@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.2

package/api/automations-compat-routes.js

@@ -0,0 +1,274 @@
+/**
+ * Automations node-catalog endpoint.
+ *
+ * The full Automations list/CRUD surface (`GET /api/automations` etc.) lives in
+ * `@elizaos/plugin-workflow` (`src/routes/automations.ts`) — the workflow
+ * plugin owns the unified workflow + trigger model.
+ *
+ * This file remains in app-core because the node catalog (`/api/automations/nodes`)
+ * is multi-domain: it enumerates runtime actions/providers, static automation
+ * specs, and dynamically-registered contributors via
+ * `listAutomationNodeContributors()`. Other plugins (LifeOps, etc.) register
+ * contributors here, so the registry must live where it can be loaded by all
+ * consumers without a workflow plugin dependency.
+ */
+import { loadElizaConfig } from "@elizaos/agent";
+import { stringToUuid } from "@elizaos/core";
+import { ensureRouteAuthorized } from "./auth.js";
+import { listAutomationNodeContributors } from "./automation-node-contributors";
+import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response";
+const BLOCKED_AUTOMATION_PROVIDER_NODES = new Set([
+    "recent-conversations",
+    "relevant-conversations",
+]);
+const STATIC_AUTOMATION_NODE_SPECS = [
+    {
+        id: "crypto:evm.swap",
+        label: "EVM swap",
+        description: "EVM token swap automation backed by a loaded EVM runtime action.",
+        class: "action",
+        backingCapability: "SWAP",
+        actionNames: ["SWAP", "SWAP_TOKENS", "SWAP_TOKEN"],
+        pluginNames: ["evm", "wallet", "plugin-wallet", "@elizaos/plugin-wallet"],
+        ownerScoped: true,
+        enabledWithoutRuntimeCapability: false,
+        disabledReason: "Load the EVM plugin with swap support.",
+    },
+    {
+        id: "crypto:evm.bridge",
+        label: "EVM bridge",
+        description: "EVM cross-chain bridge automation backed by a loaded EVM runtime action.",
+        class: "action",
+        backingCapability: "CROSS_CHAIN_TRANSFER",
+        actionNames: ["CROSS_CHAIN_TRANSFER", "BRIDGE", "BRIDGE_TOKENS"],
+        pluginNames: ["evm", "wallet", "plugin-wallet", "@elizaos/plugin-wallet"],
+        ownerScoped: true,
+        enabledWithoutRuntimeCapability: false,
+        disabledReason: "Load the EVM plugin with bridge support.",
+    },
+    {
+        id: "crypto:solana.swap",
+        label: "Solana swap",
+        description: "Solana token swap automation backed by a loaded Solana runtime action.",
+        class: "action",
+        backingCapability: "SWAP_SOLANA",
+        actionNames: [
+            "SWAP_SOLANA",
+            "SWAP_SOL",
+            "SWAP_TOKENS_SOLANA",
+            "TOKEN_SWAP_SOLANA",
+            "TRADE_TOKENS_SOLANA",
+            "EXCHANGE_TOKENS_SOLANA",
+        ],
+        pluginNames: [
+            "chain_solana",
+            "solana",
+            "wallet",
+            "plugin-wallet",
+            "@elizaos/plugin-wallet",
+        ],
+        ownerScoped: true,
+        enabledWithoutRuntimeCapability: false,
+        disabledReason: "Load the Solana plugin with swap support.",
+    },
+    {
+        id: "crypto:hyperliquid.action",
+        label: "Hyperliquid action",
+        description: "Hyperliquid automation entry point backed by a loaded Hyperliquid runtime plugin.",
+        class: "action",
+        backingCapability: "HYPERLIQUID_ACTION",
+        actionNames: [
+            "HYPERLIQUID_ACTION",
+            "HYPERLIQUID_ORDER",
+            "HYPERLIQUID_TRADE",
+        ],
+        pluginNames: [
+            "hyperliquid",
+            "plugin-hyperliquid",
+            "@elizaos/plugin-hyperliquid",
+        ],
+        ownerScoped: true,
+        enabledWithoutRuntimeCapability: false,
+        disabledReason: "Load the Hyperliquid runtime plugin.",
+    },
+    {
+        id: "trigger:order.schedule",
+        label: "Order schedule",
+        description: "Schedule order-intent workflows; venue execution still requires a loaded trading action.",
+        class: "trigger",
+        backingCapability: "ORDER_SCHEDULE",
+        actionNames: [],
+        pluginNames: [],
+        ownerScoped: false,
+        enabledWithoutRuntimeCapability: true,
+        disabledReason: "Automation schedules are unavailable.",
+    },
+    {
+        id: "trigger:order.event",
+        label: "Order event",
+        description: "React to order lifecycle events emitted by a loaded trading venue plugin.",
+        class: "trigger",
+        backingCapability: "ORDER_EVENT",
+        actionNames: [
+            "ORDER_EVENT",
+            "ORDER_FILLED",
+            "ORDER_UPDATED",
+            "HYPERLIQUID_ACTION",
+        ],
+        pluginNames: [
+            "hyperliquid",
+            "plugin-hyperliquid",
+            "@elizaos/plugin-hyperliquid",
+        ],
+        ownerScoped: false,
+        enabledWithoutRuntimeCapability: false,
+        disabledReason: "Load an order-event-capable runtime plugin.",
+    },
+];
+function humanizeCapabilityName(value) {
+    return value
+        .trim()
+        .replace(/[_-]+/g, " ")
+        .replace(/\s+/g, " ")
+        .toLowerCase()
+        .replace(/\b\w/g, (char) => char.toUpperCase());
+}
+function resolveAgentName(runtime, config) {
+    return (runtime?.character?.name?.trim() ||
+        config.ui?.assistant?.name?.trim() ||
