@stage-labs/metro 0.1.0-beta.53 → 0.1.0-beta.55

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -8,14 +8,57 @@ import { readJson } from './secure-fs.js';
 
 const RESTART_DELAY_MS = 2_000;
 
-export const quickTunnelWanted = (): boolean =>
-  process.env.METRO_TUNNEL?.trim() === 'quick';
+export type TunnelKind = 'quick' | 'tailscale';
+
+export function tunnelKind(): TunnelKind | null {
+  const raw = process.env.METRO_TUNNEL?.trim();
+  return raw === 'quick' || raw === 'tailscale' ? raw : null;
+}
+
+export const quickTunnelWanted = (): boolean => tunnelKind() === 'quick';
 
 const QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+const FUNNEL_URL_RE = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.ts\.net(?::\d{2,5})?(?=[\s/]|$)/i;
+const SILENT_MS = 20_000;
 
 export const quickTunnelUrlIn = (text: string): string | null =>
   QUICK_URL_RE.exec(text)?.[0] ?? null;
 
+export const funnelUrlIn = (text: string): string | null =>
+  FUNNEL_URL_RE.exec(text)?.[0]?.toLowerCase() ?? null;
+
+export interface TunnelDriver {
+  name: string;
+  command: string;
+  args: string[];
+  urlIn: (text: string) => string | null;
+  waitsForDns: boolean;
+}
+
+export const quickDriver = (port: number): TunnelDriver => ({
+  name: 'cloudflared quick tunnel',
+  command: 'cloudflared',
+  args: ['--no-autoupdate', 'tunnel', '--url', `http://127.0.0.1:${String(port)}`],
+  urlIn: quickTunnelUrlIn,
+  waitsForDns: true,
+});
+
+function tailscaleBin(): string {
+  const configured = process.env.METRO_TAILSCALE_BIN?.trim() ?? '';
+  return configured === '' ? 'tailscale' : configured;
+}
+
+export const funnelDriver = (port: number, bin = tailscaleBin()): TunnelDriver => ({
+  name: 'tailscale funnel',
+  command: bin,
+  args: ['funnel', String(port)],
+  urlIn: funnelUrlIn,
+  waitsForDns: false,
+});
+
+export const driverFor = (kind: TunnelKind, port: number): TunnelDriver =>
+  kind === 'quick' ? quickDriver(port) : funnelDriver(port);
+
 let liveUrl: string | null = null;
 
 export const currentTunnelUrl = (): string | null => liveUrl;
@@ -104,53 +147,72 @@ export function tokenMatches(secret: string, given: string): boolean {
 export class Tunnel {
   private child: ChildProcess | null = null;
   private closed = false;
+  private output: string[] = [];
 
   constructor(
-    private port: number,
+    private driver: TunnelDriver,
     private onUrl: (url: string) => void = () => undefined,
     private resolves: Resolves = resolvesAtCloudflare,
   ) {}
 
-  private origin(): string {
-    return `http://127.0.0.1:${String(this.port)}`;
-  }
-
   private noticeUrl(text: string): void {
-    const url = quickTunnelUrlIn(text);
+    const url = this.driver.urlIn(text);
     if (url === null || url === liveUrl) return;
     liveUrl = url;
-    log.info({ url }, 'quick tunnel up; waiting for its name to resolve');
+    if (!this.driver.waitsForDns) {
+      log.info({ url }, `${this.driver.name} up`);
+      this.onUrl(url);
+      return;
+    }
+    log.info({ url }, `${this.driver.name} up; waiting for its name to resolve`);
     this.announceWhenResolvable(url).catch((err: unknown) => {
-      log.warn({ err: errMsg(err) }, 'quick tunnel: announce failed');
+      log.warn({ err: errMsg(err) }, `${this.driver.name}: announce failed`);
     });
   }
 
   private async announceWhenResolvable(url: string): Promise<void> {
     const resolved = await untilResolvable(new URL(url).host, this.resolves);
     if (liveUrl !== url) return;
-    if (!resolved) log.warn({ url }, 'quick tunnel name still not resolving; announcing anyway');
+    if (!resolved) log.warn({ url }, `${this.driver.name} name still not resolving; announcing anyway`);
     this.onUrl(url);
   }
 
