@stage-labs/metro 0.1.0-beta.76 → 0.1.0-beta.77

package/dist/bedrock-upstream.js

@@ -1,72 +0,0 @@
-export const freshAdaptations = () => ({
-    fields: new Set(),
-    dropBetas: false,
-});
-const EXTRA_INPUT_RE = /^([A-Za-z0-9_]+)(?:\.[^:]*)?: Extra inputs are not permitted/;
-const MAX_REPAIRS = 4;
-export function invokeUrl(up, modelId, action) {
-    return `${up.base}/model/${encodeURIComponent(modelId)}/${action}`;
-}
-export function callBedrock(up, url, body, accept, signal) {
-    return fetch(url, {
-        method: 'POST',
-        headers: {
-            authorization: `Bearer ${up.cfg.bearerToken}`,
-            'content-type': 'application/json',
-            accept,
-        },
-        body: JSON.stringify(body),
-        signal,
-    });
-}
-export function upstreamMessage(text) {
-    const fallback = text === '' ? 'Bedrock returned no body' : text;
-    try {
-        const parsed = JSON.parse(text);
-        const message = parsed.message ?? parsed.Message;
-        return typeof message === 'string' && message !== '' ? message : fallback;
-    }
-    catch {
-        return fallback;
-    }
-}
-const without = (body, keys) => Object.fromEntries(Object.entries(body).filter(([key]) => !keys.has(key)));
-function applyLearned(req, learned) {
-    const dropped = new Set(learned.fields);
-    if (learned.dropBetas)
-        dropped.add('anthropic_beta');
-    return {
-        body: without(req.body, dropped),
-        betas: learned.dropBetas ? [] : req.betas,
-    };
-}
-function repair(attempt, learned, message) {
-    const named = EXTRA_INPUT_RE.exec(message)?.[1];
-    if (named !== undefined && named in attempt.body) {
-        learned.fields.add(named);
-        process.stderr.write(`metro bedrock: Bedrock refused "${named}" (extra input); dropping it from every request\n`);
-        return { body: without(attempt.body, new Set([named])), betas: attempt.betas };
-    }
-    if (attempt.betas.length > 0) {
-        learned.dropBetas = true;
-        process.stderr.write(`metro bedrock: retrying without anthropic_beta [${attempt.betas.join(', ')}]\n`);
-        return { body: without(attempt.body, new Set(['anthropic_beta'])), betas: [] };
-    }
-    return null;
-}
-export async function invoke(up, req, signal) {
-    const action = req.stream ? 'invoke-with-response-stream' : 'invoke';
-    const accept = req.stream ? 'application/vnd.amazon.eventstream' : 'application/json';
-    const url = invokeUrl(up, req.modelId, action);
-    let attempt = applyLearned(req, up.learned);
-    for (let repairs = 0;; repairs += 1) {
-        const res = await callBedrock(up, url, attempt.body, accept, signal);
-        if (res.status !== 400 || repairs >= MAX_REPAIRS)
-            return res;
-        const text = await res.text();
-        const next = repair(attempt, up.learned, upstreamMessage(text));
-        if (next === null)
-            return new Response(text, { status: 400, headers: res.headers });
-        attempt = next;
-    }
-}

