@elizaos/plugin-elizacloud 2.0.0-alpha.8 → 2.0.11-beta.7

package/dist/lib/cloud-connection.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/cloud/base-url.ts", "../src/cloud/validate-url.ts", "../src/lib/config-like.ts", "../src/lib/cloud-secrets.ts", "../src/lib/cloud-connection.ts"],
+  "sourcesContent": [
+    "/**\n * Cloud site/API URL normalizer. The implementation moved to\n * `@elizaos/shared/elizacloud/base-url` so host-layer packages can normalize\n * URLs without reverse-importing this plugin.\n */\nexport { normalizeCloudSiteUrl, resolveCloudApiBaseUrl } from \"@elizaos/shared\";\n",
+    "import dns from \"node:dns\";\nimport net from \"node:net\";\nimport { promisify } from \"node:util\";\n\nconst dnsLookupAll = promisify(dns.lookup);\n\nconst BLOCKED_IPV4_CIDRS: Array<{ base: number; mask: number }> = [\n  cidrV4(\"0.0.0.0\", 8),\n  cidrV4(\"10.0.0.0\", 8),\n  cidrV4(\"172.16.0.0\", 12),\n  cidrV4(\"192.168.0.0\", 16),\n  cidrV4(\"100.64.0.0\", 10),\n  cidrV4(\"127.0.0.0\", 8),\n  cidrV4(\"169.254.0.0\", 16),\n  cidrV4(\"192.0.0.0\", 24),\n  cidrV4(\"198.18.0.0\", 15),\n  cidrV4(\"192.0.2.0\", 24),\n  cidrV4(\"198.51.100.0\", 24),\n  cidrV4(\"203.0.113.0\", 24),\n  cidrV4(\"224.0.0.0\", 4),\n  cidrV4(\"240.0.0.0\", 4),\n];\n\nfunction normalizeHostLike(value: string): string {\n  return value\n    .trim()\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction decodeIpv6MappedHex(mapped: string): string | null {\n  const parts = mapped.split(\":\");\n  if (parts.length < 1 || parts.length > 2) return null;\n\n  const parsed = parts.map((part) => {\n    if (!/^[0-9a-f]{1,4}$/i.test(part)) return Number.NaN;\n    return Number.parseInt(part, 16);\n  });\n  if (parsed.some((value) => !Number.isFinite(value))) return null;\n\n  const [hi, lo] = parsed.length === 1 ? [0, parsed[0]] : parsed;\n  const octets = [hi >> 8, hi & 0xff, lo >> 8, lo & 0xff];\n  return octets.join(\".\");\n}\n\nfunction canonicalizeIpv6(ip: string): string | null {\n  try {\n    return new URL(`http://[${ip}]/`).hostname.replace(/^\\[|\\]$/g, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeIpForPolicy(ip: string): string {\n  const base = normalizeHostLike(ip).split(\"%\")[0];\n  if (!base) return base;\n\n  let normalized = base;\n  if (net.isIP(normalized) === 6) {\n    normalized = canonicalizeIpv6(normalized) ?? normalized;\n  }\n\n  let mapped: string | null = null;\n  if (normalized.startsWith(\"::ffff:\")) {\n    mapped = normalized.slice(\"::ffff:\".length);\n  } else if (normalized.startsWith(\"0:0:0:0:0:ffff:\")) {\n    mapped = normalized.slice(\"0:0:0:0:0:ffff:\".length);\n  }\n  if (!mapped) return normalized;\n\n  if (net.isIP(mapped) === 4) return mapped;\n  return decodeIpv6MappedHex(mapped) ?? normalized;\n}\n\nfunction cidrV4(base: string, prefix: number): { base: number; mask: number } {\n  const parsed = parseIpv4ToInt(base);\n  if (parsed === null) {\n    throw new Error(`Invalid CIDR base IPv4 address: ${base}`);\n  }\n  const shift = 32 - prefix;\n  const mask = shift === 32 ? 0 : (0xffffffff << shift) >>> 0;\n  return { base: parsed & mask, mask };\n}\n\nfunction parseIpv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n  if (parts.length !== 4) return null;\n\n  let value = 0;\n  for (const part of parts) {\n    if (!/^\\d{1,3}$/.test(part)) return null;\n    const octet = Number.parseInt(part, 10);\n    if (!Number.isInteger(octet) || octet < 0 || octet > 255) return null;\n    value = (value << 8) | octet;\n  }\n\n  return value >>> 0;\n}\n\nfunction isBlockedIpv4(ip: string): boolean {\n  const asInt = parseIpv4ToInt(ip);\n  if (asInt === null) return true;\n  return BLOCKED_IPV4_CIDRS.some((cidr) => (asInt & cidr.mask) === cidr.base);\n}\n\nfunction isBlockedIpv6(ip: string): boolean {\n  const normalized = ip.toLowerCase();\n  return (\n    normalized === \"::\" ||\n    normalized === \"::1\" ||\n    /^fe[89ab][0-9a-f]:/.test(normalized) ||\n    /^f[cd][0-9a-f]{2}:/i.test(normalized) ||\n    normalized.startsWith(\"ff\")\n  );\n}\n\nfunction isBlockedIp(ip: string): boolean {\n  const normalized = normalizeIpForPolicy(ip);\n  const family = net.isIP(normalized);\n  if (family === 4) return isBlockedIpv4(normalized);\n  if (family === 6) return isBlockedIpv6(normalized);\n  return false;\n}\n\nexport async function validateCloudBaseUrl(\n  rawUrl: string,\n): Promise<string | null> {\n  let parsed: URL;\n  try {\n    parsed = new URL(rawUrl);\n  } catch {\n    return `Invalid cloud base URL: \"${rawUrl}\"`;\n  }\n\n  if (parsed.protocol !== \"https:\") {\n    return `Cloud base URL must use HTTPS, got \"${parsed.protocol}\" in \"${rawUrl}\"`;\n  }\n\n  const hostname = normalizeHostLike(parsed.hostname);\n  if (!hostname) {\n    return `Invalid cloud base URL: \"${rawUrl}\"`;\n  }\n\n  if (\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\") ||\n    hostname.endsWith(\".local\")\n  ) {\n    return `Cloud base URL \"${rawUrl}\" points to a blocked local hostname.`;\n  }\n\n  // Dev-mode bypass: skip IP-range blocking but keep URL format checks above.\n  const elizaDev = process.env.ELIZA_DEV?.trim().toLowerCase();\n  if (\n    process.env.NODE_ENV === \"development\" ||\n    elizaDev === \"1\" ||\n    elizaDev === \"true\" ||\n    elizaDev === \"yes\"\n  ) {\n    return null;\n  }\n\n  if (isBlockedIp(hostname)) {\n    return `Cloud base URL \"${rawUrl}\" points to a blocked address.`;\n  }\n\n  try {\n    const results = await dnsLookupAll(hostname, { all: true });\n    const addresses = Array.isArray(results) ? results : [results];\n    for (const entry of addresses) {\n      const ip =\n        typeof entry === \"string\"\n          ? entry\n          : (entry as { address: string }).address;\n      if (isBlockedIp(ip)) {\n        return (\n          `Cloud base URL \"${rawUrl}\" resolves to ${ip}, ` +\n          \"which is a blocked internal/metadata address.\"\n        );\n      }\n    }\n  } catch {\n    return `Cloud base URL \"${rawUrl}\" could not be resolved via DNS.`;\n  }\n\n  return null;\n}\n",
+    "import type {\n  DeploymentTargetConfig,\n  LinkedAccountFlagsConfig,\n  ServiceCapability,\n  ServiceRoutingConfig,\n} from \"@elizaos/core\";\n\nexport interface CloudProxyConfigLike {\n  cloud?: {\n    apiKey?: string;\n    baseUrl?: string;\n    enabled?: boolean;\n    serviceKey?: string;\n    backup?: {\n      autoBackupIntervalMs?: number;\n    };\n    bridge?: {\n      heartbeatIntervalMs?: number;\n    };\n  };\n}\n\nexport type CloudConfig = NonNullable<CloudProxyConfigLike[\"cloud\"]>;\n\nexport type ElizaConfig = Record<string, unknown> &\n  CloudProxyConfigLike & {\n    deploymentTarget?: DeploymentTargetConfig;\n    linkedAccounts?: LinkedAccountFlagsConfig;\n    serviceRouting?: ServiceRoutingConfig;\n  };\n\nexport interface AutonomousConfigLike {\n  [key: string]: unknown;\n}\n\ntype MutableElizaConfig = Partial<ElizaConfig> & {\n  cloud?: Record<string, unknown>;\n  deploymentTarget?: DeploymentTargetConfig;\n  linkedAccounts?: LinkedAccountFlagsConfig;\n  serviceRouting?: ServiceRoutingConfig;\n};\n\nfunction ensureLinkedAccounts(\n  config: MutableElizaConfig,\n): LinkedAccountFlagsConfig {\n  config.linkedAccounts ??= {};\n  return config.linkedAccounts;\n}\n\nfunction ensureServiceRouting(\n  config: MutableElizaConfig,\n): ServiceRoutingConfig {\n  config.serviceRouting ??= {};\n  return config.serviceRouting;\n}\n\nfunction persistDeploymentTarget(\n  config: MutableElizaConfig,\n  deploymentTarget: DeploymentTargetConfig | null | undefined,\n): void {\n  if (!deploymentTarget) {\n    delete config.deploymentTarget;\n    return;\n  }\n  config.deploymentTarget = { ...deploymentTarget };\n}\n\nfunction persistLinkedAccounts(\n  config: MutableElizaConfig,\n  linkedAccounts: LinkedAccountFlagsConfig | null | undefined,\n): void {\n  if (!linkedAccounts) return;\n\n  const existing = ensureLinkedAccounts(config);\n  for (const [accountId, account] of Object.entries(linkedAccounts)) {\n    if (!account || Object.keys(account).length === 0) {\n      delete existing[accountId];\n      continue;\n    }\n    existing[accountId] = {\n      ...existing[accountId],\n      ...account,\n    };\n  }\n\n  if (Object.keys(existing).length === 0) {\n    delete config.linkedAccounts;\n  }\n}\n\nfunction persistServiceRouting(\n  config: MutableElizaConfig,\n  serviceRouting: ServiceRoutingConfig | null | undefined,\n  clearRoutes: readonly ServiceCapability[] = [],\n): void {\n  const existing = ensureServiceRouting(config);\n\n  for (const capability of clearRoutes) {\n    delete existing[capability];\n  }\n\n  if (serviceRouting) {\n    for (const [capability, route] of Object.entries(serviceRouting)) {\n      const serviceKey = capability as ServiceCapability;\n      if (!route || Object.keys(route).length === 0) {\n        delete existing[serviceKey];\n        continue;\n      }\n      existing[serviceKey] = { ...route };\n    }\n  }\n\n  if (Object.keys(existing).length === 0) {\n    delete config.serviceRouting;\n  }\n}\n\nexport function applyCanonicalSetupConfig(\n  config: MutableElizaConfig,\n  args: {\n    deploymentTarget?: DeploymentTargetConfig | null;\n    linkedAccounts?: LinkedAccountFlagsConfig | null;\n    serviceRouting?: ServiceRoutingConfig | null;\n    clearRoutes?: readonly ServiceCapability[];\n  },\n): void {\n  if (args.deploymentTarget !== undefined) {\n    persistDeploymentTarget(config, args.deploymentTarget);\n  }\n  if (args.linkedAccounts !== undefined) {\n    persistLinkedAccounts(config, args.linkedAccounts);\n  }\n  if (args.serviceRouting !== undefined || args.clearRoutes?.length) {\n    persistServiceRouting(config, args.serviceRouting, args.clearRoutes);\n  }\n}\n\nexport function normalizeEnvValue(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nexport function isTimeoutError(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  if (error.name === \"TimeoutError\" || error.name === \"AbortError\") return true;\n  const message = error.message.toLowerCase();\n  return message.includes(\"timed out\") || message.includes(\"timeout\");\n}\n",