+  private read(d: Buffer | string): void {
+    const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();
+    if (text === '') return;
+    this.output.push(text);
+    log.debug({ output: text }, this.driver.name);
+    this.noticeUrl(text);
+  }
+
+  private silentCheck(): void {
+    if (this.closed || liveUrl !== null || this.child === null) return;
+    log.warn(
+      { output: this.output.join('\n') },
+      `${this.driver.name}: no public address after ${String(SILENT_MS / 1000)}s; its own output follows`,
+    );
+  }
+
   start(): void {
     if (this.closed) return;
-    log.info({ port: this.port }, 'cloudflared quick tunnel starting');
-    const child = spawn(
-      'cloudflared',
-      ['--no-autoupdate', 'tunnel', '--url', this.origin()],
-      { stdio: ['ignore', 'pipe', 'pipe'] },
-    );
+    log.info({ command: this.driver.command, args: this.driver.args }, `${this.driver.name} starting`);
+    this.output = [];
+    const child = spawn(this.driver.command, this.driver.args, { stdio: ['ignore', 'pipe', 'pipe'] });
     this.child = child;
+    child.stdout?.on('data', (d: Buffer | string) => {
+      this.read(d);
+    });
     child.stderr?.on('data', (d: Buffer | string) => {
-      const text = (typeof d === 'string' ? d : d.toString('utf8')).trim();
-      log.debug({ cloudflared: text }, 'cloudflared');
-      this.noticeUrl(text);
+      this.read(d);
     });
+    setTimeout(() => {
+      this.silentCheck();
+    }, SILENT_MS).unref();
     child.on('exit', (code) => {
       this.child = null;
       liveUrl = null;
       if (this.closed) return;
-      log.warn({ code }, 'cloudflared exited; restarting');
+      log.warn({ code, output: this.output.slice(-5).join('\n') }, `${this.driver.name} exited; restarting`);
       setTimeout(() => {
         this.start();
       }, RESTART_DELAY_MS);
@@ -159,17 +221,18 @@ export class Tunnel {
       if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
         this.closed = true;
         log.error(
-          'cloudflared is not installed, so there is no public address; install it and restart',
+          { command: this.driver.command },
+          `${this.driver.name}: the binary is not installed, so there is no public address; install it and restart`,
         );
         return;
       }
-      log.warn({ err: errMsg(err) }, 'cloudflared spawn error');
+      log.warn({ err: errMsg(err) }, `${this.driver.name} spawn error`);
     });
   }
 
   stop(): void {
     this.closed = true;
-    this.child?.kill();
+    this.child?.kill('SIGINT');
     this.child = null;
   }
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/update-api.ts

@@ -93,13 +93,10 @@ export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, d
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
   Promise.resolve()
     .then(async (): Promise<unknown> => {
+      const session = await apiSession(req);
+      if (!session) throw new ApiError('unauthorized', 401);
       deps.authorize(session.subject);
       const bin = binOrThrow(deps);
       if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };

package/runtime/node_modules/@metro-labs/mcp/src/daemon/upload-api.ts

@@ -4,7 +4,6 @@ import { guessMime } from '../stations/attachments.js';
 import { safeFileName } from '../stations/attach-inline.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
   extractToken,
 } from '../mcp/request-identity.js';
@@ -69,7 +68,7 @@ const query = (req: IncomingMessage, key: string): string | undefined =>
   new URL(req.url ?? '/', 'http://localhost').searchParams.get(key) ?? undefined;
 
 const identityScope = (req: IncomingMessage): Set<string> =>
-  allowedAgents(authenticate(req, authConfigFromEnv()) ?? undefined);
+  allowedAgents(authenticate(req) ?? undefined);
 
 function ownerFromScope(req: IncomingMessage, allowed: Set<string>): string {
   const requested = query(req, 'agent');

