@elizaos/agent 2.0.0-beta.1 → 2.0.11-beta.5

package/services/tee-runtime-config.js

@@ -0,0 +1,109 @@
+import { readFile } from "node:fs/promises";
+import { teePolicyFromReleaseManifest, } from "./tee-release-policy.js";
+import { mergeTeeRevocationsIntoPolicy, verifyTeeRevocationManifest, } from "./tee-revocation.js";
+export async function resolveTeeRuntimePolicy(options = {}) {
+    const env = options.env ?? process.env;
+    const readText = options.readText ?? ((filePath) => readFile(filePath, "utf8"));
+    const inlinePolicy = env.ELIZA_TEE_POLICY_JSON;
+    if (inlinePolicy?.trim()) {
+        return withRuntimeRevocations(normalizeRuntimePolicy(JSON.parse(inlinePolicy), env, options.nowMs), env, readText);
+    }
+    const policyPath = env.ELIZA_TEE_POLICY_PATH;
+    if (policyPath?.trim()) {
+        return withRuntimeRevocations(normalizeRuntimePolicy(JSON.parse(await readText(policyPath.trim())), env, options.nowMs), env, readText);
+    }
+    const inlineManifest = env.ELIZA_TEE_RELEASE_MANIFEST_JSON;
+    if (inlineManifest?.trim()) {
+        return withRuntimeRevocations(teePolicyFromReleaseManifest(JSON.parse(inlineManifest), runtimePolicyOptions(env, options.nowMs)), env, readText);
+    }
+    const manifestPath = env.ELIZA_TEE_RELEASE_MANIFEST_PATH;
+    if (manifestPath?.trim()) {
+        return withRuntimeRevocations(teePolicyFromReleaseManifest(JSON.parse(await readText(manifestPath.trim())), runtimePolicyOptions(env, options.nowMs)), env, readText);
+    }
+    if (env.ELIZA_TEE_REQUIRED === "true") {
+        return withRuntimeRevocations({
+            required: true,
+            ...runtimePolicyOptions(env, options.nowMs),
+        }, env, readText);
+    }
+    return undefined;
+}
+function normalizeRuntimePolicy(value, env, nowMs) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("TEE policy must be a JSON object.");
+    }
+    return {
+        ...value,
+        ...runtimePolicyOptions(env, nowMs),
+    };
+}
+async function withRuntimeRevocations(policy, env, readText) {
+    const inlineRevocations = env.ELIZA_TEE_REVOCATIONS_JSON;
+    if (inlineRevocations?.trim()) {
+        return mergeTeeRevocationsIntoPolicy(policy, verifiedRevocationManifest(JSON.parse(inlineRevocations), env));
+    }
+    const revocationPath = env.ELIZA_TEE_REVOCATIONS_PATH;
+    if (revocationPath?.trim()) {
+        return mergeTeeRevocationsIntoPolicy(policy, verifiedRevocationManifest(JSON.parse(await readText(revocationPath.trim())), env));
+    }
+    return policy;
+}
+/**
+ * Verify the revocation manifest's signature before it is merged into the
+ * policy (plan §3.4 / A5). Refuses to merge an unsigned/invalid/untrusted
+ * manifest when a trusted authority key is configured via
+ * `ELIZA_TEE_REVOCATION_PUBKEY` (+ optional `ELIZA_TEE_REVOCATION_AUTHORITY`).
+ * A revocation list is security-relevant data: a tampered or forged one could
+ * silently un-revoke a compromised measurement, so this is fail-closed.
+ */
+function verifiedRevocationManifest(manifest, env) {
+    const result = verifyTeeRevocationManifest(manifest, {
+        trustedAuthorities: resolveRevocationAuthorities(manifest, env),
+    });
+    if (!result.verified) {
+        throw new Error(`TEE revocation manifest rejected: ${result.reason}${result.detail ? ` (${result.detail})` : ""}.`);
+    }
+    return manifest;
+}
+function resolveRevocationAuthorities(manifest, env) {
+    const pem = decodePublicKeyPem(env.ELIZA_TEE_REVOCATION_PUBKEY);
+    if (pem === undefined)
+        return {};
+    const authorityId = env.ELIZA_TEE_REVOCATION_AUTHORITY?.trim() || manifest.authority || "";
+    return { [authorityId]: pem };
+}
+/**
+ * Accept either a raw PEM (containing a BEGIN header) or a base64-encoded PEM
+ * (convenient for a single-line env var). Returns undefined when unset.
+ */
+function decodePublicKeyPem(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    if (trimmed.includes("-----BEGIN"))
+        return trimmed;
+    const decoded = Buffer.from(trimmed, "base64").toString("utf8");
+    if (!decoded.includes("-----BEGIN")) {
+        throw new Error("ELIZA_TEE_REVOCATION_PUBKEY must be a PEM public key or its base64 encoding.");
+    }
+    return decoded;
+}
+function runtimePolicyOptions(env, nowMs) {
+    const maxAgeMs = parseOptionalPositiveInteger(env.ELIZA_TEE_MAX_AGE_MS);
+    return {
+        ...(env.ELIZA_TEE_EXPECTED_NONCE === undefined
+            ? {}
+            : { expectedNonce: env.ELIZA_TEE_EXPECTED_NONCE }),
+        ...(maxAgeMs === undefined ? {} : { maxAgeMs }),
+        ...(nowMs === undefined ? {} : { nowMs }),
+    };
+}
+function parseOptionalPositiveInteger(value) {
+    if (value === undefined || !value.trim())
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+        throw new Error("ELIZA_TEE_MAX_AGE_MS must be a positive integer.");
+    }
+    return parsed;
+}

