@stage-labs/metro 0.1.0-beta.26 → 0.1.0-beta.261

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -1,308 +0,0 @@
-import { assertRenameFreeOfClash } from './connector-collections.js';
-import { projectIdOrThrow } from './projects.js';
-import { and, asc, eq, inArray } from 'drizzle-orm';
-import {
-  connectorUrlText,
-  ConnectorVerifyError,
-  parseConnectorUrl,
-  verifyRemoteMcp,
-  type ConnectorAuth,
-  type OAuthAuth,
-  type VerifiedRecord,
-} from '../daemon/connector-verify.js';
-import { oauthExpired, refreshOAuth } from '../daemon/connector-oauth.js';
-import { advertisesOAuth } from '../daemon/oauth-discovery.js';
-import {
-  ConnectorError,
-  connectorAuth,
-  connectorName,
-  readConfig,
-  signInState,
-  stamp,
-  type ConnectorConfig,
-  type ConnectorSignIn,
-} from './connector-config.js';
-import { newId } from './ids.js';
-import { getDb } from './client.js';
-import { connectors, type ConnectorTransport } from './schema.js';
-
-export interface Connector {
-  id: string;
-  name: string;
-  url: string;
-  transport: ConnectorTransport;
-  auth: ConnectorAuth['kind'];
-  header: string | null;
-  secret: string | null;
-  bearer: string | null;
-  expiresAt: number | null;
-  signIn: ConnectorSignIn;
-  verified: VerifiedRecord;
-}
-
-export interface ConnectorInput {
-  name: unknown;
-  url: unknown;
-  header: unknown;
-  value: unknown;
-}
-
-export type ConnectorCheck =
-  | { id: string; name: string; ok: true; verified: VerifiedRecord }
-  | { id: string; name: string; ok: false; reason: string };
-
-export interface DeletedConnector {
-  id: string;
-  name: string;
-}
-
-type ConnectorRow = typeof connectors.$inferSelect;
-
-function toConnector(row: ConnectorRow): Connector {
-  const config = readConfig(row.config);
-  const auth = config.auth;
-  return {
-    id: row.id,
-    name: row.name,
-    url: row.url,
-    transport: row.transport,
-    auth: auth.kind,
-    header: auth.kind === 'header' ? auth.name : null,
-    secret: auth.kind === 'header' ? auth.value : null,
-    bearer: auth.kind === 'oauth' ? auth.accessToken : null,
-    expiresAt: auth.kind === 'oauth' ? (auth.expiresAt ?? null) : null,
-    signIn: signInState(config),
-    verified: config.verified,
-  };
-}
-
-const missing = (): ConnectorError =>
-  new ConnectorError('no such connector', 404);
-
-async function ownedConnectorOrThrow(
-  email: string,
-  id: string,
-): Promise<ConnectorRow> {
-  const rows = await getDb()
-    .select()
-    .from(connectors)
-    .where(eq(connectors.id, id));
-  const row = rows[0];
-  if (row === undefined) throw missing();
-  try {
-    await projectIdOrThrow(email, row.projectId);
-  } catch {
-    throw missing();
-  }
-  return row;
-}
-
-async function saveConfig(
-  row: ConnectorRow,
-  config: ConnectorConfig,
-): Promise<Connector> {
-  const rows = await getDb()
-    .update(connectors)
-    .set({ config })
-    .where(and(eq(connectors.id, row.id), eq(connectors.projectId, row.projectId)))
-    .returning();
-  const saved = rows[0];
-  if (saved === undefined) throw missing();
-  return toConnector(saved);
-}
-
-async function connectorRowsFor(
-  email: string,
-  project: string,
-): Promise<ConnectorRow[]> {
-  const projectId = await projectIdOrThrow(email, project);
-  return getDb()
-    .select()
-    .from(connectors)
-    .where(eq(connectors.projectId, projectId))
-    .orderBy(asc(connectors.id));
-}
-
-export async function listConnectorsForEmail(
-  email: string,
-  project: string,
-): Promise<Connector[]> {
-  return (await connectorRowsFor(email, project)).map(toConnector);
-}
-
-async function rowsByIds(ids: string[]): Promise<ConnectorRow[]> {
-  if (ids.length === 0) return [];
-  return getDb()
-    .select()
-    .from(connectors)
-    .where(inArray(connectors.id, ids))
-    .orderBy(asc(connectors.id));
