@elizaos/agent 2.0.0-alpha.520 → 2.0.0-alpha.521

package/apps/app-steward/src/routes/wallet-browser-compat-routes.js

@@ -1,387 +0,0 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import crypto from "node:crypto";
-import { loadElizaConfig } from "@elizaos/agent/config/config";
-import { ensureCompatApiAuthorized } from "@elizaos/app-core/api/auth";
-import { readCompatJsonBody, } from "@elizaos/app-core/api/compat-route-shared";
-import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "@elizaos/app-core/api/response";
-import { ethers } from "ethers";
-import { deriveSolanaAddress } from "../api/wallet";
-import { resolveWalletRpcReadiness } from "../api/wallet-rpc";
-/** @internal Exported for testing. Parse a transaction value string to BigInt. */
-export function safeParseBigInt(value) {
-    try {
-        return BigInt(value);
-    }
-    catch {
-        throw new Error(`Invalid transaction value: expected an integer or hex string, got "${value}"`);
-    }
-}
-import { isStewardConfigured, signViaSteward } from "./steward-bridge";
-function normalizeHexData(value) {
-    if (typeof value !== "string") {
-        return undefined;
-    }
-    const trimmed = value.trim();
-    if (!trimmed) {
-        return undefined;
-    }
-    return trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
-}
-function normalizeString(value) {
-    if (typeof value !== "string") {
-        return undefined;
-    }
-    const trimmed = value.trim();
-    return trimmed ? trimmed : undefined;
-}
-function normalizeBoolean(value, fallback) {
-    return typeof value === "boolean" ? value : fallback;
-}
-const SOLANA_PKCS8_DER_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
-const B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
-function resolveLocalBrowserWallet() {
-    const evmKey = normalizeString(process.env.EVM_PRIVATE_KEY);
-    if (!evmKey) {
-        throw new Error("Local wallet signing is unavailable.");
-    }
-    return new ethers.Wallet(evmKey.startsWith("0x") ? evmKey : `0x${evmKey}`);
-}
-function base58Decode(value) {
-    if (!value.length) {
-        return Buffer.alloc(0);
-    }
-    let number = 0n;
-    for (const character of value) {
-        const index = B58.indexOf(character);
-        if (index === -1) {
-            throw new Error(`Invalid base58 character: ${character}`);
-        }
-        number = number * 58n + BigInt(index);
-    }
-    const hex = number.toString(16);
-    const bytes = Buffer.from(hex.length % 2 === 0 ? hex : `0${hex}`, "hex");
-    let leadingZeroes = 0;
-    for (const character of value) {
-        if (character !== "1") {
-            break;
-        }
-        leadingZeroes += 1;
-    }
-    return leadingZeroes
-        ? Buffer.concat([Buffer.alloc(leadingZeroes), bytes])
-        : bytes;
-}
-function decodeLocalSolanaPrivateKey(value) {
-    const trimmed = value.trim();
-    if (trimmed.startsWith("[") &&
-        trimmed.endsWith("]") &&
-        /^\[\s*\d/.test(trimmed)) {
-        const parsed = JSON.parse(trimmed);
-        if (!Array.isArray(parsed) ||
-            !parsed.every((entry) => typeof entry === "number")) {
-            throw new Error("Invalid Solana private key JSON array.");
-        }
-        return Buffer.from(parsed);
-    }
-    return base58Decode(trimmed);
-}
-function resolveLocalSolanaSeed() {
-    const solanaKey = normalizeString(process.env.SOLANA_PRIVATE_KEY);
-    if (!solanaKey) {
-        throw new Error("Local Solana signing is unavailable.");
-    }
-    const decoded = decodeLocalSolanaPrivateKey(solanaKey);