package/services/tee-sealed-volume.d.ts

@@ -0,0 +1,114 @@
+import type { TeeMeasurementName } from "./tee-evidence.ts";
+import type { TeeKeyReleaseClient, TeeKeyReleaseResult } from "./tee-key-release.ts";
+import type { TeeEvidencePolicy } from "./tee-policy.ts";
+/**
+ * Attestation-bound sealed state-volume key manager (plan §2.3 / Phase C item
+ * C3). Replaces dstack's host-readable LUKS2 key (GHSA-jxq2-hpw3-m5wf, plan
+ * §5.5) with a key that is RELEASED ONLY after a passing attestation.
+ *
+ * SCOPE OF THIS MODULE — the security-critical, host-agnostic binding layer:
+ * it requests the state-volume key through the existing attestation-gated
+ * key-release + policy path and refuses (fail-closed) when the evidence is not
+ * trusted or the boot gate already blocked secrets. The key is bound to the
+ * measured agent/policy/device identity, so a tampered OS/agent yields a
+ * DIFFERENT key and the volume simply will not decrypt — the negative path is
+ * enforced by *data unavailability*, not by a software flag that could be
+ * patched out. This mirrors the confidential-inference `model-key` unseal
+ * pattern (`tee-confidential-inference.ts`).
+ *
+ * NOT IN SCOPE — the OS layer (`packages/os/docs/tee-os-implementation-plan.md`
+ * §3.4): the dm-crypt/LUKS2 plumbing itself. A mount hook in the confidential
+ * guest calls {@link unsealStateVolumeKey} BEFORE mounting the state dir,
+ * hands the released key (or the LUKS passphrase recovered from the
+ * sealed metadata blob) to `cryptsetup`, and refuses to mount when this throws.
+ * That plumbing is host-specific and not unit-testable in memory; the
+ * attestation→key binding here is, and it is the part that matters for the
+ * security property.
+ *
+ * HARDWARE BOUNDARY (fail-closed): real TDX/CoVE quote-signature verification
+ * is BLOCKED on hardware (plan Phase B2/C1). This path verifies a normalized
+ * evidence document + measurement match via the key-release client only; it
+ * must not be presented as hardware-verified trust until B2/C1 land.
+ */
+/**
+ * Key-release scope for the per-user sealed state volume. Distinct from
+ * `model-key` so the volume key and the weights key derive from independent
+ * KMS-side material even under the same measured identity. Maps to a dstack
+ * `keyId` in production (plan §3.5).
+ */
+export declare const STATE_VOLUME_KEY_ID: "state-volume";
+/**
+ * Measurements that MUST be gated by the policy before the state-volume key is
+ * released. The volume holds the user's agent-session secret scope, so its key
+ * is bound to the measured agent, the release policy, and the device identity:
+ * change any one and the released key changes, and the volume will not mount.
+ */
+export declare const STATE_VOLUME_REQUIRED_MEASUREMENTS: readonly TeeMeasurementName[];
+export type UnsealStateVolumeKeyConfig = {
+    keyReleaseClient: TeeKeyReleaseClient;
+    policy: TeeEvidencePolicy;
+    /**
+     * Measurements the policy MUST gate before release. Defaults to
