@elizaos/app-core 2.0.0-beta.3 → 2.0.11-beta.6

package/agent-bridge.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Narrow runtime bridge consumed by `@elizaos/agent` via dynamic import.
+ *
+ * Phase-2 refactor: agent has a runtime-only dependency on a small number of
+ * app-core symbols (account-pool singleton, shared vault, vault bootstrap,
+ * wallet-key hydration, build-variant flags). The agent loads them lazily
+ * via `await import("@elizaos/app-core/agent-bridge")` so the static
+ * dependency graph (and `bunx madge`) sees a leaf `.d.ts` whose transitive
+ * imports do NOT reach back into `@elizaos/agent`. This is the documented
+ * "narrow subpath" exception in `AGENTS.md` — used here deliberately to
+ * break the agent ↔ app-core .d.ts cycle that madge picks up by following
+ * the dynamic-import specifier into `app-core/dist/index.d.ts` (the full
+ * barrel which re-exports server-* + runtime/* modules that DO import from
+ * `@elizaos/agent`).
+ *
+ * Every symbol re-exported here lives in an app-core source file whose
+ * compiled `.d.ts` does not import from `@elizaos/agent`. Keep it that way:
+ * if a new bridge symbol's source pulls in agent types in its public
+ * signatures, do NOT add it here — rework the underlying module so its
+ * emitted `.d.ts` stays agent-free, or move the type to `@elizaos/shared`.
+ */
+export { getBuildVariant, isStoreBuild } from "./runtime/build-variant";
+export { hydrateWalletKeysFromNodePlatformSecureStore } from "./security/hydrate-wallet-keys-from-platform-store";
+export { applyAccountPoolApiCredentials, getDefaultAccountPool, startAccountPoolKeepAlive, } from "./services/account-pool";
+export { runVaultBootstrap } from "./services/vault-bootstrap";
+export { sharedVault } from "./services/vault-mirror";
+//# sourceMappingURL=agent-bridge.d.ts.map

package/agent-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-bridge.d.ts","sourceRoot":"","sources":["../../../../src/agent-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,4CAA4C,EAAE,MAAM,oDAAoD,CAAC;AAClH,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC"}

package/agent-bridge.js

@@ -0,0 +1,26 @@
+/**
+ * Narrow runtime bridge consumed by `@elizaos/agent` via dynamic import.
+ *
+ * Phase-2 refactor: agent has a runtime-only dependency on a small number of
+ * app-core symbols (account-pool singleton, shared vault, vault bootstrap,
+ * wallet-key hydration, build-variant flags). The agent loads them lazily
+ * via `await import("@elizaos/app-core/agent-bridge")` so the static
+ * dependency graph (and `bunx madge`) sees a leaf `.d.ts` whose transitive
+ * imports do NOT reach back into `@elizaos/agent`. This is the documented
+ * "narrow subpath" exception in `AGENTS.md` — used here deliberately to
+ * break the agent ↔ app-core .d.ts cycle that madge picks up by following
+ * the dynamic-import specifier into `app-core/dist/index.d.ts` (the full
+ * barrel which re-exports server-* + runtime/* modules that DO import from
+ * `@elizaos/agent`).
+ *
+ * Every symbol re-exported here lives in an app-core source file whose
+ * compiled `.d.ts` does not import from `@elizaos/agent`. Keep it that way:
+ * if a new bridge symbol's source pulls in agent types in its public
+ * signatures, do NOT add it here — rework the underlying module so its
+ * emitted `.d.ts` stays agent-free, or move the type to `@elizaos/shared`.
+ */
+export { getBuildVariant, isStoreBuild } from "./runtime/build-variant.js";
+export { hydrateWalletKeysFromNodePlatformSecureStore } from "./security/hydrate-wallet-keys-from-platform-store.js";
+export { applyAccountPoolApiCredentials, getDefaultAccountPool, startAccountPoolKeepAlive, } from "./services/account-pool.js";
+export { runVaultBootstrap } from "./services/vault-bootstrap.js";
+export { sharedVault } from "./services/vault-mirror.js";

