@stage-labs/metro 0.1.0-beta.76 → 0.1.0-beta.78

package/dist/bedrock-proxy.js

@@ -1,260 +0,0 @@
-import { createServer, } from 'node:http';
-import { EventStreamDecoder } from './bedrock-eventstream.js';
-import { callBedrock, freshAdaptations, invoke, invokeUrl, upstreamMessage, } from './bedrock-upstream.js';
-export class BedrockConfigError extends Error {
-}
-class ProxyError extends Error {
-    status;
-    kind;
-    constructor(status, kind, message) {
-        super(message);
-        this.status = status;
-        this.kind = kind;
-    }
-}
-const ANTHROPIC_VERSION = 'bedrock-2023-05-31';
-const BODY_MAX = 64 * 1024 * 1024;
-const MESSAGES_PATH = '/v1/messages';
-const COUNT_PATH = '/v1/messages/count_tokens';
-function firstEnv(env, names) {
-    for (const name of names) {
-        const value = env[name]?.trim() ?? '';
-        if (value !== '')
-            return value;
-    }
-    return '';
-}
-export function bedrockConfigFromEnv(env = process.env) {
-    const bearerToken = firstEnv(env, ['AWS_BEARER_TOKEN_BEDROCK']);
-    if (bearerToken === '')
-        throw new BedrockConfigError('AWS_BEARER_TOKEN_BEDROCK is not set. Create an Amazon Bedrock API key in the AWS console (Bedrock → API keys) and export it.');
-    const region = firstEnv(env, ['METRO_BEDROCK_REGION', 'AWS_REGION', 'AWS_DEFAULT_REGION']);
-    if (region === '')
-        throw new BedrockConfigError('no AWS region: set AWS_REGION (or METRO_BEDROCK_REGION) to the region your Bedrock API key belongs to');
-    const model = firstEnv(env, ['METRO_BEDROCK_MODEL']);
-    return { region, bearerToken, model: model === '' ? null : model };
-}
-const PREFIXES = [
-    [/^us-gov-/, 'us-gov'],
-    [/^us-/, 'us'],
-    [/^eu-/, 'eu'],
-    [/^ap-/, 'apac'],
-];
-export function regionPrefix(region) {
-    for (const [pattern, prefix] of PREFIXES)
-        if (pattern.test(region))
-            return prefix;
-    return 'global';
-}
-export function mapModel(requested, cfg) {
-    if (cfg.model !== null)
-        return cfg.model;
-    if (requested.includes('anthropic.'))
-        return requested;
-    return `${regionPrefix(cfg.region)}.anthropic.${requested}`;
-}
-export const upstreamBase = (cfg, override) => override ?? `https://bedrock-runtime.${cfg.region}.amazonaws.com`;
-function splitBetas(header) {
-    const raw = Array.isArray(header) ? header.join(',') : (header ?? '');
-    return raw
-        .split(',')
-        .map((b) => b.trim())
-        .filter((b) => b !== '');
-}
-export function rewriteBody(raw, betaHeader, cfg) {
-    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
-        throw new ProxyError(400, 'invalid_request_error', 'body must be a JSON object');
-    const { model, stream, ...rest } = raw;
-    if (typeof model !== 'string' || model === '')
-        throw new ProxyError(400, 'invalid_request_error', 'model is required');
-    const betas = splitBetas(betaHeader);
-    const body = { ...rest, anthropic_version: ANTHROPIC_VERSION };
-    if (betas.length > 0)
-        body.anthropic_beta = betas;
-    return { modelId: mapModel(model, cfg), stream: stream === true, body, betas };
-}
-export function errorKind(status, errorType) {
-    if (status === 429 || errorType === 'ThrottlingException')
-        return 'rate_limit_error';
-    if (status === 400)
-        return 'invalid_request_error';
-    if (status === 401)
-        return 'authentication_error';
-    if (status === 403)
-        return 'permission_error';
-    if (status === 404)
-        return 'not_found_error';
-    if (status === 503)
-        return 'overloaded_error';
-    return 'api_error';
-}
-function sendError(res, status, kind, message) {
-    res.writeHead(status, { 'content-type': 'application/json' });
-    res.end(JSON.stringify({ type: 'error', error: { type: kind, message } }));
-}
-async function readBody(req) {
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of req) {
-        const buf = chunk;
-        total += buf.length;
-        if (total > BODY_MAX)
-            throw new ProxyError(413, 'invalid_request_error', 'request too large');
-        chunks.push(buf);
-    }
-    try {
-        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
-    }
-    catch {
-        throw new ProxyError(400, 'invalid_request_error', 'body must be JSON');
-    }
-}
-async function relayError(upstream, res) {
-    const text = await upstream.text();
-    const kind = errorKind(upstream.status, upstream.headers.get('x-amzn-errortype'));
-    sendError(res, upstream.status, kind, upstreamMessage(text));
-}
-function eventTypeOf(event) {
-    try {
-        const parsed = JSON.parse(event);
-        return typeof parsed.type === 'string' ? parsed.type : 'message';
-    }
-    catch {
-        return 'message';
-    }
-}
-function writeEvent(res, message) {
-    if (message.headers[':message-type'] === 'event') {
