@stage-labs/metro 0.1.0-beta.57 → 0.1.0-beta.59

package/dist/cli.js

@@ -14,9 +14,9 @@ const USAGE = `metro — run your agent on this machine
                   run the daemon: the agent, its channels and its connectors live in
                   ~/.metro/agents here, and the page at metro.box manages it through the
                   link it prints; --owner names the one wallet that may sign in (remembered
-                  after the first start); --tunnel adds a public https address through a
-                  Cloudflare quick tunnel (needs cloudflared, no account) so the link works
-                  from anywhere
+                  after the first start); --tunnel publishes the daemon through Tailscale
+                  Funnel at a permanent https://<machine>.<tailnet>.ts.net (Tailscale
+                  installed and signed in on this machine), so the link works from anywhere
   metro stop      stop the metro daemon on this machine
   metro tail <agent-id>
                   follow this machine's inbound events, one JSON line each

package/dist/serve.js

@@ -10,7 +10,7 @@ const SCRUBBED = new Set(['METRO_RUN_TOKEN', 'METRO_AGENT', 'DATABASE_URL']);
 const PORT_FLAG = /^--port=(.*)$/;
 const OWNER_FLAG = /^--owner=(.*)$/;
 const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
-const USAGE = 'usage: metro serve [--port <n>] [--tunnel [quick|tailscale]] [--owner <address>]';
+const USAGE = 'usage: metro serve [--port <n>] [--tunnel] [--owner <address>]';
 const TUNNEL_FLAG = /^--tunnel=(.*)$/;
 const TAILSCALE_APP = '/Applications/Tailscale.app/Contents/MacOS/Tailscale';
 function portOf(raw) {
@@ -20,22 +20,21 @@ function portOf(raw) {
     return n;
 }
 function tunnelOf(raw) {
-    if (raw === undefined || raw === '' || raw === 'quick')
-        return 'quick';
-    if (raw === 'tailscale')
-        return 'tailscale';
-    throw new Error(`'${raw}' is not a tunnel kind (quick or tailscale) — ${USAGE}`);
+    if (raw === undefined || raw === '' || raw === 'tailscale')
+        return true;
+    throw new Error(`'${raw}' is not a tunnel metro knows; the public address is Tailscale Funnel — ${USAGE}`);
 }
 function tunnelFlag(argv, i) {
     const arg = argv[i] ?? '';
     const inline = TUNNEL_FLAG.exec(arg);
     if (inline)
-        return { kind: tunnelOf(inline[1]), consumed: 0 };
+        return { consumed: Number(tunnelOf(inline[1])) - 1 };
     if (arg !== '--tunnel')
         return null;
     const next = argv[i + 1];
     const takesValue = next !== undefined && !next.startsWith('-');
-    return { kind: tunnelOf(takesValue ? next : undefined), consumed: takesValue ? 1 : 0 };
+    tunnelOf(takesValue ? next : undefined);
+    return { consumed: takesValue ? 1 : 0 };
 }
 function ownerOf(raw) {
     if (raw === undefined || !ADDRESS.test(raw))
@@ -44,13 +43,13 @@ function ownerOf(raw) {
 }
 export function parseServeArgs(argv) {
     let port = localPort();
-    let tunnel = null;
+    let tunnel = false;
     let owner = null;
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i] ?? '';
         const tunnelArg = tunnelFlag(argv, i);
         if (tunnelArg) {
-            tunnel = tunnelArg.kind;
+            tunnel = true;
             i += tunnelArg.consumed;
             continue;
         }
@@ -111,18 +110,6 @@ export function findTailscale(candidates = ['tailscale', TAILSCALE_APP]) {
             'Funnel also has to be enabled once on your tailnet: https://tailscale.com/kb/1223/funnel');
     return bin;
 }
-function findCloudflared() {
-    const found = spawnSync('cloudflared', ['--version'], { stdio: 'ignore' });
-    if (found.error !== undefined || found.status !== 0)
-        throw new Error('metro serve --tunnel needs cloudflared, which is not on PATH.\n' +
-            'Debian/Ubuntu (it is not in the distro repos; this adds Cloudflare\'s signed one):\n' +
-            '  sudo mkdir -p --mode=0755 /usr/share/keyrings\n' +
-            '  curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null\n' +
-            "  echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list\n" +
-            '  sudo apt-get update && sudo apt-get install cloudflared\n' +
-            'macOS:  brew install cloudflared\n' +
-            'Others: https://pkg.cloudflare.com/');
-}
 export function servePlan(opts) {
     const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !SCRUBBED.has(key)));
     return {
@@ -141,7 +128,7 @@ export function servePlan(opts) {
                 ? {}
                 : { METRO_RUNTIME_STORE: opts.runtime.dir, METRO_RUNTIME_MANIFEST: opts.runtime.manifest }),
             METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
-            ...(opts.tunnel === null ? {} : { METRO_TUNNEL: opts.tunnel }),
+            ...(opts.tunnel ? { METRO_TUNNEL: 'tailscale' } : {}),
             ...(opts.tailscaleBin === undefined ? {} : { METRO_TAILSCALE_BIN: opts.tailscaleBin }),
             ...(opts.owner === null ? {} : { METRO_OWNER: opts.owner }),
         },
@@ -154,9 +141,7 @@ export function serve(argv) {
         throw new Error(`a metro serve daemon is already running on this machine (pid ${String(running)}). ` +
             'Stop it first: metro stop');
     requireOwner(owner);
-    if (tunnel === 'quick')
-        findCloudflared();
-    const tailscaleBin = tunnel === 'tailscale' ? findTailscale() : undefined;
+    const tailscaleBin = tunnel ? findTailscale() : undefined;
     process.stderr.write(`Starting a metro daemon of your own on http://127.0.0.1:${String(port)}\n`);
     return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, tunnel, owner, ...(tailscaleBin === undefined ? {} : { tailscaleBin }) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.57",
+  "version": "0.1.0-beta.59",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -6,7 +6,7 @@ import { errMsg, log, logFatalSync } from './log.js';
 import { acquireLock, isLocalMode, STATE_DIR, trainsDir } from './paths.js';
 import { installCrashGuard, markDaemonReady } from './crash-guard.js';
 import { METRO_VERSION } from './version.js';
-import { driverFor, Tunnel, tunnelKind, webhookPort } from './tunnel.js';
+import { funnelDriver, Tunnel, tunnelWanted, webhookPort } from './tunnel.js';
 import {
   localConnectHint,
   publicConnectHint,
@@ -61,8 +61,7 @@ supervisor.onTrainEvent((env, train) => {
 });
 
