@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.2

package/account-pool.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Public entry for account pool — import from `@elizaos/app-core/account-pool`
+ * or from `@elizaos/app-core` (barrel).
+ */
+export * from "./services/account-pool.js";
+//# sourceMappingURL=account-pool.d.ts.map

package/account-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../../src/account-pool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,4BAA4B,CAAC"}

package/account-pool.js

@@ -0,0 +1,5 @@
+/**
+ * Public entry for account pool — import from `@elizaos/app-core/account-pool`
+ * or from `@elizaos/app-core` (barrel).
+ */
+export * from "./services/account-pool.js";

package/api/__tests__/sandbox-test-helpers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared helpers for sandbox route tests.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+export declare function createMockReq(method: string, body?: string): IncomingMessage;
+export declare function createMockRes(): ServerResponse & {
+    _status: number;
+    _body: string;
+};
+//# sourceMappingURL=sandbox-test-helpers.d.ts.map

package/api/__tests__/sandbox-test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-test-helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/api/__tests__/sandbox-test-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAM5E;AAED,wBAAgB,aAAa,IAAI,cAAc,GAAG;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf,CAMA"}

package/api/__tests__/sandbox-test-helpers.js

@@ -0,0 +1,15 @@
+/**
+ * Shared helpers for sandbox route tests.
+ */
+import { createMockHttpResponse, createMockIncomingMessage, } from "@elizaos/shared";
+export function createMockReq(method, body) {
+    return createMockIncomingMessage({
+        method,
+        headers: {},
+        body,
+    });
+}
+export function createMockRes() {
+    const { res } = createMockHttpResponse();
+    return res;
+}

package/api/auth/audit.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Auth audit emitter.
+ *
+ * Every sensitive auth action ends up in two places:
+ *   1. `auth_audit_events` table via `AuthStore.appendAuditEvent`.
+ *   2. JSONL file at `<state>/auth/audit.log`, rotated at 10MB, so the
+ *      operator can read history even if pglite is wiped.
+ *
+ * Both writes happen synchronously from the caller's perspective. If the DB
+ * write throws the file write still happens (and vice versa) — the operator
+ * notices a divergence rather than losing the event entirely.
+ *
+ * Token-shaped values (20+ characters of `[A-Za-z0-9_-]`) are redacted in
+ * `metadata` before either write, so a misconfigured caller can't smuggle a
+ * bearer token into an audit row.
+ */
+import type { RuntimeEnvRecord } from "@elizaos/shared";
+import type { AuthStore } from "../../services/auth-store";
+export declare const AUDIT_LOG_FILENAME = "audit.log";
+export declare const AUDIT_LOG_ROTATE_FILENAME = "audit.log.1";
+export declare const AUDIT_LOG_MAX_BYTES: number;
+export declare const AUDIT_REDACTION_RE: RegExp;
+export interface AuditEventInput {
+    actorIdentityId: string | null;
+    ip: string | null;
+    userAgent: string | null;
+    action: string;
+    outcome: "success" | "failure";
+    metadata?: Record<string, string | number | boolean>;
+}
+export interface AuditEmitterOptions {
+    store: AuthStore;
+    env?: RuntimeEnvRecord;
+    now?: () => number;
+}
+/**
+ * Replace token-shaped runs in `metadata` with the literal `<redacted>` string.
+ *
+ * Only string values are scanned; numbers and booleans pass through unchanged.
+ */
+export declare function redactMetadata(metadata: Record<string, string | number | boolean>): Record<string, string | number | boolean>;
+export declare function resolveAuditLogPath(env?: RuntimeEnvRecord): string;
+export declare function resolveAuditLogRotatedPath(env?: RuntimeEnvRecord): string;
+/**
+ * Append an audit event to the database AND the JSONL log.
+ *
+ * Both writes are attempted. The first error is rethrown to the caller —
+ * an audit-write failure is a real problem and should surface, not be
+ * swallowed.
+ */
+export declare function appendAuditEvent(input: AuditEventInput, options: AuditEmitterOptions): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/api/auth/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG3D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAC9C,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AACvD,eAAO,MAAM,mBAAmB,QAAmB,CAAC;AACpD,eAAO,MAAM,kBAAkB,QAAuB,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAClD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAU3C;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,gBAA8B,GAClC,MAAM,CAER;AAED,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,gBAA8B,GAClC,MAAM,CAMR;AAsCD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/api/auth/audit.js

