@elizaos/app-core 2.0.3-beta.2 → 2.0.3-beta.4

package/agent-bridge.d.ts

@@ -19,9 +19,9 @@
  * signatures, do NOT add it here — rework the underlying module so its
  * emitted `.d.ts` stays agent-free, or move the type to `@elizaos/shared`.
  */
-export { getBuildVariant, isStoreBuild } from "./runtime/build-variant";
-export { hydrateWalletKeysFromNodePlatformSecureStore } from "./security/hydrate-wallet-keys-from-platform-store";
-export { applyAccountPoolApiCredentials, getDefaultAccountPool, startAccountPoolKeepAlive, } from "./services/account-pool";
-export { runVaultBootstrap } from "./services/vault-bootstrap";
-export { sharedVault } from "./services/vault-mirror";
+export { getBuildVariant, isStoreBuild } from "./runtime/build-variant.js";
+export { hydrateWalletKeysFromNodePlatformSecureStore } from "./security/hydrate-wallet-keys-from-platform-store.js";
+export { applyAccountPoolApiCredentials, getDefaultAccountPool, startAccountPoolKeepAlive, } from "./services/account-pool.js";
+export { runVaultBootstrap } from "./services/vault-bootstrap.js";
+export { sharedVault } from "./services/vault-mirror.js";
 //# sourceMappingURL=agent-bridge.d.ts.map

package/api/auth/audit.d.ts

@@ -15,7 +15,7 @@
  * bearer token into an audit row.
  */
 import type { RuntimeEnvRecord } from "@elizaos/shared";
-import type { AuthStore } from "../../services/auth-store";
+import type { AuthStore } from "../../services/auth-store.js";
 export declare const AUDIT_LOG_FILENAME = "audit.log";
 export declare const AUDIT_LOG_ROTATE_FILENAME = "audit.log.1";
 export declare const AUDIT_LOG_MAX_BYTES: number;

package/api/auth/auth-context.d.ts

@@ -13,7 +13,7 @@
  */
 import type http from "node:http";
 import type { RuntimeEnvRecord } from "@elizaos/shared";
-import type { AuthIdentityRow, AuthSessionRow, AuthStore } from "../../services/auth-store";
+import type { AuthIdentityRow, AuthSessionRow, AuthStore } from "../../services/auth-store.js";
 export type AuthContextSource = "cookie" | "bearer-session" | "bearer-bootstrap";
 export interface ResolvedAuthContext {
     session: AuthSessionRow | null;

package/api/auth/bootstrap-token.d.ts

@@ -12,7 +12,7 @@
  * `{ ok: false, reason }` and the caller MUST refuse the request.
  */
 import type { RuntimeEnvRecord } from "@elizaos/shared";
-import type { AuthStore } from "../../services/auth-store";
+import type { AuthStore } from "../../services/auth-store.js";
 export declare const BOOTSTRAP_TOKEN_ALG = "RS256";
 export declare const BOOTSTRAP_TOKEN_SCOPE = "bootstrap";
 export interface BootstrapTokenClaims {

package/api/auth/sessions.d.ts

@@ -15,7 +15,7 @@
  */
 import type http from "node:http";
 import { type RuntimeEnvRecord } from "@elizaos/shared";
-import type { AuthSessionRow, AuthStore } from "../../services/auth-store";
+import type { AuthSessionRow, AuthStore } from "../../services/auth-store.js";
 /** Browser session sliding window: 12h. */
 export declare const BROWSER_SESSION_TTL_MS: number;
 /** Browser session absolute cap when `rememberDevice=true`: 30 days. */

package/api/auth-bootstrap-routes.d.ts

@@ -8,7 +8,7 @@
  * any replay is rejected.
  */
 import type http from "node:http";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 /** 12h sliding TTL for browser sessions per plan §1.3. */
 export declare const BROWSER_SESSION_TTL_MS: number;
 /**

package/api/auth-pairing-routes.d.ts

@@ -1,5 +1,5 @@
 import type http from "node:http";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 export declare function _resetAuthPairingStateForTests(): void;
 export declare function ensureAuthPairingCodeForRemoteAccess(): {
     code: string;