package/dist/bedrock.js

@@ -1,37 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { claudeArgs, runClaude } from './claude.js';
-import { bedrockConfigFromEnv, startBedrockProxy } from './bedrock-proxy.js';
-import { settingsConflicts, settingsFiles } from './claude-settings.js';
-import { PROVIDER_FLAGS } from './provider-flags.js';
-export { PROVIDER_FLAGS, settingsConflicts, settingsFiles };
-const SCRUBBED = [...PROVIDER_FLAGS, 'ANTHROPIC_API_KEY', 'AWS_BEARER_TOKEN_BEDROCK'];
-export function firstPartyModelId(bedrockId) {
-    return bedrockId.replace(/^(?:[a-z-]+\.)?anthropic\./, '').replace(/-v\d+:\d+$/, '');
-}
-export function claudeEnv(base, port, token, pinned = null) {
-    const kept = Object.entries(base).filter(([key]) => !SCRUBBED.includes(key));
-    const model = (base.ANTHROPIC_MODEL ?? '').trim();
-    return {
-        ...Object.fromEntries(kept),
-        ...(pinned !== null && model === '' && { ANTHROPIC_MODEL: firstPartyModelId(pinned) }),
-        ANTHROPIC_BASE_URL: `http://127.0.0.1:${String(port)}`,
-        ANTHROPIC_AUTH_TOKEN: token,
-    };
-}
-export async function bedrock(argv) {
-    const cfg = bedrockConfigFromEnv();
-    const conflicts = settingsConflicts(settingsFiles());
-    if (conflicts.length > 0)
-        throw new Error('metro bedrock: these settings would put Claude Code back on a third-party provider, or override the proxy. Remove them, or point CLAUDE_CONFIG_DIR at a separate profile:\n  ' +
-            conflicts.join('\n  '));
-    const token = `mb_${randomBytes(18).toString('base64url')}`;
-    const proxy = await startBedrockProxy(cfg, { token });
-    const pinned = cfg.model === null ? '' : ` (${cfg.model})`;
-    process.stderr.write(`metro bedrock: Claude Code → http://127.0.0.1:${String(proxy.port)} → Bedrock ${cfg.region}${pinned}\n`);
-    try {
-        return await runClaude(claudeArgs(argv), claudeEnv(process.env, proxy.port, token, cfg.model));
-    }
-    finally {
-        await proxy.close();
-    }
-}

package/runtime/node_modules/@metro-labs/mcp/package.json

@@ -1,64 +0,0 @@
-{
-  "name": "@metro-labs/mcp",
-  "version": "0.1.0-beta.15",
-  "private": true,
-  "description": "Event-interception wire. Supervises train subprocesses in ~/.metro/trains/, multiplexes their JSON event stream onto stdout, and routes outbound action calls back via stdin. Per-platform code is written by the agent (or user) as train scripts — metro core is pure transport.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/bonustrack/metro.git"
-  },
-  "homepage": "https://github.com/bonustrack/metro#readme",
-  "bugs": "https://github.com/bonustrack/metro/issues",
-  "type": "module",
-  "engines": {
-    "node": ">=22"
-  },
-  "exports": {
-    ".": "./src/mcp/index.ts",
-    "./log": "./src/daemon/log.ts",
-    "./train-error": "./src/daemon/train-error.ts",
-    "./secure-fs": "./src/daemon/secure-fs.ts",
-    "./lines": "./src/stations/lines.ts",
-    "./events": "./src/daemon/events.ts",
-    "./endpoints": "./src/daemon/tunnel.ts",
-    "./trains/protocol": "./src/daemon/protocol.ts",
-    "./stations/types": "./src/stations/types.ts",
-    "./stations/station-runtime": "./src/stations/station-runtime.ts",
-    "./stations/account-store": "./src/stations/account-store.ts",
-    "./stations/attachments": "./src/stations/attachments.ts",
-    "./stations/messaging-normalize": "./src/stations/messaging-normalize.ts"
-  },
-  "scripts": {
-    "start": "bun src/server.ts",
-    "build": "tsc",
-    "db:migrate": "drizzle-kit migrate",
-    "test": "tsc --noEmit && DYLD_FALLBACK_LIBRARY_PATH=/usr/lib METRO_STATE_DIR=\"$(mktemp -d /tmp/metro-test.XXXXXX)\" bun test test/"
-  },
-  "dependencies": {
-    "@metro-labs/discord-bot": "workspace:*",
-    "@metro-labs/telegram": "workspace:*",
-    "@metro-labs/telegram-bot": "workspace:*",
-    "@metro-labs/webhook": "workspace:*",
-    "@metro-labs/whatsapp": "workspace:*",
-    "@metro-labs/xmtp": "workspace:*",
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@noble/curves": "^1.9.7",
-    "drizzle-kit": "^0.31.0",
-    "drizzle-orm": "^0.44.0",
-    "pino": "^9.5.0",
-    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.5",
-    "viem": "2.52.2",
-    "ws": "^8.18.0",
-    "zod": "^3.23.8"
-  },
-  "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
-    "@types/ws": "^8.18.0",
-    "eslint": "^10.3.0",
-    "knip": "^6.15.0",
-    "madge": "^8.0.0",
-    "typescript": "^5"
-  }
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/server-types.ts