@@ -0,0 +1,126 @@
+/**
+ * Auth audit emitter.
+ *
+ * Every sensitive auth action ends up in two places:
+ *   1. `auth_audit_events` table via `AuthStore.appendAuditEvent`.
+ *   2. JSONL file at `<state>/auth/audit.log`, rotated at 10MB, so the
+ *      operator can read history even if pglite is wiped.
+ *
+ * Both writes happen synchronously from the caller's perspective. If the DB
+ * write throws the file write still happens (and vice versa) — the operator
+ * notices a divergence rather than losing the event entirely.
+ *
+ * Token-shaped values (20+ characters of `[A-Za-z0-9_-]`) are redacted in
+ * `metadata` before either write, so a misconfigured caller can't smuggle a
+ * bearer token into an audit row.
+ */
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { resolveElizaStateDir } from "../../services/cloud-jwks-store";
+export const AUDIT_LOG_FILENAME = "audit.log";
+export const AUDIT_LOG_ROTATE_FILENAME = "audit.log.1";
+export const AUDIT_LOG_MAX_BYTES = 10 * 1024 * 1024;
+export const AUDIT_REDACTION_RE = /[A-Za-z0-9_-]{20,}/;
+function truncateUserAgent(value) {
+    if (!value)
+        return null;
+    return value.length > 200 ? value.slice(0, 200) : value;
+}
+/**
+ * Replace token-shaped runs in `metadata` with the literal `<redacted>` string.
+ *
+ * Only string values are scanned; numbers and booleans pass through unchanged.
+ */
+export function redactMetadata(metadata) {
+    const out = {};
+    for (const [key, raw] of Object.entries(metadata)) {
+        if (typeof raw !== "string") {
+            out[key] = raw;
+            continue;
+        }
+        out[key] = AUDIT_REDACTION_RE.test(raw) ? "<redacted>" : raw;
+    }
+    return out;
+}
+export function resolveAuditLogPath(env = process.env) {
+    return path.join(resolveElizaStateDir(env), "auth", AUDIT_LOG_FILENAME);
+}
+export function resolveAuditLogRotatedPath(env = process.env) {
+    return path.join(resolveElizaStateDir(env), "auth", AUDIT_LOG_ROTATE_FILENAME);
+}
+async function rotateIfNeeded(filePath) {
+    let size;
+    try {
+        const stat = await fs.stat(filePath);
+        size = stat.size;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        throw err;
+    }
+    if (size < AUDIT_LOG_MAX_BYTES)
+        return;
+    const rotated = `${filePath}.1`;
+    await fs.rename(filePath, rotated).catch(async (err) => {
+        if (err.code !== "ENOENT")
+            throw err;
+    });
+}
+async function appendJsonLine(filePath, line) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    await rotateIfNeeded(filePath);
+    await fs.appendFile(filePath, `${JSON.stringify(line)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+/**
+ * Append an audit event to the database AND the JSONL log.
+ *
+ * Both writes are attempted. The first error is rethrown to the caller —
+ * an audit-write failure is a real problem and should surface, not be
+ * swallowed.
+ */
+export async function appendAuditEvent(input, options) {
+    const env = options.env ?? process.env;
+    const now = options.now?.() ?? Date.now();
+    const id = crypto.randomUUID();
+    const safeMetadata = redactMetadata(input.metadata ?? {});
+    const userAgent = truncateUserAgent(input.userAgent);
+    const filePath = resolveAuditLogPath(env);
+    const line = {
+        id,
+        ts: now,
+        actorIdentityId: input.actorIdentityId,
+        ip: input.ip,
+        userAgent,
+        action: input.action,
+        outcome: input.outcome,
+        metadata: safeMetadata,
+    };
+    let firstError = null;
+    const fileWrite = appendJsonLine(filePath, line).catch((err) => {
+        if (firstError === null)
+            firstError = err;
+    });
+    const dbWrite = options.store
+        .appendAuditEvent({
+        id,
+        ts: now,
+        actorIdentityId: input.actorIdentityId,
+        ip: input.ip,
+        userAgent,
+        action: input.action,
+        outcome: input.outcome,
+        metadata: safeMetadata,
+    })
+        .catch((err) => {
+        if (firstError === null)
+            firstError = err;
+    });
+    await Promise.all([fileWrite, dbWrite]);
+    if (firstError !== null)
+        throw firstError;
+}

