@stage-labs/metro 0.1.0-beta.32 → 0.1.0-beta.320

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-routes.ts

@@ -1,89 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from './log.js';
-import {
-  apiFailure,
-  bodyField,
-  cors,
-  readJsonBody,
-  sendJson,
-} from './api-http.js';
-import { mintNonce, takeNonce } from './siwe-nonces.js';
-import { verifySiweLogin } from './siwe-auth.js';
-import { signSession } from './session.js';
-import { sessionTtlFromEnv } from './session-config.js';
-import { ensureUserWithProject } from '../db/projects.js';
-
-const NONCE_PATH = '/auth/siwe/nonce';
-const VERIFY_PATH = '/auth/siwe/verify';
-
-export interface SiweRouteDeps {
-  ensureUser: (address: string) => Promise<string>;
-}
-
-const defaultDeps: SiweRouteDeps = { ensureUser: ensureUserWithProject };
-
-async function handleVerify(
-  req: IncomingMessage,
-  res: ServerResponse,
-  secret: string,
-  deps: SiweRouteDeps,
-): Promise<void> {
-  const body = await readJsonBody(req);
-  const message = bodyField(body, 'message');
-  const signature = bodyField(body, 'signature');
-  if (typeof message !== 'string' || typeof signature !== 'string') {
-    sendJson(req, res, 400, { error: 'message and signature are required' });
-    return;
-  }
-  const address = await verifySiweLogin({ message, signature }, { takeNonce });
-  const userId = await deps.ensureUser(address);
-  log.info({ userId, address }, 'siwe: session issued');
-  const session = signSession({ subject: address, agentIds: [] }, secret, {
-    ttlSec: sessionTtlFromEnv(),
-  });
-  sendJson(req, res, 200, { session, address });
-}
-
-const ROUTES: Record<string, string> = {
-  [NONCE_PATH]: 'GET',
-  [VERIFY_PATH]: 'POST',
-};
-
-function refused(
-  req: IncomingMessage,
-  res: ServerResponse,
-  path: string,
-): boolean {
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (req.method !== ROUTES[path]) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  return false;
-}
-
-export function handleSiweAuthRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: SiweRouteDeps = defaultDeps,
-): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  if (ROUTES[path] === undefined) return false;
-  if (refused(req, res, path)) return true;
-  const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  if (secret === '') {
-    sendJson(req, res, 503, { error: 'sign-in is not configured' });
-    return true;
-  }
-  if (path === NONCE_PATH) {
-    sendJson(req, res, 200, { nonce: mintNonce() });
-    return true;
-  }
-  handleVerify(req, res, secret, deps).catch((err: unknown) => {
-    apiFailure(req, res, err, 'siwe');
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -1,169 +0,0 @@
-import { spawn, spawnSync, type ChildProcess } from 'node:child_process';
-import { timingSafeEqual } from 'node:crypto';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { STATE_DIR } from './paths.js';
-import { errMsg, log } from './log.js';
-import { readJson } from './secure-fs.js';
-
-const FILE = join(STATE_DIR, 'tunnel.json');
-const LEGACY_WEBHOOKS_FILE = join(STATE_DIR, 'webhooks.json');
-const RESTART_DELAY_MS = 2_000;
-
-interface TunnelConfig {
-  name: string;
-  hostname: string;
-}
-
-export interface Endpoint {
-  id: string;
-  webhookId?: string;
-  label: string;
-  secret?: string;
-  session?: string;
-  createdAt: string;
-}
-interface AccountRecord {
-  id?: unknown;
-  webhookId?: unknown;
-  label?: unknown;
-  secret?: unknown;
-  session?: unknown;
-  createdAt?: unknown;
-}
-
-export const webhookPort = (): number =>
-  Number(process.env.METRO_WEBHOOK_PORT) || 8420;
-
-const accountsFile = (): string =>
-  process.env.WEBHOOK_ACCOUNTS_FILE ??