package/api/__tests__/sandbox-test-helpers.js

@@ -1,7 +1,7 @@
 /**
  * Shared helpers for sandbox route tests.
  */
-import { createMockHttpResponse, createMockIncomingMessage, } from "@elizaos/shared";
+import { createMockHttpResponse, createMockIncomingMessage, } from "../../test-support/test-helpers.js";
 export function createMockReq(method, body) {
     return createMockIncomingMessage({
         method,

package/api/auth/audit.js

@@ -17,7 +17,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { resolveElizaStateDir } from "../../services/cloud-jwks-store";
+import { resolveElizaStateDir } from "../../services/cloud-jwks-store.js";
 export const AUDIT_LOG_FILENAME = "audit.log";
 export const AUDIT_LOG_ROTATE_FILENAME = "audit.log.1";
 export const AUDIT_LOG_MAX_BYTES = 10 * 1024 * 1024;

package/api/auth/auth-context.js

@@ -12,7 +12,7 @@
  * error and pretend the request was authenticated.
  */
 import { getProvidedApiToken } from "../auth.js";
-import { findActiveSession, parseSessionCookie } from "./sessions";
+import { findActiveSession, parseSessionCookie } from "./sessions.js";
 /**
  * Resolve the request to a session + identity if possible. Returns null on
  * any failure path; never throws on bad input. The caller is responsible

package/api/auth/bootstrap-token.js

@@ -12,7 +12,7 @@
  * `{ ok: false, reason }` and the caller MUST refuse the request.
  */
 import { createLocalJWKSet, jwtVerify } from "jose";
-import { readCachedJwks, writeCachedJwks, } from "../../services/cloud-jwks-store";
+import { readCachedJwks, writeCachedJwks, } from "../../services/cloud-jwks-store.js";
 export const BOOTSTRAP_TOKEN_ALG = "RS256";
 export const BOOTSTRAP_TOKEN_SCOPE = "bootstrap";
 function isFiniteNumber(value) {
@@ -140,7 +140,7 @@ export async function verifyBootstrapToken(token, options) {
     }
     const now = options.now?.() ?? Date.now();
     // Defence in depth: jose already rejects expired tokens, but an attacker
-    // who controls the signing key could mint with a future `exp` we still
+    // who controls the signing key could mint with an excessive `exp` we still
     // refuse to honour beyond reason.
     if (claims.exp * 1000 <= now)
         return { ok: false, reason: "expired" };