@@ -1,21 +0,0 @@
-export interface ServerEntry {
-  id: string;
-  host: string;
-  name: string | null;
-  addedAt: string;
-}
-
-const HOST_RE = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/;
-const HOST_MAX = 253;
-const NAME_MAX = 40;
-
-export function parseServerHost(raw: string): string | null {
-  const host = raw.trim().toLowerCase();
-  return host.length <= HOST_MAX && HOST_RE.test(host) ? host : null;
-}
-
-export function parseServerName(raw: unknown): string | null {
-  if (typeof raw !== 'string') return null;
-  const name = raw.replace(/[\p{Cc}]/gu, '').trim().slice(0, NAME_MAX);
-  return name === '' ? null : name;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/servers-api.ts

@@ -1,80 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from './log.js';
-import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { signedIdentity } from './signed-identity.js';
-import type { ServerEntry } from './server-types.js';
-import { parseId } from '../db/ids.js';
-
-const PREFIX = '/api/servers';
-
-export interface ServersApiDeps {
-  list: (subject: string) => Promise<ServerEntry[]>;
-  add: (subject: string, body: unknown) => Promise<ServerEntry>;
-  rename: (subject: string, id: string, body: unknown) => Promise<ServerEntry>;
-  remove: (subject: string, id: string) => Promise<{ id: string; host: string }>;
-}
-
-type Target = { kind: 'index' } | { kind: 'server'; id: string } | { kind: 'unknown' } | null;
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const id = parseId(segments[0] ?? '');
-  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'server', id };
-}
-
-const ALLOWED: Record<'index' | 'server', string[]> = { index: ['GET', 'POST'], server: ['PUT', 'DELETE'] };
-
-async function answer(
-  req: IncomingMessage,
-  deps: ServersApiDeps,
-  owner: string,
-  tgt: { kind: 'index' } | { kind: 'server'; id: string },
-): Promise<unknown> {
-  if (tgt.kind === 'index')
-    return req.method === 'GET' ? { servers: await deps.list(owner) } : deps.add(owner, await readJsonBody(req));
-  return req.method === 'DELETE' ? deps.remove(owner, tgt.id) : deps.rename(owner, tgt.id, await readJsonBody(req));
-}
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ServersApiDeps,
-  tgt: { kind: 'index' } | { kind: 'server'; id: string },
-): Promise<void> {
-  try {
-    const owner = await signedIdentity(req);
-    if (owner === null) {
-      sendJson(req, res, 401, { error: 'unauthorized' });
-      return;
-    }
-    const body = await answer(req, deps, owner, tgt);
-    if (req.method !== 'GET') log.info({ method: req.method, target: tgt }, 'servers-api: list changed');
-    sendJson(req, res, 200, body);
-  } catch (err) {
-    apiFailure(req, res, err, 'servers-api');
-  }
-}
-
-export function handleServersApiRequest(req: IncomingMessage, res: ServerResponse, deps: ServersApiDeps): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const tgt = target(path);
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such server' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  route(req, res, deps, tgt).catch((err: unknown) => {
-    apiFailure(req, res, err, 'servers-api');
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-api.ts

@@ -1,78 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { parseId } from '../db/ids.js';
-import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from './vault-types.js';
-import { signedIdentity } from './signed-identity.js';
-
-const PREFIX = '/api/vault';
-const BODY_MAX = ENVELOPE_MAX + 64 * 1024;
-
-export interface VaultApiDeps {
-  list: (subject: string) => Promise<VaultEntry[]>;
-  put: (subject: string, id: string, body: unknown) => Promise<VaultEntry>;
-  get: (subject: string, id: string) => Promise<VaultBundle>;
-  remove: (subject: string, id: string) => Promise<{ id: string; name: string }>;
-}
-
-type Target = { kind: 'index' } | { kind: 'bundle'; id: string } | { kind: 'unknown' } | null;
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const id = parseId(segments[0] ?? '');
-  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'bundle', id };
-}
-
-const ALLOWED: Record<'index' | 'bundle', string[]> = { index: ['GET'], bundle: ['GET', 'PUT', 'DELETE'] };
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: VaultApiDeps,
-  tgt: { kind: 'index' } | { kind: 'bundle'; id: string },
-): Promise<void> {
-  try {
-    const owner = await signedIdentity(req);
-    if (owner === null) {
-      sendJson(req, res, 401, { error: 'unauthorized' });
-      return;
-    }
-    if (tgt.kind === 'index') {
-      sendJson(req, res, 200, { entries: await deps.list(owner) });
-      return;
-    }
-    if (req.method === 'GET') sendJson(req, res, 200, await deps.get(owner, tgt.id));
-    else if (req.method === 'DELETE') sendJson(req, res, 200, await deps.remove(owner, tgt.id));
-    else {
-      const saved = await deps.put(owner, tgt.id, await readJsonBody(req, BODY_MAX));
-      log.info({ id: saved.id, name: saved.name }, 'vault-api: bundle stored');
-      sendJson(req, res, 200, saved);
-    }
-  } catch (err) {
-    apiFailure(req, res, err, 'vault-api');
-  }
-}
-
-export function handleVaultApiRequest(req: IncomingMessage, res: ServerResponse, deps: VaultApiDeps): boolean {
-  const tgt = target((req.url ?? '').split('?')[0] ?? '');
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such bundle' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  route(req, res, deps, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'vault-api: unhandled error');
-    if (!res.headersSent) sendJson(req, res, 500, { error: 'vault api failed' });
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-types.ts