+        "Eliza");
+}
+function resolveAdminEntityId(config, agentName) {
+    const configured = config.agents?.defaults?.adminEntityId?.trim();
+    if (configured) {
+        return configured;
+    }
+    return stringToUuid(`${agentName}-admin-entity`);
+}
+function normalizeCapabilityName(value) {
+    return value.trim().toLowerCase();
+}
+function getRuntimeActionCapabilityNames(runtime) {
+    const names = new Set();
+    for (const action of runtime.actions) {
+        names.add(normalizeCapabilityName(action.name));
+        for (const simile of action.similes ?? []) {
+            names.add(normalizeCapabilityName(simile));
+        }
+    }
+    return names;
+}
+function getRuntimePluginNames(runtime) {
+    return new Set((runtime.plugins ?? [])
+        .map((plugin) => normalizeCapabilityName(plugin.name))
+        .filter((name) => name.length > 0));
+}
+function hasMatchingRuntimeCapability(spec, actionNames, pluginNames) {
+    if (spec.enabledWithoutRuntimeCapability) {
+        return true;
+    }
+    return (spec.actionNames.some((name) => actionNames.has(normalizeCapabilityName(name))) ||
+        spec.pluginNames.some((name) => pluginNames.has(normalizeCapabilityName(name))));
+}
+function buildStaticAutomationNode(spec, actionNames, pluginNames) {
+    const enabled = hasMatchingRuntimeCapability(spec, actionNames, pluginNames);
+    return {
+        id: spec.id,
+        label: spec.label,
+        description: spec.description,
+        class: spec.class,
+        source: "static_catalog",
+        backingCapability: spec.backingCapability,
+        ownerScoped: spec.ownerScoped,
+        requiresSetup: !enabled,
+        availability: enabled ? "enabled" : "disabled",
+        ...(enabled ? {} : { disabledReason: spec.disabledReason }),
+    };
+}
+async function buildAutomationNodeCatalog(state) {
+    const runtime = state.current;
+    if (!runtime) {
+        throw new Error("Agent runtime is not available");
+    }
+    const config = loadElizaConfig();
+    const agentName = resolveAgentName(runtime, config);
+    const adminEntityId = resolveAdminEntityId(config, agentName);
+    const runtimeActionNodes = runtime.actions
+        .slice()
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map((action) => ({
+        id: `action:${action.name}`,
+        label: humanizeCapabilityName(action.name),
+        description: action.description || `${action.name} runtime action`,
+        class: action.name === "START_CODING_TASK" ||
+            action.name === "CREATE_TASK" ||
+            action.name === "CODE_TASK"
+            ? "agent"
+            : "action",
+        source: "runtime_action",
+        backingCapability: action.name,
+        ownerScoped: false,
+        requiresSetup: false,
+        availability: "enabled",
+    }));
+    const runtimeProviderNodes = runtime.providers
+        .slice()
+        .filter((provider) => !BLOCKED_AUTOMATION_PROVIDER_NODES.has(provider.name))
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map((provider) => ({
+        id: `provider:${provider.name}`,
+        label: humanizeCapabilityName(provider.name),
+        description: provider.description || `${provider.name} runtime provider`,
+        class: "context",
+        source: "runtime_provider",
+        backingCapability: provider.name,
+        ownerScoped: false,
+        requiresSetup: false,
+        availability: "enabled",
+    }));
+    const runtimeActionCapabilityNames = getRuntimeActionCapabilityNames(runtime);
+    const runtimePluginNames = getRuntimePluginNames(runtime);
+    const staticAutomationNodes = STATIC_AUTOMATION_NODE_SPECS.map((spec) => buildStaticAutomationNode(spec, runtimeActionCapabilityNames, runtimePluginNames));
+    const contributorNodeGroups = await Promise.all(listAutomationNodeContributors().map((contributor) => contributor({ runtime, config, agentName, adminEntityId })));
+    const contributorNodes = contributorNodeGroups.flat();
+    const nodes = [
+        ...runtimeActionNodes,
+        ...runtimeProviderNodes,
+        ...staticAutomationNodes,
+        ...contributorNodes,
+    ].sort((left, right) => {
+        if (left.class !== right.class) {
+            return left.class.localeCompare(right.class);
+        }
+        return left.label.localeCompare(right.label);
+    });
+    return {
+        nodes,
+        summary: {
+            total: nodes.length,
+            enabled: nodes.filter((node) => node.availability === "enabled").length,
+            disabled: nodes.filter((node) => node.availability === "disabled").length,
+        },
+    };
+}
+export async function handleAutomationsCompatRoutes(req, res, state) {
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (!url.pathname.startsWith("/api/automations")) {
+        return false;
+    }
+    if (!(await ensureRouteAuthorized(req, res, state))) {
+        return true;
+    }
+    if (method === "GET" && url.pathname === "/api/automations/nodes") {
+        if (!state.current) {
+            sendJsonErrorResponse(res, 503, "Agent runtime is not available");
+            return true;
+        }
+        const payload = await buildAutomationNodeCatalog(state);
+        sendJsonResponse(res, 200, payload);
+        return true;
+    }
+    // /api/automations (root listing) is served by @elizaos/plugin-workflow.
+    return false;
+}