package/api/auth/index.d.ts

@@ -1,14 +1,13 @@
 /**
- * Barrel for the P0 auth subsystem.
+ * Barrel for the auth subsystem.
  *
- * Consumers should import from here rather than reaching into the individual
- * module files; this keeps the public surface explicit and lets us reshape
- * internals during P1+ without rippling through callers.
+ * Import from here rather than reaching into individual module files.
  */
-export { AUDIT_LOG_FILENAME, AUDIT_LOG_MAX_BYTES, AUDIT_LOG_ROTATE_FILENAME, AUDIT_REDACTION_RE, type AuditEmitterOptions, type AuditEventInput, appendAuditEvent, redactMetadata, resolveAuditLogPath, resolveAuditLogRotatedPath, } from "./audit";
-export { type AuthContextSource, type EnsureSessionOptions, ensureSessionForRequest, type ResolvedAuthContext, } from "./auth-context";
-export { BOOTSTRAP_TOKEN_ALG, BOOTSTRAP_TOKEN_SCOPE, type BootstrapTokenClaims, type VerifyBootstrapFailureReason, type VerifyBootstrapResult, verifyBootstrapToken, } from "./bootstrap-token";
-export { ARGON2_PARAMS, assertPasswordStrong, hashPassword, PASSWORD_MIN_LENGTH, type PasswordStrengthFailureReason, verifyPassword, WeakPasswordError, } from "./passwords";
-export { _resetSensitiveLimiters, bootstrapExchangeLimiter, getSensitiveLimiter, SENSITIVE_RATE_LIMIT_MAX, SENSITIVE_RATE_LIMIT_WINDOW_MS, } from "./sensitive-rate-limit";
-export { BROWSER_SESSION_REMEMBER_CAP_MS, BROWSER_SESSION_TTL_MS, type CreateBrowserSessionOptions, type CreateMachineSessionOptions, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createBrowserSession, createMachineSession, deriveCsrfToken, findActiveSession, MACHINE_SESSION_TTL_MS, parseCookieHeader, parseSessionCookie, revokeAllSessionsForIdentity, revokeSession, SESSION_COOKIE_NAME, type SessionWithCsrf, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyCsrfToken, } from "./sessions";
+export { _resetAuthRateLimiter, type AuthSessionOrBootstrapResult, ensureAuthSessionOrBootstrap, ensureCompatApiAuthorized, ensureCompatApiAuthorizedAsync, ensureCompatSensitiveRouteAuthorized, ensureRouteAuthorized, extractHeaderValue, getCompatApiToken, getProvidedApiToken, getSessionCookieName, isDevEnvironment, readCookie, tokenMatches, } from "../auth.js";
+export { AUDIT_LOG_FILENAME, AUDIT_LOG_MAX_BYTES, AUDIT_LOG_ROTATE_FILENAME, AUDIT_REDACTION_RE, type AuditEmitterOptions, type AuditEventInput, appendAuditEvent, redactMetadata, resolveAuditLogPath, resolveAuditLogRotatedPath, } from "./audit.js";
+export { type AuthContextSource, type EnsureSessionOptions, ensureSessionForRequest, type ResolvedAuthContext, } from "./auth-context.js";
+export { BOOTSTRAP_TOKEN_ALG, BOOTSTRAP_TOKEN_SCOPE, type BootstrapTokenClaims, type VerifyBootstrapFailureReason, type VerifyBootstrapResult, verifyBootstrapToken, } from "./bootstrap-token.js";
+export { ARGON2_PARAMS, assertPasswordStrong, hashPassword, PASSWORD_MIN_LENGTH, type PasswordStrengthFailureReason, verifyPassword, WeakPasswordError, } from "./passwords.js";
+export { _resetSensitiveLimiters, bootstrapExchangeLimiter, getSensitiveLimiter, SENSITIVE_RATE_LIMIT_MAX, SENSITIVE_RATE_LIMIT_WINDOW_MS, } from "./sensitive-rate-limit.js";
+export { BROWSER_SESSION_REMEMBER_CAP_MS, BROWSER_SESSION_TTL_MS, type CreateBrowserSessionOptions, type CreateMachineSessionOptions, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createBrowserSession, createMachineSession, deriveCsrfToken, findActiveSession, MACHINE_SESSION_TTL_MS, parseCookieHeader, parseSessionCookie, revokeAllSessionsForIdentity, revokeSession, SESSION_COOKIE_NAME, type SessionWithCsrf, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyCsrfToken, } from "./sessions.js";
 //# sourceMappingURL=index.d.ts.map

package/api/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,4BAA4B,EAC5B,aAAa,EACb,mBAAmB,EACnB,KAAK,eAAe,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,oCAAoC,EACpC,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,4BAA4B,EAC5B,aAAa,EACb,mBAAmB,EACnB,KAAK,eAAe,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,eAAe,GAChB,MAAM,eAAe,CAAC"}