-  join(homedir(), '.metro', 'webhook-accounts.json');
-
-const str = (v: unknown): string | undefined =>
-  typeof v === 'string' && v !== '' ? v : undefined;
-
-function toEndpoint(raw: AccountRecord): Endpoint | null {
-  const id = str(raw.id);
-  if (id === undefined) return null;
-  return {
-    id,
-    webhookId: str(raw.webhookId),
-    label: str(raw.label) ?? id,
-    secret: str(raw.secret),
-    session: str(raw.session),
-    createdAt: str(raw.createdAt) ?? '',
-  };
-}
-
-export function listEndpoints(): Endpoint[] {
-  const raw = readJson<AccountRecord[]>(accountsFile(), [], {
-    warn: 'webhook-accounts.json: malformed, ignoring',
-  });
-  if (!Array.isArray(raw)) return [];
-  return raw.map(toEndpoint).filter((e): e is Endpoint => e !== null);
-}
-
-export const findEndpointByWebhookId = (
-  webhookId: string,
-): Endpoint | undefined =>
-  listEndpoints().find((e) => e.webhookId === webhookId);
-
-export function tokenMatches(secret: string, given: string): boolean {
-  const want = Buffer.from(secret);
-  const got = Buffer.from(given);
-  return want.length === got.length && timingSafeEqual(want, got);
-}
-
-export function warnOnLegacyWebhooks(): void {
-  const legacy = readJson<{ endpoints?: unknown[] }>(LEGACY_WEBHOOKS_FILE, {});
-  const count = Array.isArray(legacy.endpoints) ? legacy.endpoints.length : 0;
-  if (count > 0)
-    log.warn(
-      { file: LEGACY_WEBHOOKS_FILE, endpoints: count },
-      'webhook: webhooks.json is no longer read — endpoints live in the accounts table; these endpoints are inactive',
-    );
-}
-
-export const loadTunnelConfig = (): TunnelConfig | null =>
-  readJson<TunnelConfig | null>(FILE, null, {
-    warn: 'tunnel.json: malformed, ignoring',
-  });
-
-function fetchTunnelToken(name: string): string | null {
-  const r = spawnSync('cloudflared', ['tunnel', 'token', name], {
-    encoding: 'utf8',
-  });
-  if (r.status !== 0) return null;
-  const token = r.stdout.trim();
-  return token.length > 0 ? token : null;
-}
-
-export class Tunnel {
-  private child: ChildProcess | null = null;
-  private closed = false;
-  private token: string | null | undefined = undefined;
-
-  constructor(
-    private cfg: TunnelConfig,
-    private port: number,
-  ) {}
-
-  get hostname(): string {
-    return this.cfg.hostname;
-  }
-
-  start(): void {
-    if (this.closed) return;
-    if (this.token === undefined) this.token = fetchTunnelToken(this.cfg.name);
-    const mode = this.token ? 'token' : 'named';
-    log.info(
-      {
-        name: this.cfg.name,
-        hostname: this.cfg.hostname,
-        port: this.port,
-        mode,
-      },
-      'cloudflared tunnel starting',
-    );
-    const args = [
-      '--no-autoupdate',
-      'tunnel',
-      'run',
-      '--url',
-      `http://127.0.0.1:${this.port}`,
-    ];
-    if (!this.token) args.push(this.cfg.name);
-    const env = this.token
-      ? { ...process.env, TUNNEL_TOKEN: this.token }
-      : process.env;
-    this.child = spawn('cloudflared', args, {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env,
-    });
-    this.child.stderr?.on('data', (d: Buffer | string) => {
-      log.debug(
-        {
-          cloudflared: (typeof d === 'string' ? d : d.toString('utf8')).trim(),
-        },
-        'cloudflared',
-      );
-    });
-    this.child.on('exit', (code) => {
-      this.child = null;
-      if (this.closed) return;
-      log.warn({ code }, 'cloudflared exited; restarting');
-      setTimeout(() => {
-        this.start();
-      }, RESTART_DELAY_MS);
-    });
-    this.child.on('error', (err) => {
-      log.warn({ err: errMsg(err) }, 'cloudflared spawn error');
-    });
-  }
-
-  stop(): void {
-    this.closed = true;
-    this.child?.kill();
-    this.child = null;
-  }
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/account-attach.ts

@@ -1,91 +0,0 @@
-import { isUniqueViolation } from './users.js';
-import { and, eq, sql } from 'drizzle-orm';
-import { newId } from './ids.js';
-import { getDb } from './client.js';
-import {  AgentAdminError,    ownedAgentOrThrow,  } from './agent-admin.js';
-import { stations, STATIONS, type StationName } from './schema.js';
-
-const ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-const ID_ATTEMPTS = 5;
-
-export interface AccountRef {
-  agentId: string;
