@stage-labs/metro 0.1.0-beta.44 → 0.1.0-beta.46

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-discovery.ts

@@ -1,4 +1,5 @@
 import { ConnectorVerifyError, parseConnectorUrl } from './connector-verify.js';
+import { isRecord } from './is-record.js';
 
 const DISCOVERY_TIMEOUT_MS = 10_000;
 
@@ -14,10 +15,6 @@ function refused(message: string): ConnectorVerifyError {
   return new ConnectorVerifyError(message, 400);
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 const str = (value: unknown): string =>
   typeof value === 'string' ? value : '';
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/paths.ts

@@ -1,7 +1,6 @@
 import { execFileSync } from 'node:child_process';
 import {
   closeSync,
-  existsSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -20,10 +19,6 @@ mkdirSync(STATE_DIR, { recursive: true });
 export const configDir = (): string =>
   process.env.METRO_CONFIG_DIR ??
   join(process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config'), 'metro');
-export const CONFIG_DIR = configDir();
-export const CONFIG_ENV_FILE = join(CONFIG_DIR, '.env');
-
-export const TRAINS_ENV_FILE = join(homedir(), '.metro', '.env');
 
 export function trainsDir(): string {
   const env = process.env.METRO_TRAINS_DIR?.trim();
@@ -34,34 +29,6 @@ export function trainsDir(): string {
 export const isLocalMode = (): boolean =>
   process.env.METRO_MODE?.trim() === 'local';
 
-export const envSources = (): readonly string[] => [
-  join(process.cwd(), '.env'),
-  TRAINS_ENV_FILE,
-  CONFIG_ENV_FILE,
-];
-
-const LINE_RE = /^\s*([A-Za-z_]\w*)\s*=\s*(.*?)\s*$/;
-const QUOTED_RE = /^(['"])(.*)\1$/;
-
-export function readDotenv(path: string): Record<string, string> {
-  if (!existsSync(path)) return {};
-  const out: Record<string, string> = {};
-  for (const line of readFileSync(path, 'utf8').split('\n')) {
-    const m = LINE_RE.exec(line);
-    if (m?.[1] !== undefined && m[2] !== undefined)
-      out[m[1]] = m[2].replace(QUOTED_RE, '$2');
-  }
-  return out;
-}
-
-export function loadMetroEnv(): void {
-  for (const path of envSources()) {
-    for (const [k, v] of Object.entries(readDotenv(path))) {
-      process.env[k] ??= v;
-    }
-  }
-}
-
 function readLockPid(lockFile: string): number {
   try {
     return Number(readFileSync(lockFile, 'utf8').trim());

package/runtime/node_modules/@metro-labs/mcp/src/daemon/protocol.ts

@@ -11,7 +11,7 @@ export {
   type TrainErrorInfo,
 } from './train-error.js';
 
-export const CALL_TIMEOUT_MS = 60_000;
+const CALL_TIMEOUT_MS = 60_000;
 
 export interface Pending {
   resolve: (r: TrainCallResponse) => void;
@@ -24,7 +24,7 @@ export interface CallTarget {
   proc: ({ stdin?: unknown } & Record<string, unknown>) | null;
 }
 
-export const STDOUT_LINE_MAX = 4 * 1024 * 1024;
+const STDOUT_LINE_MAX = 4 * 1024 * 1024;
 
 export type TrainEvent = {
   station?: string;
@@ -149,7 +149,7 @@ export function readCalls(
   });
 }
 
-export function encodeCall(id: string, action: string, args: unknown): string {
+function encodeCall(id: string, action: string, args: unknown): string {
   return JSON.stringify({ op: 'call', id, action, args }) + '\n';
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/run-api.ts

@@ -9,7 +9,7 @@ import {
   sendJson,
 } from './api-http.js';
 import { AGENT_CODE_RE, takeAgentCode } from './agent-pair.js';
-import { sessionTtlFromEnv } from './session-config.js';
+import { SESSION_TTL_SEC } from './session-config.js';
 import { signRunToken } from './session.js';
 import type { LoadedAgent } from '../db/materialize.js';
 import type { RuntimeLease } from '../db/runtimes.js';
@@ -80,7 +80,7 @@ async function handleClaim(
   const token = signRunToken(
     { subject: taken.subject, agentId: lease.agentId, runtimeId: lease.runtimeId },
     secret,
-    { ttlSec: sessionTtlFromEnv() },
+    { ttlSec: SESSION_TTL_SEC },
   );
   log.info(
     { agent: lease.agentId, runtime: lease.runtimeId, label: lease.label },