+    "/**\n * Sealed in-process secret store for cloud credentials.\n *\n * The implementation moved to `@elizaos/shared/elizacloud/cloud-secrets` so\n * app-core and other host-layer packages can read sealed cloud secrets without\n * reverse-importing this plugin. This module remains for backwards\n * compatibility with plugin-internal callers.\n */\nexport {\n  clearCloudSecrets,\n  getCloudSecret,\n  scrubCloudSecretsFromEnv,\n  _resetCloudSecretsForTesting,\n} from \"@elizaos/shared\";\n",
+    "import {\n  isCloudInferenceSelectedInConfig,\n  isElizaSettingsDebugEnabled,\n  migrateLegacyRuntimeConfig,\n  settingsDebugCloudSummary,\n} from \"@elizaos/core\";\nimport { resolveCloudApiBaseUrl as resolveCanonicalCloudApiBaseUrl } from \"../cloud/base-url.js\";\nimport { validateCloudBaseUrl } from \"../cloud/validate-url.js\";\nimport type { AgentRuntime } from \"@elizaos/core\";\nimport { logger } from \"@elizaos/core\";\nimport {\n  applyCanonicalSetupConfig,\n  type ElizaConfig,\n  normalizeEnvValue,\n} from \"./config-like\";\nimport {\n  clearCloudSecrets,\n  getCloudSecret,\n  scrubCloudSecretsFromEnv,\n} from \"./cloud-secrets\";\n\nconst DEFAULT_CLOUD_API_BASE_URL = \"https://www.elizacloud.ai/api/v1\";\nexport const CLOUD_BILLING_URL =\n  \"https://www.elizacloud.ai/dashboard/settings?tab=billing\";\n\nconst CLOUD_ENV_KEYS = [\n  \"ELIZAOS_CLOUD_API_KEY\",\n  \"ELIZAOS_CLOUD_ENABLED\",\n  \"ELIZAOS_CLOUD_BASE_URL\",\n  \"ELIZAOS_CLOUD_NANO_MODEL\",\n  \"ELIZAOS_CLOUD_MEDIUM_MODEL\",\n  \"ELIZAOS_CLOUD_SMALL_MODEL\",\n  \"ELIZAOS_CLOUD_LARGE_MODEL\",\n  \"ELIZAOS_CLOUD_MEGA_MODEL\",\n  \"ELIZAOS_CLOUD_RESPONSE_HANDLER_MODEL\",\n  \"ELIZAOS_CLOUD_SHOULD_RESPOND_MODEL\",\n  \"ELIZAOS_CLOUD_ACTION_PLANNER_MODEL\",\n  \"ELIZAOS_CLOUD_PLANNER_MODEL\",\n  \"ELIZAOS_CLOUD_USE_INFERENCE\",\n  \"ELIZAOS_CLOUD_USE_TTS\",\n  \"ELIZAOS_CLOUD_USE_MEDIA\",\n  \"ELIZAOS_CLOUD_USE_EMBEDDINGS\",\n  \"ELIZAOS_CLOUD_USE_RPC\",\n] as const;\n\nconst CLOUD_RUNTIME_SECRET_KEYS = [\n  \"ELIZAOS_CLOUD_API_KEY\",\n  \"ELIZAOS_CLOUD_ENABLED\",\n  \"ELIZAOS_CLOUD_BASE_URL\",\n  \"ELIZAOS_CLOUD_NANO_MODEL\",\n  \"ELIZAOS_CLOUD_MEDIUM_MODEL\",\n  \"ELIZAOS_CLOUD_SMALL_MODEL\",\n  \"ELIZAOS_CLOUD_LARGE_MODEL\",\n  \"ELIZAOS_CLOUD_MEGA_MODEL\",\n  \"ELIZAOS_CLOUD_RESPONSE_HANDLER_MODEL\",\n  \"ELIZAOS_CLOUD_SHOULD_RESPOND_MODEL\",\n  \"ELIZAOS_CLOUD_ACTION_PLANNER_MODEL\",\n  \"ELIZAOS_CLOUD_PLANNER_MODEL\",\n  \"ELIZA_CLOUD_AUTH_TOKEN\",\n  \"ELIZA_CLOUD_USER_ID\",\n  \"ELIZA_CLOUD_ORGANIZATION_ID\",\n] as const;\n\nconst CLOUD_RUNTIME_SETTING_KEYS = [\n  \"ELIZA_CLOUD_AUTH_TOKEN\",\n  \"ELIZA_CLOUD_USER_ID\",\n  \"ELIZA_CLOUD_ORGANIZATION_ID\",\n] as const;\n\nconst CLOUD_AUTH_CLEAR_METHODS = [\n  \"disconnect\",\n  \"logout\",\n  \"signOut\",\n  \"signout\",\n  \"clearSession\",\n  \"clearAuth\",\n  \"resetAuth\",\n  \"reset\",\n] as const;\n\ntype CloudClientLike = {\n  get?: (path: string) => Promise<unknown>;\n};\n\nexport type CloudAuthLike = {\n  authenticateWithApiKey?: (input: {\n    apiKey: string;\n    organizationId?: string;\n    userId?: string;\n  }) => unknown;\n  isAuthenticated?: () => boolean;\n  getUserId?: () => string | undefined;\n  getOrganizationId?: () => string | undefined;\n  getClient?: () => CloudClientLike | null;\n} & Partial<\n  Record<\n    (typeof CLOUD_AUTH_CLEAR_METHODS)[number],\n    (() => Promise<unknown>) | (() => unknown)\n  >\n>;\n\nexport type RuntimeCloudLike = AgentRuntime & {\n  agentId: string;\n  character: {\n    secrets?: Record<string, string | number | boolean>;\n    settings?: Record<string, unknown>;\n  };\n  updateAgent?: (\n    agentId: string,\n    update: { secrets: Record<string, string | number | boolean> },\n  ) => Promise<unknown>;\n  setSetting?: (key: string, value: string | null) => unknown;\n  getService?: (name: string) => unknown;\n};\n\ntype CloudManagerLike = {\n  disconnect?: () => Promise<void>;\n} | null;\n\nexport type CloudConnectionSnapshot = {\n  apiKey: string | undefined;\n  authConnected: boolean;\n  cloudAuth: CloudAuthLike | null;\n  connected: boolean;\n  enabled: boolean;\n  hasApiKey: boolean;\n  organizationId: string | undefined;\n  userId: string | undefined;\n};\n\ntype CloudCreditsResponse = {\n  balance: number | null;\n  connected: boolean;\n  authRejected?: boolean;\n  critical?: boolean;\n  error?: string;\n  low?: boolean;\n  topUpUrl?: string;\n};\n\n/** Thrown when the credits endpoint returns 401 — same credential path as chat completions. */\nexport class CloudCreditsAuthRejectedError extends Error {\n  override readonly name = \"CloudCreditsAuthRejectedError\";\n  constructor(message = \"Eliza Cloud API key was rejected\") {\n    super(message);\n  }\n}\n\nfunction cloudCreditsHttpErrorMessage(\n  status: number,\n  creditResponse: { error?: unknown },\n): string {\n  const err = creditResponse.error;\n  if (typeof err === \"string\" && err.trim()) {\n    return err.trim();\n  }\n  if (err && typeof err === \"object\" && \"message\" in err) {\n    const msg = (err as { message?: unknown }).message;\n    if (typeof msg === \"string\" && msg.trim()) {\n      return msg.trim();\n    }\n  }\n  return `HTTP ${status}`;\n}\n\nfunction asRuntimeCloud(runtime: AgentRuntime | null): RuntimeCloudLike | null {\n  return runtime as RuntimeCloudLike | null;\n}\n\nexport function getCloudAuth(\n  runtime: AgentRuntime | null,\n): CloudAuthLike | null {\n  const runtimeWithServices = asRuntimeCloud(runtime);\n  if (typeof runtimeWithServices?.getService !== \"function\") {\n    return null;\n  }\n\n  const service = runtimeWithServices.getService(\"CLOUD_AUTH\");\n  return service && typeof service === \"object\"\n    ? (service as CloudAuthLike)\n    : null;\n}\n\nfunction resolvePersistedCloudIdentity(runtime: AgentRuntime | null): {\n  organizationId: string | undefined;\n  userId: string | undefined;\n} {\n  const runtimeWithCloud = asRuntimeCloud(runtime);\n  return {\n    organizationId:\n      normalizeEnvValue(\n        runtimeWithCloud?.getSetting?.(\"ELIZA_CLOUD_ORGANIZATION_ID\") as\n          | string\n          | undefined,\n      ) ??\n      normalizeEnvValue(\n        runtimeWithCloud?.character?.secrets?.ELIZA_CLOUD_ORGANIZATION_ID as\n          | string\n          | undefined,\n      ),\n    userId:\n      normalizeEnvValue(\n        runtimeWithCloud?.getSetting?.(\"ELIZA_CLOUD_USER_ID\") as\n          | string\n          | undefined,\n      ) ??\n      normalizeEnvValue(\n        runtimeWithCloud?.character?.secrets?.ELIZA_CLOUD_USER_ID as\n          | string\n          | undefined,\n      ),\n  };\n}\n\nexport function resolveCloudApiBaseUrl(rawBaseUrl?: string): string {\n  return (\n    resolveCanonicalCloudApiBaseUrl(rawBaseUrl ?? DEFAULT_CLOUD_API_BASE_URL) ??\n    DEFAULT_CLOUD_API_BASE_URL\n  );\n}\n\nexport function resolveCloudApiKey(\n  config: Pick<ElizaConfig, \"cloud\"> | Record<string, unknown>,\n  runtime?: {\n    character?: { secrets?: Record<string, unknown> };\n    getSetting?: (key: string) => unknown;\n  } | null,\n): string | undefined {\n  migrateLegacyRuntimeConfig(config as Record<string, unknown>);\n  // 1. Config file (disk)\n  const configApiKey = normalizeEnvValue(\n    (config as { cloud?: { apiKey?: string } }).cloud?.apiKey,\n  );\n  if (configApiKey) return configApiKey;\n\n  if (!isCloudInferenceSelectedInConfig(config as Record<string, unknown>)) {\n    // A linked cloud account is represented by the persisted disk key above.\n    // Do not resurrect cloud from sealed/env/runtime fallbacks when the\n    // canonical connection is local, remote, or unset.