package/api/auth-pairing-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-pairing-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-pairing-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAelC,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAkC/B,wBAAgB,8BAA8B,IAAI,IAAI,CAIrD;AAuCD,wBAAgB,oCAAoC,IAAI;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAGP;AAoFD;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CA2LlB"}
+{"version":3,"file":"auth-pairing-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-pairing-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAelC,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,uBAAuB,CAAC;AAkC/B,wBAAgB,8BAA8B,IAAI,IAAI,CAIrD;AAuCD,wBAAgB,oCAAoC,IAAI;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAGP;AAoFD;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CA0LlB"}

package/api/auth-pairing-routes.js

@@ -142,9 +142,8 @@ export async function handleAuthPairingCompatRoutes(req, res, state) {
     const method = (req.method ?? "GET").toUpperCase();
     const url = new URL(req.url ?? "/", "http://localhost");
     // ── GET /api/first-run/status ──────────────────────────────────────
-    // Cloud-provisioned containers used to skip auth here entirely. That
-    // bypass is gone: callers now need a trusted local request, a valid
-    // cookie session, an allowed bearer token, or a bootstrap exchange.
+    // Requires a trusted local request, a valid cookie session, an allowed
+    // bearer token, or a bootstrap exchange — no unauthenticated bypass.
     if (method === "GET" && url.pathname === "/api/first-run/status") {
         if (!(await ensureRouteAuthorized(req, res, state))) {
             return true;

package/api/auth-session-routes.d.ts

@@ -17,8 +17,8 @@
  *     the body.
  */
 import type http from "node:http";
-import { SESSION_COOKIE_NAME } from "./auth/index";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { SESSION_COOKIE_NAME } from "./auth/index.js";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 /** Test-only reset. */
 export declare function _resetAuthSessionRoutesLimiter(): void;
 /**

package/api/auth.d.ts

@@ -56,7 +56,7 @@ export declare function ensureCompatApiAuthorized(req: Pick<http.IncomingMessage
  * once per handler.
  */
 export declare function ensureCompatApiAuthorizedAsync(req: Pick<http.IncomingMessage, "headers" | "socket" | "method">, res: http.ServerResponse, options: {
-    store: import("../services/auth-store").AuthStore;
+    store: import("../services/auth-store.js").AuthStore;
     now?: number;
     /**
      * Skip CSRF enforcement for routes that ALWAYS handle CSRF themselves

package/api/automations-compat-routes.d.ts

@@ -13,6 +13,6 @@
  * consumers without a workflow plugin dependency.
  */
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleAutomationsCompatRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=automations-compat-routes.d.ts.map

package/api/background-tasks-routes.d.ts

@@ -1,4 +1,4 @@
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleBackgroundTasksRoute(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=background-tasks-routes.d.ts.map

package/api/catalog-routes.d.ts

@@ -1,4 +1,4 @@
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleCatalogRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=catalog-routes.d.ts.map

package/api/cloud-voice-routes.d.ts

@@ -17,7 +17,7 @@
  */
 import type http from "node:http";
 import type { AgentRuntime } from "@elizaos/core";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export interface CloudVoiceCatalogEntry {
     id: string;
     name: string;