package/api/auth/auth-context.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Canonical request guard for the auth model.
+ *
+ * Order of resolution:
+ *   1. session cookie (`eliza_session`) — modern path, what the SPA uses.
+ *   2. session-id bearer header (machine sessions and SPA fallback).
+ *   3. bootstrap-token bearer (delegates to existing
+ *      `ensureAuthSessionOrBootstrap` semantics in `../auth.ts`).
+ *
+ * Hard rule: this helper fails closed on every error. A DB lookup throw, a
+ * malformed cookie, a CSRF mismatch — all return null. We do NOT swallow an
+ * error and pretend the request was authenticated.
+ */
+import type http from "node:http";
+import type { RuntimeEnvRecord } from "@elizaos/shared";
+import type { AuthIdentityRow, AuthSessionRow, AuthStore } from "../../services/auth-store";
+export type AuthContextSource = "cookie" | "bearer-session" | "bearer-bootstrap";
+export interface ResolvedAuthContext {
+    session: AuthSessionRow | null;
+    identity: AuthIdentityRow | null;
+    source: AuthContextSource;
+}
+export interface EnsureSessionOptions {
+    store: AuthStore;
+    env?: RuntimeEnvRecord;
+    now?: number;
+    /**
+     * When true (default), accept a raw bootstrap-token bearer and let the
+     * caller exchange it. Set false on routes that should NEVER accept a
+     * bootstrap bearer (i.e. anything outside the dedicated exchange route).
+     */
+    allowBootstrapBearer?: boolean;
+}
+/**
+ * Resolve the request to a session + identity if possible. Returns null on
+ * any failure path; never throws on bad input. The caller is responsible
+ * for sending the 401.
+ */
+export declare function ensureSessionForRequest(req: Pick<http.IncomingMessage, "headers" | "socket">, _res: http.ServerResponse, options: EnsureSessionOptions): Promise<ResolvedAuthContext | null>;
+//# sourceMappingURL=auth-context.d.ts.map

package/api/auth/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,SAAS,EACV,MAAM,2BAA2B,CAAC;AAInC,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,IAAI,EAAE,IAAI,CAAC,cAAc,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAuDrC"}

package/api/auth/auth-context.js

@@ -0,0 +1,68 @@
+/**
+ * Canonical request guard for the auth model.
+ *
+ * Order of resolution:
+ *   1. session cookie (`eliza_session`) — modern path, what the SPA uses.
+ *   2. session-id bearer header (machine sessions and SPA fallback).
+ *   3. bootstrap-token bearer (delegates to existing
+ *      `ensureAuthSessionOrBootstrap` semantics in `../auth.ts`).
+ *
+ * Hard rule: this helper fails closed on every error. A DB lookup throw, a
+ * malformed cookie, a CSRF mismatch — all return null. We do NOT swallow an
+ * error and pretend the request was authenticated.
+ */
+import { getProvidedApiToken } from "../auth.js";
+import { findActiveSession, parseSessionCookie } from "./sessions";
+/**
+ * Resolve the request to a session + identity if possible. Returns null on
+ * any failure path; never throws on bad input. The caller is responsible
+ * for sending the 401.
+ */
+export async function ensureSessionForRequest(req, _res, options) {
+    const { store } = options;
+    const now = options.now ?? Date.now();
+    const allowBootstrap = options.allowBootstrapBearer ?? true;
+    // 1. cookie session
+    const cookieSessionId = parseSessionCookie(req);
+    if (cookieSessionId) {
+        const session = await findActiveSession(store, cookieSessionId, now).catch(() => null);
+        if (session) {
+            const identity = await store
+                .findIdentity(session.identityId)
+                .catch(() => null);
+            if (identity) {
+                return { session, identity, source: "cookie" };
+            }
+            return null;
+        }
+        // Cookie present but invalid — fall through to bearer paths to allow
+        // CI tools that pin a bearer alongside a stale cookie. Failure to find
+        // a bearer below ends the request.
+    }
+    // 2. bearer header
+    const bearer = getProvidedApiToken(req);
+    if (bearer) {
+        // 2a. session-id bearer (machine sessions and SPA fallback).
+        const session = await findActiveSession(store, bearer, now).catch(() => null);
+        if (session) {
+            const identity = await store
+                .findIdentity(session.identityId)
+                .catch(() => null);
+            if (identity) {
+                return { session, identity, source: "bearer-session" };
+            }
+            return null;
+        }
+        // 2b. bootstrap bearer — caller exchanges via dedicated route. We do
+        // not verify here (verification consumes the jti), only signal that a
+        // bearer is present so the route handler can decide.
+        if (allowBootstrap) {
+            return {
+                session: null,
+                identity: null,
+                source: "bearer-bootstrap",
+            };
+        }
+    }
+    return null;
+}

