@stage-labs/metro 0.1.0-beta.52 → 0.1.0-beta.54

package/dist/local.js

@@ -29,6 +29,32 @@ export function localAgents(dir = agentsDir()) {
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));
 }
+export function localStations(dir = agentsDir()) {
+    if (!existsSync(dir))
+        return [];
+    const out = new Set();
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const path = join(dir, entry.name, 'agent.json');
+        if (!existsSync(path))
+            continue;
+        try {
+            const file = JSON.parse(readFileSync(path, 'utf8'));
+            if (!Array.isArray(file.stations))
+                continue;
+            for (const s of file.stations) {
+                const station = s.station;
+                if (typeof station === 'string')
+                    out.add(station);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return [...out].sort();
+}
 export function pickLocalAgent(agents, wanted) {
     if (wanted !== undefined && wanted !== '') {
         const found = agents.find((a) => a.name === wanted || a.id === wanted);

package/dist/runtime-install.js

@@ -0,0 +1,84 @@
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { localStations } from './local.js';
+import { SERVER_ENTRY, findBun, runtimeDir } from './runtime.js';
+export const MANIFEST_FILE = 'stations.json';
+const METRO_SOURCES = join('node_modules', '@metro-labs');
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+export function runtimeStore() {
+    const env = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+    return env === '' ? join(homedir(), '.metro', 'runtime') : env;
+}
+const isRecord = (v) => typeof v === 'object' && v !== null;
+const ranges = (raw) => isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e) => typeof e[1] === 'string'))
+    : {};
+export function readManifest(path) {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!isRecord(raw))
+        throw new Error(`${path} is not a runtime manifest`);
+    const stations = isRecord(raw.stations) ? raw.stations : {};
+    return {
+        core: ranges(raw.core),
+        stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+    };
+}
+export function dependenciesFor(manifest, stations) {
+    const out = { ...manifest.core };
+    for (const station of new Set(stations))
+        Object.assign(out, manifest.stations[station] ?? {});
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+const packageText = (deps) => `${JSON.stringify({ name: 'metro-runtime', private: true, dependencies: deps }, null, 2)}\n`;
+function readOrNull(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function syncSources(sources, store) {
+    const stamp = readOrNull(join(sources, 'runtime.json'));
+    if (stamp !== null && readOrNull(join(store, 'runtime.json')) === stamp)
+        return false;
+    rmSync(join(store, METRO_SOURCES), { recursive: true, force: true });
+    cpSync(join(sources, METRO_SOURCES), join(store, METRO_SOURCES), { recursive: true });
+    if (stamp !== null)
+        writeFileSync(join(store, 'runtime.json'), stamp);
+    return true;
+}
+export function installDependencies(store, deps, bun, log) {
+    const wanted = packageText(deps);
+    const marker = join(store, 'node_modules', '.metro-installed');
+    if (existsSync(marker) && readOrNull(join(store, 'package.json')) === wanted)
+        return false;
+    writeFileSync(join(store, 'package.json'), wanted);
+    log(`Installing the channel SDKs this machine needs into ${store}`);
+    const run = spawnSync(bun, ['install', '--no-summary', '--no-progress'], {
+        cwd: store,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        timeout: INSTALL_TIMEOUT_MS,
+    });
+    if (run.error !== undefined || run.status !== 0)
+        throw new Error(`bun install failed in ${store}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+    writeFileSync(marker, `${new Date().toISOString()}\n`);
+    return true;
+}
+export function prepareRuntime(opts = {}) {
+    const sources = opts.sources ?? runtimeDir();
+    const manifestPath = join(sources, MANIFEST_FILE);
+    if (!existsSync(manifestPath))
+        return { dir: sources, entry: join(sources, SERVER_ENTRY), trains: join(sources, 'trains'), manifest: null };
+    const store = opts.store ?? runtimeStore();
+    const log = opts.log ??
+        ((line) => {
+            process.stderr.write(`${line}\n`);
+        });
+    mkdirSync(join(store, 'trains'), { recursive: true });
+    syncSources(sources, store);
+    installDependencies(store, dependenciesFor(readManifest(manifestPath), localStations(opts.agents)), opts.bun ?? findBun(), log);
+    return { dir: store, entry: join(store, SERVER_ENTRY), trains: join(store, 'trains'), manifest: manifestPath };
+}