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-config.ts

@@ -1,11 +1,6 @@
-const DEFAULT_SESSION_TTL_SEC = 30 * 24 * 3600;
+export const SESSION_TTL_SEC = 30 * 24 * 3600;
 const PREVIEW = /^([a-z0-9-]+--)?metro-ui\.netlify\.app$/;
 
-export function sessionTtlFromEnv(): number {
-  const ttl = Number(process.env.METRO_SESSION_TTL_SEC);
-  return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SEC;
-}
-
 export function allowedWebHost(host: string): boolean {
   if (host === 'metro.box' || host === 'localhost' || host === '127.0.0.1')
     return true;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session.ts

@@ -1,4 +1,4 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { ID_RE } from '../db/ids.js';
 
 export class SessionError extends Error {}
@@ -53,47 +53,6 @@ function verify(token: string, secret: string): Record<string, unknown> {
 
 const nowSec = (now?: number): number => Math.floor((now ?? Date.now()) / 1000);
 
-export function newNonce(): string {
-  return b64url(randomBytes(16));
-}
-
-interface StateClaims {
-  return_to: string;
-  nonce: string;
-}
-
-export function signState(
-  claims: StateClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'state',
-      return_to: claims.return_to,
-      nonce: claims.nonce,
-      iat,
-      exp: iat + (opts.ttlSec ?? 600),
-    },
-    secret,
-  );
-}
-
-export function verifyState(
-  token: string,
-  secret: string,
-  now?: number,
-): StateClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'state') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('state expired');
-  if (typeof p.return_to !== 'string' || typeof p.nonce !== 'string')
-    throw new SessionError('malformed state');
-  return { return_to: p.return_to, nonce: p.nonce };
-}
-
 interface SessionClaims {
   subject: string;
   agentIds: string[];

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-auth.ts

@@ -10,16 +10,8 @@ export interface SiweLogin {
   signature: string;
 }
 
-export interface SiweVerifyArgs {
-  address: `0x${string}`;
-  message: string;
-  signature: Hex;
-}
-
 export interface SiweDeps {
   takeNonce: (nonce: string) => boolean;
-  now?: number;
-  verify?: (args: SiweVerifyArgs) => Promise<boolean>;
 }
 
 const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
@@ -66,14 +58,13 @@ export async function verifySiweLogin(
   if (!HEX_SIGNATURE.test(input.signature))
     throw new SiweError('that is not an Ethereum signature', 400);
   const { address, domain, nonce, parsed } = fieldsOrThrow(input.message);
-  const time = new Date(deps.now ?? Date.now());
+  const time = new Date();
   if (!validateSiweMessage({ message: parsed, domain, nonce, time }))
     throw new SiweError('this sign-in message is expired or does not match', 400);
   if (!deps.takeNonce(nonce))
     throw new SiweError('that sign-in has expired or was already used', 400);
-  const verify = deps.verify ?? verifyMessage;
   const signature = input.signature as Hex;
-  if (!(await verify({ address, message: input.message, signature })))
+  if (!(await verifyMessage({ address, message: input.message, signature })))
     throw new SiweError(
       'the signature does not match the address; smart-contract wallets are not supported yet',
       401,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-routes.ts

@@ -10,7 +10,7 @@ import {
 import { mintNonce, takeNonce } from './siwe-nonces.js';
 import { verifySiweLogin } from './siwe-auth.js';
 import { signSession } from './session.js';
-import { sessionTtlFromEnv } from './session-config.js';
+import { SESSION_TTL_SEC } from './session-config.js';
 import { ensureUserWithProject } from '../db/projects.js';
 
 const NONCE_PATH = '/auth/siwe/nonce';
@@ -39,7 +39,7 @@ async function handleVerify(
   const userId = await deps.ensureUser(address);
   log.info({ userId, address }, 'siwe: session issued');
   const session = signSession({ subject: address, agentIds: [] }, secret, {
-    ttlSec: sessionTtlFromEnv(),
+    ttlSec: SESSION_TTL_SEC,
   });
   sendJson(req, res, 200, { session, address });
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -1,31 +1,15 @@
-import { spawn, spawnSync, type ChildProcess } from 'node:child_process';
+import { spawn, type ChildProcess } from 'node:child_process';
 import { timingSafeEqual } from 'node:crypto';
 import { Resolver } from 'node:dns/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { STATE_DIR } from './paths.js';
 import { errMsg, log } from './log.js';
 import { readJson } from './secure-fs.js';
 
