@elizaos/app-core 2.0.0-alpha.53 → 2.0.0-alpha.535

package/packages/agent/src/security/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./access.js";
+export * from "./audit-log.js";
+export * from "./network-policy.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/agent/src/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC"}

package/packages/agent/src/security/index.js

@@ -0,0 +1,3 @@
+export * from "./access.js";
+export * from "./audit-log.js";
+export * from "./network-policy.js";

package/packages/agent/src/security/network-policy.d.ts

@@ -0,0 +1,6 @@
+export declare function normalizeHostLike(value: string): string;
+export declare function decodeIpv6MappedHex(mapped: string): string | null;
+export declare function normalizeIpForPolicy(ip: string): string;
+export declare function isBlockedPrivateOrLinkLocalIp(ip: string): boolean;
+export declare function isLoopbackHost(host: string): boolean;
+//# sourceMappingURL=network-policy.d.ts.map

package/packages/agent/src/security/network-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/security/network-policy.ts"],"names":[],"mappings":"AAkBA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAajE;AAUD,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAmBvD;AAED,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAapD"}

package/packages/agent/src/security/network-policy.js

@@ -0,0 +1,85 @@
+import net from "node:net";
+const ALWAYS_BLOCKED_IP_PATTERNS = [
+    /^0\./, // "this" network
+    /^169\.254\./, // link-local / metadata
+    /^fe[89ab][0-9a-f]:/i, // IPv6 link-local fe80::/10
+    /^::$/i, // unspecified
+    /^::1$/i, // IPv6 loopback
+];
+const PRIVATE_IP_PATTERNS = [
+    /^10\./, // RFC1918
+    /^127\./, // loopback
+    /^172\.(1[6-9]|2\d|3[01])\./, // RFC1918
+    /^192\.168\./, // RFC1918
+    /^f[cd][0-9a-f]{2}:/i, // IPv6 ULA fc00::/7
+];
+export function normalizeHostLike(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "");
+}
+export function decodeIpv6MappedHex(mapped) {
+    const parts = mapped.split(":");
+    if (parts.length < 1 || parts.length > 2)
+        return null;
+    const parsed = parts.map((part) => {
+        if (!/^[0-9a-f]{1,4}$/i.test(part))
+            return Number.NaN;
+        return Number.parseInt(part, 16);
+    });
+    if (parsed.some((value) => !Number.isFinite(value)))
+        return null;
+    const [hi, lo] = parsed.length === 1 ? [0, parsed[0]] : parsed;
+    const octets = [hi >> 8, hi & 0xff, lo >> 8, lo & 0xff];
+    return octets.join(".");
+}
+function canonicalizeIpv6(ip) {
+    try {
+        return new URL(`http://[${ip}]/`).hostname.replace(/^\[|\]$/g, "");
+    }
+    catch {
+        return null;
+    }
+}
+export function normalizeIpForPolicy(ip) {
+    const base = normalizeHostLike(ip).split("%")[0];
+    if (!base)
+        return base;
+    let normalized = base;
+    if (net.isIP(normalized) === 6) {
+        normalized = canonicalizeIpv6(normalized) ?? normalized;
+    }
+    let mapped = null;
+    if (normalized.startsWith("::ffff:")) {
+        mapped = normalized.slice("::ffff:".length);
+    }
+    else if (normalized.startsWith("0:0:0:0:0:ffff:")) {
+        mapped = normalized.slice("0:0:0:0:0:ffff:".length);
+    }
+    if (!mapped)
+        return normalized;
+    if (net.isIP(mapped) === 4)
+        return mapped;
+    return decodeIpv6MappedHex(mapped) ?? normalized;
+}
+export function isBlockedPrivateOrLinkLocalIp(ip) {
+    const normalized = normalizeIpForPolicy(ip);
+    if (ALWAYS_BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized))) {
+        return true;
+    }
+    return PRIVATE_IP_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+export function isLoopbackHost(host) {
+    const normalized = normalizeIpForPolicy(host);
+    if (!normalized)
+        return false;
+    if (normalized === "localhost" || normalized === "::1") {
+        return true;
+    }
+    // Accept only IPv4 literals in 127.0.0.0/8, not hostnames that prefix-match.
+    if (net.isIP(normalized) === 4) {
+        return normalized.startsWith("127.");
+    }
+    return false;
+}

