@stage-labs/metro 0.1.0-beta.4 → 0.1.0-beta.41

package/runtime/node_modules/@metro-labs/mcp/src/db/materialize.ts

@@ -0,0 +1,373 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { ID_RE } from './ids.js';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { log } from '../daemon/log.js';
+import { writeSecure } from '../daemon/secure-fs.js';
+import { isLocalMode, trainsDir } from '../daemon/paths.js';
+import { closeDb, databaseUrl, getDb } from './client.js';
+import {
+  setAgentMap,
+  setAllowlistMap,
+  type AgentMap,
+  type AgentNameMap,
+  type AllowlistMap,
+} from './agent-map.js';
+import { setKeyMap } from './key-map.js';
+import { carryTokenStores, PREVIOUS_ACCOUNT_ID } from './token-carry.js';
+import { STATIONS, stations, agents, type StationName } from './schema.js';
+
+interface StationTarget {
+  file: string;
+  fileEnv: string;
+  trainImport: string | null;
+}
+
+export interface LoadedAccount {
+  station: StationName;
+  id: string;
+  allowlist: string[] | null;
+  config: Record<string, unknown>;
+}
+
+export interface LoadedAgent {
+  id: string;
+  name: string;
+  accounts: LoadedAccount[];
+  key: string | null;
+}
+
+const METRO_DIR = join(homedir(), '.metro');
+
+const STATION_TARGETS: Record<StationName, StationTarget> = {
+  xmtp: {
+    file: 'xmtp-accounts.json',
+    fileEnv: 'XMTP_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/xmtp/train',
+  },
+  'telegram-bot': {
+    file: 'telegram-bot-accounts.json',
+    fileEnv: 'TELEGRAM_BOT_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/telegram-bot/train',
+  },
+  'telegram': {
+    file: 'telegram-accounts.json',
+    fileEnv: 'TELEGRAM_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/telegram/train',
+  },
+  'discord-bot': {
+    file: 'discord-bot-accounts.json',
+    fileEnv: 'DISCORD_BOT_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/discord-bot/train',
+  },
+  whatsapp: {
+    file: 'whatsapp-accounts.json',
+    fileEnv: 'WHATSAPP_ACCOUNTS_FILE',
+    trainImport: '@metro-labs/whatsapp/train',
+  },
+  webhook: {
+    file: 'webhook-accounts.json',
+    fileEnv: 'WEBHOOK_ACCOUNTS_FILE',
+    trainImport: null,
+  },
+};
+
+function accountFilePath(station: StationName): string {
+  const target = STATION_TARGETS[station];
+  return process.env[target.fileEnv] ?? join(METRO_DIR, target.file);
+}
+
+function agentFilter(): string | undefined {
+  const v = process.env.METRO_AGENT?.trim();
+  if (!v) return undefined;
+  if (!ID_RE.test(v))
+    throw new Error(`METRO_AGENT must be an 11-character agent id, got '${v}'`);
+  return v;
+}
+
+export type StationSource = () => Promise<LoadedAgent[]>;
+
+export const MOVABLE_STATIONS = new Set<StationName>(
+  STATIONS.filter((s) => s !== 'webhook'),
+);
+
+export function unmovableStations(list: LoadedAccount[]): StationName[] {
+  return [
+    ...new Set(
+      list
+        .map((a) => a.station)
+        .filter((station) => !MOVABLE_STATIONS.has(station)),
+    ),
+  ];
+}
+
+export async function loadAllStationsFor(
+  agentId: string,
+): Promise<LoadedAccount[]> {
+  const rows = await getDb()
+    .select()
+    .from(stations)
+    .where(eq(stations.agentId, agentId));
+  return rows.map((r) => ({
+    station: r.station,
+    id: r.id,
+    allowlist: r.allowlist,
+    config: r.config as Record<string, unknown>,
+  }));
+}
+
+export async function loadAgentForRuntime(
+  agentId: string,
+): Promise<LoadedAgent> {
+  const db = getDb();
+  const rows = await db.select().from(agents).where(eq(agents.id, agentId));
+  const a = rows[0];
+  if (a === undefined) throw new Error(`no such agent '${agentId}'`);
+  const acctRows = await db
+    .select()
+    .from(stations)
+    .where(eq(stations.agentId, a.id));
+  return {
+    id: a.id,
+    name: a.name,
+    key: a.key,
+    accounts: acctRows
+      .filter((r) => MOVABLE_STATIONS.has(r.station))
+      .map((r) => ({
+        station: r.station,
+        id: r.id,
+        allowlist: r.allowlist,
+        config: r.config as Record<string, unknown>,
+      })),
+  };
+}
+
+export const pgSource: StationSource = () => loadAgents();
+
+async function loadAgents(): Promise<LoadedAgent[]> {
+  const db = getDb();