package/api/auth/bootstrap-token.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Bootstrap-token verifier.
+ *
+ * The Eliza Cloud control plane mints an RS256-signed JWT, injects it as
+ * `ELIZA_CLOUD_BOOTSTRAP_TOKEN`, and the user pastes the same value into the
+ * dashboard exactly once. We verify here and reject everything that doesn't
+ * match: wrong issuer, wrong container, expired, replayed, signed with the
+ * wrong algorithm, or by an unknown key.
+ *
+ * Hard rule: this module fails closed. There is no `try { … } catch { return
+ * { authenticated: true } }` shortcut. Any error path returns
+ * `{ ok: false, reason }` and the caller MUST refuse the request.
+ */
+import type { RuntimeEnvRecord } from "@elizaos/shared";
+import type { AuthStore } from "../../services/auth-store";
+export declare const BOOTSTRAP_TOKEN_ALG = "RS256";
+export declare const BOOTSTRAP_TOKEN_SCOPE = "bootstrap";
+export interface BootstrapTokenClaims {
+    iss: string;
+    sub: string;
+    containerId: string;
+    scope: "bootstrap";
+    iat: number;
+    exp: number;
+    jti: string;
+}
+export type VerifyBootstrapResult = {
+    ok: true;
+    claims: BootstrapTokenClaims;
+} | {
+    ok: false;
+    reason: VerifyBootstrapFailureReason;
+};
+export type VerifyBootstrapFailureReason = "missing_issuer_env" | "missing_container_env" | "missing_token" | "jwks_fetch_failed" | "signature_invalid" | "alg_not_allowed" | "issuer_mismatch" | "claims_invalid" | "scope_mismatch" | "container_mismatch" | "expired" | "replay" | "store_error";
+interface VerifyOptions {
+    env?: RuntimeEnvRecord;
+    authStore: AuthStore;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}
+/**
+ * Verify a bootstrap token.
+ *
+ * On success the same `jti` is recorded as seen so a second presentation
+ * fails immediately with `replay`. The caller must NOT call this twice for
+ * the same exchange — `recordJtiSeen` is consumed atomically here.
+ */
+export declare function verifyBootstrapToken(token: string, options: VerifyOptions): Promise<VerifyBootstrapResult>;
+export {};
+//# sourceMappingURL=bootstrap-token.d.ts.map

package/api/auth/bootstrap-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-token.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/bootstrap-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAO3D,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,4BAA4B,CAAA;CAAE,CAAC;AAExD,MAAM,MAAM,4BAA4B,GACpC,oBAAoB,GACpB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,SAAS,GACT,QAAQ,GACR,aAAa,CAAC;AAElB,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AA8ED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA0EhC"}

