@stage-labs/metro 0.1.0-beta.30 → 0.1.0-beta.32

package/runtime/node_modules/@metro-labs/mcp/src/daemon/relay.ts

@@ -1,15 +1,16 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { RelayTarget } from '../db/connector-relay.js';
-import { cliIdentity } from './api-http.js';
+import { agentIdentity, assertLease, type Fence } from './api-http.js';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from './log.js';
 
 export interface RelayApiDeps {
   target: (
-    collectionId: string,
+    agentId: string,
     connectorId: string,
     force: boolean,
   ) => Promise<RelayTarget>;
+  fence: Fence;
 }
 
 const ID_PATH_RE = /^\/relay\/([A-Za-z0-9][A-Za-z0-9_-]{10})$/;
@@ -196,18 +197,18 @@ type Exchanged =
 
 async function exchange(
   req: IncomingMessage,
-  collectionId: string,
+  agentId: string,
   connectorId: string,
   deps: RelayApiDeps,
   body: Uint8Array<ArrayBuffer> | null,
   signal: AbortSignal,
 ): Promise<Exchanged> {
-  const target = await deps.target(collectionId, connectorId, false);
+  const target = await deps.target(agentId, connectorId, false);
   if (target.kind !== 'ok') return { kind: target.kind };
   let upstream = await forward(req, target, body, signal);
   if (!authFailed(upstream.status)) return { kind: 'response', upstream };
   await upstream.body?.cancel();
-  const fresh = await deps.target(collectionId, connectorId, true);
+  const fresh = await deps.target(agentId, connectorId, true);
   if (fresh.kind !== 'ok') return { kind: 'signin' };
   upstream = await forward(req, fresh, body, signal);
   if (!authFailed(upstream.status)) return { kind: 'response', upstream };
@@ -218,7 +219,7 @@ async function exchange(
 async function relayExchange(
   req: IncomingMessage,
   res: ServerResponse,
-  collectionId: string,
+  agentId: string,
   connectorId: string,
   deps: RelayApiDeps,
 ): Promise<void> {
@@ -234,7 +235,7 @@ async function relayExchange(
   const body = req.method === 'POST' ? await readCapped(req) : null;
   const out = await exchange(
     req,
-    collectionId,
+    agentId,
     connectorId,
     deps,
     body,
@@ -262,13 +263,14 @@ function dispatch(
   connectorId: string,
   deps: RelayApiDeps,
 ): void {
-  const who = cliIdentity(req);
+  const who = agentIdentity(req);
   if (who === null) {
     answer(res, 401, { error: 'unauthorized' });
     return;
   }
-  relayExchange(req, res, who.collectionId, connectorId, deps).catch(
-    (err: unknown) => {
+  assertLease(who, deps.fence)
+    .then(() => relayExchange(req, res, who.agentId, connectorId, deps))
+    .catch((err: unknown) => {
       if (err instanceof ApiError) {
         answer(res, err.status, { error: err.message });
       } else {
@@ -277,8 +279,7 @@ function dispatch(
         if (!res.writableEnded) res.end();
       }
       closeIfBodyUnread(req, res);
-    },
-  );
+    });
 }
 
 export function handleRelayRequest(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -8,8 +8,8 @@ import {
   runIdentity,
   sendJson,
 } from './api-http.js';
-import { RUN_CODE_RE, takeRunCode } from './run-pair.js';
-import { sessionTtlFromEnv } from './google-oauth.js';
+import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
+import { sessionTtlFromEnv } from './session-config.js';
 import { signRunToken } from './session.js';
 import type { LoadedAgent } from '../db/materialize.js';
 import type { RuntimeLease } from '../db/runtimes.js';
@@ -27,6 +27,7 @@ export interface RunApiDeps {
   fenceRuntime: (runtimeId: string, agentId: string) => Promise<void>;
   touchRuntime: (runtimeId: string) => Promise<void>;
   loadAgent: (agentId: string) => Promise<LoadedAgent>;
+  blockedStations: (agentId: string) => Promise<string[]>;
 }
 