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-api.ts

@@ -1,42 +1,12 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from './log.js';
-import { verifyMessage } from 'viem';
 import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { normalizeAddress } from '../db/address.js';
 import { parseId } from '../db/ids.js';
 import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from './vault-types.js';
+import { signedIdentity } from './signed-identity.js';
 
 const PREFIX = '/api/vault';
 const BODY_MAX = ENVELOPE_MAX + 64 * 1024;
-const SKEW_MS = 5 * 60_000;
-const SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
-
-export const vaultChallenge = (method: string, path: string, at: number): string =>
-  `metro-vault\n${method} ${path}\n${String(at)}`;
-
-interface VaultProof {
-  address: string;
-  at: number;
-  signature: `0x${string}`;
-}
-
-function parseVaultHeader(header: string): VaultProof | null {
-  const [scheme, rawAddress, rawAt, signature] = header.trim().split(/\s+/);
-  if (scheme !== 'Vault' || rawAddress === undefined || rawAt === undefined || signature === undefined) return null;
-  const address = normalizeAddress(rawAddress);
-  const at = Number(rawAt);
-  if (address === null || !Number.isFinite(at) || !SIGNATURE_RE.test(signature)) return null;
-  return { address, at, signature: signature as `0x${string}` };
-}
-
-export async function vaultIdentity(req: IncomingMessage, now = Date.now()): Promise<string | null> {
-  const proof = parseVaultHeader(req.headers.authorization ?? '');
-  if (proof === null || Math.abs(now - proof.at) > SKEW_MS) return null;
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const message = vaultChallenge(req.method ?? '', path, proof.at);
-  const ok = await verifyMessage({ address: proof.address as `0x${string}`, message, signature: proof.signature }).catch(() => false);
-  return ok ? proof.address : null;
-}
 
 export interface VaultApiDeps {
   list: (subject: string) => Promise<VaultEntry[]>;
@@ -64,7 +34,7 @@ async function route(
   tgt: { kind: 'index' } | { kind: 'bundle'; id: string },
 ): Promise<void> {
   try {
-    const owner = await vaultIdentity(req);
+    const owner = await signedIdentity(req);
     if (owner === null) {
       sendJson(req, res, 401, { error: 'unauthorized' });
       return;

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -54,16 +54,6 @@ export function setLocalOwner(raw: string, dir = agentsDir()): string {
   return address;
 }
 
-export function ownerSignIn(raw: string, dir = agentsDir()): Promise<string> {
-  const owner = localOwner(dir);
-  if (owner === null)
-    return Promise.reject(
-      new ApiError('this machine has no owner yet: start it with metro serve --owner <address>', 403),
-    );
-  if (owner !== normalizeAddress(raw))
-    return Promise.reject(new ApiError('this machine belongs to another wallet', 403));
-  return Promise.resolve(owner);
-}
 
 function isOwner(subject: string, dir: string): boolean {
   const owner = localOwner(dir);

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -4,12 +4,6 @@ import { STATIONS, type ConnectorTransport, type StationName } from './stations.
 
 export { STATIONS, type ConnectorTransport, type StationName };
 
-export const users = pgTable('users', {
-  id: text('id').primaryKey(),
-  email: text('email').unique(),
-  address: text('address').unique(),
-});
-
 export type ProjectRole = 'admin' | 'member';
 
