@stage-labs/metro 0.1.0-beta.50 → 0.1.0-beta.52

package/runtime/node_modules/@metro-labs/mcp/src/db/materialize.ts

@@ -6,13 +6,10 @@ import {
   writeFileSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
-import { ID_RE } from './ids.js';
 import { join } from 'node:path';
-import { eq } from 'drizzle-orm';
 import { log } from '../daemon/log.js';
 import { writeSecure } from '../daemon/secure-fs.js';
 import { isLocalMode, trainsDir } from '../daemon/paths.js';
-import { closeDb, databaseUrl, getDb } from './client.js';
 import {
   setAgentMap,
   setAllowlistMap,
@@ -21,14 +18,7 @@ import {
   type AllowlistMap,
 } from './agent-map.js';
 import { setKeyMap } from './key-map.js';
-import {
-  agentConnectors,
-  agents,
-  connectors,
-  stations,
-  STATIONS,
-  type StationName,
-} from './schema.js';
+import { STATIONS, type StationName } from './schema.js';
 
 interface StationTarget {
   file: string;
@@ -99,116 +89,12 @@ function accountFilePath(station: StationName): string {
   return process.env[target.fileEnv] ?? join(METRO_DIR, target.file);
 }
 
-function agentFilter(): string | undefined {
-  const v = process.env.METRO_AGENT?.trim();
-  if (!v) return undefined;
-  if (!ID_RE.test(v))
-    throw new Error(`METRO_AGENT must be an 11-character agent id, got '${v}'`);
-  return v;
-}
-
 export type StationSource = () => Promise<LoadedAgent[]>;
 
 export const MOVABLE_STATIONS = new Set<StationName>(
   STATIONS.filter((s) => s !== 'webhook'),
 );
 
-export function unmovableStations(list: LoadedAccount[]): StationName[] {
-  return [
-    ...new Set(
-      list
-        .map((a) => a.station)
-        .filter((station) => !MOVABLE_STATIONS.has(station)),
-    ),
-  ];
-}
-
-export async function loadAllStationsFor(
-  agentId: string,
-): Promise<LoadedAccount[]> {
-  const rows = await getDb()
-    .select()
-    .from(stations)
-    .where(eq(stations.agentId, agentId));
-  return rows.map((r) => ({
-    station: r.station,
-    id: r.id,
-    allowlist: r.allowlist,
-    config: r.config as Record<string, unknown>,
-  }));
-}
-
-export async function loadAgentForRuntime(
-  agentId: string,
-): Promise<LoadedAgent> {
-  const db = getDb();
-  const rows = await db.select().from(agents).where(eq(agents.id, agentId));
-  const a = rows[0];
-  if (a === undefined) throw new Error(`no such agent '${agentId}'`);
-  const acctRows = await db
-    .select()
-    .from(stations)
-    .where(eq(stations.agentId, a.id));
-  const held = await db
-    .select({ id: connectors.id, name: connectors.name, url: connectors.url, config: connectors.config })
-    .from(agentConnectors)
-    .innerJoin(connectors, eq(connectors.id, agentConnectors.connectorId))
-    .where(eq(agentConnectors.agentId, a.id));
-  return {
-    id: a.id,
-    name: a.name,
-    key: a.key,
-    connectors: held.map((c) => ({
-      id: c.id,
-      name: c.name,
-      url: c.url,
-      transport: 'http' as const,
-      config: c.config as Record<string, unknown>,
-    })),
-    accounts: acctRows
-      .filter((r) => MOVABLE_STATIONS.has(r.station))
-      .map((r) => ({
-        station: r.station,
-        id: r.id,
-        allowlist: r.allowlist,
-        config: r.config as Record<string, unknown>,
-      })),
-  };
-}
-
-const pgSource: StationSource = () => loadAgents();
-
-async function loadAgents(): Promise<LoadedAgent[]> {
-  const db = getDb();
-  const only = agentFilter();
-  const agentRows =
-    only !== undefined
-      ? await db.select().from(agents).where(eq(agents.id, only))
-      : await db.select().from(agents);
-  if (only !== undefined && agentRows.length === 0)
-    throw new Error(`METRO_AGENT=${only} does not match any agent`);
-
-  const out: LoadedAgent[] = [];
-  for (const a of agentRows) {
-    const acctRows = await db
-      .select()
-      .from(stations)
-      .where(eq(stations.agentId, a.id));
-    out.push({
-      id: a.id,
-      name: a.name,
-      accounts: acctRows.map((r) => ({
-        station: r.station,
-        id: r.id,
-        allowlist: r.allowlist,
-        config: r.config as Record<string, unknown>,
-      })),
-      key: a.runtimeId === null ? a.key : null,
-    });
-  }
-  return out;
-}
-
 function trainStubPath(station: StationName): string {
   return join(trainsDir(), `${station}.ts`);
 }
@@ -227,11 +113,8 @@ export function writeIfChanged(path: string, content: string): boolean {
   return true;
 }
 