package/packages/agent/src/services/agent-export.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Agent Export/Import Service
+ *
+ * Provides encrypted, portable agent archives for migrating agents between
+ * machines. Captures all database state (character, memories, entities,
+ * relationships, rooms, participants, worlds, tasks, and optionally logs)
+ * into a single password-encrypted binary file (.eliza-agent).
+ *
+ * Encryption: PBKDF2-SHA256 key derivation + AES-256-GCM
+ * Compression: gzip
+ *
+ * File format (binary):
+ *   ELIZA_AGENT_V1\n   (15 bytes magic header)
+ *   iterations           (4 bytes uint32 BE — PBKDF2 iteration count)
+ *   salt                 (32 bytes — PBKDF2 salt)
+ *   iv                   (12 bytes — AES-256-GCM nonce)
+ *   tag                  (16 bytes — AES-GCM authentication tag)
+ *   ciphertext           (variable — gzip-compressed JSON, encrypted)
+ */
+import type { Agent, AgentRuntime, Component, Entity, Log, Memory, Relationship, Room, Task, World } from "@elizaos/core";
+export interface AgentExportOptions {
+    /** Include execution logs in the export. Can be large. Defaults to false. */
+    includeLogs?: boolean;
+}
+export interface AgentExportPayload {
+    version: number;
+    exportedAt: string;
+    sourceAgentId: string;
+    agent: Partial<Agent>;
+    /** Runtime character config (from buildCharacterFromConfig) — may contain
+     *  fields not persisted to the DB agent record (style, topics, adjectives,
+     *  messageExamples, postExamples, knowledge sources, etc.). On import, this
+     *  is merged with the agent record to reconstruct the full character. */
+    characterConfig?: Record<string, unknown>;
+    entities: Entity[];
+    memories: Memory[];
+    components: Component[];
+    rooms: Room[];
+    participants: Array<{
+        entityId: string;
+        roomId: string;
+        userState: string | null;
+    }>;
+    relationships: Relationship[];
+    worlds: World[];
+    tasks: Task[];
+    logs: Log[];
+}
+export interface ImportResult {
+    success: boolean;
+    agentId: string;
+    agentName: string;
+    counts: {
+        memories: number;
+        entities: number;
+        components: number;
+        rooms: number;
+        participants: number;
+        relationships: number;
+        worlds: number;
+        tasks: number;
+        logs: number;
+    };
+}
+export interface ExportSizeEstimate {
+    estimatedBytes: number;
+    memoriesCount: number;
+    entitiesCount: number;
+    roomsCount: number;
+    worldsCount: number;
+    tasksCount: number;
+}
+export declare class AgentExportError extends Error {
+    constructor(message: string);
+}
+/**
+ * Export the current agent's full state as a password-encrypted binary file.
+ *
+ * @param runtime - The running AgentRuntime with an active database adapter
+ * @param password - User-provided password for encryption
+ * @param options - Export options (e.g., whether to include logs)
+ * @returns A Buffer containing the encrypted .eliza-agent file
+ */
+export declare function exportAgent(runtime: AgentRuntime, password: string, options?: AgentExportOptions): Promise<Buffer>;
+/**
+ * Import an agent from a password-encrypted .eliza-agent file.
+ *
+ * @param runtime - An AgentRuntime with an active database adapter (the agent
+ *                  will be created in this database, not overwriting the current agent)
+ * @param fileBuffer - The raw bytes of the .eliza-agent file
+ * @param password - The password used when the file was exported
+ * @returns An ImportResult describing what was imported
+ */
+export declare function importAgent(runtime: AgentRuntime, fileBuffer: Buffer, password: string): Promise<ImportResult>;
+/**
+ * Estimate the size of an agent export without actually creating it.
+ * Useful for showing the user how large the export will be.
+ */
+export declare function estimateExportSize(runtime: AgentRuntime): Promise<ExportSizeEstimate>;
+//# sourceMappingURL=agent-export.d.ts.map

package/packages/agent/src/services/agent-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-export.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/agent-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EACV,KAAK,EACL,YAAY,EACZ,SAAS,EACT,MAAM,EACN,GAAG,EACH,MAAM,EACN,YAAY,EACZ,IAAI,EACJ,IAAI,EAEJ,KAAK,EACN,MAAM,eAAe,CAAC;AAsCvB,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB;;;6EAGyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,YAAY,EAAE,KAAK,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AA6KD,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AA2eD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAgFvB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAmD7B"}