package/api/catalog-routes.d.ts

@@ -0,0 +1,4 @@
+import type http from "node:http";
+import type { CompatRuntimeState } from "./compat-route-shared";
+export declare function handleCatalogRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
+//# sourceMappingURL=catalog-routes.d.ts.map

package/api/catalog-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/catalog-routes.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAKlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAsChE,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/api/catalog-routes.js

@@ -0,0 +1,61 @@
+// Catalog routes — surfaces the registry SoT to the frontend.
+//
+// /api/catalog/apps  → static apps known to the registry (internal-tool apps,
+//                      curated apps, plugin-shipped apps). Lets AppsView stop
+//                      depending on the hardcoded INTERNAL_TOOL_APPS array
+//                      and the ELIZA_CURATED_APP_DEFINITIONS list.
+//
+// Server-discovered apps (npm packages installed at runtime) and overlay
+// apps (runtime-registered) are still merged on the frontend; this endpoint
+// covers the static, declared catalog only.
+import { resolveAppHeroImage } from "@elizaos/agent";
+import { getApps, loadRegistry } from "../registry";
+import { ensureRouteAuthorized } from "./auth.js";
+import { sendJson as sendJsonResponse } from "./response";
+function appEntryToRegistryAppInfo(entry) {
+    const launchType = entry.launch.type === "server-launch" ? "server" : entry.launch.type;
+    const packageName = entry.npmName ?? entry.id;
+    // Resolve heroImage so apps that only declare it in their package.json
+    // (e.g. "assets/hero.png") still surface a working `/api/apps/hero/<slug>`
+    // URL through the catalog. Falls back to generated artwork when nothing is
+    // declared.
+    const heroImage = entry.render.heroImage ?? resolveAppHeroImage(packageName, null);
+    return {
+        name: packageName,
+        displayName: entry.name,
+        description: entry.description ?? "",
+        category: entry.subtype,
+        launchType,
+        launchUrl: entry.launch.url ?? null,
+        icon: entry.render.icon ?? null,
+        heroImage,
+        capabilities: entry.launch.capabilities ?? [],
+        stars: 0,
+        repository: entry.resources.repository ?? "",
+        latestVersion: entry.version ?? null,
+        supports: entry.launch.supports ?? { v0: false, v1: false, v2: true },
+        npm: {
+            package: entry.launch.npm?.package ?? entry.npmName ?? entry.id,
+            v0Version: entry.launch.npm?.v0Version ?? null,
+            v1Version: entry.launch.npm?.v1Version ?? null,
+            v2Version: entry.launch.npm?.v2Version ?? entry.version ?? null,
+        },
+        viewer: entry.launch.viewer,
+        uiExtension: entry.launch.uiExtension,
+    };
+}
+export async function handleCatalogRoutes(req, res, state) {
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (!url.pathname.startsWith("/api/catalog")) {
+        return false;
+    }
+    if (method === "GET" && url.pathname === "/api/catalog/apps") {
+        if (!(await ensureRouteAuthorized(req, res, state)))
+            return true;
+        const apps = getApps(loadRegistry()).filter((a) => a.render.visible);
+        sendJsonResponse(res, 200, apps.map(appEntryToRegistryAppInfo));
+        return true;
+    }
+    return false;
+}

