@elizaos/autonomous 2.0.0-alpha.37

package/dist/packages/autonomous/src/services/mcp-marketplace.js

@@ -0,0 +1,200 @@
+/**
+ * MCP Marketplace Service
+ *
+ * Fetches MCP servers from the official registry and manages local config.
+ */
+import { createIntegrationTelemetrySpan } from "../diagnostics/integration-observability";
+const MCP_REGISTRY_BASE_URL = "https://registry.modelcontextprotocol.io";
+export async function searchMcpMarketplace(query, limit = 30) {
+    const url = `${MCP_REGISTRY_BASE_URL}/v0/servers`;
+    const searchSpan = createIntegrationTelemetrySpan({
+        boundary: "mcp",
+        operation: "search_registry_servers",
+    });
+    let resp;
+    try {
+        resp = await fetch(url, {
+            headers: {
+                Accept: "application/json",
+            },
+        });
+    }
+    catch (err) {
+        searchSpan.failure({ error: err });
+        throw err;
+    }
+    if (!resp.ok) {
+        searchSpan.failure({ statusCode: resp.status, errorKind: "http_error" });
+        throw new Error(`Registry API error: ${resp.status} ${resp.statusText}`);
+    }
+    let data;
+    try {
+        data = (await resp.json());
+    }
+    catch (err) {
+        searchSpan.failure({ error: err, statusCode: resp.status });
+        throw err;
+    }
+    const results = [];
+    const seenNames = new Set();
+    for (const entry of data.servers) {
+        const server = entry.server;
+        const meta = entry._meta?.["io.modelcontextprotocol.registry/official"];
+        if (!meta?.isLatest)
+            continue;
+        if (seenNames.has(server.name))
+            continue;
+        seenNames.add(server.name);
+        if (query) {
+            const q = query.toLowerCase();
+            const matchName = server.name.toLowerCase().includes(q);
+            const matchTitle = server.title?.toLowerCase().includes(q);
+            const matchDesc = server.description?.toLowerCase().includes(q);
+            if (!matchName && !matchTitle && !matchDesc)
+                continue;
+        }
+        let connectionType = "remote";
+        let connectionUrl;
+        let npmPackage;
+        let dockerImage;
+        if (server.remotes && server.remotes.length > 0) {
+            connectionType = "remote";
+            connectionUrl = server.remotes[0].url;
+        }
+        else if (server.packages && server.packages.length > 0) {
+            const pkg = server.packages[0];
+            connectionType = "stdio";
+            if (pkg.registryType === "npm") {
+                npmPackage = pkg.identifier;
+            }
+            else if (pkg.registryType === "oci") {
+                dockerImage = pkg.identifier;
+            }
+        }
+        results.push({
+            id: `${server.name}@${server.version}`,
+            name: server.name,
+            title: server.title || server.name.split("/").pop() || server.name,
+            description: server.description || "No description",
+            version: server.version,
+            connectionType,
+            connectionUrl,
+            npmPackage,
+            dockerImage,
+            repositoryUrl: server.repository?.url,
+            websiteUrl: server.websiteUrl,
+            iconUrl: server.icons?.[0]?.src,
+            publishedAt: meta?.publishedAt,
+            isLatest: true,
+        });
+        if (results.length >= limit)
+            break;
+    }
+    searchSpan.success({ statusCode: resp.status });
+    return { results };
+}
+export async function getMcpServerDetails(name) {
+    const url = `${MCP_REGISTRY_BASE_URL}/v0/servers/${encodeURIComponent(name)}`;
+    const detailsSpan = createIntegrationTelemetrySpan({
+        boundary: "mcp",
+        operation: "get_registry_server_details",
+    });
+    let resp;
+    try {
+        resp = await fetch(url, {
+            headers: { Accept: "application/json" },
+        });
+    }
+    catch (err) {
+        detailsSpan.failure({ error: err });
+        throw err;
+    }
+    if (!resp.ok) {
+        if (resp.status === 404) {
+            detailsSpan.success({ statusCode: resp.status });
+            return null;
+        }
+        detailsSpan.failure({ statusCode: resp.status, errorKind: "http_error" });
+        throw new Error(`Registry API error: ${resp.status}`);
+    }
+    let data;
+    try {
+        data = (await resp.json());
+    }
+    catch (err) {
+        detailsSpan.failure({ error: err, statusCode: resp.status });
+        throw err;
+    }
+    detailsSpan.success({ statusCode: resp.status });
+    return data.server;
+}
+export function generateMcpConfigFromRegistry(server) {
+    if (server.connectionType === "remote" && server.connectionUrl) {
+        return {
+            type: "streamable-http",
+            url: server.connectionUrl,
+        };
+    }
+    else if (server.connectionType === "stdio" && server.npmPackage) {
+        return {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", server.npmPackage],
+        };
+    }
+    else if (server.connectionType === "stdio" && server.dockerImage) {
+        return {
+            type: "stdio",
+            command: "docker",
+            args: ["run", "-i", "--rm", server.dockerImage],
+        };
+    }
+    return null;
+}
+export function generateMcpConfigFromServerDetails(server, envValues, headerValues) {
+    if (server.remotes && server.remotes.length > 0) {
+        const remote = server.remotes[0];
+        const config = {
+            type: remote.type || "streamable-http",
+            url: remote.url,
+        };
+        if (headerValues && Object.keys(headerValues).length > 0) {
+            config.headers = { ...headerValues };
+        }
+        return config;
+    }
+    if (server.packages && server.packages.length > 0) {
+        const pkg = server.packages[0];
+        if (pkg.registryType === "npm") {
+            const args = ["-y", pkg.identifier];
+            if (pkg.packageArguments) {
+                for (const arg of pkg.packageArguments) {
+                    if (arg.default) {
+                        args.push(arg.default);
+                    }
+                }
+            }
+            const config = {
+                type: "stdio",
+                command: "npx",
+                args,
+            };
+            if (envValues && Object.keys(envValues).length > 0) {
+                config.env = { ...envValues };
+            }
+            return config;
+        }
+        if (pkg.registryType === "oci") {
+            const config = {
+                type: "stdio",
+                command: "docker",
+                args: ["run", "-i", "--rm", pkg.identifier],
+            };
+            if (envValues && Object.keys(envValues).length > 0) {
+                config.env = { ...envValues };
+            }
+            return config;
+        }
+    }
+    return null;
+}