@@ -1,12 +0,0 @@
-export interface VaultEntry {
-  id: string;
-  name: string;
-  stations: string[];
-  syncedAt: string;
-}
-
-export interface VaultBundle extends VaultEntry {
-  envelope: Record<string, unknown>;
-}
-
-export const ENVELOPE_MAX = 2 * 1024 * 1024;

package/runtime/node_modules/@metro-labs/mcp/src/db/client.ts

@@ -1,32 +0,0 @@
-import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js';
-import postgres from 'postgres';
-import { log } from '../daemon/log.js';
-import * as schema from './schema.js';
-
-export type Db = PostgresJsDatabase<typeof schema>;
-
-let sql: ReturnType<typeof postgres> | null = null;
-let db: Db | null = null;
-
-export function databaseUrl(): string | undefined {
-  const url = process.env.DATABASE_URL?.trim();
-  if (!url) return undefined;
-  return url;
-}
-
-export function getDb(): Db {
-  const url = databaseUrl();
-  if (!url) throw new Error('DATABASE_URL is not set');
-  if (!db) {
-    sql = postgres(url, {
-      max: 4,
-      prepare: false,
-      onnotice: (notice) => {
-        log.debug({ notice: notice.message }, 'postgres notice');
-      },
-    });
-    db = drizzle(sql, { schema });
-  }
-  return db;
-}
-

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -1,33 +0,0 @@
-import { index, jsonb, pgTable, text, uniqueIndex } from 'drizzle-orm/pg-core';
-
-import { STATIONS, type ConnectorTransport, type StationName } from './stations.js';
-
-export { STATIONS, type ConnectorTransport, type StationName };
-
-export type ProjectRole = 'admin' | 'member';
-
-
-export const vaults = pgTable(
-  'vaults',
-  {
-    id: text('id').primaryKey(),
-    owner: text('owner').notNull(),
-    name: text('name').notNull(),
-    stations: jsonb('stations').notNull(),
-    envelope: jsonb('envelope').notNull(),
-    syncedAt: text('synced_at').notNull(),
-  },
-  (t) => [index('vaults_owner_idx').on(t.owner)],
-);
-
-export const servers = pgTable(
-  'servers',
-  {
-    id: text('id').primaryKey(),
-    owner: text('owner').notNull(),
-    host: text('host').notNull(),
-    name: text('name'),
-    addedAt: text('added_at').notNull(),
-  },
-  (t) => [uniqueIndex('servers_owner_host_idx').on(t.owner, t.host), index('servers_owner_idx').on(t.owner)],
-);