-    const seed = decoded.length === 64
-        ? decoded.subarray(0, 32)
-        : decoded.length === 32
-            ? decoded
-            : null;
-    if (!seed) {
-        throw new Error(`Invalid Solana private key length: expected 32 or 64 bytes, got ${decoded.length}.`);
-    }
-    return {
-        address: deriveSolanaAddress(solanaKey),
-        seed,
-    };
-}
-function resolveSolanaMessageBytes(body) {
-    const messageBase64 = normalizeString(body.messageBase64);
-    if (messageBase64) {
-        return Buffer.from(messageBase64, "base64");
-    }
-    const message = normalizeString(body.message);
-    if (!message) {
-        throw new Error("message or messageBase64 is required.");
-    }
-    return Buffer.from(message, "utf8");
-}
-let cachedRpcReadiness = null;
-let cachedRpcReadinessAt = 0;
-const RPC_CACHE_TTL_MS = 30_000;
-function resolvePreferredRpcUrl(chainId) {
-    const now = Date.now();
-    if (!cachedRpcReadiness || now - cachedRpcReadinessAt > RPC_CACHE_TTL_MS) {
-        cachedRpcReadiness = resolveWalletRpcReadiness(loadElizaConfig());
-        cachedRpcReadinessAt = now;
-    }
-    const readiness = cachedRpcReadiness;
-    switch (chainId) {
-        case 1:
-            return readiness.ethereumRpcUrls[0] ?? null;
-        case 56:
-        case 97:
-            return readiness.bscRpcUrls[0] ?? null;
-        case 8453:
-            return readiness.baseRpcUrls[0] ?? null;
-        case 43114:
-            return readiness.avalancheRpcUrls[0] ?? null;
-        default:
-            return null;
-    }
-}
-async function sendLocalBrowserWalletTransaction(request) {
-    if (request.broadcast === false) {
-        throw new Error("Local browser wallet signing currently requires broadcast=true.");
-    }
-    const rpcUrl = resolvePreferredRpcUrl(request.chainId);
-    if (!rpcUrl) {
-        throw new Error(`No RPC URL configured for chain ${request.chainId}.`);
-    }
-    const provider = new ethers.JsonRpcProvider(rpcUrl);
-    try {
-        const wallet = resolveLocalBrowserWallet().connect(provider);
-        const txResponse = await wallet.sendTransaction({
-            chainId: request.chainId,
-            data: request.data,
-            to: request.to,
-            value: safeParseBigInt(request.value),
-        });
-        return {
-            approved: true,
-            mode: "local-key",
-            pending: false,
-            txHash: txResponse.hash,
-        };
-    }
-    finally {
-        provider.destroy();
-    }
-}
-function resolveBrowserWalletMessagePayload(message) {
-    const trimmed = message.trim();
-    if (trimmed.startsWith("0x") &&
-        trimmed.length >= 4 &&
-        trimmed.length % 2 === 0) {
-        try {
-            return ethers.getBytes(trimmed);
-        }
-        catch {
-            return message;
-        }
-    }
-    return message;
-}
-async function signLocalBrowserWalletMessage(message) {
-    const wallet = resolveLocalBrowserWallet();
-    return {
-        mode: "local-key",
-        signature: await wallet.signMessage(resolveBrowserWalletMessagePayload(message)),
-    };
-}
-async function signLocalBrowserSolanaMessage(body) {
-    const { address, seed } = resolveLocalSolanaSeed();
-    const privateKey = crypto.createPrivateKey({
-        key: Buffer.concat([SOLANA_PKCS8_DER_PREFIX, seed]),
-        format: "der",
-        type: "pkcs8",
-    });
-    const signature = crypto.sign(null, resolveSolanaMessageBytes(body), privateKey);
-    return {
-        address,
-        mode: "local-key",
