@elizaos/app-core 2.0.0-beta.3 → 2.0.11-beta.5

package/api/perf-instrument.js

@@ -0,0 +1,113 @@
+/**
+ * Opt-in server performance instrumentation (route latency + DB-query count +
+ * cache hit/miss counters), gated entirely behind `ELIZA_PERF_INSTRUMENT=1`.
+ *
+ * Design contract: when the flag is OFF this module does ZERO work on the hot
+ * path. `isPerfInstrumentEnabled()` is read once at module load (env is process
+ * scoped), and every record* helper early-returns before touching any state, so
+ * the only cost when disabled is a single boolean compare. The dev endpoint
+ * `GET /api/dev/route-timings` (loopback) reads back the accumulated snapshot.
+ */
+const ENABLED = process.env.ELIZA_PERF_INSTRUMENT === "1";
+/** Cap on retained latency samples per route — bounds memory under load. */
+const MAX_SAMPLES_PER_ROUTE = 1000;
+const routeStats = new Map();
+const cacheStats = new Map();
+let dbQueryCount = 0;
+export function isPerfInstrumentEnabled() {
+    return ENABLED;
+}
+/**
+ * Collapse a concrete pathname into a low-cardinality route key so per-request
+ * ids (table names, UUIDs, numeric ids) don't explode the stats map.
+ */
+export function normalizeRouteKey(method, pathname) {
+    const collapsed = pathname
+        .replace(/\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?=\/|$)/gi, "/:id")
+        .replace(/\/\d+(?=\/|$)/g, "/:n")
+        .replace(/\/tables\/[^/]+\//g, "/tables/:table/");
+    return `${method} ${collapsed}`;
+}
+export function recordRouteTiming(routeKey, durationMs) {
+    if (!ENABLED)
+        return;
+    let stat = routeStats.get(routeKey);
+    if (!stat) {
+        stat = { count: 0, samples: [], cursor: 0, totalMs: 0, maxMs: 0 };
+        routeStats.set(routeKey, stat);
+    }
+    stat.count += 1;
+    stat.totalMs += durationMs;
+    if (durationMs > stat.maxMs)
+        stat.maxMs = durationMs;
+    if (stat.samples.length < MAX_SAMPLES_PER_ROUTE) {
+        stat.samples.push(durationMs);
+    }
+    else {
+        stat.samples[stat.cursor] = durationMs;
+        stat.cursor = (stat.cursor + 1) % MAX_SAMPLES_PER_ROUTE;
+    }
+}
+export function recordDbQuery(n = 1) {
+    if (!ENABLED)
+        return;
+    dbQueryCount += n;
+}
+export function recordCacheHit(cacheName) {
+    if (!ENABLED)
+        return;
+    bumpCache(cacheName).hits += 1;
+}
+export function recordCacheMiss(cacheName) {
+    if (!ENABLED)
+        return;
+    bumpCache(cacheName).misses += 1;
+}
+function bumpCache(cacheName) {
+    let counters = cacheStats.get(cacheName);
+    if (!counters) {
+        counters = { hits: 0, misses: 0 };
+        cacheStats.set(cacheName, counters);
+    }
+    return counters;
+}
+function percentile(sorted, p) {
+    if (sorted.length === 0)
+        return 0;
+    const idx = Math.min(sorted.length - 1, Math.floor(sorted.length * p));
+    return sorted[idx];
+}
+export function getPerfSnapshot() {
+    const routes = [];
+    for (const [route, stat] of routeStats) {
+        const sorted = [...stat.samples].sort((a, b) => a - b);
+        routes.push({
+            route,
+            count: stat.count,
+            p50Ms: round(percentile(sorted, 0.5)),
+            p95Ms: round(percentile(sorted, 0.95)),
+            maxMs: round(stat.maxMs),
+            avgMs: round(stat.count > 0 ? stat.totalMs / stat.count : 0),
+        });
+    }
+    routes.sort((a, b) => b.count - a.count);
+    const caches = [];
+    for (const [cache, counters] of cacheStats) {
+        const total = counters.hits + counters.misses;
+        caches.push({
+            cache,
+            hits: counters.hits,
+            misses: counters.misses,
+            hitRate: total > 0 ? round(counters.hits / total) : 0,
+        });
+    }
+    return { enabled: ENABLED, routes, dbQueries: dbQueryCount, caches };
+}
+export function resetPerfSnapshot() {
+    routeStats.clear();
+    cacheStats.clear();
+    dbQueryCount = 0;
+}
+function round(value) {
+    return Math.round(value * 1000) / 1000;
+}