package/api/auth/bootstrap-token.js

@@ -0,0 +1,157 @@
+/**
+ * Bootstrap-token verifier.
+ *
+ * The Eliza Cloud control plane mints an RS256-signed JWT, injects it as
+ * `ELIZA_CLOUD_BOOTSTRAP_TOKEN`, and the user pastes the same value into the
+ * dashboard exactly once. We verify here and reject everything that doesn't
+ * match: wrong issuer, wrong container, expired, replayed, signed with the
+ * wrong algorithm, or by an unknown key.
+ *
+ * Hard rule: this module fails closed. There is no `try { … } catch { return
+ * { authenticated: true } }` shortcut. Any error path returns
+ * `{ ok: false, reason }` and the caller MUST refuse the request.
+ */
+import { createLocalJWKSet, jwtVerify } from "jose";
+import { readCachedJwks, writeCachedJwks, } from "../../services/cloud-jwks-store";
+export const BOOTSTRAP_TOKEN_ALG = "RS256";
+export const BOOTSTRAP_TOKEN_SCOPE = "bootstrap";
+function isFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function shapeClaims(payload) {
+    if (!isNonEmptyString(payload.iss) ||
+        !isNonEmptyString(payload.sub) ||
+        !isNonEmptyString(payload.containerId) ||
+        !isNonEmptyString(payload.jti) ||
+        !isFiniteNumber(payload.iat) ||
+        !isFiniteNumber(payload.exp)) {
+        return { ok: false, reason: "claims_invalid" };
+    }
+    if (payload.scope !== BOOTSTRAP_TOKEN_SCOPE) {
+        return { ok: false, reason: "scope_mismatch" };
+    }
+    return {
+        ok: true,
+        claims: {
+            iss: payload.iss,
+            sub: payload.sub,
+            containerId: payload.containerId,
+            scope: BOOTSTRAP_TOKEN_SCOPE,
+            iat: payload.iat,
+            exp: payload.exp,
+            jti: payload.jti,
+        },
+    };
+}
+async function loadJwks(issuer, options) {
+    const env = options.env ?? process.env;
+    const now = options.now?.() ?? Date.now();
+    const cached = await readCachedJwks(issuer, { env, now });
+    if (cached)
+        return cached;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const url = `${issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+    const response = await fetchImpl(url, {
+        headers: { accept: "application/json" },
+    });
+    if (!response.ok)
+        return null;
+    const body = await response.json();
+    if (!body || typeof body !== "object")
+        return null;
+    const candidate = body;
+    if (!Array.isArray(candidate.keys))
+        return null;
+    const document = {
+        keys: candidate.keys,
+    };
+    await writeCachedJwks(issuer, document, { env, now });
+    return document;
+}
+/**
+ * Verify a bootstrap token.
+ *
+ * On success the same `jti` is recorded as seen so a second presentation
+ * fails immediately with `replay`. The caller must NOT call this twice for
+ * the same exchange — `recordJtiSeen` is consumed atomically here.
+ */
+export async function verifyBootstrapToken(token, options) {
+    const env = options.env ?? process.env;
+    const issuer = env.ELIZA_CLOUD_ISSUER?.trim();
+    const expectedContainerId = env.ELIZA_CLOUD_CONTAINER_ID?.trim();
+    if (!issuer)
+        return { ok: false, reason: "missing_issuer_env" };
+    if (!expectedContainerId)
+        return { ok: false, reason: "missing_container_env" };
+    if (!token || typeof token !== "string" || token.length < 8) {
+        return { ok: false, reason: "missing_token" };
+    }
+    let jwks;
+    try {
+        jwks = await loadJwks(issuer, options);
+    }
+    catch {
+        return { ok: false, reason: "jwks_fetch_failed" };
+    }
+    if (!jwks || jwks.keys.length === 0) {
+        return { ok: false, reason: "jwks_fetch_failed" };
+    }
+    // jose's local JWKS resolver enforces the algorithm we restrict to via
+    // `algorithms`. We pin RS256 explicitly — anything else (notably HS256
+    // signed with a leaked secret) MUST be rejected.
+    const localJwks = createLocalJWKSet({ keys: jwks.keys });
+    let payload;
+    try {
+        const verified = await jwtVerify(token, localJwks, {
+            algorithms: [BOOTSTRAP_TOKEN_ALG],
+            issuer,
+        });
+        payload = verified.payload;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ERR_JWT_EXPIRED")
+            return { ok: false, reason: "expired" };
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED") {
+            const claim = err.claim;
+            if (claim === "iss")
+                return { ok: false, reason: "issuer_mismatch" };
+            return { ok: false, reason: "claims_invalid" };
+        }
+        if (code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
+            return { ok: false, reason: "signature_invalid" };
+        }
+        if (code === "ERR_JOSE_ALG_NOT_ALLOWED" || code === "ERR_JWS_INVALID") {
+            return { ok: false, reason: "alg_not_allowed" };
+        }
+        return { ok: false, reason: "signature_invalid" };
+    }
+    const shape = shapeClaims(payload);
+    if (!shape.ok)
+        return shape;
+    const claims = shape.claims;
+    if (claims.iss !== issuer)
+        return { ok: false, reason: "issuer_mismatch" };
+    if (claims.containerId !== expectedContainerId) {
+        return { ok: false, reason: "container_mismatch" };
+    }
+    const now = options.now?.() ?? Date.now();
+    // Defence in depth: jose already rejects expired tokens, but an attacker
+    // who controls the signing key could mint with a future `exp` we still
+    // refuse to honour beyond reason.
+    if (claims.exp * 1000 <= now)
+        return { ok: false, reason: "expired" };
+    let unseen;
+    try {
+        unseen = await options.authStore.recordJtiSeen(claims.jti, now);
+    }
+    catch {
+        return { ok: false, reason: "store_error" };
+    }
+    if (!unseen)
+        return { ok: false, reason: "replay" };
+    return { ok: true, claims };
+}

