@elizaos/plugin-elizacloud 2.0.0-alpha.8 → 2.0.0-beta.1

package/dist/lib/cloud-connection.js

@@ -0,0 +1,731 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/cloud/base-url.ts
+function isLoopbackHost(hostname) {
+  const normalized = hostname.toLowerCase();
+  return normalized === "localhost" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:1" || normalized.startsWith("127.");
+}
+function trimApiPath(pathname) {
+  const normalized = pathname.trim().replace(/\/+$/, "");
+  if (!normalized)
+    return "";
+  if (normalized === "/api/v1")
+    return "";
+  if (normalized.endsWith("/api/v1")) {
+    return normalized.slice(0, -"/api/v1".length);
+  }
+  return normalized;
+}
+function normalizeCloudSiteUrl(rawUrl) {
+  const envOverride = process.env.ELIZAOS_CLOUD_BASE_URL?.trim();
+  const candidate = envOverride || rawUrl?.trim() || DEFAULT_CLOUD_SITE_URL;
+  try {
+    const parsed = new URL(candidate);
+    const pathname = trimApiPath(parsed.pathname);
+    const host = parsed.hostname.toLowerCase();
+    const preserveLocalOrigin = isLoopbackHost(host);
+    parsed.hash = "";
+    parsed.search = "";
+    if (!preserveLocalOrigin) {
+      parsed.protocol = "https:";
+      parsed.port = "";
+    }
+    parsed.pathname = pathname;
+    if (LEGACY_CLOUD_HOST_ALIASES.has(host)) {
+      parsed.hostname = "www.elizacloud.ai";
+      parsed.pathname = "";
+    }
+    return parsed.toString().replace(/\/{1,1024}$/, "");
+  } catch {
+    const safeCandidate = candidate.length > 8192 ? candidate.slice(0, 8192) : candidate;
+    return safeCandidate.replace(/\/{1,1024}$/, "");
+  }
+}
+function resolveCloudApiBaseUrl(rawUrl) {
+  return `${normalizeCloudSiteUrl(rawUrl)}/api/v1`;
+}
+var DEFAULT_CLOUD_SITE_URL = "https://www.elizacloud.ai", LEGACY_CLOUD_HOST_ALIASES;
+var init_base_url = __esm(() => {
+  LEGACY_CLOUD_HOST_ALIASES = new Set([
+    "elizacloud.ai",
+    "www.elizacloud.ai"
+  ]);
+});
+
+// src/cloud/validate-url.ts
+import dns from "node:dns";
+import net from "node:net";
+import { promisify } from "node:util";
+function normalizeHostLike(value) {
+  return value.trim().toLowerCase().replace(/^\[|\]$/g, "");
+}
+function decodeIpv6MappedHex(mapped) {
+  const parts = mapped.split(":");
+  if (parts.length < 1 || parts.length > 2)
+    return null;
+  const parsed = parts.map((part) => {
+    if (!/^[0-9a-f]{1,4}$/i.test(part))
+      return Number.NaN;
+    return Number.parseInt(part, 16);
+  });
+  if (parsed.some((value) => !Number.isFinite(value)))
+    return null;
+  const [hi, lo] = parsed.length === 1 ? [0, parsed[0]] : parsed;
+  const octets = [hi >> 8, hi & 255, lo >> 8, lo & 255];
+  return octets.join(".");
+}
+function canonicalizeIpv6(ip) {
+  try {
+    return new URL(`http://[${ip}]/`).hostname.replace(/^\[|\]$/g, "");
+  } catch {
+    return null;
+  }
+}
+function normalizeIpForPolicy(ip) {
+  const base = normalizeHostLike(ip).split("%")[0];
+  if (!base)
+    return base;
+  let normalized = base;
+  if (net.isIP(normalized) === 6) {
+    normalized = canonicalizeIpv6(normalized) ?? normalized;
+  }
+  let mapped = null;
+  if (normalized.startsWith("::ffff:")) {
+    mapped = normalized.slice("::ffff:".length);
+  } else if (normalized.startsWith("0:0:0:0:0:ffff:")) {
+    mapped = normalized.slice("0:0:0:0:0:ffff:".length);
+  }
+  if (!mapped)
+    return normalized;
+  if (net.isIP(mapped) === 4)
+    return mapped;