package/api/compat-route-shared.d.ts

@@ -1,6 +1,6 @@
 import type http from "node:http";
-import { type ElizaConfig } from "@elizaos/agent";
 import type { AgentRuntime } from "@elizaos/core";
+import { type ElizaConfig, isLoopbackRemoteAddress } from "@elizaos/shared";
 export interface CompatRuntimeState {
     current: AgentRuntime | null;
     pendingAgentName: string | null;
@@ -9,11 +9,18 @@ export interface CompatRuntimeState {
 export declare function clearCompatRuntimeRestart(state: CompatRuntimeState): void;
 export declare function scheduleCompatRuntimeRestart(state: CompatRuntimeState, reason: string): void;
 export declare const DATABASE_UNAVAILABLE_MESSAGE = "Database not available. The agent may not be running or the database adapter is not initialized.";
-export declare function isLoopbackRemoteAddress(remoteAddress: string | null | undefined): boolean;
+export { isLoopbackRemoteAddress };
 /**
- * Same-machine dashboard access. This is intentionally stricter than just
- * checking `remoteAddress`: the browser must also be targeting a loopback Host
- * and must not present cross-site browser metadata.
+ * Same-machine dashboard access for the app-core compat API. Delegates to the
+ * canonical `@elizaos/shared` parser with app-core's exact policy gates:
+ *  - cloudCheck "env": the raw `ELIZA_CLOUD_PROVISIONED === "1"` flag (NOT the
+ *    agent's stricter `isCloudProvisionedContainer()`).
+ *  - requireLocalAuthEnv: honour `ELIZA_REQUIRE_LOCAL_AUTH=1`.
+ *  - devAuthBypassEnv: `ELIZA_DEV_AUTH_BYPASS=1` in a dev `NODE_ENV` restores
+ *    local trust (dev-ui sets this for the local dashboard).
+ *
+ * Intentionally stricter than a bare `remoteAddress` check: the browser must
+ * also target a loopback Host and must not present cross-site browser metadata.
  */
 export declare function isTrustedLocalRequest(req: Pick<http.IncomingMessage, "headers" | "socket">): boolean;
 export declare function readCompatJsonBody(req: http.IncomingMessage, res: http.ServerResponse): Promise<Record<string, unknown> | null>;

package/api/compat-route-shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compat-route-shared.d.ts","sourceRoot":"","sources":["../../../../../src/api/compat-route-shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAWlD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzE;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,GACb,IAAI,CAaN;AAED,eAAO,MAAM,4BAA4B,qGAC2D,CAAC;AAErG,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAUT;AAsLD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,OAAO,CAqBT;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA+CzC;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAoC5E;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAc5D;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAM5E"}
+{"version":3,"file":"compat-route-shared.d.ts","sourceRoot":"","sources":["../../../../../src/api/compat-route-shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,KAAK,WAAW,EAChB,uBAAuB,EAKxB,MAAM,iBAAiB,CAAC;AAKzB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzE;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,GACb,IAAI,CAaN;AAED,eAAO,MAAM,4BAA4B,qGAC2D,CAAC;AAMrG,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,OAAO,CAMT;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA+CzC;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAoC5E;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAc5D;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAM5E"}

