@stage-labs/metro 0.1.0-beta.31 → 0.1.0-beta.310

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/stations/attach-xmtp.ts

@@ -1,7 +1,8 @@
 import { randomBytes } from 'node:crypto';
+import { stringOf } from '@metro-labs/http/api-http';
 import { rmSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { errMsg, log } from '../daemon/log.js';
+import { errMsg, log } from '@metro-labs/core/log';
 
 export class XmtpAttachError extends Error {}
 
@@ -43,8 +44,6 @@ interface VerifyReply {
   error?: unknown;
 }
 
-const str = (value: unknown): string => (typeof value === 'string' ? value : '');
-
 function readReply(raw: string): VerifyReply {
   const line = raw.trim().split('\n').at(-1) ?? '';
   try {
@@ -89,7 +88,7 @@ export async function verifyXmtpKeyOutOfProcess(
   dbPath: string,
 ): Promise<XmtpIdentity> {
   const raw = await runVerifier(
-    JSON.stringify({ privateKey, dbPath }),
+    JSON.stringify({ privateKey, dbPath, smart: true }),
   ).catch((err: unknown) => {
     log.warn({ err: errMsg(err) }, 'attach-xmtp: could not run the inbox check');
     throw new XmtpAttachError(UNREACHABLE);
@@ -97,13 +96,13 @@ export async function verifyXmtpKeyOutOfProcess(
   const reply = readReply(raw);
   if (reply.ok !== true)
     throw new XmtpAttachError(
-      withoutKey(str(reply.error) || UNREACHABLE, privateKey),
+      withoutKey(stringOf(reply.error) || UNREACHABLE, privateKey),
     );
   const identity = {
-    inboxId: str(reply.inboxId),
-    address: str(reply.address),
-    installationId: str(reply.installationId),
-    dbPath: str(reply.dbPath),
+    inboxId: stringOf(reply.inboxId),
+    address: stringOf(reply.address),
+    installationId: stringOf(reply.installationId),
+    dbPath: stringOf(reply.dbPath),
   };
   if (identity.inboxId === '' || identity.address === '')
     throw new XmtpAttachError(UNREACHABLE);

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/stations/attach.ts

@@ -7,8 +7,15 @@ import {
   TelegramTokenError,
   verifyTelegramBotToken,
 } from '@metro-labs/telegram-bot/verify';
-import { ApiError } from '../daemon/api-error.js';
-import { publicBaseOrDefault } from '../daemon/attach-serve.js';
+import {
+  parsePrivateKey,
+  ThreemaGatewayError,
+  verifyThreemaGateway,
+} from '@metro-labs/threema/verify';
+import { ApiError } from '@metro-labs/http/api-error';
+import { bodyField } from '@metro-labs/http/api-http';
+import { ensureStationDeps } from './runtime-deps.js';
+import { publicBaseOrDefault } from '../files/attach-serve.js';
 import {
   discardXmtpDb,
   newXmtpDbPath,
@@ -20,6 +27,7 @@ import {
 export const ATTACHABLE_STATIONS = [
   'discord-bot',
   'telegram-bot',
+  'threema',
   'xmtp',
   'webhook',
 ] as const;
@@ -31,6 +39,9 @@ export class StationAttachError extends ApiError {}
 export interface AttachInput {
   station: AttachStation;
   token?: unknown;
+  gatewayId?: unknown;
+  secret?: unknown;
+  privateKey?: unknown;
 }
 
 export interface OneTimeSecret {
@@ -52,6 +63,16 @@ const SECP256K1_ORDER = BigInt(
   '0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141',
 );
 
+export function attachInputOf(station: AttachStation, body: unknown): AttachInput {
+  return {
+    station,
+    token: bodyField(body, 'token'),
+    gatewayId: bodyField(body, 'gatewayId'),
+    secret: bodyField(body, 'secret'),
+    privateKey: bodyField(body, 'privateKey'),
+  };
+}
+
 export function isAttachStation(raw: unknown): raw is AttachStation {
   return (
     typeof raw === 'string' &&
@@ -137,7 +158,7 @@ async function prepareXmtp(verify: VerifyXmtpKey): Promise<PreparedAccount> {
     ),
   );
   return {
-    config: { privateKey, dbPath },
+    config: { privateKey, dbPath, smart: true },
     identity: { inboxId: identity.inboxId, address: identity.address },
     secret: {
       label: 'xmtp private key',
@@ -162,6 +183,49 @@ export function newWebhookId(): string {
   return String(WEBHOOK_ID_FLOOR + (raw % (9n * WEBHOOK_ID_FLOOR)));
 }
 