package/api/compat-route-shared.d.ts

@@ -0,0 +1,29 @@
+import type http from "node:http";
+import { type ElizaConfig } from "@elizaos/agent";
+import type { AgentRuntime } from "@elizaos/core";
+export interface CompatRuntimeState {
+    current: AgentRuntime | null;
+    pendingAgentName: string | null;
+    pendingRestartReasons: string[];
+}
+export declare function clearCompatRuntimeRestart(state: CompatRuntimeState): void;
+export declare function scheduleCompatRuntimeRestart(state: CompatRuntimeState, reason: string): void;
+export declare const DATABASE_UNAVAILABLE_MESSAGE = "Database not available. The agent may not be running or the database adapter is not initialized.";
+export declare function isLoopbackRemoteAddress(remoteAddress: string | null | undefined): boolean;
+/**
+ * Same-machine dashboard access. This is intentionally stricter than just
+ * checking `remoteAddress`: the browser must also be targeting a loopback Host
+ * and must not present cross-site browser metadata.
+ */
+export declare function isTrustedLocalRequest(req: Pick<http.IncomingMessage, "headers" | "socket">): boolean;
+export declare function readCompatJsonBody(req: http.IncomingMessage, res: http.ServerResponse): Promise<Record<string, unknown> | null>;
+export declare function hasCompatPersistedOnboardingState(config: ElizaConfig): boolean;
+export declare function getConfiguredCompatAgentName(): string | null;
+/**
+ * Best-effort grab of the Drizzle DB handle off the live runtime adapter.
+ * Returns null when the runtime is not yet up or the adapter has not
+ * exposed a `db` field. Callers MUST treat null as "service unavailable"
+ * — it is never authentication.
+ */
+export declare function getCompatDrizzleDb(state: CompatRuntimeState): unknown | null;
+//# sourceMappingURL=compat-route-shared.d.ts.map

package/api/compat-route-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-route-shared.d.ts","sourceRoot":"","sources":["../../../../../src/api/compat-route-shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAWlD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzE;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,GACb,IAAI,CAaN;AAED,eAAO,MAAM,4BAA4B,qGAC2D,CAAC;AAErG,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAUT;AAgLD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,OAAO,CAqBT;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA+CzC;AAED,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,WAAW,GAClB,OAAO,CAoCT;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAc5D;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAM5E"}