package/api/auth/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Barrel for the P0 auth subsystem.
+ *
+ * Consumers should import from here rather than reaching into the individual
+ * module files; this keeps the public surface explicit and lets us reshape
+ * internals during P1+ without rippling through callers.
+ */
+export { AUDIT_LOG_FILENAME, AUDIT_LOG_MAX_BYTES, AUDIT_LOG_ROTATE_FILENAME, AUDIT_REDACTION_RE, type AuditEmitterOptions, type AuditEventInput, appendAuditEvent, redactMetadata, resolveAuditLogPath, resolveAuditLogRotatedPath, } from "./audit";
+export { type AuthContextSource, type EnsureSessionOptions, ensureSessionForRequest, type ResolvedAuthContext, } from "./auth-context";
+export { BOOTSTRAP_TOKEN_ALG, BOOTSTRAP_TOKEN_SCOPE, type BootstrapTokenClaims, type VerifyBootstrapFailureReason, type VerifyBootstrapResult, verifyBootstrapToken, } from "./bootstrap-token";
+export { ARGON2_PARAMS, assertPasswordStrong, hashPassword, PASSWORD_MIN_LENGTH, type PasswordStrengthFailureReason, verifyPassword, WeakPasswordError, } from "./passwords";
+export { _resetSensitiveLimiters, bootstrapExchangeLimiter, getSensitiveLimiter, SENSITIVE_RATE_LIMIT_MAX, SENSITIVE_RATE_LIMIT_WINDOW_MS, } from "./sensitive-rate-limit";
+export { BROWSER_SESSION_REMEMBER_CAP_MS, BROWSER_SESSION_TTL_MS, type CreateBrowserSessionOptions, type CreateMachineSessionOptions, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createBrowserSession, createMachineSession, deriveCsrfToken, findActiveSession, MACHINE_SESSION_TTL_MS, parseCookieHeader, parseSessionCookie, revokeAllSessionsForIdentity, revokeSession, SESSION_COOKIE_NAME, type SessionWithCsrf, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyCsrfToken, } from "./sessions";
+//# sourceMappingURL=index.d.ts.map

package/api/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,4BAA4B,EAC5B,aAAa,EACb,mBAAmB,EACnB,KAAK,eAAe,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/api/auth/index.js

@@ -0,0 +1,13 @@
+/**
+ * Barrel for the P0 auth subsystem.
+ *
+ * Consumers should import from here rather than reaching into the individual
+ * module files; this keeps the public surface explicit and lets us reshape
+ * internals during P1+ without rippling through callers.
+ */
+export { AUDIT_LOG_FILENAME, AUDIT_LOG_MAX_BYTES, AUDIT_LOG_ROTATE_FILENAME, AUDIT_REDACTION_RE, appendAuditEvent, redactMetadata, resolveAuditLogPath, resolveAuditLogRotatedPath, } from "./audit";
+export { ensureSessionForRequest, } from "./auth-context";
+export { BOOTSTRAP_TOKEN_ALG, BOOTSTRAP_TOKEN_SCOPE, verifyBootstrapToken, } from "./bootstrap-token";
+export { ARGON2_PARAMS, assertPasswordStrong, hashPassword, PASSWORD_MIN_LENGTH, verifyPassword, WeakPasswordError, } from "./passwords";
+export { _resetSensitiveLimiters, bootstrapExchangeLimiter, getSensitiveLimiter, SENSITIVE_RATE_LIMIT_MAX, SENSITIVE_RATE_LIMIT_WINDOW_MS, } from "./sensitive-rate-limit";
+export { BROWSER_SESSION_REMEMBER_CAP_MS, BROWSER_SESSION_TTL_MS, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createBrowserSession, createMachineSession, deriveCsrfToken, findActiveSession, MACHINE_SESSION_TTL_MS, parseCookieHeader, parseSessionCookie, revokeAllSessionsForIdentity, revokeSession, SESSION_COOKIE_NAME, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyCsrfToken, } from "./sessions";