+export const threemaCallbackUrl = (callbackId: string, token: string): string =>
+  `${publicBaseOrDefault().replace(/\/+$/, '')}/api/threema/${callbackId}/${token}`;
+
+function requireText(raw: unknown, label: string): string {
+  const text = typeof raw === 'string' ? raw.trim() : '';
+  if (text === '')
+    throw new StationAttachError(`the Threema ${label} is required`, 400);
+  return text;
+}
+
+async function prepareThreema(input: AttachInput): Promise<PreparedAccount> {
+  const gatewayId = requireText(input.gatewayId, 'Gateway ID');
+  const secret = requireText(input.secret, 'API secret');
+  const privateKey = requireText(input.privateKey, 'private key');
+  try {
+    const identity = await verifyThreemaGateway({ gatewayId, secret, privateKey });
+    const callbackId = newWebhookId();
+    const callbackToken = randomBytes(48).toString('base64url');
+    return {
+      config: {
+        gatewayId: identity.gatewayId,
+        secret,
+        privateKey: parsePrivateKey(privateKey) ?? privateKey,
+        callbackId,
+        callbackToken,
+        createdAt: new Date().toISOString(),
+      },
+      identity: {
+        gatewayId: identity.gatewayId,
+        credits: String(identity.credits),
+        callback: threemaCallbackUrl(callbackId, callbackToken),
+      },
+    };
+  } catch (err) {
+    if (err instanceof StationAttachError) throw err;
+    return rejected(
+      err,
+      err instanceof ThreemaGatewayError,
+      'Threema rejected those Gateway credentials',
+    );
+  }
+}
+
 function prepareWebhook(): PreparedAccount {
   const secret = randomBytes(48).toString('base64url');
   const webhookId = newWebhookId();
@@ -175,8 +239,10 @@ export async function prepareAccount(
   input: AttachInput,
   verify: VerifyXmtpKey = verifyXmtpKeyOutOfProcess,
 ): Promise<PreparedAccount> {
+  ensureStationDeps(input.station);
   if (input.station === 'discord-bot') return prepareDiscord(input.token);
   if (input.station === 'telegram-bot') return prepareTelegram(input.token);
   if (input.station === 'webhook') return prepareWebhook();
+  if (input.station === 'threema') return prepareThreema(input);
   return prepareXmtp(verify);
 }

package/runtime/node_modules/@metro-labs/{mcp/src/db → daemon/src/stations}/materialize.ts

@@ -1,3 +1,4 @@
+import { setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import {
   existsSync,
   mkdirSync,
@@ -6,22 +7,21 @@ import {
   writeFileSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
-import { ID_RE } from './ids.js';
 import { join } from 'node:path';
-import { eq } from 'drizzle-orm';
-import { log } from '../daemon/log.js';
-import { writeSecure } from '../daemon/secure-fs.js';
-import { closeDb, databaseUrl, getDb } from './client.js';
+import { log } from '@metro-labs/core/log';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { trainsDir } from '../boot/paths.js';
 import {
   setAgentMap,
   setAllowlistMap,
+  setApproversMap,
+  setDisabledAccounts,
   type AgentMap,
   type AgentNameMap,
   type AllowlistMap,
-} from './agent-map.js';
-import { setKeyMap } from './key-map.js';
-import { carryTokenStores, PREVIOUS_ACCOUNT_ID } from './token-carry.js';
-import { STATIONS, stations, agents, type StationName } from './schema.js';
+} from '../agents/map.js';
+import { setKeyMap } from '../agents/keys.js';
+import { STATIONS, type StationName } from '@metro-labs/core/station-names';
 
 interface StationTarget {
   file: string;
@@ -33,6 +33,9 @@ export interface LoadedAccount {
   station: StationName;
   id: string;
   allowlist: string[] | null;
+  approvers?: string[];
+  enabled?: boolean;
+  policy?: ToolPolicy;
   config: Record<string, unknown>;
 }
 
