@elizaos/agent 2.0.0-beta.1 → 2.0.11-beta.5

package/runtime/agent-wallets.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Per-agent wallet keys, stored in the Eliza vault.
+ *
+ * This module is the bridge between agent identity and the vault. Each
+ * agent gets its own EVM and Solana keypair, stored under
+ * `agent.<agentId>.wallet.<chain>` as a JSON record. Private keys are
+ * sensitive and AES-GCM encrypted at rest by the vault; the vault's
+ * master key lives in the OS keychain.
+ *
+ * The runtime-wide single wallet (process.env.EVM_PRIVATE_KEY etc.) is
+ * the *user* wallet, hydrated from the OS secure store via
+ * `hydrateWalletKeysFromNodePlatformSecureStore`. Per-agent wallets are
+ * stored *inside* the vault (encrypted file), enumerable and easy to
+ * surface in the UI alongside saved logins.
+ *
+ * This module does not generate or store keys on its own; callers
+ * supply a `Vault` instance. Agent-creation lifecycle code wires this
+ * up — see `runtime/eliza.ts`.
+ */
+import type { WalletChain } from "@elizaos/shared";
+import { type Vault } from "@elizaos/vault";
+/** Public, non-sensitive description of an agent wallet. */
+export interface AgentWalletDescriptor {
+    readonly agentId: string;
+    readonly chain: WalletChain;
+    readonly address: string;
+    readonly lastModified: number;
+}
+declare function walletKey(agentId: string, chain: WalletChain): string;
+declare function agentPrefix(agentId: string): string;
+declare function parseAgentWalletKey(key: string): {
+    agentId: string;
+    chain: WalletChain;
+} | null;
+/**
+ * Derive the public address from a stored private key. EVM uses the
+ * existing helper; Solana stores the public key alongside the secret in
+ * `generateWalletForChain`, so the stored `address` is authoritative
+ * and we trust it for the read path.
+ */
+declare function deriveAddressFor(chain: WalletChain, privateKey: string): string;
+/**
+ * Read the public descriptor for an agent's wallet. Returns null when
+ * the agent has no wallet for that chain. Does NOT reveal the private
+ * key.
+ */
+export declare function getAgentWalletDescriptor(vault: Vault, agentId: string, chain: WalletChain): Promise<AgentWalletDescriptor | null>;
+/**
+ * Reveal the private key. Audit-logged via the vault. Use only for
+ * signing flows.
+ */
+export declare function revealAgentWalletPrivateKey(vault: Vault, agentId: string, chain: WalletChain, caller?: string): Promise<string>;
+/**
+ * Existence check. Does not reveal the key.
+ */
+export declare function hasAgentWallet(vault: Vault, agentId: string, chain: WalletChain): Promise<boolean>;
+/**
+ * List every wallet descriptor for an agent (typically [evm, solana]).
+ */
+export declare function listAgentWallets(vault: Vault, agentId: string): Promise<readonly AgentWalletDescriptor[]>;
+/**
+ * List every agent that has at least one wallet stored. Returns the
+ * agent IDs (decoded). Use for UI surfaces enumerating agent wallets.
+ */
+export declare function listAgentsWithWallets(vault: Vault): Promise<readonly string[]>;
+/**
+ * Persist a wallet for an agent. Replaces any existing entry for that
+ * (agentId, chain). Stamps `lastModified`.
+ *
+ * Caller is responsible for supplying the matching address — for EVM
