if (node === undefined) throw new Error('usage: install.ts --node <absolute path of the node that runs the root upgrade>');
+  return node;
+}
+
 if (import.meta.main) {
+  const node = nodeArg(process.argv.slice(2));
   installRootHelper();
   installImdsGuard();
-  process.stdout.write(`metro: wrote ${HELPER_PATH}, ${SUDOERS_PATH} and ${IMDS_UNIT_PATH}; only root and metro reach the instance metadata service\n`);
+  installUpgradeUnit(node);
+  process.stdout.write(
+    `metro: wrote ${HELPER_PATH}, ${SUDOERS_PATH}, ${IMDS_UNIT_PATH} and ${UPGRADE_UNIT_PATH}; only root and metro reach the instance metadata service, and the root side follows every update\n`,
+  );
 }

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/privilege.ts

@@ -46,3 +46,5 @@ export function mustHelper(args: string[], input?: string): string {
 }
 
 export const helperArgv = (args: string[]): [string, string[]] => ['sudo', ['-n', HELPER_PATH, ...args]];
+
+export const rootStepHint = (version: string): string => `as root, once: npx -y @stage-labs/metro@${version} service install --user metro`;

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/root-follow.ts

@@ -0,0 +1,16 @@
+import { log } from '@metro-labs/core/log';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { rootHelper, rootStepHint, type HelperResult } from './privilege.js';
+
+export function followRelease(run: (args: string[]) => HelperResult = rootHelper, version: string = METRO_VERSION): boolean {
+  const result = run(['upgrade', version]);
+  if (result.status === 0) {
+    log.info({ version, journal: `journalctl -u metro-root-upgrade@${version}` }, 'root: asked the root side to follow this version');
+    return true;
+  }
+  log.warn(
+    { err: result.stderr.trim(), fix: rootStepHint(version) },
+    'root: the root side cannot follow updates by itself yet, since the root helper on this box predates it',
+  );
+  return false;
+}

package/runtime/node_modules/@metro-labs/xmtp/src/actions.ts

@@ -9,11 +9,13 @@ import {
   AttachmentCodec,
   type Attachment,
 } from '@xmtp/content-type-remote-attachment';
+import type { EncodedContent } from '@xmtp/content-type-primitives';
 import { convOf, type Account } from './accounts.js';
 import { resolveMsgId } from './wire.js';
 import { emitOutbound } from './emit.js';
 import { CallSignalCodec, FrameCodec, PollCodec, buildPollContent, encodeDeleteMessage } from './codecs.js';
 import { buildFrameContent } from './frames.js';
+import { buildWalletContent } from './wallet.js';
 import { callLeftovers } from './call-leftovers.js';
 import { convHandlers } from './actions-conv.js';
 import { messagingAliases } from '@metro-labs/core/stations/messaging-normalize';
@@ -30,19 +32,27 @@ const noConv = (line: string): TrainError =>
 const badArgs = (message: string): TrainError =>
   new TrainError('INVALID_ARGS', message);
 
+function framePart(raw: unknown): { encoded: EncodedContent; summary: string } {
+  const built = buildFrameContent(raw);
+  return { encoded: new FrameCodec().encode(built.frame), summary: `Frame: ${built.title}` };
+}
+
 async function send(id: string, args: Args): Promise<void> {
   const { line, text } = args as { line: string; text: string };
-  const built = args.frame === undefined ? undefined : buildFrameContent(args.frame);
+  const parts = [
+    ...(args.frame === undefined ? [] : [framePart(args.frame)]),
+    ...(args.wallet === undefined ? [] : [buildWalletContent(args.wallet)]),
+  ];
   const { acct, conv } = await convOf(line);
   if (!conv) throw noConv(line);
   let messageId: string | undefined;
-  if (text || !built) {
+  if (text || parts.length === 0) {
     messageId = await conv.sendText(text);
     emitOutbound(acct.cfg.id, line, messageId, text);
   }
-  if (built) {
-    messageId = await conv.send(new FrameCodec().encode(built.frame));
-    emitOutbound(acct.cfg.id, line, messageId, `Frame: ${built.title}`);
+  for (const part of parts) {
+    messageId = await conv.send(part.encoded);
+    emitOutbound(acct.cfg.id, line, messageId, part.summary);
   }
   respond(id, { result: { messageId } });
 }

package/runtime/node_modules/@metro-labs/xmtp/src/codecs.ts

@@ -166,6 +166,24 @@ export const SignatureReferenceCodec =
     c.signature ? `[Signature] ${c.signature}` : '[Signature]',
   );
 