@@ -44,7 +47,6 @@ export interface LoadedAgent {
 }
 
 const METRO_DIR = join(homedir(), '.metro');
-const TRAINS_DIR = process.env.METRO_TRAINS_DIR ?? join(METRO_DIR, 'trains');
 
 const STATION_TARGETS: Record<StationName, StationTarget> = {
   xmtp: {
@@ -72,6 +74,21 @@ const STATION_TARGETS: Record<StationName, StationTarget> = {
     fileEnv: 'WHATSAPP_ACCOUNTS_FILE',
     trainImport: '@metro-labs/whatsapp/train',
   },
+  threema: {
+    file: 'threema-accounts.json',
+    fileEnv: 'THREEMA_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/threema/train',
+  },
+  outlook: {
+    file: 'outlook-accounts.json',
+    fileEnv: 'OUTLOOK_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/outlook/train',
+  },
+  gmail: {
+    file: 'gmail-accounts.json',
+    fileEnv: 'GMAIL_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/gmail/train',
+  },
   webhook: {
     file: 'webhook-accounts.json',
     fileEnv: 'WEBHOOK_ACCOUNTS_FILE',
@@ -79,137 +96,19 @@ const STATION_TARGETS: Record<StationName, StationTarget> = {
   },
 };
 
-function accountFilePath(station: StationName): string {
+export function accountFilePath(station: StationName): string {
   const target = STATION_TARGETS[station];
   return process.env[target.fileEnv] ?? join(METRO_DIR, target.file);
 }
 
-function agentFilter(): string | undefined {
-  const v = process.env.METRO_AGENT?.trim();
-  if (!v) return undefined;
-  if (!ID_RE.test(v))
-    throw new Error(`METRO_AGENT must be an 11-character agent id, got '${v}'`);
-  return v;
-}
-
 export type StationSource = () => Promise<LoadedAgent[]>;
 
 export const MOVABLE_STATIONS = new Set<StationName>(
   STATIONS.filter((s) => s !== 'webhook'),
 );
 
-export function unmovableStations(list: LoadedAccount[]): StationName[] {
-  return [
-    ...new Set(
-      list
-        .map((a) => a.station)
-        .filter((station) => !MOVABLE_STATIONS.has(station)),
-    ),
-  ];
-}
-
-export interface StationRecord {
-  id: string;
-  agentId: string;
-  station: StationName;
-}
-
-export async function listAllStations(): Promise<StationRecord[]> {
-  if (!databaseUrl()) return [];
-  const rows = await getDb()
-    .select({
-      id: stations.id,
-      agentId: stations.agentId,
-      station: stations.station,
-    })
-    .from(stations);
-  return rows;
-}
-
-export async function loadAllStationsFor(
-  agentId: string,
-): Promise<LoadedAccount[]> {
-  const rows = await getDb()
-    .select()
-    .from(stations)
-    .where(eq(stations.agentId, agentId));
-  return rows.map((r) => ({
-    station: r.station,
-    id: r.id,
-    allowlist: r.allowlist,
-    config: r.config as Record<string, unknown>,
-  }));
-}
-
-export async function loadAgentForRuntime(
-  agentId: string,
-): Promise<LoadedAgent> {
-  const db = getDb();
-  const rows = await db.select().from(agents).where(eq(agents.id, agentId));
-  const a = rows[0];
-  if (a === undefined) throw new Error(`no such agent '${agentId}'`);
-  const acctRows = await db
-    .select()
-    .from(stations)
-    .where(eq(stations.agentId, a.id));
-  return {
-    id: a.id,
-    name: a.name,
-    key: a.key,
-    accounts: acctRows
-      .filter((r) => MOVABLE_STATIONS.has(r.station))
-      .map((r) => ({
-        station: r.station,
-        id: r.id,
-        allowlist: r.allowlist,
-        config: r.config as Record<string, unknown>,
-      })),
-  };
-}
-
-export const pgSource: StationSource = () => loadAgents();
-
-async function loadAgents(): Promise<LoadedAgent[]> {
-  const db = getDb();
-  const only = agentFilter();
-  const agentRows =
-    only !== undefined
-      ? await db.select().from(agents).where(eq(agents.id, only))
-      : await db.select().from(agents);
-  if (only !== undefined && agentRows.length === 0)
-    throw new Error(`METRO_AGENT=${only} does not match any agent`);
-
-  const out: LoadedAgent[] = [];
-  for (const a of agentRows) {
-    const acctRows = await db
-      .select()
-      .from(stations)
-      .where(eq(stations.agentId, a.id));
-    out.push({
-      id: a.id,
-      name: a.name,
-      accounts: acctRows.map((r) => ({
-        station: r.station,
-        id: r.id,
-        allowlist: r.allowlist,
-        config: r.config as Record<string, unknown>,
-      })),
-      key: a.runtimeId === null ? a.key : null,
-    });
-  }
-  return out;
-}
-
-function trainConfig(
-  config: Record<string, unknown>,
-): Record<string, unknown> {
-  return Object.fromEntries(
-    Object.entries(config).filter(([key]) => key !== PREVIOUS_ACCOUNT_ID),
-  );
-}
-
 function trainStubPath(station: StationName): string {
-  return join(TRAINS_DIR, `${station}.ts`);
+  return join(trainsDir(), `${station}.ts`);
 }
 