 let webhookServer: Server | null = null;
-const tunnelWanted = tunnelKind();
-const tunnel = tunnelWanted === null ? null : new Tunnel(driverFor(tunnelWanted, webhookPort()), announcePublic);
+const tunnel = tunnelWanted() ? new Tunnel(funnelDriver(webhookPort()), announcePublic) : null;
 
 function announcePublic(url: string): void {
   process.stderr.write(`\n${publicConnectHint(url, localOwner())}`);
@@ -74,7 +73,7 @@ setTrainCallBackend((train, action, args) =>
 
 function announceLocalEndpoint(): void {
   process.stderr.write(
-    `\n${tunnelWanted === null ? localConnectHint(webhookPort(), localOwner()) : tunnelPendingHint(tunnelWanted)}`,
+    `\n${tunnel === null ? localConnectHint(webhookPort(), localOwner()) : tunnelPendingHint()}`,
   );
   const key = localAgentKey();
   if (key === null) {
@@ -119,6 +118,7 @@ async function sessionApis(): Promise<SessionApis> {
       prepareAccount,
     });
   const vault = await import('../db/vault.js');
+  const servers = await import('../db/servers.js');
   return {
     vaultApi: {
       list: vault.listVaultForOwner,
@@ -126,6 +126,12 @@ async function sessionApis(): Promise<SessionApis> {
       get: vault.getVaultForOwner,
       remove: vault.deleteVaultForOwner,
     },
+    serversApi: {
+      list: servers.listServersForOwner,
+      add: servers.addServerForOwner,
+      rename: servers.renameServerForOwner,
+      remove: servers.deleteServerForOwner,
+    },
     mode: hostedMode,
   };
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/connect-hint.ts