package/api/compat-route-shared.js

@@ -1,6 +1,5 @@
-import { isIP } from "node:net";
-import { loadElizaConfig } from "@elizaos/agent";
-import { isLoopbackBindHost, normalizeFirstRunProviderId, resolveDeploymentTargetInConfig, resolveServiceRoutingInConfig, } from "@elizaos/shared";
+import { loadElizaConfig } from "@elizaos/agent/config/config";
+import { isLoopbackRemoteAddress, isTrustedLocalRequest as isTrustedLocalRequestShared, normalizeFirstRunProviderId, resolveDeploymentTargetInConfig, resolveServiceRoutingInConfig, } from "@elizaos/shared";
 import { sendJsonError as sendJsonErrorResponse } from "./response.js";
 const MAX_BODY_BYTES = 1_048_576;
 export function clearCompatRuntimeRestart(state) {
@@ -16,193 +15,29 @@ export function scheduleCompatRuntimeRestart(state, reason) {
     state.pendingRestartReasons.push(reason);
 }
 export const DATABASE_UNAVAILABLE_MESSAGE = "Database not available. The agent may not be running or the database adapter is not initialized.";
-export function isLoopbackRemoteAddress(remoteAddress) {
-    if (!remoteAddress)
-        return false;
-    const normalized = remoteAddress.trim().toLowerCase();
-    return (normalized === "127.0.0.1" ||
-        normalized === "::1" ||
-        normalized === "0:0:0:0:0:0:0:1" ||
-        normalized === "::ffff:127.0.0.1" ||
-        normalized === "::ffff:0:127.0.0.1");
-}
-function firstHeaderValue(value) {
-    if (typeof value === "string")
-        return value;
-    if (Array.isArray(value) && typeof value[0] === "string")
-        return value[0];
-    return null;
-}
-const CLIENT_IP_PROXY_HEADERS = new Set([
-    "forwarded",
-    "forwarded-for",
-    "x-forwarded",
-    "x-forwarded-for",
-    "x-original-forwarded-for",
-    "x-real-ip",
-    "x-client-ip",
-    "x-forwarded-client-ip",
-    "x-cluster-client-ip",
-    "cf-connecting-ip",
-    "true-client-ip",
-    "fastly-client-ip",
-    "x-appengine-user-ip",
-    "x-azure-clientip",
-]);
-function headerValues(value) {
-    if (typeof value === "string")
-        return [value];
-    if (Array.isArray(value)) {
-        return value.filter((item) => typeof item === "string");
-    }
-    return [];
-}
-function isClientIpProxyHeaderName(name) {
-    const normalized = name.toLowerCase();
-    return (CLIENT_IP_PROXY_HEADERS.has(normalized) ||
-        normalized.endsWith("-client-ip") ||
-        normalized.endsWith("-connecting-ip") ||
-        normalized.endsWith("-real-ip"));
-}
-function extractForwardedForCandidates(raw) {
-    const candidates = [];
-    const pattern = /(?:^|[;,])\s*for=(?:"([^"]*)"|([^;,]*))/gi;
-    for (const match of raw.matchAll(pattern)) {
-        candidates.push(match[1] ?? match[2] ?? "");
-    }
-    return candidates;
-}
-function extractProxyClientAddressCandidates(headerName, raw) {
-    if (headerName === "forwarded") {
-        return extractForwardedForCandidates(raw);
-    }
-    const forwardedCandidates = raw.toLowerCase().includes("for=")
-        ? extractForwardedForCandidates(raw)
-        : [];
-    if (forwardedCandidates.length > 0)
-        return forwardedCandidates;
-    return raw.split(",");
-}
-function stripMatchingQuotes(value) {
-    const trimmed = value.trim();
-    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
-        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-        return trimmed.slice(1, -1);
-    }
-    return trimmed;
-}
-function isNeutralProxyClientAddress(raw) {
-    const normalized = stripMatchingQuotes(raw).trim().toLowerCase();
-    return (!normalized ||
-        normalized === "unknown" ||
-        normalized === "null" ||
-        normalized.startsWith("_"));
-}
-function normalizeProxyClientIp(raw) {
-    let normalized = stripMatchingQuotes(raw).trim();
-    if (!normalized)
-        return null;
-    if (normalized.startsWith("[")) {
-        const close = normalized.indexOf("]");
-        if (close > 0) {
-            normalized = normalized.slice(1, close);
-        }
-    }
-    else {
-        const ipv4HostPort = /^(\d{1,3}(?:\.\d{1,3}){3})(?::\d+)$/.exec(normalized);
-        if (ipv4HostPort?.[1]) {
-            normalized = ipv4HostPort[1];
-        }
-    }
-    const zoneIndex = normalized.indexOf("%");
-    if (zoneIndex >= 0) {
-        normalized = normalized.slice(0, zoneIndex);
-    }
-    normalized = normalized.trim().toLowerCase();