-        signatureBase64: signature.toString("base64"),
-    };
-}
-const SOLANA_WEB3_PACKAGE = "@solana/web3.js";
-async function loadSolanaWeb3() {
-    return (await import(__rewriteRelativeImportExtension(SOLANA_WEB3_PACKAGE)));
-}
-function normalizeSolanaCluster(value) {
-    if (value === "devnet" || value === "testnet" || value === "mainnet") {
-        return value;
-    }
-    return "mainnet";
-}
-function clusterRpcUrl(cluster) {
-    switch (cluster) {
-        case "devnet":
-            return "https://api.devnet.solana.com";
-        case "testnet":
-            return "https://api.testnet.solana.com";
-        default:
-            return "https://api.mainnet-beta.solana.com";
-    }
-}
-async function signLocalBrowserSolanaTransaction(body) {
-    const transactionBase64 = normalizeString(body.transactionBase64);
-    if (!transactionBase64) {
-        throw new Error("transactionBase64 is required.");
-    }
-    const broadcast = normalizeBoolean(body.broadcast, false);
-    const cluster = normalizeSolanaCluster(body.cluster);
-    const { address, seed } = resolveLocalSolanaSeed();
-    const web3 = await loadSolanaWeb3();
-    const { Keypair, VersionedTransaction, Transaction, Connection } = web3;
-    const keypair = Keypair.fromSeed(new Uint8Array(seed));
-    const txBytes = Buffer.from(transactionBase64, "base64");
-    // Solana transactions have a single-byte version prefix on v0/versioned
-    // transactions (high bit set). Try the versioned path first; fall back to
-    // legacy on parse failure to support both shapes uniformly.
-    let signedBytes;
-    let broadcastSignature;
-    try {
-        const versioned = VersionedTransaction.deserialize(txBytes);
-        versioned.sign([keypair]);
-        signedBytes = versioned.serialize();
-        if (broadcast) {
-            const conn = new Connection(clusterRpcUrl(cluster), "confirmed");
-            broadcastSignature = await conn.sendRawTransaction(signedBytes);
-        }
-    }
-    catch (_err) {
-        const legacy = Transaction.from(txBytes);
-        legacy.partialSign(keypair);
-        signedBytes = legacy.serialize();
-        if (broadcast) {
-            const conn = new Connection(clusterRpcUrl(cluster), "confirmed");
-            broadcastSignature = await conn.sendRawTransaction(signedBytes);
-        }
-    }
-    return {
-        address,
-        mode: "local-key",
-        signedTransactionBase64: Buffer.from(signedBytes).toString("base64"),
-        ...(broadcastSignature ? { signature: broadcastSignature } : {}),
-        cluster,
-    };
-}
-export async function handleWalletBrowserCompatRoutes(req, res, _state) {
-    const method = (req.method ?? "GET").toUpperCase();
-    const url = new URL(req.url ?? "/", "http://localhost");
-    if (method !== "POST" ||
-        (url.pathname !== "/api/wallet/browser-transaction" &&
-            url.pathname !== "/api/wallet/browser-sign-message" &&
-            url.pathname !== "/api/wallet/browser-solana-sign-message" &&
-            url.pathname !== "/api/wallet/browser-solana-transaction")) {
-        return false;
-    }
-    if (!ensureCompatApiAuthorized(req, res)) {
-        return true;
-    }
-    const body = await readCompatJsonBody(req, res);
-    if (!body) {
-        return true;
-    }
-    const hasLocalKey = Boolean(normalizeString(process.env.EVM_PRIVATE_KEY));
-    const hasLocalSolanaKey = Boolean(normalizeString(process.env.SOLANA_PRIVATE_KEY));
-    let stewardError = null;
-    if (url.pathname === "/api/wallet/browser-sign-message") {