package/dist/serve.js

@@ -4,7 +4,8 @@ import { join } from 'node:path';
 import { agentsDir } from './local.js';
 import { currentVersion } from './version.js';
 import { serveLockedBy, serveStateDir } from './control.js';
-import { findBun, localPort, runtimeDir, SERVER_ENTRY, spawnPlan, } from './runtime.js';
+import { findBun, localPort, SERVER_ENTRY, spawnPlan } from './runtime.js';
+import { prepareRuntime } from './runtime-install.js';
 const SCRUBBED = new Set(['METRO_RUN_TOKEN', 'METRO_AGENT', 'DATABASE_URL']);
 const PORT_FLAG = /^--port=(.*)$/;
 const OWNER_FLAG = /^--owner=(.*)$/;
@@ -80,7 +81,7 @@ export function servePlan(opts) {
     return {
         command: findBun(),
         args: [SERVER_ENTRY],
-        cwd: opts.dir,
+        cwd: opts.runtime.dir,
         env: {
             ...env,
             METRO_MODE: 'local',
@@ -88,7 +89,10 @@ export function servePlan(opts) {
             METRO_CLI_BIN: process.argv[1] ?? '',
             METRO_WEBHOOK_PORT: String(opts.port),
             METRO_HTTP_HOST: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
-            METRO_TRAINS_DIR: join(opts.dir, 'trains'),
+            METRO_TRAINS_DIR: opts.runtime.trains,
+            ...(opts.runtime.manifest === null
+                ? {}
+                : { METRO_RUNTIME_STORE: opts.runtime.dir, METRO_RUNTIME_MANIFEST: opts.runtime.manifest }),
             METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
             ...(opts.tunnel ? { METRO_TUNNEL: 'quick' } : {}),
             ...(opts.owner === null ? {} : { METRO_OWNER: opts.owner }),
@@ -104,7 +108,6 @@ export function serve(argv) {
     requireOwner(owner);
     if (tunnel)
         findCloudflared();
-    const dir = runtimeDir();
     process.stderr.write(`Starting a metro daemon of your own on http://127.0.0.1:${String(port)}\n`);
-    return spawnPlan(() => servePlan({ dir, port, tunnel, owner }));
+    return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, tunnel, owner }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.52",
+  "version": "0.1.0-beta.54",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {
@@ -35,26 +35,5 @@
     "knip": "^6.15.0",
     "madge": "^8.0.0",
     "typescript": "^5"
-  },
-  "dependencies": {
-    "@discordjs/voice": "^0.19.2",
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@mtcute/bun": "0.30.1",
-    "@xmtp/content-type-primitives": "^3.0.1",
-    "@xmtp/content-type-reaction": "^2.0.2",
-    "@xmtp/content-type-remote-attachment": "^2.0.4",
-    "@xmtp/content-type-reply": "^2.0.3",
-    "@xmtp/content-type-wallet-send-calls": "^2.0.0",
-    "@xmtp/node-bindings": "1.9.1",
-    "@xmtp/node-sdk": "^6.0.0",
-    "baileys": "7.0.0-rc14",
-    "discord.js": "^14.26.4",
-    "drizzle-orm": "^0.44.0",
-    "pino": "^9.5.0",
-    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.5",
-    "prism-media": "^1.3.5",
-    "viem": "^2.52.2",
-    "zod": "^3.23.8"
   }
 }

package/runtime/node_modules/@metro-labs/mcp/package.json

@@ -44,6 +44,7 @@
     "@metro-labs/whatsapp": "workspace:*",
     "@metro-labs/xmtp": "workspace:*",
     "@modelcontextprotocol/sdk": "^1.12.0",
+    "@noble/curves": "^1.9.7",
     "drizzle-kit": "^0.31.0",
     "drizzle-orm": "^0.44.0",
     "pino": "^9.5.0",

package/runtime/node_modules/@metro-labs/mcp/src/daemon/account-api.ts

@@ -13,7 +13,7 @@ import {
   parseAccountId,
   type AccountRef,
 } from '../db/account-attach.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
 import {
   ATTACHABLE_STATIONS,
   isAttachStation,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-api.ts

@@ -259,20 +259,20 @@ function methodAllowed(tgt: Routable, method: string | undefined): boolean {
   return ALLOWED[tgt.kind].includes(method ?? '');
 }
 
-function dispatch(
+async function dispatch(
   req: IncomingMessage,
   res: ServerResponse,
   deps: AgentApiDeps,
   tgt: Routable,
 ): Promise<void> {
-  const session = apiSession(req);
+  const session = await apiSession(req);
   if (!session) {
     sendJson(req, res, 401, { error: 'unauthorized' });
-    return Promise.resolve();
+    return;
   }
   if (tgt.kind === 'accounts')
-    return handleAccountRoute(req, res, deps, session, tgt.id, tgt.route);
-  return routeAgent(req, res, deps, session, tgt);
+    await handleAccountRoute(req, res, deps, session, tgt.id, tgt.route);
+  else await routeAgent(req, res, deps, session, tgt);
 }
 
 export function handleAgentApiRequest(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/agent-connector-api.ts