 function currentText(path: string): string | null {
@@ -226,25 +125,32 @@ export function writeIfChanged(path: string, content: string): boolean {
   return true;
 }
 
-export const isLocalRuntime = (): boolean =>
-  (process.env.METRO_RUN_TOKEN?.trim() ?? '') !== '';
-
-export const stationRunsHere = (station: StationName): boolean =>
-  isLocalRuntime() || !MOVABLE_STATIONS.has(station);
-
 interface WrittenStations {
   active: Map<StationName, number>;
   changed: StationName[];
 }
 
+const channelPolicies = (list: LoadedAgent[]): [PolicyTarget, ToolPolicy][] =>
+  list.flatMap((agent) =>
+    agent.accounts.flatMap((a): [PolicyTarget, ToolPolicy][] =>
+      a.policy === undefined ? [] : [[{ kind: 'channel', station: a.station, account: a.id }, a.policy]],
+    ),
+  );
+
+const approversOf = (list: LoadedAgent[]): Record<string, string[]> =>
+  Object.fromEntries(
+    list.flatMap((agent) => agent.accounts.flatMap((a) => (a.approvers === undefined ? [] : [[`${a.station}/${a.id}`, a.approvers]]))),
+  );
+
 function writeStations(list: LoadedAgent[]): WrittenStations {
   mkdirSync(METRO_DIR, { recursive: true });
-  mkdirSync(TRAINS_DIR, { recursive: true });
+  mkdirSync(trainsDir(), { recursive: true });
 
   const byStation = new Map<StationName, LoadedAccount[]>();
   const map: AgentMap = {};
   const names: AgentNameMap = {};
   const allow: AllowlistMap = {};
+  const disabled = new Set<string>();
   for (const agent of list) {
     names[agent.id] = agent.name;
     for (const a of agent.accounts) {
@@ -257,21 +163,22 @@ function writeStations(list: LoadedAgent[]): WrittenStations {
       }
       map[`${a.station}/${a.id}`] = agent.id;
       if (a.allowlist) allow[`${a.station}/${a.id}`] = a.allowlist;
-      if (stationRunsHere(a.station)) {
-        const cur = byStation.get(a.station);
-        if (cur) cur.push(a);
-        else byStation.set(a.station, [a]);
-      }
+      if (a.enabled === false) disabled.add(`${a.station}/${a.id}`);
+      const cur = byStation.get(a.station);
+      if (cur) cur.push(a);
+      else byStation.set(a.station, [a]);
     }
   }
   setAgentMap(map, names);
   setAllowlistMap(allow);
-  carryTokenStores(list.flatMap((agent) => agent.accounts));
+  setApproversMap(approversOf(list));
+  setDisabledAccounts(disabled);
+  setPolicies('channel', channelPolicies(list));
 
   const active = new Map<StationName, number>();
   const changed: StationName[] = [];
   for (const [station, accts] of byStation) {
-    const records = accts.map((a) => ({ id: a.id, ...trainConfig(a.config) }));
+    const records = accts.map((a) => ({ id: a.id, ...a.config }));
     const path = accountFilePath(station);
     const content = JSON.stringify(records, null, 2);
     if (currentText(path) !== content) {
@@ -309,7 +216,6 @@ const stationLabels = (m: Map<StationName, number>): string[] =>
   [...m].map(([station, n]) => `${station}(${n})`);
 
 function applyKeyMap(list: LoadedAgent[]): void {
-  lastKey = list.find((a) => a.key !== null)?.key ?? null;
   setKeyMap(
     list.flatMap((agent) =>
       agent.key === null ? [] : [{ key: agent.key, agentId: agent.id }],
@@ -317,12 +223,6 @@ function applyKeyMap(list: LoadedAgent[]): void {
   );
 }
 