+     * {@link STATE_VOLUME_REQUIRED_MEASUREMENTS}. A caller may add more (e.g.
+     * `os`, `boot`) for a stricter mount.
+     */
+    requiredMeasurements?: readonly TeeMeasurementName[];
+    /** Optional KDF context forwarded to the key-release client. */
+    context?: string;
+};
+export type UnsealStateVolumeKeyResult = {
+    /**
+     * Released 32-byte volume key, hex-encoded. The OS-side mount hook hands this
+     * to dm-crypt/LUKS2 (or uses it to open {@link openSealedVolumeMetadata}).
+     * The caller must zeroize the derived buffer after handing it to the kernel
+     * keyring; it must never be written to disk, env, or the structured logger.
+     */
+    keyMaterialHex: string;
+    decision: TeeKeyReleaseResult["decision"];
+};
+/**
+ * Request the `state-volume` key, gated by the attestation policy. Fails closed
+ * when the boot gate already blocked secrets, when the policy does not gate the
+ * required measurements, or when the released decision is not trusted. On
+ * success returns the released key material for the OS layer to hand to
+ * dm-crypt/LUKS2.
+ */
+export declare function unsealStateVolumeKey(config: UnsealStateVolumeKeyConfig): Promise<UnsealStateVolumeKeyResult>;
+/**
+ * AES-256-GCM envelope holding small volume metadata — most importantly the
+ * actual LUKS2 passphrase. Storing the passphrase inside an attestation-bound
+ * envelope (rather than handing the released key directly to LUKS) lets the
+ * LUKS keyslot be re-keyed independently of the attested identity while keeping
+ * the *only* path to the passphrase gated on attestation. Same shape as
+ * `SealedWeightsBlob` so the binding property is end-to-end testable in memory.
+ */
+export type SealedVolumeMetadata = {
+    algorithm: "aes-256-gcm";
+    ivBase64: string;
+    authTagBase64: string;
+    ciphertextBase64: string;
+    /**
+     * SHA-256 of the plaintext metadata, verified after decrypt as defense in
+     * depth on top of the GCM auth tag.
+     */
+    metadataSha256: string;
+};
+/**
+ * Seal a small metadata blob (e.g. the LUKS2 passphrase envelope) under the
+ * attestation-released volume key. The key must be the 32-byte hex value from
+ * {@link unsealStateVolumeKey}. Used by the OS-side provisioning hook and by
+ * tests; mirrors the single-blob seal in `tee-confidential-inference.ts`.
+ */
+export declare function sealVolumeMetadata(input: {
+    metadata: Buffer;
+    keyMaterialHex: string;
+}): SealedVolumeMetadata;
+/**
+ * Open the sealed volume metadata with the attestation-released key. Because
+ * the key is bound to the measured identity, a key released for a DIFFERENT
+ * agent/policy/device fails the GCM auth-tag check here and yields no
+ * plaintext — proving the volume key is attestation-bound. The returned buffer
+ * holds the LUKS passphrase / metadata; the caller must zeroize it after use.
+ */
+export declare function openSealedVolumeMetadata(sealed: SealedVolumeMetadata, keyMaterialHex: string): Buffer;
+//# sourceMappingURL=tee-sealed-volume.d.ts.map