@@ -35,7 +35,5 @@ export function publicConnectHint(url: string, owner: string | null): string {
   ].join('\n');
 }
 
-export const tunnelPendingHint = (kind: 'quick' | 'tailscale'): string =>
-  kind === 'quick'
-    ? 'Bringing up a public address through a Cloudflare quick tunnel…\n'
-    : 'Publishing this daemon through Tailscale Funnel… (if Tailscale asks to enable Funnel, its link is in the log)\n';
+export const tunnelPendingHint = (): string =>
+  'Publishing this daemon through Tailscale Funnel… (if Tailscale asks to enable Funnel, its link is in the log)\n';

package/runtime/node_modules/@metro-labs/mcp/src/daemon/server-types.ts

@@ -0,0 +1,21 @@
+export interface ServerEntry {
+  id: string;
+  host: string;
+  name: string | null;
+  addedAt: string;
+}
+
+const HOST_RE = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/;
+const HOST_MAX = 253;
+const NAME_MAX = 40;
+
+export function parseServerHost(raw: string): string | null {
+  const host = raw.trim().toLowerCase();
+  return host.length <= HOST_MAX && HOST_RE.test(host) ? host : null;
+}
+
+export function parseServerName(raw: unknown): string | null {
+  if (typeof raw !== 'string') return null;
+  const name = raw.replace(/[\p{Cc}]/gu, '').trim().slice(0, NAME_MAX);
+  return name === '' ? null : name;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/servers-api.ts

@@ -0,0 +1,80 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from './log.js';
+import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
+import { signedIdentity } from './signed-identity.js';
+import type { ServerEntry } from './server-types.js';
+import { parseId } from '../db/ids.js';
+
+const PREFIX = '/api/servers';
+
+export interface ServersApiDeps {
+  list: (subject: string) => Promise<ServerEntry[]>;
+  add: (subject: string, body: unknown) => Promise<ServerEntry>;
+  rename: (subject: string, id: string, body: unknown) => Promise<ServerEntry>;
+  remove: (subject: string, id: string) => Promise<{ id: string; host: string }>;
+}
+
+type Target = { kind: 'index' } | { kind: 'server'; id: string } | { kind: 'unknown' } | null;
+
+function target(path: string): Target {
+  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
+  if (!path.startsWith(`${PREFIX}/`)) return null;
+  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const id = parseId(segments[0] ?? '');
+  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'server', id };
+}
+
+const ALLOWED: Record<'index' | 'server', string[]> = { index: ['GET', 'POST'], server: ['PUT', 'DELETE'] };
+
+async function answer(
+  req: IncomingMessage,
+  deps: ServersApiDeps,
+  owner: string,
+  tgt: { kind: 'index' } | { kind: 'server'; id: string },
+): Promise<unknown> {
+  if (tgt.kind === 'index')
+    return req.method === 'GET' ? { servers: await deps.list(owner) } : deps.add(owner, await readJsonBody(req));
+  return req.method === 'DELETE' ? deps.remove(owner, tgt.id) : deps.rename(owner, tgt.id, await readJsonBody(req));
+}
+
+async function route(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ServersApiDeps,
+  tgt: { kind: 'index' } | { kind: 'server'; id: string },
+): Promise<void> {
+  try {
+    const owner = await signedIdentity(req);
+    if (owner === null) {
+      sendJson(req, res, 401, { error: 'unauthorized' });
+      return;
+    }
+    const body = await answer(req, deps, owner, tgt);
+    if (req.method !== 'GET') log.info({ method: req.method, target: tgt }, 'servers-api: list changed');
+    sendJson(req, res, 200, body);
+  } catch (err) {
+    apiFailure(req, res, err, 'servers-api');
+  }
+}
+
+export function handleServersApiRequest(req: IncomingMessage, res: ServerResponse, deps: ServersApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const tgt = target(path);
+  if (tgt === null) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (tgt.kind === 'unknown') {
+    sendJson(req, res, 404, { error: 'no such server' });
+    return true;
+  }
+  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  route(req, res, deps, tgt).catch((err: unknown) => {
+    apiFailure(req, res, err, 'servers-api');
+  });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -15,6 +15,7 @@ import { handleLocalCliRequest, type LocalCliDeps } from './local-cli-api.js';
 import { handleClaudeRequest, type ClaudeApiDeps } from './claude-api.js';
 import type { ModeInfo } from './mode-api.js';
 import { handleVaultApiRequest, type VaultApiDeps } from './vault-api.js';
+import { handleServersApiRequest, type ServersApiDeps } from './servers-api.js';
 import { handleBundleRequest, type BundleApiDeps } from './bundle-api.js';
 import { handleUpdateRequest, type UpdateApiDeps } from './update-api.js';
 