\n    return undefined;\n  }\n\n  // 2. Sealed in-process secret store\n  const sealedKey = normalizeEnvValue(getCloudSecret(\"ELIZAOS_CLOUD_API_KEY\"));\n  if (sealedKey) return sealedKey;\n\n  // 3. Process environment (may not be scrubbed yet)\n  const envKey = normalizeEnvValue(process.env.ELIZAOS_CLOUD_API_KEY);\n  if (envKey) return envKey;\n\n  // 4. Runtime settings (persisted in database, survives restarts)\n  const runtimeSettingKey = normalizeEnvValue(\n    runtime?.getSetting?.(\"ELIZAOS_CLOUD_API_KEY\") as string | undefined,\n  );\n  if (runtimeSettingKey) return runtimeSettingKey;\n\n  // 5. Runtime character secrets (persisted in database, survives restarts)\n  const runtimeKey = normalizeEnvValue(\n    runtime?.character?.secrets?.ELIZAOS_CLOUD_API_KEY as string | undefined,\n  );\n  if (runtimeKey) return runtimeKey;\n\n  return undefined;\n}\n\nexport function resolveCloudConnectionSnapshot(\n  config: Partial<ElizaConfig>,\n  runtime: AgentRuntime | null,\n): CloudConnectionSnapshot {\n  migrateLegacyRuntimeConfig(config as Record<string, unknown>);\n  const _cloudRecord =\n    config.cloud && typeof config.cloud === \"object\"\n      ? (config.cloud as Record<string, unknown>)\n      : undefined;\n  const enabled = isCloudInferenceSelectedInConfig(\n    config as Record<string, unknown>,\n  );\n  const apiKey = resolveCloudApiKey(config, runtime);\n  const cloudAuth = getCloudAuth(runtime);\n  const authConnected = Boolean(cloudAuth?.isAuthenticated?.());\n  const hasApiKey = Boolean(apiKey);\n  const persistedIdentity = resolvePersistedCloudIdentity(runtime);\n  const shouldExposeIdentity = authConnected || hasApiKey;\n\n  return {\n    apiKey,\n    authConnected,\n    cloudAuth,\n    connected: authConnected || hasApiKey,\n    enabled,\n    hasApiKey,\n    organizationId: shouldExposeIdentity\n      ? (normalizeEnvValue(cloudAuth?.getOrganizationId?.()) ??\n        persistedIdentity.organizationId)\n      : undefined,\n    userId: shouldExposeIdentity\n      ? (normalizeEnvValue(cloudAuth?.getUserId?.()) ??\n        persistedIdentity.userId)\n      : undefined,\n  };\n}\n\n/**\n * Coerce an Eliza Cloud `balance` field into a number. The cloud API\n * returns `balance` as `string | number` (per the Bridge client + config\n * type definitions) — string when the upstream is using a fixed-precision\n * decimal, number when it's been arithmetic'd. Treat both as the same\n * dollar amount; reject anything else as an unexpected response.\n */\nfunction coerceCloudBalance(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (!trimmed) return null;\n    const parsed = Number.parseFloat(trimmed);\n    return Number.isFinite(parsed) ? parsed : null;\n  }\n  return null;\n}\n\nasync function fetchCloudCreditsByApiKey(\n  baseUrl: string,\n  apiKey: string,\n): Promise<number | null> {\n  const response = await fetch(`${baseUrl}/credits/balance`, {\n    headers: {\n      Accept: \"application/json\",\n      Authorization: `Bearer ${apiKey}`,\n    },\n    redirect: \"manual\",\n    signal: AbortSignal.timeout(10_000),\n  });\n\n  if (response.status >= 300 && response.status < 400) {\n    throw new Error(\n      \"Cloud credits request was redirected; redirects are not allowed\",\n    );\n  }\n\n  const creditResponse = (await response.json().catch((err: unknown) => {\n    console.warn(\n      \"[cloud-connection] Failed to parse credit balance response JSON:\",\n      err,\n    );\n    return {};\n  })) as {\n    balance?: unknown;\n    data?: { balance?: unknown };\n    error?: unknown;\n  };\n\n  if (response.status === 401) {\n    throw new CloudCreditsAuthRejectedError(\n      cloudCreditsHttpErrorMessage(401, creditResponse),\n    );\n  }\n\n  if (!response.ok) {\n    throw new Error(\n      cloudCreditsHttpErrorMessage(response.status, creditResponse),\n    );\n  }\n\n  const balance =\n    coerceCloudBalance(creditResponse.balance) ??\n    coerceCloudBalance(creditResponse.data?.balance);\n\n  return balance;\n}\n\n/** Configurable credit thresholds. Override via env vars if defaults don't fit. */\nconst CREDIT_LOW_THRESHOLD = Number(\n  process.env.ELIZA_CREDIT_LOW_THRESHOLD ?? \"2.0\",\n);\nconst CREDIT_CRITICAL_THRESHOLD = Number(\n  process.env.ELIZA_CREDIT_CRITICAL_THRESHOLD ?? \"0.5\",\n);\n\nfunction withCreditFlags(balance: number): CloudCreditsResponse {\n  return {\n    connected: true,\n    balance,\n    low: balance < CREDIT_LOW_THRESHOLD,\n    critical: balance < CREDIT_CRITICAL_THRESHOLD,\n    topUpUrl: CLOUD_BILLING_URL,\n  };\n}\n\nexport async function fetchCloudCredits(\n  config: Partial<ElizaConfig>,\n  runtime: AgentRuntime | null,\n): Promise<CloudCreditsResponse> {\n  const snapshot = resolveCloudConnectionSnapshot(config, runtime);\n  let authenticatedFailure: string | null = null;\n  let authenticatedUnexpectedResponse = false;\n\n  if (!snapshot.connected) {\n    return { balance: null, connected: false };\n  }\n\n  const cloudClient = snapshot.cloudAuth?.getClient?.();\n  if (snapshot.authConnected && typeof cloudClient?.get === \"function\") {\n    try {\n      const creditResponse = (await cloudClient.get(\"/credits/balance\")) as {\n        balance?: unknown;\n        data?: { balance?: unknown };\n      };\n      const rawBalance =\n        coerceCloudBalance(creditResponse?.balance) ??\n        coerceCloudBalance(creditResponse?.data?.balance);\n\n      if (typeof rawBalance === \"number\") {\n        return withCreditFlags(rawBalance);\n      }\n\n      authenticatedUnexpectedResponse = true;\n      logger.debug(\n        `[cloud/credits] Unexpected authenticated response shape: ${JSON.stringify(creditResponse)}`,\n      );\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : \"cloud API unreachable\";\n      authenticatedFailure = msg;\n      logger.debug(\n        `[cloud/credits] Authenticated balance fetch failed: ${msg}`,\n      );\n    }\n  }\n\n  if (!snapshot.apiKey) {\n    return {\n      balance: null,\n      connected: snapshot.connected,\n      error:\n        authenticatedFailure ??\n        (authenticatedUnexpectedResponse\n          ? \"unexpected response\"\n          : \"missing cloud api key\"),\n    };\n  }\n\n  const resolvedBaseUrl = resolveCloudApiBaseUrl(config.cloud?.baseUrl);\n  const baseUrlRejection = await validateCloudBaseUrl(resolvedBaseUrl);\n  if (baseUrlRejection) {\n    return {\n      balance: null,\n      connected: true,\n      error: baseUrlRejection,\n    };\n  }\n\n  try {\n    const balance = await fetchCloudCreditsByApiKey(\n      resolvedBaseUrl,\n      snapshot.apiKey,\n    );\n\n    if (typeof balance !== \"number\") {\n      return {\n        balance: null,\n        connected: true,\n        error: \"unexpected response\",\n      };\n    }\n\n    return withCreditFlags(balance);\n  } catch (err) {\n    if (err instanceof CloudCreditsAuthRejectedError) {\n      logger.debug(`[cloud/credits] API key rejected: ${err.message}`);\n      return {\n        balance: null,\n        connected: true,\n        authRejected: true,\n        error: err.message,\n        topUpUrl: CLOUD_BILLING_URL,\n      };\n    }\n    const msg = err instanceof Error ? err.message : \"cloud API unreachable\";\n    logger.debug(`[cloud/credits] Failed to fetch balance via API key: ${msg}`);\n    return {\n      balance: null,\n      connected: true,\n      error: msg,\n    };\n  }\n}\n\nexport async function clearCloudAuthService(\n  cloudAuth: CloudAuthLike | null,\n): Promise<void> {\n  if (!cloudAuth) {\n    return;\n  }\n\n  const seen = new Set<(...args: never[]) => unknown>();\n  for (const methodName of CLOUD_AUTH_CLEAR_METHODS) {\n    const method = cloudAuth[methodName];\n    if (typeof method !== \"function\" || seen.has(method)) {\n      continue;\n    }\n\n    seen.add(method);\n    try {\n      await method.call(cloudAuth);\n      // First successful clear method is sufficient — stop trying remaining ones.\n      break;\n    } catch (err) {\n      logger.warn(\n        `[cloud/disconnect] Failed to invoke CLOUD_AUTH.