-        const parsed = JSON.parse(message.payload.toString('utf8'));
-        if (typeof parsed.bytes !== 'string')
-            return;
-        const event = Buffer.from(parsed.bytes, 'base64').toString('utf8');
-        res.write(`event: ${eventTypeOf(event)}\ndata: ${event}\n\n`);
-        return;
-    }
-    const errorType = message.headers[':exception-type'] ?? message.headers[':error-code'] ?? null;
-    const body = {
-        type: 'error',
-        error: {
-            type: errorKind(500, errorType),
-            message: upstreamMessage(message.payload.toString('utf8')),
-        },
-    };
-    res.write(`event: error\ndata: ${JSON.stringify(body)}\n\n`);
-}
-async function relayStream(upstream, res) {
-    res.writeHead(200, {
-        'content-type': 'text/event-stream',
-        'cache-control': 'no-store',
-        connection: 'keep-alive',
-    });
-    const body = upstream.body;
-    if (body === null) {
-        res.end();
-        return;
-    }
-    const decoder = new EventStreamDecoder();
-    const reader = body.getReader();
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        for (const message of decoder.push(Buffer.from(value)))
-            writeEvent(res, message);
-    }
-    res.end();
-}
-async function relayJson(upstream, res) {
-    const text = await upstream.text();
-    res.writeHead(200, { 'content-type': 'application/json' });
-    res.end(text);
-}
-async function handleMessages(req, res, up) {
-    const rewritten = rewriteBody(await readBody(req), req.headers['anthropic-beta'], up.cfg);
-    const controller = new AbortController();
-    res.on('close', () => {
-        if (!res.writableEnded)
-            controller.abort();
-    });
-    const upstream = await invoke(up, rewritten, controller.signal);
-    if (!upstream.ok) {
-        await relayError(upstream, res);
-        return;
-    }
-    if (rewritten.stream)
-        await relayStream(upstream, res);
-    else
-        await relayJson(upstream, res);
-}
-function estimateTokens(body) {
-    return Math.ceil(JSON.stringify(body).length / 4);
-}
-async function handleCount(req, res, up) {
-    const rewritten = rewriteBody(await readBody(req), req.headers['anthropic-beta'], up.cfg);
-    const controller = new AbortController();
-    const upstream = await callBedrock(up, invokeUrl(up, rewritten.modelId, 'count-tokens'), { input: { invokeModel: { body: JSON.stringify(rewritten.body) } } }, 'application/json', controller.signal);
-    const text = await upstream.text();
-    let counted = null;
-    if (upstream.ok) {
-        const parsed = JSON.parse(text);
-        if (typeof parsed.inputTokens === 'number')
-            counted = parsed.inputTokens;
-    }
-    res.writeHead(200, { 'content-type': 'application/json' });
-    res.end(JSON.stringify({ input_tokens: counted ?? estimateTokens(rewritten.body) }));
-}
-function presentedToken(req) {
-    const auth = req.headers.authorization ?? '';
-    if (auth.toLowerCase().startsWith('bearer '))
-        return auth.slice(7).trim();
-    const key = req.headers['x-api-key'];
-    return Array.isArray(key) ? (key[0] ?? '') : (key ?? '');
-}
-async function route(req, res, cfg, opts, learned) {
-    if (presentedToken(req) !== opts.token)
-        throw new ProxyError(401, 'authentication_error', 'unauthorized');
-    const path = (req.url ?? '').split('?')[0] ?? '';
-    const up = { cfg, base: upstreamBase(cfg, opts.upstream), learned };
-    if (req.method === 'POST' && path === MESSAGES_PATH)
-        return handleMessages(req, res, up);
-    if (req.method === 'POST' && path === COUNT_PATH)
-        return handleCount(req, res, up);
-    throw new ProxyError(404, 'not_found_error', 'not found');
-}
-function failed(res, err) {
-    if (res.headersSent) {
-        res.end();
-        return;
-    }
-    if (err instanceof ProxyError) {
-        sendError(res, err.status, err.kind, err.message);
-        return;
-    }
-    const message = err instanceof Error ? err.message : 'proxy failure';
-    sendError(res, 502, 'api_error', `metro bedrock proxy: ${message}`);
-}
-export function startBedrockProxy(cfg, opts) {
-    const learned = freshAdaptations();
-    const server = createServer((req, res) => {
-        route(req, res, cfg, opts, learned).catch((err) => {
-            failed(res, err);
-        });
-    });
-    return new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(opts.port ?? 0, '127.0.0.1', () => {
-            const address = server.address();
-            const port = typeof address === 'object' && address !== null ? address.port : 0;
-            resolve({
-                port,
-                server,
-                learned,
-                close: () => new Promise((done) => {
-                    server.close(() => {
-                        done();
-                    });
-                }),
-            });
-        });
-    });
-}