+  const only = agentFilter();
+  const agentRows =
+    only !== undefined
+      ? await db.select().from(agents).where(eq(agents.id, only))
+      : await db.select().from(agents);
+  if (only !== undefined && agentRows.length === 0)
+    throw new Error(`METRO_AGENT=${only} does not match any agent`);
+
+  const out: LoadedAgent[] = [];
+  for (const a of agentRows) {
+    const acctRows = await db
+      .select()
+      .from(stations)
+      .where(eq(stations.agentId, a.id));
+    out.push({
+      id: a.id,
+      name: a.name,
+      accounts: acctRows.map((r) => ({
+        station: r.station,
+        id: r.id,
+        allowlist: r.allowlist,
+        config: r.config as Record<string, unknown>,
+      })),
+      key: a.runtimeId === null ? a.key : null,
+    });
+  }
+  return out;
+}
+
+function trainConfig(
+  config: Record<string, unknown>,
+): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(config).filter(([key]) => key !== PREVIOUS_ACCOUNT_ID),
+  );
+}
+
+function trainStubPath(station: StationName): string {
+  return join(trainsDir(), `${station}.ts`);
+}
+
+function currentText(path: string): string | null {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function writeIfChanged(path: string, content: string): boolean {
+  if (currentText(path) === content) return false;
+  writeFileSync(path, content);
+  return true;
+}
+
+export const isLocalRuntime = (): boolean =>
+  (process.env.METRO_RUN_TOKEN?.trim() ?? '') !== '';
+
+export const stationRunsHere = (station: StationName): boolean =>
+  isLocalRuntime() || isLocalMode() || !MOVABLE_STATIONS.has(station);
+
+interface WrittenStations {
+  active: Map<StationName, number>;
+  changed: StationName[];
+}
+
+function writeStations(list: LoadedAgent[]): WrittenStations {
+  mkdirSync(METRO_DIR, { recursive: true });
+  mkdirSync(trainsDir(), { recursive: true });
+
+  const byStation = new Map<StationName, LoadedAccount[]>();
+  const map: AgentMap = {};
+  const names: AgentNameMap = {};
+  const allow: AllowlistMap = {};
+  for (const agent of list) {
+    names[agent.id] = agent.name;
+    for (const a of agent.accounts) {
+      if (!(a.station in STATION_TARGETS)) {
+        log.error(
+          { station: a.station, id: a.id },
+          'unknown station — this metro is older or newer than the row; skipping it',
+        );
+        continue;
+      }
+      map[`${a.station}/${a.id}`] = agent.id;
+      if (a.allowlist) allow[`${a.station}/${a.id}`] = a.allowlist;
+      if (stationRunsHere(a.station)) {
+        const cur = byStation.get(a.station);
+        if (cur) cur.push(a);
+        else byStation.set(a.station, [a]);
+      }
+    }
+  }
+  setAgentMap(map, names);
+  setAllowlistMap(allow);
+  carryTokenStores(list.flatMap((agent) => agent.accounts));
+
+  const active = new Map<StationName, number>();
+  const changed: StationName[] = [];
+  for (const [station, accts] of byStation) {
+    const records = accts.map((a) => ({ id: a.id, ...trainConfig(a.config) }));
+    const path = accountFilePath(station);
+    const content = JSON.stringify(records, null, 2);
+    if (currentText(path) !== content) {
+      writeSecure(path, content);
+      changed.push(station);
+    }
+    const { trainImport } = STATION_TARGETS[station];
+    if (trainImport !== null)
+      writeIfChanged(trainStubPath(station), `import '${trainImport}';\n`);
+    active.set(station, accts.length);
+  }
+  return { active, changed };
+}
+
+const BLANKED = '[]\n';
+
+function pruneStations(present: Map<StationName, number>): StationName[] {
+  const removed: StationName[] = [];
+  for (const station of Object.keys(STATION_TARGETS) as StationName[]) {
+    if (present.has(station)) continue;
+    const hasTrain = STATION_TARGETS[station].trainImport !== null;
+    const stub = trainStubPath(station);
+    const stubGone = !hasTrain || !existsSync(stub);
+    const file = currentText(accountFilePath(station));
+    const fileInert = file === null || file === BLANKED;
+    if (stubGone && fileInert) continue;
+    if (!fileInert) writeSecure(accountFilePath(station), BLANKED);
+    if (hasTrain) rmSync(stub, { force: true });
+    removed.push(station);
+  }
