@stage-labs/metro 0.1.0-beta.7 → 0.1.0-beta.71

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-map.ts

@@ -0,0 +1,84 @@
+export type AgentMap = Record<string, string>;
+export type AgentNameMap = Record<string, string>;
+export type AllowlistMap = Record<string, string[]>;
+
+const mapKey = (station: string, accountId: string): string =>
+  `${station}/${accountId}`;
+
+let agentMap: AgentMap = {};
+let agentNames: AgentNameMap = {};
+let allowlistMap: AllowlistMap = {};
+
+export function setAgentMap(map: AgentMap, names: AgentNameMap): void {
+  agentMap = map;
+  agentNames = names;
+}
+
+export function setAllowlistMap(map: AllowlistMap): void {
+  allowlistMap = map;
+}
+
+export function accountFromLine(
+  line: string,
+): { station: string; accountId: string } | undefined {
+  const parts = line.split('/');
+  const station = parts[2];
+  const accountId = parts[3];
+  if (!station || !accountId) return undefined;
+  return { station, accountId };
+}
+
+export function agentIdForAccount(
+  station: string,
+  accountId: string,
+): string | undefined {
+  return agentMap[mapKey(station, accountId)];
+}
+
+export function agentIdForLine(line: string): string | undefined {
+  const a = accountFromLine(line);
+  return a ? agentIdForAccount(a.station, a.accountId) : undefined;
+}
+
+export function agentForLine(line: string): string | undefined {
+  const id = agentIdForLine(line);
+  return id === undefined ? undefined : agentNames[id];
+}
+
+export interface KnownAccount {
+  station: string;
+  id: string;
+  agentId: string;
+}
+
+export function knownAccounts(): KnownAccount[] {
+  return Object.entries(agentMap).flatMap(([key, agentId]) => {
+    const cut = key.indexOf('/');
+    return cut === -1 ? [] : [{ station: key.slice(0, cut), id: key.slice(cut + 1), agentId }];
+  });
+}
+
+export function stationAgentIds(station: string): string[] {
+  const prefix = `${station}/`;
+  return Object.entries(agentMap)
+    .filter(([key]) => key.startsWith(prefix))
+    .map(([, id]) => id);
+}
+
+export function allowlistForLine(line: string): string[] | undefined {
+  const a = accountFromLine(line);
+  return a ? allowlistMap[mapKey(a.station, a.accountId)] : undefined;
+}
+
+export function senderMatchesAllowlist(
+  allowlist: string[],
+  from: string,
+): boolean {
+  if (allowlist.length === 0 || allowlist.includes('*')) return true;
+  const f = (from ?? '').toLowerCase();
+  const id = f.split('/').pop() ?? f;
+  return allowlist.some((a) => {
+    const v = a.toLowerCase();
+    return v === f || v === id;
+  });
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-scope.ts

@@ -0,0 +1,64 @@
+import {
+  accountFromLine,
+  agentIdForAccount,
+  stationAgentIds,
+} from './agent-map.js';
+import { STATIONS } from './stations.js';
+
+const ACCOUNT_STATIONS = new Set<string>(STATIONS);
+
+const stationHasAccounts = (station: string): boolean =>
+  ACCOUNT_STATIONS.has(station);
+
+const accountInScope = (
+  allowed: Set<string>,
+  station: string,
+  accountId: string,
+): boolean => {
+  const agentId = agentIdForAccount(station, accountId);
+  return agentId !== undefined && allowed.has(agentId);
+};
+
+export function lineTargetDenied(
+  allowed: Set<string>,
+  args: Record<string, unknown>,
+  station?: string,
+): boolean {
+  const line = typeof args.line === 'string' ? args.line : undefined;
+  if (line === undefined) return false;
+  const acct = accountFromLine(line);
+  if (!acct) return true;
+  if (station !== undefined && acct.station !== station) return true;
+  if (!accountInScope(allowed, acct.station, acct.accountId)) return true;
+  const override = typeof args.account === 'string' ? args.account : undefined;
+  return override !== undefined
+    ? !accountInScope(allowed, acct.station, override)
+    : false;
+}
+
+export function stationFullyScoped(
+  allowed: Set<string>,
+  station: string,
+): boolean {
+  const ids = stationAgentIds(station);
+  return ids.length > 0 && ids.every((id) => allowed.has(id));
+}
+
+export function callTargetDenied(
+  allowed: Set<string>,
+  station: string,
+  args: Record<string, unknown>,
+): boolean {
+  if (typeof args.line === 'string')
+    return lineTargetDenied(allowed, args, station);
+  if (typeof args.account === 'string')
+    return !accountInScope(allowed, station, args.account);
+  return !stationFullyScoped(allowed, station);
+}
+
+export function eventInScope(allowed: Set<string>, line: string): boolean {
+  const acct = accountFromLine(line);
+  if (!acct) return false;
+  if (!stationHasAccounts(acct.station)) return true;
+  return accountInScope(allowed, acct.station, acct.accountId);
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/client.ts