-}
-
-export async function connectorNamesByIds(
-  ids: string[],
-): Promise<{ id: string; name: string }[]> {
-  return (await rowsByIds(ids)).map((row) => ({ id: row.id, name: row.name }));
-}
-
-export async function getConnectorForEmail(
-  email: string,
-  id: string,
-): Promise<Connector> {
-  return toConnector(await ownedConnectorOrThrow(email, id));
-}
-
-async function insertConnector(
-  projectId: string,
-  name: string,
-  url: URL,
-  config: ConnectorConfig,
-): Promise<Connector> {
-  const rows = await getDb()
-    .insert(connectors)
-    .values({
-      id: newId(),
-      projectId,
-      name,
-      url: connectorUrlText(url),
-      transport: 'http',
-      config,
-    })
-    .returning();
-  const row = rows[0];
-  if (row === undefined)
-    throw new ConnectorError('connector insert returned no row', 500);
-  return toConnector(row);
-}
-
-const UNVERIFIED = {
-  at: '',
-  server: '',
-  version: '',
-  protocol: '',
-  icon: '',
-  tools: 0,
-  catalog: [],
-};
-
-export async function createPendingConnectorForEmail(
-  email: string,
-  project: string,
-  input: { name: unknown; url: unknown },
-): Promise<Connector> {
-  const name = connectorName(input.name);
-  const url = parseConnectorUrl(input.url);
-  const projectId = await projectIdOrThrow(email, project);
-  return insertConnector(projectId, name, url, {
-    auth: { kind: 'none' },
-    createdAt: new Date().toISOString(),
-    verified: UNVERIFIED,
-    oauth: true,
-  });
-}
-
-export async function createConnectorForEmail(
-  email: string,
-  project: string,
-  input: ConnectorInput,
-): Promise<Connector> {
-  const name = connectorName(input.name);
-  const url = parseConnectorUrl(input.url);
-  const auth = connectorAuth(input.header, input.value);
-  const projectId = await projectIdOrThrow(email, project);
-  const verified = stamp(await verifyRemoteMcp(url, auth));
-  return insertConnector(projectId, name, url, {
-    auth,
-    createdAt: new Date().toISOString(),
-    verified,
-    oauth: await oauthCapable(url, auth),
-  });
-}
-
-async function oauthCapable(url: URL, auth: ConnectorAuth): Promise<boolean> {
-  if (auth.kind === 'oauth') return true;
-  if (auth.kind === 'header') return false;
-  return advertisesOAuth(url);
-}
-
-async function freshAuth(
-  auth: ConnectorAuth,
-  resource: string,
-): Promise<ConnectorAuth> {
-  if (auth.kind !== 'oauth' || !oauthExpired(auth)) return auth;
-  return refreshOAuth(auth, resource);
-}
-
-export async function reconnectConnectorForEmail(
-  email: string,
-  id: string,
-  auth: OAuthAuth,
-): Promise<Connector> {
-  const row = await ownedConnectorOrThrow(email, id);
-  const config = readConfig(row.config);
-  const url = parseConnectorUrl(row.url);
-  const verified = stamp(await verifyRemoteMcp(url, auth));
-  return saveConfig(row, { ...config, auth, verified, oauth: true });
-}
-
-export async function disconnectConnectorForEmail(
-  email: string,
-  id: string,
-): Promise<Connector> {
-  const row = await ownedConnectorOrThrow(email, id);
-  const config = readConfig(row.config);
-  if (config.auth.kind !== 'oauth')
-    throw new ConnectorError('that connector is not signed in', 400);
-  return saveConfig(row, { ...config, auth: { kind: 'none' }, oauth: true });
-}
-
-export async function verifyConnectorForEmail(
-  email: string,
-  id: string,
-): Promise<ConnectorCheck> {
-  const row = await ownedConnectorOrThrow(email, id);
-  const config = readConfig(row.config);
-  try {
-    const url = parseConnectorUrl(row.url);
-    const auth = await freshAuth(config.auth, url.toString());
-    const verified = stamp(await verifyRemoteMcp(url, auth));
-    const oauth = config.oauth || (await oauthCapable(url, auth));
-    await saveConfig(row, { ...config, auth, verified, oauth });