-const isLocalRuntime = (): boolean =>
-  (process.env.METRO_RUN_TOKEN?.trim() ?? '') !== '';
-
 export const stationRunsHere = (station: StationName): boolean =>
-  isLocalRuntime() || isLocalMode() || !MOVABLE_STATIONS.has(station);
+  isLocalMode() || !MOVABLE_STATIONS.has(station);
 
 interface WrittenStations {
   active: Map<StationName, number>;
@@ -350,16 +233,6 @@ export async function materializeFrom(
   );
 }
 
-export async function materializeFromDb(): Promise<void> {
-  if (!databaseUrl())
-    throw new Error('DATABASE_URL is not set — accounts load from Postgres');
-  try {
-    await materializeFrom(pgSource);
-  } finally {
-    await closeDb();
-  }
-}
-
 export interface ReloadedStations {
   active: StationName[];
   removed: StationName[];
@@ -378,14 +251,3 @@ export async function reloadFrom(
     );
   return { active: [...active.keys()], removed, changed };
 }
-
-export async function reloadAccountsFromDb(): Promise<ReloadedStations> {
-  if (!databaseUrl())
-    throw new Error('DATABASE_URL is not set — accounts load from Postgres');
-  return reloadFrom(pgSource);
-}
-
-if (import.meta.main) {
-  await materializeFromDb();
-  process.exit(0);
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -1,4 +1,4 @@
-import { boolean, index, jsonb, pgTable, text, unique } from 'drizzle-orm/pg-core';
+import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core';
 
 export const STATIONS = [
   'xmtp',
@@ -17,98 +17,10 @@ export const users = pgTable('users', {
   address: text('address').unique(),
 });
 
-
 export type ProjectRole = 'admin' | 'member';
 
-export const projects = pgTable('projects', {
-  id: text('id').primaryKey(),
-  name: text('name').notNull(),
-  ownerId: text('owner_id')
-    .notNull()
-    .references(() => users.id, { onDelete: 'restrict' }),
-  isDefault: boolean('is_default').notNull().default(false),
-});
-
-export const projectMembers = pgTable(
-  'project_members',
-  {
-    id: text('id').primaryKey(),
-    projectId: text('project_id')
-      .notNull()
-      .references(() => projects.id, { onDelete: 'cascade' }),
-    userId: text('user_id')
-      .notNull()
-      .references(() => users.id, { onDelete: 'restrict' }),
-    role: text('role').$type<ProjectRole>().notNull(),
-  },
-  (t) => [unique('project_members_project_id_user_id_unique').on(t.projectId, t.userId)],
-);
-
-export const agents = pgTable('agents', {
-  id: text('id').primaryKey(),
-  name: text('name').notNull(),
-  projectId: text('project_id')
-    .notNull()
-    .references(() => projects.id, { onDelete: 'restrict' }),
-  key: text('key').unique(),
-  runtimeId: text('runtime_id'),
-});
-
-export const runtimes = pgTable('runtimes', {
-  id: text('id').primaryKey(),
-  agentId: text('agent_id')
-    .notNull()
-    .references(() => agents.id, { onDelete: 'cascade' }),
-  label: text('label').notNull(),
-  createdAt: text('created_at').notNull(),
-  lastSeenAt: text('last_seen_at'),
-  revokedAt: text('revoked_at'),
-});
-
-export const stations = pgTable('stations', {
-  id: text('id').primaryKey(),
-  agentId: text('agent_id').notNull(),
-  station: text('station').$type<StationName>().notNull(),
-  allowlist: text('allowlist').array().default(['*']),
-  config: jsonb('config').notNull(),
-});
-
-
 export type ConnectorTransport = 'http' | 'sse';
 