 

package/runtime/node_modules/@metro-labs/mcp/src/mcp/index.ts

@@ -5,7 +5,6 @@ import {
 } from '../daemon/http.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
   runWithIdentity,
   type RequestIdentity,
@@ -156,7 +155,7 @@ export async function createMetroMcp(): Promise<{
     req: IncomingMessage,
     res: ServerResponse,
   ): Promise<void> => {
-    const identity = authenticate(req, authConfigFromEnv());
+    const identity = authenticate(req);
     if (!identity) {
       res.writeHead(401).end('unauthorized');
       return;

package/runtime/node_modules/@metro-labs/mcp/src/mcp/request-identity.ts

@@ -1,6 +1,5 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import type { IncomingMessage } from 'node:http';
-import { verifySession } from '../daemon/session.js';
 import { agentIdForKey } from '../db/key-map.js';
 
 export type RequestIdentity =
@@ -20,14 +19,6 @@ export function currentIdentity(): RequestIdentity | undefined {
   return storage.getStore();
 }
 
-export interface AuthConfig {
-  sessionSecret: string;
-}
-
-export function authConfigFromEnv(): AuthConfig {
-  return { sessionSecret: process.env.METRO_SESSION_SECRET?.trim() ?? '' };
-}
-
 export function extractToken(req: IncomingMessage): string | undefined {
   const header = req.headers.authorization;
   if (header?.startsWith('Bearer ')) {
@@ -40,28 +31,11 @@ export function extractToken(req: IncomingMessage): string | undefined {
   return qt ?? undefined;
 }
 
-const looksLikeJwt = (token: string): boolean =>
-  /^[\w-]+\.[\w-]+\.[\w-]+$/.test(token);
-
-export function authenticate(
-  req: IncomingMessage,
-  cfg: AuthConfig,
-): RequestIdentity | null {
+export function authenticate(req: IncomingMessage): RequestIdentity | null {
   const token = extractToken(req);
   if (!token) return null;
-
   const agentId = agentIdForKey(token);
-  if (agentId !== undefined) return { kind: 'agent', agentId };
-
-  if (cfg.sessionSecret !== '' && looksLikeJwt(token)) {
-    try {
-      const { subject, agentIds } = verifySession(token, cfg.sessionSecret);
-      return { kind: 'session', subject, agentIds };
-    } catch {
-      return null;
-    }
-  }
-  return null;
+  return agentId === undefined ? null : { kind: 'agent', agentId };
 }
 
 export function allowedAgents(

package/runtime/node_modules/@metro-labs/mcp/src/monitor/api.ts

@@ -6,7 +6,6 @@ import { callTargetDenied, eventInScope } from '../db/agent-scope.js';
 import { hasAnyKey } from '../db/key-map.js';
 import {
   allowedAgents,
-  authConfigFromEnv,
   authenticate,
 } from '../mcp/request-identity.js';
 import { METRO_VERSION } from '../daemon/version.js';
@@ -20,9 +19,7 @@ export type MonitorCall = (
 const KEEPALIVE_MS = 25_000;
 const CALL_BODY_MAX = 256 * 1024;
 
-function monitorEnabled(): boolean {
-  return hasAnyKey() || authConfigFromEnv().sessionSecret !== '';
-}
+const monitorEnabled = (): boolean => hasAnyKey();
 
 function cors(req: IncomingMessage): Record<string, string> {
   return {
@@ -230,7 +227,7 @@ export function handleMonitorRequest(
   const path = (req.url ?? '').split('?', 2)[0] ?? '';
   if (!path.startsWith('/api/')) return false;
   if (preflight(req, res, path)) return true;
-  const identity = authenticate(req, authConfigFromEnv());
+  const identity = authenticate(req);
   if (!identity) {
     sendJson(res, req, 401, { error: 'unauthorized' });
     return true;

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.53"
+  "version": "0.1.0-beta.55"
 }

package/runtime/stations.json

@@ -1,6 +1,7 @@
 {
   "core": {
     "@modelcontextprotocol/sdk": "^1.12.0",
+    "@noble/curves": "^1.9.7",
     "pino": "^9.5.0",
     "pino-pretty": "^13.1.3",
     "viem": "2.52.2",