-        const message = normalizeString(body.message);
-        if (!message) {
-            sendJsonErrorResponse(res, 400, "message is required.");
-            return true;
-        }
-        if (hasLocalKey) {
-            try {
-                sendJsonResponse(res, 200, await signLocalBrowserWalletMessage(message));
-                return true;
-            }
-            catch (error) {
-                const failureMessage = error instanceof Error ? error.message : String(error);
-                sendJsonErrorResponse(res, 503, failureMessage);
-                return true;
-            }
-        }
-        sendJsonErrorResponse(res, 503, isStewardConfigured()
-            ? "Browser message signing currently requires a local wallet key."
-            : "No browser wallet signer is available.");
-        return true;
-    }
-    if (url.pathname === "/api/wallet/browser-solana-sign-message") {
-        if (hasLocalSolanaKey) {
-            try {
-                sendJsonResponse(res, 200, await signLocalBrowserSolanaMessage(body));
-                return true;
-            }
-            catch (error) {
-                const failureMessage = error instanceof Error ? error.message : String(error);
-                sendJsonErrorResponse(res, 503, failureMessage);
-                return true;
-            }
-        }
-        sendJsonErrorResponse(res, 503, "No browser Solana signer is available.");
-        return true;
-    }
-    if (url.pathname === "/api/wallet/browser-solana-transaction") {
-        if (hasLocalSolanaKey) {
-            try {
-                sendJsonResponse(res, 200, await signLocalBrowserSolanaTransaction(body));
-                return true;
-            }
-            catch (error) {
-                const failureMessage = error instanceof Error ? error.message : String(error);
-                sendJsonErrorResponse(res, 503, failureMessage);
-                return true;
-            }
-        }
-        sendJsonErrorResponse(res, 503, "No browser Solana transaction signer is available.");
-        return true;
-    }
-    const request = {
-        broadcast: normalizeBoolean(body.broadcast, true),
-        chainId: typeof body.chainId === "number" && Number.isFinite(body.chainId)
-            ? body.chainId
-            : Number.NaN,
-        data: normalizeHexData(body.data),
-        description: normalizeString(body.description),
-        to: normalizeString(body.to) ?? "",
-        value: normalizeString(body.value) ?? "0",
-    };
-    if (!request.to || !request.value || !Number.isFinite(request.chainId)) {
-        sendJsonErrorResponse(res, 400, "to, value, and a valid chainId are required.");
-        return true;
-    }
-    if (isStewardConfigured()) {
-        try {
-            const result = await signViaSteward(request);
-            sendJsonResponse(res, 200, {
-                ...result,
-                mode: "steward",
-            });
-            return true;
-        }
-        catch (error) {
-            stewardError = error instanceof Error ? error : new Error(String(error));
-        }
-    }
-    if (hasLocalKey) {
-        try {
-            sendJsonResponse(res, 200, await sendLocalBrowserWalletTransaction(request));
-            return true;
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            sendJsonErrorResponse(res, 503, message);
-            return true;
-        }
-    }
-    sendJsonErrorResponse(res, 503, stewardError?.message || "No browser wallet signer is available.");
-    return true;
-}