package/api/auth/index.js

@@ -1,13 +1,12 @@
 /**
- * Barrel for the P0 auth subsystem.
+ * Barrel for the auth subsystem.
  *
- * Consumers should import from here rather than reaching into the individual
- * module files; this keeps the public surface explicit and lets us reshape
- * internals during P1+ without rippling through callers.
+ * Import from here rather than reaching into individual module files.
  */
-export { AUDIT_LOG_FILENAME, AUDIT_LOG_MAX_BYTES, AUDIT_LOG_ROTATE_FILENAME, AUDIT_REDACTION_RE, appendAuditEvent, redactMetadata, resolveAuditLogPath, resolveAuditLogRotatedPath, } from "./audit";
-export { ensureSessionForRequest, } from "./auth-context";
-export { BOOTSTRAP_TOKEN_ALG, BOOTSTRAP_TOKEN_SCOPE, verifyBootstrapToken, } from "./bootstrap-token";
-export { ARGON2_PARAMS, assertPasswordStrong, hashPassword, PASSWORD_MIN_LENGTH, verifyPassword, WeakPasswordError, } from "./passwords";
-export { _resetSensitiveLimiters, bootstrapExchangeLimiter, getSensitiveLimiter, SENSITIVE_RATE_LIMIT_MAX, SENSITIVE_RATE_LIMIT_WINDOW_MS, } from "./sensitive-rate-limit";
-export { BROWSER_SESSION_REMEMBER_CAP_MS, BROWSER_SESSION_TTL_MS, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createBrowserSession, createMachineSession, deriveCsrfToken, findActiveSession, MACHINE_SESSION_TTL_MS, parseCookieHeader, parseSessionCookie, revokeAllSessionsForIdentity, revokeSession, SESSION_COOKIE_NAME, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyCsrfToken, } from "./sessions";
+export { _resetAuthRateLimiter, ensureAuthSessionOrBootstrap, ensureCompatApiAuthorized, ensureCompatApiAuthorizedAsync, ensureCompatSensitiveRouteAuthorized, ensureRouteAuthorized, extractHeaderValue, getCompatApiToken, getProvidedApiToken, getSessionCookieName, isDevEnvironment, readCookie, tokenMatches, } from "../auth.js";
+export { AUDIT_LOG_FILENAME, AUDIT_LOG_MAX_BYTES, AUDIT_LOG_ROTATE_FILENAME, AUDIT_REDACTION_RE, appendAuditEvent, redactMetadata, resolveAuditLogPath, resolveAuditLogRotatedPath, } from "./audit.js";
+export { ensureSessionForRequest, } from "./auth-context.js";
+export { BOOTSTRAP_TOKEN_ALG, BOOTSTRAP_TOKEN_SCOPE, verifyBootstrapToken, } from "./bootstrap-token.js";
+export { ARGON2_PARAMS, assertPasswordStrong, hashPassword, PASSWORD_MIN_LENGTH, verifyPassword, WeakPasswordError, } from "./passwords.js";
+export { _resetSensitiveLimiters, bootstrapExchangeLimiter, getSensitiveLimiter, SENSITIVE_RATE_LIMIT_MAX, SENSITIVE_RATE_LIMIT_WINDOW_MS, } from "./sensitive-rate-limit.js";
+export { BROWSER_SESSION_REMEMBER_CAP_MS, BROWSER_SESSION_TTL_MS, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createBrowserSession, createMachineSession, deriveCsrfToken, findActiveSession, MACHINE_SESSION_TTL_MS, parseCookieHeader, parseSessionCookie, revokeAllSessionsForIdentity, revokeSession, SESSION_COOKIE_NAME, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyCsrfToken, } from "./sessions.js";

package/api/auth/passwords.js

@@ -71,7 +71,7 @@ export function assertPasswordStrong(plain) {
  * Errors propagate to the caller — fail-fast policy.
  */
 export async function hashPassword(plain) {
-    return await hash(plain, ARGON2_PARAMS);
+    return hash(plain, ARGON2_PARAMS);
 }
 /**
  * Compare `plain` against a stored argon2id hash. Returns `true` on match,
@@ -83,5 +83,5 @@ export async function hashPassword(plain) {
  * => false)` is wrong; let it surface).
  */
 export async function verifyPassword(plain, encodedHash) {
-    return await verify(encodedHash, plain);
+    return verify(encodedHash, plain);
 }