package/dist/packages/autonomous/src/services/plugin-manager-types.d.ts

@@ -0,0 +1,139 @@
+export interface RegistryVersionSupport {
+    v0: boolean;
+    v1: boolean;
+    v2: boolean;
+}
+export interface RegistryPluginNpmInfo {
+    package: string;
+    v0Version?: string | null;
+    v1Version?: string | null;
+    v2Version?: string | null;
+}
+export interface RegistryPluginViewerInfo {
+    url: string;
+    embedParams?: Record<string, string>;
+    postMessageAuth?: boolean;
+    sandbox?: string;
+}
+export interface AppUiExtensionConfig {
+    detailPanelId: string;
+}
+export interface RegistryPluginAppMeta {
+    displayName?: string;
+    category?: string;
+    launchType?: string;
+    launchUrl?: string | null;
+    icon?: string | null;
+    capabilities?: string[];
+    uiExtension?: AppUiExtensionConfig;
+    viewer?: RegistryPluginViewerInfo;
+}
+export interface RegistryPluginInfo {
+    name: string;
+    gitRepo: string;
+    gitUrl: string;
+    displayName?: string;
+    description: string;
+    homepage?: string | null;
+    topics: string[];
+    stars: number;
+    language: string;
+    launchType?: string;
+    launchUrl?: string | null;
+    viewer?: RegistryPluginViewerInfo;
+    uiExtension?: AppUiExtensionConfig;
+    kind?: string;
+    appMeta?: RegistryPluginAppMeta;
+    npm: RegistryPluginNpmInfo;
+    supports: RegistryVersionSupport;
+    category?: string;
+    capabilities?: string[];
+    icon?: string | null;
+}
+export interface RegistrySearchResult {
+    name: string;
+    description: string;
+    score: number;
+    tags: string[];
+    version: string | null;
+    latestVersion?: string | null;
+    npmPackage: string;
+    repository: string;
+    stars: number;
+    supports: RegistryVersionSupport;
+}
+export interface InstalledPluginInfo {
+    name: string;
+    version?: string;
+    installedAt?: string;
+}
+export interface InstallProgressLike {
+    phase: string;
+    message: string;
+    pluginName?: string;
+}
+export interface PluginInstallResult {
+    success: boolean;
+    pluginName: string;
+    version: string;
+    installPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface PluginUninstallResult {
+    success: boolean;
+    pluginName: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface EjectResult {
+    success: boolean;
+    pluginName: string;
+    ejectedPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface SyncResult {
+    success: boolean;
+    pluginName: string;
+    ejectedPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface ReinjectResult {
+    success: boolean;
+    pluginName: string;
+    removedPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface PluginManagerLike {
+    refreshRegistry(): Promise<Map<string, RegistryPluginInfo>>;
+    listInstalledPlugins(): Promise<InstalledPluginInfo[]>;
+    getRegistryPlugin(name: string): Promise<RegistryPluginInfo | null>;
+    searchRegistry(query: string, limit?: number): Promise<RegistrySearchResult[]>;
+    installPlugin(pluginName: string, onProgress?: (progress: InstallProgressLike) => void): Promise<PluginInstallResult>;
+    uninstallPlugin(pluginName: string): Promise<PluginUninstallResult>;
+    listEjectedPlugins(): Promise<InstalledPluginInfo[]>;
+    ejectPlugin(pluginName: string): Promise<EjectResult>;
+    syncPlugin(pluginName: string): Promise<SyncResult>;
+    reinjectPlugin(pluginName: string): Promise<ReinjectResult>;
+}
+export interface CoreStatusLike {
+    ejected: boolean;
+    ejectedPath: string;
+    monorepoPath: string;
+    corePackagePath: string;
+    coreDistPath: string;
+    version: string;
+    npmVersion: string;
+    commitHash: string | null;
+    localChanges: boolean;
+    upstream: unknown;
+}
+export interface CoreManagerLike {
+    getCoreStatus(): Promise<CoreStatusLike>;
+}
+export declare function isPluginManagerLike(candidate: unknown): candidate is PluginManagerLike;
+export declare function isCoreManagerLike(candidate: unknown): candidate is CoreManagerLike;
+//# sourceMappingURL=plugin-manager-types.d.ts.map

package/dist/packages/autonomous/src/services/plugin-manager-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manager-types.d.ts","sourceRoot":"","sources":["../../../../../src/services/plugin-manager-types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,GAAG,EAAE,qBAAqB,CAAC;IAC3B,QAAQ,EAAE,sBAAsB,CAAC;IAEjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,oBAAoB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpE,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,GACnD,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpE,kBAAkB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACrD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1C;AAMD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,OAAO,GACjB,SAAS,IAAI,iBAAiB,CAWhC;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,OAAO,GACjB,SAAS,IAAI,eAAe,CAG9B"}

package/dist/packages/autonomous/src/services/plugin-manager-types.js

@@ -0,0 +1,18 @@
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+export function isPluginManagerLike(candidate) {
+    if (!isObjectRecord(candidate))
+        return false;
+    return (typeof candidate.refreshRegistry === "function" &&
+        typeof candidate.listInstalledPlugins === "function" &&
+        typeof candidate.getRegistryPlugin === "function" &&
+        typeof candidate.searchRegistry === "function" &&
+        typeof candidate.installPlugin === "function" &&
+        typeof candidate.uninstallPlugin === "function");
+}
+export function isCoreManagerLike(candidate) {
+    if (!isObjectRecord(candidate))
+        return false;
+    return typeof candidate.getCoreStatus === "function";
+}

