fix(cloud): export runWithTrajectoryPurpose + fetchWithSsrfGuard from Worker core-stub — unblock prod deploy

[NubsCarson]

URGENT — prod deploy blocker (maintainer review requested, do not let it sit)

Unblocks the promote #12051 prod deploy carrying the money fixes (#12047 embeddings affiliate, #11976/#11989, #11785). Please review + merge via maintainer lane — I am not self-merging.

The break (deploy run 28680305905, job 85062716654, re-run failed identically 2026-07-04T04:2x)

Deploy to Cloudflare Workers / wrangler esbuild fails on main (and would fail on develop once its build:core blocker is cleared):

✘ [ERROR] No matching export in "src/stubs/elizaos-core.ts" for import "runWithTrajectoryPurpose"
      ../../shared/src/email-classification/email-classifier.ts:20:2
✘ [ERROR] No matching export in "src/stubs/elizaos-core.ts" for import "fetchWithSsrfGuard"
      ../../../plugins/plugin-elizacloud/src/models/transcription.ts:2:9

Worker-stub-drift, same class as #11845/#11857/#11865/#11875/#11902. Root cause of the first: commit c7b4c1d332 ("fix: clear monetization branch blockers" — a stale branch merged after the hotfixes) deleted the runWithTrajectoryPurpose export that #11845/#11875 had added. The second: plugin-elizacloud's transcription audioUrl fetch was routed through the SSRF guard (correctly), but the guard was never stubbed for the Worker bundle.

A local production dry-run surfaced 8 more missing stub exports that accumulated while the wrangler step was masked by the develop lane's earlier build:core failure — all fixed here too: registerSubscriptionAuthProvider/getSubscriptionAuthProvider/hasSubscriptionAuthProvider (packages/auth), isSensitiveKeyName/redactLogArgs (cloud-shared logger), CLOUD_AUTH_SERVICE_TYPE (plugin-elizacloud cloud-auth), setAnthropicAccountPoolBridge/setCodingAgentSelectorBridge (app-core services).

What was added (matches the stub's existing patterns)

• runWithTrajectoryPurpose — pass-through beside the existing runWithTrajectoryContext stand-in. The trajectory context manager lives on the agent sidecar; purpose-tagging is observability, nothing billing/security-bearing runs through it in the Worker.
• fetchWithSsrfGuard — Worker-safe port of core's guard that reuses the real, pure core/src/network/ssrf.ts validators (zero imports, zero I/O) so the blocklist (exotic IPv4 encodings, IPv6 prefixes, metadata hostnames) cannot drift. Full contract preserved: http/https-only per hop, private/loopback/link-local + internal-hostname blocking honoring policy, manual redirects re-validated every hop, WHATWG 301/302-POST/303 GET-rewrite + body-header strip, cross-origin credential stripping, timeout/abort, and fail-closed on lookupFn without pinnedFetchImpl. The only delta from core is omitting the Node-autoloaded pinned-DNS transport — workerd has no node:dns; this is exactly core's own documented EDGE-SSRF mode. SSRF protection is not weakened. (Bonus: bundling core's real guard would have been wrong on workerd — nodejs_compat defines process.versions.node, so core would try the Node pinned transport and fail closed at runtime.)
• isSensitiveKeyName / redactLogArgs — re-exported from core's pure security/redact.ts. These must stay real: a no-op here would leak API keys/tokens into Worker logs.
• subscription-auth registry + account-pool bridges — re-exported from their pure core modules (every bundled @elizaos/core import resolves to this stub, so the bundle shares one registry instance).
• CLOUD_AUTH_SERVICE_TYPE — mirrored (ServiceType.CLOUD_AUTH, same value as core).

Build proof (real output, local dry-run of the exact wrangler build the deploy runs)

$ cd packages/cloud/api && bunx wrangler deploy --env production --dry-run --outdir /tmp/wrangler-dryrun-check
 ⛅️ wrangler 4.100.0
Total Upload: 15967.15 KiB / gzip: 3544.10 KiB
--dry-run: exiting now.
EXIT=0   (grep -c 'ERROR|No matching export' → 0)

Before the fix, the identical local harness reproduced the missing-export failures (the 2 from CI + the 8 newly-exposed ones), so the harness demonstrably catches this error class.

Also verified:

• bun run --cwd packages/cloud/api typecheck → clean
• bunx biome check on both files → clean
• bun test __tests__/elizaos-core-stub.test.ts → 9 pass — new tests cover the SSRF guard for real: private-IP/metadata/localhost blocking before any fetch, non-http(s) rejection, fail-closed lookupFn-without-pinned-transport, redirect-hop re-validation (redirect→169.254.169.254 blocked), cross-origin credential stripping, redirect cap, plus trajectory-purpose pass-through (sync/async/throw).

⚠️ Second, independent deploy blocker (NOT fixed here)

Every current develop deploy run dies earlier, at Build linked elizaOS workspaces (bun run build:core):

@elizaos/core:build: src/cloud-routing.ts(8,8): error TS2307: Cannot find module '@elizaos/cloud-routing'

(e.g. runs 28694656324, 28694875576 — all 3 deploy jobs, deterministic). @elizaos/cloud-routing IS in CORE_BUILD_PACKAGES and in core's dependencies, so this looks like an install/turbo-graph issue in the deploy job, from the #12092 item-28 cloud-routing single-sourcing. #12650 fixed only the snap variant. Both blockers must be clear before the next develop→main promote deploys; filing separately.

urgent: unblocks promote #12051 money-fix deploy

[cloud-security]

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d7af000b-89fe-4664-a12e-2c251df91e59

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/worker-stub-trajectory-ssrf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lalalune]

Closing as superseded by current develop: #12807/#12823 already restored the Worker core-stub exports this PR adds, including runWithTrajectoryPurpose, fetchWithSsrfGuard, subscription auth helpers, redaction helpers, CLOUD_AUTH_SERVICE_TYPE, and the account-pool bridge setters. I verified current origin/develop exports those symbols and ran the focused stub test: bun run --cwd packages/cloud/api test __tests__/elizaos-core-stub.test.ts -> 7 passed. The PR branch is now conflict-stale against develop, so merging it would reintroduce churn rather than unblock deploy.