@@ -23,6 +24,7 @@ export interface SessionApis {
   agentConnectorApi?: AgentConnectorApiDeps;
   bundleApi?: BundleApiDeps;
   vaultApi?: VaultApiDeps;
+  serversApi?: ServersApiDeps;
   updateApi?: UpdateApiDeps;
   localCli?: LocalCliDeps;
   claudeApi?: ClaudeApiDeps;
@@ -46,6 +48,7 @@ export function handleSessionApis(
     ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.vaultApi, (d) => handleVaultApiRequest(req, res, d)),
+    ...when(apis.serversApi, (d) => handleServersApiRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.claudeApi, (d) => handleClaudeRequest(req, res, d)),
     ...when(apis.agentConnectorApi, (d) => handleAgentConnectorRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/mcp/src/daemon/tunnel.ts

@@ -11,22 +11,11 @@ const RESTART_DELAY_MAX_MS = 30_000;
 const TAKEN_RE = /listener already exists/i;
 const FUNNEL_ON_RE = /\(Funnel on\)/i;
 
-export type TunnelKind = 'quick' | 'tailscale';
+export const tunnelWanted = (): boolean => process.env.METRO_TUNNEL?.trim() === 'tailscale';
 
-export function tunnelKind(): TunnelKind | null {
-  const raw = process.env.METRO_TUNNEL?.trim();
-  return raw === 'quick' || raw === 'tailscale' ? raw : null;
-}
-
-export const quickTunnelWanted = (): boolean => tunnelKind() === 'quick';
-
-const QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
 const FUNNEL_URL_RE = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+\.ts\.net(?::\d{2,5})?(?=[\s/]|$)/i;
 const SILENT_MS = 20_000;
 
-export const quickTunnelUrlIn = (text: string): string | null =>
-  QUICK_URL_RE.exec(text)?.[0] ?? null;
-
 export const funnelUrlIn = (text: string): string | null =>
   FUNNEL_URL_RE.exec(text)?.[0]?.toLowerCase() ?? null;
 
@@ -51,6 +40,47 @@ const runText = (command: string, args: string[]): Promise<string> =>
     });
   });
 