${methodName}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  }\n}\n\nfunction clearCloudEnv(): void {\n  for (const key of CLOUD_ENV_KEYS) {\n    delete process.env[key];\n  }\n  clearCloudSecrets();\n  scrubCloudSecretsFromEnv();\n}\n\nasync function clearRuntimeCloudState(\n  runtime: AgentRuntime | null,\n): Promise<void> {\n  const runtimeWithCloud = asRuntimeCloud(runtime);\n  if (!runtimeWithCloud) {\n    return;\n  }\n\n  const existingSecrets = runtimeWithCloud.character.secrets ?? {};\n  const nextSecrets = { ...existingSecrets };\n  for (const key of CLOUD_RUNTIME_SECRET_KEYS) {\n    delete nextSecrets[key];\n  }\n  runtimeWithCloud.character.secrets = nextSecrets;\n\n  if (\n    runtimeWithCloud.character.settings &&\n    typeof runtimeWithCloud.character.settings === \"object\"\n  ) {\n    for (const key of CLOUD_RUNTIME_SETTING_KEYS) {\n      delete runtimeWithCloud.character.settings[key];\n    }\n  }\n\n  if (typeof runtimeWithCloud.setSetting === \"function\") {\n    for (const key of CLOUD_RUNTIME_SETTING_KEYS) {\n      try {\n        runtimeWithCloud.setSetting(key, null);\n      } catch (err) {\n        logger.warn(\n          `[cloud/disconnect] Failed to clear runtime setting ${key}: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n      }\n    }\n  }\n\n  if (typeof runtimeWithCloud.updateAgent === \"function\") {\n    try {\n      await runtimeWithCloud.updateAgent(runtimeWithCloud.agentId, {\n        secrets: { ...nextSecrets },\n      });\n    } catch (err) {\n      logger.warn(\n        `[cloud/disconnect] Failed to clear cloud secrets from agent DB: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  }\n}\n\nexport async function disconnectCloudConnection(args: {\n  cloudManager?: CloudManagerLike;\n  config: Partial<ElizaConfig>;\n  runtime: AgentRuntime | null;\n  saveConfig?: (config: Partial<ElizaConfig>) => void;\n}): Promise<void> {\n  const { cloudManager = null, config, runtime, saveConfig } = args;\n\n  if (isElizaSettingsDebugEnabled()) {\n    const c = config.cloud as Record<string, unknown> | undefined;\n    logger.debug(\n      `[eliza][settings][cloud] disconnectCloudConnection start cloud=${JSON.stringify(settingsDebugCloudSummary(c))}`,\n    );\n  }\n\n  if (typeof cloudManager?.disconnect === \"function\") {\n    try {\n      await cloudManager.disconnect();\n    } catch (err) {\n      logger.warn(\n        `[cloud/disconnect] Failed to disconnect cloud manager: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  }\n\n  await clearCloudAuthService(getCloudAuth(runtime));\n\n  const nextCloud = { ...(config.cloud ?? {}) };\n  delete nextCloud.apiKey;\n  config.cloud = nextCloud;\n  applyCanonicalSetupConfig(config as ElizaConfig, {\n    deploymentTarget: { runtime: \"local\" },\n    linkedAccounts: {\n      elizacloud: {\n        status: \"unlinked\",\n        source: \"api-key\",\n      },\n    },\n    clearRoutes: [\"llmText\", \"tts\", \"media\", \"embeddings\", \"rpc\"],\n  });\n  migrateLegacyRuntimeConfig(config as Record<string, unknown>);\n\n  try {\n    saveConfig?.(config);\n    if (isElizaSettingsDebugEnabled()) {\n      const c = config.cloud as Record<string, unknown> | undefined;\n      logger.debug(\n        `[eliza][settings][cloud] disconnectCloudConnection saveConfig OK cloud=${JSON.stringify(settingsDebugCloudSummary(c))}`,\n      );\n    }\n  } catch (err) {\n    logger.warn(\n      `[cloud/disconnect] Failed to save cloud disconnect state: ${\n        err instanceof Error ? err.message : String(err)\n      }`,\n    );\n  }\n\n  clearCloudEnv();\n  await clearRuntimeCloudState(runtime);\n\n  if (isElizaSettingsDebugEnabled()) {\n    logger.debug(\n      \"[eliza][settings][cloud] disconnectCloudConnection done (env cleared + runtime cloud state cleared)\",\n    );\n  }\n}\n\n/** Matches `reason` from GET /api/cloud/status when connected via API key without CLOUD_AUTH. */\nconst CLOUD_STATUS_API_KEY_ONLY_REASONS: ReadonlySet<string> = new Set([\n  \"api_key_present_not_authenticated\",\n  \"api_key_present_runtime_not_started\",\n]);\n\nexport function isCloudStatusReasonApiKeyOnly(\n  reason: string | null | undefined,\n): boolean {\n  return (\n    typeof reason === \"string\" && CLOUD_STATUS_API_KEY_ONLY_REASONS.has(reason)\n  );\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAKA;AAAA;;;ACLA;AACA;AACA;AAqBA,SAAS,iBAAiB,CAAC,OAAuB;AAAA,EAChD,OAAO,MACJ,KAAK,EACL,YAAY,EACZ,QAAQ,YAAY,EAAE;AAAA;AAG3B,SAAS,mBAAmB,CAAC,QAA+B;AAAA,EAC1D,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,EAC9B,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS;AAAA,IAAG,OAAO;AAAA,EAEjD,MAAM,SAAS,MAAM,IAAI,CAAC,SAAS;AAAA,IACjC,IAAI,CAAC,mBAAmB,KAAK,IAAI;AAAA,MAAG,OAAO,OAAO;AAAA,IAClD,OAAO,OAAO,SAAS,MAAM,EAAE;AAAA,GAChC;AAAA,EACD,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,SAAS,KAAK,CAAC;AAAA,IAAG,OAAO;AAAA,EAE5D,OAAO,IAAI,MAAM,OAAO,WAAW,IAAI,CAAC,GAAG,OAAO,EAAE,IAAI;AAAA,EACxD,MAAM,SAAS,CAAC,MAAM,GAAG,KAAK,KAAM,MAAM,GAAG,KAAK,GAAI;AAAA,EACtD,OAAO,OAAO,KAAK,GAAG;AAAA;AAGxB,SAAS,gBAAgB,CAAC,IAA2B;AAAA,EACnD,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,WAAW,MAAM,EAAE,SAAS,QAAQ,YAAY,EAAE;AAAA,IACjE,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIX,SAAS,oBAAoB,CAAC,IAAoB;AAAA,EAChD,MAAM,OAAO,kBAAkB,EAAE,EAAE,MAAM,GAAG,EAAE;AAAA,EAC9C,IAAI,CAAC;AAAA,IAAM,OAAO;AAAA,EAElB,IAAI,aAAa;AAAA,EACjB,IAAI,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,IAC9B,aAAa,iBAAiB,UAAU,KAAK;AAAA,EAC/C;AAAA,EAEA,IAAI,SAAwB;AAAA,EAC5B,IAAI,WAAW,WAAW,SAAS,GAAG;AAAA,IACpC,SAAS,WAAW,MAAM,UAAU,MAAM;AAAA,EAC5C,EAAO,SAAI,WAAW,WAAW,iBAAiB,GAAG;AAAA,IACnD,SAAS,WAAW,MAAM,kBAAkB,MAAM;AAAA,EACpD;AAAA,EACA,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EAEpB,IAAI,IAAI,KAAK,MAAM,MAAM;AAAA,IAAG,OAAO;AAAA,EACnC,OAAO,oBAAoB,MAAM,KAAK;AAAA;AAGxC,SAAS,MAAM,CAAC,MAAc,QAAgD;AAAA,EAC5E,MAAM,SAAS,eAAe,IAAI;AAAA,EAClC,IAAI,WAAW,MAAM;AAAA,IACnB,MAAM,IAAI,MAAM,mCAAmC,MAAM;AAAA,EAC3D;AAAA,EACA,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,UAAU,KAAK,IAAK,cAAc,UAAW;AAAA,EAC1D,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK;AAAA;AAGrC,SAAS,cAAc,CAAC,IAA2B;AAAA,EACjD,MAAM,QAAQ,GAAG,MAAM,GAAG;AAAA,EAC1B,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EAE/B,IAAI,QAAQ;AAAA,EACZ,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,YAAY,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACpC,MAAM,QAAQ,OAAO,SAAS,MAAM,EAAE;AAAA,IACtC,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ;AAAA,MAAK,OAAO;AAAA,IACjE,QAAS,SAAS,IAAK;AAAA,EACzB;AAAA,EAEA,OAAO,UAAU;AAAA;AAGnB,SAAS,aAAa,CAAC,IAAqB;AAAA,EAC1C,MAAM,QAAQ,eAAe,EAAE;AAAA,EAC/B,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,OAAO,mBAAmB,KAAK,CAAC,UAAU,QAAQ,KAAK,UAAU,KAAK,IAAI;AAAA;AAG5E,SAAS,aAAa,CAAC,IAAqB;AAAA,EAC1C,MAAM,aAAa,GAAG,YAAY;AAAA,EAClC,OACE,eAAe,QACf,eAAe,SACf,qBAAqB,KAAK,UAAU,KACpC,sBAAsB,KAAK,UAAU,KACrC,WAAW,WAAW,IAAI;AAAA;AAI9B,SAAS,WAAW,CAAC,IAAqB;AAAA,EACxC,MAAM,aAAa,qBAAqB,EAAE;AAAA,EAC1C,MAAM,SAAS,IAAI,KAAK,UAAU;AAAA,EAClC,IAAI,WAAW;AAAA,IAAG,OAAO,cAAc,UAAU;AAAA,EACjD,IAAI,WAAW;AAAA,IAAG,OAAO,cAAc,UAAU;AAAA,EACjD,OAAO;AAAA;AAGT,eAAsB,oBAAoB,CACxC,QACwB;AAAA,EACxB,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,IAAI,IAAI,MAAM;AAAA,IACvB,MAAM;AAAA,IACN,OAAO,4BAA4B;AAAA;AAAA,EAGrC,IAAI,OAAO,aAAa,UAAU;AAAA,IAChC,OAAO,uCAAuC,OAAO,iBAAiB;AAAA,EACxE;AAAA,EAEA,MAAM,WAAW,kBAAkB,OAAO,QAAQ;AAAA,EAClD,IAAI,CAAC,UAAU;AAAA,IACb,OAAO,4BAA4B;AAAA,EACrC;AAAA,EAEA,IACE,aAAa,eACb,SAAS,SAAS,YAAY,KAC9B,SAAS,SAAS,QAAQ,GAC1B;AAAA,IACA,OAAO,mBAAmB;AAAA,EAC5B;AAAA,EAGA,MAAM,WAAW,QAAQ,IAAI,WAAW,KAAK,EAAE,YAAY;AAAA,EAC3D,IACE,MAIA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,YAAY,QAAQ,GAAG;AAAA,IACzB,OAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,UAAU,MAAM,aAAa,UAAU,EAAE,KAAK,KAAK,CAAC;AAAA,IAC1D,MAAM,YAAY,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AAAA,IAC7D,WAAW,SAAS,WAAW;AAAA,MAC7B,MAAM,KACJ,OAAO,UAAU,WACb,QACC,MAA8B;AAAA,MACrC,IAAI,YAAY,EAAE,GAAG;AAAA,QACnB,OACE,mBAAmB,uBAAuB,SAC1C;AAAA,MAEJ;AAAA,IACF;AAAA,IACA,MAAM;AAAA,IACN,OAAO,mBAAmB;AAAA;AAAA,EAG5B,OAAO;AAAA;AAAA,IArLH,cAEA;AAAA;AAAA,EAFA,eAAe,UAAU,IAAI,MAAM;AAAA,EAEnC,qBAA4D;AAAA,IAChE,OAAO,WAAW,CAAC;AAAA,IACnB,OAAO,YAAY,CAAC;AAAA,IACpB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,aAAa,CAAC;AAAA,IACrB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,aAAa,EAAE;AAAA,IACtB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,aAAa,EAAE;AAAA,IACtB,OAAO,gBAAgB,EAAE;AAAA,IACzB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,aAAa,CAAC;AAAA,IACrB,OAAO,aAAa,CAAC;AAAA,EACvB;AAAA;;;ACqBA,SAAS,oBAAoB,CAC3B,QAC0B;AAAA,EAC1B,OAAO,mBAAmB,CAAC;AAAA,EAC3B,OAAO,OAAO;AAAA;AAGhB,SAAS,oBAAoB,CAC3B,QACsB;AAAA,EACtB,OAAO,mBAAmB,CAAC;AAAA,EAC3B,OAAO,OAAO;AAAA;AAGhB,SAAS,uBAAuB,CAC9B,QACA,kBACM;AAAA,EACN,IAAI,CAAC,kBAAkB;AAAA,IACrB,OAAO,OAAO;AAAA,IACd;AAAA,EACF;AAAA,EACA,OAAO,mBAAmB,KAAK,iBAAiB;AAAA;AAGlD,SAAS,qBAAqB,CAC5B,QACA,gBACM;AAAA,EACN,IAAI,CAAC;AAAA,IAAgB;AAAA,EAErB,MAAM,WAAW,qBAAqB,MAAM;AAAA,EAC5C,YAAY,WAAW,YAAY,OAAO,QAAQ,cAAc,GAAG;AAAA,IACjE,IAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AAAA,MACjD,OAAO,SAAS;AAAA,MAChB;AAAA,IACF;AAAA,IACA,SAAS,aAAa;AAAA,SACjB,SAAS;AAAA,SACT;AAAA,IACL;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AAAA,IACtC,OAAO,OAAO;AAAA,EAChB;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,gBACA,cAA4C,CAAC,GACvC;AAAA,EACN,MAAM,WAAW,qBAAqB,MAAM;AAAA,EAE5C,WAAW,cAAc,aAAa;AAAA,IACpC,OAAO,SAAS;AAAA,EAClB;AAAA,EAEA,IAAI,gBAAgB;AAAA,IAClB,YAAY,YAAY,UAAU,OAAO,QAAQ,cAAc,GAAG;AAAA,MAChE,MAAM,aAAa;AAAA,MACnB,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AAAA,QAC7C,OAAO,SAAS;AAAA,QAChB;AAAA,MACF;AAAA,MACA,SAAS,cAAc,KAAK,MAAM;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AAAA,IACtC,OAAO,OAAO;AAAA,EAChB;AAAA;AAGK,SAAS,yBAAyB,CACvC,QACA,MAMM;AAAA,EACN,IAAI,KAAK,qBAAqB,WAAW;AAAA,IACvC,wBAAwB,QAAQ,KAAK,gBAAgB;AAAA,EACvD;AAAA,EACA,IAAI,KAAK,mBAAmB,WAAW;AAAA,IACrC,sBAAsB,QAAQ,KAAK,cAAc;AAAA,EACnD;AAAA,EACA,IAAI,KAAK,mBAAmB,aAAa,KAAK,aAAa,