package/runtime/node_modules/@metro-labs/mcp/src/db/servers.ts

@@ -1,83 +0,0 @@
-import { and, asc, eq } from 'drizzle-orm';
-import { ApiError } from '../daemon/api-error.js';
-import { isRecord } from '../daemon/is-record.js';
-import { getDb } from './client.js';
-import { newId, parseId } from './ids.js';
-import { servers } from './schema.js';
-import { normalizeAddress } from './address.js';
-import { parseServerHost, parseServerName, type ServerEntry } from '../daemon/server-types.js';
-
-export class ServerListError extends ApiError {}
-
-const missing = (): ServerListError => new ServerListError('no such server', 404);
-
-function ownerOf(subject: string): string {
-  const address = normalizeAddress(subject);
-  if (address === null) throw new ServerListError('the server list needs a signed identity', 403);
-  return address;
-}
-
-function idOf(raw: string): string {
-  const id = parseId(raw);
-  if (id === null) throw missing();
-  return id;
-}
-
-const entryOf = (row: { id: string; host: string; name: string | null; addedAt: string }): ServerEntry => ({
-  id: row.id,
-  host: row.host,
-  name: row.name,
-  addedAt: row.addedAt,
-});
-
-const columns = { id: servers.id, host: servers.host, name: servers.name, addedAt: servers.addedAt };
-
-export async function listServersForOwner(subject: string): Promise<ServerEntry[]> {
-  const owner = ownerOf(subject);
-  const rows = await getDb().select(columns).from(servers).where(eq(servers.owner, owner)).orderBy(asc(servers.addedAt));
-  return rows.map(entryOf);
-}
-
-export async function addServerForOwner(subject: string, body: unknown): Promise<ServerEntry> {
-  const owner = ownerOf(subject);
-  const host = parseServerHost(isRecord(body) && typeof body.host === 'string' ? body.host : '');
-  if (host === null) throw new ServerListError('host is not a server address', 400);
-  const name = parseServerName(isRecord(body) ? body.name : undefined);
-  const db = getDb();
-  const held = await db.select(columns).from(servers).where(and(eq(servers.owner, owner), eq(servers.host, host)));
-  const row = held[0];
-  if (row !== undefined) {
-    if (name === null) return entryOf(row);
-    await db.update(servers).set({ name }).where(eq(servers.id, row.id));
-    return entryOf({ ...row, name });
-  }
-  const next = { id: newId(), owner, host, name, addedAt: new Date().toISOString() };
-  await db.insert(servers).values(next);
-  return entryOf(next);
-}
-
-export async function renameServerForOwner(subject: string, rawId: string, body: unknown): Promise<ServerEntry> {
-  const owner = ownerOf(subject);
-  const id = idOf(rawId);
-  const name = parseServerName(isRecord(body) ? body.name : undefined);
-  const rows = await getDb()
-    .update(servers)
-    .set({ name })
-    .where(and(eq(servers.id, id), eq(servers.owner, owner)))
-    .returning(columns);
-  const row = rows[0];
-  if (row === undefined) throw missing();
-  return entryOf(row);
-}
-
-export async function deleteServerForOwner(subject: string, rawId: string): Promise<{ id: string; host: string }> {
-  const owner = ownerOf(subject);
-  const id = idOf(rawId);
-  const gone = await getDb()
-    .delete(servers)
-    .where(and(eq(servers.id, id), eq(servers.owner, owner)))
-    .returning({ id: servers.id, host: servers.host });
-  const row = gone[0];
-  if (row === undefined) throw missing();
-  return row;
-}