-    return isIP(normalized) ? normalized : null;
-}
-function isLoopbackProxyClientIp(ip) {
-    const normalized = ip.trim().toLowerCase();
-    return (normalized === "::1" ||
-        normalized === "0:0:0:0:0:0:0:1" ||
-        normalized.startsWith("127.") ||
-        normalized.startsWith("::ffff:127.") ||
-        normalized.startsWith("::ffff:0:127."));
-}
-function proxyClientHeaderBlocksLocalTrust(headers) {
-    for (const [rawName, rawValue] of Object.entries(headers)) {
-        const headerName = rawName.toLowerCase();
-        if (!isClientIpProxyHeaderName(headerName))
-            continue;
-        for (const value of headerValues(rawValue)) {
-            for (const candidate of extractProxyClientAddressCandidates(headerName, value)) {
-                if (isNeutralProxyClientAddress(candidate))
-                    continue;
-                const ip = normalizeProxyClientIp(candidate);
-                if (!ip || !isLoopbackProxyClientIp(ip))
-                    return true;
-            }
-        }
-    }
-    return false;
-}
-function isCloudProvisionedByEnv() {
-    return process.env.ELIZA_CLOUD_PROVISIONED === "1";
-}
-function isLocalAuthRequiredByEnv() {
-    if (process.env.ELIZA_DEV_AUTH_BYPASS === "1" &&
-        (process.env.NODE_ENV === "development" || process.env.NODE_ENV === "dev")) {
-        return false;
-    }
-    return process.env.ELIZA_REQUIRE_LOCAL_AUTH === "1";
-}
-function isTrustedLocalOrigin(raw) {
-    const trimmed = raw.trim();
-    if (!trimmed || trimmed === "null")
-        return true;
-    try {
-        const parsed = new URL(trimmed);
-        if (parsed.protocol === "file:" ||
-            parsed.protocol === "app:" ||
-            parsed.protocol === "tauri:" ||
-            parsed.protocol === "capacitor:" ||
-            parsed.protocol === "capacitor-electron:" ||
-            parsed.protocol === "electrobun:") {
-            return true;
-        }
-        return isLoopbackBindHost(parsed.hostname);
-    }
-    catch {
-        return false;
-    }
-}
+// `isLoopbackRemoteAddress` is re-exported from the canonical
+// `@elizaos/shared` trust module (this used to be a local duplicate). Other
+// app-core modules import it from here (e.g. `dev-compat-routes.ts`,
+// `server.ts`), so the name stays available on this subpath.
+export { isLoopbackRemoteAddress };
 /**
- * Same-machine dashboard access. This is intentionally stricter than just
- * checking `remoteAddress`: the browser must also be targeting a loopback Host
- * and must not present cross-site browser metadata.
+ * Same-machine dashboard access for the app-core compat API. Delegates to the
+ * canonical `@elizaos/shared` parser with app-core's exact policy gates:
+ *  - cloudCheck "env": the raw `ELIZA_CLOUD_PROVISIONED === "1"` flag (NOT the
+ *    agent's stricter `isCloudProvisionedContainer()`).
+ *  - requireLocalAuthEnv: honour `ELIZA_REQUIRE_LOCAL_AUTH=1`.
+ *  - devAuthBypassEnv: `ELIZA_DEV_AUTH_BYPASS=1` in a dev `NODE_ENV` restores
+ *    local trust (dev-ui sets this for the local dashboard).
+ *
+ * Intentionally stricter than a bare `remoteAddress` check: the browser must
+ * also target a loopback Host and must not present cross-site browser metadata.
  */
 export function isTrustedLocalRequest(req) {
-    if (isLocalAuthRequiredByEnv())
-        return false;
-    if (isCloudProvisionedByEnv())
-        return false;
-    if (!isLoopbackRemoteAddress(req.socket.remoteAddress))
-        return false;
-    if (proxyClientHeaderBlocksLocalTrust(req.headers))
-        return false;
-    const host = firstHeaderValue(req.headers.host);
-    if (host && !isLoopbackBindHost(host))
-        return false;
-    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
-    if (secFetchSite === "cross-site")
-        return false;
-    const origin = firstHeaderValue(req.headers.origin);
-    if (origin && !isTrustedLocalOrigin(origin))
-        return false;
-    const referer = firstHeaderValue(req.headers.referer);
-    if (!origin && referer && !isTrustedLocalOrigin(referer))
-        return false;
-    return true;
+    return isTrustedLocalRequestShared(req, {
+        requireLocalAuthEnv: true,
+        devAuthBypassEnv: true,
+        cloudCheck: "env",
+    });
 }
 export async function readCompatJsonBody(req, res) {
     // When this handler is invoked through the runtime's plugin-route adapter