package/dist/bedrock-upstream.js

@@ -1,72 +0,0 @@
-export const freshAdaptations = () => ({
-    fields: new Set(),
-    dropBetas: false,
-});
-const EXTRA_INPUT_RE = /^([A-Za-z0-9_]+)(?:\.[^:]*)?: Extra inputs are not permitted/;
-const MAX_REPAIRS = 4;
-export function invokeUrl(up, modelId, action) {
-    return `${up.base}/model/${encodeURIComponent(modelId)}/${action}`;
-}
-export function callBedrock(up, url, body, accept, signal) {
-    return fetch(url, {
-        method: 'POST',
-        headers: {
-            authorization: `Bearer ${up.cfg.bearerToken}`,
-            'content-type': 'application/json',
-            accept,
-        },
-        body: JSON.stringify(body),
-        signal,
-    });
-}
-export function upstreamMessage(text) {
-    const fallback = text === '' ? 'Bedrock returned no body' : text;
-    try {
-        const parsed = JSON.parse(text);
-        const message = parsed.message ?? parsed.Message;
-        return typeof message === 'string' && message !== '' ? message : fallback;
-    }
-    catch {
-        return fallback;
-    }
-}
-const without = (body, keys) => Object.fromEntries(Object.entries(body).filter(([key]) => !keys.has(key)));
-function applyLearned(req, learned) {
-    const dropped = new Set(learned.fields);
-    if (learned.dropBetas)
-        dropped.add('anthropic_beta');
-    return {
-        body: without(req.body, dropped),
-        betas: learned.dropBetas ? [] : req.betas,
-    };
-}
-function repair(attempt, learned, message) {
-    const named = EXTRA_INPUT_RE.exec(message)?.[1];
-    if (named !== undefined && named in attempt.body) {
-        learned.fields.add(named);
-        process.stderr.write(`metro bedrock: Bedrock refused "${named}" (extra input); dropping it from every request\n`);
-        return { body: without(attempt.body, new Set([named])), betas: attempt.betas };
-    }
-    if (attempt.betas.length > 0) {
-        learned.dropBetas = true;
-        process.stderr.write(`metro bedrock: retrying without anthropic_beta [${attempt.betas.join(', ')}]\n`);
-        return { body: without(attempt.body, new Set(['anthropic_beta'])), betas: [] };
-    }
-    return null;
-}
-export async function invoke(up, req, signal) {
-    const action = req.stream ? 'invoke-with-response-stream' : 'invoke';
-    const accept = req.stream ? 'application/vnd.amazon.eventstream' : 'application/json';
-    const url = invokeUrl(up, req.modelId, action);
-    let attempt = applyLearned(req, up.learned);
-    for (let repairs = 0;; repairs += 1) {
-        const res = await callBedrock(up, url, attempt.body, accept, signal);
-        if (res.status !== 400 || repairs >= MAX_REPAIRS)
-            return res;
-        const text = await res.text();
-        const next = repair(attempt, up.learned, upstreamMessage(text));
-        if (next === null)
-            return new Response(text, { status: 400, headers: res.headers });
-        attempt = next;
-    }
-}