package/api/auth/sensitive-rate-limit.d.ts

@@ -45,10 +45,7 @@ declare class SensitiveRateLimiter {
  * `_resetSensitiveLimiters` test helper handle them all.
  */
 export declare function getSensitiveLimiter(name: string): SensitiveRateLimiter;
-/**
- * Bootstrap exchange limiter — kept as a named export so existing P0
- * callers don't churn. New code should prefer `getSensitiveLimiter(name)`.
- */
+/** Bootstrap exchange limiter. New code should prefer `getSensitiveLimiter(name)`. */
 export declare const bootstrapExchangeLimiter: SensitiveRateLimiter;
 /** Reset state. Test-only. */
 export declare function _resetSensitiveLimiters(): void;

package/api/auth/sensitive-rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive-rate-limit.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/sensitive-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAO1C,cAAM,oBAAoB;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAe7D,KAAK,IAAI,IAAI;IAIb,KAAK,CAAC,GAAG,GAAE,MAAmB,GAAG,IAAI;CAKtC;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAOtE;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,sBAEpC,CAAC;AAcF,8BAA8B;AAC9B,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C"}
+{"version":3,"file":"sensitive-rate-limit.d.ts","sourceRoot":"","sources":["../../../../../../src/api/auth/sensitive-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAO1C,cAAM,oBAAoB;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAe7D,KAAK,IAAI,IAAI;IAIb,KAAK,CAAC,GAAG,GAAE,MAAmB,GAAG,IAAI;CAKtC;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAUtE;AAED,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,sBAEpC,CAAC;AAcF,8BAA8B;AAC9B,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C"}

package/api/auth/sensitive-rate-limit.js

@@ -35,7 +35,7 @@ class SensitiveRateLimiter {
     consume(ip, now = Date.now()) {
         const key = ip ?? "unknown";
         const entry = this.buckets.get(key);
-        if (!entry || now > entry.resetAt) {
+        if (!entry || now >= entry.resetAt) {
             this.buckets.set(key, {
                 count: 1,
                 resetAt: now + SENSITIVE_RATE_LIMIT_WINDOW_MS,
@@ -52,7 +52,7 @@ class SensitiveRateLimiter {
     }
     sweep(now = Date.now()) {
         for (const [key, entry] of this.buckets) {
-            if (now > entry.resetAt)
+            if (now >= entry.resetAt)
                 this.buckets.delete(key);
         }
     }
@@ -67,6 +67,9 @@ const limiterRegistry = new Map();
  * `_resetSensitiveLimiters` test helper handle them all.
  */
 export function getSensitiveLimiter(name) {
+    if (!name.trim()) {
+        throw new Error("Sensitive limiter name is required");
+    }
     let limiter = limiterRegistry.get(name);
     if (!limiter) {
         limiter = new SensitiveRateLimiter();
@@ -74,10 +77,7 @@ export function getSensitiveLimiter(name) {
     }
     return limiter;
 }
-/**
- * Bootstrap exchange limiter — kept as a named export so existing P0
- * callers don't churn. New code should prefer `getSensitiveLimiter(name)`.
- */
+/** Bootstrap exchange limiter. New code should prefer `getSensitiveLimiter(name)`. */
 export const bootstrapExchangeLimiter = getSensitiveLimiter("auth.bootstrap.exchange");
 const sweepTimer = setInterval(() => {
     for (const limiter of limiterRegistry.values()) {

package/api/auth/sessions.js

@@ -15,8 +15,8 @@
  */
 import crypto from "node:crypto";
 import { isLoopbackBindHost, resolveApiBindHost, } from "@elizaos/shared";
-import { appendAuditEvent } from "./audit";
-import { tokenMatches } from "./tokens";
+import { appendAuditEvent } from "./audit.js";
+import { tokenMatches } from "./tokens.js";
 // ── TTLs (plan §1.3, §4.4) ───────────────────────────────────────────────────
 /** Browser session sliding window: 12h. */
 export const BROWSER_SESSION_TTL_MS = 12 * 60 * 60 * 1000;