+export type Probe = (url: string) => Promise<boolean>;
+
+const PROBE_MS = 5_000;
+
+export async function daemonAnswersAt(url: string): Promise<boolean> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, PROBE_MS);
+  try {
+    const res = await fetch(`${url}/api/mode`, { signal: controller.signal });
+    if (!res.ok) return false;
+    const body: unknown = await res.json();
+    return typeof body === 'object' && body !== null && (body as { mode?: unknown }).mode === 'local';
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export function nodeNameIn(statusJson: string): string | null {
+  try {
+    const parsed: unknown = JSON.parse(statusJson);
+    const self = typeof parsed === 'object' && parsed !== null ? (parsed as { Self?: { DNSName?: unknown } }).Self : undefined;
+    const name = typeof self?.DNSName === 'string' ? self.DNSName.replace(/\.$/, '').toLowerCase() : '';
+    return name === '' ? null : name;
+  } catch {
+    return null;
+  }
+}
+
+async function adoptFunnel(bin: string, port: number, probe: Probe): Promise<Adopted> {
+  const name = nodeNameIn(await runText(bin, ['status', '--json']));
+  if (name !== null) {
+    const url = `https://${name}`;
+    if (await probe(url)) return { url, hint: `a Funnel already publishes this daemon at ${url}; using it` };
+  }
+  return funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port);
+}
+
 export function funnelAlreadyServing(status: string, port: number): Adopted {
   const lines = status.split('\n');
   const target = `http://127.0.0.1:${String(port)}`;
@@ -69,31 +99,20 @@ export function funnelAlreadyServing(status: string, port: number): Adopted {
   return { url: null, hint: 'port 443 is held by another serve config on this node; run: tailscale serve reset' };
 }
 
-export const quickDriver = (port: number): TunnelDriver => ({
-  name: 'cloudflared quick tunnel',
-  command: 'cloudflared',
-  args: ['--no-autoupdate', 'tunnel', '--url', `http://127.0.0.1:${String(port)}`],
-  urlIn: quickTunnelUrlIn,
-  waitsForDns: true,
-});
-
 function tailscaleBin(): string {
   const configured = process.env.METRO_TAILSCALE_BIN?.trim() ?? '';
   return configured === '' ? 'tailscale' : configured;
 }
 
-export const funnelDriver = (port: number, bin = tailscaleBin()): TunnelDriver => ({
+export const funnelDriver = (port: number, bin = tailscaleBin(), probe: Probe = daemonAnswersAt): TunnelDriver => ({
   name: 'tailscale funnel',
   command: bin,
   args: ['funnel', String(port)],
   urlIn: funnelUrlIn,
   waitsForDns: true,
-  adopt: async () => funnelAlreadyServing(await runText(bin, ['funnel', 'status']), port),
+  adopt: () => adoptFunnel(bin, port, probe),
 });
 
-export const driverFor = (kind: TunnelKind, port: number): TunnelDriver =>
-  kind === 'quick' ? quickDriver(port) : funnelDriver(port);
-
 let liveUrl: string | null = null;
 
 export const currentTunnelUrl = (): string | null => liveUrl;
@@ -114,7 +133,7 @@ async function resolvesAt(server: string, host: string): Promise<boolean> {
   return answers.some((a) => a.length > 0);
 }
 
-export async function resolvesAtCloudflare(host: string): Promise<boolean> {
+export async function resolvesPublicly(host: string): Promise<boolean> {
   const found = await Promise.all(PUBLIC_RESOLVERS.map((server) => resolvesAt(server, host)));
   return found.some(Boolean);
 }
@@ -193,7 +212,7 @@ export class Tunnel {
   constructor(
     private driver: TunnelDriver,
     private onUrl: (url: string) => void = () => undefined,
-    private resolves: Resolves = resolvesAtCloudflare,
+    private resolves: Resolves = resolvesPublicly,
   ) {}
 
   private noticeUrl(text: string): void {

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -1,4 +1,4 @@
-import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core';
+import { index, jsonb, pgTable, text, uniqueIndex } from 'drizzle-orm/pg-core';
 
 import { STATIONS, type ConnectorTransport, type StationName } from './stations.js';
 
@@ -7,8 +7,8 @@ export { STATIONS, type ConnectorTransport, type StationName };
 export type ProjectRole = 'admin' | 'member';
 