package/apps/app-steward/src/routes/wallet-bsc-core-routes.d.ts

@@ -1,15 +0,0 @@
-/**
- * BSC wallet trade routes wrapper — wraps handleWalletBscRoutes for plugin
- * route registration.
- *
- * Handles:
- *   POST /api/wallet/trade/preflight
- *   POST /api/wallet/trade/quote
- *   GET  /api/wallet/trade/tx-status
- *   GET  /api/wallet/trading/profile
- *   POST /api/wallet/transfer/execute
- *   POST /api/wallet/production-defaults
- */
-import type http from "node:http";
-export declare function handleWalletBscCoreRoutes(req: http.IncomingMessage, res: http.ServerResponse, _state: unknown): Promise<boolean>;
-//# sourceMappingURL=wallet-bsc-core-routes.d.ts.map

package/apps/app-steward/src/routes/wallet-bsc-core-routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wallet-bsc-core-routes.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-steward/src/routes/wallet-bsc-core-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAyBlC,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,OAAO,CAAC,CAmClB"}

package/apps/app-steward/src/routes/wallet-bsc-core-routes.js

@@ -1,42 +0,0 @@
-import { loadElizaConfig, saveElizaConfig } from "@elizaos/agent/config/config";
-import { readCompatJsonBody } from "@elizaos/app-core/api/compat-route-shared";
-import { sendJson, sendJsonError } from "@elizaos/app-core/api/response";
-import { buildBscTradePreflight, buildBscTradeQuote, resolvePrimaryBscRpcUrl, } from "../api/bsc-trade";
-import { getWalletAddresses } from "../api/wallet";
-import { handleWalletBscRoutes } from "../api/wallet-bsc-routes";
-import { resolveWalletRpcReadiness } from "../api/wallet-rpc";
-import { loadWalletTradingProfile, updateWalletTradeLedgerEntryStatus, } from "../api/wallet-trading-profile";
-import { canUseLocalTradeExecution, resolveTradePermissionMode, } from "./server-wallet-trade";
-function isAgentAutomationRequest(req) {
-    return req.headers["x-eliza-agent-automation"] === "1";
-}
-export async function handleWalletBscCoreRoutes(req, res, _state) {
-    const method = req.method?.toUpperCase() ?? "GET";
-    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-    const pathname = url.pathname;
-    const config = loadElizaConfig();
-    return handleWalletBscRoutes({
-        req,
-        res,
-        method,
-        pathname,
-        url,
-        state: { config },
-        json: (r, data, status) => sendJson(r, status ?? 200, data),
-        error: (r, message, status) => sendJsonError(r, status ?? 500, message),
-        readJsonBody: readCompatJsonBody,
-        deps: {
-            getWalletAddresses,
-            resolveWalletRpcReadiness,
-            resolvePrimaryBscRpcUrl,
-            buildBscTradePreflight,
-            buildBscTradeQuote,
-            updateWalletTradeLedgerEntryStatus: updateWalletTradeLedgerEntryStatus,
-            loadWalletTradingProfile: loadWalletTradingProfile,
-            resolveTradePermissionMode: resolveTradePermissionMode,
-            isAgentAutomationRequest,
-            canUseLocalTradeExecution: canUseLocalTradeExecution,
-            saveElizaConfig: saveElizaConfig,
-        },
-    });
-}

package/apps/app-steward/src/routes/wallet-compat-routes.d.ts

@@ -1,13 +0,0 @@
-/**
- * Wallet OS-store, keys, and NFT compat routes.
- *
- * Handles:
- *   GET  /api/wallet/os-store  — keychain/secret-service backend status
- *   POST /api/wallet/os-store  — migrate / delete wallet secrets in OS store
- *   GET  /api/wallet/keys      — EVM + Solana keys (loopback + onboarding gate)
- *   GET  /api/wallet/nfts      — EVM NFT fetch
- */
-import type http from "node:http";
-import { type CompatRuntimeState } from "@elizaos/app-core/api/compat-route-shared";
-export declare function handleWalletCompatRoutes(req: http.IncomingMessage, res: http.ServerResponse, _state: CompatRuntimeState): Promise<boolean>;
-//# sourceMappingURL=wallet-compat-routes.d.ts.map

package/apps/app-steward/src/routes/wallet-compat-routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wallet-compat-routes.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-steward/src/routes/wallet-compat-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,2CAA2C,CAAC;AAoBnD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,OAAO,CAAC,CAqNlB"}