package/dist/packages/autonomous/src/services/privy-wallets.d.ts

@@ -0,0 +1,18 @@
+export type PrivyWalletChain = "ethereum" | "solana";
+export interface PrivyWalletAddresses {
+    evmAddress: string | null;
+    solanaAddress: string | null;
+}
+export interface PrivyWalletSummary {
+    id: string;
+    chain: PrivyWalletChain;
+    address: string;
+}
+export interface PrivyEnsureWalletsResult extends PrivyWalletAddresses {
+    userId: string;
+    createdUser: boolean;
+    wallets: PrivyWalletSummary[];
+}
+export declare function isPrivyWalletProvisioningEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function ensurePrivyWalletsForCustomUser(customUserId: string, chains?: PrivyWalletChain[], env?: NodeJS.ProcessEnv): Promise<PrivyEnsureWalletsResult>;
+//# sourceMappingURL=privy-wallets.d.ts.map

package/dist/packages/autonomous/src/services/privy-wallets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy-wallets.d.ts","sourceRoot":"","sources":["../../../../../src/services/privy-wallets.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAyED,wBAAgB,gCAAgC,CAC9C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AA6MD,wBAAsB,+BAA+B,CACnD,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,gBAAgB,EAA2B,EACnD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,wBAAwB,CAAC,CA8CnC"}