package/api/response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../../../../src/api/response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBlC,wBAAgB,QAAQ,CACtB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,IAAI,CAEN"}
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../../../../src/api/response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAqBlC,wBAAgB,QAAQ,CACtB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,IAAI,CAEN"}

package/api/response.js

@@ -1,19 +1,19 @@
-function scrubStackFields(value) {
+/**
+ * JSON.stringify replacer that strips stack traces in a single serialization
+ * pass: omits `stack`/`stackTrace` keys and renders Error values as a safe
+ * `{ error: message }`. This replaces a recursive deep-clone scrub that
+ * allocated a parallel object tree on every response (~86 us/response) — the
+ * replacer is byte-identical for all normal data and allocates nothing extra.
+ * (Values with a custom `toJSON`, e.g. Date, now serialize via `toJSON` as one
+ * would expect, instead of the old scrub's `{}`.)
+ */
+function scrubStackReplacer(_key, value) {
+    if (_key === "stack" || _key === "stackTrace") {
+        return undefined;
+    }
     if (value instanceof Error) {
         return { error: value.message || "Internal error" };
     }
-    if (Array.isArray(value)) {
-        return value.map(scrubStackFields);
-    }
-    if (value && typeof value === "object") {
-        const out = {};
-        for (const [key, nested] of Object.entries(value)) {
-            if (key === "stack" || key === "stackTrace")
-                continue;
-            out[key] = scrubStackFields(nested);
-        }
-        return out;
-    }
     return value;
 }
 export function sendJson(res, status, body) {
@@ -21,7 +21,7 @@ export function sendJson(res, status, body) {
         return;
     res.statusCode = status;
     res.setHeader("content-type", "application/json; charset=utf-8");
-    res.end(JSON.stringify(scrubStackFields(body)));
+    res.end(JSON.stringify(body, scrubStackReplacer));
 }
 export function sendJsonError(res, status, message) {
     sendJson(res, status, { error: message });

package/api/runtime-mode-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-mode-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/runtime-mode-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}
+{"version":3,"file":"runtime-mode-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/runtime-mode-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/api/runtime-mode-routes.js

@@ -7,9 +7,9 @@
  * — those are credentials the controller already holds; leaking them to
  * a browser session would broaden the trust boundary.
  */
+import { getRuntimeModeSnapshot } from "../runtime/mode/runtime-mode.js";
 import { ensureRouteAuthorized } from "./auth.js";
-import { sendJson, sendJsonError } from "./response";
-import { getRuntimeModeSnapshot } from "../runtime/mode/runtime-mode";
+import { sendJson, sendJsonError } from "./response.js";
 export async function handleRuntimeModeRoute(req, res, state) {
     const url = new URL(req.url ?? "/", "http://localhost");
     const method = (req.method ?? "GET").toUpperCase();

package/api/secrets-inventory-routes.js

@@ -35,9 +35,9 @@
  * not loosen that boundary.
  */
 import { listVaultInventory, profileStorageKey, ROUTING_KEY, readEntryMeta, readRoutingConfig, removeEntryMeta, setEntryMeta, writeRoutingConfig, } from "@elizaos/vault";
-import { sharedVault } from "../services/vault-mirror";
+import { sharedVault } from "../services/vault-mirror.js";
 import { ensureCompatSensitiveRouteAuthorized } from "./auth.js";
-import { sendJson, sendJsonError } from "./response";
+import { sendJson, sendJsonError } from "./response.js";
 // ── Public dispatcher ──────────────────────────────────────────────
 const KEY_RE = /^[A-Za-z0-9_.-]+$/;
 const PROFILE_ID_RE = /^[A-Za-z0-9_-]+$/;