package/api/database-rows-compat-routes.d.ts

@@ -1,4 +1,4 @@
 import type http from "node:http";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleDatabaseRowsCompatRoute(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=database-rows-compat-routes.d.ts.map

package/api/dev-compat-routes.d.ts

@@ -1,5 +1,5 @@
 import type http from "node:http";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 /**
  * Dev observability routes (loopback where noted).
  *

package/api/dev-route-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-route-catalog.d.ts","sourceRoot":"","sources":["../../../../../src/api/dev-route-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,kBAAkB,CAAC;IAC/B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,oBAAoB,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,OAAO,sCAAsC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,gBAAgB,EAAE,uBAAuB,EAAE,CAAC;IAC5C,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAwbD,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,IAAiB,GACrB,sBAAsB,CAQxB"}
+{"version":3,"file":"dev-route-catalog.d.ts","sourceRoot":"","sources":["../../../../../src/api/dev-route-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,kBAAkB,CAAC;IAC/B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,oBAAoB,CAAC;CACpC;AACD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,OAAO,sCAAsC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,gBAAgB,EAAE,uBAAuB,EAAE,CAAC;IAC5C,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AA4cD,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,IAAiB,GACrB,sBAAsB,CAQxB"}

package/api/dev-route-catalog.js

@@ -231,6 +231,16 @@ const ROUTES = [
         requiresAuth: true,
         platformGate: null,
     },
+    {
+        tabId: "files",
+        path: "/apps/files",
+        label: "Files",
+        group: "Apps",
+        visibility: "all",
+        featureFlag: "VITE_ENABLE_APPS",
+        requiresAuth: true,
+        platformGate: null,
+    },
     {
         tabId: "logs",
         path: "/apps/logs",
@@ -381,6 +391,16 @@ const ROUTES = [
         requiresAuth: true,
         platformGate: "desktop",
     },
+    {
+        tabId: "background",
+        path: "/background",
+        label: "Background",
+        group: "Hidden",
+        visibility: "all",
+        featureFlag: null,
+        requiresAuth: true,
+        platformGate: null,
+    },
 ];
 /**
  * Mirror of `SETTINGS_SECTION_META` from

package/api/drop-status-compat-route.d.ts

@@ -0,0 +1,3 @@
+import type http from "node:http";
+export declare function handleDropStatusCompatRoute(req: http.IncomingMessage, res: http.ServerResponse, method: string, pathname: string): boolean;
+//# sourceMappingURL=drop-status-compat-route.d.ts.map

package/api/drop-status-compat-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-status-compat-route.d.ts","sourceRoot":"","sources":["../../../../../src/api/drop-status-compat-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAaT"}

package/api/drop-status-compat-route.js

@@ -0,0 +1,12 @@
+import { logger } from "@elizaos/core";
+import { ensureCompatSensitiveRouteAuthorized } from "./auth.js";
+export function handleDropStatusCompatRoute(req, res, method, pathname) {
+    if (method !== "GET" || pathname !== "/api/drop/status") {
+        return false;
+    }
+    if (!ensureCompatSensitiveRouteAuthorized(req, res)) {
+        logger.warn("[eliza][drop] GET /api/drop/status rejected (sensitive route not authorized)");
+        return true;
+    }
+    return false;
+}

package/api/first-run-routes.d.ts

@@ -1,4 +1,4 @@
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleFirstRunRoute(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=first-run-routes.d.ts.map

package/api/internal-routes.d.ts

@@ -1,5 +1,5 @@
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 /**
  * Wake telemetry visible to /api/health. Wave 5 reads `lastWakeFiredAt` to
  * surface "last background tick" on the dashboard.

package/api/runtime-mode-routes.d.ts

@@ -8,6 +8,6 @@
  * a browser session would broaden the trust boundary.
  */
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleRuntimeModeRoute(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=runtime-mode-routes.d.ts.map

package/api/secrets-manager-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-manager-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/secrets-manager-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,SAAS,EAYd,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AAyExB,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,IAAI,CAGN;AAeD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAyOlB;AA8ND,YAAY,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"secrets-manager-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/secrets-manager-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,SAAS,EASd,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AA+ExB,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,IAAI,CAGN;AAeD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAyOlB;AA8ND,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/api/sensitive-request-routes.d.ts

@@ -1,7 +1,7 @@
 import type http from "node:http";
 import { type SensitiveRequest, type SensitiveRequestEvent } from "@elizaos/core";
-import { type CompatRuntimeState } from "./compat-route-shared";
-import { type LocalSensitiveRequestRecord, type LocalSensitiveRequestStore } from "./sensitive-request-store";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
+import { type LocalSensitiveRequestRecord, type LocalSensitiveRequestStore } from "./sensitive-request-store.js";
 export interface SensitiveRequestRouteOptions {
     store?: LocalSensitiveRequestStore;
     now?: () => number;

package/api/server-config-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-config-filter.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-config-filter.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,aAiBtC,CAAC;AAwCH;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}
+{"version":3,"file":"server-config-filter.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-config-filter.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,aAgBtC,CAAC;AAwCH;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/api/server-config-filter.js