 function secretOrNull(): string | null {
@@ -53,23 +54,31 @@ async function handleClaim(
   const body = await readJsonBody(req);
   const raw = bodyField(body, 'code');
   const code = typeof raw === 'string' ? raw.trim() : '';
-  if (!RUN_CODE_RE.test(code)) {
+  if (!AGENT_CODE_RE.test(code)) {
     sendJson(req, res, 400, {
       error:
-        'that does not look like a runtime code — metro start wants the mr_… code from the agent page',
+        'that does not look like an agent code — metro start wants the ma_… code from the agent page',
     });
     return;
   }
-  const taken = takeRunCode(code);
+  const taken = takeAgentCode(code);
   if (taken === undefined) {
     sendJson(req, res, 400, {
       error: 'that code has expired or was already used',
     });
     return;
   }
+  const blocked = await deps.blockedStations(taken.agentId);
+  if (blocked.length > 0) {
+    sendJson(req, res, 409, {
+      error:
+        `this agent holds ${blocked.join(', ')}, which only runs on metro because a webhook url has to be publicly reachable. Detach it, or move it to a second agent that stays on metro, then start this one.`,
+    });
+    return;
+  }
   const lease = await deps.claimRuntime(taken.agentId, labelOf(body));
   const token = signRunToken(
-    { email: taken.email, agentId: lease.agentId, runtimeId: lease.runtimeId },
+    { subject: taken.subject, agentId: lease.agentId, runtimeId: lease.runtimeId },
     secret,
     { ttlSec: sessionTtlFromEnv() },
   );

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-api.ts

@@ -22,6 +22,6 @@ export function handleSessionApiRequest(
     sendJson(req, res, 401, { error: 'unauthorized' });
     return true;
   }
-  sendJson(req, res, 200, { email: session.email });
+  sendJson(req, res, 200, { subject: session.subject });
   return true;
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -5,7 +5,6 @@ import {
   handleConnectorApiRequest,
   type ConnectorApiDeps,
 } from './connector-api.js';
-import { handleCollectionApiRequest } from './collection-api.js';
 import { handleCliPairRequest } from './cli-pair-api.js';
 import { handleRunApiRequest, type RunApiDeps } from './run-api.js';
 import type { RelayApiDeps } from './relay.js';
@@ -13,13 +12,22 @@ import {
   handleProjectApiRequest,
   type ProjectApiDeps,
 } from './project-api.js';
+import {
+  handleAgentConnectorRequest,
+  type AgentConnectorApiDeps,
+} from './agent-connector-api.js';
+import type { SiweRouteDeps } from './siwe-routes.js';
+import type { ModeInfo } from './mode-api.js';
 
 export interface SessionApis {
   agentApi?: AgentApiDeps;
+  agentConnectorApi?: AgentConnectorApiDeps;
   connectorApi?: ConnectorApiDeps;
   projectApi?: ProjectApiDeps;
   runApi?: RunApiDeps;
   relayApi?: RelayApiDeps;
+  siwe?: SiweRouteDeps;
+  mode?: () => ModeInfo;
 }
 
 export function handleSessionApis(
@@ -27,7 +35,7 @@ export function handleSessionApis(
   res: ServerResponse,
   apis: SessionApis,
 ): boolean {
-  const { agentApi, connectorApi, projectApi, runApi } = apis;
+  const { agentApi, agentConnectorApi, connectorApi, projectApi, runApi } = apis;
   const routes: (() => boolean)[] = [() => handleSessionApiRequest(req, res)];
   if (runApi) routes.push(() => handleRunApiRequest(req, res, runApi));
   if (projectApi)
@@ -35,9 +43,10 @@ export function handleSessionApis(
   if (connectorApi)
     routes.push(
       () => handleCliPairRequest(req, res, connectorApi),
-      () => handleCollectionApiRequest(req, res, connectorApi),
       () => handleConnectorApiRequest(req, res, connectorApi),
     );
+  if (agentConnectorApi)
+    routes.push(() => handleAgentConnectorRequest(req, res, agentConnectorApi));
   if (agentApi) routes.push(() => handleAgentApiRequest(req, res, agentApi));
   return routes.some((run) => run());
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-config.ts