package/api/compat-route-shared.js

@@ -0,0 +1,298 @@
+import { isIP } from "node:net";
+import { loadElizaConfig } from "@elizaos/agent";
+import { isLoopbackBindHost, normalizeOnboardingProviderId, resolveDeploymentTargetInConfig, resolveServiceRoutingInConfig, } from "@elizaos/shared";
+import { sendJsonError as sendJsonErrorResponse } from "./response";
+const MAX_BODY_BYTES = 1_048_576;
+export function clearCompatRuntimeRestart(state) {
+    state.pendingRestartReasons = [];
+}
+export function scheduleCompatRuntimeRestart(state, reason) {
+    if (state.pendingRestartReasons.includes(reason)) {
+        return;
+    }
+    if (state.pendingRestartReasons.length >= 50) {
+        state.pendingRestartReasons.splice(1, state.pendingRestartReasons.length - 1);
+    }
+    state.pendingRestartReasons.push(reason);
+}
+export const DATABASE_UNAVAILABLE_MESSAGE = "Database not available. The agent may not be running or the database adapter is not initialized.";
+export function isLoopbackRemoteAddress(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    const normalized = remoteAddress.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1" ||
+        normalized === "::ffff:0:127.0.0.1");
+}
+function firstHeaderValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return null;
+}
+const CLIENT_IP_PROXY_HEADERS = new Set([
+    "forwarded",
+    "forwarded-for",
+    "x-forwarded",
+    "x-forwarded-for",
+    "x-original-forwarded-for",
+    "x-real-ip",
+    "x-client-ip",
+    "x-forwarded-client-ip",
+    "x-cluster-client-ip",
+    "cf-connecting-ip",
+    "true-client-ip",
+    "fastly-client-ip",
+    "x-appengine-user-ip",
+    "x-azure-clientip",
+]);
+function headerValues(value) {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value)) {
+        return value.filter((item) => typeof item === "string");
+    }
+    return [];
+}
+function isClientIpProxyHeaderName(name) {
+    const normalized = name.toLowerCase();
+    return (CLIENT_IP_PROXY_HEADERS.has(normalized) ||
+        normalized.endsWith("-client-ip") ||
+        normalized.endsWith("-connecting-ip") ||
+        normalized.endsWith("-real-ip"));
+}
+function extractForwardedForCandidates(raw) {
+    const candidates = [];
+    const pattern = /(?:^|[;,])\s*for=(?:"([^"]*)"|([^;,]*))/gi;
+    for (const match of raw.matchAll(pattern)) {
+        candidates.push(match[1] ?? match[2] ?? "");
+    }
+    return candidates;
+}
+function extractProxyClientAddressCandidates(headerName, raw) {
+    if (headerName === "forwarded") {
+        return extractForwardedForCandidates(raw);
+    }
+    const forwardedCandidates = raw.toLowerCase().includes("for=")
+        ? extractForwardedForCandidates(raw)
+        : [];
+    if (forwardedCandidates.length > 0)
+        return forwardedCandidates;
+    return raw.split(",");
+}
+function stripMatchingQuotes(value) {
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function isNeutralProxyClientAddress(raw) {
+    const normalized = stripMatchingQuotes(raw).trim().toLowerCase();
+    return (!normalized ||
+        normalized === "unknown" ||
+        normalized === "null" ||
+        normalized.startsWith("_"));
+}
+function normalizeProxyClientIp(raw) {
+    let normalized = stripMatchingQuotes(raw).trim();
+    if (!normalized)
+        return null;
+    if (normalized.startsWith("[")) {
+        const close = normalized.indexOf("]");
+        if (close > 0) {
+            normalized = normalized.slice(1, close);
+        }
+    }
+    else {
+        const ipv4HostPort = /^(\d{1,3}(?:\.\d{1,3}){3})(?::\d+)$/.exec(normalized);
+        if (ipv4HostPort?.[1]) {
+            normalized = ipv4HostPort[1];
+        }
+    }
+    const zoneIndex = normalized.indexOf("%");
+    if (zoneIndex >= 0) {
+        normalized = normalized.slice(0, zoneIndex);
+    }
+    normalized = normalized.trim().toLowerCase();
+    return isIP(normalized) ? normalized : null;
+}
+function isLoopbackProxyClientIp(ip) {
+    const normalized = ip.trim().toLowerCase();
+    return (normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized.startsWith("127.") ||
+        normalized.startsWith("::ffff:127.") ||
+        normalized.startsWith("::ffff:0:127."));
+}
+function proxyClientHeaderBlocksLocalTrust(headers) {
+    for (const [rawName, rawValue] of Object.entries(headers)) {
+        const headerName = rawName.toLowerCase();
+        if (!isClientIpProxyHeaderName(headerName))
+            continue;
+        for (const value of headerValues(rawValue)) {
+            for (const candidate of extractProxyClientAddressCandidates(headerName, value)) {
+                if (isNeutralProxyClientAddress(candidate))
+                    continue;
+                const ip = normalizeProxyClientIp(candidate);
+                if (!ip || !isLoopbackProxyClientIp(ip))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+function isCloudProvisionedByEnv() {
+    return process.env.ELIZA_CLOUD_PROVISIONED === "1";
+}
+function isLocalAuthRequiredByEnv() {
+    return process.env.ELIZA_REQUIRE_LOCAL_AUTH === "1";
+}
+function isTrustedLocalOrigin(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return true;
