@stage-labs/metro 0.1.0-beta.301 → 0.1.0-beta.303

package/runtime/node_modules/@metro-labs/daemon/src/connectors/api.ts

@@ -1,316 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from '@metro-labs/core/log';
-import { healthOf } from './health.js';
-import type { RemoteTool } from './tools.js';
-import type { ConnectorMigrationPreview } from './migration-preview.js';
-import { normalizePolicy, type ToolPolicy } from '../policy/policy.js';
-import {
-  apiFailure,
-  apiSession,
-  bodyField,
-  cors,
-  readJsonBody,
-  requireAdmin,
-  sendJson,
-  stringOf,
-} from '@metro-labs/http/api-http';
-import { parseId } from '@metro-labs/core/ids';
-import {
-  handleCallback,
-  handleConnect,
-  hostOf,
-  startOAuth,
-  type OAuthRouteDeps,
-} from './oauth-routes.js';
-import { ConnectorUnauthorized } from '@metro-labs/http/connector-url';
-import type {
-  Connector,
-  ConnectorCheck,
-  ConnectorInput,
-  DeletedConnector,
-} from './store.js';
-
-const PREFIX = '/api/connectors';
-
-export interface ConnectorApiDeps extends OAuthRouteDeps {
-  migrationPreview?: () => ConnectorMigrationPreview;
-  listConnectors: () => Promise<Connector[]>;
-  createConnector: (input: ConnectorInput) => Promise<Connector>;
-  verifyConnector: (id: string) => Promise<ConnectorCheck>;
-  connectorTools: (id: string) => Promise<RemoteTool[]>;
-  disconnectConnector: (id: string) => Promise<Connector>;
-  renameConnector: (id: string, name: string) => Promise<Connector>;
-  deleteConnector: (id: string) => Promise<DeletedConnector>;
-  setConnectorPolicy: (id: string, policy: ToolPolicy) => Promise<Connector>;
-}
-
-type Routable =
-  | { kind: 'collection' }
-  | { kind: 'migration-preview' }
-  | { kind: 'callback' }
-  | { kind: 'connector'; id: string }
-  | { kind: 'verify'; id: string }
-  | { kind: 'tools'; id: string }
-  | { kind: 'connect'; id: string }
-  | { kind: 'disconnect'; id: string }
-  | { kind: 'rename'; id: string }
-  | { kind: 'policy'; id: string };
-
-type Target = Routable | { kind: 'unknown' } | null;
-
-function subTarget(id: string, rest: string[]): Target {
-  if (rest.length === 0) return { kind: 'connector', id };
-  if (rest.length > 1) return { kind: 'unknown' };
-  const head = rest[0];
-  if (head === 'verify') return { kind: 'verify', id };
-  if (head === 'tools') return { kind: 'tools', id };
-  if (head === 'connect') return { kind: 'connect', id };
-  if (head === 'disconnect') return { kind: 'disconnect', id };
-  if (head === 'rename') return { kind: 'rename', id };
-  if (head === 'policy') return { kind: 'policy', id };
-  return { kind: 'unknown' };
-}
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'collection' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const head = segments[0];
-  if (head === undefined) return { kind: 'collection' };
-  if (head === 'callback' && segments.length === 1) return { kind: 'callback' };
-  if (head === 'migration-preview' && segments.length === 1) return { kind: 'migration-preview' };
-  const id = parseId(head);
-  return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
-}
-
-function connectorPayload(row: Connector): Record<string, unknown> {
-  return {
-    id: row.id,
-    name: row.name,
-    url: row.url,
-    auth: row.auth,
-    header: row.header,
-    clientId: row.client?.clientId ?? null,
-    signIn: row.signIn,
-    verified: row.verified,
-    policy: row.policy,
-    health: healthOf(row.id),
-  };
-}
-
-async function handleList(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-): Promise<void> {
-  const rows = await deps.listConnectors();
-  sendJson(req, res, 200, {
-    connectors: rows.map((row) => connectorPayload(row)),
-  });
-}
-
-async function handleCreate(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-): Promise<void> {
-  const body = await readJsonBody(req);
-  const offered = stringOf(bodyField(body, 'value')).trim() !== '';
-  try {
-    const created = await deps.createConnector({
-      name: bodyField(body, 'name'),
-      url: bodyField(body, 'url'),
-      header: bodyField(body, 'header'),
-      value: bodyField(body, 'value'),
-      clientId: bodyField(body, 'clientId'),
-      clientSecret: bodyField(body, 'clientSecret'),
-    });
-    log.info(
-      { id: created.id, name: created.name, host: hostOf(created.url) },