package/dist/packages/autonomous/src/services/privy-wallets.js

@@ -0,0 +1,225 @@
+import { logger } from "@elizaos/core";
+const PRIVY_DEFAULT_API_BASE_URL = "https://auth.privy.io/api/v1";
+const PRIVY_TIMEOUT_MS = 12_000;
+function normalizeEnvValue(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function resolvePrivyConfig(env = process.env) {
+    const appId = normalizeEnvValue(env.PRIVY_APP_ID) ??
+        normalizeEnvValue(env.BABYLON_PRIVY_APP_ID);
+    const appSecret = normalizeEnvValue(env.PRIVY_APP_SECRET) ??
+        normalizeEnvValue(env.BABYLON_PRIVY_APP_SECRET);
+    if (!appId || !appSecret)
+        return null;
+    const apiBaseUrl = normalizeEnvValue(env.PRIVY_API_BASE_URL) ?? PRIVY_DEFAULT_API_BASE_URL;
+    // Validate that the Privy API base URL uses HTTPS to prevent SSRF
+    // attacks that could leak credentials to arbitrary endpoints.
+    try {
+        const parsed = new URL(apiBaseUrl);
+        if (parsed.protocol !== "https:") {
+            logger.warn(`[privy] PRIVY_API_BASE_URL must use https:, got ${parsed.protocol} — falling back to default.`);
+            return {
+                appId,
+                appSecret,
+                apiBaseUrl: PRIVY_DEFAULT_API_BASE_URL,
+            };
+        }
+    }
+    catch {
+        logger.warn("[privy] PRIVY_API_BASE_URL is not a valid URL — falling back to default.");
+        return {
+            appId,
+            appSecret,
+            apiBaseUrl: PRIVY_DEFAULT_API_BASE_URL,
+        };
+    }
+    return {
+        appId,
+        appSecret,
+        apiBaseUrl: apiBaseUrl.replace(/\/+$/, ""),
+    };
+}
+export function isPrivyWalletProvisioningEnabled(env = process.env) {
+    return resolvePrivyConfig(env) !== null;
+}
+function assertPrivyConfig(env = process.env) {
+    const config = resolvePrivyConfig(env);
+    if (!config) {
+        throw new Error("Privy wallet provisioning is not configured (missing PRIVY_APP_ID / PRIVY_APP_SECRET).");
+    }
+    return config;
+}
+function authHeaders(config) {
+    const basic = Buffer.from(`${config.appId}:${config.appSecret}`).toString("base64");
+    return {
+        Authorization: `Basic ${basic}`,
+        "Content-Type": "application/json",
+        "privy-app-id": config.appId,
+    };
+}
+async function readResponseText(response) {
+    try {
+        return (await response.text()).trim();
+    }
+    catch {
+        return "";
+    }
+}
+async function privyRequest(config, path, init) {
+    const response = await fetch(`${config.apiBaseUrl}${path}`, {
+        ...init,
+        headers: {
+            ...authHeaders(config),
+            ...(init?.headers ?? {}),
+        },
+        signal: AbortSignal.timeout(PRIVY_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        const details = (await readResponseText(response)).slice(0, 240);
+        const suffix = details ? `: ${details}` : "";
+        throw new Error(`Privy request failed (${response.status}) for ${path}${suffix}`);
+    }
+    return (await response.json());
+}
+async function getUserByCustomAuthId(config, customUserId) {
+    const response = await fetch(`${config.apiBaseUrl}/users/custom_auth/id`, {
+        method: "POST",
+        headers: authHeaders(config),
+        body: JSON.stringify({ custom_user_id: customUserId }),
+        signal: AbortSignal.timeout(PRIVY_TIMEOUT_MS),
+    });
+    if (response.status === 404) {
+        return null;
+    }
+    if (!response.ok) {
+        const details = (await readResponseText(response)).slice(0, 240);
+        throw new Error(`Privy user lookup failed (${response.status})${details ? `: ${details}` : ""}`);
+    }
+    const payload = (await response.json());
+    if (typeof payload.id !== "string" || payload.id.length === 0) {
+        throw new Error("Privy user lookup returned an invalid response.");
+    }
+    return { id: payload.id };
+}
+async function createUserWithWallets(config, customUserId) {
+    const payload = await privyRequest(config, "/users", {
+        method: "POST",
+        body: JSON.stringify({
+            linked_accounts: [
+                {
+                    type: "custom_auth",
+                    custom_user_id: customUserId,
+                },
+            ],