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol === "file:" ||
+            parsed.protocol === "app:" ||
+            parsed.protocol === "tauri:" ||
+            parsed.protocol === "capacitor:" ||
+            parsed.protocol === "capacitor-electron:" ||
+            parsed.protocol === "electrobun:") {
+            return true;
+        }
+        return isLoopbackBindHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Same-machine dashboard access. This is intentionally stricter than just
+ * checking `remoteAddress`: the browser must also be targeting a loopback Host
+ * and must not present cross-site browser metadata.
+ */
+export function isTrustedLocalRequest(req) {
+    if (isLocalAuthRequiredByEnv())
+        return false;
+    if (isCloudProvisionedByEnv())
+        return false;
+    if (!isLoopbackRemoteAddress(req.socket?.remoteAddress))
+        return false;
+    if (proxyClientHeaderBlocksLocalTrust(req.headers))
+        return false;
+    const host = firstHeaderValue(req.headers.host);
+    if (host && !isLoopbackBindHost(host))
+        return false;
+    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
+    if (secFetchSite === "cross-site")
+        return false;
+    const origin = firstHeaderValue(req.headers.origin);
+    if (origin && !isTrustedLocalOrigin(origin))
+        return false;
+    const referer = firstHeaderValue(req.headers.referer);
+    if (!origin && referer && !isTrustedLocalOrigin(referer))
+        return false;
+    return true;
+}
+export async function readCompatJsonBody(req, res) {
+    // When this handler is invoked through the runtime's plugin-route adapter
+    // (rawPath: true), the runtime has already consumed the request stream and
+    // attached the parsed JSON body as `req.body`. Streaming the IncomingMessage
+    // again would yield zero bytes and we'd return `{}`, even though the caller
+    // sent a real payload. Honour the pre-parsed body when present.
+    const preParsed = req.body;
+    if (preParsed && typeof preParsed === "object" && !Array.isArray(preParsed)) {
+        return preParsed;
+    }
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        for await (const chunk of req) {
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            totalBytes += buf.length;
+            if (totalBytes > MAX_BODY_BYTES) {
+                req.destroy();
+                sendJsonErrorResponse(res, 413, "Request body too large");
+                return null;
+            }
+            chunks.push(buf);
+        }
+    }
+    catch {
+        sendJsonErrorResponse(res, 400, "Invalid request body");
+        return null;
+    }
+    if (chunks.length === 0) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            sendJsonErrorResponse(res, 400, "Invalid JSON body");
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        sendJsonErrorResponse(res, 400, "Invalid JSON body");
+        return null;
+    }
+}
+export function hasCompatPersistedOnboardingState(config) {
+    if (config.meta?.onboardingComplete === true) {
+        return true;
+    }
+    const deploymentTarget = resolveDeploymentTargetInConfig(config);
+    const llmText = resolveServiceRoutingInConfig(config)?.llmText;
+    const backend = normalizeOnboardingProviderId(llmText?.backend);
+    const remoteApiBase = llmText?.remoteApiBase?.trim() ?? deploymentTarget.remoteApiBase?.trim();
+    const hasCompleteCanonicalRouting = (llmText?.transport === "direct" &&
+        Boolean(backend && backend !== "elizacloud")) ||
+        (llmText?.transport === "remote" && Boolean(remoteApiBase)) ||
+        (llmText?.transport === "cloud-proxy" &&
+            backend === "elizacloud" &&
+            Boolean(llmText.smallModel?.trim() && llmText.largeModel?.trim())) ||
+        (deploymentTarget.runtime === "remote" &&
+            Boolean(deploymentTarget.remoteApiBase?.trim()));
+    if (hasCompleteCanonicalRouting) {
+        return true;
+    }
+    if (Array.isArray(config.agents?.list) && config.agents.list.length > 0) {
+        return true;
+    }
+    return Boolean(config.agents?.defaults?.workspace?.trim() ||
+        config.agents?.defaults?.adminEntityId?.trim());
+}
+export function getConfiguredCompatAgentName() {
+    const config = loadElizaConfig();
+    const listAgent = config.agents?.list?.[0];
+    const listAgentName = typeof listAgent?.name === "string" ? listAgent.name.trim() : "";
+    if (listAgentName) {
+        return listAgentName;
+    }
+    const assistantName = typeof config.ui?.assistant?.name === "string"
+        ? config.ui.assistant.name.trim()
+        : "";
+    return assistantName || null;
+}
+/**
+ * Best-effort grab of the Drizzle DB handle off the live runtime adapter.
+ * Returns null when the runtime is not yet up or the adapter has not
+ * exposed a `db` field. Callers MUST treat null as "service unavailable"
+ * — it is never authentication.
+ */
+export function getCompatDrizzleDb(state) {
+    const runtime = state.current;
+    if (!runtime)
+        return null;
+    const adapter = runtime.adapter;
+    if (!adapter?.db)
+        return null;
+    return adapter.db;
+}