-      'connector-api: created connector',
-    );
-    sendJson(req, res, 201, connectorPayload(created));
-  } catch (err) {
-    if (offered || !(err instanceof ConnectorUnauthorized)) throw err;
-    await startOAuth(req, res, deps, body, (row) =>
-      connectorPayload(row),
-    );
-  }
-}
-
-async function handleVerify(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  id: string,
-): Promise<void> {
-  const check = await deps.verifyConnector(id);
-  log.info(
-    { id: check.id, name: check.name, ok: check.ok },
-    'connector-api: re-verified connector',
-  );
-  sendJson(req, res, 200, check);
-}
-
-async function handleDisconnect(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  id: string,
-): Promise<void> {
-  const row = await deps.disconnectConnector(id);
-  log.info(
-    { id: row.id, name: row.name },
-    'connector-api: signed the connector out',
-  );
-  sendJson(req, res, 200, connectorPayload(row));
-}
-
-async function handleDelete(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  id: string,
-): Promise<void> {
-  const gone = await deps.deleteConnector(id);
-  log.info(
-    { id: gone.id, name: gone.name },
-    'connector-api: deleted connector',
-  );
-  sendJson(req, res, 200, { id: gone.id, name: gone.name, deleted: true });
-}
-
-async function handleConnector(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  id: string,
-): Promise<void> {
-  if (req.method !== 'GET') {
-    await handleDelete(req, res, deps, id);
-    return;
-  }
-  const row = await deps.getConnector(id);
-  sendJson(req, res, 200, connectorPayload(row));
-}
-
-async function handleRename(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  id: string,
-): Promise<void> {
-  const name = bodyField(await readJsonBody(req), 'name');
-  if (typeof name !== 'string') {
-    sendJson(req, res, 400, { error: 'name is required' });
-    return;
-  }
-  const row = await deps.renameConnector(id, name);
-  log.info({ id: row.id, name: row.name }, 'connector-api: renamed connector');
-  sendJson(req, res, 200, connectorPayload(row));
-}
-
-async function handlePolicy(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  id: string,
-): Promise<void> {
-  const policy = normalizePolicy(bodyField(await readJsonBody(req), 'policy'));
-  const row = await deps.setConnectorPolicy(id, policy);
-  log.info({ id: row.id, name: row.name, policy: row.policy }, 'connector-api: tool policy set');
-  sendJson(req, res, 200, connectorPayload(row));
-}
-
-type ById = Exclude<Routable['kind'], 'collection' | 'callback' | 'migration-preview'>;
-
-const BY_ID: Record<ById, (req: IncomingMessage, res: ServerResponse, deps: ConnectorApiDeps, id: string) => Promise<void>> = {
-  verify: handleVerify,
-  tools: async (req, res, deps, id) => {
-    sendJson(req, res, 200, { tools: await deps.connectorTools(id) });
-  },
-  connect: handleConnect,
-  disconnect: handleDisconnect,
-  rename: handleRename,
-  policy: handlePolicy,
-  connector: handleConnector,
-};
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  tgt: Routable,
-): Promise<void> {
-  try {
-    if (tgt.kind === 'callback') return;
-    if (tgt.kind === 'migration-preview') {
-      if (deps.migrationPreview === undefined) sendJson(req, res, 503, { error: 'Migration preview is unavailable.' });
-      else sendJson(req, res, 200, deps.migrationPreview());
-      return;
-    }
-    if (tgt.kind !== 'collection') await BY_ID[tgt.kind](req, res, deps, tgt.id);
-    else if (req.method === 'GET') await handleList(req, res, deps);
-    else await handleCreate(req, res, deps);
-  } catch (err) {
-    apiFailure(req, res, err, 'connector-api');
-  }
-}
-
-const ALLOWED: Record<Routable['kind'], string[]> = {
-  collection: ['GET', 'POST'],
-  'migration-preview': ['GET'],
-  callback: ['GET'],
-  connector: ['GET', 'DELETE'],
-  verify: ['POST'],
-  tools: ['GET'],
-  connect: ['POST'],
-  disconnect: ['POST'],
-  rename: ['POST'],
-  policy: ['PUT'],
-};
-
-async function dispatch(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-  tgt: Routable,
-): Promise<void> {
-  if (tgt.kind === 'callback') {
-    handleCallback(req, res, deps);
-    return;
-  }
-  const session = await apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return;
-  }
