@stage-labs/metro 0.1.0-beta.52 → 0.1.0-beta.54

package/runtime/node_modules/@metro-labs/mcp/src/daemon/runtime-deps.ts

@@ -0,0 +1,82 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { log } from './log.js';
+import { isRecord } from './is-record.js';
+import type { StationName } from '../db/stations.js';
+import { knownAccounts } from '../db/agent-map.js';
+
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+
+export interface RuntimeManifest {
+  core: Record<string, string>;
+  stations: Record<string, Record<string, string>>;
+}
+
+export interface RuntimeStore {
+  dir: string;
+  manifest: RuntimeManifest;
+}
+
+const ranges = (raw: unknown): Record<string, string> =>
+  isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e): e is [string, string] => typeof e[1] === 'string'))
+    : {};
+
+export function readManifest(path: string): RuntimeManifest {
+  const raw: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!isRecord(raw)) throw new Error(`${path} is not a runtime manifest`);
+  const stations = isRecord(raw.stations) ? raw.stations : {};
+  return {
+    core: ranges(raw.core),
+    stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+  };
+}
+
+export function runtimeStore(): RuntimeStore | null {
+  const dir = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  const manifest = process.env.METRO_RUNTIME_MANIFEST?.trim() ?? '';
+  if (dir === '' || manifest === '') return null;
+  return { dir, manifest: readManifest(manifest) };
+}
+
+export function dependenciesFor(manifest: RuntimeManifest, stations: Iterable<string>): Record<string, string> {
+  const out: Record<string, string> = { ...manifest.core };
+  for (const station of new Set(stations)) Object.assign(out, manifest.stations[station] ?? {});
+  return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+const packageText = (deps: Record<string, string>): string =>
+  `${JSON.stringify({ name: 'metro-runtime', private: true, dependencies: deps }, null, 2)}\n`;
+
+function current(dir: string): string | null {
+  try {
+    return readFileSync(join(dir, 'package.json'), 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function installRuntime(store: RuntimeStore, stations: Iterable<string>): boolean {
+  const wanted = packageText(dependenciesFor(store.manifest, stations));
+  const installed = existsSync(join(store.dir, 'node_modules', '.metro-installed'));
+  if (installed && current(store.dir) === wanted) return false;
+  mkdirSync(store.dir, { recursive: true });
+  writeFileSync(join(store.dir, 'package.json'), wanted);
+  log.info({ dir: store.dir }, 'runtime: installing the channel SDKs this machine needs');
+  const run = spawnSync('bun', ['install', '--no-summary', '--no-progress'], {
+    cwd: store.dir,
+    stdio: ['ignore', 'inherit', 'inherit'],
+    timeout: INSTALL_TIMEOUT_MS,
+  });
+  if (run.error !== undefined || run.status !== 0)
+    throw new Error(`bun install failed in ${store.dir}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+  writeFileSync(join(store.dir, 'node_modules', '.metro-installed'), `${new Date().toISOString()}\n`);
+  return true;
+}
+
+export function ensureStationDeps(station: StationName): void {
+  const store = runtimeStore();
+  if (store === null) return;
+  installRuntime(store, [...knownAccounts().map((a) => a.station), station]);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-api.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { apiSession, cors, sendJson } from './api-http.js';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
 
 const PATH = '/api/session';
 
@@ -17,11 +17,13 @@ export function handleSessionApiRequest(
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  sendJson(req, res, 200, { subject: session.subject });
+  apiSession(req)
+    .then((session) => {
+      if (!session) sendJson(req, res, 401, { error: 'unauthorized' });
+      else sendJson(req, res, 200, { subject: session.subject });
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'session');
+    });
   return true;
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -10,7 +10,7 @@ import {
   handleAgentConnectorRequest,
   type AgentConnectorApiDeps,
 } from './agent-connector-api.js';
-import type { SiweRouteDeps } from './siwe-routes.js';
+import type { IdentityRouteDeps } from './identity-routes.js';
 import { handleLocalCliRequest, type LocalCliDeps } from './local-cli-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from './claude-api.js';
 import type { ModeInfo } from './mode-api.js';
@@ -28,7 +28,7 @@ export interface SessionApis {
   claudeApi?: ClaudeApiDeps;
   connectorApi?: ConnectorApiDeps;
   relayApi?: RelayApiDeps;
-  siwe?: SiweRouteDeps;
+  identity?: IdentityRouteDeps;
   mode?: () => ModeInfo;
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/signed-identity.ts