@@ -122,12 +122,15 @@ export function handleAgentConnectorRequest(
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  route(req, res, deps, session, tgt).catch((err: unknown) => {
+  apiSession(req)
+    .then((session) => {
+      if (!session) {
+        sendJson(req, res, 401, { error: 'unauthorized' });
+        return;
+      }
+      return route(req, res, deps, session, tgt);
+    })
+    .catch((err: unknown) => {
     log.warn({ err: errMsg(err) }, 'agent-api: unhandled error');
     if (!res.headersSent) sendJson(req, res, 500, { error: 'agent api failed' });
   });

package/runtime/node_modules/@metro-labs/mcp/src/daemon/api-http.ts

@@ -1,8 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from './log.js';
-import { verifySession } from './session.js';
-import { extractToken } from '../mcp/request-identity.js';
+import { signedIdentity } from './signed-identity.js';
+import { identitySubject } from './identity-registry.js';
 
 const BODY_MAX = 4 * 1024;
 
@@ -35,17 +35,10 @@ export function sendJson(
   res.end(JSON.stringify(body));
 }
 
-export function apiSession(req: IncomingMessage): ApiSession | null {
-  const secret = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  if (secret === '') return null;
-  const token = extractToken(req) ?? '';
-  if (token === '') return null;
-  try {
-    const { subject } = verifySession(token, secret);
-    return { subject: subject.toLowerCase() };
-  } catch {
-    return null;
-  }
+export async function apiSession(req: IncomingMessage): Promise<ApiSession | null> {
+  const address = await signedIdentity(req);
+  const subject = address === null ? undefined : identitySubject(address);
+  return subject === undefined ? null : { subject };
 }
 
 export interface AgentIdentity {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-serve.ts

@@ -7,7 +7,6 @@ import {
 } from '../stations/attachments.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
   extractToken,
 } from '../mcp/request-identity.js';
@@ -21,7 +20,7 @@ function authorized(req: IncomingMessage, name: string): boolean {
   const owner = attachmentOwner(name);
   if (owner === undefined) return false;
   if (grantAllows(name, owner, extractToken(req) ?? '')) return true;
-  return allowedAgents(authenticate(req, authConfigFromEnv()) ?? undefined).has(
+  return allowedAgents(authenticate(req) ?? undefined).has(
     owner,
   );
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-session.ts

@@ -1,7 +1,8 @@
 import { randomBytes } from 'node:crypto';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from './log.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
+import { ensureStationDeps } from './runtime-deps.js';
 import {
   startInteractiveAttach,
   type AttachDriver,
@@ -216,6 +217,7 @@ export class AttachSessions {
     };
     this.sessions.set(attachId, session);
     try {
+      ensureStationDeps(station);
       const started = await (this.deps.start ?? startInteractiveAttach)(
         station,
         input,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -20,9 +20,9 @@ import {
 } from './http.js';
 import { localAgentKey } from '../db/materialize.js';
 import { fileSource } from '../db/file-source.js';
-import { ensureLocalSessionSecret } from './local-secret.js';
 import { applyLocalOwner } from './local-owner.js';
 import { localOwner } from '../db/file-admin.js';
+import { ensureStationDeps } from './runtime-deps.js';
 import { localSessionApis } from './local-mode.js';
 import type { ModeInfo } from './mode-api.js';
 import type { SessionApis } from './session-apis.js';
@@ -39,13 +39,7 @@ import {
 } from '../stations/registry.js';
 import { prepareAccount } from '../stations/attach.js';
 import { materializeFrom, reloadFrom } from '../db/materialize.js';
-import {
-  deleteVaultForOwner,
-  getVaultForOwner,
-  listVaultForOwner,
-  putVaultForOwner,
-} from '../db/vault.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
 import { startUploadReaper } from './upload-store.js';
 
 installCrashGuard();
@@ -96,7 +90,10 @@ async function syncStations(station: StationName): Promise<void> {
   const { removed } = await reloadFrom(fileSource);
   if (stationByName(station)?.hasTrain === false) return;
   if (removed.includes(station)) await supervisor.stopTrain(station);
-  else supervisor.requestReload(station);
+  else {
+    ensureStationDeps(station);
+    supervisor.requestReload(station);
+  }
 }
 
 const hostedMode = (): ModeInfo => ({
@@ -106,7 +103,7 @@ const hostedMode = (): ModeInfo => ({
   version: METRO_VERSION,
 });
 