package/api/secrets-manager-routes.d.ts

@@ -2,7 +2,7 @@ import type http from "node:http";
 import { type BackendId, type SecretsManager } from "@elizaos/vault";
 /** Test hook: drop the cached manager. Production code must not call this. */
 export declare function _resetSecretsManagerForTesting(): void;
-/** Test hook: inject a manager built around a test vault + stub exec. */
+/** Test hook: inject a manager built around a test vault + exec double. */
 export declare function _setSecretsManagerForTesting(next: SecretsManager | null): void;
 export declare function handleSecretsManagerRoute(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, method: string): Promise<boolean>;
 export type { BackendId };

package/api/secrets-manager-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-manager-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/secrets-manager-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,SAAS,EASd,KAAK,cAAc,EAMpB,MAAM,gBAAgB,CAAC;AAyExB,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD;AAED,yEAAyE;AACzE,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,IAAI,CAGN;AAeD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAyOlB;AA+ND,YAAY,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"secrets-manager-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/secrets-manager-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,SAAS,EAYd,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AAyExB,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,IAAI,CAGN;AAeD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAyOlB;AA8ND,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/api/secrets-manager-routes.js

@@ -1,7 +1,7 @@
 import { createManager, deleteSavedLogin, getAutofillAllowed, getSavedLogin, resolveRunnableMethods, setAutofillAllowed, setSavedLogin, } from "@elizaos/vault";
-import { _resetSecretsManagerInstallerForTesting, getSecretsManagerInstaller, } from "../services/secrets-manager-installer";
-import { sharedVault } from "../services/vault-mirror";
-import { sendJson, sendJsonError } from "./response";
+import { _resetSecretsManagerInstallerForTesting, getSecretsManagerInstaller, } from "../services/secrets-manager-installer.js";
+import { sharedVault } from "../services/vault-mirror.js";
+import { sendJson, sendJsonError } from "./response.js";
 /**
  * Routes that drive the Settings → Secrets Manager UI.
  *
@@ -18,7 +18,7 @@ import { sendJson, sendJsonError } from "./response";
  *
  * Saved-login routes (in-app browser autofill):
  *
- *   GET    /api/secrets/logins                 → UnifiedLoginListEntry[] (no passwords)
+ *   GET    /api/secrets/logins                 → LoginListEntry[] (no passwords)
  *                                                Aggregates in-house, 1Password, Bitwarden
  *   GET    /api/secrets/logins?domain=...      → filtered to one domain
  *   GET    /api/secrets/logins/reveal?source=...&identifier=...
@@ -30,8 +30,8 @@ import { sendJson, sendJsonError } from "./response";
  *
  * Why is CREATE in-house only? `op item create` and `bw create item` work
  * but require a vault path / folder id and structured field metadata that
- * a generic POST can't safely synthesize for the user. Adding an external
- * item is deferred to a future iteration with vendor-specific UI.
+ * a generic POST can't safely synthesize for the user. External-manager
+ * creates must go through vendor-specific UI that can collect those fields.
  *
  * The manager wraps `@elizaos/vault` and routes sensitive writes to
  * the user's chosen password manager (1Password / Proton / Bitwarden)
@@ -65,7 +65,7 @@ export function _resetSecretsManagerForTesting() {
     _manager = null;
     _resetSecretsManagerInstallerForTesting();
 }
-/** Test hook: inject a manager built around a test vault + stub exec. */
+/** Test hook: inject a manager built around a test vault + exec double. */
 export function _setSecretsManagerForTesting(next) {
     _manager = next;
     _resetSecretsManagerInstallerForTesting();
@@ -311,9 +311,8 @@ async function handleSavedLoginsRoute(req, res, pathname, method, manager) {
         });
         return true;
     }
-    // Unified reveal endpoint. Replaces the legacy
-    // `GET /api/secrets/logins/:domain/:user` which only knew about
-    // in-house entries.
+    // Reveal endpoint for all configured secret-manager sources. Replaces the
+    // legacy in-house-only `GET /api/secrets/logins/:domain/:user` route.
     if (method === "GET" && pathname === "/api/secrets/logins/reveal") {
         const url = new URL(req.url ?? "", "http://localhost");
         const source = url.searchParams.get("source");