@@ -0,0 +1,36 @@
+import type { IncomingMessage } from 'node:http';
+import { verifyMessage } from 'viem';
+import { normalizeAddress } from '../db/address.js';
+
+export const AUTH_SCHEME = 'Metro';
+const SKEW_MS = 5 * 60_000;
+const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+
+export const identityChallenge = (method: string, path: string, at: number): string =>
+  `metro-auth\n${method} ${path}\n${String(at)}`;
+
+export interface SignedHeader {
+  address: string;
+  at: number;
+  signature: `0x${string}`;
+}
+
+export function parseIdentityHeader(header: string): SignedHeader | null {
+  const [scheme, rawAddress, rawAt, signature] = header.trim().split(/\s+/);
+  if (scheme !== AUTH_SCHEME || rawAddress === undefined || rawAt === undefined || signature === undefined) return null;
+  const address = normalizeAddress(rawAddress);
+  const at = Number(rawAt);
+  if (address === null || !Number.isFinite(at) || !SIGNATURE_RE.test(signature)) return null;
+  return { address, at, signature: signature as `0x${string}` };
+}
+
+export async function signedIdentity(req: IncomingMessage, now = Date.now()): Promise<string | null> {
+  const proof = parseIdentityHeader(req.headers.authorization ?? '');
+  if (proof === null || Math.abs(now - proof.at) > SKEW_MS) return null;
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const message = identityChallenge(req.method ?? '', path, proof.at);
+  const ok = await verifyMessage({ address: proof.address as `0x${string}`, message, signature: proof.signature }).catch(
+    () => false,
+  );
+  return ok ? proof.address : null;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/update-api.ts

@@ -93,13 +93,10 @@ export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, d
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
   Promise.resolve()
     .then(async (): Promise<unknown> => {
+      const session = await apiSession(req);
+      if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       const bin = binOrThrow(deps);
       if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };

package/runtime/node_modules/@metro-labs/mcp/src/daemon/upload-api.ts

@@ -4,7 +4,6 @@ import { guessMime } from '../stations/attachments.js';
 import { safeFileName } from '../stations/attach-inline.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
   extractToken,
 } from '../mcp/request-identity.js';
@@ -69,7 +68,7 @@ const query = (req: IncomingMessage, key: string): string | undefined =>
   new URL(req.url ?? '/', 'http://localhost').searchParams.get(key) ?? undefined;
 
 const identityScope = (req: IncomingMessage): Set<string> =>
-  allowedAgents(authenticate(req, authConfigFromEnv()) ?? undefined);
+  allowedAgents(authenticate(req) ?? undefined);
 
 function ownerFromScope(req: IncomingMessage, allowed: Set<string>): string {
   const requested = query(req, 'agent');

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-api.ts

@@ -1,42 +1,12 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from './log.js';
-import { verifyMessage } from 'viem';
 import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { normalizeAddress } from '../db/users.js';
 import { parseId } from '../db/ids.js';
-import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from '../db/vault.js';
+import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from './vault-types.js';
+import { signedIdentity } from './signed-identity.js';
 
 const PREFIX = '/api/vault';
 const BODY_MAX = ENVELOPE_MAX + 64 * 1024;
-const SKEW_MS = 5 * 60_000;
-const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
-
-export const vaultChallenge = (method: string, path: string, at: number): string =>
-  `metro-vault\n${method} ${path}\n${String(at)}`;
-
-interface VaultProof {
-  address: string;
-  at: number;
-  signature: `0x${string}`;
-}
-
-function parseVaultHeader(header: string): VaultProof | null {
-  const [scheme, rawAddress, rawAt, signature] = header.trim().split(/\s+/);
-  if (scheme !== 'Vault' || rawAddress === undefined || rawAt === undefined || signature === undefined) return null;
-  const address = normalizeAddress(rawAddress);
-  const at = Number(rawAt);
-  if (address === null || !Number.isFinite(at) || !SIGNATURE_RE.test(signature)) return null;
-  return { address, at, signature: signature as `0x${string}` };
-}
-
-export async function vaultIdentity(req: IncomingMessage, now = Date.now()): Promise<string | null> {
-  const proof = parseVaultHeader(req.headers.authorization ?? '');
-  if (proof === null || Math.abs(now - proof.at) > SKEW_MS) return null;
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const message = vaultChallenge(req.method ?? '', path, proof.at);
-  const ok = await verifyMessage({ address: proof.address as `0x${string}`, message, signature: proof.signature }).catch(() => false);
-  return ok ? proof.address : null;
-}
 
 export interface VaultApiDeps {
   list: (subject: string) => Promise<VaultEntry[]>;
@@ -64,7 +34,7 @@ async function route(
   tgt: { kind: 'index' } | { kind: 'bundle'; id: string },
 ): Promise<void> {
   try {
-    const owner = await vaultIdentity(req);
+    const owner = await signedIdentity(req);
     if (owner === null) {
       sendJson(req, res, 401, { error: 'unauthorized' });
       return;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-types.ts