@@ -13,7 +13,6 @@ export const SENSITIVE_ENV_RESPONSE_KEYS = new Set([
     "ELIZA_API_TOKEN",
     "ELIZA_WALLET_EXPORT_TOKEN",
     "ELIZA_TERMINAL_RUN_TOKEN",
-    "HYPERSCAPE_AUTH_TOKEN",
     // Cloud API keys
     "ELIZAOS_CLOUD_API_KEY",
     // Third-party auth tokens

package/api/server-first-run-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-first-run-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-first-run-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoFH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAIT;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0FxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,GAAG,IAAI,CA6Gf;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CAkCA;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAc5C"}
+{"version":3,"file":"server-first-run-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-first-run-helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoFH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAIT;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0FxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,GAAG,IAAI,CA6Gf;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CA+BA;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAc5C"}

package/api/server-first-run-helpers.js

@@ -235,9 +235,6 @@ export function deriveFirstRunReplayBody(body) {
     const serviceRouting = normalizeServiceRoutingConfig(body.serviceRouting) ?? undefined;
     const isCloudMode = deploymentTarget?.runtime === "cloud";
     const replayBody = { ...body };
-    for (const key of DEPRECATED_FIRST_RUN_REQUEST_KEYS) {
-        delete replayBody[key];
-    }
     if (deploymentTarget) {
         replayBody.deploymentTarget = deploymentTarget;
     }

package/api/server.d.ts

@@ -1,15 +1,15 @@
 import http from "node:http";
 import { AGENT_EVENT_ALLOWED_STREAMS, CONFIG_WRITE_ALLOWED_TOP_KEYS, type ConversationMeta, cloneWithoutBlockedObjectKeys, discoverInstalledPlugins, discoverPluginsFromManifest, type ElizaConfig, extractAuthToken, fetchWithTimeoutGuard, isAllowedHost, isAuthorized, normalizeWsClientId, persistConversationRoomTitle, resolveMcpServersRejection, resolvePluginConfigMutationRejections, routeAutonomyTextToUser, streamResponseBodyWithByteLimit, startApiServer as upstreamStartApiServer, validateMcpServerConfig } from "@elizaos/agent";
 import { type AgentRuntime } from "@elizaos/core";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 export { __resetCloudBaseUrlCache, ensureCloudTtsApiKeyAlias, resolveCloudTtsBaseUrl, resolveElevenLabsApiKeyForCloudMode, } from "@elizaos/shared/elizacloud/server-cloud-tts";
-export { type CompatRuntimeState, DATABASE_UNAVAILABLE_MESSAGE, getConfiguredCompatAgentName, hasCompatPersistedFirstRunState, isLoopbackRemoteAddress, readCompatJsonBody, } from "./compat-route-shared";
-export { filterConfigEnvForResponse, SENSITIVE_ENV_RESPONSE_KEYS, } from "./server-config-filter";
-export { buildCorsAllowedPorts, invalidateCorsAllowedPorts, } from "./server-cors";
-export { injectApiBaseIntoHtml } from "./server-html";
-export { ensureApiTokenForBindHost, resolveMcpTerminalAuthorizationRejection, resolveTerminalRunClientId, resolveTerminalRunRejection, resolveWebSocketUpgradeRejection, } from "./server-security";
-export { findOwnPackageRoot, isSafeResetStateDir, resolveCorsOrigin, } from "./server-startup";
-export { resolveWalletExportRejection } from "./server-wallet-trade";
+export { type CompatRuntimeState, DATABASE_UNAVAILABLE_MESSAGE, getConfiguredCompatAgentName, hasCompatPersistedFirstRunState, isLoopbackRemoteAddress, readCompatJsonBody, } from "./compat-route-shared.js";
+export { filterConfigEnvForResponse, SENSITIVE_ENV_RESPONSE_KEYS, } from "./server-config-filter.js";
+export { buildCorsAllowedPorts, invalidateCorsAllowedPorts, } from "./server-cors.js";
+export { injectApiBaseIntoHtml } from "./server-html.js";
+export { ensureApiTokenForBindHost, resolveMcpTerminalAuthorizationRejection, resolveTerminalRunClientId, resolveTerminalRunRejection, resolveWebSocketUpgradeRejection, } from "./server-security.js";
+export { findOwnPackageRoot, isSafeResetStateDir, resolveCorsOrigin, } from "./server-startup.js";
+export { resolveWalletExportRejection } from "./server-wallet-trade.js";
 export { AGENT_EVENT_ALLOWED_STREAMS, CONFIG_WRITE_ALLOWED_TOP_KEYS, type ConversationMeta, cloneWithoutBlockedObjectKeys, discoverInstalledPlugins, discoverPluginsFromManifest, extractAuthToken, fetchWithTimeoutGuard, isAllowedHost, isAuthorized, normalizeWsClientId, persistConversationRoomTitle, resolveMcpServersRejection, resolvePluginConfigMutationRejections, routeAutonomyTextToUser, streamResponseBodyWithByteLimit, validateMcpServerConfig, };
 export declare function syncCompatConfigFiles(): void;
 /**