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-secret.ts

@@ -1,21 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { agentsDir } from '../db/file-source.js';
-import { ensureSecureDir, writeSecure } from './secure-fs.js';
-
-const SECRET_FILE = '.session-secret';
-
-export function ensureLocalSessionSecret(dir = agentsDir()): string {
-  const configured = process.env.METRO_SESSION_SECRET?.trim() ?? '';
-  if (configured !== '') return configured;
-  const path = join(dir, SECRET_FILE);
-  let secret = existsSync(path) ? readFileSync(path, 'utf8').trim() : '';
-  if (secret === '') {
-    secret = randomBytes(32).toString('base64url');
-    ensureSecureDir(dir);
-    writeSecure(path, `${secret}\n`);
-  }
-  process.env.METRO_SESSION_SECRET = secret;
-  return secret;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session.ts

@@ -1,96 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
-import { ID_RE } from '../db/ids.js';
-
-export class SessionError extends Error {}
-
-const b64url = (buf: Buffer): string =>
-  buf
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/, '');
-
-const b64urlJson = (v: unknown): string =>
-  b64url(Buffer.from(JSON.stringify(v)));
-
-const decodeJson = (seg: string): unknown =>
-  JSON.parse(
-    Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString(
-      'utf8',
-    ),
-  );
-
-const HEADER = b64urlJson({ alg: 'HS256', typ: 'JWT' });
-
-function sign(payload: Record<string, unknown>, secret: string): string {
-  if (secret === '') throw new SessionError('missing signing secret');
-  const body = b64urlJson(payload);
-  const data = `${HEADER}.${body}`;
-  const sig = b64url(createHmac('sha256', secret).update(data).digest());
-  return `${data}.${sig}`;
-}
-
-function verify(token: string, secret: string): Record<string, unknown> {
-  if (secret === '') throw new SessionError('missing signing secret');
-  const parts = token.split('.');
-  if (parts.length !== 3) throw new SessionError('malformed token');
-  const data = `${parts[0]}.${parts[1]}`;
-  const expected = b64url(createHmac('sha256', secret).update(data).digest());
-  const a = Buffer.from(parts[2] ?? '');
-  const b = Buffer.from(expected);
-  if (a.length !== b.length || !timingSafeEqual(a, b))
-    throw new SessionError('bad signature');
-  let payload: unknown;
-  try {
-    payload = decodeJson(parts[1] ?? '');
-  } catch {
-    throw new SessionError('malformed payload');
-  }
-  if (typeof payload !== 'object' || payload === null)
-    throw new SessionError('malformed payload');
-  return payload as Record<string, unknown>;
-}
-
-const nowSec = (now?: number): number => Math.floor((now ?? Date.now()) / 1000);
-
-interface SessionClaims {
-  subject: string;
-  agentIds: string[];
-}
-
-export function signSession(
-  claims: SessionClaims,
-  secret: string,
-  opts: { ttlSec?: number; now?: number } = {},
-): string {
-  const iat = nowSec(opts.now);
-  return sign(
-    {
-      typ: 'session',
-      sub: claims.subject,
-      agent_ids: claims.agentIds,
-      iat,
-      exp: iat + (opts.ttlSec ?? 30 * 24 * 3600),
-    },
-    secret,
-  );
-}
-
-export function verifySession(
-  token: string,
-  secret: string,
-  now?: number,
-): SessionClaims {
-  const p = verify(token, secret);
-  if (p.typ !== 'session') throw new SessionError('wrong token type');
-  if (typeof p.exp !== 'number' || p.exp < nowSec(now))
-    throw new SessionError('session expired');
-  const ids = p.agent_ids;
-  if (
-    typeof p.sub !== 'string' ||
-    !Array.isArray(ids) ||
-    ids.some((a) => typeof a !== 'string' || !ID_RE.test(a))
-  )
-    throw new SessionError('malformed session');
-  return { subject: p.sub, agentIds: ids as string[] };
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-auth.ts