@@ -0,0 +1,27 @@
+const DEFAULT_SESSION_TTL_SEC = 30 * 24 * 3600;
+const PREVIEW = /^([a-z0-9-]+--)?metro-ui\.netlify\.app$/;
+
+export function sessionTtlFromEnv(): number {
+  const ttl = Number(process.env.METRO_SESSION_TTL_SEC);
+  return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SEC;
+}
+
+export function allowedWebHost(host: string): boolean {
+  if (host === 'metro.box' || host === 'localhost' || host === '127.0.0.1')
+    return true;
+  return PREVIEW.test(host);
+}
+
+export function validateReturnTo(returnTo: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(returnTo);
+  } catch {
+    return false;
+  }
+  const host = url.hostname;
+  if (url.protocol === 'http:' && (host === 'localhost' || host === '127.0.0.1'))
+    return true;
+  if (url.protocol !== 'https:') return false;
+  return allowedWebHost(host);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session.ts

@@ -95,17 +95,17 @@ export function verifyState(
 }
 
 interface SessionClaims {
-  email: string;
+  subject: string;
   agentIds: string[];
 }
 
-export interface CliClaims {
-  email: string;
-  collectionId: string;
+export interface AgentClaims {
+  subject: string;
+  agentId: string;
 }
 
 export interface RunClaims {
-  email: string;
+  subject: string;
   agentId: string;
   runtimeId: string;
 }
@@ -119,7 +119,7 @@ export function signSession(
   return sign(
     {
       typ: 'session',
-      sub: claims.email,
+      sub: claims.subject,
       agent_ids: claims.agentIds,
       iat,
       exp: iat + (opts.ttlSec ?? 30 * 24 * 3600),
@@ -144,20 +144,20 @@ export function verifySession(
     ids.some((a) => typeof a !== 'string' || !ID_RE.test(a))
   )
     throw new SessionError('malformed session');
-  return { email: p.sub, agentIds: ids as string[] };
+  return { subject: p.sub, agentIds: ids as string[] };
 }
 
-export function signCliToken(
-  claims: CliClaims,
+export function signAgentToken(
+  claims: AgentClaims,
   secret: string,
   opts: { ttlSec?: number; now?: number } = {},
 ): string {
   const iat = nowSec(opts.now);
   return sign(
     {
-      typ: 'cli',
-      sub: claims.email,
-      collection: claims.collectionId,
+      typ: 'agent',
+      sub: claims.subject,
+      agent: claims.agentId,
       iat,
       exp: iat + (opts.ttlSec ?? 30 * 24 * 3600),
     },
@@ -165,18 +165,18 @@ export function signCliToken(
   );
 }
 
-export function verifyCliToken(
+export function verifyAgentToken(
   token: string,
   secret: string,
   now?: number,
-): CliClaims {
+): AgentClaims {
   const p = verify(token, secret);
-  if (p.typ !== 'cli') throw new SessionError('wrong token type');
+  if (p.typ !== 'agent') throw new SessionError('wrong token type');
   if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('cli token expired');
-  if (typeof p.sub !== 'string' || typeof p.collection !== 'string')
-    throw new SessionError('malformed cli token');
-  return { email: p.sub, collectionId: p.collection };
+    throw new SessionError('agent token expired');
+  if (typeof p.sub !== 'string' || typeof p.agent !== 'string')
+    throw new SessionError('malformed agent token');
+  return { subject: p.sub, agentId: p.agent };
 }
 
 export function signRunToken(
@@ -188,7 +188,7 @@ export function signRunToken(
   return sign(
     {
       typ: 'run',
-      sub: claims.email,
+      sub: claims.subject,
       agent: claims.agentId,
       rt: claims.runtimeId,
       iat,
@@ -214,5 +214,5 @@ export function verifyRunToken(
     !ID_RE.test(p.agent)
   )
     throw new SessionError('malformed run token');
-  return { email: p.sub, agentId: p.agent, runtimeId: p.rt };
+  return { subject: p.sub, agentId: p.agent, runtimeId: p.rt };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-auth.ts