package/api/sensitive-request-routes.js

@@ -1,9 +1,9 @@
 import { defaultSensitiveRequestPolicy, resolveSensitiveRequestDelivery, } from "@elizaos/core";
-import { sharedVault } from "../services/vault-mirror";
+import { sharedVault } from "../services/vault-mirror.js";
 import { ensureRouteAuthorized, getCompatApiToken, getProvidedApiToken, tokenMatches, } from "./auth.js";
-import { isTrustedLocalRequest, readCompatJsonBody, } from "./compat-route-shared";
-import { sendJson, sendJsonError } from "./response";
-import { localSensitiveRequestStore, redactLocalSensitiveRequest, } from "./sensitive-request-store";
+import { isTrustedLocalRequest, readCompatJsonBody, } from "./compat-route-shared.js";
+import { sendJson, sendJsonError } from "./response.js";
+import { localSensitiveRequestStore, redactLocalSensitiveRequest, } from "./sensitive-request-store.js";
 const ROUTE_PREFIX = "/api/sensitive-requests";
 const SAFE_ID_RE = /^[A-Za-z0-9._:-]{1,200}$/;
 const SAFE_KEY_RE = /^[A-Za-z0-9_.-]{1,256}$/;
@@ -237,7 +237,7 @@ async function ensureCallerAuthorized(req, res, state) {
     if (expected && provided && tokenMatches(expected, provided)) {
         return true;
     }
-    return await ensureRouteAuthorized(req, res, state);
+    return ensureRouteAuthorized(req, res, state);
 }
 async function defaultFulfillSecret(record, value) {
     if (record.target.kind !== "secret") {

package/api/server-cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-cors.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-cors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,GAAG,CAAC,MAAM,CAAC,CAYnD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,GAAG,CAAC,MAAM,CAAC,CAerD;AAMD,wBAAgB,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,CAKjD;AAED,wBAAgB,sBAAsB,IAAI,GAAG,CAAC,MAAM,CAAC,CAKpD;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,IAAI,IAAI,CAGjD;AAuCD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACjC,OAAO,CAkBT"}
+{"version":3,"file":"server-cors.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-cors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,GAAG,CAAC,MAAM,CAAC,CAanD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,GAAG,CAAC,MAAM,CAAC,CAerD;AAMD,wBAAgB,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,CAKjD;AAED,wBAAgB,sBAAsB,IAAI,GAAG,CAAC,MAAM,CAAC,CAKpD;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,IAAI,IAAI,CAGjD;AAmDD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACjC,OAAO,CAoBT"}

package/api/server-cors.js

@@ -11,6 +11,7 @@
 export function buildCorsAllowedPorts() {
     const ports = new Set([
         String(process.env.ELIZA_API_PORT ?? process.env.ELIZA_PORT ?? "31337"),
+        String(process.env.ELIZA_UI_PORT || process.env.ELIZA_PORT || ""),
         String(process.env.ELIZA_PORT ?? "2138"),
         String(process.env.ELIZA_GATEWAY_PORT ?? "18789"),
         String(process.env.ELIZA_HOME_PORT ?? "2142"),
@@ -83,6 +84,7 @@ const CAPACITOR_WEBVIEW_ORIGINS = new Set([
  * these origins; they are used by packaged/native app shells.
  */
 const NATIVE_WEBVIEW_PROTOCOLS = new Set([
+    "views:",
     "capacitor:",
     "capacitor-electron:",
     "ionic:",
@@ -97,6 +99,14 @@ const NATIVE_WEBVIEW_PROTOCOLS = new Set([
 function originString(u) {
     return `${u.protocol}//${u.host}`;
 }
+function isAllowedNativeWebviewHost(u) {
+    const host = u.hostname.toLowerCase();
+    return (host === "" ||
+        host === "localhost" ||
+        host === "127.0.0.1" ||
+        host === "[::1]" ||
+        host === "::1");
+}
 /**
  * Check whether a URL string is an allowed origin for CORS:
  *   - a configured local API port,
@@ -111,8 +121,9 @@ export function isAllowedOrigin(urlStr, allowedPorts, allowedRemoteOrigins) {
         const origin = originString(u);
         if (CAPACITOR_WEBVIEW_ORIGINS.has(origin))
             return true;
-        if (NATIVE_WEBVIEW_PROTOCOLS.has(u.protocol))
-            return true;
+        if (NATIVE_WEBVIEW_PROTOCOLS.has(u.protocol)) {
+            return isAllowedNativeWebviewHost(u);
+        }
         if (u.protocol !== "http:" && u.protocol !== "https:")
             return false;
         if (remoteOrigins.has(origin))