+  return removed;
+}
+
+const stationLabels = (m: Map<StationName, number>): string[] =>
+  [...m].map(([station, n]) => `${station}(${n})`);
+
+function applyKeyMap(list: LoadedAgent[]): void {
+  lastKey = list.find((a) => a.key !== null)?.key ?? null;
+  setKeyMap(
+    list.flatMap((agent) =>
+      agent.key === null ? [] : [{ key: agent.key, agentId: agent.id }],
+    ),
+  );
+}
+
+let lastKey: string | null = null;
+
+export function localAgentKey(): string | null {
+  return lastKey;
+}
+
+async function loadAndWrite(
+  source: StationSource,
+): Promise<WrittenStations & { agents: number }> {
+  const list = await source();
+  applyKeyMap(list);
+  return { ...writeStations(list), agents: list.length };
+}
+
+export interface MaterializeOptions {
+  allowEmpty?: boolean;
+}
+
+export async function materializeFrom(
+  source: StationSource,
+  opts: MaterializeOptions = {},
+): Promise<void> {
+  const { active, agents: found } = await loadAndWrite(source);
+
+  if (found === 0 && opts.allowEmpty !== true)
+    throw new Error('no agents found — nothing to materialize');
+  const removed = pruneStations(active);
+  log.info(
+    { stations: stationLabels(active), agents: found, removed },
+    'materialized station accounts',
+  );
+}
+
+export async function materializeFromDb(): Promise<void> {
+  if (!databaseUrl())
+    throw new Error('DATABASE_URL is not set — accounts load from Postgres');
+  try {
+    await materializeFrom(pgSource);
+  } finally {
+    await closeDb();
+  }
+}
+
+export interface ReloadedStations {
+  active: StationName[];
+  removed: StationName[];
+  changed: StationName[];
+}
+
+export async function reloadFrom(
+  source: StationSource,
+): Promise<ReloadedStations> {
+  const { active, changed } = await loadAndWrite(source);
+  const removed = pruneStations(active);
+  if (removed.length > 0 || changed.length > 0)
+    log.info(
+      { stations: stationLabels(active), removed, changed },
+      'reloaded station accounts',
+    );
+  return { active: [...active.keys()], removed, changed };
+}
+
+export async function reloadAccountsFromDb(): Promise<ReloadedStations> {
+  if (!databaseUrl())
+    throw new Error('DATABASE_URL is not set — accounts load from Postgres');
+  return reloadFrom(pgSource);
+}
+
+if (import.meta.main) {
+  await materializeFromDb();
+  process.exit(0);
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/projects.ts

@@ -0,0 +1,309 @@
+import {
+  ensureUserByAddress,
+  normalizeAddress,
+  userIdForSubject,
+} from './users.js';
+import { and, asc, eq } from 'drizzle-orm';
+import { ApiError } from '../daemon/api-error.js';
+import { getDb } from './client.js';
+import { newId } from './ids.js';
+import { projectMembers, projects, users, type ProjectRole } from './schema.js';
+
+export class ProjectError extends ApiError {}
+
+export interface Project {
+  id: string;
+  name: string;
+  isDefault: boolean;
+  owner: boolean;
+  role: ProjectRole;
+}
+
+export interface Member {
+  id: string;
+  address: string | null;
+  email: string | null;
+  role: ProjectRole;
+  owner: boolean;
+}
+
+const NAME_MAX = 64;
+const CONTROL = /[\u0000-\u001f\u007f]/;
+
+const missing = (): ProjectError => new ProjectError('no such project', 404);
+const forbidden = (why: string): ProjectError => new ProjectError(why, 403);
+
+export function projectName(raw: unknown): string {
+  const name = typeof raw === 'string' ? raw.trim() : '';
+  if (name === '' || name.length > NAME_MAX)
+    throw new ProjectError(
+      `a project name is 1-${String(NAME_MAX)} characters`,
+      400,
+    );
+  if (CONTROL.test(name))
+    throw new ProjectError('a project name cannot carry control characters', 400);
+  return name;
+}
+
+export interface Access {
+  userId: string;
+  projectId: string;
+  ownerId: string;
+  isDefault: boolean;
+  name: string;
+  role: ProjectRole;
+}
+
+export async function memberAccessOrThrow(
+  subject: string,
+  projectId: string,
+): Promise<Access> {
+  const userId = await userIdForSubject(subject);
+  if (userId === null) throw missing();
+  const rows = await getDb()
+    .select({
+      id: projects.id,
+      name: projects.name,
+      ownerId: projects.ownerId,