-function sessionApis(): SessionApis {
+async function sessionApis(): Promise<SessionApis> {
   if (isLocalMode())
     return localSessionApis({
       syncStations,
@@ -120,12 +117,13 @@ function sessionApis(): SessionApis {
       liveness: agentLiveness,
       prepareAccount,
     });
+  const vault = await import('../db/vault.js');
   return {
     vaultApi: {
-      list: listVaultForOwner,
-      put: putVaultForOwner,
-      get: getVaultForOwner,
-      remove: deleteVaultForOwner,
+      list: vault.listVaultForOwner,
+      put: vault.putVaultForOwner,
+      get: vault.getVaultForOwner,
+      remove: vault.deleteVaultForOwner,
     },
     mode: hostedMode,
   };
@@ -133,7 +131,6 @@ function sessionApis(): SessionApis {
 
 async function main(): Promise<void> {
   if (isLocalMode()) {
-    ensureLocalSessionSecret();
     applyLocalOwner();
     await materializeFrom(fileSource, { allowEmpty: true });
   }
@@ -141,7 +138,7 @@ async function main(): Promise<void> {
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
     emit,
-    sessionApis(),
+    await sessionApis(),
     metroMcp.httpHandler,
     metroCall,
   );

package/runtime/node_modules/@metro-labs/mcp/src/daemon/bundle-api.ts

@@ -5,7 +5,7 @@ import { ApiError } from './api-error.js';
 import { isRecord } from './is-record.js';
 import { parseId } from '../db/ids.js';
 import type { LoadedAccount, LoadedAgent, LoadedConnector } from '../db/materialize.js';
-import { STATIONS } from '../db/schema.js';
+import { STATIONS } from '../db/stations.js';
 
 const AGENTS = '/api/agents';
 const RESTORE_PATH = `${AGENTS}/restore`;
@@ -92,12 +92,11 @@ export function handleBundleRequest(req: IncomingMessage, res: ServerResponse, d
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  answer(req, deps, session.subject, path)
+  apiSession(req)
+    .then((session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      return answer(req, deps, session.subject, path);
+    })
     .then((body) => {
       sendJson(req, res, isRestore ? 201 : 200, body);
     })

package/runtime/node_modules/@metro-labs/mcp/src/daemon/claude-api.ts

@@ -77,13 +77,9 @@ export function handleClaudeRequest(
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  Promise.resolve()
-    .then(() => {
+  apiSession(req)
+    .then((session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       return answer(req.method ?? 'GET', path, new URLSearchParams(search), (deps.dir ?? claudeDir)());
     })

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-api.ts

@@ -265,7 +265,7 @@ const ALLOWED: Record<Routable['kind'], string[]> = {
   rename: ['POST'],
 };
 
-function dispatch(
+async function dispatch(
   req: IncomingMessage,
   res: ServerResponse,
   deps: ConnectorApiDeps,
@@ -273,14 +273,14 @@ function dispatch(
 ): Promise<void> {
   if (tgt.kind === 'callback') {
     handleCallback(req, res, deps);
-    return Promise.resolve();
+    return;
   }
-  const session = apiSession(req);
+  const session = await apiSession(req);
   if (!session) {
     sendJson(req, res, 401, { error: 'unauthorized' });
-    return Promise.resolve();
+    return;
   }
-  return route(req, res, deps, session, tgt);
+  await route(req, res, deps, session, tgt);
 }
 
 export function handleConnectorApiRequest(

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connector-oauth.ts

@@ -4,7 +4,7 @@ import {
   type OAuthAuth,
   type OAuthTokens,
 } from './connector-verify.js';
-import { validateReturnTo } from './session-config.js';
+import { validateReturnTo } from './return-to.js';
 import {
   authorizeUrl,
   exchangeCode,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -27,7 +27,7 @@ import {
 } from './tunnel.js';
 import { attachmentEventUrl, handleAttachRequest } from './attach-serve.js';
 import { webhookEntry } from '@metro-labs/webhook';
-import { handleSiweAuthRequest } from './siwe-routes.js';
+import { handleIdentityRequest } from './identity-routes.js';
 import { handleModeRequest } from './mode-api.js';
 import { handleUploadRequest } from './upload-api.js';
 import {
@@ -328,7 +328,7 @@ function handleSignInRoutes(
   res: ServerResponse,
   apis: SessionApis,
 ): boolean {
-  if (handleSiweAuthRequest(req, res, apis.siwe)) return true;
+  if (apis.identity !== undefined && handleIdentityRequest(req, res, apis.identity)) return true;
   return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity-key.ts