package/api/server-first-run-helpers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * First-run helpers — API key persistence, setup defaults,
+ * cloud-mode detection, and cloud-provisioned container detection.
+ */
+export declare function hasDeprecatedFirstRunRequestFields(body: Record<string, unknown>): boolean;
+/**
+ * Extract canonical first-run credential inputs from an first-run request body
+ * and persist them to config + process.env. Returns the env key name if a local
+ * provider API key was persisted, or null.
+ */
+export declare function extractAndPersistFirstRunApiKey(body: Record<string, unknown>): Promise<string | null>;
+export declare function persistFirstRunDefaults(body: Record<string, unknown>): string | null;
+export declare function deriveFirstRunReplayBody(body: Record<string, unknown>): {
+    isCloudMode: boolean;
+    replayBody: Record<string, unknown>;
+};
+/**
+ * Check if this is a cloud-provisioned container.
+ *
+ * METADATA-ONLY. This function exists so routes like `/api/cloud/status` can
+ * branch on cloud-provisioned shape. It does NOT authorise anything: callers
+ * must still pass through `ensureCompatApiAuthorized` (bearer token) or
+ * `ensureAuthSessionOrBootstrap`.
+ */
+export declare function isCloudProvisioned(): boolean;
+//# sourceMappingURL=server-first-run-helpers.d.ts.map

package/api/server-first-run-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-first-run-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-first-run-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoFH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAIT;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0FxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,GAAG,IAAI,CA6Gf;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CAkCA;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAc5C"}