 
-export const vault = pgTable(
-  'vault',
+export const vaults = pgTable(
+  'vaults',
   {
     id: text('id').primaryKey(),
     owner: text('owner').notNull(),
@@ -17,5 +17,17 @@ export const vault = pgTable(
     envelope: jsonb('envelope').notNull(),
     syncedAt: text('synced_at').notNull(),
   },
-  (t) => [index('vault_owner_idx').on(t.owner)],
+  (t) => [index('vaults_owner_idx').on(t.owner)],
+);
+
+export const servers = pgTable(
+  'servers',
+  {
+    id: text('id').primaryKey(),
+    owner: text('owner').notNull(),
+    host: text('host').notNull(),
+    name: text('name'),
+    addedAt: text('added_at').notNull(),
+  },
+  (t) => [uniqueIndex('servers_owner_host_idx').on(t.owner, t.host), index('servers_owner_idx').on(t.owner)],
 );

package/runtime/node_modules/@metro-labs/mcp/src/db/servers.ts

@@ -0,0 +1,83 @@
+import { and, asc, eq } from 'drizzle-orm';
+import { ApiError } from '../daemon/api-error.js';
+import { isRecord } from '../daemon/is-record.js';
+import { getDb } from './client.js';
+import { newId, parseId } from './ids.js';
+import { servers } from './schema.js';
+import { normalizeAddress } from './address.js';
+import { parseServerHost, parseServerName, type ServerEntry } from '../daemon/server-types.js';
+
+export class ServerListError extends ApiError {}
+
+const missing = (): ServerListError => new ServerListError('no such server', 404);
+
+function ownerOf(subject: string): string {
+  const address = normalizeAddress(subject);
+  if (address === null) throw new ServerListError('the server list needs a signed identity', 403);
+  return address;
+}
+
+function idOf(raw: string): string {
+  const id = parseId(raw);
+  if (id === null) throw missing();
+  return id;
+}
+
+const entryOf = (row: { id: string; host: string; name: string | null; addedAt: string }): ServerEntry => ({
+  id: row.id,
+  host: row.host,
+  name: row.name,
+  addedAt: row.addedAt,
+});
+
+const columns = { id: servers.id, host: servers.host, name: servers.name, addedAt: servers.addedAt };
+
+export async function listServersForOwner(subject: string): Promise<ServerEntry[]> {
+  const owner = ownerOf(subject);
+  const rows = await getDb().select(columns).from(servers).where(eq(servers.owner, owner)).orderBy(asc(servers.addedAt));
+  return rows.map(entryOf);
+}
+
+export async function addServerForOwner(subject: string, body: unknown): Promise<ServerEntry> {
+  const owner = ownerOf(subject);
+  const host = parseServerHost(isRecord(body) && typeof body.host === 'string' ? body.host : '');
+  if (host === null) throw new ServerListError('host is not a server address', 400);
+  const name = parseServerName(isRecord(body) ? body.name : undefined);
+  const db = getDb();
+  const held = await db.select(columns).from(servers).where(and(eq(servers.owner, owner), eq(servers.host, host)));
+  const row = held[0];
+  if (row !== undefined) {
+    if (name === null) return entryOf(row);
+    await db.update(servers).set({ name }).where(eq(servers.id, row.id));
+    return entryOf({ ...row, name });
+  }
+  const next = { id: newId(), owner, host, name, addedAt: new Date().toISOString() };
+  await db.insert(servers).values(next);
+  return entryOf(next);
+}
+
+export async function renameServerForOwner(subject: string, rawId: string, body: unknown): Promise<ServerEntry> {
+  const owner = ownerOf(subject);
+  const id = idOf(rawId);
+  const name = parseServerName(isRecord(body) ? body.name : undefined);
+  const rows = await getDb()
+    .update(servers)
+    .set({ name })
+    .where(and(eq(servers.id, id), eq(servers.owner, owner)))
+    .returning(columns);
+  const row = rows[0];
+  if (row === undefined) throw missing();
+  return entryOf(row);
+}
+
+export async function deleteServerForOwner(subject: string, rawId: string): Promise<{ id: string; host: string }> {
+  const owner = ownerOf(subject);
+  const id = idOf(rawId);
+  const gone = await getDb()
+    .delete(servers)
+    .where(and(eq(servers.id, id), eq(servers.owner, owner)))
+    .returning({ id: servers.id, host: servers.host });
+  const row = gone[0];
+  if (row === undefined) throw missing();
+  return row;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/vault.ts