package/apps/app-steward/src/routes/wallet-compat-routes.js

@@ -1,200 +0,0 @@
-import { loadElizaConfig, } from "@elizaos/agent/config/config";
-import { ensureCompatApiAuthorized, ensureCompatSensitiveRouteAuthorized, getCompatApiToken, isDevEnvironment, } from "@elizaos/app-core/api/auth";
-import { isLoopbackRemoteAddress, readCompatJsonBody, } from "@elizaos/app-core/api/compat-route-shared";
-import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "@elizaos/app-core/api/response";
-import { deriveAgentVaultId } from "@elizaos/app-core/security/agent-vault-id";
-import { createNodePlatformSecureStore, isWalletOsStoreReadEnabled, } from "@elizaos/app-core/security/platform-secure-store-node";
-import { logger } from "@elizaos/core";
-import { getWalletAddresses } from "../api/wallet";
-import { fetchEvmNfts } from "../api/wallet-evm-balance";
-import { resolveWalletRpcReadiness } from "../api/wallet-rpc";
-import { deleteWalletSecretsFromOsStore, migrateWalletPrivateKeysToOsStore, } from "../security/wallet-os-store-actions";
-import { getStewardBridgeStatus, isStewardConfigured } from "./steward-bridge";
-export async function handleWalletCompatRoutes(req, res, _state) {
-    const method = (req.method ?? "GET").toUpperCase();
-    const url = new URL(req.url ?? "/", "http://localhost");
-    // Quick prefix check — all routes here live under /api/wallet/
-    if (!url.pathname.startsWith("/api/wallet/")) {
-        return false;
-    }
-    // ── GET /api/wallet/os-store ─────────────────────────────────────────
-    if (method === "GET" && url.pathname === "/api/wallet/os-store") {
-        if (!ensureCompatApiAuthorized(req, res)) {
-            return true;
-        }
-        try {
-            const store = createNodePlatformSecureStore();
-            const available = await store.isAvailable();
-            sendJsonResponse(res, 200, {
-                backend: store.backend,
-                available,
-                readEnabled: isWalletOsStoreReadEnabled(),
-                vaultId: deriveAgentVaultId(),
-            });
-        }
-        catch (err) {
-            logger.warn(`[wallet][os-store] GET status failed: ${err instanceof Error ? err.message : String(err)}`);
-            sendJsonResponse(res, 500, { error: "os-store status failed" });
-        }
-        return true;
-    }
-    // ── POST /api/wallet/os-store ────────────────────────────────────────
-    if (method === "POST" && url.pathname === "/api/wallet/os-store") {
-        if (!ensureCompatSensitiveRouteAuthorized(req, res)) {
-            return true;
-        }
-        const body = await readCompatJsonBody(req, res);
-        if (!body) {
-            return true;
-        }
-        const action = typeof body.action === "string" ? body.action.trim() : "";
-        try {
-            if (action === "migrate") {
-                const result = await migrateWalletPrivateKeysToOsStore();
-                if (result.unavailable) {
-                    sendJsonResponse(res, 503, {
-                        ok: false,
-                        error: "OS secret store unavailable on this host",
-                    });
-                    return true;
-                }
-                sendJsonResponse(res, 200, {
-                    ok: true,
-                    migrated: result.migrated,
-                    failed: result.failed,
-                });
-                return true;
-            }
-            if (action === "delete") {
-                await deleteWalletSecretsFromOsStore();
-                sendJsonResponse(res, 200, { ok: true });
-                return true;
-            }
-        }
-        catch (err) {
-            logger.warn(`[wallet][os-store] POST failed: ${err instanceof Error ? err.message : String(err)}`);
-            sendJsonResponse(res, 500, {
-                error: err instanceof Error ? err.message : "os-store action failed",
-            });
-            return true;
-        }
-        sendJsonResponse(res, 400, { error: "Unknown action" });
-        return true;
-    }
-    // ── GET /api/wallet/keys (onboarding only, loopback only) ────────────
-    // Security note: this compat route exists only for the embedded desktop
-    // onboarding flow, where the renderer needs to display the keys already
-    // generated inside the local runtime. Electrobun injects a loopback
-    // `http://127.0.0.1:<port>` API base plus a generated API token before the
-    // renderer mounts, and ensureCompatSensitiveRouteAuthorized fails closed if
-    // that token is missing. The route is also permanently disabled once
-    // onboardingComplete flips true so the backup screen cannot be reopened as a
-    // general-purpose key export endpoint.
-    if (method === "GET" && url.pathname === "/api/wallet/keys") {
-        if (!isLoopbackRemoteAddress(req.socket.remoteAddress)) {
-            sendJsonErrorResponse(res, 403, "loopback only");
-            return true;
-        }
-        // In production without a configured token, reject even from loopback.
-        // Electrobun injects a generated token before the renderer mounts; a
-        // missing token signals the renderer has not been properly initialised.