+      isDefault: projects.isDefault,
+      role: projectMembers.role,
+    })
+    .from(projects)
+    .innerJoin(projectMembers, eq(projectMembers.projectId, projects.id))
+    .where(and(eq(projects.id, projectId), eq(projectMembers.userId, userId)));
+  const row = rows[0];
+  if (row === undefined) throw missing();
+  return {
+    userId,
+    projectId: row.id,
+    ownerId: row.ownerId,
+    isDefault: row.isDefault,
+    name: row.name,
+    role: row.role,
+  };
+}
+
+export async function projectIdOrThrow(
+  subject: string,
+  projectId: string,
+): Promise<string> {
+  return (await memberAccessOrThrow(subject, projectId)).projectId;
+}
+
+async function addMemberRow(
+  projectId: string,
+  userId: string,
+  role: ProjectRole,
+): Promise<void> {
+  await getDb()
+    .insert(projectMembers)
+    .values({ id: newId(), projectId, userId, role })
+    .onConflictDoNothing();
+}
+
+export async function ensureDefaultProject(userId: string): Promise<string> {
+  const existing = await getDb()
+    .select({ id: projects.id })
+    .from(projects)
+    .where(and(eq(projects.ownerId, userId), eq(projects.isDefault, true)));
+  const found = existing[0];
+  if (found !== undefined) return found.id;
+  const id = newId();
+  await getDb()
+    .insert(projects)
+    .values({ id, name: 'Personal', ownerId: userId, isDefault: true });
+  await addMemberRow(id, userId, 'admin');
+  return id;
+}
+
+export async function ensureUserWithProject(address: string): Promise<string> {
+  const userId = await ensureUserByAddress(address);
+  await ensureDefaultProject(userId);
+  return userId;
+}
+
+export async function listProjectsForUser(subject: string): Promise<Project[]> {
+  const userId = await userIdForSubject(subject);
+  if (userId === null) return [];
+  const rows = await getDb()
+    .select({
+      id: projects.id,
+      name: projects.name,
+      isDefault: projects.isDefault,
+      ownerId: projects.ownerId,
+      role: projectMembers.role,
+    })
+    .from(projects)
+    .innerJoin(projectMembers, eq(projectMembers.projectId, projects.id))
+    .where(eq(projectMembers.userId, userId))
+    .orderBy(asc(projects.id));
+  return rows.map((r) => ({
+    id: r.id,
+    name: r.name,
+    isDefault: r.isDefault,
+    owner: r.ownerId === userId,
+    role: r.role,
+  }));
+}
+
+export async function createProjectForUser(
+  subject: string,
+  raw: unknown,
+): Promise<Project> {
+  const name = projectName(raw);
+  const userId = await userIdForSubject(subject);
+  if (userId === null) throw new ProjectError('unknown account', 401);
+  const id = newId();
+  await getDb().insert(projects).values({ id, name, ownerId: userId });
+  await addMemberRow(id, userId, 'admin');
+  return { id, name, isDefault: false, owner: true, role: 'admin' };
+}
+
+export async function renameProjectForUser(
+  subject: string,
+  projectId: string,
+  raw: unknown,
+): Promise<Project> {
+  const name = projectName(raw);
+  const access = await memberAccessOrThrow(subject, projectId);
+  if (access.role !== 'admin')
+    throw forbidden('only an admin can rename a project');
+  await getDb()
+    .update(projects)
+    .set({ name })
+    .where(eq(projects.id, access.projectId));
+  return {
+    id: access.projectId,
+    name,
+    isDefault: access.isDefault,
+    owner: access.ownerId === access.userId,
+    role: access.role,
+  };
+}
+
+export async function deleteProjectForUser(
+  subject: string,
+  projectId: string,
+): Promise<{ id: string; name: string }> {
+  const access = await memberAccessOrThrow(subject, projectId);
+  if (access.ownerId !== access.userId)
+    throw forbidden('only the owner can delete a project');
+  if (access.isDefault)
+    throw forbidden('your default project cannot be deleted');
+  try {
+    await getDb().delete(projects).where(eq(projects.id, access.projectId));
+  } catch {
+    throw new ProjectError(
+      'this project still holds agents or connectors',
+      409,
+    );
+  }
+  return { id: access.projectId, name: access.name };
+}
+
+export async function listMembersForUser(
+  subject: string,
+  projectId: string,
+): Promise<Member[]> {
+  const access = await memberAccessOrThrow(subject, projectId);