-const FILE = join(STATE_DIR, 'tunnel.json');
-const LEGACY_WEBHOOKS_FILE = join(STATE_DIR, 'webhooks.json');
 const RESTART_DELAY_MS = 2_000;
 
-interface NamedTunnel {
-  name: string;
-  hostname: string;
-}
-
-interface QuickTunnel {
-  quick: true;
-}
-
-export type TunnelConfig = NamedTunnel | QuickTunnel;
-
-const isQuick = (cfg: TunnelConfig): cfg is QuickTunnel => 'quick' in cfg;
-
-export const tunnelConfigFromEnv = (): TunnelConfig | null =>
-  process.env.METRO_TUNNEL?.trim() === 'quick' ? { quick: true } : null;
+export const quickTunnelWanted = (): boolean =>
+  process.env.METRO_TUNNEL?.trim() === 'quick';
 
 const QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
 
@@ -61,17 +45,11 @@ async function untilResolvable(host: string, resolves: Resolves): Promise<boolea
   return false;
 }
 
-export function configuredTunnelHost(): string | null {
-  const cfg = loadTunnelConfig();
-  return cfg !== null && !isQuick(cfg) ? cfg.hostname : null;
-}
-
 export interface Endpoint {
   id: string;
   webhookId?: string;
   label: string;
   secret?: string;
-  session?: string;
   createdAt: string;
 }
 interface AccountRecord {
@@ -79,7 +57,6 @@ interface AccountRecord {
   webhookId?: unknown;
   label?: unknown;
   secret?: unknown;
-  session?: unknown;
   createdAt?: unknown;
 }
 
@@ -101,7 +78,6 @@ function toEndpoint(raw: AccountRecord): Endpoint | null {
     webhookId: str(raw.webhookId),
     label: str(raw.label) ?? id,
     secret: str(raw.secret),
-    session: str(raw.session),
     createdAt: str(raw.createdAt) ?? '',
   };
 }
@@ -125,76 +101,21 @@ export function tokenMatches(secret: string, given: string): boolean {
   return want.length === got.length && timingSafeEqual(want, got);
 }
 
-export function warnOnLegacyWebhooks(): void {
-  const legacy = readJson<{ endpoints?: unknown[] }>(LEGACY_WEBHOOKS_FILE, {});
-  const count = Array.isArray(legacy.endpoints) ? legacy.endpoints.length : 0;
-  if (count > 0)
-    log.warn(
-      { file: LEGACY_WEBHOOKS_FILE, endpoints: count },
-      'webhook: webhooks.json is no longer read — endpoints live in the accounts table; these endpoints are inactive',
-    );
-}
-
-export const loadTunnelConfig = (): TunnelConfig | null =>
-  readJson<TunnelConfig | null>(FILE, null, {
-    warn: 'tunnel.json: malformed, ignoring',
-  });
-
-function fetchTunnelToken(name: string): string | null {
-  const r = spawnSync('cloudflared', ['tunnel', 'token', name], {
-    encoding: 'utf8',
-  });
-  if (r.status !== 0) return null;
-  const token = r.stdout.trim();
-  return token.length > 0 ? token : null;
-}
-
-interface Plan {
-  args: string[];
-  env: NodeJS.ProcessEnv;
-  mode: string;
-}
-
 export class Tunnel {
   private child: ChildProcess | null = null;
   private closed = false;
-  private token: string | null | undefined = undefined;
 
   constructor(
-    private cfg: TunnelConfig,
     private port: number,
     private onUrl: (url: string) => void = () => undefined,
     private resolves: Resolves = resolvesAtCloudflare,
   ) {}
 
-  get hostname(): string {
-    if (!isQuick(this.cfg)) return this.cfg.hostname;
-    return liveUrl === null ? '' : new URL(liveUrl).host;
-  }
-
   private origin(): string {
     return `http://127.0.0.1:${String(this.port)}`;
   }
 