-export const connectors = pgTable(
-  'connectors',
-  {
-    id: text('id').primaryKey(),
-    projectId: text('project_id')
-      .notNull()
-      .references(() => projects.id, { onDelete: 'restrict' }),
-    name: text('name').notNull(),
-    url: text('url').notNull(),
-    transport: text('transport').$type<ConnectorTransport>().notNull(),
-    config: jsonb('config').notNull(),
-  },
-);
-
-export const agentConnectors = pgTable(
-  'agent_connectors',
-  {
-    id: text('id').primaryKey(),
-    agentId: text('agent_id')
-      .notNull()
-      .references(() => agents.id, { onDelete: 'cascade' }),
-    connectorId: text('connector_id')
-      .notNull()
-      .references(() => connectors.id, { onDelete: 'cascade' }),
-  },
-  (t) => [
-    unique('agent_connectors_agent_id_connector_id_unique').on(
-      t.agentId,
-      t.connectorId,
-    ),
-  ],
-);
-
 export const vault = pgTable(
   'vault',
   {

package/runtime/node_modules/@metro-labs/mcp/src/db/users.ts

@@ -1,4 +1,4 @@
-import { eq, type SQL } from 'drizzle-orm';
+import { eq } from 'drizzle-orm';
 import { ApiError } from '../daemon/api-error.js';
 import { getDb } from './client.js';
 import { newId } from './ids.js';
@@ -22,51 +22,24 @@ export function isUniqueViolation(err: unknown): boolean {
   return false;
 }
 
-export function normalizeEmail(raw: string): string {
-  return raw.trim().toLowerCase();
-}
-
 export function normalizeAddress(raw: string): string | null {
   const address = raw.trim().toLowerCase();
   return ADDRESS_RE.test(address) ? address : null;
 }
 
-async function userIdWhere(where: SQL): Promise<string | null> {
-  const rows = await getDb().select({ id: users.id }).from(users).where(where);
-  return rows[0]?.id ?? null;
-}
-
-export async function userIdForSubject(subject: string): Promise<string | null> {
-  const address = normalizeAddress(subject);
-  if (address !== null) return userIdWhere(eq(users.address, address));
-  return userIdWhere(eq(users.email, normalizeEmail(subject)));
-}
-
-export async function resolveUserId(
-  insert: () => Promise<string | undefined>,
-  lookup: () => Promise<string | null>,
-): Promise<string> {
-  const inserted = await insert();
-  if (inserted !== undefined) return inserted;
-  const existing = await lookup();
-  if (existing === null)
-    throw new UserError('user lookup returned no id', 500);
-  return existing;
-}
-
 export async function ensureUserByAddress(raw: string): Promise<string> {
   const address = normalizeAddress(raw);
-  if (address === null)
-    throw new UserError('an Ethereum address is required', 400);
-  return resolveUserId(
-    async () => {
-      const rows = await getDb()
-        .insert(users)
-        .values({ id: newId(), address })
-        .onConflictDoNothing({ target: users.address })
-        .returning({ id: users.id });
-      return rows[0]?.id;
-    },
-    () => userIdWhere(eq(users.address, address)),
-  );
+  if (address === null) throw new UserError('an Ethereum address is required', 400);
+  const db = getDb();
+  const inserted = await db
+    .insert(users)
+    .values({ id: newId(), address })
+    .onConflictDoNothing({ target: users.address })
+    .returning({ id: users.id });
+  const id = inserted[0]?.id;
+  if (id !== undefined) return id;
+  const rows = await db.select({ id: users.id }).from(users).where(eq(users.address, address));
+  const existing = rows[0]?.id;
+  if (existing === undefined) throw new UserError('user lookup returned no id', 500);
+  return existing;
 }

package/runtime/node_modules/@metro-labs/mcp/src/db/vault.ts

@@ -32,7 +32,7 @@ const missing = (): VaultError => new VaultError('no such bundle', 404);
 
 function ownerOf(subject: string): string {
   const address = normalizeAddress(subject);
-  if (address === null) throw new VaultError('the vault needs a wallet sign-in', 403);
+  if (address === null) throw new VaultError('the vault needs a vault identity', 403);
   return address;
 }
 
@@ -44,12 +44,12 @@ function stationsOf(raw: unknown): string[] {
   return [...new Set(list)];
 }
 
-function envelopeOf(raw: unknown, id: string, owner: string): Record<string, unknown> {
+function envelopeOf(raw: unknown, id: string): Record<string, unknown> {
   if (!isRecord(raw) || raw.v !== 1 || raw.agentId !== id)
     throw new VaultError('envelope must be a v1 envelope for this agent', 400);
   const key = raw.key;
-  if (!isRecord(key) || key.recipient !== owner)
-    throw new VaultError('envelope must be sealed to the signed-in wallet', 400);
+  if (!isRecord(key) || normalizeAddress(typeof key.recipient === 'string' ? key.recipient : '') === null)
+    throw new VaultError('envelope must name the wallet it was sealed to', 400);
   if (typeof raw.ciphertext !== 'string' || typeof raw.nonce !== 'string')
     throw new VaultError('envelope carries no ciphertext', 400);
   if (JSON.stringify(raw).length > ENVELOPE_MAX)
@@ -63,7 +63,7 @@ export function parseVaultInput(subject: string, id: string, body: unknown): Vau
   if (!isRecord(body)) throw new VaultError('body must be an object', 400);
   const name = typeof body.name === 'string' ? body.name.trim() : '';
   if (!AGENT_NAME_RE.test(name)) throw new VaultError('name is not an agent name', 400);
-  return { owner, name, stations: stationsOf(body.stations), envelope: envelopeOf(body.envelope, id, owner) };
+  return { owner, name, stations: stationsOf(body.stations), envelope: envelopeOf(body.envelope, id) };
 }
 