-  station: StationName;
-  accountId: string;
-}
-
-export function isStationName(raw: unknown): raw is StationName {
-  return (
-    typeof raw === 'string' && (STATIONS as readonly string[]).includes(raw)
-  );
-}
-
-export function parseAccountId(raw: string): string | null {
-  return ACCOUNT_ID_RE.test(raw) ? raw : null;
-}
-
-async function assertTokenFree(
-  station: StationName,
-  token: string,
-): Promise<void> {
-  const rows = await getDb()
-    .select({ id: stations.id })
-    .from(stations)
-    .where(
-      and(
-        eq(stations.station, station),
-        sql`${stations.config}->>'token' = ${token}`,
-      ),
-    );
-  if (rows.length > 0)
-    throw new AgentAdminError(
-      'that bot token is already attached to a Metro account',
-      409,
-    );
-}
-
-export async function attachAccountToAgent(
-  email: string,
-  agentId: string,
-  station: StationName,
-  config: Record<string, unknown>,
-): Promise<AccountRef> {
-  const { agent } = await ownedAgentOrThrow(email, agentId);
-  const token = config.token;
-  if (typeof token === 'string') await assertTokenFree(station, token);
-  const db = getDb();
-  for (let attempt = 0; attempt < ID_ATTEMPTS; attempt++) {
-    const accountId = newId();
-    try {
-      await db
-        .insert(stations)
-        .values({ id: accountId, agentId: agent.id, station, config });
-      return { agentId: agent.id, station, accountId };
-    } catch (err) {
-      if (!isUniqueViolation(err)) throw err;
-    }
-  }
-  throw new AgentAdminError('could not allocate a free account id', 500);
-}
-
-export async function detachAccountFromAgent(
-  email: string,
-  agentId: string,
-  station: StationName,
-  accountId: string,
-): Promise<AccountRef> {
-  const { agent } = await ownedAgentOrThrow(email, agentId);
-  const gone = await getDb()
-    .delete(stations)
-    .where(
-      and(
-        eq(stations.agentId, agent.id),
-        eq(stations.station, station),
-        eq(stations.id, accountId),
-      ),
-    )
-    .returning({ id: stations.id });
-  if (gone.length === 0)
-    throw new AgentAdminError('no such account on this agent', 404);
-  return { agentId: agent.id, station, accountId };
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-admin.ts

@@ -1,214 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { and, asc, eq, inArray } from 'drizzle-orm';
-import { ApiError } from '../daemon/api-error.js';
-import { getDb } from './client.js';
-import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
-import { AGENT_NAME_RE, newId, parseId } from './ids.js';
-import { agents, stations } from './schema.js';
-import { isUniqueViolation } from './users.js';
-import { projectIdOrThrow } from './projects.js';
-
-const KEY_ATTEMPTS = 5;
-
-export class AgentAdminError extends ApiError {}
-
-export interface AgentSummary {
-  id: string;
-  name: string;
-  owned: boolean;
-  key: string | null;
-}
-
-export interface CreatedAgent {
-  id: string;
-  name: string;
-  key: string;
-}
-
-export interface OwnedAgent {
-  id: string;
-  name: string;
-}
-
-export type DeletedAgent = OwnedAgent;
-
-export interface ResetAgentKey extends OwnedAgent {
-  key: string;
-}
-
-export function normalizeAgentName(raw: unknown): string {
-  const name = typeof raw === 'string' ? raw.trim() : '';
-  if (!AGENT_NAME_RE.test(name))
-    throw new AgentAdminError(
-      'name must be 2-32 characters of A-Z, a-z, 0-9, - or _, starting with a letter or digit',
-      400,
-    );
-  return name;
-}
-
-export function newApiKey(): string {
-  return `mk_${randomBytes(32).toString('base64url')}`;
-}
-
-const agentPin = (): string => process.env.METRO_AGENT?.trim() ?? '';
-
-export function servesEveryAgent(): boolean {
-  return agentPin() === '';
-}
-
-export function daemonServesAgent(id: string): boolean {
-  const pin = agentPin();
-  return pin === '' || pin === id;
-}
-
-interface AgentRow {
-  id: string;
-  name: string;
-  projectId: string;
-}
-
-interface KeyRow {
-  agentId: string;
-  key: string | null;
-}
-
-export function toAgentSummaries(
-  rows: AgentRow[],
-  keyRows: KeyRow[],
-): AgentSummary[] {
-  return rows.map((r) => ({
-    id: r.id,
-    name: r.name,
-    owned: true,
-    key: keyRows.find((k) => k.agentId === r.id)?.key ?? null,
-  }));
-}