QAAQ;AAAA,IACjE,sBAAsB,QAAQ,KAAK,gBAAgB,KAAK,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,iBAAiB,CAAC,OAAoC;AAAA,EACpE,IAAI,OAAO,UAAU;AAAA,IAAU;AAAA,EAC/B,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,OAAO,WAAW;AAAA;AAGb,SAAS,cAAc,CAAC,OAAyB;AAAA,EACtD,IAAI,EAAE,iBAAiB;AAAA,IAAQ,OAAO;AAAA,EACtC,IAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS;AAAA,IAAc,OAAO;AAAA,EACzE,MAAM,UAAU,MAAM,QAAQ,YAAY;AAAA,EAC1C,OAAO,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS;AAAA;;;AC3IpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACRA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA;AA2IA,SAAS,4BAA4B,CACnC,QACA,gBACQ;AAAA,EACR,MAAM,MAAM,eAAe;AAAA,EAC3B,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,GAAG;AAAA,IACzC,OAAO,IAAI,KAAK;AAAA,EAClB;AAAA,EACA,IAAI,OAAO,OAAO,QAAQ,YAAY,aAAa,KAAK;AAAA,IACtD,MAAM,MAAO,IAA8B;AAAA,IAC3C,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,GAAG;AAAA,MACzC,OAAO,IAAI,KAAK;AAAA,IAClB;AAAA,EACF;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,cAAc,CAAC,SAAuD;AAAA,EAC7E,OAAO;AAAA;AAGF,SAAS,YAAY,CAC1B,SACsB;AAAA,EACtB,MAAM,sBAAsB,eAAe,OAAO;AAAA,EAClD,IAAI,OAAO,qBAAqB,eAAe,YAAY;AAAA,IACzD,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,oBAAoB,WAAW,YAAY;AAAA,EAC3D,OAAO,WAAW,OAAO,YAAY,WAChC,UACD;AAAA;AAGN,SAAS,6BAA6B,CAAC,SAGrC;AAAA,EACA,MAAM,mBAAmB,eAAe,OAAO;AAAA,EAC/C,OAAO;AAAA,IACL,gBACE,kBACE,kBAAkB,aAAa,6BAA6B,CAG9D,KACA,kBACE,kBAAkB,WAAW,SAAS,2BAGxC;AAAA,IACF,QACE,kBACE,kBAAkB,aAAa,qBAAqB,CAGtD,KACA,kBACE,kBAAkB,WAAW,SAAS,mBAGxC;AAAA,EACJ;AAAA;AAGK,SAAS,uBAAsB,CAAC,YAA6B;AAAA,EAClE,OACE,uBAAgC,cAAc,0BAA0B,KACxE;AAAA;AAIG,SAAS,kBAAkB,CAChC,QACA,SAIoB;AAAA,EACpB,2BAA2B,MAAiC;AAAA,EAE5D,MAAM,eAAe,kBAClB,OAA2C,OAAO,MACrD;AAAA,EACA,IAAI;AAAA,IAAc,OAAO;AAAA,EAEzB,IAAI,CAAC,iCAAiC,MAAiC,GAAG;AAAA,IAIxE;AAAA,EACF;AAAA,EAGA,MAAM,YAAY,kBAAkB,eAAe,uBAAuB,CAAC;AAAA,EAC3E,IAAI;AAAA,IAAW,OAAO;AAAA,EAGtB,MAAM,SAAS,kBAAkB,QAAQ,IAAI,qBAAqB;AAAA,EAClE,IAAI;AAAA,IAAQ,OAAO;AAAA,EAGnB,MAAM,oBAAoB,kBACxB,SAAS,aAAa,uBAAuB,CAC/C;AAAA,EACA,IAAI;AAAA,IAAmB,OAAO;AAAA,EAG9B,MAAM,aAAa,kBACjB,SAAS,WAAW,SAAS,qBAC/B;AAAA,EACA,IAAI;AAAA,IAAY,OAAO;AAAA,EAEvB;AAAA;AAGK,SAAS,8BAA8B,CAC5C,QACA,SACyB;AAAA,EACzB,2BAA2B,MAAiC;AAAA,EAC5D,MAAM,eACJ,OAAO,SAAS,OAAO,OAAO,UAAU,WACnC,OAAO,QACR;AAAA,EACN,MAAM,UAAU,iCACd,MACF;AAAA,EACA,MAAM,SAAS,mBAAmB,QAAQ,OAAO;AAAA,EACjD,MAAM,YAAY,aAAa,OAAO;AAAA,EACtC,MAAM,gBAAgB,QAAQ,WAAW,kBAAkB,CAAC;AAAA,EAC5D,MAAM,YAAY,QAAQ,MAAM;AAAA,EAChC,MAAM,oBAAoB,8BAA8B,OAAO;AAAA,EAC/D,MAAM,uBAAuB,iBAAiB;AAAA,EAE9C,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,iBAAiB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,gBAAgB,uBACX,kBAAkB,WAAW,oBAAoB,CAAC,KACnD,kBAAkB,iBAClB;AAAA,IACJ,QAAQ,uBACH,kBAAkB,WAAW,YAAY,CAAC,KAC3C,kBAAkB,SAClB;AAAA,EACN;AAAA;AAUF,SAAS,kBAAkB,CAAC,OAA+B;AAAA,EACzD,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AAAA,IACvD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK;AAAA,IAC3B,IAAI,CAAC;AAAA,MAAS,OAAO;AAAA,IACrB,MAAM,SAAS,OAAO,WAAW,OAAO;AAAA,IACxC,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,yBAAyB,CACtC,SACA,QACwB;AAAA,EACxB,MAAM,WAAW,MAAM,MAAM,GAAG,2BAA2B;AAAA,IACzD,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe,UAAU;AAAA,IAC3B;AAAA,IACA,UAAU;AAAA,IACV,QAAQ,YAAY,QAAQ,GAAM;AAAA,EACpC,CAAC;AAAA,EAED,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AAAA,IACnD,MAAM,IAAI,MACR,iEACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAkB,MAAM,SAAS,KAAK,EAAE,MAAM,CAAC,QAAiB;AAAA,IACpE,QAAQ,KACN,oEACA,GACF;AAAA,IACA,OAAO,CAAC;AAAA,GACT;AAAA,EAMD,IAAI,SAAS,WAAW,KAAK;AAAA,IAC3B,MAAM,IAAI,8BACR,6BAA6B,KAAK,cAAc,CAClD;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,SAAS,IAAI;AAAA,IAChB,MAAM,IAAI,MACR,6BAA6B,SAAS,QAAQ,cAAc,CAC9D;AAAA,EACF;AAAA,EAEA,MAAM,UACJ,mBAAmB,eAAe,OAAO,KACzC,mBAAmB,eAAe,MAAM,OAAO;AAAA,EAEjD,OAAO;AAAA;AAWT,SAAS,eAAe,CAAC,SAAuC;AAAA,EAC9D,OAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,KAAK,UAAU;AAAA,IACf,UAAU,UAAU;AAAA,IACpB,UAAU;AAAA,EACZ;AAAA;AAGF,eAAsB,iBAAiB,CACrC,QACA,SAC+B;AAAA,EAC/B,MAAM,WAAW,+BAA+B,QAAQ,OAAO;AAAA,EAC/D,IAAI,uBAAsC;AAAA,EAC1C,IAAI,kCAAkC;AAAA,EAEtC,IAAI,CAAC,SAAS,WAAW;AAAA,IACvB,OAAO,EAAE,SAAS,MAAM,WAAW,MAAM;AAAA,EAC3C;AAAA,EAEA,MAAM,cAAc,SAAS,WAAW,YAAY;AAAA,EACpD,IAAI,SAAS,iBAAiB,OAAO,aAAa,QAAQ,YAAY;AAAA,IACpE,IAAI;AAAA,MACF,MAAM,iBAAkB,MAAM,YAAY,IAAI,kBAAkB;AAAA,MAIhE,MAAM,aACJ,mBAAmB,gBAAgB,OAAO,KAC1C,mBAAmB,gBAAgB,MAAM,OAAO;AAAA,MAElD,IAAI,OAAO,eAAe,UAAU;AAAA,QAClC,OAAO,gBAAgB,UAAU;AAAA,MACnC;AAAA,MAEA,kCAAkC;AAAA,MAClC,OAAO,MACL,4DAA4D,KAAK,UAAU,cAAc,GAC3F;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AAAA,MACjD,uBAAuB;AAAA,MACvB,OAAO,MACL,uDAAuD,KACzD;AAAA;AAAA,EAEJ;AAAA,EAEA,IAAI,CAAC,SAAS,QAAQ;AAAA,IACpB,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,SAAS;AAAA,MACpB,OACE,yBACC,kCACG,wBACA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,wBAAuB,OAAO,OAAO,OAAO;AAAA,EACpE,MAAM,mBAAmB,MAAM,qBAAqB,eAAe;AAAA,EACnE,IAAI,kBAAkB;AAAA,IACpB,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,UAAU,MAAM,0BACpB,iBACA,SAAS,MACX;AAAA,IAEA,IAAI,OAAO,YAAY,UAAU;AAAA,MAC/B,OAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,OAAO,gBAAgB,OAAO;AAAA,IAC9B,OAAO,KAAK;AAAA,IACZ,IAAI,eAAe,+BAA+B;AAAA,MAChD,OAAO,MAAM,qCAAqC,IAAI,SAAS;AAAA,MAC/D,OAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,cAAc;AAAA,QACd,OAAO,IAAI;AAAA,QACX,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AAAA,IACjD,OAAO,MAAM,wDAAwD,KAAK;AAAA,IAC1E,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA;AAAA;AAIJ,eAAsB,qBAAqB,CACzC,WACe;AAAA,EACf,IAAI,CAAC,WAAW;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,cAAc,0BAA0B;AAAA,IACjD,MAAM,SAAS,UAAU;AAAA,IACzB,IAAI,OAAO,WAAW,cAAc,KAAK,IAAI,MAAM,GAAG;AAAA,MACpD;AAAA,IACF;AAAA,IAEA,KAAK,IAAI,MAAM;AAAA,IACf,IAAI;AAAA,MACF,MAAM,OAAO,KAAK,SAAS;AAAA,MAE3B;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,OAAO,KACL,kDAAkD,eAChD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;AAAA;AAAA,EAEJ;AAAA;AAGF,SAAS,aAAa,GAAS;AAAA,EAC7B,WAAW,OAAO,gBAAgB;AAAA,IAChC,OAAO,QAAQ,IAAI;AAAA,EACrB;AAAA,EACA,kBAAkB;AAAA,EAClB,yBAAyB;AAAA;AAG3B,eAAe,sBAAsB,CACnC,SACe;AAAA,EACf,MAAM,mBAAmB,eAAe,OAAO;AAAA,EAC/C,IAAI,CAAC,kBAAkB;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,iBAAiB,UAAU,WAAW,CAAC;AAAA,EAC/D,MAAM,cAAc,KAAK,gBAAgB;AAAA,EACzC,WAAW,OAAO,2BAA2B;AAAA,IAC3C,OAAO,YAAY;AAAA,EACrB;AAAA,EACA,iBAAiB,UAAU,UAAU;AAAA,EAErC,IACE,iBAAiB,UAAU,YAC3B,OAAO,iBAAiB,UAAU,aAAa,UAC/C;AAAA,IACA,WAAW,OAAO,4BAA4B;AAAA,MAC5C,OAAO,iBAAiB,UAAU,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,iBAAiB,eAAe,YAAY;AAAA,IACrD,WAAW,OAAO,4BAA4B;AAAA,MAC5C,IAAI;AAAA,QACF,iBAAiB,WAAW,KAAK,IAAI;AAAA,QACrC,OAAO,KAAK;AAAA,QACZ,OAAO,KACL,sDAAsD,QACpD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;AAAA;AAAA,IAEJ;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,iBAAiB,gBAAgB,YAAY;AAAA,IACtD,IAAI;AAAA,MACF,MAAM,iBAAiB,YAAY,iBAAiB,SAAS;AAAA,QAC3D,SAAS,KAAK,YAAY;AAAA,MAC5B,CAAC;AAAA,MACD,OAAO,KAAK;AAAA,MACZ,OAAO,KACL,mEACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;AAAA;AAAA,EAEJ;AAAA;AAGF,eAAsB,yBAAyB,CAAC,MAK9B;AAAA,EAChB,QAAQ,eAAe,MAAM,QAAQ,SAAS,eAAe;AAAA,EAE7D,IAAI,4BAA4B,GAAG;AAAA,IACjC,MAAM,IAAI,OAAO;AAAA,IACjB,OAAO,MACL,kEAAkE,KAAK,UAAU,0BAA0B,CAAC,CAAC,GAC/G;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,cAAc,eAAe,YAAY;AAAA,IAClD,IAAI;AAAA,MACF,MAAM,aAAa,WAAW;AAAA,MAC9B,OAAO,KAAK;AAAA,MACZ,OAAO,KACL,0DACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;AAAA;AAAA,EAEJ;AAAA,EAEA,MAAM,sBAAsB,aAAa,OAAO,CAAC;AAAA,EAEjD,MAAM,YAAY,KAAM,OAAO,SAAS,CAAC,EAAG;AAAA,EAC5C,OAAO,UAAU;AAAA,EACjB,OAAO,QAAQ;AAAA,EACf,0BAA0B,QAAuB;AAAA,IAC/C,kBAAkB,EAAE,SAAS,QAAQ;AAAA,IACrC,gBAAgB;AAAA,MACd,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,aAAa,CAAC,WAAW,OAAO,SAAS,cAAc,KAAK;AAAA,EAC9D,CAAC;AAAA,EACD,2BAA2B,MAAiC;AAAA,EAE5D,IAAI;AAAA,IACF,aAAa,MAAM;AAAA,IACnB,IAAI,4BAA4B,GAAG;AAAA,MACjC,MAAM,IAAI,OAAO;AAAA,MACjB,OAAO,MACL,0EAA0E,KAAK,UAAU,0BAA0B,CAAC,CAAC,GACvH;AAAA,IACF;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,OAAO,KACL,6DACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAEnD;AAAA;AAAA,EAGF,cAAc;AAAA,EACd,MAAM,uBAAuB,OAAO;AAAA,EAEpC,IAAI,4BAA4B,GAAG;AAAA,IACjC,OAAO,MACL,qGACF;AAAA,EACF;AAAA;AASK,SAAS,6BAA6B,CAC3C,QACS;AAAA,EACT,OACE,OAAO,WAAW,YAAY,kCAAkC,IAAI,MAAM;AAAA;AAAA,IA7nBxE,6BAA6B,oCACtB,oBACX,4DAEI,gBAoBA,2BAkBA,4BAMA,0BAwEO,+BAwOP,sBAGA,2BAiRA;AAAA;AAAA,EAnoBN;AAAA,EACA;AAAA,EAQA;AAAA,EAUM,iBAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEM,4BAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEM,6BAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEM,2BAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EA+Da,gCAAN,MAAM,sCAAsC,MAAM;AAAA,IACrC,OAAO;AAAA,IACzB,WAAW,CAAC,UAAU,oCAAoC;AAAA,MACxD,MAAM,OAAO;AAAA;AAAA,EAEjB;AAAA,EAmOM,uBAAuB,OAC3B,QAAQ,IAAI,8BAA8B,KAC5C;AAAA,EACM,4BAA4B,OAChC,QAAQ,IAAI,mCAAmC,KACjD;AAAA,EA+QM,oCAAyD,IAAI,IAAI;AAAA,IACrE;AAAA,IACA;AAAA,EACF,CAAC;AAAA;",
+  "debugId": "58E0F22026D243D464756E2164756E21",
+  "names": []
+}