@@ -0,0 +1,82 @@
+import { verifyMessage, type Hex } from 'viem';
+import { parseSiweMessage, validateSiweMessage } from 'viem/siwe';
+import { ApiError } from './api-error.js';
+import { allowedWebHost } from './session-config.js';
+
+export class SiweError extends ApiError {}
+
+export interface SiweLogin {
+  message: string;
+  signature: string;
+}
+
+export interface SiweVerifyArgs {
+  address: `0x${string}`;
+  message: string;
+  signature: Hex;
+}
+
+export interface SiweDeps {
+  takeNonce: (nonce: string) => boolean;
+  now?: number;
+  verify?: (args: SiweVerifyArgs) => Promise<boolean>;
+}
+
+const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
+
+export function allowedSiweDomain(domain: string): boolean {
+  return allowedWebHost(domain.replace(/:\d+$/, ''));
+}
+
+function hostOf(uri: string): string | null {
+  try {
+    return new URL(uri).host;
+  } catch {
+    return null;
+  }
+}
+
+function fieldsOrThrow(message: string): {
+  address: `0x${string}`;
+  domain: string;
+  nonce: string;
+  parsed: ReturnType<typeof parseSiweMessage>;
+} {
+  const parsed = parseSiweMessage(message);
+  const { address, domain, nonce, uri, version } = parsed;
+  if (
+    address === undefined ||
+    domain === undefined ||
+    nonce === undefined ||
+    uri === undefined ||
+    version !== '1'
+  )
+    throw new SiweError('that is not a sign-in message', 400);
+  if (!allowedSiweDomain(domain))
+    throw new SiweError(`sign-in messages for ${domain} are not accepted here`, 400);
+  if (hostOf(uri) !== domain)
+    throw new SiweError('the sign-in message names a different site', 400);
+  return { address, domain, nonce, parsed };
+}
+
+export async function verifySiweLogin(
+  input: SiweLogin,
+  deps: SiweDeps,
+): Promise<string> {
+  if (!HEX_SIGNATURE.test(input.signature))
+    throw new SiweError('that is not an Ethereum signature', 400);
+  const { address, domain, nonce, parsed } = fieldsOrThrow(input.message);
+  const time = new Date(deps.now ?? Date.now());
+  if (!validateSiweMessage({ message: parsed, domain, nonce, time }))
+    throw new SiweError('this sign-in message is expired or does not match', 400);
+  if (!deps.takeNonce(nonce))
+    throw new SiweError('that sign-in has expired or was already used', 400);
+  const verify = deps.verify ?? verifyMessage;
+  const signature = input.signature as Hex;
+  if (!(await verify({ address, message: input.message, signature })))
+    throw new SiweError(
+      'the signature does not match the address; smart-contract wallets are not supported yet',
+      401,
+    );
+  return address.toLowerCase();
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-nonces.ts