package/api/auth-bootstrap-routes.d.ts

@@ -2,14 +2,10 @@
  * Bootstrap-token exchange route.
  *
  * The cloud control plane mints a single-use RS256 JWT and injects it as
- * `ELIZA_CLOUD_BOOTSTRAP_TOKEN`. The dashboard pastes the same value into
- * this endpoint exactly once; on success we mint a long-lived browser
- * session row and return its id. The UI uses the id as a bearer until P1
- * lands the cookie + CSRF infrastructure.
- *
- * This is the only place that flips bootstrap → session. The token's `jti`
- * is consumed atomically by the verifier so a replay (even after a crash
- * mid-mint) is rejected.
+ * `ELIZA_CLOUD_BOOTSTRAP_TOKEN`. The dashboard submits it to this endpoint
+ * exactly once; on success a long-lived browser session row is minted and
+ * returned as a cookie pair. The token's `jti` is consumed atomically so
+ * any replay is rejected.
  */
 import type http from "node:http";
 import { type CompatRuntimeState } from "./compat-route-shared";
@@ -20,13 +16,10 @@ export declare const BROWSER_SESSION_TTL_MS: number;
  *
  * Body: `{ token: string }`
  *
- * Success: 200 with `{ sessionId, identityId, expiresAt }`. The caller stores
- * the session id and presents it as a bearer (`Authorization: Bearer …`)
- * on subsequent requests until P1 ships cookie auth.
+ * Success: 200 with `{ sessionId, identityId, expiresAt }` plus session/CSRF cookies.
  *
  * Failure: 401 / 403 / 429 with `{ error, reason }`. Reason is one of the
- * `VerifyBootstrapFailureReason` values plus `rate_limited` and
- * `db_unavailable`.
+ * `VerifyBootstrapFailureReason` values plus `rate_limited` and `db_unavailable`.
  */
 export declare function handleAuthBootstrapRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=auth-bootstrap-routes.d.ts.map

package/api/auth-bootstrap-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-bootstrap-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-bootstrap-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,uBAAuB,CAAC;AAM/B,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAiC1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAuIlB"}
+{"version":3,"file":"auth-bootstrap-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-bootstrap-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAM/B,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAiC1D;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAsIlB"}