package/dist/lib/cloud-secrets.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Sealed in-process secret store for cloud credentials.
+ *
+ * The implementation moved to `@elizaos/shared/elizacloud/cloud-secrets` so
+ * app-core and other host-layer packages can read sealed cloud secrets without
+ * reverse-importing this plugin. This module remains for backwards
+ * compatibility with plugin-internal callers.
+ */
+export { clearCloudSecrets, getCloudSecret, scrubCloudSecretsFromEnv, _resetCloudSecretsForTesting, } from "@elizaos/shared";
+//# sourceMappingURL=cloud-secrets.d.ts.map

package/dist/lib/cloud-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-secrets.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC"}

package/dist/lib/cloud-secrets.js

@@ -0,0 +1,36 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/lib/cloud-secrets.ts
+import {
+  clearCloudSecrets,
+  getCloudSecret,
+  scrubCloudSecretsFromEnv,
+  _resetCloudSecretsForTesting
+} from "@elizaos/shared";
+var init_cloud_secrets = () => {};
+init_cloud_secrets();
+
+export {
+  scrubCloudSecretsFromEnv,
+  getCloudSecret,
+  clearCloudSecrets,
+  _resetCloudSecretsForTesting
+};
+
+//# debugId=099592669B1CE26764756E2164756E21

package/dist/lib/cloud-secrets.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/cloud-secrets.ts"],
+  "sourcesContent": [
+    "/**\n * Sealed in-process secret store for cloud credentials.\n *\n * The implementation moved to `@elizaos/shared/elizacloud/cloud-secrets` so\n * app-core and other host-layer packages can read sealed cloud secrets without\n * reverse-importing this plugin. This module remains for backwards\n * compatibility with plugin-internal callers.\n */\nexport {\n  clearCloudSecrets,\n  getCloudSecret,\n  scrubCloudSecretsFromEnv,\n  _resetCloudSecretsForTesting,\n} from \"@elizaos/shared\";\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAQA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "debugId": "099592669B1CE26764756E2164756E21",
+  "names": []
+}

package/dist/lib/config-env.d.ts

@@ -0,0 +1,5 @@
+export interface PersistConfigEnvOptions {
+    stateDir?: string;
+}
+export declare function persistConfigEnv(key: string, value: string, opts?: PersistConfigEnvOptions): Promise<void>;
+//# sourceMappingURL=config-env.d.ts.map

package/dist/lib/config-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-env.d.ts","sourceRoot":"","sources":["../../src/lib/config-env.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAuFD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,IAAI,CAAC,CAyCf"}

package/dist/lib/config-env.js

@@ -0,0 +1,191 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/lib/state-paths.ts
+import fs from "node:fs";
+import path from "node:path";
+import {
+  getElizaNamespace,
+  resolveStateDir,
+  resolveUserPath
+} from "@elizaos/core";
+function resolveConfigPath(env = process.env, stateDirPath = resolveStateDir(env)) {
+  const override = env.ELIZA_CONFIG_PATH?.trim();
+  if (override)
+    return resolveUserPath(override);
+  const namespace = getElizaNamespace(env);
+  const primaryPath = path.join(stateDirPath, `${namespace}.json`);
+  if (fs.existsSync(primaryPath))
+    return primaryPath;
+  if (namespace !== "eliza") {
+    const legacyPath = path.join(stateDirPath, "eliza.json");
+    if (fs.existsSync(legacyPath))
+      return legacyPath;
+  }
+  return primaryPath;
+}
+var init_state_paths = () => {};
+
+// src/lib/config-env.ts
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+function parseConfigEnv(contents) {
+  const lines = contents.length === 0 ? [] : contents.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  const index = new Map;
+  for (let i = 0;i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0)
+      continue;
+    const key = line.slice(0, eq).trim();
+    if (KEY_PATTERN.test(key))
+      index.set(key, i);
+  }
+  return { lines, index };
+}
+function serialiseConfigEnv(parsed) {
+  return parsed.lines.length === 0 ? "" : `${parsed.lines.join(`
+`)}
+`;
+}
+function encodeValue(value) {
+  if (value === "")
+    return "";
+  const needsQuoting = /[\s#"'\\]|^\s|\s$/.test(value) || /\n|\r/.test(value);
+  if (!needsQuoting)
+    return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `"${escaped}"`;
+}
+function validateKey(key) {
+  if (!KEY_PATTERN.test(key)) {
+    throw new Error(`persistConfigEnv: invalid key "${key}" - must match /^[A-Z][A-Z0-9_]*$/`);
+  }
+  if (BLOCKED_CONFIG_ENV_KEYS.has(key)) {
+    throw new Error(`persistConfigEnv: key "${key}" is a shell/runtime hijack vector and cannot be written`);
+  }
+}
+async function readIfExists(filePath) {
+  try {
+    return await fs2.readFile(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
+async function writeAtomic(filePath, contents) {
+  const tmpPath = `${filePath}${TMP_SUFFIX}`;
+  const handle = await fs2.open(tmpPath, "w", 384);
+  try {
+    await handle.writeFile(contents, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await fs2.rename(tmpPath, filePath);
+}
+function serialise(fn) {
+  const next = writeChain.then(fn, fn);
+  writeChain = next.catch(() => {
+    return;
+  });
+  return next;
+}
+function resolveConfigEnvPath(stateDir) {
+  return path2.join(stateDir ?? resolveStateDir(), CONFIG_ENV_FILENAME);
+}
+async function persistConfigEnv(key, value, opts = {}) {
+  validateKey(key);
+  await serialise(async () => {
+    const filePath = resolveConfigEnvPath(opts.stateDir);
+    await fs2.mkdir(path2.dirname(filePath), { recursive: true });
+    const existing = await readIfExists(filePath) ?? "";
+    const parsed = parseConfigEnv(existing);
+    const existingIdx = parsed.index.get(key);
+    const isDelete = value === "";
+    if (isDelete) {
+      if (existingIdx === undefined) {
+        delete process.env[key];
+        return;
+      }
+      parsed.lines.splice(existingIdx, 1);
+    } else {
+      const encoded = `${key}=${encodeValue(value)}`;
+      if (existingIdx === undefined) {
+        parsed.lines.push(encoded);
+      } else {
+        parsed.lines[existingIdx] = encoded;
+      }
+    }
+    if (existing.length > 0) {
+      await fs2.writeFile(`${filePath}${BAK_SUFFIX}`, existing, {
+        encoding: "utf8",
+        mode: 384
+      });
+    }
+    await writeAtomic(filePath, serialiseConfigEnv(parsed));
+    if (isDelete) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  });
+}
+var CONFIG_ENV_FILENAME = "config.env", BAK_SUFFIX = ".bak", TMP_SUFFIX = ".tmp", KEY_PATTERN, BLOCKED_CONFIG_ENV_KEYS, writeChain;
+var init_config_env = __esm(() => {
+  init_state_paths();
+  KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+  BLOCKED_CONFIG_ENV_KEYS = new Set([
+    "NODE_OPTIONS",
+    "NODE_EXTRA_CA_CERTS",
+    "NODE_TLS_REJECT_UNAUTHORIZED",
+    "NODE_PATH",
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "DYLD_INSERT_LIBRARIES",
+    "DYLD_LIBRARY_PATH",
+    "DYLD_FRAMEWORK_PATH",
+    "DYLD_FALLBACK_FRAMEWORK_PATH",
+    "DYLD_FALLBACK_LIBRARY_PATH",
+    "PATH",
+    "HOME",
+    "SHELL",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "ALL_PROXY",
+    "NO_PROXY",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "CURL_CA_BUNDLE"
+  ]);
+  writeChain = Promise.resolve();
+});
+init_config_env();
+
+export {
+  persistConfigEnv
+};
+
+//# debugId=1B185D85653B0B0864756E2164756E21