package/api/server-first-run-helpers.js

@@ -0,0 +1,271 @@
+/**
+ * First-run helpers — API key persistence, setup defaults,
+ * cloud-mode detection, and cloud-provisioned container detection.
+ */
+import { applyFirstRunCredentialPersistence, loadElizaConfig, saveElizaConfig, } from "@elizaos/agent";
+import { logger, stringToUuid } from "@elizaos/core";
+import { deriveFirstRunCredentialPersistencePlan, getDefaultStylePreset, getStylePresets, migrateLegacyRuntimeConfig, normalizeCharacterLanguage, normalizeDeploymentTargetConfig, normalizeFirstRunCredentialInputs, normalizeLinkedAccountFlagsConfig, normalizeServiceRoutingConfig, PREMADE_VOICES, } from "@elizaos/shared";
+import { getCompatApiToken } from "./auth.js";
+import { resolveProviderCredential } from "./credential-resolver.js";
+// ---------------------------------------------------------------------------
+// First-run API key persistence
+// ---------------------------------------------------------------------------
+function trimToUndefined(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+const DEFAULT_ELEVENLABS_TTS_MODEL = "eleven_flash_v2_5";
+const ELEVENLABS_VOICE_ID_BY_PRESET = new Map(PREMADE_VOICES.map((voice) => [voice.id, voice.voiceId]));
+function resolveCompatFirstRunStyle(body, language) {
+    const presets = getStylePresets(language);
+    const requestedPresetId = trimToUndefined(body.presetId);
+    if (requestedPresetId) {
+        const byId = presets.find((preset) => preset.id === requestedPresetId);
+        if (byId)
+            return byId;
+    }
+    if (typeof body.avatarIndex === "number" &&
+        Number.isFinite(body.avatarIndex)) {
+        const byAvatar = presets.find((preset) => preset.avatarIndex === Number(body.avatarIndex));
+        if (byAvatar)
+            return byAvatar;
+    }
+    const requestedName = trimToUndefined(body.name);
+    if (requestedName) {
+        const byName = presets.find((preset) => preset.name === requestedName);
+        if (byName)
+            return byName;
+    }
+    return getDefaultStylePreset(language);
+}
+const DEPRECATED_FIRST_RUN_REQUEST_KEYS = [
+    "connection",
+    "runMode",
+    "cloudProvider",
+    "provider",
+    "providerApiKey",
+    "primaryModel",
+    "smallModel",
+    "largeModel",
+];
+export function hasDeprecatedFirstRunRequestFields(body) {
+    return DEPRECATED_FIRST_RUN_REQUEST_KEYS.some((key) => Object.hasOwn(body, key));
+}
+/**
+ * Extract canonical first-run credential inputs from an first-run request body
+ * and persist them to config + process.env. Returns the env key name if a local
+ * provider API key was persisted, or null.
+ */
+export async function extractAndPersistFirstRunApiKey(body) {
+    const credentialInputs = normalizeFirstRunCredentialInputs(body.credentialInputs);
+    const explicitDeploymentTarget = normalizeDeploymentTargetConfig(body.deploymentTarget);
+    const explicitServiceRouting = normalizeServiceRoutingConfig(body.serviceRouting);
+    logger.info(`[first-run] extractAndPersistFirstRunApiKey: credentialInputs=${credentialInputs ? "present" : "missing"}, keys=${Object.keys(body).join(",")}`);
+    const initialPlan = deriveFirstRunCredentialPersistencePlan({
+        credentialInputs,
+        deploymentTarget: explicitDeploymentTarget,
+        serviceRouting: explicitServiceRouting,
+    });
+    let effectiveCredentialInputs = credentialInputs;
+    let effectiveServiceRouting = explicitServiceRouting;
+    let llmSelection = initialPlan.llmSelection;
+    if (!llmSelection && !initialPlan.cloudApiKey) {
+        logger.warn("[first-run] No first-run credentials resolved from request body");
+        return null;
+    }
+    logger.info(`[first-run] Resolved selection: transport=${llmSelection?.transport ?? "none"}, provider=${llmSelection?.backend ?? "N/A"}, hasKey=${Boolean(llmSelection?.apiKey)}, hasCloudKey=${Boolean(initialPlan.cloudApiKey)}`);
+    // If the key is masked (from IPC) or missing, try to resolve the real
+    // key from local credential stores (files, keychain, env).
+    if (llmSelection?.transport === "direct" &&
+        llmSelection.backend !== "elizacloud" &&
+        !llmSelection.apiKey?.startsWith("****")) {
+        const resolved = resolveProviderCredential(llmSelection.backend);
+        if (resolved && resolved.authType === "subscription") {
+            effectiveCredentialInputs = {
+                ...(effectiveCredentialInputs ?? {}),
+                llmApiKey: resolved.apiKey,
+            };
+            effectiveServiceRouting = normalizeServiceRoutingConfig({
+                ...(effectiveServiceRouting ?? {}),
+                llmText: {
+                    ...(effectiveServiceRouting?.llmText ?? {}),
+                    backend: resolved.providerId,
+                    transport: "direct",
+                },
+            });
+            logger.info(`[first-run] Using subscription auth for ${resolved.providerId}`);
+        }
+        else if (resolved) {
+            effectiveCredentialInputs = {
+                ...(effectiveCredentialInputs ?? {}),
+                llmApiKey: resolved.apiKey,
+            };
+            logger.info(`[first-run] Resolved real key for ${llmSelection.backend} via credential-resolver`);
+        }
+        else if (!llmSelection.apiKey) {
+            logger.warn(`[first-run] No key found for ${llmSelection.backend} — cannot persist`);
+            return null;
+        }
+        llmSelection = deriveFirstRunCredentialPersistencePlan({
+            credentialInputs: effectiveCredentialInputs,
+            deploymentTarget: explicitDeploymentTarget,
+            serviceRouting: effectiveServiceRouting,
+        }).llmSelection;
+    }
+    const config = loadElizaConfig();
+    const result = await applyFirstRunCredentialPersistence(config, {
+        credentialInputs: effectiveCredentialInputs,