-
-async function selectKeyRows(ids: string[]): Promise<KeyRow[]> {
-  if (ids.length === 0) return [];
-  return getDb()
-    .select({ agentId: agents.id, key: agents.key })
-    .from(agents)
-    .where(inArray(agents.id, ids));
-}
-
-export async function listAgentsForUser(
-  subject: string,
-  project: string,
-): Promise<AgentSummary[]> {
-  const projectId = await projectIdOrThrow(subject, project);
-  const rows = await getDb()
-    .select({ id: agents.id, name: agents.name, projectId: agents.projectId })
-    .from(agents)
-    .where(eq(agents.projectId, projectId))
-    .orderBy(asc(agents.name), asc(agents.id));
-  if (rows.length === 0) return [];
-  const keyRows = await selectKeyRows(rows.map((r) => r.id));
-  return toAgentSummaries(rows, keyRows);
-}
-
-async function insertAgent(
-  projectId: string,
-  name: string,
-  key: string,
-): Promise<string> {
-  const inserted = await getDb()
-    .insert(agents)
-    .values({ id: newId(), name, projectId, key })
-    .returning({ id: agents.id });
-  const id = inserted[0]?.id;
-  if (id === undefined)
-    throw new AgentAdminError('agent insert returned no id', 500);
-  return id;
-}
-
-export async function createAgentForUser(
-  subject: string,
-  project: string,
-  rawName: string,
-): Promise<CreatedAgent> {
-  const name = normalizeAgentName(rawName);
-  const key = newApiKey();
-  const id = await insertAgent(await projectIdOrThrow(subject, project), name, key);
-  if (servesEveryAgent()) registerKey(key, id);
-  return { id, name, key };
-}
-
-export function parseAgentId(raw: string): string | null {
-  return parseId(raw);
-}
-
-interface Deletable {
-  agent: DeletedAgent;
-  projectId: string;
-}
-
-export async function ownedAgentOrThrow(
-  subject: string,
-  id: string,
-): Promise<Deletable> {
-  const rows = await getDb().select().from(agents).where(eq(agents.id, id));
-  const row = rows[0];
-  const missing = new AgentAdminError('no such agent', 404);
-  if (!row) throw missing;
-  try {
-    await projectIdOrThrow(subject, row.projectId);
-  } catch {
-    throw missing;
-  }
-  return { agent: { id: row.id, name: row.name }, projectId: row.projectId };
-}
-
-async function writeNewKey(id: string, projectId: string): Promise<string> {
-  for (let attempt = 0; attempt < KEY_ATTEMPTS; attempt += 1) {
-    const key = newApiKey();
-    try {
-      const changed = await getDb()
-        .update(agents)
-        .set({ key })
-        .where(and(eq(agents.id, id), eq(agents.projectId, projectId)))
-        .returning({ id: agents.id });
-      if (changed.length === 0)
-        throw new AgentAdminError('no such agent', 404);
-      return key;
-    } catch (err) {
-      if (!isUniqueViolation(err)) throw err;
-    }
-  }
-  throw new AgentAdminError('could not allocate a free api key', 500);
-}
-
-export async function resetAgentKeyForUser(
-  subject: string,
-  id: string,
-): Promise<ResetAgentKey> {
-  const { agent, projectId } = await ownedAgentOrThrow(subject, id);
-  const key = await writeNewKey(agent.id, projectId);
-  rotateAgentKey(agent.id, daemonServesAgent(agent.id) ? key : null);
-  return { id: agent.id, name: agent.name, key };
-}
-
-export async function deleteAgentForUser(
-  subject: string,
-  id: string,
-): Promise<DeletedAgent> {
-  const { agent, projectId } = await ownedAgentOrThrow(subject, id);
-  await getDb().transaction(async (tx) => {
-    const attached = await tx
-      .select({ id: stations.id })
-      .from(stations)
-      .where(eq(stations.agentId, id));
-    if (attached.length > 0)
-      throw new AgentAdminError(
-        `agent '${agent.name}' still has ${attached.length} station account(s) attached — an operator must remove them first`,
-        409,
-      );
-    const gone = await tx
-      .delete(agents)
-      .where(and(eq(agents.id, id), eq(agents.projectId, projectId)))
-      .returning({ id: agents.id });
-    if (gone.length === 0) throw new AgentAdminError('no such agent', 404);
-  });
-  unregisterAgentKey(id);
-  return agent;
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-connectors.ts

@@ -1,143 +0,0 @@
-import { and, asc, eq, inArray, ne } from 'drizzle-orm';
-import { getDb } from './client.js';
-import { newId } from './ids.js';
-import { isUniqueViolation } from './users.js';