package/dist/lib/config-env.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/state-paths.ts", "../src/lib/config-env.ts"],
+  "sourcesContent": [
+    "import fs from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  getElizaNamespace,\n  resolveStateDir,\n  resolveUserPath,\n} from \"@elizaos/core\";\n\nexport { getElizaNamespace, resolveStateDir, resolveUserPath };\n\nexport function resolveConfigPath(\n  env: NodeJS.ProcessEnv = process.env,\n  stateDirPath: string = resolveStateDir(env),\n): string {\n  const override = env.ELIZA_CONFIG_PATH?.trim();\n  if (override) return resolveUserPath(override);\n\n  const namespace = getElizaNamespace(env);\n  const primaryPath = path.join(stateDirPath, `${namespace}.json`);\n  if (fs.existsSync(primaryPath)) return primaryPath;\n\n  if (namespace !== \"eliza\") {\n    const legacyPath = path.join(stateDirPath, \"eliza.json\");\n    if (fs.existsSync(legacyPath)) return legacyPath;\n  }\n\n  return primaryPath;\n}\n",
+    "import fs from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { resolveStateDir } from \"./state-paths\";\n\nconst CONFIG_ENV_FILENAME = \"config.env\";\nconst BAK_SUFFIX = \".bak\";\nconst TMP_SUFFIX = \".tmp\";\nconst KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/;\n\nconst BLOCKED_CONFIG_ENV_KEYS: ReadonlySet<string> = new Set([\n  \"NODE_OPTIONS\",\n  \"NODE_EXTRA_CA_CERTS\",\n  \"NODE_TLS_REJECT_UNAUTHORIZED\",\n  \"NODE_PATH\",\n  \"LD_PRELOAD\",\n  \"LD_LIBRARY_PATH\",\n  \"DYLD_INSERT_LIBRARIES\",\n  \"DYLD_LIBRARY_PATH\",\n  \"DYLD_FRAMEWORK_PATH\",\n  \"DYLD_FALLBACK_FRAMEWORK_PATH\",\n  \"DYLD_FALLBACK_LIBRARY_PATH\",\n  \"PATH\",\n  \"HOME\",\n  \"SHELL\",\n  \"HTTP_PROXY\",\n  \"HTTPS_PROXY\",\n  \"ALL_PROXY\",\n  \"NO_PROXY\",\n  \"SSL_CERT_FILE\",\n  \"SSL_CERT_DIR\",\n  \"CURL_CA_BUNDLE\",\n]);\n\nexport interface PersistConfigEnvOptions {\n  stateDir?: string;\n}\n\ninterface ParsedConfigEnv {\n  lines: string[];\n  index: Map<string, number>;\n}\n\nfunction parseConfigEnv(contents: string): ParsedConfigEnv {\n  const lines = contents.length === 0 ? [] : contents.split(/\\r?\\n/);\n  if (lines.length > 0 && lines[lines.length - 1] === \"\") {\n    lines.pop();\n  }\n  const index = new Map<string, number>();\n  for (let i = 0; i < lines.length; i += 1) {\n    const line = lines[i] ?? \"\";\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    const eq = line.indexOf(\"=\");\n    if (eq <= 0) continue;\n    const key = line.slice(0, eq).trim();\n    if (KEY_PATTERN.test(key)) index.set(key, i);\n  }\n  return { lines, index };\n}\n\nfunction serialiseConfigEnv(parsed: ParsedConfigEnv): string {\n  return parsed.lines.length === 0 ? \"\" : `${parsed.lines.join(\"\\n\")}\\n`;\n}\n\nfunction encodeValue(value: string): string {\n  if (value === \"\") return \"\";\n  const needsQuoting = /[\\s#\"'\\\\]|^\\s|\\s$/.test(value) || /\\n|\\r/.test(value);\n  if (!needsQuoting) return value;\n  const escaped = value\n    .replace(/\\\\/g, \"\\\\\\\\\")\n    .replace(/\"/g, '\\\\\"')\n    .replace(/\\n/g, \"\\\\n\")\n    .replace(/\\r/g, \"\\\\r\");\n  return `\"${escaped}\"`;\n}\n\nfunction validateKey(key: string): void {\n  if (!KEY_PATTERN.test(key)) {\n    throw new Error(\n      `persistConfigEnv: invalid key \"${key}\" - must match /^[A-Z][A-Z0-9_]*$/`,\n    );\n  }\n  if (BLOCKED_CONFIG_ENV_KEYS.has(key)) {\n    throw new Error(\n      `persistConfigEnv: key \"${key}\" is a shell/runtime hijack vector and cannot be written`,\n    );\n  }\n}\n\nasync function readIfExists(filePath: string): Promise<string | null> {\n  try {\n    return await fs.readFile(filePath, \"utf8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw error;\n  }\n}\n\nasync function writeAtomic(filePath: string, contents: string): Promise<void> {\n  const tmpPath = `${filePath}${TMP_SUFFIX}`;\n  const handle = await fs.open(tmpPath, \"w\", 0o600);\n  try {\n    await handle.writeFile(contents, \"utf8\");\n    await handle.sync();\n  } finally {\n    await handle.close();\n  }\n  await fs.rename(tmpPath, filePath);\n}\n\nlet writeChain: Promise<unknown> = Promise.resolve();\n\nfunction serialise<T>(fn: () => Promise<T>): Promise<T> {\n  const next = writeChain.then(fn, fn);\n  writeChain = next.catch(() => undefined);\n  return next;\n}\n\nfunction resolveConfigEnvPath(stateDir?: string): string {\n  return path.join(stateDir ?? resolveStateDir(), CONFIG_ENV_FILENAME);\n}\n\nexport async function persistConfigEnv(\n  key: string,\n  value: string,\n  opts: PersistConfigEnvOptions = {},\n): Promise<void> {\n  validateKey(key);\n\n  await serialise(async () => {\n    const filePath = resolveConfigEnvPath(opts.stateDir);\n    await fs.mkdir(path.dirname(filePath), { recursive: true });\n\n    const existing = (await readIfExists(filePath)) ?? \"\";\n    const parsed = parseConfigEnv(existing);\n    const existingIdx = parsed.index.get(key);\n    const isDelete = value === \"\";\n\n    if (isDelete) {\n      if (existingIdx === undefined) {\n        delete process.env[key];\n        return;\n      }\n      parsed.lines.splice(existingIdx, 1);\n    } else {\n      const encoded = `${key}=${encodeValue(value)}`;\n      if (existingIdx === undefined) {\n        parsed.lines.push(encoded);\n      } else {\n        parsed.lines[existingIdx] = encoded;\n      }\n    }\n\n    if (existing.length > 0) {\n      await fs.writeFile(`${filePath}${BAK_SUFFIX}`, existing, {\n        encoding: \"utf8\",\n        mode: 0o600,\n      });\n    }\n\n    await writeAtomic(filePath, serialiseConfigEnv(parsed));\n    if (isDelete) {\n      delete process.env[key];\n    } else {\n      process.env[key] = value;\n    }\n  });\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAAA;AAAA;AAAA;AAAA;AAQO,SAAS,iBAAiB,CAC/B,MAAyB,QAAQ,KACjC,eAAuB,gBAAgB,GAAG,GAClC;AAAA,EACR,MAAM,WAAW,IAAI,mBAAmB,KAAK;AAAA,EAC7C,IAAI;AAAA,IAAU,OAAO,gBAAgB,QAAQ;AAAA,EAE7C,MAAM,YAAY,kBAAkB,GAAG;AAAA,EACvC,MAAM,cAAc,KAAK,KAAK,cAAc,GAAG,gBAAgB;AAAA,EAC/D,IAAI,GAAG,WAAW,WAAW;AAAA,IAAG,OAAO;AAAA,EAEvC,IAAI,cAAc,SAAS;AAAA,IACzB,MAAM,aAAa,KAAK,KAAK,cAAc,YAAY;AAAA,IACvD,IAAI,GAAG,WAAW,UAAU;AAAA,MAAG,OAAO;AAAA,EACxC;AAAA,EAEA,OAAO;AAAA;AAAA;;;AC1BT;AACA;AAyCA,SAAS,cAAc,CAAC,UAAmC;AAAA,EACzD,MAAM,QAAQ,SAAS,WAAW,IAAI,CAAC,IAAI,SAAS,MAAM,OAAO;AAAA,EACjE,IAAI,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,OAAO,IAAI;AAAA,IACtD,MAAM,IAAI;AAAA,EACZ;AAAA,EACA,MAAM,QAAQ,IAAI;AAAA,EAClB,SAAS,IAAI,EAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxC,MAAM,OAAO,MAAM,MAAM;AAAA,IACzB,MAAM,UAAU,KAAK,KAAK;AAAA,IAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG;AAAA,MAAG;AAAA,IACzC,MAAM,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC3B,IAAI,MAAM;AAAA,MAAG;AAAA,IACb,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,IACnC,IAAI,YAAY,KAAK,GAAG;AAAA,MAAG,MAAM,IAAI,KAAK,CAAC;AAAA,EAC7C;AAAA,EACA,OAAO,EAAE,OAAO,MAAM;AAAA;AAGxB,SAAS,kBAAkB,CAAC,QAAiC;AAAA,EAC3D,OAAO,OAAO,MAAM,WAAW,IAAI,KAAK,GAAG,OAAO,MAAM,KAAK;AAAA,CAAI;AAAA;AAAA;AAGnE,SAAS,WAAW,CAAC,OAAuB;AAAA,EAC1C,IAAI,UAAU;AAAA,IAAI,OAAO;AAAA,EACzB,MAAM,eAAe,oBAAoB,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK;AAAA,EAC1E,IAAI,CAAC;AAAA,IAAc,OAAO;AAAA,EAC1B,MAAM,UAAU,MACb,QAAQ,OAAO,MAAM,EACrB,QAAQ,MAAM,MAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AAAA,EACvB,OAAO,IAAI;AAAA;AAGb,SAAS,WAAW,CAAC,KAAmB;AAAA,EACtC,IAAI,CAAC,YAAY,KAAK,GAAG,GAAG;AAAA,IAC1B,MAAM,IAAI,MACR,kCAAkC,uCACpC;AAAA,EACF;AAAA,EACA,IAAI,wBAAwB,IAAI,GAAG,GAAG;AAAA,IACpC,MAAM,IAAI,MACR,0BAA0B,6DAC5B;AAAA,EACF;AAAA;AAGF,eAAe,YAAY,CAAC,UAA0C;AAAA,EACpE,IAAI;AAAA,IACF,OAAO,MAAM,IAAG,SAAS,UAAU,MAAM;AAAA,IACzC,OAAO,OAAO;AAAA,IACd,IAAK,MAAgC,SAAS;AAAA,MAAU,OAAO;AAAA,IAC/D,MAAM;AAAA;AAAA;AAIV,eAAe,WAAW,CAAC,UAAkB,UAAiC;AAAA,EAC5E,MAAM,UAAU,GAAG,WAAW;AAAA,EAC9B,MAAM,SAAS,MAAM,IAAG,KAAK,SAAS,KAAK,GAAK;AAAA,EAChD,IAAI;AAAA,IACF,MAAM,OAAO,UAAU,UAAU,MAAM;AAAA,IACvC,MAAM,OAAO,KAAK;AAAA,YAClB;AAAA,IACA,MAAM,OAAO,MAAM;AAAA;AAAA,EAErB,MAAM,IAAG,OAAO,SAAS,QAAQ;AAAA;AAKnC,SAAS,SAAY,CAAC,IAAkC;AAAA,EACtD,MAAM,OAAO,WAAW,KAAK,IAAI,EAAE;AAAA,EACnC,aAAa,KAAK,MAAM,MAAG;AAAA,IAAG;AAAA,GAAS;AAAA,EACvC,OAAO;AAAA;AAGT,SAAS,oBAAoB,CAAC,UAA2B;AAAA,EACvD,OAAO,MAAK,KAAK,YAAY,gBAAgB,GAAG,mBAAmB;AAAA;AAGrE,eAAsB,gBAAgB,CACpC,KACA,OACA,OAAgC,CAAC,GAClB;AAAA,EACf,YAAY,GAAG;AAAA,EAEf,MAAM,UAAU,YAAY;AAAA,IAC1B,MAAM,WAAW,qBAAqB,KAAK,QAAQ;AAAA,IACnD,MAAM,IAAG,MAAM,MAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,IAE1D,MAAM,WAAY,MAAM,aAAa,QAAQ,KAAM;AAAA,IACnD,MAAM,SAAS,eAAe,QAAQ;AAAA,IACtC,MAAM,cAAc,OAAO,MAAM,IAAI,GAAG;AAAA,IACxC,MAAM,WAAW,UAAU;AAAA,IAE3B,IAAI,UAAU;AAAA,MACZ,IAAI,gBAAgB,WAAW;AAAA,QAC7B,OAAO,QAAQ,IAAI;AAAA,QACnB;AAAA,MACF;AAAA,MACA,OAAO,MAAM,OAAO,aAAa,CAAC;AAAA,IACpC,EAAO;AAAA,MACL,MAAM,UAAU,GAAG,OAAO,YAAY,KAAK;AAAA,MAC3C,IAAI,gBAAgB,WAAW;AAAA,QAC7B,OAAO,MAAM,KAAK,OAAO;AAAA,MAC3B,EAAO;AAAA,QACL,OAAO,MAAM,eAAe;AAAA;AAAA;AAAA,IAIhC,IAAI,SAAS,SAAS,GAAG;AAAA,MACvB,MAAM,IAAG,UAAU,GAAG,WAAW,cAAc,UAAU;AAAA,QACvD,UAAU;AAAA,QACV,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,YAAY,UAAU,mBAAmB,MAAM,CAAC;AAAA,IACtD,IAAI,UAAU;AAAA,MACZ,OAAO,QAAQ,IAAI;AAAA,IACrB,EAAO;AAAA,MACL,QAAQ,IAAI,OAAO;AAAA;AAAA,GAEtB;AAAA;AAAA,IAlKG,sBAAsB,cACtB,aAAa,QACb,aAAa,QACb,aAEA,yBAqGF;AAAA;AAAA,EA5GJ;AAAA,EAKM,cAAc;AAAA,EAEd,0BAA+C,IAAI,IAAI;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EA+EG,aAA+B,QAAQ,QAAQ;AAAA;",
+  "debugId": "1B185D85653B0B0864756E2164756E21",
+  "names": []
+}