package/dist/bedrock.js

@@ -1,37 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { claudeArgs, runClaude } from './claude.js';
-import { bedrockConfigFromEnv, startBedrockProxy } from './bedrock-proxy.js';
-import { settingsConflicts, settingsFiles } from './claude-settings.js';
-import { PROVIDER_FLAGS } from './provider-flags.js';
-export { PROVIDER_FLAGS, settingsConflicts, settingsFiles };
-const SCRUBBED = [...PROVIDER_FLAGS, 'ANTHROPIC_API_KEY', 'AWS_BEARER_TOKEN_BEDROCK'];
-export function firstPartyModelId(bedrockId) {
-    return bedrockId.replace(/^(?:[a-z-]+\.)?anthropic\./, '').replace(/-v\d+:\d+$/, '');
-}
-export function claudeEnv(base, port, token, pinned = null) {
-    const kept = Object.entries(base).filter(([key]) => !SCRUBBED.includes(key));
-    const model = (base.ANTHROPIC_MODEL ?? '').trim();
-    return {
-        ...Object.fromEntries(kept),
-        ...(pinned !== null && model === '' && { ANTHROPIC_MODEL: firstPartyModelId(pinned) }),
-        ANTHROPIC_BASE_URL: `http://127.0.0.1:${String(port)}`,
-        ANTHROPIC_AUTH_TOKEN: token,
-    };
-}
-export async function bedrock(argv) {
-    const cfg = bedrockConfigFromEnv();
-    const conflicts = settingsConflicts(settingsFiles());
-    if (conflicts.length > 0)
-        throw new Error('metro bedrock: these settings would put Claude Code back on a third-party provider, or override the proxy. Remove them, or point CLAUDE_CONFIG_DIR at a separate profile:\n  ' +
-            conflicts.join('\n  '));
-    const token = `mb_${randomBytes(18).toString('base64url')}`;
-    const proxy = await startBedrockProxy(cfg, { token });
-    const pinned = cfg.model === null ? '' : ` (${cfg.model})`;
-    process.stderr.write(`metro bedrock: Claude Code → http://127.0.0.1:${String(proxy.port)} → Bedrock ${cfg.region}${pinned}\n`);
-    try {
-        return await runClaude(claudeArgs(argv), claudeEnv(process.env, proxy.port, token, cfg.model));
-    }
-    finally {
-        await proxy.close();
-    }
-}

package/runtime/node_modules/@metro-labs/mcp/package.json

@@ -1,64 +0,0 @@
-{
-  "name": "@metro-labs/mcp",
-  "version": "0.1.0-beta.15",
-  "private": true,
-  "description": "Event-interception wire. Supervises train subprocesses in ~/.metro/trains/, multiplexes their JSON event stream onto stdout, and routes outbound action calls back via stdin. Per-platform code is written by the agent (or user) as train scripts — metro core is pure transport.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/bonustrack/metro.git"
-  },
-  "homepage": "https://github.com/bonustrack/metro#readme",
-  "bugs": "https://github.com/bonustrack/metro/issues",
-  "type": "module",
-  "engines": {
-    "node": ">=22"
-  },
-  "exports": {
-    ".": "./src/mcp/index.ts",
-    "./log": "./src/daemon/log.ts",
-    "./train-error": "./src/daemon/train-error.ts",
-    "./secure-fs": "./src/daemon/secure-fs.ts",
-    "./lines": "./src/stations/lines.ts",
-    "./events": "./src/daemon/events.ts",
-    "./endpoints": "./src/daemon/tunnel.ts",
-    "./trains/protocol": "./src/daemon/protocol.ts",
-    "./stations/types": "./src/stations/types.ts",
-    "./stations/station-runtime": "./src/stations/station-runtime.ts",
-    "./stations/account-store": "./src/stations/account-store.ts",
-    "./stations/attachments": "./src/stations/attachments.ts",
-    "./stations/messaging-normalize": "./src/stations/messaging-normalize.ts"
-  },
-  "scripts": {
-    "start": "bun src/server.ts",
-    "build": "tsc",
-    "db:migrate": "drizzle-kit migrate",
-    "test": "tsc --noEmit && DYLD_FALLBACK_LIBRARY_PATH=/usr/lib METRO_STATE_DIR=\"$(mktemp -d /tmp/metro-test.XXXXXX)\" bun test test/"
-  },
-  "dependencies": {
-    "@metro-labs/discord-bot": "workspace:*",
-    "@metro-labs/telegram": "workspace:*",
-    "@metro-labs/telegram-bot": "workspace:*",
-    "@metro-labs/webhook": "workspace:*",
-    "@metro-labs/whatsapp": "workspace:*",
-    "@metro-labs/xmtp": "workspace:*",
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@noble/curves": "^1.9.7",
-    "drizzle-kit": "^0.31.0",
-    "drizzle-orm": "^0.44.0",
-    "pino": "^9.5.0",
-    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.5",
-    "viem": "2.52.2",
-    "ws": "^8.18.0",
-    "zod": "^3.23.8"
-  },
-  "devDependencies": {
-    "@stage-labs/config": "0.1.0-beta.2",
-    "@types/ws": "^8.18.0",
-    "eslint": "^10.3.0",
-    "knip": "^6.15.0",
-    "madge": "^8.0.0",
-    "typescript": "^5"
-  }
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/server-types.ts