-        if (!isDevEnvironment() && !getCompatApiToken()) {
-            sendJsonErrorResponse(res, 403, "Sensitive endpoint requires API token authentication");
-            return true;
-        }
-        if (!ensureCompatSensitiveRouteAuthorized(req, res)) {
-            return true;
-        }
-        const config = loadElizaConfig();
-        if (config.meta?.onboardingComplete === true) {
-            sendJsonResponse(res, 403, {
-                error: "Wallet keys are only available during onboarding",
-            });
-            return true;
-        }
-        // When Steward is configured, return masked keys with Steward status
-        if (isStewardConfigured()) {
-            try {
-                const addresses = getWalletAddresses();
-                const stewardStatus = await getStewardBridgeStatus({
-                    evmAddress: addresses.evmAddress,
-                });
-                sendJsonResponse(res, 200, {
-                    evmPrivateKey: "[managed-by-steward]",
-                    evmAddress: addresses.evmAddress ?? stewardStatus.evmAddress ?? "",
-                    solanaPrivateKey: "[managed-by-steward]",
-                    solanaAddress: addresses.solanaAddress ?? "",
-                    steward: {
-                        configured: true,
-                        connected: stewardStatus.connected,
-                        agentId: stewardStatus.agentId,
-                    },
-                });
-                return true;
-            }
-            catch {
-                // fall through to legacy path
-            }
-        }
-        const evmKey = process.env.EVM_PRIVATE_KEY ?? "";
-        const solKey = process.env.SOLANA_PRIVATE_KEY ?? "";
-        try {
-            const addresses = getWalletAddresses();
-            sendJsonResponse(res, 200, {
-                evmPrivateKey: evmKey,
-                evmAddress: addresses.evmAddress ?? "",
-                solanaPrivateKey: solKey,
-                solanaAddress: addresses.solanaAddress ?? "",
-            });
-        }
-        catch {
-            sendJsonResponse(res, 200, {
-                evmPrivateKey: evmKey,
-                evmAddress: "",
-                solanaPrivateKey: solKey,
-                solanaAddress: "",
-            });
-        }
-        return true;
-    }
-    // ── GET /api/wallet/nfts ─────────────────────────────────────────────
-    if (method === "GET" && url.pathname === "/api/wallet/nfts") {
-        if (!ensureCompatApiAuthorized(req, res)) {
-            return true;
-        }
-        const config = loadElizaConfig();
-        const addresses = getWalletAddresses();
-        const rpcReadiness = resolveWalletRpcReadiness(config);
-        const alchemyKey = process.env.ALCHEMY_API_KEY?.trim() || null;
-        const ankrKey = process.env.ANKR_API_KEY?.trim() || null;
-        const result = {
-            evm: [],
-            solana: null,
-        };
-        if (addresses.evmAddress && rpcReadiness.evmBalanceReady) {
-            try {
-                result.evm = await fetchEvmNfts(addresses.evmAddress, {
-                    alchemyKey,
-                    ankrKey,
-                    cloudManagedAccess: rpcReadiness.cloudManagedAccess,
-                    bscRpcUrls: rpcReadiness.bscRpcUrls,
-                    ethereumRpcUrls: rpcReadiness.ethereumRpcUrls,
-                    baseRpcUrls: rpcReadiness.baseRpcUrls,
-                    avaxRpcUrls: rpcReadiness.avalancheRpcUrls,
-                    nodeRealBscRpcUrl: process.env.NODEREAL_BSC_RPC_URL,
-                    quickNodeBscRpcUrl: process.env.QUICKNODE_BSC_RPC_URL,
-                    bscRpcUrl: process.env.BSC_RPC_URL,
-                    ethereumRpcUrl: process.env.ETHEREUM_RPC_URL,
-                    baseRpcUrl: process.env.BASE_RPC_URL,
-                    avaxRpcUrl: process.env.AVALANCHE_RPC_URL,
-                });
-            }
-            catch (err) {
-                logger.warn(`[wallet] EVM NFT fetch failed: ${err}`);
-            }
-        }
-        sendJsonResponse(res, 200, result);
-        return true;
-    }
-    return false;
-}

package/apps/app-steward/src/routes/wallet-trade-compat-routes.d.ts

@@ -1,11 +0,0 @@
-/**
- * Wallet trade / transfer compat routes.
- *
- * Handles:
- *   POST /api/wallet/trade/execute    — BSC DEX trade execution
- *   POST /api/wallet/transfer/execute — token / BNB transfer execution
- */
-import type http from "node:http";
-import { type CompatRuntimeState } from "@elizaos/app-core/api/compat-route-shared";
-export declare function handleWalletTradeCompatRoutes(req: http.IncomingMessage, res: http.ServerResponse, _state: CompatRuntimeState): Promise<boolean>;
-//# sourceMappingURL=wallet-trade-compat-routes.d.ts.map

package/apps/app-steward/src/routes/wallet-trade-compat-routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wallet-trade-compat-routes.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-steward/src/routes/wallet-trade-compat-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,2CAA2C,CAAC;AAuInD,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,OAAO,CAAC,CAsjBlB"}