@@ -0,0 +1,43 @@
+import { generateSiweNonce } from 'viem/siwe';
+
+const TTL_MS = 10 * 60_000;
+const SWEEP_MS = 60_000;
+const MAX_LIVE = 500;
+
+const live = new Map<string, number>();
+let sweeper: ReturnType<typeof setInterval> | null = null;
+
+function sweep(now = Date.now()): void {
+  for (const [nonce, expiresAt] of live) if (expiresAt <= now) live.delete(nonce);
+}
+
+function ensureSweeper(): void {
+  if (sweeper !== null) return;
+  sweeper = setInterval(sweep, SWEEP_MS);
+  sweeper.unref?.();
+}
+
+export function mintNonce(now = Date.now()): string {
+  sweep(now);
+  while (live.size >= MAX_LIVE) {
+    const oldest = live.keys().next();
+    if (oldest.done) break;
+    live.delete(oldest.value);
+  }
+  const nonce = generateSiweNonce();
+  live.set(nonce, now + TTL_MS);
+  ensureSweeper();
+  return nonce;
+}
+
+export function takeNonce(nonce: string, now = Date.now()): boolean {
+  const expiresAt = live.get(nonce);
+  if (expiresAt === undefined) return false;
+  live.delete(nonce);
+  return expiresAt > now;
+}
+
+export function nonceCount(): number {
+  sweep();
+  return live.size;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-routes.ts

@@ -0,0 +1,89 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from './log.js';
+import {
+  apiFailure,
+  bodyField,
+  cors,
+  readJsonBody,
+  sendJson,
+} from './api-http.js';
+import { mintNonce, takeNonce } from './siwe-nonces.js';
+import { verifySiweLogin } from './siwe-auth.js';
+import { signSession } from './session.js';
+import { sessionTtlFromEnv } from './session-config.js';
+import { ensureUserWithProject } from '../db/projects.js';
+
+const NONCE_PATH = '/auth/siwe/nonce';
+const VERIFY_PATH = '/auth/siwe/verify';
+
+export interface SiweRouteDeps {
+  ensureUser: (address: string) => Promise<string>;
+}
+
+const defaultDeps: SiweRouteDeps = { ensureUser: ensureUserWithProject };
+
+async function handleVerify(
+  req: IncomingMessage,
+  res: ServerResponse,
+  secret: string,
+  deps: SiweRouteDeps,
+): Promise<void> {
+  const body = await readJsonBody(req);
+  const message = bodyField(body, 'message');
+  const signature = bodyField(body, 'signature');
+  if (typeof message !== 'string' || typeof signature !== 'string') {
+    sendJson(req, res, 400, { error: 'message and signature are required' });
+    return;
+  }
+  const address = await verifySiweLogin({ message, signature }, { takeNonce });
+  const userId = await deps.ensureUser(address);
+  log.info({ userId, address }, 'siwe: session issued');
+  const session = signSession({ subject: address, agentIds: [] }, secret, {
+    ttlSec: sessionTtlFromEnv(),
+  });
+  sendJson(req, res, 200, { session, address });
+}
+
+const ROUTES: Record<string, string> = {
+  [NONCE_PATH]: 'GET',
+  [VERIFY_PATH]: 'POST',
+};
+
+function refused(
+  req: IncomingMessage,
+  res: ServerResponse,
+  path: string,
+): boolean {
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== ROUTES[path]) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  return false;
+}
+
+export function handleSiweAuthRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: SiweRouteDeps = defaultDeps,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (ROUTES[path] === undefined) return false;
+  if (refused(req, res, path)) return true;
+  const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
+  if (secret === '') {
+    sendJson(req, res, 503, { error: 'sign-in is not configured' });
+    return true;
+  }
+  if (path === NONCE_PATH) {
+    sendJson(req, res, 200, { nonce: mintNonce() });
+    return true;
+  }
+  handleVerify(req, res, secret, deps).catch((err: unknown) => {
+    apiFailure(req, res, err, 'siwe');
+  });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/supervisor.ts

@@ -1,5 +1,4 @@
 import { mkdirSync, statSync, type FSWatcher } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { errMsg, log } from './log.js';
 import { daemonSelf } from './events.js';
@@ -22,9 +21,7 @@ import {
   startWatcher,
   type TrainState,
 } from './supervisor-io.js';
-
-export const TRAINS_DIR =
-  process.env.METRO_TRAINS_DIR ?? join(homedir(), '.metro', 'trains');
+import { trainsDir } from './paths.js';
 
 const DYLD_FALLBACK_ENV: Record<string, string> =
   process.platform === 'darwin'
@@ -45,7 +42,7 @@ export class TrainSupervisor {
   private watcher: FSWatcher | null = null;
   private reloadTimers = new Map<string, ReturnType<typeof setTimeout>>();
 