-    return { id: row.id, name: row.name, ok: true, verified };
-  } catch (err) {
-    if (!(err instanceof ConnectorVerifyError)) throw err;
-    return { id: row.id, name: row.name, ok: false, reason: err.message };
-  }
-}
-
-export async function renameConnectorForEmail(
-  email: string,
-  id: string,
-  raw: string,
-): Promise<Connector> {
-  const name = connectorName(raw);
-  const row = await ownedConnectorOrThrow(email, id);
-  await assertRenameFreeOfClash(row.id, name);
-  const rows = await getDb()
-    .update(connectors)
-    .set({ name })
-    .where(and(eq(connectors.id, row.id), eq(connectors.projectId, row.projectId)))
-    .returning();
-  const saved = rows[0];
-  if (saved === undefined) throw missing();
-  return toConnector(saved);
-}
-
-export async function deleteConnectorForEmail(
-  email: string,
-  id: string,
-): Promise<DeletedConnector> {
-  const row = await ownedConnectorOrThrow(email, id);
-  const gone = await getDb()
-    .delete(connectors)
-    .where(eq(connectors.id, row.id))
-    .returning({ id: connectors.id, name: connectors.name });
-  const deleted = gone[0];
-  if (deleted === undefined) throw missing();
-  return deleted;
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/projects.ts

@@ -1,300 +0,0 @@
-import { ensureUser, normalizeEmail, userIdForEmail } from './users.js';
-import { and, asc, eq } from 'drizzle-orm';
-import { ApiError } from '../daemon/api-error.js';
-import { getDb } from './client.js';
-import { newId } from './ids.js';
-import { projectMembers, projects, users, type ProjectRole } from './schema.js';
-
-export class ProjectError extends ApiError {}
-
-export interface Project {
-  id: string;
-  name: string;
-  isDefault: boolean;
-  owner: boolean;
-  role: ProjectRole;
-}
-
-export interface Member {
-  id: string;
-  email: string;
-  role: ProjectRole;
-  owner: boolean;
-}
-
-const NAME_MAX = 64;
-const CONTROL = /[\u0000-\u001f\u007f]/;
-
-const missing = (): ProjectError => new ProjectError('no such project', 404);
-const forbidden = (why: string): ProjectError => new ProjectError(why, 403);
-
-export function projectName(raw: unknown): string {
-  const name = typeof raw === 'string' ? raw.trim() : '';
-  if (name === '' || name.length > NAME_MAX)
-    throw new ProjectError(
-      `a project name is 1-${String(NAME_MAX)} characters`,
-      400,
-    );
-  if (CONTROL.test(name))
-    throw new ProjectError('a project name cannot carry control characters', 400);
-  return name;
-}
-
-export interface Access {
-  userId: string;
-  projectId: string;
-  ownerId: string;
-  isDefault: boolean;
-  name: string;
-  role: ProjectRole;
-}
-
-export async function memberAccessOrThrow(
-  email: string,
-  projectId: string,
-): Promise<Access> {
-  const userId = await userIdForEmail(email);
-  if (userId === null) throw missing();
-  const rows = await getDb()
-    .select({
-      id: projects.id,
-      name: projects.name,
-      ownerId: projects.ownerId,
-      isDefault: projects.isDefault,
-      role: projectMembers.role,
-    })
-    .from(projects)
-    .innerJoin(projectMembers, eq(projectMembers.projectId, projects.id))
-    .where(and(eq(projects.id, projectId), eq(projectMembers.userId, userId)));
-  const row = rows[0];
-  if (row === undefined) throw missing();
-  return {
-    userId,
-    projectId: row.id,
-    ownerId: row.ownerId,
-    isDefault: row.isDefault,
-    name: row.name,
-    role: row.role,
-  };
-}
-
-export async function projectIdOrThrow(
-  email: string,
-  projectId: string,
-): Promise<string> {
-  return (await memberAccessOrThrow(email, projectId)).projectId;
-}
-
-async function addMemberRow(
-  projectId: string,
-  userId: string,
-  role: ProjectRole,
-): Promise<void> {
-  await getDb()
-    .insert(projectMembers)
-    .values({ id: newId(), projectId, userId, role })
-    .onConflictDoNothing();