+  return decodeIpv6MappedHex(mapped) ?? normalized;
+}
+function cidrV4(base, prefix) {
+  const parsed = parseIpv4ToInt(base);
+  if (parsed === null) {
+    throw new Error(`Invalid CIDR base IPv4 address: ${base}`);
+  }
+  const shift = 32 - prefix;
+  const mask = shift === 32 ? 0 : 4294967295 << shift >>> 0;
+  return { base: parsed & mask, mask };
+}
+function parseIpv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4)
+    return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return null;
+    const octet = Number.parseInt(part, 10);
+    if (!Number.isInteger(octet) || octet < 0 || octet > 255)
+      return null;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function isBlockedIpv4(ip) {
+  const asInt = parseIpv4ToInt(ip);
+  if (asInt === null)
+    return true;
+  return BLOCKED_IPV4_CIDRS.some((cidr) => (asInt & cidr.mask) === cidr.base);
+}
+function isBlockedIpv6(ip) {
+  const normalized = ip.toLowerCase();
+  return normalized === "::" || normalized === "::1" || /^fe[89ab][0-9a-f]:/.test(normalized) || /^f[cd][0-9a-f]{2}:/i.test(normalized) || normalized.startsWith("ff");
+}
+function isBlockedIp(ip) {
+  const normalized = normalizeIpForPolicy(ip);
+  const family = net.isIP(normalized);
+  if (family === 4)
+    return isBlockedIpv4(normalized);
+  if (family === 6)
+    return isBlockedIpv6(normalized);
+  return false;
+}
+async function validateCloudBaseUrl(rawUrl) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    return `Invalid cloud base URL: "${rawUrl}"`;
+  }
+  if (parsed.protocol !== "https:") {
+    return `Cloud base URL must use HTTPS, got "${parsed.protocol}" in "${rawUrl}"`;
+  }
+  const hostname = normalizeHostLike(parsed.hostname);
+  if (!hostname) {
+    return `Invalid cloud base URL: "${rawUrl}"`;
+  }
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
+    return `Cloud base URL "${rawUrl}" points to a blocked local hostname.`;
+  }
+  if (true) {
+    return null;
+  }
+  if (isBlockedIp(hostname)) {
+    return `Cloud base URL "${rawUrl}" points to a blocked address.`;
+  }
+  try {
+    const results = await dnsLookupAll(hostname, { all: true });
+    const addresses = Array.isArray(results) ? results : [results];
+    for (const entry of addresses) {
+      const ip = typeof entry === "string" ? entry : entry.address;
+      if (isBlockedIp(ip)) {
+        return `Cloud base URL "${rawUrl}" resolves to ${ip}, ` + "which is a blocked internal/metadata address.";
+      }
+    }
+  } catch {
+    return `Cloud base URL "${rawUrl}" could not be resolved via DNS.`;
+  }
+  return null;
+}
+var dnsLookupAll, BLOCKED_IPV4_CIDRS;
+var init_validate_url = __esm(() => {
+  dnsLookupAll = promisify(dns.lookup);
+  BLOCKED_IPV4_CIDRS = [
+    cidrV4("0.0.0.0", 8),
+    cidrV4("10.0.0.0", 8),
+    cidrV4("172.16.0.0", 12),
+    cidrV4("192.168.0.0", 16),
+    cidrV4("100.64.0.0", 10),
+    cidrV4("127.0.0.0", 8),
+    cidrV4("169.254.0.0", 16),
+    cidrV4("192.0.0.0", 24),
+    cidrV4("198.18.0.0", 15),
+    cidrV4("192.0.2.0", 24),
+    cidrV4("198.51.100.0", 24),
+    cidrV4("203.0.113.0", 24),
+    cidrV4("224.0.0.0", 4),
+    cidrV4("240.0.0.0", 4)
+  ];
+});
+
+// src/lib/config-like.ts
+function ensureLinkedAccounts(config) {
+  config.linkedAccounts ??= {};
+  return config.linkedAccounts;
+}
+function ensureServiceRouting(config) {
+  config.serviceRouting ??= {};
+  return config.serviceRouting;
+}
+function persistDeploymentTarget(config, deploymentTarget) {