+const xmtpOrg = (typeId: string): ContentTypeId => ({
+  authorityId: 'xmtp.org',
+  typeId,
+  versionMajor: 1,
+  versionMinor: 0,
+});
+export const WalletSendCallsCodec = makeJsonCodec<{ calls?: { metadata?: { description?: string } }[] }>(
+  xmtpOrg('walletSendCalls'),
+  (c) => {
+    const desc = c.calls?.[0]?.metadata?.description;
+    return desc ? `[Transaction request] ${desc}` : '[Transaction request]';
+  },
+);
+export const TransactionReferenceCodec = makeJsonCodec<{ reference?: string }>(
+  xmtpOrg('transactionReference'),
+  (c) => (c.reference ? `[Transaction] ${c.reference}` : '[Transaction]'),
+);
+
 export const ContentTypeFrame: ContentTypeId = {
   authorityId: 'stage.box',
   typeId: 'frame',

package/runtime/node_modules/@metro-labs/xmtp/src/frames.ts

@@ -12,10 +12,10 @@ const TEXT_TYPES = new Set(['Text', 'Caption', 'Markdown']);
 
 type Node = Record<string, unknown>;
 
-const isNode = (v: unknown): v is Node =>
+export const isNode = (v: unknown): v is Node =>
   typeof v === 'object' && v !== null && !Array.isArray(v);
 
-const bad = (message: string): TrainError => new TrainError('INVALID_ARGS', message);
+export const bad = (message: string): TrainError => new TrainError('INVALID_ARGS', message);
 
 function plain(value: unknown): string {
   if (typeof value !== 'string') return '';
@@ -56,7 +56,7 @@ function clip(value: unknown, max: number, name: string): string | undefined {
   return out === '' ? undefined : out;
 }
 
-function parseJson(raw: unknown, name: string): unknown {
+export function parseJson(raw: unknown, name: string): unknown {
   if (typeof raw !== 'string') return raw;
   try {
     return JSON.parse(raw);

package/runtime/node_modules/@metro-labs/xmtp/src/wallet.ts

@@ -0,0 +1,28 @@
+import type { EncodedContent } from '@xmtp/content-type-primitives';
+import {
+  SignatureReferenceCodec,
+  SignatureRequestCodec,
+  TransactionReferenceCodec,
+  WalletSendCallsCodec,
+} from './codecs.js';
+import { bad, isNode, parseJson } from './frames.js';
+
+const WALLET_TYPES: Record<string, { codec: { encode(c: Record<string, unknown>): EncodedContent }; needs: string[] }> = {
+  walletSendCalls: { codec: new WalletSendCallsCodec(), needs: ['version', 'chainId', 'from', 'calls'] },
+  transactionReference: { codec: new TransactionReferenceCodec(), needs: ['networkId', 'reference'] },
+  signatureRequest: { codec: new SignatureRequestCodec(), needs: ['id', 'kind'] },
+  signatureReference: { codec: new SignatureReferenceCodec(), needs: ['requestId', 'signature', 'signer'] },
+};
+
+export function buildWalletContent(raw: unknown): { encoded: EncodedContent; summary: string } {
+  const args = parseJson(raw, 'wallet');
+  const type = isNode(args) && typeof args.type === 'string' ? args.type : '';
+  const spec = Object.hasOwn(WALLET_TYPES, type) ? WALLET_TYPES[type] : undefined;
+  if (!isNode(args) || !spec) throw bad(`wallet type must be one of ${Object.keys(WALLET_TYPES).join(', ')}`);
+  const content = parseJson(args.content, 'wallet content');
+  if (!isNode(content)) throw bad(`wallet content must be the ${type} JSON object`);
+  const missing = spec.needs.filter((key) => content[key] === undefined);
+  if (missing.length > 0) throw bad(`${type} content needs ${missing.join(', ')}`);
+  const encoded = spec.codec.encode(content);
+  return { encoded, summary: encoded.fallback ?? type };
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.246"
+  "version": "0.1.0-beta.248"
 }