@@ -0,0 +1,12 @@
+export interface VaultEntry {
+  id: string;
+  name: string;
+  stations: string[];
+  syncedAt: string;
+}
+
+export interface VaultBundle extends VaultEntry {
+  envelope: Record<string, unknown>;
+}
+
+export const ENVELOPE_MAX = 2 * 1024 * 1024;

package/runtime/node_modules/@metro-labs/mcp/src/db/account-attach.ts

@@ -1,4 +1,4 @@
-import { STATIONS, type StationName } from './schema.js';
+import { STATIONS, type StationName } from './stations.js';
 
 const ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 

package/runtime/node_modules/@metro-labs/mcp/src/db/address.ts

@@ -0,0 +1,6 @@
+const ADDRESS_RE = /^0x[0-9a-f]{40}$/;
+
+export function normalizeAddress(raw: string): string | null {
+  const address = raw.trim().toLowerCase();
+  return ADDRESS_RE.test(address) ? address : null;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-scope.ts

@@ -3,7 +3,7 @@ import {
   agentIdForAccount,
   stationAgentIds,
 } from './agent-map.js';
-import { STATIONS } from './schema.js';
+import { STATIONS } from './stations.js';
 
 const ACCOUNT_STATIONS = new Set<string>(STATIONS);
 

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -1,6 +1,6 @@
 import type { ConnectorAuth, VerifiedRecord } from '../daemon/connector-verify.js';
 import { readConfig, signInState, type ConnectorSignIn } from './connector-config.js';
-import type { ConnectorTransport } from './schema.js';
+import type { ConnectorTransport } from './stations.js';
 
 export interface Connector {
   id: string;

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -25,8 +25,8 @@ import {
 import { newId } from './ids.js';
 import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
 import { MOVABLE_STATIONS, type LoadedAgent } from './materialize.js';
-import type { StationName } from './schema.js';
-import { normalizeAddress } from './users.js';
+import type { StationName } from './stations.js';
+import { normalizeAddress } from './address.js';
 
 export const LOCAL_PROJECT_ID = 'localdaemon';
 const OWNER_FILE = '.owner';
@@ -54,16 +54,6 @@ export function setLocalOwner(raw: string, dir = agentsDir()): string {
   return address;
 }
 
-export function ownerSignIn(raw: string, dir = agentsDir()): Promise<string> {
-  const owner = localOwner(dir);
-  if (owner === null)
-    return Promise.reject(
-      new ApiError('this machine has no owner yet: start it with metro serve --owner <address>', 403),
-    );
-  if (owner !== normalizeAddress(raw))
-    return Promise.reject(new ApiError('this machine belongs to another wallet', 403));
-  return Promise.resolve(owner);
-}
 
 function isOwner(subject: string, dir: string): boolean {
   const owner = localOwner(dir);

package/runtime/node_modules/@metro-labs/mcp/src/db/file-source.ts

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { AGENT_NAME_RE, ID_RE } from './ids.js';
-import { STATIONS, type StationName } from './schema.js';
+import { STATIONS, type StationName } from './stations.js';
 import type { LoadedAccount, LoadedAgent, StationSource } from './materialize.js';
 import { isRecord } from '../daemon/is-record.js';
 

package/runtime/node_modules/@metro-labs/mcp/src/db/materialize.ts

@@ -18,7 +18,7 @@ import {
   type AllowlistMap,
 } from './agent-map.js';
 import { setKeyMap } from './key-map.js';
-import { STATIONS, type StationName } from './schema.js';
+import { STATIONS, type StationName } from './stations.js';
 
 interface StationTarget {
   file: string;

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -1,25 +1,11 @@
 import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core';
 
-export const STATIONS = [
-  'xmtp',
-  'telegram-bot',
-  'telegram',
-  'discord-bot',
-  'whatsapp',
-  'webhook',
-] as const;
+import { STATIONS, type ConnectorTransport, type StationName } from './stations.js';
 
-export type StationName = (typeof STATIONS)[number];
-
-export const users = pgTable('users', {
-  id: text('id').primaryKey(),
-  email: text('email').unique(),
-  address: text('address').unique(),
-});
+export { STATIONS, type ConnectorTransport, type StationName };
 
 export type ProjectRole = 'admin' | 'member';
 