package/services/tee-sealed-volume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-sealed-volume.d.ts","sourceRoot":"","sources":["../../src/services/tee-sealed-volume.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAG,cAAuB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,kBAAkB,EACpC,CAAC;AAEzC,MAAM,MAAM,0BAA0B,GAAG;IACvC,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoCrC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,oBAAoB,CAsBvB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,cAAc,EAAE,MAAM,GACrB,MAAM,CA+BR"}

package/services/tee-sealed-volume.js

@@ -0,0 +1,161 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual, } from "node:crypto";
+import { teeBootGateBlocksSecrets } from "./tee-boot-gate-state.js";
+/**
+ * Attestation-bound sealed state-volume key manager (plan §2.3 / Phase C item
+ * C3). Replaces dstack's host-readable LUKS2 key (GHSA-jxq2-hpw3-m5wf, plan
+ * §5.5) with a key that is RELEASED ONLY after a passing attestation.
+ *
+ * SCOPE OF THIS MODULE — the security-critical, host-agnostic binding layer:
+ * it requests the state-volume key through the existing attestation-gated
+ * key-release + policy path and refuses (fail-closed) when the evidence is not
+ * trusted or the boot gate already blocked secrets. The key is bound to the
+ * measured agent/policy/device identity, so a tampered OS/agent yields a
+ * DIFFERENT key and the volume simply will not decrypt — the negative path is
+ * enforced by *data unavailability*, not by a software flag that could be
+ * patched out. This mirrors the confidential-inference `model-key` unseal
+ * pattern (`tee-confidential-inference.ts`).
+ *
+ * NOT IN SCOPE — the OS layer (`packages/os/docs/tee-os-implementation-plan.md`
+ * §3.4): the dm-crypt/LUKS2 plumbing itself. A mount hook in the confidential
+ * guest calls {@link unsealStateVolumeKey} BEFORE mounting the state dir,
+ * hands the released key (or the LUKS passphrase recovered from the
+ * sealed metadata blob) to `cryptsetup`, and refuses to mount when this throws.
+ * That plumbing is host-specific and not unit-testable in memory; the
+ * attestation→key binding here is, and it is the part that matters for the
+ * security property.
+ *
+ * HARDWARE BOUNDARY (fail-closed): real TDX/CoVE quote-signature verification
+ * is BLOCKED on hardware (plan Phase B2/C1). This path verifies a normalized
+ * evidence document + measurement match via the key-release client only; it
+ * must not be presented as hardware-verified trust until B2/C1 land.
+ */
+/**
+ * Key-release scope for the per-user sealed state volume. Distinct from
+ * `model-key` so the volume key and the weights key derive from independent
+ * KMS-side material even under the same measured identity. Maps to a dstack
+ * `keyId` in production (plan §3.5).
+ */
+export const STATE_VOLUME_KEY_ID = "state-volume";
+/**
+ * Measurements that MUST be gated by the policy before the state-volume key is
+ * released. The volume holds the user's agent-session secret scope, so its key
+ * is bound to the measured agent, the release policy, and the device identity:
+ * change any one and the released key changes, and the volume will not mount.
+ */
+export const STATE_VOLUME_REQUIRED_MEASUREMENTS = ["agent", "policy", "device"];
+/**
+ * Request the `state-volume` key, gated by the attestation policy. Fails closed
+ * when the boot gate already blocked secrets, when the policy does not gate the
+ * required measurements, or when the released decision is not trusted. On
+ * success returns the released key material for the OS layer to hand to
+ * dm-crypt/LUKS2.
+ */
+export async function unsealStateVolumeKey(config) {
+    // Fail closed if the one-time boot gate already determined that required TEE
+    // evidence was not trusted — the volume must not mount in that state.
+    if (teeBootGateBlocksSecrets()) {
+        throw new Error("state-volume key release refused: TEE boot gate blocks secrets (untrusted evidence at boot).");
+    }
+    const required = config.requiredMeasurements ?? STATE_VOLUME_REQUIRED_MEASUREMENTS;
+    assertPolicyGatesRequiredMeasurements(config.policy, required);