@@ -0,0 +1,33 @@
+import { hkdfSync } from 'node:crypto';
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { mapHashToField } from '@noble/curves/abstract/modular';
+import { privateKeyToAccount } from 'viem/accounts';
+
+export const ENCRYPTION_KEY_TYPED_DATA = {
+  domain: { name: 'metro', version: '1' },
+  types: {
+    EncryptionKey: [
+      { name: 'purpose', type: 'string' },
+      { name: 'keyVersion', type: 'uint256' },
+    ],
+  },
+  primaryType: 'EncryptionKey',
+  message: { purpose: 'encryption-key', keyVersion: 1n },
+} as const;
+
+const KEY_SALT = 'metro';
+const IDENTITY_INFO = 'vault-secp256k1';
+const KEY_HASH_BYTES = 48;
+
+const toHex = (bytes: Uint8Array): `0x${string}` =>
+  `0x${[...bytes].map((b) => b.toString(16).padStart(2, '0')).join('')}`;
+
+export function deriveIdentityKey(signature: `0x${string}`): `0x${string}` {
+  const ikm = Buffer.from(signature.slice(2), 'hex');
+  const hash = new Uint8Array(hkdfSync('sha256', ikm, KEY_SALT, IDENTITY_INFO, KEY_HASH_BYTES));
+  return toHex(mapHashToField(hash, secp256k1.CURVE.n));
+}
+
+export function deriveIdentityAddress(signature: `0x${string}`): string {
+  return privateKeyToAccount(deriveIdentityKey(signature)).address.toLowerCase();
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity-registry.ts

@@ -0,0 +1,13 @@
+const subjects = new Map<string, string>();
+
+export function authorizeIdentity(address: string, subject: string): void {
+  subjects.set(address.toLowerCase(), subject.toLowerCase());
+}
+
+export function identitySubject(address: string): string | undefined {
+  return subjects.get(address.toLowerCase());
+}
+
+export function resetIdentities(): void {
+  subjects.clear();
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/identity-routes.ts

@@ -0,0 +1,54 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { verifyTypedData } from 'viem';
+import { log } from './log.js';
+import { ApiError } from './api-error.js';
+import { apiFailure, bodyField, cors, readJsonBody, sendJson } from './api-http.js';
+import { ENCRYPTION_KEY_TYPED_DATA, deriveIdentityAddress } from './identity-key.js';
+import { authorizeIdentity } from './identity-registry.js';
+
+const PATH = '/auth/identity';
+const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+
+export interface IdentityRouteDeps {
+  owner: () => string | null;
+}
+
+async function register(req: IncomingMessage, deps: IdentityRouteDeps): Promise<{ address: string; owner: string }> {
+  const signature = bodyField(await readJsonBody(req), 'signature');
+  if (typeof signature !== 'string' || !SIGNATURE_RE.test(signature))
+    throw new ApiError('signature is required: the EncryptionKey signature of the owner wallet', 400);
+  const owner = deps.owner();
+  if (owner === null)
+    throw new ApiError('this machine has no owner yet: start it with metro serve --owner <address>', 403);
+  const ok = await verifyTypedData({
+    ...ENCRYPTION_KEY_TYPED_DATA,
+    address: owner as `0x${string}`,
+    signature: signature as `0x${string}`,
+  }).catch(() => false);
+  if (!ok) throw new ApiError('this machine belongs to another wallet', 403);
+  const address = deriveIdentityAddress(signature as `0x${string}`);
+  authorizeIdentity(address, owner);
+  log.info({ owner, identity: address }, 'identity: owner signed in');
+  return { address, owner };
+}
+
+export function handleIdentityRequest(req: IncomingMessage, res: ServerResponse, deps: IdentityRouteDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  register(req, deps)
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'identity');
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -44,11 +44,10 @@ import {
   localOwnedAgentOrThrow,
   localOwner,
   localResetAgentKey,
-  ownerSignIn,
   readLocalAgentFile,
 } from '../db/file-admin.js';
 import { listAgentFiles, readAgentFile } from '../db/file-source.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
 
 export interface LocalModeDeps {
   syncStations: (station: StationName) => Promise<void>;
@@ -191,7 +190,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     localCli,
     claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
     updateApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart },
-    siwe: { ensureUser: ownerSignIn },
+    identity: { owner: localOwner },
     mode: localModeInfo,
   };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/{session-config.ts → return-to.ts}

@@ -1,4 +1,3 @@
-export const SESSION_TTL_SEC = 30 * 24 * 3600;
 const PREVIEW = /^([a-z0-9-]+--)?metro-ui\.netlify\.app$/;
 
 export function allowedWebHost(host: string): boolean {