@@ -0,0 +1,32 @@
+import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import postgres from 'postgres';
+import { log } from '../daemon/log.js';
+import * as schema from './schema.js';
+
+export type Db = PostgresJsDatabase<typeof schema>;
+
+let sql: ReturnType<typeof postgres> | null = null;
+let db: Db | null = null;
+
+export function databaseUrl(): string | undefined {
+  const url = process.env.DATABASE_URL?.trim();
+  if (!url) return undefined;
+  return url;
+}
+
+export function getDb(): Db {
+  const url = databaseUrl();
+  if (!url) throw new Error('DATABASE_URL is not set');
+  if (!db) {
+    sql = postgres(url, {
+      max: 4,
+      prepare: false,
+      onnotice: (notice) => {
+        log.debug({ notice: notice.message }, 'postgres notice');
+      },
+    });
+    db = drizzle(sql, { schema });
+  }
+  return db;
+}
+

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-config.ts

@@ -0,0 +1,144 @@
+import { ApiError } from '../daemon/api-error.js';
+import type {
+  ConnectorAuth,
+  VerifiedRecord,
+  VerifiedServer,
+} from '../daemon/connector-verify.js';
+import { readStoredTools } from '../daemon/connector-tools.js';
+import { isRecord } from '../daemon/is-record.js';
+
+const CONNECTOR_NAME_MAX = 64;
+const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
+const HEADER_VALUE_RE = /^[\x20-\x7e]{1,4096}$/;
+const DEFAULT_HEADER = 'Authorization';
+
+export class ConnectorError extends ApiError {}
+
+export type ConnectorSignIn = 'connected' | 'disconnected' | null;
+
+export interface ConnectorConfig {
+  auth: ConnectorAuth;
+  createdAt: string;
+  verified: VerifiedRecord;
+  oauth: boolean;
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' ? value : '';
+}
+
+function hasControlChar(value: string): boolean {
+  for (const ch of value) {
+    const code = ch.codePointAt(0) ?? 0;
+    if (code < 0x20 || code === 0x7f) return true;
+  }
+  return false;
+}
+
+export function connectorName(raw: unknown): string {
+  const name = typeof raw === 'string' ? raw.trim() : '';
+  if (name === '') throw new ConnectorError('a connector needs a name', 400);
+  if (name.length > CONNECTOR_NAME_MAX)
+    throw new ConnectorError(
+      `a connector name must be ${String(CONNECTOR_NAME_MAX)} characters or fewer`,
+      400,
+    );
+  if (hasControlChar(name))
+    throw new ConnectorError(
+      'a connector name must not contain control characters',
+      400,
+    );
+  return name;
+}
+
+export function connectorAuth(
+  rawHeader: unknown,
+  rawValue: unknown,
+): ConnectorAuth {
+  const header = text(rawHeader).trim();
+  const value = text(rawValue).trim();
+  if (header === '' && value === '') return { kind: 'none' };
+  if (value === '')
+    throw new ConnectorError(
+      'that header has no value — give both a header name and its value, or neither',
+      400,
+    );
+  const name = header === '' ? DEFAULT_HEADER : header;
+  if (!HEADER_NAME_RE.test(name))
+    throw new ConnectorError('that is not a valid HTTP header name', 400);
+  if (!HEADER_VALUE_RE.test(value))
+    throw new ConnectorError('that header value is not sendable', 400);
+  return { kind: 'header', name, value };
+}
+
+function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
+  const accessToken = text(raw.accessToken);
+  const clientId = text(raw.clientId);
+  const tokenEndpoint = text(raw.tokenEndpoint);
+  if (accessToken === '' || clientId === '' || tokenEndpoint === '')
+    return { kind: 'none' };
+  const refreshToken = text(raw.refreshToken);
+  const clientSecret = text(raw.clientSecret);
+  return {
+    kind: 'oauth',
+    accessToken,
+    clientId,
+    tokenEndpoint,
+    issuer: text(raw.issuer),
+    ...(refreshToken === '' ? {} : { refreshToken }),
+    ...(clientSecret === '' ? {} : { clientSecret }),
+    ...(typeof raw.expiresAt === 'number' ? { expiresAt: raw.expiresAt } : {}),
+  };
+}
+
+function readAuth(raw: unknown): ConnectorAuth {
+  if (!isRecord(raw)) return { kind: 'none' };
+  if (raw.kind === 'oauth') return readOAuth(raw);
+  if (raw.kind !== 'header') return { kind: 'none' };
+  const name = text(raw.name);
+  const value = text(raw.value);
+  if (name === '' || value === '') return { kind: 'none' };
+  return { kind: 'header', name, value };
+}
+
+function readVerified(raw: unknown): VerifiedRecord {
+  const record = isRecord(raw) ? raw : {};
+  const catalog = readStoredTools(record.catalog);
+  return {
+    at: text(record.at),
+    server: text(record.server),
+    version: text(record.version),
+    protocol: text(record.protocol),
+    icon: text(record.icon),
+    tools: typeof record.tools === 'number' ? record.tools : 0,
+    catalog,
+  };
+}
+
+export function readConfig(raw: unknown): ConnectorConfig {
+  const record = isRecord(raw) ? raw : {};
+  const auth = readAuth(record.auth);
+  return {
+    auth,
+    createdAt: text(record.createdAt),
+    verified: readVerified(record.verified),
+    oauth: record.oauth === true || auth.kind === 'oauth',
+  };
+}
+
+export function signInState(config: ConnectorConfig): ConnectorSignIn {
+  if (config.auth.kind === 'oauth') return 'connected';
+  return config.oauth ? 'disconnected' : null;
+}
+
+export function stamp(server: VerifiedServer): VerifiedRecord {
+  return {
+    at: new Date().toISOString(),
+    server: server.server,
+    version: server.version,
+    protocol: server.protocol,
+    icon: server.icon,
+    tools: server.tools,
+    catalog: server.catalog,
+  };
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-relay.ts