+            wallets: [{ chain_type: "ethereum" }, { chain_type: "solana" }],
+        }),
+    });
+    if (typeof payload.id !== "string" || payload.id.length === 0) {
+        throw new Error("Privy user creation returned an invalid response.");
+    }
+    return { id: payload.id };
+}
+function parseWalletList(payload) {
+    if (Array.isArray(payload)) {
+        return payload.filter((entry) => typeof entry === "object" && entry !== null);
+    }
+    if (typeof payload !== "object" || payload === null)
+        return [];
+    const candidate = payload;
+    const arrays = [candidate.data, candidate.results, candidate.wallets];
+    for (const value of arrays) {
+        if (!Array.isArray(value))
+            continue;
+        return value.filter((entry) => typeof entry === "object" && entry !== null);
+    }
+    return [];
+}
+function normalizeWalletChain(wallet) {
+    const rawChain = typeof wallet.chain_type === "string"
+        ? wallet.chain_type.toLowerCase()
+        : "";
+    if (rawChain.includes("sol"))
+        return "solana";
+    if (rawChain.includes("eth") || rawChain === "evm")
+        return "ethereum";
+    const address = typeof wallet.address === "string" ? wallet.address : "";
+    if (address.startsWith("0x"))
+        return "ethereum";
+    if (address.length > 0)
+        return "solana";
+    return null;
+}
+function normalizeWalletSummary(wallet) {
+    const chain = normalizeWalletChain(wallet);
+    const address = typeof wallet.address === "string" ? wallet.address.trim() : "";
+    const id = typeof wallet.id === "string" ? wallet.id : "";
+    if (!chain || !address || !id)
+        return null;
+    return { id, chain, address };
+}
+async function listUserWallets(config, userId) {
+    const payload = await privyRequest(config, `/wallets?user_id=${encodeURIComponent(userId)}&limit=100`, { method: "GET" });
+    const rawWallets = parseWalletList(payload);
+    const wallets = [];
+    for (const raw of rawWallets) {
+        const summary = normalizeWalletSummary(raw);
+        if (!summary)
+            continue;
+        if (wallets.some((wallet) => wallet.chain === summary.chain && wallet.address === summary.address)) {
+            continue;
+        }
+        wallets.push(summary);
+    }
+    return wallets;
+}
+async function createWalletForUser(config, userId, chain) {
+    await privyRequest(config, `/users/${encodeURIComponent(userId)}/wallets`, {
+        method: "POST",
+        body: JSON.stringify({ chain_type: chain }),
+    });
+}
+function pickAddresses(wallets) {
+    const evmAddress = wallets.find((wallet) => wallet.chain === "ethereum")?.address ?? null;
+    const solanaAddress = wallets.find((wallet) => wallet.chain === "solana")?.address ?? null;
+    return { evmAddress, solanaAddress };
+}
+export async function ensurePrivyWalletsForCustomUser(customUserId, chains = ["ethereum", "solana"], env = process.env) {
+    const normalizedCustomUserId = customUserId.trim();
+    if (!normalizedCustomUserId) {
+        throw new Error("customUserId is required.");
+    }
+    const targetChains = Array.from(new Set(chains));
+    const config = assertPrivyConfig(env);
+    let user = await getUserByCustomAuthId(config, normalizedCustomUserId);
+    let createdUser = false;
+    if (!user) {
+        user = await createUserWithWallets(config, normalizedCustomUserId);
+        createdUser = true;
+    }
+    let wallets = await listUserWallets(config, user.id);
+    for (const chain of targetChains) {
+        const exists = wallets.some((wallet) => wallet.chain === chain);
+        if (!exists) {
+            await createWalletForUser(config, user.id, chain);
+        }
+    }
+    if (targetChains.some((chain) => !wallets.some((w) => w.chain === chain))) {
+        wallets = await listUserWallets(config, user.id);
+    }
+    const addresses = pickAddresses(wallets);
+    if (targetChains.includes("ethereum") &&
+        !addresses.evmAddress &&
+        targetChains.includes("solana") &&
+        !addresses.solanaAddress) {
+        logger.warn(`[privy] Wallet ensure returned no addresses for user ${user.id}`);
+    }
+    return {
+        userId: user.id,
+        createdUser,
+        wallets,
+        ...addresses,
+    };
+}