+ * this can be derived from the private key, for Solana the keypair
+ * generator returns it directly.
+ */
+export declare function setAgentWallet(vault: Vault, agentId: string, chain: WalletChain, privateKey: string, address: string, caller?: string): Promise<AgentWalletDescriptor>;
+/**
+ * Generate a fresh wallet for an agent and persist it. Returns the
+ * public descriptor. Idempotent: callers should check `hasAgentWallet`
+ * first if they want to avoid replacing an existing wallet.
+ */
+export declare function generateAgentWallet(vault: Vault, agentId: string, chain: WalletChain, caller?: string): Promise<AgentWalletDescriptor>;
+/**
+ * Generate any missing wallets (EVM + Solana) for an agent. Existing
+ * wallets are left alone. Returns descriptors for every chain that now
+ * has a wallet (whether it was generated this call or was already
+ * present).
+ */
+export declare function ensureAgentWallets(vault: Vault, agentId: string, caller?: string): Promise<readonly AgentWalletDescriptor[]>;
+/**
+ * Make the per-agent wallet visible as the user wallet for THIS process.
+ *
+ * The wallet UI tab + every consumer plugin (`@elizaos/plugin-evm`,
+ * `@elizaos/plugin-solana`) reads from `process.env.EVM_PRIVATE_KEY` /
+ * `SOLANA_PRIVATE_KEY`. Per-agent wallets live in the vault, so without
+ * a bridge the UI shows "No EVM/Solana address" even though the agent
+ * has a perfectly good wallet sitting in the vault.
+ *
+ * ## Security trade-off — this is OPT-IN by default
+ *
+ * Writing a private key to `process.env` exposes it via:
+ *   - `/proc/self/environ` (readable by the same UID; some sandboxes leak more)
+ *   - crash dumps + core files
+ *   - any `JSON.stringify(process.env)` in error reports or telemetry
+ *   - inheritance into every spawned child process (default `env` for spawn)
+ *
+ * For most users on a single-user machine that's an acceptable trade —
+ * the agent IS the wallet, the box is the user's, and the convenience
+ * (wallet UI just works) outweighs the leak surface. But for shared
+ * machines, server deployments, or anyone with strict secrets hygiene,
+ * the leak surface is real.
+ *
+ * Default behavior: bridge is OFF. The wallet UI shows "No address"
+ * for the chain unless the user explicitly opts in via
+ * `ELIZA_AGENT_WALLET_AS_USER=1`. The proper fix is for consumer
+ * plugins to read from the vault directly via `getAgentWallet(agentId,
+ * chain)` instead of `process.env.*_PRIVATE_KEY` — when that
+ * migration lands, this whole bridge can be deleted.
+ */
+export declare function bridgeAgentWalletsToProcessEnv(vault: Vault, agentId: string, descriptors: readonly AgentWalletDescriptor[], caller?: string): Promise<void>;
+/**
+ * Remove an agent's wallet for one chain. Idempotent.
+ */
+export declare function removeAgentWallet(vault: Vault, agentId: string, chain: WalletChain): Promise<void>;
+/**
+ * Remove every wallet for an agent. Use during agent deletion.
+ */
+export declare function removeAllAgentWallets(vault: Vault, agentId: string): Promise<void>;
+export declare const __test__: {
+    walletKey: typeof walletKey;
+    agentPrefix: typeof agentPrefix;
+    parseAgentWalletKey: typeof parseAgentWalletKey;
+    deriveAddressFor: typeof deriveAddressFor;
+};
+export {};
+//# sourceMappingURL=agent-wallets.d.ts.map