-  private plan(): Plan {
-    if (isQuick(this.cfg))
-      return {
-        args: ['--no-autoupdate', 'tunnel', '--url', this.origin()],
-        env: process.env,
-        mode: 'quick',
-      };
-    if (this.token === undefined) this.token = fetchTunnelToken(this.cfg.name);
-    const args = ['--no-autoupdate', 'tunnel', 'run', '--url', this.origin()];
-    if (!this.token) args.push(this.cfg.name);
-    return {
-      args,
-      env: this.token ? { ...process.env, TUNNEL_TOKEN: this.token } : process.env,
-      mode: this.token ? 'token' : 'named',
-    };
-  }
-
   private noticeUrl(text: string): void {
-    if (!isQuick(this.cfg)) return;
     const url = quickTunnelUrlIn(text);
     if (url === null || url === liveUrl) return;
     liveUrl = url;
@@ -213,15 +134,12 @@ export class Tunnel {
 
   start(): void {
     if (this.closed) return;
-    const plan = this.plan();
-    log.info(
-      { tunnel: isQuick(this.cfg) ? 'quick' : this.cfg.name, port: this.port, mode: plan.mode },
-      'cloudflared tunnel starting',
+    log.info({ port: this.port }, 'cloudflared quick tunnel starting');
+    const child = spawn(
+      'cloudflared',
+      ['--no-autoupdate', 'tunnel', '--url', this.origin()],
+      { stdio: ['ignore', 'pipe', 'pipe'] },
     );
-    const child = spawn('cloudflared', plan.args, {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env: plan.env,
-    });
     this.child = child;
     child.stderr?.on('data', (d: Buffer | string) => {
       const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();

package/runtime/node_modules/@metro-labs/mcp/src/daemon/upload-api.ts

@@ -38,7 +38,7 @@ const VAGUE_MIMES = new Set([
 
 const mib = (n: number): string => `${Math.round(n / (1024 * 1024))} MiB`;
 
-export const uploadLimit = (): string =>
+const uploadLimit = (): string =>
   `${mib(MAX_UPLOAD_BYTES)} (${MAX_UPLOAD_BYTES} bytes)`;
 
 const tooLarge = (): string =>

package/runtime/node_modules/@metro-labs/mcp/src/daemon/version.ts

@@ -0,0 +1 @@
+export const METRO_VERSION = process.env.npm_package_version ?? '0.1.0-beta.15';

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-connectors.ts

@@ -56,7 +56,7 @@ export async function assertRenameFreeOfClash(
   if (clash !== null) throw nameClash(name, clash);
 }
 
-export async function connectorIdsOfAgent(agentId: string): Promise<string[]> {
+async function connectorIdsOfAgent(agentId: string): Promise<string[]> {
   const rows = await getDb()
     .select({ connectorId: agentConnectors.connectorId })
     .from(agentConnectors)

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-config.ts

@@ -5,6 +5,7 @@ import type {
   VerifiedServer,
 } from '../daemon/connector-verify.js';
 import { readStoredTools } from '../daemon/connector-tools.js';
+import { isRecord } from '../daemon/is-record.js';
 
 const CONNECTOR_NAME_MAX = 64;
 const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
@@ -22,10 +23,6 @@ export interface ConnectorConfig {
   oauth: boolean;
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 function text(value: unknown): string {
   return typeof value === 'string' ? value : '';
 }

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-relay.ts

@@ -25,7 +25,7 @@ export function staleUsable(auth: OAuthAuth, now = Date.now()): boolean {
   return auth.expiresAt === undefined || auth.expiresAt > now;
 }
 
-export function headerAuthHeaders(
+function headerAuthHeaders(
   auth: ConnectorAuth,
 ): Record<string, string> | null {
   return auth.kind === 'header' ? { [auth.name]: auth.value } : null;

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -278,10 +278,12 @@ export function localSetAgentConnectors(
   save(stored);
 }
 