+  const rows = await getDb()
+    .select({
+      id: projectMembers.id,
+      address: users.address,
+      email: users.email,
+      role: projectMembers.role,
+      userId: projectMembers.userId,
+    })
+    .from(projectMembers)
+    .innerJoin(users, eq(users.id, projectMembers.userId))
+    .where(eq(projectMembers.projectId, access.projectId))
+    .orderBy(asc(projectMembers.id));
+  return rows.map((r) => ({
+    id: r.id,
+    address: r.address,
+    email: r.email,
+    role: r.role,
+    owner: r.userId === access.ownerId,
+  }));
+}
+
+function readRole(raw: unknown): ProjectRole {
+  if (raw === 'admin' || raw === 'member') return raw;
+  throw new ProjectError("a role is 'admin' or 'member'", 400);
+}
+
+async function adminAccessOrThrow(
+  subject: string,
+  projectId: string,
+): Promise<Access> {
+  const access = await memberAccessOrThrow(subject, projectId);
+  if (access.role !== 'admin')
+    throw forbidden('only an admin can manage members');
+  return access;
+}
+
+export async function addMemberForUser(
+  subject: string,
+  projectId: string,
+  raw: unknown,
+  rawRole: unknown,
+): Promise<Member[]> {
+  const access = await adminAccessOrThrow(subject, projectId);
+  const role = readRole(rawRole);
+  const invited = normalizeAddress(typeof raw === 'string' ? raw : '');
+  if (invited === null)
+    throw new ProjectError('an Ethereum address is required', 400);
+  const invitedId = await ensureUserByAddress(invited);
+  await ensureDefaultProject(invitedId);
+  await addMemberRow(access.projectId, invitedId, role);
+  return listMembersForUser(subject, projectId);
+}
+
+async function memberRowOrThrow(
+  projectId: string,
+  memberId: string,
+): Promise<{ userId: string }> {
+  const rows = await getDb()
+    .select({ userId: projectMembers.userId })
+    .from(projectMembers)
+    .where(
+      and(
+        eq(projectMembers.id, memberId),
+        eq(projectMembers.projectId, projectId),
+      ),
+    );
+  const row = rows[0];
+  if (row === undefined) throw new ProjectError('no such member', 404);
+  return row;
+}
+
+export async function setMemberRoleForUser(
+  subject: string,
+  projectId: string,
+  memberId: string,
+  rawRole: unknown,
+): Promise<Member[]> {
+  const access = await adminAccessOrThrow(subject, projectId);
+  const role = readRole(rawRole);
+  const member = await memberRowOrThrow(access.projectId, memberId);
+  if (member.userId === access.ownerId)
+    throw forbidden('the owner is always an admin');
+  await getDb()
+    .update(projectMembers)
+    .set({ role })
+    .where(eq(projectMembers.id, memberId));
+  return listMembersForUser(subject, projectId);
+}
+
+export async function removeMemberForUser(
+  subject: string,
+  projectId: string,
+  memberId: string,
+): Promise<Member[]> {
+  const access = await adminAccessOrThrow(subject, projectId);
+  const member = await memberRowOrThrow(access.projectId, memberId);
+  if (member.userId === access.ownerId)
+    throw forbidden('the owner cannot be removed from their own project');
+  await getDb().delete(projectMembers).where(eq(projectMembers.id, memberId));
+  return listMembersForUser(subject, projectId);
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/runtime-admin.ts

@@ -0,0 +1,24 @@
+import { ownedAgentOrThrow } from './agent-admin.js';
+import { mintAgentCode } from '../daemon/agent-pair.js';
+import { loadAllStationsFor, unmovableStations } from './materialize.js';
+import { releaseRuntime } from './runtimes.js';
+
+export async function mintAgentCodeForUser(
+  subject: string,
+  agentId: string,
+): Promise<{ code: string; expiresAt: number; agent: string }> {
+  const { agent } = await ownedAgentOrThrow(subject, agentId);
+  return { ...mintAgentCode({ subject, agentId: agent.id }), agent: agent.name };
+}
+
+export async function blockedStationsFor(agentId: string): Promise<string[]> {
+  return unmovableStations(await loadAllStationsFor(agentId));
+}
+
+export async function releaseRuntimeForUser(
+  subject: string,
+  agentId: string,
+): Promise<void> {
+  const { agent } = await ownedAgentOrThrow(subject, agentId);
+  await releaseRuntime(agent.id);
+}