package/runtime/agent-wallets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-wallets.d.ts","sourceRoot":"","sources":["../../src/runtime/agent-wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAiC,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAO3E,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAwBD,iBAAS,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAE9D;AAED,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,iBAAS,mBAAmB,CAC1B,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG,IAAI,CAUhD;AAsBD;;;;;GAKG;AACH,iBAAS,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CASxE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAWvC;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAgB3C;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAS5B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,CA+BhC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAa3C;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,SAAS,qBAAqB,EAAE,EAC7C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,eAAO,MAAM,QAAQ;;;;;CAKpB,CAAC"}

package/runtime/agent-wallets.js

@@ -0,0 +1,317 @@
+/**
+ * Per-agent wallet keys, stored in the Eliza vault.
+ *
+ * This module is the bridge between agent identity and the vault. Each
+ * agent gets its own EVM and Solana keypair, stored under
+ * `agent.<agentId>.wallet.<chain>` as a JSON record. Private keys are
+ * sensitive and AES-GCM encrypted at rest by the vault; the vault's
+ * master key lives in the OS keychain.
+ *
+ * The runtime-wide single wallet (process.env.EVM_PRIVATE_KEY etc.) is
+ * the *user* wallet, hydrated from the OS secure store via
+ * `hydrateWalletKeysFromNodePlatformSecureStore`. Per-agent wallets are
+ * stored *inside* the vault (encrypted file), enumerable and easy to
+ * surface in the UI alongside saved logins.
+ *
+ * This module does not generate or store keys on its own; callers
+ * supply a `Vault` instance. Agent-creation lifecycle code wires this
+ * up — see `runtime/eliza.ts`.
+ */
+import { logger } from "@elizaos/core";
+import { removeEntryMeta, setEntryMeta } from "@elizaos/vault";
+import { deriveEvmAddress, generateWalletForChain } from "../api/wallet.js";
+import { teeBootGateBlocksSecrets } from "../services/tee-boot-gate-state.js";
+const PREFIX = "agent";
+const SEGMENT = "wallet";
+function encodeAgentSegment(agentId) {
+    if (typeof agentId !== "string" || agentId.trim().length === 0) {
+        throw new TypeError("agent-wallets: agentId must be a non-empty string");
+    }
+    // encodeURIComponent leaves `.` alone, but our vault keys split on `.`
+    // — escape it explicitly so an agent ID like "alice.bob" doesn't bleed
+    // into the layout (`agent.alice.bob.wallet.evm` has five parts, not four).
+    return encodeURIComponent(agentId.trim()).replace(/\./g, "%2E");
+}
+function decodeAgentSegment(segment) {
+    return decodeURIComponent(segment);
+}
+function walletKey(agentId, chain) {
+    return `${PREFIX}.${encodeAgentSegment(agentId)}.${SEGMENT}.${chain}`;
+}
+function agentPrefix(agentId) {
+    return `${PREFIX}.${encodeAgentSegment(agentId)}.${SEGMENT}`;
+}
+function parseAgentWalletKey(key) {
+    // Layout: agent.<encodedId>.wallet.<chain>
+    const parts = key.split(".");
+    if (parts.length !== 4)
+        return null;
+    if (parts[0] !== PREFIX || parts[2] !== SEGMENT)
+        return null;
+    const encodedAgentId = parts[1];
+    if (!encodedAgentId)
+        return null;
+    const chain = parts[3];
+    if (chain !== "evm" && chain !== "solana")
+        return null;
+    return { agentId: decodeAgentSegment(encodedAgentId), chain };
+}
+function parseStored(raw) {
+    const parsed = JSON.parse(raw);
+    if ((parsed.chain !== "evm" && parsed.chain !== "solana") ||
+        typeof parsed.address !== "string" ||
+        typeof parsed.privateKey !== "string" ||
+        typeof parsed.lastModified !== "number") {
+        throw new Error("agent-wallets: stored entry malformed (expected chain/address/privateKey/lastModified)");
+    }
+    return {
+        chain: parsed.chain,
+        address: parsed.address,
+        privateKey: parsed.privateKey,
+        lastModified: parsed.lastModified,
+    };
+}
+/**
+ * Derive the public address from a stored private key. EVM uses the
+ * existing helper; Solana stores the public key alongside the secret in
+ * `generateWalletForChain`, so the stored `address` is authoritative
+ * and we trust it for the read path.
+ */
+function deriveAddressFor(chain, privateKey) {
+    if (chain === "evm")
+        return deriveEvmAddress(privateKey);