-export type ConnectorTransport = 'http' | 'sse';
 
 export const vault = pgTable(
   'vault',

package/runtime/node_modules/@metro-labs/mcp/src/db/stations.ts

@@ -0,0 +1,12 @@
+export const STATIONS = [
+  'xmtp',
+  'telegram-bot',
+  'telegram',
+  'discord-bot',
+  'whatsapp',
+  'webhook',
+] as const;
+
+export type StationName = (typeof STATIONS)[number];
+
+export type ConnectorTransport = 'http' | 'sse';

package/runtime/node_modules/@metro-labs/mcp/src/db/vault.ts

@@ -3,29 +3,19 @@ import { ApiError } from '../daemon/api-error.js';
 import { isRecord } from '../daemon/is-record.js';
 import { getDb } from './client.js';
 import { AGENT_NAME_RE, parseId } from './ids.js';
-import { STATIONS, vault } from './schema.js';
-import { normalizeAddress } from './users.js';
+import { vault } from './schema.js';
+import { STATIONS } from './stations.js';
+import { normalizeAddress } from './address.js';
 
 export class VaultError extends ApiError {}
 
-export interface VaultEntry {
-  id: string;
-  name: string;
-  stations: string[];
-  syncedAt: string;
-}
-
-export interface VaultBundle extends VaultEntry {
-  envelope: Record<string, unknown>;
-}
+import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from '../daemon/vault-types.js';
 
 export interface VaultInput {
   name: string;
   stations: string[];
   envelope: Record<string, unknown>;
 }
-
-export const ENVELOPE_MAX = 2 * 1024 * 1024;
 const STATION_NAMES = new Set<string>(STATIONS);
 
 const missing = (): VaultError => new VaultError('no such bundle', 404);

package/runtime/node_modules/@metro-labs/mcp/src/mcp/accounts.ts

@@ -7,7 +7,7 @@ import { listEndpoints } from '../daemon/tunnel.js';
 import { hookUrl } from '../stations/attach.js';
 import { agentIdForAccount, knownAccounts, type KnownAccount } from '../db/agent-map.js';
 import { stationRunsHere } from '../db/materialize.js';
-import { type StationName } from '../db/schema.js';
+import { type StationName } from '../db/stations.js';
 
 const accountId = (acc: unknown): string | undefined => {
   const id = (acc as { id?: unknown }).id;

package/runtime/node_modules/@metro-labs/mcp/src/mcp/index.ts

@@ -5,7 +5,6 @@ import {
 } from '../daemon/http.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
   runWithIdentity,
   type RequestIdentity,
@@ -156,7 +155,7 @@ export async function createMetroMcp(): Promise<{
     req: IncomingMessage,
     res: ServerResponse,
   ): Promise<void> => {
-    const identity = authenticate(req, authConfigFromEnv());
+    const identity = authenticate(req);
     if (!identity) {
       res.writeHead(401).end('unauthorized');
       return;

package/runtime/node_modules/@metro-labs/mcp/src/mcp/request-identity.ts

@@ -1,6 +1,5 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import type { IncomingMessage } from 'node:http';
-import { verifySession } from '../daemon/session.js';
 import { agentIdForKey } from '../db/key-map.js';
 
 export type RequestIdentity =
@@ -20,14 +19,6 @@ export function currentIdentity(): RequestIdentity | undefined {
   return storage.getStore();
 }
 
-export interface AuthConfig {
-  sessionSecret: string;
-}
-
-export function authConfigFromEnv(): AuthConfig {
-  return { sessionSecret: process.env.METRO_SESSION_SECRET?.trim() ?? '' };
-}
-
 export function extractToken(req: IncomingMessage): string | undefined {
   const header = req.headers.authorization;
   if (header?.startsWith('Bearer ')) {
@@ -40,28 +31,11 @@ export function extractToken(req: IncomingMessage): string | undefined {
   return qt ?? undefined;
 }
 