-}
-
-export async function ensureDefaultProject(userId: string): Promise<string> {
-  const existing = await getDb()
-    .select({ id: projects.id })
-    .from(projects)
-    .where(and(eq(projects.ownerId, userId), eq(projects.isDefault, true)));
-  const found = existing[0];
-  if (found !== undefined) return found.id;
-  const id = newId();
-  await getDb()
-    .insert(projects)
-    .values({ id, name: 'Personal', ownerId: userId, isDefault: true });
-  await addMemberRow(id, userId, 'admin');
-  return id;
-}
-
-export async function ensureUserWithProject(rawEmail: string): Promise<string> {
-  const userId = await ensureUser(rawEmail);
-  await ensureDefaultProject(userId);
-  return userId;
-}
-
-export async function listProjectsForEmail(email: string): Promise<Project[]> {
-  const userId = await userIdForEmail(email);
-  if (userId === null) return [];
-  const rows = await getDb()
-    .select({
-      id: projects.id,
-      name: projects.name,
-      isDefault: projects.isDefault,
-      ownerId: projects.ownerId,
-      role: projectMembers.role,
-    })
-    .from(projects)
-    .innerJoin(projectMembers, eq(projectMembers.projectId, projects.id))
-    .where(eq(projectMembers.userId, userId))
-    .orderBy(asc(projects.id));
-  return rows.map((r) => ({
-    id: r.id,
-    name: r.name,
-    isDefault: r.isDefault,
-    owner: r.ownerId === userId,
-    role: r.role,
-  }));
-}
-
-export async function createProjectForEmail(
-  email: string,
-  raw: unknown,
-): Promise<Project> {
-  const name = projectName(raw);
-  const userId = await ensureUser(email);
-  const id = newId();
-  await getDb().insert(projects).values({ id, name, ownerId: userId });
-  await addMemberRow(id, userId, 'admin');
-  return { id, name, isDefault: false, owner: true, role: 'admin' };
-}
-
-export async function renameProjectForEmail(
-  email: string,
-  projectId: string,
-  raw: unknown,
-): Promise<Project> {
-  const name = projectName(raw);
-  const access = await memberAccessOrThrow(email, projectId);
-  if (access.role !== 'admin')
-    throw forbidden('only an admin can rename a project');
-  await getDb()
-    .update(projects)
-    .set({ name })
-    .where(eq(projects.id, access.projectId));
-  return {
-    id: access.projectId,
-    name,
-    isDefault: access.isDefault,
-    owner: access.ownerId === access.userId,
-    role: access.role,
-  };
-}
-
-export async function deleteProjectForEmail(
-  email: string,
-  projectId: string,
-): Promise<{ id: string; name: string }> {
-  const access = await memberAccessOrThrow(email, projectId);
-  if (access.ownerId !== access.userId)
-    throw forbidden('only the owner can delete a project');
-  if (access.isDefault)
-    throw forbidden('your default project cannot be deleted');
-  try {
-    await getDb().delete(projects).where(eq(projects.id, access.projectId));
-  } catch {
-    throw new ProjectError(
-      'this project still holds agents, connectors or collections',
-      409,
-    );
-  }
-  return { id: access.projectId, name: access.name };
-}
-
-export async function listMembersForEmail(
-  email: string,
-  projectId: string,
-): Promise<Member[]> {
-  const access = await memberAccessOrThrow(email, projectId);
-  const rows = await getDb()
-    .select({
-      id: projectMembers.id,
-      email: users.email,
-      role: projectMembers.role,
-      userId: projectMembers.userId,
-    })
-    .from(projectMembers)
-    .innerJoin(users, eq(users.id, projectMembers.userId))
-    .where(eq(projectMembers.projectId, access.projectId))
-    .orderBy(asc(projectMembers.id));
-  return rows.map((r) => ({
-    id: r.id,
-    email: r.email,
-    role: r.role,
-    owner: r.userId === access.ownerId,
-  }));
-}
-
-function readRole(raw: unknown): ProjectRole {
-  if (raw === 'admin' || raw === 'member') return raw;