+    // For Solana the keypair format already includes the public key; the
+    // caller is expected to have stored the public key as `address` at
+    // write time. Re-derivation would require @solana/web3.js, which we
+    // avoid pulling in here.
+    throw new Error("agent-wallets: deriveAddressFor only supports EVM; Solana addresses must be supplied at write time");
+}
+/**
+ * Read the public descriptor for an agent's wallet. Returns null when
+ * the agent has no wallet for that chain. Does NOT reveal the private
+ * key.
+ */
+export async function getAgentWalletDescriptor(vault, agentId, chain) {
+    const key = walletKey(agentId, chain);
+    if (!(await vault.has(key)))
+        return null;
+    const raw = await vault.get(key);
+    const stored = parseStored(raw);
+    return {
+        agentId,
+        chain,
+        address: stored.address,
+        lastModified: stored.lastModified,
+    };
+}
+/**
+ * Reveal the private key. Audit-logged via the vault. Use only for
+ * signing flows.
+ */
+export async function revealAgentWalletPrivateKey(vault, agentId, chain, caller) {
+    // Fail-closed under a blocking TEE boot gate: a signing private key is a
+    // high-value secret and must not be revealed when TEE evidence is not
+    // trusted. Inert when no TEE policy is configured (the gate is unset/not
+    // required), so normal/local-only boots are unaffected.
+    if (teeBootGateBlocksSecrets()) {
+        throw new Error(`[TeeBootGate] agent-wallet private-key reveal blocked: TEE evidence is not trusted (agentId=${agentId}, chain=${chain}).`);
+    }
+    const key = walletKey(agentId, chain);
+    const raw = await vault.reveal(key, caller);
+    return parseStored(raw).privateKey;
+}
+/**
+ * Existence check. Does not reveal the key.
+ */
+export async function hasAgentWallet(vault, agentId, chain) {
+    return vault.has(walletKey(agentId, chain));
+}
+/**
+ * List every wallet descriptor for an agent (typically [evm, solana]).
+ */
+export async function listAgentWallets(vault, agentId) {
+    const keys = await vault.list(agentPrefix(agentId));
+    const out = [];
+    for (const key of keys) {
+        const parsed = parseAgentWalletKey(key);
+        if (!parsed)
+            continue;
+        const raw = await vault.get(key);
+        const stored = parseStored(raw);
+        out.push({
+            agentId: parsed.agentId,
+            chain: parsed.chain,
+            address: stored.address,
+            lastModified: stored.lastModified,
+        });
+    }
+    return out;
+}
+/**
+ * List every agent that has at least one wallet stored. Returns the
+ * agent IDs (decoded). Use for UI surfaces enumerating agent wallets.
+ */
+export async function listAgentsWithWallets(vault) {
+    const keys = await vault.list(PREFIX);
+    const agents = new Set();
+    for (const key of keys) {
+        const parsed = parseAgentWalletKey(key);
+        if (!parsed)
+            continue;
+        agents.add(parsed.agentId);
+    }
+    return [...agents];
+}
+/**
+ * Persist a wallet for an agent. Replaces any existing entry for that
+ * (agentId, chain). Stamps `lastModified`.
+ *
+ * Caller is responsible for supplying the matching address — for EVM
+ * this can be derived from the private key, for Solana the keypair
+ * generator returns it directly.
+ */
+export async function setAgentWallet(vault, agentId, chain, privateKey, address, caller) {
+    if (typeof privateKey !== "string" || privateKey.trim().length === 0) {
+        throw new TypeError("agent-wallets: privateKey required");
+    }
+    if (typeof address !== "string" || address.trim().length === 0) {
+        throw new TypeError("agent-wallets: address required");
+    }
+    const stored = {
+        chain,
+        address,
+        privateKey,
+        lastModified: Date.now(),
+    };
+    const key = walletKey(agentId, chain);
+    await vault.set(key, JSON.stringify(stored), {
+        sensitive: true,
+        ...(caller ? { caller } : {}),
+    });
+    // Surface per-agent wallets in Settings → Vault → Secrets under the
+    // "Wallet" group. Without explicit meta, the inventory categorizer
+    // falls back to "plugin" for the `agent.<id>.wallet.<chain>` shape.
+    await setEntryMeta(vault, key, {
+        category: "wallet",
+        label: `agent ${agentId} (${chain})`,
+    });
+    return {
+        agentId,
+        chain,
+        address: stored.address,
+        lastModified: stored.lastModified,
+    };
+}
+/**
+ * Generate a fresh wallet for an agent and persist it. Returns the
+ * public descriptor. Idempotent: callers should check `hasAgentWallet`