-  constructor(private dir: string = TRAINS_DIR) {}
+  constructor(private dir: string = trainsDir()) {}
 
   running(): string[] {
     return [...this.trains.keys()];

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-admin.ts

@@ -3,12 +3,11 @@ import { and, asc, eq, inArray } from 'drizzle-orm';
 import { ApiError } from '../daemon/api-error.js';
 import { getDb } from './client.js';
 import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
-import { newId, parseId } from './ids.js';
+import { AGENT_NAME_RE, newId, parseId } from './ids.js';
 import { agents, stations } from './schema.js';
 import { isUniqueViolation } from './users.js';
 import { projectIdOrThrow } from './projects.js';
 
-export const AGENT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{1,31}$/;
 const KEY_ATTEMPTS = 5;
 
 export class AgentAdminError extends ApiError {}
@@ -93,11 +92,11 @@ async function selectKeyRows(ids: string[]): Promise<KeyRow[]> {
     .where(inArray(agents.id, ids));
 }
 
-export async function listAgentsForEmail(
-  email: string,
+export async function listAgentsForUser(
+  subject: string,
   project: string,
 ): Promise<AgentSummary[]> {
-  const projectId = await projectIdOrThrow(email, project);
+  const projectId = await projectIdOrThrow(subject, project);
   const rows = await getDb()
     .select({ id: agents.id, name: agents.name, projectId: agents.projectId })
     .from(agents)
@@ -123,14 +122,14 @@ async function insertAgent(
   return id;
 }
 
-export async function createAgentForEmail(
-  email: string,
+export async function createAgentForUser(
+  subject: string,
   project: string,
   rawName: string,
 ): Promise<CreatedAgent> {
   const name = normalizeAgentName(rawName);
   const key = newApiKey();
-  const id = await insertAgent(await projectIdOrThrow(email, project), name, key);
+  const id = await insertAgent(await projectIdOrThrow(subject, project), name, key);
   if (servesEveryAgent()) registerKey(key, id);
   return { id, name, key };
 }
@@ -145,7 +144,7 @@ interface Deletable {
 }
 
 export async function ownedAgentOrThrow(
-  email: string,
+  subject: string,
   id: string,
 ): Promise<Deletable> {
   const rows = await getDb().select().from(agents).where(eq(agents.id, id));
@@ -153,7 +152,7 @@ export async function ownedAgentOrThrow(
   const missing = new AgentAdminError('no such agent', 404);
   if (!row) throw missing;
   try {
-    await projectIdOrThrow(email, row.projectId);
+    await projectIdOrThrow(subject, row.projectId);
   } catch {
     throw missing;
   }
@@ -179,21 +178,21 @@ async function writeNewKey(id: string, projectId: string): Promise<string> {
   throw new AgentAdminError('could not allocate a free api key', 500);
 }
 
-export async function resetAgentKeyForEmail(
-  email: string,
+export async function resetAgentKeyForUser(
+  subject: string,
   id: string,
 ): Promise<ResetAgentKey> {
-  const { agent, projectId } = await ownedAgentOrThrow(email, id);
+  const { agent, projectId } = await ownedAgentOrThrow(subject, id);
   const key = await writeNewKey(agent.id, projectId);
   rotateAgentKey(agent.id, daemonServesAgent(agent.id) ? key : null);
   return { id: agent.id, name: agent.name, key };
 }
 
-export async function deleteAgentForEmail(
-  email: string,
+export async function deleteAgentForUser(
+  subject: string,
   id: string,
 ): Promise<DeletedAgent> {
-  const { agent, projectId } = await ownedAgentOrThrow(email, id);
+  const { agent, projectId } = await ownedAgentOrThrow(subject, id);
   await getDb().transaction(async (tx) => {
     const attached = await tx
       .select({ id: stations.id })