@@ -1,21 +0,0 @@
-export interface ServerEntry {
-  id: string;
-  host: string;
-  name: string | null;
-  addedAt: string;
-}
-
-const HOST_RE = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/;
-const HOST_MAX = 253;
-const NAME_MAX = 40;
-
-export function parseServerHost(raw: string): string | null {
-  const host = raw.trim().toLowerCase();
-  return host.length <= HOST_MAX && HOST_RE.test(host) ? host : null;
-}
-
-export function parseServerName(raw: unknown): string | null {
-  if (typeof raw !== 'string') return null;
-  const name = raw.replace(/[\p{Cc}]/gu, '').trim().slice(0, NAME_MAX);
-  return name === '' ? null : name;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/servers-api.ts

@@ -1,80 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { log } from './log.js';
-import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { signedIdentity } from './signed-identity.js';
-import type { ServerEntry } from './server-types.js';
-import { parseId } from '../db/ids.js';
-
-const PREFIX = '/api/servers';
-
-export interface ServersApiDeps {
-  list: (subject: string) => Promise<ServerEntry[]>;
-  add: (subject: string, body: unknown) => Promise<ServerEntry>;
-  rename: (subject: string, id: string, body: unknown) => Promise<ServerEntry>;
-  remove: (subject: string, id: string) => Promise<{ id: string; host: string }>;
-}
-
-type Target = { kind: 'index' } | { kind: 'server'; id: string } | { kind: 'unknown' } | null;
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const id = parseId(segments[0] ?? '');
-  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'server', id };
-}
-
-const ALLOWED: Record<'index' | 'server', string[]> = { index: ['GET', 'POST'], server: ['PUT', 'DELETE'] };
-
-async function answer(
-  req: IncomingMessage,
-  deps: ServersApiDeps,
-  owner: string,
-  tgt: { kind: 'index' } | { kind: 'server'; id: string },
-): Promise<unknown> {
-  if (tgt.kind === 'index')
-    return req.method === 'GET' ? { servers: await deps.list(owner) } : deps.add(owner, await readJsonBody(req));
-  return req.method === 'DELETE' ? deps.remove(owner, tgt.id) : deps.rename(owner, tgt.id, await readJsonBody(req));
-}
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: ServersApiDeps,
-  tgt: { kind: 'index' } | { kind: 'server'; id: string },
-): Promise<void> {
-  try {
-    const owner = await signedIdentity(req);
-    if (owner === null) {
-      sendJson(req, res, 401, { error: 'unauthorized' });
-      return;
-    }
-    const body = await answer(req, deps, owner, tgt);
-    if (req.method !== 'GET') log.info({ method: req.method, target: tgt }, 'servers-api: list changed');
-    sendJson(req, res, 200, body);
-  } catch (err) {
-    apiFailure(req, res, err, 'servers-api');
-  }
-}
-
-export function handleServersApiRequest(req: IncomingMessage, res: ServerResponse, deps: ServersApiDeps): boolean {
-  const path = (req.url ?? '').split('?')[0] ?? '';
-  const tgt = target(path);
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such server' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  route(req, res, deps, tgt).catch((err: unknown) => {
-    apiFailure(req, res, err, 'servers-api');
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-api.ts