+        deploymentTarget: explicitDeploymentTarget,
+        serviceRouting: effectiveServiceRouting,
+    });
+    saveElizaConfig(config);
+    if (result) {
+        logger.info(`[first-run] Persisted ${result} from first-run credentials`);
+    }
+    return result;
+}
+export function persistFirstRunDefaults(body) {
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    if (!name) {
+        return null;
+    }
+    const config = loadElizaConfig();
+    const language = normalizeCharacterLanguage(body.language);
+    const stylePreset = resolveCompatFirstRunStyle(body, language);
+    if (!config.agents || typeof config.agents !== "object") {
+        config.agents = {};
+    }
+    const agents = config.agents;
+    if (!agents.defaults || typeof agents.defaults !== "object") {
+        agents.defaults = {};
+    }
+    const adminEntityId = stringToUuid(`${name}-admin-entity`);
+    agents.defaults.adminEntityId = adminEntityId;
+    if (!Array.isArray(agents.list) || agents.list.length === 0) {
+        agents.list = [{ id: "main", default: true }];
+    }
+    const agentEntry = agents.list[0];
+    agentEntry.name = name;
+    if (Array.isArray(body.bio)) {
+        agentEntry.bio = body.bio;
+    }
+    if (typeof body.systemPrompt === "string" && body.systemPrompt.trim()) {
+        agentEntry.system = body.systemPrompt.trim();
+    }
+    if (body.style && typeof body.style === "object") {
+        agentEntry.style = body.style;
+    }
+    if (Array.isArray(body.adjectives)) {
+        agentEntry.adjectives = body.adjectives;
+    }
+    if (Array.isArray(body.topics)) {
+        agentEntry.topics = body.topics;
+    }
+    if (Array.isArray(body.postExamples)) {
+        agentEntry.postExamples = body.postExamples;
+    }
+    if (Array.isArray(body.messageExamples)) {
+        agentEntry.messageExamples = body.messageExamples;
+    }
+    if (!config.ui || typeof config.ui !== "object") {
+        config.ui = {};
+    }
+    const ui = config.ui;
+    ui.assistant = {
+        ...(ui.assistant && typeof ui.assistant === "object"
+            ? ui.assistant
+            : {}),
+        name,
+    };
+    ui.language = language;
+    if (typeof body.avatarIndex === "number" &&
+        Number.isFinite(body.avatarIndex)) {
+        ui.avatarIndex = Number(body.avatarIndex);
+    }
+    else if (typeof stylePreset.avatarIndex === "number") {
+        ui.avatarIndex = stylePreset.avatarIndex;
+    }
+    if (trimToUndefined(body.presetId)) {
+        ui.presetId = trimToUndefined(body.presetId);
+    }
+    else if (stylePreset.id) {
+        ui.presetId = stylePreset.id;
+    }
+    const elevenLabsApiKey = process.env.ELEVENLABS_API_KEY?.trim();
+    const voicePresetId = stylePreset.voicePresetId.trim();
+    const voiceId = voicePresetId
+        ? ELEVENLABS_VOICE_ID_BY_PRESET.get(voicePresetId)
+        : undefined;
+    if (elevenLabsApiKey && voiceId) {
+        if (!config.messages || typeof config.messages !== "object") {
+            config.messages = {};
+        }
+        const messages = config.messages;
+        const existingTts = messages.tts && typeof messages.tts === "object"
+            ? messages.tts
+            : {};
+        const existingElevenlabs = existingTts.elevenlabs && typeof existingTts.elevenlabs === "object"
+            ? existingTts.elevenlabs
+            : {};
+        messages.tts = {
+            ...existingTts,
+            provider: "elevenlabs",
+            elevenlabs: {
+                ...existingElevenlabs,
+                voiceId,
+                modelId: typeof existingElevenlabs.modelId === "string" &&
+                    existingElevenlabs.modelId.trim()
+                    ? existingElevenlabs.modelId.trim()
+                    : DEFAULT_ELEVENLABS_TTS_MODEL,
+            },
+        };
+    }
+    migrateLegacyRuntimeConfig(config);
+    saveElizaConfig(config);
+    return adminEntityId;
+}
+export function deriveFirstRunReplayBody(body) {
+    const explicitDeploymentTarget = normalizeDeploymentTargetConfig(body.deploymentTarget);
+    const explicitCredentialInputs = normalizeFirstRunCredentialInputs(body.credentialInputs);
+    const deploymentTarget = explicitDeploymentTarget ?? undefined;
+    const linkedAccounts = normalizeLinkedAccountFlagsConfig(body.linkedAccounts) ?? undefined;
+    const serviceRouting = normalizeServiceRoutingConfig(body.serviceRouting) ?? undefined;
+    const isCloudMode = deploymentTarget?.runtime === "cloud";
+    const replayBody = { ...body };
+    for (const key of DEPRECATED_FIRST_RUN_REQUEST_KEYS) {
+        delete replayBody[key];
+    }
+    if (deploymentTarget) {
+        replayBody.deploymentTarget = deploymentTarget;
+    }
+    if (linkedAccounts) {
+        replayBody.linkedAccounts = linkedAccounts;
+    }
+    if (serviceRouting) {
+        replayBody.serviceRouting = serviceRouting;
+    }
+    if (explicitCredentialInputs) {
+        replayBody.credentialInputs = explicitCredentialInputs;
+    }
+    return { isCloudMode, replayBody };
+}
+/**
+ * Check if this is a cloud-provisioned container.
+ *
+ * METADATA-ONLY. This function exists so routes like `/api/cloud/status` can
+ * branch on cloud-provisioned shape. It does NOT authorise anything: callers
+ * must still pass through `ensureCompatApiAuthorized` (bearer token) or
+ * `ensureAuthSessionOrBootstrap`.
+ */
+export function isCloudProvisioned() {
+    const hasCloudFlag = process.env.ELIZA_CLOUD_PROVISIONED === "1";
+    const hasCloudApiKeyProvisioning = process.env.ELIZAOS_CLOUD_ENABLED === "true" &&
+        Boolean(process.env.ELIZAOS_CLOUD_API_KEY?.trim());
+    const hasPlatformToken = Boolean(process.env.STEWARD_AGENT_TOKEN?.trim() ||
+        getCompatApiToken() ||
+        hasCloudApiKeyProvisioning);
+    return hasCloudFlag && hasPlatformToken;
+}