+    const release = await config.keyReleaseClient.releaseKey({
+        keyId: STATE_VOLUME_KEY_ID,
+        ...(config.context === undefined ? {} : { context: config.context }),
+        policy: config.policy,
+    });
+    if (!release.decision.trusted) {
+        throw new Error(`state-volume key release denied: ${release.decision.detail ?? release.decision.reason}`);
+    }
+    if (!/^[a-f0-9]{64}$/.test(release.keyMaterialHex)) {
+        throw new Error("state-volume key material must be 32 bytes (hex) for AES-256 / LUKS2.");
+    }
+    return {
+        keyMaterialHex: release.keyMaterialHex,
+        decision: release.decision,
+    };
+}
+/**
+ * Seal a small metadata blob (e.g. the LUKS2 passphrase envelope) under the
+ * attestation-released volume key. The key must be the 32-byte hex value from
+ * {@link unsealStateVolumeKey}. Used by the OS-side provisioning hook and by
+ * tests; mirrors the single-blob seal in `tee-confidential-inference.ts`.
+ */
+export function sealVolumeMetadata(input) {
+    const key = keyFromHex(input.keyMaterialHex);
+    try {
+        if (input.metadata.length === 0) {
+            throw new Error("cannot seal empty volume metadata.");
+        }
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(input.metadata),
+            cipher.final(),
+        ]);
+        return {
+            algorithm: "aes-256-gcm",
+            ivBase64: iv.toString("base64"),
+            authTagBase64: cipher.getAuthTag().toString("base64"),
+            ciphertextBase64: ciphertext.toString("base64"),
+            metadataSha256: createHash("sha256").update(input.metadata).digest("hex"),
+        };
+    }
+    finally {
+        key.fill(0);
+    }
+}
+/**
+ * Open the sealed volume metadata with the attestation-released key. Because
+ * the key is bound to the measured identity, a key released for a DIFFERENT
+ * agent/policy/device fails the GCM auth-tag check here and yields no
+ * plaintext — proving the volume key is attestation-bound. The returned buffer
+ * holds the LUKS passphrase / metadata; the caller must zeroize it after use.
+ */
+export function openSealedVolumeMetadata(sealed, keyMaterialHex) {
+    if (sealed.algorithm !== "aes-256-gcm") {
+        throw new Error(`Unsupported sealed-volume algorithm "${sealed.algorithm}".`);
+    }
+    const key = keyFromHex(keyMaterialHex);
+    try {
+        const iv = Buffer.from(sealed.ivBase64, "base64");
+        if (iv.length !== 12) {
+            throw new Error("AES-256-GCM IV must be 12 bytes.");
+        }
+        const decipher = createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(Buffer.from(sealed.authTagBase64, "base64"));
+        // A key derived from tampered evidence (wrong measured identity) fails the
+        // GCM tag check here rather than yielding usable plaintext.
+        const metadata = Buffer.concat([
+            decipher.update(Buffer.from(sealed.ciphertextBase64, "base64")),
+            decipher.final(),
+        ]);
+        const actualDigest = createHash("sha256").update(metadata).digest("hex");
+        if (!digestsEqual(actualDigest, sealed.metadataSha256)) {
+            metadata.fill(0);
+            throw new Error("Decrypted volume metadata digest does not match the sealed envelope.");
+        }
+        return metadata;
+    }
+    finally {
+        key.fill(0);
+    }
+}
+function keyFromHex(keyMaterialHex) {
+    const key = Buffer.from(keyMaterialHex, "hex");
+    if (key.length !== 32) {
+        throw new Error("volume key material must be 32 bytes for AES-256-GCM.");
+    }
+    return key;
+}
+function digestsEqual(a, b) {
+    const left = Buffer.from(a, "hex");
+    const right = Buffer.from(b, "hex");
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function assertPolicyGatesRequiredMeasurements(policy, required) {
+    const gated = policy.requiredMeasurements ?? {};
+    const missing = required.filter((name) => typeof gated[name] !== "string" || gated[name]?.trim() === "");
+    if (missing.length > 0) {
+        throw new Error(`state-volume policy does not gate required measurements: ${missing.join(", ")}.`);
+    }
+}