@@ -3,7 +3,7 @@ import { ApiError } from '../daemon/api-error.js';
 import { isRecord } from '../daemon/is-record.js';
 import { getDb } from './client.js';
 import { AGENT_NAME_RE, parseId } from './ids.js';
-import { vault } from './schema.js';
+import { vaults } from './schema.js';
 import { STATIONS } from './stations.js';
 import { normalizeAddress } from './address.js';
 
@@ -66,10 +66,10 @@ const entryOf = (row: { id: string; name: string; stations: unknown; syncedAt: s
 export async function listVaultForOwner(subject: string): Promise<VaultEntry[]> {
   const owner = ownerOf(subject);
   const rows = await getDb()
-    .select({ id: vault.id, name: vault.name, stations: vault.stations, syncedAt: vault.syncedAt })
-    .from(vault)
-    .where(eq(vault.owner, owner))
-    .orderBy(asc(vault.name));
+    .select({ id: vaults.id, name: vaults.name, stations: vaults.stations, syncedAt: vaults.syncedAt })
+    .from(vaults)
+    .where(eq(vaults.owner, owner))
+    .orderBy(asc(vaults.name));
   return rows.map(entryOf);
 }
 
@@ -78,19 +78,19 @@ export async function putVaultForOwner(subject: string, id: string, body: unknow
   const syncedAt = new Date().toISOString();
   const values = { id, owner: input.owner, name: input.name, stations: input.stations, envelope: input.envelope, syncedAt };
   const db = getDb();
-  const held = await db.select({ owner: vault.owner }).from(vault).where(eq(vault.id, id));
+  const held = await db.select({ owner: vaults.owner }).from(vaults).where(eq(vaults.id, id));
   if (held[0] !== undefined && held[0].owner !== input.owner) throw missing();
   await db
-    .insert(vault)
+    .insert(vaults)
     .values(values)
-    .onConflictDoUpdate({ target: vault.id, set: { name: input.name, stations: input.stations, envelope: input.envelope, syncedAt } });
+    .onConflictDoUpdate({ target: vaults.id, set: { name: input.name, stations: input.stations, envelope: input.envelope, syncedAt } });
   return entryOf(values);
 }
 
 export async function getVaultForOwner(subject: string, id: string): Promise<VaultBundle> {
   const owner = ownerOf(subject);
   if (parseId(id) === null) throw missing();
-  const rows = await getDb().select().from(vault).where(and(eq(vault.id, id), eq(vault.owner, owner)));
+  const rows = await getDb().select().from(vaults).where(and(eq(vaults.id, id), eq(vaults.owner, owner)));
   const row = rows[0];
   if (row === undefined) throw missing();
   return { ...entryOf(row), envelope: isRecord(row.envelope) ? row.envelope : {} };
@@ -100,9 +100,9 @@ export async function deleteVaultForOwner(subject: string, id: string): Promise<
   const owner = ownerOf(subject);
   if (parseId(id) === null) throw missing();
   const gone = await getDb()
-    .delete(vault)
-    .where(and(eq(vault.id, id), eq(vault.owner, owner)))
-    .returning({ id: vault.id, name: vault.name });
+    .delete(vaults)
+    .where(and(eq(vaults.id, id), eq(vaults.owner, owner)))
+    .returning({ id: vaults.id, name: vaults.name });
   const row = gone[0];
   if (row === undefined) throw missing();
   return row;

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.57"
+  "version": "0.1.0-beta.59"
 }