package/runtime/node_modules/@metro-labs/mcp/src/db/vault.ts

@@ -1,109 +0,0 @@
-import { and, asc, eq } from 'drizzle-orm';
-import { ApiError } from '../daemon/api-error.js';
-import { isRecord } from '../daemon/is-record.js';
-import { getDb } from './client.js';
-import { AGENT_NAME_RE, parseId } from './ids.js';
-import { vaults } from './schema.js';
-import { STATIONS } from './stations.js';
-import { normalizeAddress } from './address.js';
-
-export class VaultError extends ApiError {}
-
-import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from '../daemon/vault-types.js';
-
-export interface VaultInput {
-  name: string;
-  stations: string[];
-  envelope: Record<string, unknown>;
-}
-const STATION_NAMES = new Set<string>(STATIONS);
-
-const missing = (): VaultError => new VaultError('no such bundle', 404);
-
-function ownerOf(subject: string): string {
-  const address = normalizeAddress(subject);
-  if (address === null) throw new VaultError('the vault needs a vault identity', 403);
-  return address;
-}
-
-function stationsOf(raw: unknown): string[] {
-  if (!Array.isArray(raw)) throw new VaultError('stations must be a list of station names', 400);
-  const list = raw.map((s: unknown) => (typeof s === 'string' ? s : ''));
-  const bad = list.find((s) => !STATION_NAMES.has(s));
-  if (bad !== undefined) throw new VaultError(`'${bad}' is not a station`, 400);
-  return [...new Set(list)];
-}
-
-function envelopeOf(raw: unknown, id: string): Record<string, unknown> {
-  if (!isRecord(raw) || raw.v !== 1 || raw.agentId !== id)
-    throw new VaultError('envelope must be a v1 envelope for this agent', 400);
-  const key = raw.key;
-  if (!isRecord(key) || normalizeAddress(typeof key.recipient === 'string' ? key.recipient : '') === null)
-    throw new VaultError('envelope must name the wallet it was sealed to', 400);
-  if (typeof raw.ciphertext !== 'string' || typeof raw.nonce !== 'string')
-    throw new VaultError('envelope carries no ciphertext', 400);
-  if (JSON.stringify(raw).length > ENVELOPE_MAX)
-    throw new VaultError(`envelope is over ${String(ENVELOPE_MAX)} bytes`, 413);
-  return raw;
-}
-
-export function parseVaultInput(subject: string, id: string, body: unknown): VaultInput & { owner: string } {
-  const owner = ownerOf(subject);
-  if (parseId(id) === null) throw missing();
-  if (!isRecord(body)) throw new VaultError('body must be an object', 400);
-  const name = typeof body.name === 'string' ? body.name.trim() : '';
-  if (!AGENT_NAME_RE.test(name)) throw new VaultError('name is not an agent name', 400);
-  return { owner, name, stations: stationsOf(body.stations), envelope: envelopeOf(body.envelope, id) };
-}
-
-const entryOf = (row: { id: string; name: string; stations: unknown; syncedAt: string }): VaultEntry => ({
-  id: row.id,
-  name: row.name,
-  stations: Array.isArray(row.stations) ? row.stations.filter((s): s is string => typeof s === 'string') : [],
-  syncedAt: row.syncedAt,
-});
-
-export async function listVaultForOwner(subject: string): Promise<VaultEntry[]> {
-  const owner = ownerOf(subject);
-  const rows = await getDb()
-    .select({ id: vaults.id, name: vaults.name, stations: vaults.stations, syncedAt: vaults.syncedAt })
-    .from(vaults)
-    .where(eq(vaults.owner, owner))
-    .orderBy(asc(vaults.name));
-  return rows.map(entryOf);
-}
-
-export async function putVaultForOwner(subject: string, id: string, body: unknown): Promise<VaultEntry> {
-  const input = parseVaultInput(subject, id, body);
-  const syncedAt = new Date().toISOString();
-  const values = { id, owner: input.owner, name: input.name, stations: input.stations, envelope: input.envelope, syncedAt };
-  const db = getDb();
-  const held = await db.select({ owner: vaults.owner }).from(vaults).where(eq(vaults.id, id));
-  if (held[0] !== undefined && held[0].owner !== input.owner) throw missing();
-  await db
-    .insert(vaults)
-    .values(values)
-    .onConflictDoUpdate({ target: vaults.id, set: { name: input.name, stations: input.stations, envelope: input.envelope, syncedAt } });
-  return entryOf(values);
-}
-
-export async function getVaultForOwner(subject: string, id: string): Promise<VaultBundle> {
-  const owner = ownerOf(subject);
-  if (parseId(id) === null) throw missing();
-  const rows = await getDb().select().from(vaults).where(and(eq(vaults.id, id), eq(vaults.owner, owner)));
-  const row = rows[0];
-  if (row === undefined) throw missing();
-  return { ...entryOf(row), envelope: isRecord(row.envelope) ? row.envelope : {} };
-}
-
-export async function deleteVaultForOwner(subject: string, id: string): Promise<{ id: string; name: string }> {
-  const owner = ownerOf(subject);
-  if (parseId(id) === null) throw missing();
-  const gone = await getDb()
-    .delete(vaults)
-    .where(and(eq(vaults.id, id), eq(vaults.owner, owner)))
-    .returning({ id: vaults.id, name: vaults.name });
-  const row = gone[0];
-  if (row === undefined) throw missing();
-  return row;
-}

package/runtime/node_modules/@metro-labs/mcp/src/server.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env bun
-import './daemon/boot.js';