-let lastKey: string | null = null;
-
-export function localAgentKey(): string | null {
-  return lastKey;
-}
-
 async function loadAndWrite(
   source: StationSource,
 ): Promise<WrittenStations & { agents: number }> {
@@ -333,24 +233,13 @@ async function loadAndWrite(
 
 export async function materializeFrom(source: StationSource): Promise<void> {
   const { active, agents: found } = await loadAndWrite(source);
-
-  if (found === 0) throw new Error('no agents found — nothing to materialize');
+  const removed = pruneStations(active);
   log.info(
-    { stations: stationLabels(active), agents: found },
+    { stations: stationLabels(active), agents: found, removed },
     'materialized station accounts',
   );
 }
 
-export async function materializeFromDb(): Promise<void> {
-  if (!databaseUrl())
-    throw new Error('DATABASE_URL is not set — accounts load from Postgres');
-  try {
-    await materializeFrom(pgSource);
-  } finally {
-    await closeDb();
-  }
-}
-
 export interface ReloadedStations {
   active: StationName[];
   removed: StationName[];
@@ -369,14 +258,3 @@ export async function reloadFrom(
     );
   return { active: [...active.keys()], removed, changed };
 }
-
-export async function reloadAccountsFromDb(): Promise<ReloadedStations> {
-  if (!databaseUrl())
-    throw new Error('DATABASE_URL is not set — accounts load from Postgres');
-  return reloadFrom(pgSource);
-}
-
-if (import.meta.main) {
-  await materializeFromDb();
-  process.exit(0);
-}

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/stations/registry.ts

@@ -1,10 +1,14 @@
-import type { Station } from './types.js';
-import { Line } from './lines.js';
+import type { Station } from '@metro-labs/core/stations/types';
+import { Line } from '@metro-labs/core/lines';
+import { errMsg, log } from '@metro-labs/core/log';
 import { xmtpStation } from '@metro-labs/xmtp';
 import { telegramBotStation } from '@metro-labs/telegram-bot';
 import { telegramStation } from '@metro-labs/telegram';
 import { discordBotStation } from '@metro-labs/discord-bot';
 import { whatsappStation } from '@metro-labs/whatsapp';
+import { threemaStation } from '@metro-labs/threema';
+import { outlookStation } from '@metro-labs/outlook';
+import { gmailStation } from '@metro-labs/gmail';
 import { webhookStation } from '@metro-labs/webhook';
 
 export const STATIONS: readonly Station[] = [
@@ -13,6 +17,9 @@ export const STATIONS: readonly Station[] = [
   telegramStation,
   discordBotStation,
   whatsappStation,
+  threemaStation,
+  outlookStation,
+  gmailStation,
   webhookStation,
 ];
 
@@ -33,3 +40,14 @@ export const accountStationCapabilities = (): Record<string, string[]> => {
     if (s.hasAccounts) out[s.name] = [...s.messageVerbs].sort();
   return out;
 };
+
+export function forgetOrphans(known: readonly { station: string; id: string }[]): void {
+  for (const s of STATIONS) {
+    if (s.forgetExcept === undefined) continue;
+    try {
+      s.forgetExcept(known.filter((a) => a.station === s.name).map((a) => a.id));
+    } catch (err) {
+      log.warn({ station: s.name, err: errMsg(err) }, 'stations: could not remove the files of detached accounts');
+    }
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/stations/runtime-deps.ts