 const entryOf = (row: { id: string; name: string; stations: unknown; syncedAt: string }): VaultEntry => ({

package/runtime/node_modules/@metro-labs/whatsapp/package.json

@@ -19,11 +19,9 @@
   },
   "devDependencies": {
     "@stage-labs/config": "0.1.0-beta.2",
-    "@types/qrcode-terminal": "^0.12.2",
     "eslint": "^10.3.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",
-    "qrcode-terminal": "^0.12.0",
     "typescript": "^5"
   }
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.50"
+  "version": "0.1.0-beta.52"
 }

package/dist/prompt.js

@@ -1,61 +0,0 @@
-import { createInterface } from 'node:readline';
-const CTRL_C = '\u0003';
-const BACKSPACE = '\u007f';
-function askLine(question) {
-    const rl = createInterface({ input: process.stdin, output: process.stderr });
-    return new Promise((resolve) => {
-        rl.question(question, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}
-export function feedSecret(value, chunk) {
-    let out = value;
-    for (const ch of chunk) {
-        if (ch === CTRL_C)
-            return { kind: 'cancelled' };
-        if (ch === '\r' || ch === '\n')
-            return { kind: 'done', value: out };
-        if (ch === BACKSPACE || ch === '\b') {
-            out = out.slice(0, -1);
-            continue;
-        }
-        if (ch >= ' ')
-            out += ch;
-    }
-    return { kind: 'more', value: out };
-}
-export function askSecret(question) {
-    const stdin = process.stdin;
-    if (!stdin.isTTY)
-        return askLine(question);
-    process.stderr.write(question);
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding('utf8');
-    return new Promise((resolve, reject) => {
-        let value = '';
-        const finish = () => {
-            stdin.setRawMode(false);
-            stdin.pause();
-            stdin.off('data', onData);
-            process.stderr.write('\n');
-        };
-        const onData = (chunk) => {
-            const step = feedSecret(value, chunk);
-            if (step.kind === 'cancelled') {
-                finish();
-                reject(new Error('cancelled'));
-                return;
-            }
-            if (step.kind === 'done') {
-                finish();
-                resolve(step.value.trim());
-                return;
-            }
-            value = step.value;
-        };
-        stdin.on('data', onData);
-    });
-}

package/dist/store.js

@@ -1,93 +0,0 @@
-import { chmodSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-const DEFAULT_BASE = 'https://mcp.metro.box';
-const DEFAULT_WEB = 'https://metro.box';
-function fromEnv(name, fallback) {
-    const raw = process.env[name]?.trim();
-    return raw === undefined || raw === '' ? fallback : raw.replace(/\/+$/, '');
-}
-export function metroUrl() {
-    return fromEnv('METRO_URL', DEFAULT_BASE);
-}
-export function metroWebUrl() {
-    return fromEnv('METRO_UI_URL', DEFAULT_WEB);
-}
-function configDir() {
-    const xdg = process.env.XDG_CONFIG_HOME?.trim();
-    const base = xdg === undefined || xdg === '' ? join(homedir(), '.config') : xdg;
-    return join(base, 'metro');
-}
-export function credentialsPath() {
-    return join(configDir(), 'credentials.json');
-}
-function readStoredAt(path) {
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (typeof parsed !== 'object' || parsed === null)
-        return null;
-    const { token, url } = parsed;
-    if (typeof token !== 'string' || token === '')
-        return null;
-    return { token, url: typeof url === 'string' ? url : DEFAULT_BASE };
-}
-const readStored = () => readStoredAt(credentialsPath());
-const RUN_TOKEN_FILE = /^runtime-[A-Za-z0-9_-]{11}\.json$/;
-export function readRunTokens() {
-    const fromEnv = process.env.METRO_RUN_TOKEN?.trim();
-    if (fromEnv !== undefined && fromEnv !== '')
-        return [fromEnv];
-    let names;
-    try {
-        names = readdirSync(configDir());
-    }
-    catch {
-        return [];
-    }
-    const out = [];
-    for (const name of names) {
-        if (!RUN_TOKEN_FILE.test(name))
-            continue;
-        const stored = readStoredAt(join(configDir(), name));
-        if (stored !== null && stored.url === metroUrl())
-            out.push(stored.token);
-    }
-    return out;
-}
-export function readToken() {
-    const fromEnv = process.env.METRO_TOKEN?.trim();
-    if (fromEnv !== undefined && fromEnv !== '')
-        return fromEnv;
-    const stored = readStored();
-    if (stored === null)
-        return null;
-    return stored.url === metroUrl() ? stored.token : null;
-}
-export function writeToken(token) {
-    const path = credentialsPath();
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, `${JSON.stringify({ token, url: metroUrl() })}\n`, {
-        mode: 0o600,
-    });
-    chmodSync(path, 0o600);
-}
-export function clearToken() {
-    try {
-        rmSync(credentialsPath());
-    }
-    catch {
-        return;
-    }
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-import.ts