package/api/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../src/api/server.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EAErB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,KAAK,WAAW,EAChB,gBAAgB,EAChB,qBAAqB,EAGrB,aAAa,EACb,YAAY,EAEZ,mBAAmB,EACnB,4BAA4B,EAE5B,0BAA0B,EAC1B,qCAAqC,EAErC,uBAAuB,EAEvB,+BAA+B,EAC/B,cAAc,IAAI,sBAAsB,EACxC,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,KAAK,YAAY,EAA2B,MAAM,eAAe,CAAC;AAS3E,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,mCAAmC,GACpC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,KAAK,kBAAkB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EACL,yBAAyB,EACzB,wCAAwC,EACxC,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,qCAAqC,EACrC,uBAAuB,EACvB,+BAA+B,EAC/B,uBAAuB,GACxB,CAAC;AAgKF,wBAAgB,qBAAqB,IAAI,IAAI,CAsC5C;AAoBD;;;;;;;;;;GAUG;AACH,iBAAe,wBAAwB,CACrC,OAAO,EAAE,YAAY,GAAG,IAAI,EAC5B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAwDf;AAED,eAAO,MAAM,iCAAiC,iCAA2B,CAAC;AA6kB1E,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAElB;AAiBD,wBAAgB,2BAA2B,IAAI,kBAAkB,CAEhE;AAED,wBAAgB,8BAA8B,IAAI,MAAM,IAAI,CA0J3D;AAED,wBAAsB,cAAc,CAClC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,GACjD,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAgF7D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../src/api/server.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EAErB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,KAAK,WAAW,EAChB,gBAAgB,EAChB,qBAAqB,EAGrB,aAAa,EACb,YAAY,EAEZ,mBAAmB,EACnB,4BAA4B,EAE5B,0BAA0B,EAC1B,qCAAqC,EAErC,uBAAuB,EAEvB,+BAA+B,EAC/B,cAAc,IAAI,sBAAsB,EACxC,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,KAAK,YAAY,EAA2B,MAAM,eAAe,CAAC;AAS3E,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,mCAAmC,GACpC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,KAAK,kBAAkB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EACL,yBAAyB,EACzB,wCAAwC,EACxC,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,qCAAqC,EACrC,uBAAuB,EACvB,+BAA+B,EAC/B,uBAAuB,GACxB,CAAC;AA0JF,wBAAgB,qBAAqB,IAAI,IAAI,CAsC5C;AAoBD;;;;;;;;;;GAUG;AACH,iBAAe,wBAAwB,CACrC,OAAO,EAAE,YAAY,GAAG,IAAI,EAC5B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAwDf;AAED,eAAO,MAAM,iCAAiC,iCAA2B,CAAC;AA0hB1E,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAElB;AAiBD,wBAAgB,2BAA2B,IAAI,kBAAkB,CAEhE;AAED,wBAAgB,8BAA8B,IAAI,MAAM,IAAI,CA0J3D;AAED,wBAAsB,cAAc,CAClC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,GACjD,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAgF7D"}