package/api/server-security.js

@@ -4,7 +4,7 @@
  */
 import { ensureApiTokenForBindHost as upstreamEnsureApiTokenForBindHost, resolveMcpTerminalAuthorizationRejection as upstreamResolveMcpTerminalAuthorizationRejection, resolveTerminalRunClientId as upstreamResolveTerminalRunClientId, resolveTerminalRunRejection as upstreamResolveTerminalRunRejection, resolveWebSocketUpgradeRejection as upstreamResolveWebSocketUpgradeRejection, } from "@elizaos/agent";
 import { syncAppEnvToEliza, syncElizaEnvAliases } from "@elizaos/shared";
-import { normalizeCompatRejection, runWithCompatAuthContext, } from "./server-wallet-trade";
+import { normalizeCompatRejection, runWithCompatAuthContext, } from "./server-wallet-trade.js";
 export function resolveMcpTerminalAuthorizationRejection(...args) {
     const [req] = args;
     return runWithCompatAuthContext(req, () => normalizeCompatRejection(upstreamResolveMcpTerminalAuthorizationRejection(...args)));

package/api/server-startup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-startup.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-startup.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,iBAAiB,IAAI,yBAAyB,EAC/C,MAAM,gBAAgB,CAAC;AAKxB,wBAAgB,mBAAmB,CACjC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,GACtD,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAgChD;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiC3D;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,GACpD,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAO9C"}
+{"version":3,"file":"server-startup.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-startup.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,iBAAiB,IAAI,yBAAyB,EAC/C,MAAM,gBAAgB,CAAC;AAKxB,wBAAgB,mBAAmB,CACjC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,GACtD,UAAU,CAAC,OAAO,2BAA2B,CAAC,CA+BhD;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiC3D;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,GACpD,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAO9C"}