@@ -1,73 +0,0 @@
-import { verifyMessage, type Hex } from 'viem';
-import { parseSiweMessage, validateSiweMessage } from 'viem/siwe';
-import { ApiError } from './api-error.js';
-import { allowedWebHost } from './session-config.js';
-
-export class SiweError extends ApiError {}
-
-export interface SiweLogin {
-  message: string;
-  signature: string;
-}
-
-export interface SiweDeps {
-  takeNonce: (nonce: string) => boolean;
-}
-
-const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
-
-export function allowedSiweDomain(domain: string): boolean {
-  return allowedWebHost(domain.replace(/:\d+$/, ''));
-}
-
-function hostOf(uri: string): string | null {
-  try {
-    return new URL(uri).host;
-  } catch {
-    return null;
-  }
-}
-
-function fieldsOrThrow(message: string): {
-  address: `0x${string}`;
-  domain: string;
-  nonce: string;
-  parsed: ReturnType<typeof parseSiweMessage>;
-} {
-  const parsed = parseSiweMessage(message);
-  const { address, domain, nonce, uri, version } = parsed;
-  if (
-    address === undefined ||
-    domain === undefined ||
-    nonce === undefined ||
-    uri === undefined ||
-    version !== '1'
-  )
-    throw new SiweError('that is not a sign-in message', 400);
-  if (!allowedSiweDomain(domain))
-    throw new SiweError(`sign-in messages for ${domain} are not accepted here`, 400);
-  if (hostOf(uri) !== domain)
-    throw new SiweError('the sign-in message names a different site', 400);
-  return { address, domain, nonce, parsed };
-}
-
-export async function verifySiweLogin(
-  input: SiweLogin,
-  deps: SiweDeps,
-): Promise<string> {
-  if (!HEX_SIGNATURE.test(input.signature))
-    throw new SiweError('that is not an Ethereum signature', 400);
-  const { address, domain, nonce, parsed } = fieldsOrThrow(input.message);
-  const time = new Date();
-  if (!validateSiweMessage({ message: parsed, domain, nonce, time }))
-    throw new SiweError('this sign-in message is expired or does not match', 400);
-  if (!deps.takeNonce(nonce))
-    throw new SiweError('that sign-in has expired or was already used', 400);
-  const signature = input.signature as Hex;
-  if (!(await verifyMessage({ address, message: input.message, signature })))
-    throw new SiweError(
-      'the signature does not match the address; smart-contract wallets are not supported yet',
-      401,
-    );
-  return address.toLowerCase();
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-nonces.ts

@@ -1,43 +0,0 @@
-import { generateSiweNonce } from 'viem/siwe';
-
-const TTL_MS = 10 * 60_000;
-const SWEEP_MS = 60_000;
-const MAX_LIVE = 500;
-
-const live = new Map<string, number>();
-let sweeper: ReturnType<typeof setInterval> | null = null;
-
-function sweep(now = Date.now()): void {
-  for (const [nonce, expiresAt] of live) if (expiresAt <= now) live.delete(nonce);
-}
-
-function ensureSweeper(): void {
-  if (sweeper !== null) return;
-  sweeper = setInterval(sweep, SWEEP_MS);
-  sweeper.unref?.();
-}
-
-export function mintNonce(now = Date.now()): string {
-  sweep(now);
-  while (live.size >= MAX_LIVE) {
-    const oldest = live.keys().next();
-    if (oldest.done) break;
-    live.delete(oldest.value);
-  }
-  const nonce = generateSiweNonce();
-  live.set(nonce, now + TTL_MS);
-  ensureSweeper();
-  return nonce;
-}
-
-export function takeNonce(nonce: string, now = Date.now()): boolean {
-  const expiresAt = live.get(nonce);
-  if (expiresAt === undefined) return false;
-  live.delete(nonce);
-  return expiresAt > now;
-}
-
-export function nonceCount(): number {
-  sweep();
-  return live.size;
-}