package/services/tee-signer-backend.d.ts

@@ -0,0 +1,18 @@
+import type { SignerBackend, UnsignedTransaction } from "./remote-signing-service.ts";
+import type { TeeEvidenceProvider } from "./tee-evidence.ts";
+import { type TeeEvidencePolicy, type TeeEvidencePolicyDecision } from "./tee-policy.ts";
+export type TeeSignerBackendConfig = {
+    signer: SignerBackend;
+    evidenceProvider: TeeEvidenceProvider;
+    policy: TeeEvidencePolicy;
+    onDecision?: (decision: TeeEvidencePolicyDecision) => void;
+};
+export declare class TeeSignerBackend implements SignerBackend {
+    private readonly config;
+    constructor(config: TeeSignerBackendConfig);
+    getAddress(): Promise<string>;
+    signMessage(message: string): Promise<string>;
+    signTransaction(tx: UnsignedTransaction): Promise<string>;
+    private requireTrustedTee;
+}
+//# sourceMappingURL=tee-signer-backend.d.ts.map

package/services/tee-signer-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-signer-backend.d.ts","sourceRoot":"","sources":["../../src/services/tee-signer-backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,yBAAyB,KAAK,IAAI,CAAC;CAC5D,CAAC;AAEF,qBAAa,gBAAiB,YAAW,aAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,sBAAsB;IAErD,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK7C,eAAe,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;YAKjD,iBAAiB;CAUhC"}

package/services/tee-signer-backend.js

@@ -0,0 +1,26 @@
+import { evaluateTeeEvidencePolicy, } from "./tee-policy.js";
+export class TeeSignerBackend {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async getAddress() {
+        return await this.config.signer.getAddress();
+    }
+    async signMessage(message) {
+        await this.requireTrustedTee();
+        return await this.config.signer.signMessage(message);
+    }
+    async signTransaction(tx) {
+        await this.requireTrustedTee();
+        return await this.config.signer.signTransaction(tx);
+    }
+    async requireTrustedTee() {
+        const evidence = await this.config.evidenceProvider.collectEvidence();
+        const decision = evaluateTeeEvidencePolicy(evidence, this.config.policy);
+        this.config.onDecision?.(decision);
+        if (!decision.trusted) {
+            throw new Error(`TEE signing policy rejected evidence: ${decision.detail ?? decision.reason}`);
+        }
+    }
+}

package/services/update-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-checker.d.ts","sourceRoot":"","sources":["../../src/services/update-checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAQ7E,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAItE,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AA6BD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,cAAc,CAI5E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8E7B;AAED,6DAA6D;AAC7D,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC,CACtC,CAOA"}