+  if (!deploymentTarget) {
+    delete config.deploymentTarget;
+    return;
+  }
+  config.deploymentTarget = { ...deploymentTarget };
+}
+function persistLinkedAccounts(config, linkedAccounts) {
+  if (!linkedAccounts)
+    return;
+  const existing = ensureLinkedAccounts(config);
+  for (const [accountId, account] of Object.entries(linkedAccounts)) {
+    if (!account || Object.keys(account).length === 0) {
+      delete existing[accountId];
+      continue;
+    }
+    existing[accountId] = {
+      ...existing[accountId],
+      ...account
+    };
+  }
+  if (Object.keys(existing).length === 0) {
+    delete config.linkedAccounts;
+  }
+}
+function persistServiceRouting(config, serviceRouting, clearRoutes = []) {
+  const existing = ensureServiceRouting(config);
+  for (const capability of clearRoutes) {
+    delete existing[capability];
+  }
+  if (serviceRouting) {
+    for (const [capability, route] of Object.entries(serviceRouting)) {
+      const serviceKey = capability;
+      if (!route || Object.keys(route).length === 0) {
+        delete existing[serviceKey];
+        continue;
+      }
+      existing[serviceKey] = { ...route };
+    }
+  }
+  if (Object.keys(existing).length === 0) {
+    delete config.serviceRouting;
+  }
+}
+function applyCanonicalOnboardingConfig(config, args) {
+  if (args.deploymentTarget !== undefined) {
+    persistDeploymentTarget(config, args.deploymentTarget);
+  }
+  if (args.linkedAccounts !== undefined) {
+    persistLinkedAccounts(config, args.linkedAccounts);
+  }
+  if (args.serviceRouting !== undefined || args.clearRoutes?.length) {
+    persistServiceRouting(config, args.serviceRouting, args.clearRoutes);
+  }
+}
+function normalizeEnvValue(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+function isTimeoutError(error) {
+  if (!(error instanceof Error))
+    return false;
+  if (error.name === "TimeoutError" || error.name === "AbortError")
+    return true;
+  const message = error.message.toLowerCase();
+  return message.includes("timed out") || message.includes("timeout");
+}
+
+// src/lib/cloud-secrets.ts
+function getCloudSecret(key) {
+  return _cloudSecrets[key] ?? process.env[key];
+}
+function scrubCloudSecretsFromEnv() {
+  for (const key of [
+    "ELIZAOS_CLOUD_API_KEY",
+    "ELIZAOS_CLOUD_ENABLED"
+  ]) {
+    if (process.env[key] !== undefined) {
+      _cloudSecrets[key] = process.env[key];
+      delete process.env[key];
+    }
+  }
+}
+function clearCloudSecrets() {
+  for (const key of [
+    "ELIZAOS_CLOUD_API_KEY",
+    "ELIZAOS_CLOUD_ENABLED"
+  ]) {
+    delete _cloudSecrets[key];
+  }
+}
+function _resetCloudSecretsForTesting() {
+  for (const key of Object.keys(_cloudSecrets)) {
+    delete _cloudSecrets[key];
+  }
+}
+var _cloudSecrets;
+var init_cloud_secrets = __esm(() => {
+  _cloudSecrets = Object.create(null);
+  Object.defineProperty(_cloudSecrets, Symbol.toStringTag, {
+    value: "CloudSecrets",
+    enumerable: false
+  });
+});
+
+// src/lib/cloud-connection.ts
+import {
+  isCloudInferenceSelectedInConfig,
+  isElizaSettingsDebugEnabled,
+  migrateLegacyRuntimeConfig,
+  settingsDebugCloudSummary
+} from "@elizaos/core";
+import { logger } from "@elizaos/core";
+function cloudCreditsHttpErrorMessage(status, creditResponse) {
+  const err = creditResponse.error;
+  if (typeof err === "string" && err.trim()) {
+    return err.trim();
+  }