@@ -0,0 +1,39 @@
+import type { ConnectorAuth, OAuthAuth } from '../daemon/connector-verify.js';
+
+export type RelayTarget =
+  | { kind: 'ok'; url: string; headers: Record<string, string> }
+  | { kind: 'missing' }
+  | { kind: 'signin' };
+
+export const bearerHeaders = (token: string): Record<string, string> => ({
+  Authorization: `Bearer ${token}`,
+});
+
+export function staleUsable(auth: OAuthAuth, now = Date.now()): boolean {
+  return auth.expiresAt === undefined || auth.expiresAt > now;
+}
+
+function headerAuthHeaders(auth: ConnectorAuth): Record<string, string> | null {
+  return auth.kind === 'header' ? { [auth.name]: auth.value } : null;
+}
+
+export function unrefreshedTarget(
+  url: string,
+  auth: OAuthAuth,
+  force: boolean,
+  now = Date.now(),
+): RelayTarget {
+  if (force) return { kind: 'signin' };
+  if (staleUsable(auth, now))
+    return { kind: 'ok', url, headers: bearerHeaders(auth.accessToken) };
+  return { kind: 'ok', url, headers: {} };
+}
+
+export function fixedTarget(
+  url: string,
+  auth: Exclude<ConnectorAuth, OAuthAuth>,
+  force: boolean,
+): RelayTarget {
+  if (force) return { kind: 'signin' };
+  return { kind: 'ok', url, headers: headerAuthHeaders(auth) ?? {} };
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -0,0 +1,69 @@
+import type { ConnectorAuth, VerifiedRecord } from '../daemon/connector-verify.js';
+import { readConfig, signInState, type ConnectorSignIn } from './connector-config.js';
+import type { ConnectorTransport } from './stations.js';
+
+export interface Connector {
+  id: string;
+  name: string;
+  url: string;
+  transport: ConnectorTransport;
+  auth: ConnectorAuth['kind'];
+  header: string | null;
+  secret: string | null;
+  bearer: string | null;
+  expiresAt: number | null;
+  signIn: ConnectorSignIn;
+  verified: VerifiedRecord;
+}
+
+export interface ConnectorInput {
+  name: unknown;
+  url: unknown;
+  header: unknown;
+  value: unknown;
+}
+
+export type ConnectorCheck =
+  | { id: string; name: string; ok: true; verified: VerifiedRecord }
+  | { id: string; name: string; ok: false; reason: string };
+
+export interface DeletedConnector {
+  id: string;
+  name: string;
+}
+
+export interface ConnectorLike {
+  id: string;
+  name: string;
+  url: string;
+  transport: ConnectorTransport;
+  config: unknown;
+}
+
+export function connectorFromRow(row: ConnectorLike): Connector {
+  const config = readConfig(row.config);
+  const auth = config.auth;
+  return {
+    id: row.id,
+    name: row.name,
+    url: row.url,
+    transport: row.transport,
+    auth: auth.kind,
+    header: auth.kind === 'header' ? auth.name : null,
+    secret: auth.kind === 'header' ? auth.value : null,
+    bearer: auth.kind === 'oauth' ? auth.accessToken : null,
+    expiresAt: auth.kind === 'oauth' ? (auth.expiresAt ?? null) : null,
+    signIn: signInState(config),
+    verified: config.verified,
+  };
+}
+
+export const UNVERIFIED = {
+  at: '',
+  server: '',
+  version: '',
+  protocol: '',
+  icon: '',
+  tools: 0,
+  catalog: [],
+};