package/services/vault-signer-backend.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Vault-backed EVM signer. Implements `SignerBackend` over the per-agent
+ * EVM key stored in the Eliza vault (`agent.<id>.wallet.evm`).
+ *
+ * The private key is revealed from the vault on demand and used to build an
+ * ethers `Wallet` purely to produce a signature; it is never written to env,
+ * logged, or returned. `revealAgentWalletPrivateKey` is itself fail-closed
+ * under a blocking TEE boot gate, so this backend inherits that guard.
+ *
+ * EVM only: Solana signing would require `@solana/web3.js`, which the
+ * agent-wallet layer deliberately avoids pulling in. A Solana backend can be
+ * added separately when that dependency is acceptable.
+ */
+import type { Vault } from "@elizaos/vault";
+import type { SignerBackend, UnsignedTransaction } from "./remote-signing-service.ts";
+export interface VaultSignerBackendConfig {
+    readonly vault: Vault;
+    readonly agentId: string;
+    /** Audit caller tag forwarded to `vault.reveal`. */
+    readonly caller?: string;
+}
+export declare class VaultSignerBackend implements SignerBackend {
+    private readonly vault;
+    private readonly agentId;
+    private readonly caller;
+    constructor(config: VaultSignerBackendConfig);
+    getAddress(): Promise<string>;
+    signMessage(message: string): Promise<string>;
+    signTransaction(tx: UnsignedTransaction): Promise<string>;
+    private wallet;
+}
+//# sourceMappingURL=vault-signer-backend.d.ts.map

package/services/vault-signer-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-signer-backend.d.ts","sourceRoot":"","sources":["../../src/services/vault-signer-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AAErC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,kBAAmB,YAAW,aAAa;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,MAAM,EAAE,wBAAwB;IAStC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7C,eAAe,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;YAiBjD,MAAM;CASrB"}

package/services/vault-signer-backend.js

@@ -0,0 +1,57 @@
+/**
+ * Vault-backed EVM signer. Implements `SignerBackend` over the per-agent
+ * EVM key stored in the Eliza vault (`agent.<id>.wallet.evm`).
+ *
+ * The private key is revealed from the vault on demand and used to build an
+ * ethers `Wallet` purely to produce a signature; it is never written to env,
+ * logged, or returned. `revealAgentWalletPrivateKey` is itself fail-closed
+ * under a blocking TEE boot gate, so this backend inherits that guard.
+ *
+ * EVM only: Solana signing would require `@solana/web3.js`, which the
+ * agent-wallet layer deliberately avoids pulling in. A Solana backend can be
+ * added separately when that dependency is acceptable.
+ */
+import { ethers } from "ethers";
+import { revealAgentWalletPrivateKey } from "../runtime/agent-wallets.js";
+export class VaultSignerBackend {
+    vault;
+    agentId;
+    caller;
+    constructor(config) {
+        if (config.agentId.trim().length === 0) {
+            throw new TypeError("VaultSignerBackend: agentId must be non-empty");
+        }
+        this.vault = config.vault;
+        this.agentId = config.agentId;
+        this.caller = config.caller ?? "remote-signing:vault-signer";
+    }
+    async getAddress() {
+        return (await this.wallet()).address;
+    }
+    async signMessage(message) {
+        return (await this.wallet()).signMessage(message);
+    }
+    async signTransaction(tx) {
+        const wallet = await this.wallet();
+        const request = {
+            to: tx.to,
+            value: tx.value,
+            data: tx.data,
+            chainId: tx.chainId,
+        };
+        if (tx.nonce !== undefined)
+            request.nonce = tx.nonce;
+        if (tx.gasLimit !== undefined)
+            request.gasLimit = tx.gasLimit;
+        if (tx.maxFeePerGas !== undefined)
+            request.maxFeePerGas = tx.maxFeePerGas;
+        if (tx.maxPriorityFeePerGas !== undefined) {
+            request.maxPriorityFeePerGas = tx.maxPriorityFeePerGas;
+        }
+        return wallet.signTransaction(request);
+    }
+    async wallet() {
+        const privateKey = await revealAgentWalletPrivateKey(this.vault, this.agentId, "evm", this.caller);
+        return new ethers.Wallet(privateKey);
+    }
+}

package/services/version-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-compat.d.ts","sourceRoot":"","sources":["../../src/services/version-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,EAAE,OAAO,CAAC;IACpB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAC;IACpB,0BAA0B;IAC1B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAWhD,CAAC;AAiBF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,GACd,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAczC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAUrE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7E;AAMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAMD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,iBAAiB,EAAE,MAAM,EAAE,EAC3B,aAAa,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GACpD,MAAM,GAAG,IAAI,CAuDf"}