-  throw new ProjectError("a role is 'admin' or 'member'", 400);
-}
-
-async function adminAccessOrThrow(
-  email: string,
-  projectId: string,
-): Promise<Access> {
-  const access = await memberAccessOrThrow(email, projectId);
-  if (access.role !== 'admin')
-    throw forbidden('only an admin can manage members');
-  return access;
-}
-
-export async function addMemberForEmail(
-  email: string,
-  projectId: string,
-  raw: unknown,
-  rawRole: unknown,
-): Promise<Member[]> {
-  const access = await adminAccessOrThrow(email, projectId);
-  const role = readRole(rawRole);
-  const invited = normalizeEmail(typeof raw === 'string' ? raw : '');
-  if (invited === '') throw new ProjectError('an email is required', 400);
-  const invitedId = await ensureUser(invited);
-  await ensureDefaultProject(invitedId);
-  await addMemberRow(access.projectId, invitedId, role);
-  return listMembersForEmail(email, projectId);
-}
-
-async function memberRowOrThrow(
-  projectId: string,
-  memberId: string,
-): Promise<{ userId: string }> {
-  const rows = await getDb()
-    .select({ userId: projectMembers.userId })
-    .from(projectMembers)
-    .where(
-      and(
-        eq(projectMembers.id, memberId),
-        eq(projectMembers.projectId, projectId),
-      ),
-    );
-  const row = rows[0];
-  if (row === undefined) throw new ProjectError('no such member', 404);
-  return row;
-}
-
-export async function setMemberRoleForEmail(
-  email: string,
-  projectId: string,
-  memberId: string,
-  rawRole: unknown,
-): Promise<Member[]> {
-  const access = await adminAccessOrThrow(email, projectId);
-  const role = readRole(rawRole);
-  const member = await memberRowOrThrow(access.projectId, memberId);
-  if (member.userId === access.ownerId)
-    throw forbidden('the owner is always an admin');
-  await getDb()
-    .update(projectMembers)
-    .set({ role })
-    .where(eq(projectMembers.id, memberId));
-  return listMembersForEmail(email, projectId);
-}
-
-export async function removeMemberForEmail(
-  email: string,
-  projectId: string,
-  memberId: string,
-): Promise<Member[]> {
-  const access = await adminAccessOrThrow(email, projectId);
-  const member = await memberRowOrThrow(access.projectId, memberId);
-  if (member.userId === access.ownerId)
-    throw forbidden('the owner cannot be removed from their own project');
-  await getDb().delete(projectMembers).where(eq(projectMembers.id, memberId));
-  return listMembersForEmail(email, projectId);
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/runtime-admin.ts

@@ -1,31 +0,0 @@
-import { ownedAgentOrThrow } from './agent-admin.js';
-import { ApiError } from '../daemon/api-error.js';
-import { mintRunCode } from '../daemon/run-pair.js';
-import { loadAllStationsFor, unmovableStations } from './materialize.js';
-import { releaseRuntime } from './runtimes.js';
-
-export async function mintRuntimeCodeForEmail(
-  email: string,
-  agentId: string,
-): Promise<{ code: string; expiresAt: number }> {
-  const { agent } = await ownedAgentOrThrow(email, agentId);
-  const blocked = unmovableStations(await loadAllStationsFor(agent.id));
-  if (blocked.length > 0)
-    throw new ApiError(
-      `'${agent.name}' holds ${blocked.join(', ')}, which only runs on metro ` +
-        'because a webhook url has to be publicly reachable. Its deliveries ' +
-        'would arrive at metro while this agent listens on your machine, so ' +
-        'they would be dropped. Detach it, or attach it to a second agent that ' +
-        'stays on metro, then authorize this one.',
-      409,
-    );
-  return mintRunCode({ email, agentId: agent.id });
-}
-
-export async function releaseRuntimeForEmail(
-  email: string,
-  agentId: string,
-): Promise<void> {
-  const { agent } = await ownedAgentOrThrow(email, agentId);
-  await releaseRuntime(agent.id);
-}