@@ -1,76 +0,0 @@
-import { mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { ApiError } from './api-error.js';
-import { configDir } from './paths.js';
-import { writeSecure } from './secure-fs.js';
-import { carriesSecretsSafely, httpSource } from './runtime-source.js';
-import type { LoadedAgent } from '../db/materialize.js';
-
-const CLAIM_TIMEOUT_MS = 15_000;
-const CODE_RE = /^ma_[A-Za-z0-9_-]{16}$/;
-
-function metroBaseUrl(): string {
-  const raw = (process.env.METRO_URL?.trim() ?? '').replace(/\/+$/, '');
-  const url = raw === '' ? 'https://mcp.metro.box' : raw;
-  if (!carriesSecretsSafely(url))
-    throw new ApiError(`refusing to read station credentials from ${url} in the clear`, 400);
-  return url;
-}
-
-export function parsePairingCode(raw: unknown): string {
-  const code = typeof raw === 'string' ? raw.trim() : '';
-  if (!CODE_RE.test(code))
-    throw new ApiError('paste the pairing code from the agent\'s page on metro.box', 400);
-  return code;
-}
-
-async function claim(base: string, code: string, label: string): Promise<string> {
-  let res: Response;
-  try {
-    res = await fetch(`${base}/api/run/claim`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ code, label }),
-      signal: AbortSignal.timeout(CLAIM_TIMEOUT_MS),
-      redirect: 'manual',
-    });
-  } catch {
-    throw new ApiError(`could not reach ${base}`, 502);
-  }
-  const body: unknown = await res.json().catch(() => null);
-  const field = (key: string): unknown =>
-    typeof body === 'object' && body !== null ? (body as Record<string, unknown>)[key] : undefined;
-  if (!res.ok) {
-    const reason = field('error');
-    throw new ApiError(
-      typeof reason === 'string' ? reason : `metro answered ${String(res.status)} for the code`,
-      res.status === 404 ? 400 : res.status,
-    );
-  }
-  const token = field('token');
-  if (typeof token !== 'string' || token === '')
-    throw new ApiError('metro returned no runtime token', 502);
-  return token;
-}
-
-function storeRunToken(agentId: string, token: string, url: string): string {
-  const dir = configDir();
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const path = join(dir, `runtime-${agentId}.json`);
-  writeSecure(path, `${JSON.stringify({ token, url }, null, 2)}\n`);
-  return path;
-}
-
-export async function fetchAgentWithCode(
-  code: string,
-  label: string,
-  base = metroBaseUrl(),
-): Promise<LoadedAgent> {
-  const token = await claim(base, code, label);
-  const agents = await httpSource({ url: base, token })();
-  const agent = agents[0];
-  if (agent === undefined || agents.length !== 1)
-    throw new ApiError('metro returned no agent for that code', 502);
-  storeRunToken(agent.id, token, base);
-  return agent;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-pair.ts

@@ -1,20 +0,0 @@
-import { makeCodeStore } from './pair-codes.js';
-
-export interface AgentCode {
-  subject: string;
-  agentId: string;
-}
-
-const store = makeCodeStore<AgentCode>('ma');
-
-export const AGENT_CODE_RE = store.pattern;
-
-export const mintAgentCode = (
-  entry: AgentCode,
-  now?: number,
-): { code: string; expiresAt: number } => store.mint(entry, now);
-
-export const takeAgentCode = (code: string, now?: number): AgentCode | undefined =>
-  store.take(code, now);
-
-export const agentCodeCount = (): number => store.count();