+  if (err && typeof err === "object" && "message" in err) {
+    const msg = err.message;
+    if (typeof msg === "string" && msg.trim()) {
+      return msg.trim();
+    }
+  }
+  return `HTTP ${status}`;
+}
+function asRuntimeCloud(runtime) {
+  return runtime;
+}
+function getCloudAuth(runtime) {
+  const runtimeWithServices = asRuntimeCloud(runtime);
+  if (typeof runtimeWithServices?.getService !== "function") {
+    return null;
+  }
+  const service = runtimeWithServices.getService("CLOUD_AUTH");
+  return service && typeof service === "object" ? service : null;
+}
+function resolvePersistedCloudIdentity(runtime) {
+  const runtimeWithCloud = asRuntimeCloud(runtime);
+  return {
+    organizationId: normalizeEnvValue(runtimeWithCloud?.getSetting?.("ELIZA_CLOUD_ORGANIZATION_ID")) ?? normalizeEnvValue(runtimeWithCloud?.character?.secrets?.ELIZA_CLOUD_ORGANIZATION_ID),
+    userId: normalizeEnvValue(runtimeWithCloud?.getSetting?.("ELIZA_CLOUD_USER_ID")) ?? normalizeEnvValue(runtimeWithCloud?.character?.secrets?.ELIZA_CLOUD_USER_ID)
+  };
+}
+function resolveCloudApiBaseUrl2(rawBaseUrl) {
+  return resolveCloudApiBaseUrl(rawBaseUrl ?? DEFAULT_CLOUD_API_BASE_URL) ?? DEFAULT_CLOUD_API_BASE_URL;
+}
+function resolveCloudApiKey(config, runtime) {
+  migrateLegacyRuntimeConfig(config);
+  const configApiKey = normalizeEnvValue(config.cloud?.apiKey);
+  if (configApiKey)
+    return configApiKey;
+  if (!isCloudInferenceSelectedInConfig(config)) {
+    return;
+  }
+  const sealedKey = normalizeEnvValue(getCloudSecret("ELIZAOS_CLOUD_API_KEY"));
+  if (sealedKey)
+    return sealedKey;
+  const envKey = normalizeEnvValue(process.env.ELIZAOS_CLOUD_API_KEY);
+  if (envKey)
+    return envKey;
+  const runtimeSettingKey = normalizeEnvValue(runtime?.getSetting?.("ELIZAOS_CLOUD_API_KEY"));
+  if (runtimeSettingKey)
+    return runtimeSettingKey;
+  const runtimeKey = normalizeEnvValue(runtime?.character?.secrets?.ELIZAOS_CLOUD_API_KEY);
+  if (runtimeKey)
+    return runtimeKey;
+  return;
+}
+function resolveCloudConnectionSnapshot(config, runtime) {
+  migrateLegacyRuntimeConfig(config);
+  const _cloudRecord = config.cloud && typeof config.cloud === "object" ? config.cloud : undefined;
+  const enabled = isCloudInferenceSelectedInConfig(config);
+  const apiKey = resolveCloudApiKey(config, runtime);
+  const cloudAuth = getCloudAuth(runtime);
+  const authConnected = Boolean(cloudAuth?.isAuthenticated?.());
+  const hasApiKey = Boolean(apiKey);
+  const persistedIdentity = resolvePersistedCloudIdentity(runtime);
+  const shouldExposeIdentity = authConnected || hasApiKey;
+  return {
+    apiKey,
+    authConnected,
+    cloudAuth,
+    connected: authConnected || hasApiKey,
+    enabled,
+    hasApiKey,
+    organizationId: shouldExposeIdentity ? normalizeEnvValue(cloudAuth?.getOrganizationId?.()) ?? persistedIdentity.organizationId : undefined,
+    userId: shouldExposeIdentity ? normalizeEnvValue(cloudAuth?.getUserId?.()) ?? persistedIdentity.userId : undefined
+  };
+}
+function coerceCloudBalance(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (!trimmed)
+      return null;
+    const parsed = Number.parseFloat(trimmed);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  return null;
+}
+async function fetchCloudCreditsByApiKey(baseUrl, apiKey) {
+  const response = await fetch(`${baseUrl}/credits/balance`, {
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    redirect: "manual",