-  if (tgt.kind === 'migration-preview') requireAdmin(session);
-  await route(req, res, deps, tgt);
-}
-
-export function handleConnectorApiRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ConnectorApiDeps,
-): boolean {
-  const tgt = target((req.url ?? '').split('?')[0] ?? '');
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such connector' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  dispatch(req, res, deps, tgt).catch((err: unknown) => {
-    if (res.headersSent) return;
-    apiFailure(req, res, err, 'connector-api');
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/config.ts

@@ -1,105 +0,0 @@
-import { stringOf } from '@metro-labs/http/api-http';
-import type {
-  ConnectorAuth,
-  VerifiedRecord,
-  VerifiedServer,
-} from '@metro-labs/http/connector-mcp';
-import type { OAuthClient } from '@metro-labs/http/connector-oauth';
-import { isRecord } from '@metro-labs/core/is-record';
-import type { ToolGroup } from '@metro-labs/core/stations/types';
-import { parsePolicy, type ToolPolicy } from '../policy/policy.js';
-
-export type ConnectorSignIn = 'connected' | 'disconnected' | null;
-
-export interface ConnectorConfig {
-  auth: ConnectorAuth;
-  createdAt: string;
-  verified: VerifiedRecord;
-  oauth: boolean;
-  client: OAuthClient | null;
-  policy?: ToolPolicy;
-  toolGroups?: Record<string, ToolGroup>;
-}
-
-function readClient(raw: unknown): OAuthClient | null {
-  if (!isRecord(raw)) return null;
-  const clientId = stringOf(raw.clientId);
-  if (clientId === '') return null;
-  const clientSecret = stringOf(raw.clientSecret);
-  return { clientId, ...(clientSecret === '' ? {} : { clientSecret }) };
-}
-
-function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
-  const accessToken = stringOf(raw.accessToken);
-  const clientId = stringOf(raw.clientId);
-  const tokenEndpoint = stringOf(raw.tokenEndpoint);
-  if (accessToken === '' || clientId === '' || tokenEndpoint === '')
-    return { kind: 'none' };
-  const refreshToken = stringOf(raw.refreshToken);
-  const clientSecret = stringOf(raw.clientSecret);
-  const scope = stringOf(raw.scope);
-  return {
-    kind: 'oauth',
-    accessToken,
-    clientId,
-    tokenEndpoint,
-    issuer: stringOf(raw.issuer),
-    ...(typeof raw.resource === 'string' ? { resource: raw.resource } : {}),
-    ...(typeof raw.tokenEndpointAuthMethod === 'string' ? { tokenEndpointAuthMethod: raw.tokenEndpointAuthMethod } : {}),
-    ...(refreshToken === '' ? {} : { refreshToken }),
-    ...(clientSecret === '' ? {} : { clientSecret }),
-    ...(scope === '' ? {} : { scope }),
-    ...(typeof raw.expiresAt === 'number' ? { expiresAt: raw.expiresAt } : {}),
-  };
-}
-
-function readAuth(raw: unknown): ConnectorAuth {
-  if (!isRecord(raw)) return { kind: 'none' };
-  if (raw.kind === 'oauth') return readOAuth(raw);
-  if (raw.kind !== 'header') return { kind: 'none' };
-  const name = stringOf(raw.name);
-  const value = stringOf(raw.value);
-  if (name === '' || value === '') return { kind: 'none' };
-  return { kind: 'header', name, value };
-}
-
-function readVerified(raw: unknown): VerifiedRecord {
-  const record = isRecord(raw) ? raw : {};
-  return { at: stringOf(record.at), server: stringOf(record.server) };
-}
-
-const TOOL_NAME_MAX = 128;
-const TOOL_GROUPS_MAX = 1000;
-
-function readToolGroups(raw: unknown): Record<string, ToolGroup> | undefined {
-  if (!isRecord(raw)) return undefined;
-  const kept = Object.entries(raw)
-    .filter((entry): entry is [string, ToolGroup] => entry[0].length <= TOOL_NAME_MAX && (entry[1] === 'read' || entry[1] === 'write'))
-    .slice(0, TOOL_GROUPS_MAX);
-  return kept.length > 0 ? Object.fromEntries(kept) : undefined;
-}
-
-export function readConfig(raw: unknown): ConnectorConfig {
-  const record = isRecord(raw) ? raw : {};
-  const auth = readAuth(record.auth);
-  const policy = parsePolicy(record.policy, 'connectors.json');
-  const toolGroups = readToolGroups(record.toolGroups);
-  return {
-    auth,
-    createdAt: stringOf(record.createdAt),
-    verified: readVerified(record.verified),
-    oauth: record.oauth === true || auth.kind === 'oauth',
-    client: readClient(record.client),
-    ...(policy === undefined || Object.keys(policy).length === 0 ? {} : { policy }),
-    ...(toolGroups === undefined ? {} : { toolGroups }),