@@ -1,78 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from './log.js';
-import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { parseId } from '../db/ids.js';
-import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from './vault-types.js';
-import { signedIdentity } from './signed-identity.js';
-
-const PREFIX = '/api/vault';
-const BODY_MAX = ENVELOPE_MAX + 64 * 1024;
-
-export interface VaultApiDeps {
-  list: (subject: string) => Promise<VaultEntry[]>;
-  put: (subject: string, id: string, body: unknown) => Promise<VaultEntry>;
-  get: (subject: string, id: string) => Promise<VaultBundle>;
-  remove: (subject: string, id: string) => Promise<{ id: string; name: string }>;
-}
-
-type Target = { kind: 'index' } | { kind: 'bundle'; id: string } | { kind: 'unknown' } | null;
-
-function target(path: string): Target {
-  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
-  if (!path.startsWith(`${PREFIX}/`)) return null;
-  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
-  const id = parseId(segments[0] ?? '');
-  return id === null || segments.length !== 1 ? { kind: 'unknown' } : { kind: 'bundle', id };
-}
-
-const ALLOWED: Record<'index' | 'bundle', string[]> = { index: ['GET'], bundle: ['GET', 'PUT', 'DELETE'] };
-
-async function route(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: VaultApiDeps,
-  tgt: { kind: 'index' } | { kind: 'bundle'; id: string },
-): Promise<void> {
-  try {
-    const owner = await signedIdentity(req);
-    if (owner === null) {
-      sendJson(req, res, 401, { error: 'unauthorized' });
-      return;
-    }
-    if (tgt.kind === 'index') {
-      sendJson(req, res, 200, { entries: await deps.list(owner) });
-      return;
-    }
-    if (req.method === 'GET') sendJson(req, res, 200, await deps.get(owner, tgt.id));
-    else if (req.method === 'DELETE') sendJson(req, res, 200, await deps.remove(owner, tgt.id));
-    else {
-      const saved = await deps.put(owner, tgt.id, await readJsonBody(req, BODY_MAX));
-      log.info({ id: saved.id, name: saved.name }, 'vault-api: bundle stored');
-      sendJson(req, res, 200, saved);
-    }
-  } catch (err) {
-    apiFailure(req, res, err, 'vault-api');
-  }
-}
-
-export function handleVaultApiRequest(req: IncomingMessage, res: ServerResponse, deps: VaultApiDeps): boolean {
-  const tgt = target((req.url ?? '').split('?')[0] ?? '');
-  if (tgt === null) return false;
-  if (req.method === 'OPTIONS') {
-    res.writeHead(204, cors(req)).end();
-    return true;
-  }
-  if (tgt.kind === 'unknown') {
-    sendJson(req, res, 404, { error: 'no such bundle' });
-    return true;
-  }
-  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
-    sendJson(req, res, 405, { error: 'method not allowed' });
-    return true;
-  }
-  route(req, res, deps, tgt).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'vault-api: unhandled error');
-    if (!res.headersSent) sendJson(req, res, 500, { error: 'vault api failed' });
-  });
-  return true;
-}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-types.ts

@@ -1,12 +0,0 @@
-export interface VaultEntry {
-  id: string;
-  name: string;
-  stations: string[];
-  syncedAt: string;
-}
-
-export interface VaultBundle extends VaultEntry {
-  envelope: Record<string, unknown>;
-}
-
-export const ENVELOPE_MAX = 2 * 1024 * 1024;

package/runtime/node_modules/@metro-labs/mcp/src/db/client.ts

@@ -1,32 +0,0 @@
-import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js';
-import postgres from 'postgres';
-import { log } from '../daemon/log.js';
-import * as schema from './schema.js';
-
-export type Db = PostgresJsDatabase<typeof schema>;
-
-let sql: ReturnType<typeof postgres> | null = null;
-let db: Db | null = null;
-
-export function databaseUrl(): string | undefined {
-  const url = process.env.DATABASE_URL?.trim();
-  if (!url) return undefined;
-  return url;
-}
-
-export function getDb(): Db {
-  const url = databaseUrl();
-  if (!url) throw new Error('DATABASE_URL is not set');
-  if (!db) {
-    sql = postgres(url, {
-      max: 4,
-      prepare: false,
-      onnotice: (notice) => {
-        log.debug({ notice: notice.message }, 'postgres notice');
-      },
-    });
-    db = drizzle(sql, { schema });
-  }
-  return db;
-}
-