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (response.status >= 300 && response.status < 400) {
+    throw new Error("Cloud credits request was redirected; redirects are not allowed");
+  }
+  const creditResponse = await response.json().catch((err) => {
+    console.warn("[cloud-connection] Failed to parse credit balance response JSON:", err);
+    return {};
+  });
+  if (response.status === 401) {
+    throw new CloudCreditsAuthRejectedError(cloudCreditsHttpErrorMessage(401, creditResponse));
+  }
+  if (!response.ok) {
+    throw new Error(cloudCreditsHttpErrorMessage(response.status, creditResponse));
+  }
+  const balance = coerceCloudBalance(creditResponse.balance) ?? coerceCloudBalance(creditResponse.data?.balance);
+  return balance;
+}
+function withCreditFlags(balance) {
+  return {
+    connected: true,
+    balance,
+    low: balance < CREDIT_LOW_THRESHOLD,
+    critical: balance < CREDIT_CRITICAL_THRESHOLD,
+    topUpUrl: CLOUD_BILLING_URL
+  };
+}
+async function fetchCloudCredits(config, runtime) {
+  const snapshot = resolveCloudConnectionSnapshot(config, runtime);
+  let authenticatedFailure = null;
+  let authenticatedUnexpectedResponse = false;
+  if (!snapshot.connected) {
+    return { balance: null, connected: false };
+  }
+  const cloudClient = snapshot.cloudAuth?.getClient?.();
+  if (snapshot.authConnected && typeof cloudClient?.get === "function") {
+    try {
+      const creditResponse = await cloudClient.get("/credits/balance");
+      const rawBalance = coerceCloudBalance(creditResponse?.balance) ?? coerceCloudBalance(creditResponse?.data?.balance);
+      if (typeof rawBalance === "number") {
+        return withCreditFlags(rawBalance);
+      }
+      authenticatedUnexpectedResponse = true;
+      logger.debug(`[cloud/credits] Unexpected authenticated response shape: ${JSON.stringify(creditResponse)}`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "cloud API unreachable";
+      authenticatedFailure = msg;
+      logger.debug(`[cloud/credits] Authenticated balance fetch failed: ${msg}`);
+    }
+  }
+  if (!snapshot.apiKey) {
+    return {
+      balance: null,
+      connected: snapshot.connected,
+      error: authenticatedFailure ?? (authenticatedUnexpectedResponse ? "unexpected response" : "missing cloud api key")
+    };
+  }
+  const resolvedBaseUrl = resolveCloudApiBaseUrl2(config.cloud?.baseUrl);
+  const baseUrlRejection = await validateCloudBaseUrl(resolvedBaseUrl);
+  if (baseUrlRejection) {
+    return {
+      balance: null,
+      connected: true,
+      error: baseUrlRejection
+    };
+  }
+  try {
+    const balance = await fetchCloudCreditsByApiKey(resolvedBaseUrl, snapshot.apiKey);
+    if (typeof balance !== "number") {
+      return {
+        balance: null,
+        connected: true,
+        error: "unexpected response"
+      };
+    }
+    return withCreditFlags(balance);
+  } catch (err) {
+    if (err instanceof CloudCreditsAuthRejectedError) {
+      logger.debug(`[cloud/credits] API key rejected: ${err.message}`);
+      return {
+        balance: null,
+        connected: true,
+        authRejected: true,
+        error: err.message,
+        topUpUrl: CLOUD_BILLING_URL
+      };
+    }
+    const msg = err instanceof Error ? err.message : "cloud API unreachable";
+    logger.debug(`[cloud/credits] Failed to fetch balance via API key: ${msg}`);
+    return {
+      balance: null,
+      connected: true,
+      error: msg
+    };