+ * first if they want to avoid replacing an existing wallet.
+ */
+export async function generateAgentWallet(vault, agentId, chain, caller) {
+    const generated = generateWalletForChain(chain);
+    return setAgentWallet(vault, agentId, chain, generated.privateKey, generated.address, caller);
+}
+/**
+ * Generate any missing wallets (EVM + Solana) for an agent. Existing
+ * wallets are left alone. Returns descriptors for every chain that now
+ * has a wallet (whether it was generated this call or was already
+ * present).
+ */
+export async function ensureAgentWallets(vault, agentId, caller) {
+    const chains = ["evm", "solana"];
+    const out = [];
+    for (const chain of chains) {
+        const existing = await getAgentWalletDescriptor(vault, agentId, chain);
+        if (existing) {
+            out.push(existing);
+            continue;
+        }
+        out.push(await generateAgentWallet(vault, agentId, chain, caller));
+    }
+    await bridgeAgentWalletsToProcessEnv(vault, agentId, out, caller);
+    return out;
+}
+/** Env var the wallet UI + EVM/Solana plugins read for the user wallet. */
+const CHAIN_TO_ENV_KEY = {
+    evm: "EVM_PRIVATE_KEY",
+    solana: "SOLANA_PRIVATE_KEY",
+};
+/**
+ * Make the per-agent wallet visible as the user wallet for THIS process.
+ *
+ * The wallet UI tab + every consumer plugin (`@elizaos/plugin-evm`,
+ * `@elizaos/plugin-solana`) reads from `process.env.EVM_PRIVATE_KEY` /
+ * `SOLANA_PRIVATE_KEY`. Per-agent wallets live in the vault, so without
+ * a bridge the UI shows "No EVM/Solana address" even though the agent
+ * has a perfectly good wallet sitting in the vault.
+ *
+ * ## Security trade-off — this is OPT-IN by default
+ *
+ * Writing a private key to `process.env` exposes it via:
+ *   - `/proc/self/environ` (readable by the same UID; some sandboxes leak more)
+ *   - crash dumps + core files
+ *   - any `JSON.stringify(process.env)` in error reports or telemetry
+ *   - inheritance into every spawned child process (default `env` for spawn)
+ *
+ * For most users on a single-user machine that's an acceptable trade —
+ * the agent IS the wallet, the box is the user's, and the convenience
+ * (wallet UI just works) outweighs the leak surface. But for shared
+ * machines, server deployments, or anyone with strict secrets hygiene,
+ * the leak surface is real.
+ *
+ * Default behavior: bridge is OFF. The wallet UI shows "No address"
+ * for the chain unless the user explicitly opts in via
+ * `ELIZA_AGENT_WALLET_AS_USER=1`. The proper fix is for consumer
+ * plugins to read from the vault directly via `getAgentWallet(agentId,
+ * chain)` instead of `process.env.*_PRIVATE_KEY` — when that
+ * migration lands, this whole bridge can be deleted.
+ */
+export async function bridgeAgentWalletsToProcessEnv(vault, agentId, descriptors, caller) {
+    // Default off. Skipping bridge unless explicitly opted in.
+    if (process.env.ELIZA_AGENT_WALLET_AS_USER !== "1")
+        return;
+    // Fail-closed under a blocking TEE boot gate: do not write private keys into
+    // process.env when TEE evidence is not trusted. Skip-with-warn so the boot
+    // continues secret-less. Inert when no TEE policy is configured.
+    if (teeBootGateBlocksSecrets()) {
+        logger.warn({ agentId }, "[TeeBootGate] Skipping agent-wallet → process.env bridge: TEE evidence is not trusted.");
+        return;
+    }
+    for (const d of descriptors) {
+        const envKey = CHAIN_TO_ENV_KEY[d.chain];
+        if (process.env[envKey]?.trim())
+            continue; // user-set wins
+        try {
+            const pk = await revealAgentWalletPrivateKey(vault, agentId, d.chain, caller ?? "agent-wallets:bridge");
+            process.env[envKey] = pk;
+        }
+        catch {
+            // Vault read failed — leave env unset; the wallet UI will show
+            // empty for that chain and the user can re-enter via Settings.
+        }
+    }
+}
+/**
+ * Remove an agent's wallet for one chain. Idempotent.
+ */
+export async function removeAgentWallet(vault, agentId, chain) {
+    const key = walletKey(agentId, chain);
+    await vault.remove(key);
+    await removeEntryMeta(vault, key);
+}
+/**
+ * Remove every wallet for an agent. Use during agent deletion.
+ */
+export async function removeAllAgentWallets(vault, agentId) {
+    const wallets = await listAgentWallets(vault, agentId);
+    for (const w of wallets) {
+        await removeAgentWallet(vault, agentId, w.chain);
+    }
+}
+// Internal helpers — exported for tests only.
+export const __test__ = {
+    walletKey,
+    agentPrefix,
+    parseAgentWalletKey,
+    deriveAddressFor,
+};