-import { ownedAgentOrThrow } from './agent-admin.js';
-import { ConnectorError } from './connector-config.js';
-import { agentConnectors, agents, connectors } from './schema.js';
-
-export interface AgentConnectors {
-  id: string;
-  name: string;
-  connectorIds: string[];
-}
-
-const nameClash = (name: string, agent: string): ConnectorError =>
-  new ConnectorError(
-    `the agent '${agent}' already has a connector named '${name}'`,
-    409,
-  );
-
-async function collidingAgent(
-  agentIds: string[],
-  name: string,
-  exceptConnectorId: string,
-): Promise<string | null> {
-  if (agentIds.length === 0) return null;
-  const rows = await getDb()
-    .select({ agent: agents.name })
-    .from(agentConnectors)
-    .innerJoin(connectors, eq(connectors.id, agentConnectors.connectorId))
-    .innerJoin(agents, eq(agents.id, agentConnectors.agentId))
-    .where(
-      and(
-        inArray(agentConnectors.agentId, agentIds),
-        eq(connectors.name, name),
-        ne(connectors.id, exceptConnectorId),
-      ),
-    )
-    .limit(1);
-  return rows[0]?.agent ?? null;
-}
-
-export async function assertRenameFreeOfClash(
-  connectorId: string,
-  name: string,
-): Promise<void> {
-  const rows = await getDb()
-    .select({ agentId: agentConnectors.agentId })
-    .from(agentConnectors)
-    .where(eq(agentConnectors.connectorId, connectorId));
-  const clash = await collidingAgent(
-    rows.map((r) => r.agentId),
-    name,
-    connectorId,
-  );
-  if (clash !== null) throw nameClash(name, clash);
-}
-
-export async function connectorIdsOfAgent(agentId: string): Promise<string[]> {
-  const rows = await getDb()
-    .select({ connectorId: agentConnectors.connectorId })
-    .from(agentConnectors)
-    .where(eq(agentConnectors.agentId, agentId))
-    .orderBy(asc(agentConnectors.id));
-  return rows.map((r) => r.connectorId);
-}
-
-export async function connectorIdsByAgent(
-  agentIds: string[],
-): Promise<Map<string, string[]>> {
-  const out = new Map<string, string[]>();
-  if (agentIds.length === 0) return out;
-  const rows = await getDb()
-    .select({
-      agentId: agentConnectors.agentId,
-      connectorId: agentConnectors.connectorId,
-    })
-    .from(agentConnectors)
-    .where(inArray(agentConnectors.agentId, agentIds))
-    .orderBy(asc(agentConnectors.id));
-  for (const row of rows) {
-    const list = out.get(row.agentId) ?? [];
-    list.push(row.connectorId);
-    out.set(row.agentId, list);
-  }
-  return out;
-}
-
-export async function agentConnectorsForUser(
-  subject: string,
-  agentId: string,
-): Promise<AgentConnectors> {
-  const { agent } = await ownedAgentOrThrow(subject, agentId);
-  return { ...agent, connectorIds: await connectorIdsOfAgent(agent.id) };
-}
-
-async function connectorNameIn(
-  projectId: string,
-  connectorId: string,
-): Promise<string | null> {
-  const rows = await getDb()
-    .select({ name: connectors.name })
-    .from(connectors)
-    .where(and(eq(connectors.id, connectorId), eq(connectors.projectId, projectId)));
-  return rows[0]?.name ?? null;
-}
-
-export async function addConnectorToAgentForUser(
-  subject: string,
-  agentId: string,
-  connectorId: string,
-): Promise<AgentConnectors> {
-  const { agent, projectId } = await ownedAgentOrThrow(subject, agentId);
-  const name = await connectorNameIn(projectId, connectorId);
-  if (name === null) throw new ConnectorError('no such connector', 404);
-  const clash = await collidingAgent([agent.id], name, connectorId);
-  if (clash !== null) throw nameClash(name, clash);
-  try {
-    await getDb()
-      .insert(agentConnectors)
-      .values({ id: newId(), agentId: agent.id, connectorId });
-  } catch (err) {
-    if (!isUniqueViolation(err)) throw err;
-  }
-  return { ...agent, connectorIds: await connectorIdsOfAgent(agent.id) };
-}
-
-export async function removeConnectorFromAgentForUser(
-  subject: string,
-  agentId: string,
-  connectorId: string,
-): Promise<AgentConnectors> {
-  const { agent } = await ownedAgentOrThrow(subject, agentId);
-  await getDb()
-    .delete(agentConnectors)
-    .where(
-      and(
-        eq(agentConnectors.agentId, agent.id),
-        eq(agentConnectors.connectorId, connectorId),
-      ),
-    );
-  return { ...agent, connectorIds: await connectorIdsOfAgent(agent.id) };
-}