+  }
+}
+async function clearCloudAuthService(cloudAuth) {
+  if (!cloudAuth) {
+    return;
+  }
+  const seen = new Set;
+  for (const methodName of CLOUD_AUTH_CLEAR_METHODS) {
+    const method = cloudAuth[methodName];
+    if (typeof method !== "function" || seen.has(method)) {
+      continue;
+    }
+    seen.add(method);
+    try {
+      await method.call(cloudAuth);
+      break;
+    } catch (err) {
+      logger.warn(`[cloud/disconnect] Failed to invoke CLOUD_AUTH.${methodName}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+function clearCloudEnv() {
+  for (const key of CLOUD_ENV_KEYS) {
+    delete process.env[key];
+  }
+  clearCloudSecrets();
+  scrubCloudSecretsFromEnv();
+}
+async function clearRuntimeCloudState(runtime) {
+  const runtimeWithCloud = asRuntimeCloud(runtime);
+  if (!runtimeWithCloud) {
+    return;
+  }
+  const existingSecrets = runtimeWithCloud.character.secrets ?? {};
+  const nextSecrets = { ...existingSecrets };
+  for (const key of CLOUD_RUNTIME_SECRET_KEYS) {
+    delete nextSecrets[key];
+  }
+  runtimeWithCloud.character.secrets = nextSecrets;
+  if (runtimeWithCloud.character.settings && typeof runtimeWithCloud.character.settings === "object") {
+    for (const key of CLOUD_RUNTIME_SETTING_KEYS) {
+      delete runtimeWithCloud.character.settings[key];
+    }
+  }
+  if (typeof runtimeWithCloud.setSetting === "function") {
+    for (const key of CLOUD_RUNTIME_SETTING_KEYS) {
+      try {
+        runtimeWithCloud.setSetting(key, null);
+      } catch (err) {
+        logger.warn(`[cloud/disconnect] Failed to clear runtime setting ${key}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  }
+  if (typeof runtimeWithCloud.updateAgent === "function") {
+    try {
+      await runtimeWithCloud.updateAgent(runtimeWithCloud.agentId, {
+        secrets: { ...nextSecrets }
+      });
+    } catch (err) {
+      logger.warn(`[cloud/disconnect] Failed to clear cloud secrets from agent DB: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+async function disconnectCloudConnection(args) {
+  const { cloudManager = null, config, runtime, saveConfig } = args;
+  if (isElizaSettingsDebugEnabled()) {
+    const c = config.cloud;
+    logger.debug(`[eliza][settings][cloud] disconnectCloudConnection start cloud=${JSON.stringify(settingsDebugCloudSummary(c))}`);
+  }
+  if (typeof cloudManager?.disconnect === "function") {
+    try {
+      await cloudManager.disconnect();
+    } catch (err) {
+      logger.warn(`[cloud/disconnect] Failed to disconnect cloud manager: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  await clearCloudAuthService(getCloudAuth(runtime));
+  const nextCloud = { ...config.cloud ?? {} };
+  delete nextCloud.apiKey;
+  config.cloud = nextCloud;
+  applyCanonicalOnboardingConfig(config, {
+    deploymentTarget: { runtime: "local" },
+    linkedAccounts: {
+      elizacloud: {
+        status: "unlinked",
+        source: "api-key"
+      }
+    },
+    clearRoutes: ["llmText", "tts", "media", "embeddings", "rpc"]
+  });
+  migrateLegacyRuntimeConfig(config);
+  try {
+    saveConfig?.(config);
+    if (isElizaSettingsDebugEnabled()) {
+      const c = config.cloud;
+      logger.debug(`[eliza][settings][cloud] disconnectCloudConnection saveConfig OK cloud=${JSON.stringify(settingsDebugCloudSummary(c))}`);
+    }
+  } catch (err) {
+    logger.warn(`[cloud/disconnect] Failed to save cloud disconnect state: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  clearCloudEnv();