-export function localAgentsWith(connectorId: string, dir = agentsDir()): { id: string; name: string }[] {
-  return storedAgents(dir)
-    .filter((s) => s.file.connectors.includes(connectorId))
-    .map((s) => ({ id: s.file.id, name: s.file.name }));
+export function localHoldEverywhere(connectorId: string, dir = agentsDir()): void {
+  for (const stored of storedAgents(dir)) {
+    if (stored.file.connectors.includes(connectorId)) continue;
+    stored.file.connectors = [...stored.file.connectors, connectorId];
+    save(stored);
+  }
 }
 
 export function localDropConnectorEverywhere(connectorId: string, dir = agentsDir()): void {

package/runtime/node_modules/@metro-labs/mcp/src/db/file-source.ts

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { AGENT_NAME_RE, ID_RE } from './ids.js';
 import { STATIONS, type StationName } from './schema.js';
 import type { LoadedAccount, LoadedAgent, StationSource } from './materialize.js';
+import { isRecord } from '../daemon/is-record.js';
 
 export const AGENT_FILE = 'agent.json';
 
@@ -30,9 +31,6 @@ export function agentsDir(): string {
     : join(homedir(), '.metro', 'agents');
 }
 
-const isRecord = (v: unknown): v is Record<string, unknown> =>
-  typeof v === 'object' && v !== null && !Array.isArray(v);
-
 function fail(path: string, reason: string): never {
   throw new AgentFileError(`${path}: ${reason}`);
 }

package/runtime/node_modules/@metro-labs/mcp/src/db/local-connectors.ts

@@ -41,8 +41,8 @@ import {
   assertLocalOwner,
   connectorIdsOfLocalAgent,
   localAgentConnectorIds,
-  localAgentsWith,
   localDropConnectorEverywhere,
+  localHoldEverywhere,
   localOwnedAgentOrThrow,
   localSetAgentConnectors,
   LOCAL_PROJECT_ID,
@@ -70,7 +70,7 @@ const isRow = (v: unknown): v is { id: string; name: string; url: string; config
 const asList = (value: unknown): unknown[] =>
   Array.isArray(value) ? value.map((item: unknown) => item) : [];
 
-export function readLocalConnectors(dir = agentsDir()): LocalConnectorRow[] {
+function readLocalConnectors(dir = agentsDir()): LocalConnectorRow[] {
   const raw = readJson<{ connectors?: unknown }>(filePath(dir), {}, {
     warn: 'connectors.json: malformed, ignoring',
   });
@@ -125,9 +125,16 @@ export async function localGetConnector(subject: string, id: string, dir = agent
   return Promise.resolve(connectorFromRow(rowOrThrow(subject, id, dir)));
 }
 
+function assertNameFree(name: string, exceptId: string | null, dir: string): void {
+  if (readLocalConnectors(dir).some((r) => r.id !== exceptId && r.name === name))
+    throw new ConnectorError(`a connector named '${name}' already exists on this daemon`, 409);
+}
+
 function insert(dir: string, name: string, url: URL, config: ConnectorConfig): Connector {
+  assertNameFree(name, null, dir);
   const row: LocalConnectorRow = { id: newId(), name, url: connectorUrlText(url), transport: 'http', config };
   writeRows(dir, [...readLocalConnectors(dir), row]);
+  localHoldEverywhere(row.id, dir);
   return connectorFromRow(row);
 }
 
@@ -201,24 +208,10 @@ export async function localVerifyConnector(subject: string, id: string, dir = ag
   }
 }
 
-const nameClash = (name: string, agent: string): ConnectorError =>
-  new ConnectorError(`the agent '${agent}' already has a connector named '${name}'`, 409);
-
-function clashFor(name: string, exceptId: string, agentIds: string[], dir: string): string | null {
-  const rows = readLocalConnectors(dir);
-  for (const agentId of agentIds) {
-    const held = connectorIdsOfLocalAgent(agentId, dir) ?? [];
-    const other = rows.find((r) => r.id !== exceptId && held.includes(r.id) && r.name === name);
-    if (other !== undefined) return localAgentsWith(other.id, dir).find((a) => a.id === agentId)?.name ?? agentId;
-  }
-  return null;
-}
-
 export async function localRenameConnector(subject: string, id: string, raw: string, dir = agentsDir()): Promise<Connector> {
   const name = connectorName(raw);
   const row = rowOrThrow(subject, id, dir);
-  const clash = clashFor(name, id, localAgentsWith(id, dir).map((a) => a.id), dir);
-  if (clash !== null) throw nameClash(name, clash);
+  assertNameFree(name, id, dir);
   return Promise.resolve(replace(dir, { ...row, name }));
 }
 