package/api/auth-bootstrap-routes.js

@@ -2,21 +2,18 @@
  * Bootstrap-token exchange route.
  *
  * The cloud control plane mints a single-use RS256 JWT and injects it as
- * `ELIZA_CLOUD_BOOTSTRAP_TOKEN`. The dashboard pastes the same value into
- * this endpoint exactly once; on success we mint a long-lived browser
- * session row and return its id. The UI uses the id as a bearer until P1
- * lands the cookie + CSRF infrastructure.
- *
- * This is the only place that flips bootstrap → session. The token's `jti`
- * is consumed atomically by the verifier so a replay (even after a crash
- * mid-mint) is rejected.
+ * `ELIZA_CLOUD_BOOTSTRAP_TOKEN`. The dashboard submits it to this endpoint
+ * exactly once; on success a long-lived browser session row is minted and
+ * returned as a cookie pair. The token's `jti` is consumed atomically so
+ * any replay is rejected.
  */
 import crypto from "node:crypto";
-import { AuthStore } from "../services/auth-store";
-import { appendAuditEvent, bootstrapExchangeLimiter, serializeCsrfCookie, serializeSessionCookie, verifyBootstrapToken, } from "./auth/index";
+import { logger as Logger } from "@elizaos/core";
+import { AuthStore } from "../services/auth-store.js";
+import { appendAuditEvent, bootstrapExchangeLimiter, serializeCsrfCookie, serializeSessionCookie, verifyBootstrapToken, } from "./auth/index.js";
 import { extractHeaderValue } from "./auth.js";
-import { isLoopbackRemoteAddress, readCompatJsonBody, } from "./compat-route-shared";
-import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response";
+import { readCompatJsonBody, } from "./compat-route-shared.js";
+import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response.js";
 /** 12h sliding TTL for browser sessions per plan §1.3. */
 export const BROWSER_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
 function getDrizzleDb(state) {
@@ -51,13 +48,10 @@ function deriveIdentityIdFromCloudUser(cloudUserId) {
  *
  * Body: `{ token: string }`
  *
- * Success: 200 with `{ sessionId, identityId, expiresAt }`. The caller stores
- * the session id and presents it as a bearer (`Authorization: Bearer …`)
- * on subsequent requests until P1 ships cookie auth.
+ * Success: 200 with `{ sessionId, identityId, expiresAt }` plus session/CSRF cookies.
  *
  * Failure: 401 / 403 / 429 with `{ error, reason }`. Reason is one of the
- * `VerifyBootstrapFailureReason` values plus `rate_limited` and
- * `db_unavailable`.
+ * `VerifyBootstrapFailureReason` values plus `rate_limited` and `db_unavailable`.
  */
 export async function handleAuthBootstrapRoutes(req, res, state) {
     const method = (req.method ?? "GET").toUpperCase();
@@ -65,7 +59,7 @@ export async function handleAuthBootstrapRoutes(req, res, state) {
     if (method !== "POST" || url.pathname !== "/api/auth/bootstrap/exchange") {
         return false;
     }
-    const ip = req.socket?.remoteAddress ?? null;
+    const ip = req.socket.remoteAddress ?? null;
     if (!bootstrapExchangeLimiter.consume(ip)) {
         sendJsonResponse(res, 429, {
             error: "rate_limited",
@@ -105,8 +99,7 @@ export async function handleAuthBootstrapRoutes(req, res, state) {
             metadata: { reason: result.reason },
         }, { store }).catch((err) => {
             // Audit failure must not change auth outcome — but it must surface.
-            // Log to stderr; the route still returns the original auth failure.
-            console.error("[auth] audit append failed:", err);
+            Logger.error("[AuthBootstrapRoutes] audit append failed", err instanceof Error ? err.message : String(err));
         });
         const status = result.reason === "missing_token"
             ? 400
@@ -150,9 +143,6 @@ export async function handleAuthBootstrapRoutes(req, res, state) {
         userAgent,
         scopes: [],
     });
-    // P1: bootstrap exchange now also sets the cookie pair. The response body
-    // continues to include `sessionId` for P0 SPA compat (sessionStorage-based
-    // bearer fallback) but the canonical credential is the cookie.
     res.setHeader("set-cookie", [
         serializeSessionCookie(session),
         serializeCsrfCookie(session),
@@ -165,15 +155,12 @@ export async function handleAuthBootstrapRoutes(req, res, state) {
         outcome: "success",
         metadata: { containerId: claims.containerId, jti: claims.jti },
     }, { store }).catch((err) => {
-        console.error("[auth] audit append failed:", err);
+        Logger.error("[AuthBootstrapRoutes] audit append failed", err instanceof Error ? err.message : String(err));
     });
     sendJsonResponse(res, 200, {
         sessionId,
         identityId,
         expiresAt,
     });
-    // We deliberately mark loopback so dev runs over `localhost` don't miss
-    // the response (no functional effect — just documents intent).
-    void isLoopbackRemoteAddress(ip);
     return true;
 }

package/api/auth-pairing-routes.d.ts

@@ -0,0 +1,17 @@
+import type http from "node:http";
+import { type CompatRuntimeState } from "./compat-route-shared";
+export declare function _resetAuthPairingStateForTests(): void;
+export declare function ensureAuthPairingCodeForRemoteAccess(): {
+    code: string;
+    expiresAt: number;
+} | null;
+/**
+ * Auth / pairing routes:
+ *
+ * - `GET  /api/first-run/status`
+ * - `GET  /api/auth/status`
+ * - `GET  /api/auth/pair-code`
+ * - `POST /api/auth/pair`
+ */
+export declare function handleAuthPairingCompatRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
+//# sourceMappingURL=auth-pairing-routes.d.ts.map

package/api/auth-pairing-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-pairing-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-pairing-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAelC,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAkC/B,wBAAgB,8BAA8B,IAAI,IAAI,CAIrD;AAuCD,wBAAgB,oCAAoC,IAAI;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAGP;AAoFD;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CA2LlB"}