package/dist/packages/autonomous/src/services/registry-client-app-meta.d.ts

@@ -0,0 +1,6 @@
+import type { RegistryAppMeta } from "./registry-client-types.js";
+export declare const LOCAL_APP_DEFAULT_SANDBOX = "allow-scripts allow-same-origin allow-popups";
+export declare function sanitizeSandbox(rawSandbox?: string): string;
+export declare function mergeAppMeta(base: RegistryAppMeta | undefined, patch: RegistryAppMeta | undefined): RegistryAppMeta | undefined;
+export declare function resolveAppOverride(packageName: string, appMeta: RegistryAppMeta | undefined): RegistryAppMeta | undefined;
+//# sourceMappingURL=registry-client-app-meta.d.ts.map

package/dist/packages/autonomous/src/services/registry-client-app-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-app-meta.d.ts","sourceRoot":"","sources":["../../../../../src/services/registry-client-app-meta.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,4BAA4B,CAAC;AAEpC,eAAO,MAAM,yBAAyB,iDACU,CAAC;AAyFjD,wBAAgB,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAwB3D;AA6BD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,eAAe,GAAG,SAAS,EACjC,KAAK,EAAE,eAAe,GAAG,SAAS,GACjC,eAAe,GAAG,SAAS,CAY7B;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GAAG,SAAS,GACnC,eAAe,GAAG,SAAS,CA8B7B"}