-  };
-}
-
-export function signInState(config: ConnectorConfig): ConnectorSignIn {
-  if (config.auth.kind === 'oauth') return 'connected';
-  return config.oauth ? 'disconnected' : null;
-}
-
-export function stamp(server: VerifiedServer): VerifiedRecord {
-  return { at: new Date().toISOString(), server: server.server };
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/health.ts

@@ -1,18 +0,0 @@
-export interface ConnectorHealth {
-  ok: boolean;
-  reason: string | null;
-  at: string;
-}
-
-const seen = new Map<string, ConnectorHealth>();
-
-export function noteHealth(id: string, ok: boolean, reason: string | null = null): void {
-  seen.set(id, { ok, reason: ok ? null : reason, at: new Date().toISOString() });
-}
-
-export const healthOf = (id: string): ConnectorHealth | null => seen.get(id) ?? null;
-
-export function forgetHealth(id?: string): void {
-  if (id === undefined) seen.clear();
-  else seen.delete(id);
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/migration-api.ts

@@ -1,60 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { isRecord } from '@metro-labs/core/is-record';
-import { parseId } from '@metro-labs/core/ids';
-import { ApiError } from '@metro-labs/http/api-error';
-import { readJsonBody, sessionRoute } from '@metro-labs/http/api-http';
-import { publicOAuthResource } from '@metro-labs/http/connector-public-url';
-import type { ConnectorMigrations, MigrationAction } from './migration-control.js';
-
-const PATH = '/api/connectors/migrations';
-const actions: readonly MigrationAction[] = ['move', 'prepare', 'reconcile', 'cutover', 'rollback', 'resolve'];
-export type MigrationApiDeps = Pick<ConnectorMigrations, 'status' | 'run'>;
-
-interface MigrationInput {
-  sourceId: string;
-  action: MigrationAction;
-  scope: string;
-  operationId: string | null;
-  uncertainty: string | null;
-  oauthResource?: string;
-}
-
-function operationOf(value: unknown): string | null {
-  if (value === null) return null;
-  const id = parseId(value);
-  if (id === null) throw new ApiError('A migration needs its current operation ID, or null for an unprepared source.', 400);
-  return id;
-}
-
-function receiptOf(body: Record<string, unknown>, action: MigrationAction): string | null {
-  if (action !== 'resolve') {
-    if (Object.hasOwn(body, 'uncertainty')) throw new ApiError('Only request settlement accepts an uncertainty receipt.', 400);
-    return null;
-  }
-  if (typeof body.uncertainty !== 'string' || !/^[a-f0-9]{64}$/.test(body.uncertainty)) throw new ApiError('Confirming settled vendor requests needs the current uncertainty receipt.', 400);
-  return body.uncertainty;
-}
-
-function inputOf(body: unknown): MigrationInput {
-  if (!isRecord(body) || Object.keys(body).some((key) => !['scope', 'sourceId', 'action', 'operationId', 'uncertainty', 'oauthResource'].includes(key)) || typeof body.scope !== 'string' || !/^[a-f0-9]{64}$/.test(body.scope)) {
-    throw new ApiError('A migration needs its connector, action and current enrollment scope.', 400);
-  }
-  const sourceId = parseId(body.sourceId);
-  const action = actions.find((value) => value === body.action);
-  if (sourceId === null || action === undefined) throw new ApiError('A migration needs a valid connector and action.', 400);
-  return {
-    sourceId, action, scope: body.scope, operationId: operationOf(body.operationId), uncertainty: receiptOf(body, action),
-    ...(body.oauthResource === undefined ? {} : { oauthResource: publicOAuthResource(body.oauthResource) }),
-  };
-}
-
-export function handleMigrationRequest(req: IncomingMessage, res: ServerResponse, deps: MigrationApiDeps): boolean {
-  return sessionRoute(req, res, { methods: { [PATH]: ['GET', 'POST'] }, admin: true, label: 'connector-migration-api' }, async (session) => {
-    const body = req.method === 'POST' ? await readJsonBody(req) : null;
-    const current = deps.status();
-    if (current.owner === null || current.owner !== session.subject) throw new ApiError('This agent belongs to another organization.', 403);
-    if (req.method !== 'POST') return current;
-    const { sourceId, action, scope, operationId, uncertainty, oauthResource } = inputOf(body);
-    return deps.run(sourceId, action, scope, operationId, uncertainty, oauthResource);
-  });
-}