package/runtime/android-app-plugins.d.ts

@@ -0,0 +1,4 @@
+export declare const appWifiPlugin: import("@elizaos/core").Plugin;
+export declare const appContactsPlugin: import("@elizaos/core").Plugin;
+export declare const appPhonePlugin: import("@elizaos/core").Plugin;
+//# sourceMappingURL=android-app-plugins.d.ts.map

package/runtime/android-app-plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"android-app-plugins.d.ts","sourceRoot":"","sources":["../../src/runtime/android-app-plugins.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,aAAa,gCAGzB,CAAC;AACF,eAAO,MAAM,iBAAiB,gCAG7B,CAAC;AACF,eAAO,MAAM,cAAc,gCAG1B,CAAC"}

package/runtime/android-app-plugins.js

@@ -0,0 +1,40 @@
+import { gatePluginSessionForHostedApp } from "../services/app-session-gate.js";
+import { STATIC_ELIZA_PLUGINS } from "./plugin-types.js";
+const WIFI_APP_NAME = "@elizaos/plugin-wifi";
+const CONTACTS_APP_NAME = "@elizaos/plugin-contacts";
+const PHONE_APP_NAME = "@elizaos/plugin-phone";
+const [{ contactsProvider, appContactsPlugin: rawContactsPlugin }, { phoneCallLogProvider, appPhonePlugin: rawPhonePlugin }, { appWifiPlugin: rawWifiPlugin, wifiNetworksProvider },] = await Promise.all([
+    import(/* @vite-ignore */ "@elizaos/plugin-contacts"),
+    import(/* @vite-ignore */ "@elizaos/plugin-phone"),
+    import(/* @vite-ignore */ "@elizaos/plugin-wifi"),
+]);
+export const appWifiPlugin = gatePluginSessionForHostedApp(rawWifiPlugin, WIFI_APP_NAME);
+export const appContactsPlugin = gatePluginSessionForHostedApp(rawContactsPlugin, CONTACTS_APP_NAME);
+export const appPhonePlugin = gatePluginSessionForHostedApp(rawPhonePlugin, PHONE_APP_NAME);
+const appWifiPluginModule = {
+    default: appWifiPlugin,
+    appWifiPlugin,
+    wifiNetworksProvider,
+};
+const appContactsPluginModule = {
+    default: appContactsPlugin,
+    appContactsPlugin,
+    contactsProvider,
+};
+const appPhonePluginModule = {
+    default: appPhonePlugin,
+    appPhonePlugin,
+    phoneCallLogProvider,
+};
+Object.assign(STATIC_ELIZA_PLUGINS, {
+    [WIFI_APP_NAME]: appWifiPluginModule,
+    [CONTACTS_APP_NAME]: appContactsPluginModule,
+    [PHONE_APP_NAME]: appPhonePluginModule,
+});
+// Pin to globalThis so Bun.build's tree-shaker keeps the symbols even though
+// the runtime resolves plugins by name.
+globalThis.__elizaAndroidAppPlugins = {
+    wifi: appWifiPluginModule,
+    contacts: appContactsPluginModule,
+    phone: appPhonePluginModule,
+};

package/runtime/boot-telemetry.d.ts

@@ -0,0 +1,36 @@
+import type { BootSummary } from "./boot-timer.ts";
+/**
+ * Persist a boot run: enrich the boot summary with process memory + uptime and
+ * write a timestamped record plus `latest.json` under
+ * `<stateDir>/telemetry/boot/`. Returns immediately when telemetry is disabled.
+ * Resolves once the write completes (or fails safely); callers should `void` it
+ * after boot so it never delays readiness.
+ */
+export declare function recordBootTelemetry(summary: BootSummary): Promise<void>;
+/**
+ * Append a boot/(re)start event to
+ * `<stateDir>/telemetry/restart/events.json` (a bounded rolling array). Unlike
+ * {@link recordBootTelemetry}, which only fires once a boot *completes*, this is
+ * called at the very start of every boot, so a restart storm — where boots never
+ * finish — is still countable. The dev boot-history endpoint surfaces the array
+ * so an operator can see restart cadence. Best-effort; never throws, never
+ * delays boot (callers should `void` it). Returns immediately when telemetry is
+ * disabled.
+ */
+export declare function recordBootEvent(label: string): Promise<void>;
+/** Options for {@link startMemorySampler}. */
+export interface MemorySamplerOptions {
+    /** Sampling interval in milliseconds. */
+    intervalMs: number;
+}
+/**
+ * Begin periodically sampling `process.memoryUsage().rss`, tracking the peak.
+ * On `beforeExit`/`SIGTERM` (or {@link stopMemorySampler}) the run is flushed to
+ * `<stateDir>/telemetry/memory/latest.json`. The interval is `unref()`'d so it
+ * never keeps the process alive. Returns immediately when telemetry is disabled
+ * or a sampler is already running.
+ */
+export declare function startMemorySampler(options: MemorySamplerOptions): void;
+/** Stop the active memory sampler and flush a final snapshot to disk. */
+export declare function stopMemorySampler(): void;
+//# sourceMappingURL=boot-telemetry.d.ts.map

package/runtime/boot-telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-telemetry.d.ts","sourceRoot":"","sources":["../../src/runtime/boot-telemetry.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAoGnD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7E;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ClE;AAED,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;CACpB;AASD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAiDtE;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC"}