@@ -252,11 +245,7 @@ export async function localAddConnector(subject: string, agentId: string, connec
   const row = readLocalConnectors(dir).find((r) => r.id === connectorId);
   if (row === undefined) throw missing();
   const held = localAgentConnectorIds(subject, agentId, dir);
-  if (!held.includes(connectorId)) {
-    const clash = clashFor(row.name, connectorId, [agentId], dir);
-    if (clash !== null) throw nameClash(row.name, clash);
-    localSetAgentConnectors(subject, agentId, [...held, connectorId], dir);
-  }
+  if (!held.includes(connectorId)) localSetAgentConnectors(subject, agentId, [...held, connectorId], dir);
   return { ...agent, connectorIds: localAgentConnectorIds(subject, agentId, dir) };
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/db/materialize.ts

@@ -21,7 +21,6 @@ import {
   type AllowlistMap,
 } from './agent-map.js';
 import { setKeyMap } from './key-map.js';
-import { carryTokenStores, PREVIOUS_ACCOUNT_ID } from './token-carry.js';
 import { STATIONS, stations, agents, type StationName } from './schema.js';
 
 interface StationTarget {
@@ -149,7 +148,7 @@ export async function loadAgentForRuntime(
   };
 }
 
-export const pgSource: StationSource = () => loadAgents();
+const pgSource: StationSource = () => loadAgents();
 
 async function loadAgents(): Promise<LoadedAgent[]> {
   const db = getDb();
@@ -182,14 +181,6 @@ async function loadAgents(): Promise<LoadedAgent[]> {
   return out;
 }
 
-function trainConfig(
-  config: Record<string, unknown>,
-): Record<string, unknown> {
-  return Object.fromEntries(
-    Object.entries(config).filter(([key]) => key !== PREVIOUS_ACCOUNT_ID),
-  );
-}
-
 function trainStubPath(station: StationName): string {
   return join(trainsDir(), `${station}.ts`);
 }
@@ -208,7 +199,7 @@ export function writeIfChanged(path: string, content: string): boolean {
   return true;
 }
 
-export const isLocalRuntime = (): boolean =>
+const isLocalRuntime = (): boolean =>
   (process.env.METRO_RUN_TOKEN?.trim() ?? '') !== '';
 
 export const stationRunsHere = (station: StationName): boolean =>
@@ -248,12 +239,11 @@ function writeStations(list: LoadedAgent[]): WrittenStations {
   }
   setAgentMap(map, names);
   setAllowlistMap(allow);
-  carryTokenStores(list.flatMap((agent) => agent.accounts));
 
   const active = new Map<StationName, number>();
   const changed: StationName[] = [];
   for (const [station, accts] of byStation) {
-    const records = accts.map((a) => ({ id: a.id, ...trainConfig(a.config) }));
+    const records = accts.map((a) => ({ id: a.id, ...a.config }));
     const path = accountFilePath(station);
     const content = JSON.stringify(records, null, 2);
     if (currentText(path) !== content) {

package/runtime/node_modules/@metro-labs/mcp/src/db/projects.ts

@@ -33,7 +33,7 @@ const CONTROL = /[\u0000-\u001f\u007f]/;
 const missing = (): ProjectError => new ProjectError('no such project', 404);
 const forbidden = (why: string): ProjectError => new ProjectError(why, 403);
 
-export function projectName(raw: unknown): string {
+function projectName(raw: unknown): string {
   const name = typeof raw === 'string' ? raw.trim() : '';
   if (name === '' || name.length > NAME_MAX)
     throw new ProjectError(
@@ -54,7 +54,7 @@ export interface Access {
   role: ProjectRole;
 }
 
-export async function memberAccessOrThrow(
+async function memberAccessOrThrow(
   subject: string,
   projectId: string,
 ): Promise<Access> {
@@ -101,7 +101,7 @@ async function addMemberRow(
     .onConflictDoNothing();
 }
 
-export async function ensureDefaultProject(userId: string): Promise<string> {
+async function ensureDefaultProject(userId: string): Promise<string> {
   const existing = await getDb()
     .select({ id: projects.id })
     .from(projects)

package/runtime/node_modules/@metro-labs/mcp/src/db/runtimes.ts

@@ -91,7 +91,7 @@ export async function runtimeLabels(
   return out;
 }
 
-export async function runtimeFor(agentId: string): Promise<RuntimeView | null> {
+async function runtimeFor(agentId: string): Promise<RuntimeView | null> {
   const rows = await getDb()
     .select({
       id: runtimes.id,