-const looksLikeJwt = (token: string): boolean =>
-  /^[\w-]+\.[\w-]+\.[\w-]+$/.test(token);
-
-export function authenticate(
-  req: IncomingMessage,
-  cfg: AuthConfig,
-): RequestIdentity | null {
+export function authenticate(req: IncomingMessage): RequestIdentity | null {
   const token = extractToken(req);
   if (!token) return null;
-
   const agentId = agentIdForKey(token);
-  if (agentId !== undefined) return { kind: 'agent', agentId };
-
-  if (cfg.sessionSecret !== '' && looksLikeJwt(token)) {
-    try {
-      const { subject, agentIds } = verifySession(token, cfg.sessionSecret);
-      return { kind: 'session', subject, agentIds };
-    } catch {
-      return null;
-    }
-  }
-  return null;
+  return agentId === undefined ? null : { kind: 'agent', agentId };
 }
 
 export function allowedAgents(

package/runtime/node_modules/@metro-labs/mcp/src/monitor/api.ts

@@ -6,7 +6,6 @@ import { callTargetDenied, eventInScope } from '../db/agent-scope.js';
 import { hasAnyKey } from '../db/key-map.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
 } from '../mcp/request-identity.js';
 import { METRO_VERSION } from '../daemon/version.js';
@@ -20,9 +19,7 @@ export type MonitorCall = (
 const KEEPALIVE_MS = 25_000;
 const CALL_BODY_MAX = 256 * 1024;
 
-function monitorEnabled(): boolean {
-  return hasAnyKey() || authConfigFromEnv().sessionSecret !== '';
-}
+const monitorEnabled = (): boolean => hasAnyKey();
 
 function cors(req: IncomingMessage): Record<string, string> {
   return {
@@ -230,7 +227,7 @@ export function handleMonitorRequest(
   const path = (req.url ?? '').split('?', 2)[0] ?? '';
   if (!path.startsWith('/api/')) return false;
   if (preflight(req, res, path)) return true;
-  const identity = authenticate(req, authConfigFromEnv());
+  const identity = authenticate(req);
   if (!identity) {
     sendJson(res, req, 401, { error: 'unauthorized' });
     return true;

package/runtime/node_modules/@metro-labs/mcp/src/stations/attach.ts

@@ -8,6 +8,7 @@ import {
   verifyTelegramBotToken,
 } from '@metro-labs/telegram-bot/verify';
 import { ApiError } from '../daemon/api-error.js';
+import { ensureStationDeps } from '../daemon/runtime-deps.js';
 import { publicBaseOrDefault } from '../daemon/attach-serve.js';
 import {
   discardXmtpDb,
@@ -175,6 +176,7 @@ export async function prepareAccount(
   input: AttachInput,
   verify: VerifyXmtpKey = verifyXmtpKeyOutOfProcess,
 ): Promise<PreparedAccount> {
+  ensureStationDeps(input.station);
   if (input.station === 'discord-bot') return prepareDiscord(input.token);
   if (input.station === 'telegram-bot') return prepareTelegram(input.token);
   if (input.station === 'webhook') return prepareWebhook();

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.52"
+  "version": "0.1.0-beta.54"
 }

package/runtime/stations.json

@@ -0,0 +1,35 @@
+{
+  "core": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@noble/curves": "^1.9.7",
+    "pino": "^9.5.0",
+    "pino-pretty": "^13.1.3",
+    "viem": "2.52.2",
+    "zod": "^3.23.8"
+  },
+  "stations": {
+    "xmtp": {
+      "@xmtp/content-type-primitives": "^3.0.1",
+      "@xmtp/content-type-reaction": "^2.0.2",
+      "@xmtp/content-type-remote-attachment": "^2.0.4",
+      "@xmtp/content-type-reply": "^2.0.3",
+      "@xmtp/content-type-wallet-send-calls": "^2.0.0",
+      "@xmtp/node-bindings": "1.9.1",
+      "@xmtp/node-sdk": "^6.0.0",
+      "viem": "^2.52.2"
+    },
+    "telegram-bot": {},
+    "telegram": {
+      "@mtcute/bun": "0.30.1"
+    },
+    "discord-bot": {
+      "@discordjs/voice": "^0.19.2",
+      "discord.js": "^14.26.4",
+      "prism-media": "^1.3.5"
+    },
+    "whatsapp": {
+      "baileys": "7.0.0-rc14"
+    },
+    "webhook": {}
+  }
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-secret.ts

@@ -1,21 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { agentsDir } from '../db/file-source.js';
-import { ensureSecureDir, writeSecure } from './secure-fs.js';
-
-const SECRET_FILE = '.session-secret';
-
-export function ensureLocalSessionSecret(dir = agentsDir()): string {
-  const configured = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  if (configured !== '') return configured;
-  const path = join(dir, SECRET_FILE);
-  let secret = existsSync(path) ? readFileSync(path, 'utf8').trim() : '';
-  if (secret === '') {
-    secret = randomBytes(32).toString('base64url');
-    ensureSecureDir(dir);
-    writeSecure(path, `${secret}\n`);
-  }
-  process.env.METRO_SESSION_SECRET = secret;
-  return secret;
-}