+  await clearRuntimeCloudState(runtime);
+  if (isElizaSettingsDebugEnabled()) {
+    logger.debug("[eliza][settings][cloud] disconnectCloudConnection done (env cleared + runtime cloud state cleared)");
+  }
+}
+function isCloudStatusReasonApiKeyOnly(reason) {
+  return typeof reason === "string" && CLOUD_STATUS_API_KEY_ONLY_REASONS.has(reason);
+}
+var DEFAULT_CLOUD_API_BASE_URL = "https://www.elizacloud.ai/api/v1", CLOUD_BILLING_URL = "https://www.elizacloud.ai/dashboard/settings?tab=billing", CLOUD_ENV_KEYS, CLOUD_RUNTIME_SECRET_KEYS, CLOUD_RUNTIME_SETTING_KEYS, CLOUD_AUTH_CLEAR_METHODS, CloudCreditsAuthRejectedError, CREDIT_LOW_THRESHOLD, CREDIT_CRITICAL_THRESHOLD, disconnectUnifiedCloudConnection, CLOUD_STATUS_API_KEY_ONLY_REASONS;
+var init_cloud_connection = __esm(() => {
+  init_base_url();
+  init_validate_url();
+  init_cloud_secrets();
+  CLOUD_ENV_KEYS = [
+    "ELIZAOS_CLOUD_API_KEY",
+    "ELIZAOS_CLOUD_ENABLED",
+    "ELIZAOS_CLOUD_BASE_URL",
+    "ELIZAOS_CLOUD_NANO_MODEL",
+    "ELIZAOS_CLOUD_MEDIUM_MODEL",
+    "ELIZAOS_CLOUD_SMALL_MODEL",
+    "ELIZAOS_CLOUD_LARGE_MODEL",
+    "ELIZAOS_CLOUD_MEGA_MODEL",
+    "ELIZAOS_CLOUD_RESPONSE_HANDLER_MODEL",
+    "ELIZAOS_CLOUD_SHOULD_RESPOND_MODEL",
+    "ELIZAOS_CLOUD_ACTION_PLANNER_MODEL",
+    "ELIZAOS_CLOUD_PLANNER_MODEL",
+    "ELIZAOS_CLOUD_USE_INFERENCE",
+    "ELIZAOS_CLOUD_USE_TTS",
+    "ELIZAOS_CLOUD_USE_MEDIA",
+    "ELIZAOS_CLOUD_USE_EMBEDDINGS",
+    "ELIZAOS_CLOUD_USE_RPC"
+  ];
+  CLOUD_RUNTIME_SECRET_KEYS = [
+    "ELIZAOS_CLOUD_API_KEY",
+    "ELIZAOS_CLOUD_ENABLED",
+    "ELIZAOS_CLOUD_BASE_URL",
+    "ELIZAOS_CLOUD_NANO_MODEL",
+    "ELIZAOS_CLOUD_MEDIUM_MODEL",
+    "ELIZAOS_CLOUD_SMALL_MODEL",
+    "ELIZAOS_CLOUD_LARGE_MODEL",
+    "ELIZAOS_CLOUD_MEGA_MODEL",
+    "ELIZAOS_CLOUD_RESPONSE_HANDLER_MODEL",
+    "ELIZAOS_CLOUD_SHOULD_RESPOND_MODEL",
+    "ELIZAOS_CLOUD_ACTION_PLANNER_MODEL",
+    "ELIZAOS_CLOUD_PLANNER_MODEL",
+    "ELIZA_CLOUD_AUTH_TOKEN",
+    "ELIZA_CLOUD_USER_ID",
+    "ELIZA_CLOUD_ORGANIZATION_ID"
+  ];
+  CLOUD_RUNTIME_SETTING_KEYS = [
+    "ELIZA_CLOUD_AUTH_TOKEN",
+    "ELIZA_CLOUD_USER_ID",
+    "ELIZA_CLOUD_ORGANIZATION_ID"
+  ];
+  CLOUD_AUTH_CLEAR_METHODS = [
+    "disconnect",
+    "logout",
+    "signOut",
+    "signout",
+    "clearSession",
+    "clearAuth",
+    "resetAuth",
+    "reset"
+  ];
+  CloudCreditsAuthRejectedError = class CloudCreditsAuthRejectedError extends Error {
+    name = "CloudCreditsAuthRejectedError";
+    constructor(message = "Eliza Cloud API key was rejected") {
+      super(message);
+    }
+  };
+  CREDIT_LOW_THRESHOLD = Number(process.env.ELIZA_CREDIT_LOW_THRESHOLD ?? "2.0");
+  CREDIT_CRITICAL_THRESHOLD = Number(process.env.ELIZA_CREDIT_CRITICAL_THRESHOLD ?? "0.5");
+  disconnectUnifiedCloudConnection = disconnectCloudConnection;
+  CLOUD_STATUS_API_KEY_ONLY_REASONS = new Set([
+    "api_key_present_not_authenticated",
+    "api_key_present_runtime_not_started"
+  ]);
+});
+init_cloud_connection();
+
+export {
+  resolveCloudConnectionSnapshot,
+  resolveCloudApiKey,
+  resolveCloudApiBaseUrl2 as resolveCloudApiBaseUrl,
+  isCloudStatusReasonApiKeyOnly,
+  getCloudAuth,
+  fetchCloudCredits,
+  disconnectUnifiedCloudConnection,
+  disconnectCloudConnection,
+  clearCloudAuthService,
+  CloudCreditsAuthRejectedError,
+  CLOUD_BILLING_URL
+};
+
+//# debugId=FCA5F142E27D190C64756E2164756E21