package/api/auth/passwords.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Password hashing + strength gating for the P1 auth path.
+ *
+ * Backed by `@node-rs/argon2` per plan §11 (Rust prebuilt binaries, no
+ * native compile step on Bun/Linux CI). We use argon2id with parameters
+ * lifted from current OWASP Password Storage guidance:
+ *
+ *   memoryCost: 19_456 KiB (≈19 MiB)
+ *   timeCost:   2 iterations
+ *   parallelism: 1
+ *
+ * `verifyPassword` delegates to `@node-rs/argon2`'s `verify`, which is
+ * timing-safe by construction. We never short-circuit on hash shape or
+ * length comparison — every verify runs through the full KDF.
+ *
+ * Hard rule: this module fails closed. Any error during `hash` or `verify`
+ * propagates to the caller. We do NOT swallow exceptions and pretend the
+ * password matched.
+ */
+/**
+ * OWASP-aligned argon2id parameters. Tuned conservatively so cold boots on
+ * modest hardware (the desktop app) don't stutter. If these change, write a
+ * migration note — every existing hash in the DB still validates because
+ * argon2 encodes its parameters in the hash string.
+ */
+export declare const ARGON2_PARAMS: {
+    readonly algorithm: 2;
+    readonly memoryCost: 19456;
+    readonly timeCost: 2;
+    readonly parallelism: 1;
+};
+export declare const PASSWORD_MIN_LENGTH = 12;
+/** Result of {@link assertPasswordStrong}. */
+export type PasswordStrengthFailureReason = "too_short" | "missing_letter" | "missing_digit_or_symbol";
+export declare class WeakPasswordError extends Error {
+    readonly reason: PasswordStrengthFailureReason;
+    constructor(reason: PasswordStrengthFailureReason);
+}
+/**
+ * Refuse passwords under {@link PASSWORD_MIN_LENGTH} characters or with
+ * trivially weak composition. We deliberately do not pull in `zxcvbn` to
+ * avoid adding a runtime dep without explicit confirmation; the length +
+ * composition floor is the documented fallback in the task brief.
+ *
+ * Throws {@link WeakPasswordError} on rejection.
+ */
+export declare function assertPasswordStrong(plain: string): void;
+/**
+ * Hash `plain` with argon2id. Returns the encoded string (parameters + salt
+ * + tag) suitable for direct DB storage.
+ *
+ * Errors propagate to the caller — fail-fast policy.
+ */
+export declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Compare `plain` against a stored argon2id hash. Returns `true` on match,
+ * `false` on mismatch. Always runs the full KDF; never short-circuits.
+ *
+ * If the encoded hash is malformed or hashed with a different algorithm,
+ * `@node-rs/argon2` throws — we propagate. The caller MUST treat a thrown
+ * error as a verification failure (i.e., `await verifyPassword(...).catch(()
+ * => false)` is wrong; let it surface).
+ */
+export declare function verifyPassword(plain: string, encodedHash: string): Promise<boolean>;
+//# sourceMappingURL=passwords.d.ts.map

package/api/auth/passwords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/passwords.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AAEX,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,8CAA8C;AAC9C,MAAM,MAAM,6BAA6B,GACrC,WAAW,GACX,gBAAgB,GAChB,yBAAyB,CAAC;AAE9B,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;gBACnC,MAAM,EAAE,6BAA6B;CAKlD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAUxD;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB"}