@@ -0,0 +1,135 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import type { StationName } from '@metro-labs/core/station-names';
+import { knownAccounts } from '../agents/map.js';
+
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+
+export interface RuntimeManifest {
+  core: Record<string, string>;
+  stations: Record<string, Record<string, string>>;
+  patchedDependencies?: Record<string, string>;
+}
+
+export interface RuntimeStore {
+  dir: string;
+  sources: string;
+  manifest: RuntimeManifest;
+}
+
+const ranges = (raw: unknown): Record<string, string> =>
+  isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e): e is [string, string] => typeof e[1] === 'string'))
+    : {};
+
+function patchesOf(raw: unknown): Record<string, string> {
+  if (!isRecord(raw)) throw new Error('Invalid runtime patch map');
+  return Object.fromEntries(Object.entries(raw).map(([name, path]) => {
+    if (typeof path !== 'string' || !/^patches\/[a-f0-9]{64}\.patch$/.test(path))
+      throw new Error(`Invalid runtime patch path for ${name}`);
+    return [name, path];
+  }));
+}
+
+export function readManifest(path: string): RuntimeManifest {
+  const raw: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!isRecord(raw)) throw new Error(`${path} is not a runtime manifest`);
+  const stations = isRecord(raw.stations) ? raw.stations : {};
+  return {
+    core: ranges(raw.core),
+    stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+    ...(raw.patchedDependencies === undefined ? {} : { patchedDependencies: patchesOf(raw.patchedDependencies) }),
+  };
+}
+
+export function runtimeStore(): RuntimeStore | null {
+  const dir = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  const manifest = process.env.METRO_RUNTIME_MANIFEST?.trim() ?? '';
+  if (dir === '' || manifest === '') return null;
+  return { dir, sources: dirname(manifest), manifest: readManifest(manifest) };
+}
+
+export function dependenciesFor(manifest: RuntimeManifest, stations: Iterable<string>): Record<string, string> {
+  const out: Record<string, string> = { ...manifest.core };
+  for (const station of new Set(stations)) Object.assign(out, manifest.stations[station] ?? {});
+  return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+function packageText(deps: Record<string, string>, patches: Record<string, string>): string {
+  const patchedDependencies = Object.fromEntries(
+    Object.entries(deps).flatMap(([name, version]) => {
+      const key = `${name}@${version}`;
+      const path = patches[key];
+      return path === undefined ? [] : [[key, path]];
+    }),
+  );
+  return `${JSON.stringify({
+    name: 'metro-runtime',
+    private: true,
+    dependencies: deps,
+    ...(Object.keys(patchedDependencies).length === 0 ? {} : { patchedDependencies }),
+  }, null, 2)}\n`;
+}
+
+function current(dir: string): string | null {
+  try {
+    return readFileSync(join(dir, 'package.json'), 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function copyPatches(store: RuntimeStore): void {
+  const paths = Object.values(patchesOf(store.manifest.patchedDependencies ?? {}));
+  if (paths.length === 0) return;
+  const destination = join(store.dir, 'patches');
+  mkdirSync(destination, { recursive: true });
+  if (!lstatSync(join(store.sources, 'patches')).isDirectory() || !lstatSync(destination).isDirectory())
+    throw new Error('Invalid runtime patch directory');
+  for (const path of new Set(paths)) {
+    const source = join(store.sources, path);
+    const target = join(store.dir, path);
+    if (!lstatSync(source).isFile() || lstatSync(target, { throwIfNoEntry: false })?.isFile() === false)
+      throw new Error(`Invalid runtime patch file: ${path}`);
+    const hash = createHash('sha256').update(readFileSync(source)).digest('hex');
+    if (path !== `patches/${hash}.patch`) throw new Error(`Invalid runtime patch contents: ${path}`);
+    copyFileSync(source, target);
+  }
+}
+
+export function installRuntime(store: RuntimeStore, stations: Iterable<string>): boolean {
+  const wanted = packageText(dependenciesFor(store.manifest, stations), store.manifest.patchedDependencies ?? {});
+  const marker = join(store.dir, 'node_modules', '.metro-installed');
+  try {
+    copyPatches(store);
+  } catch (err) {
+    rmSync(marker, { force: true });
+    throw err;
+  }
+  if (existsSync(marker) && current(store.dir) === wanted) return false;
+  rmSync(marker, { force: true });
+  mkdirSync(store.dir, { recursive: true });
+  writeFileSync(join(store.dir, 'package.json'), wanted);
+  log.info({ dir: store.dir }, 'runtime: installing the channel SDKs this machine needs');
+  const run = spawnSync('bun', ['install', '--no-summary', '--no-progress'], {
+    cwd: store.dir,
+    stdio: ['ignore', 'inherit', 'inherit'],
+    timeout: INSTALL_TIMEOUT_MS,
+  });
+  if (run.error !== undefined || run.status !== 0)
+    throw new Error(`bun install failed in ${store.dir}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+  writeFileSync(marker, `${new Date().toISOString()}\n`);
+  return true;
+}
+
+export function ensureStationDeps(station?: StationName): void {
+  const store = runtimeStore();
+  if (store === null) return;
+  const stations = knownAccounts().map((a) => a.station);
+  if (station !== undefined) stations.push(station);
+  installRuntime(store, stations);
+}