package/dist/lib/config-like.d.ts

@@ -0,0 +1,40 @@
+import type { DeploymentTargetConfig, LinkedAccountFlagsConfig, ServiceCapability, ServiceRoutingConfig } from "@elizaos/core";
+export interface CloudProxyConfigLike {
+    cloud?: {
+        apiKey?: string;
+        baseUrl?: string;
+        enabled?: boolean;
+        serviceKey?: string;
+        backup?: {
+            autoBackupIntervalMs?: number;
+        };
+        bridge?: {
+            heartbeatIntervalMs?: number;
+        };
+    };
+}
+export type CloudConfig = NonNullable<CloudProxyConfigLike["cloud"]>;
+export type ElizaConfig = Record<string, unknown> & CloudProxyConfigLike & {
+    deploymentTarget?: DeploymentTargetConfig;
+    linkedAccounts?: LinkedAccountFlagsConfig;
+    serviceRouting?: ServiceRoutingConfig;
+};
+export interface AutonomousConfigLike {
+    [key: string]: unknown;
+}
+type MutableElizaConfig = Partial<ElizaConfig> & {
+    cloud?: Record<string, unknown>;
+    deploymentTarget?: DeploymentTargetConfig;
+    linkedAccounts?: LinkedAccountFlagsConfig;
+    serviceRouting?: ServiceRoutingConfig;
+};
+export declare function applyCanonicalSetupConfig(config: MutableElizaConfig, args: {
+    deploymentTarget?: DeploymentTargetConfig | null;
+    linkedAccounts?: LinkedAccountFlagsConfig | null;
+    serviceRouting?: ServiceRoutingConfig | null;
+    clearRoutes?: readonly ServiceCapability[];
+}): void;
+export declare function normalizeEnvValue(value: unknown): string | undefined;
+export declare function isTimeoutError(error: unknown): boolean;
+export {};
+//# sourceMappingURL=config-like.d.ts.map

package/dist/lib/config-like.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-like.d.ts","sourceRoot":"","sources":["../../src/lib/config-like.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE;YACP,oBAAoB,CAAC,EAAE,MAAM,CAAC;SAC/B,CAAC;QACF,MAAM,CAAC,EAAE;YACP,mBAAmB,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/C,oBAAoB,GAAG;IACrB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,CAAC;AAEJ,MAAM,WAAW,oBAAoB;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,KAAK,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,CAAC;AA6EF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE;IACJ,gBAAgB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC5C,GACA,IAAI,CAUN;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIpE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKtD"}

package/dist/lib/config-like.js

@@ -0,0 +1,103 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/lib/config-like.ts
+function ensureLinkedAccounts(config) {
+  config.linkedAccounts ??= {};
+  return config.linkedAccounts;
+}
+function ensureServiceRouting(config) {
+  config.serviceRouting ??= {};
+  return config.serviceRouting;
+}
+function persistDeploymentTarget(config, deploymentTarget) {
+  if (!deploymentTarget) {
+    delete config.deploymentTarget;
+    return;
+  }
+  config.deploymentTarget = { ...deploymentTarget };
+}
+function persistLinkedAccounts(config, linkedAccounts) {
+  if (!linkedAccounts)
+    return;
+  const existing = ensureLinkedAccounts(config);
+  for (const [accountId, account] of Object.entries(linkedAccounts)) {
+    if (!account || Object.keys(account).length === 0) {
+      delete existing[accountId];
+      continue;
+    }
+    existing[accountId] = {
+      ...existing[accountId],
+      ...account
+    };
+  }
+  if (Object.keys(existing).length === 0) {
+    delete config.linkedAccounts;
+  }
+}
+function persistServiceRouting(config, serviceRouting, clearRoutes = []) {
+  const existing = ensureServiceRouting(config);
+  for (const capability of clearRoutes) {
+    delete existing[capability];
+  }
+  if (serviceRouting) {
+    for (const [capability, route] of Object.entries(serviceRouting)) {
+      const serviceKey = capability;
+      if (!route || Object.keys(route).length === 0) {
+        delete existing[serviceKey];
+        continue;
+      }
+      existing[serviceKey] = { ...route };
+    }
+  }
+  if (Object.keys(existing).length === 0) {
+    delete config.serviceRouting;
+  }
+}
+function applyCanonicalSetupConfig(config, args) {
+  if (args.deploymentTarget !== undefined) {
+    persistDeploymentTarget(config, args.deploymentTarget);
+  }
+  if (args.linkedAccounts !== undefined) {
+    persistLinkedAccounts(config, args.linkedAccounts);
+  }
+  if (args.serviceRouting !== undefined || args.clearRoutes?.length) {
+    persistServiceRouting(config, args.serviceRouting, args.clearRoutes);
+  }
+}
+function normalizeEnvValue(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+function isTimeoutError(error) {
+  if (!(error instanceof Error))
+    return false;
+  if (error.name === "TimeoutError" || error.name === "AbortError")
+    return true;
+  const message = error.message.toLowerCase();
+  return message.includes("timed out") || message.includes("timeout");
+}
+export {
+  normalizeEnvValue,
+  isTimeoutError,
+  applyCanonicalSetupConfig
+};
+
+//# debugId=DC75593A0040E29E64756E2164756E21

package/dist/lib/config-like.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/config-like.ts"],
+  "sourcesContent": [
+    "import type {\n  DeploymentTargetConfig,\n  LinkedAccountFlagsConfig,\n  ServiceCapability,\n  ServiceRoutingConfig,\n} from \"@elizaos/core\";\n\nexport interface CloudProxyConfigLike {\n  cloud?: {\n    apiKey?: string;\n    baseUrl?: string;\n    enabled?: boolean;\n    serviceKey?: string;\n    backup?: {\n      autoBackupIntervalMs?: number;\n    };\n    bridge?: {\n      heartbeatIntervalMs?: number;\n    };\n  };\n}\n\nexport type CloudConfig = NonNullable<CloudProxyConfigLike[\"cloud\"]>;\n\nexport type ElizaConfig = Record<string, unknown> &\n  CloudProxyConfigLike & {\n    deploymentTarget?: DeploymentTargetConfig;\n    linkedAccounts?: LinkedAccountFlagsConfig;\n    serviceRouting?: ServiceRoutingConfig;\n  };\n\nexport interface AutonomousConfigLike {\n  [key: string]: unknown;\n}\n\ntype MutableElizaConfig = Partial<ElizaConfig> & {\n  cloud?: Record<string, unknown>;\n  deploymentTarget?: DeploymentTargetConfig;\n  linkedAccounts?: LinkedAccountFlagsConfig;\n  serviceRouting?: ServiceRoutingConfig;\n};\n\nfunction ensureLinkedAccounts(\n  config: MutableElizaConfig,\n): LinkedAccountFlagsConfig {\n  config.linkedAccounts ??= {};\n  return config.linkedAccounts;\n}\n\nfunction ensureServiceRouting(\n  config: MutableElizaConfig,\n): ServiceRoutingConfig {\n  config.serviceRouting ??= {};\n  return config.serviceRouting;\n}\n\nfunction persistDeploymentTarget(\n  config: MutableElizaConfig,\n  deploymentTarget: DeploymentTargetConfig | null | undefined,\n): void {\n  if (!deploymentTarget) {\n    delete config.deploymentTarget;\n    return;\n  }\n  config.deploymentTarget = { ...deploymentTarget };\n}\n\nfunction persistLinkedAccounts(\n  config: MutableElizaConfig,\n  linkedAccounts: LinkedAccountFlagsConfig | null | undefined,\n): void {\n  if (!linkedAccounts) return;\n\n  const existing = ensureLinkedAccounts(config);\n  for (const [accountId, account] of Object.entries(linkedAccounts)) {\n    if (!account || Object.keys(account).length === 0) {\n      delete existing[accountId];\n      continue;\n    }\n    existing[accountId] = {\n      ...existing[accountId],\n      ...account,\n    };\n  }\n\n  if (Object.keys(existing).length === 0) {\n    delete config.linkedAccounts;\n  }\n}\n\nfunction persistServiceRouting(\n  config: MutableElizaConfig,\n  serviceRouting: ServiceRoutingConfig | null | undefined,\n  clearRoutes: readonly ServiceCapability[] = [],\n): void {\n  const existing = ensureServiceRouting(config);\n\n  for (const capability of clearRoutes) {\n    delete existing[capability];\n  }\n\n  if (serviceRouting) {\n    for (const [capability, route] of Object.entries(serviceRouting)) {\n      const serviceKey = capability as ServiceCapability;\n      if (!route || Object.keys(route).length === 0) {\n        delete existing[serviceKey];\n        continue;\n      }\n      existing[serviceKey] = { ...route };\n    }\n  }\n\n  if (Object.keys(existing).length === 0) {\n    delete config.serviceRouting;\n  }\n}\n\nexport function applyCanonicalSetupConfig(\n  config: MutableElizaConfig,\n  args: {\n    deploymentTarget?: DeploymentTargetConfig | null;\n    linkedAccounts?: LinkedAccountFlagsConfig | null;\n    serviceRouting?: ServiceRoutingConfig | null;\n    clearRoutes?: readonly ServiceCapability[];\n  },\n): void {\n  if (args.deploymentTarget !== undefined) {\n    persistDeploymentTarget(config, args.deploymentTarget);\n  }\n  if (args.linkedAccounts !== undefined) {\n    persistLinkedAccounts(config, args.linkedAccounts);\n  }\n  if (args.serviceRouting !== undefined || args.clearRoutes?.length) {\n    persistServiceRouting(config, args.serviceRouting, args.clearRoutes);\n  }\n}\n\nexport function normalizeEnvValue(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nexport function isTimeoutError(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  if (error.name === \"TimeoutError\" || error.name === \"AbortError\") return true;\n  const message = error.message.toLowerCase();\n  return message.includes(\"timed out\") || message.includes(\"timeout\");\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AA0CA,SAAS,oBAAoB,CAC3B,QAC0B;AAAA,EAC1B,OAAO,mBAAmB,CAAC;AAAA,EAC3B,OAAO,OAAO;AAAA;AAGhB,SAAS,oBAAoB,CAC3B,QACsB;AAAA,EACtB,OAAO,mBAAmB,CAAC;AAAA,EAC3B,OAAO,OAAO;AAAA;AAGhB,SAAS,uBAAuB,CAC9B,QACA,kBACM;AAAA,EACN,IAAI,CAAC,kBAAkB;AAAA,IACrB,OAAO,OAAO;AAAA,IACd;AAAA,EACF;AAAA,EACA,OAAO,mBAAmB,KAAK,iBAAiB;AAAA;AAGlD,SAAS,qBAAqB,CAC5B,QACA,gBACM;AAAA,EACN,IAAI,CAAC;AAAA,IAAgB;AAAA,EAErB,MAAM,WAAW,qBAAqB,MAAM;AAAA,EAC5C,YAAY,WAAW,YAAY,OAAO,QAAQ,cAAc,GAAG;AAAA,IACjE,IAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AAAA,MACjD,OAAO,SAAS;AAAA,MAChB;AAAA,IACF;AAAA,IACA,SAAS,aAAa;AAAA,SACjB,SAAS;AAAA,SACT;AAAA,IACL;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AAAA,IACtC,OAAO,OAAO;AAAA,EAChB;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,gBACA,cAA4C,CAAC,GACvC;AAAA,EACN,MAAM,WAAW,qBAAqB,MAAM;AAAA,EAE5C,WAAW,cAAc,aAAa;AAAA,IACpC,OAAO,SAAS;AAAA,EAClB;AAAA,EAEA,IAAI,gBAAgB;AAAA,IAClB,YAAY,YAAY,UAAU,OAAO,QAAQ,cAAc,GAAG;AAAA,MAChE,MAAM,aAAa;AAAA,MACnB,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AAAA,QAC7C,OAAO,SAAS;AAAA,QAChB;AAAA,MACF;AAAA,MACA,SAAS,cAAc,KAAK,MAAM;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AAAA,IACtC,OAAO,OAAO;AAAA,EAChB;AAAA;AAGK,SAAS,yBAAyB,CACvC,QACA,MAMM;AAAA,EACN,IAAI,KAAK,qBAAqB,WAAW;AAAA,IACvC,wBAAwB,QAAQ,KAAK,gBAAgB;AAAA,EACvD;AAAA,EACA,IAAI,KAAK,mBAAmB,WAAW;AAAA,IACrC,sBAAsB,QAAQ,KAAK,cAAc;AAAA,EACnD;AAAA,EACA,IAAI,KAAK,mBAAmB,aAAa,KAAK,aAAa,QAAQ;AAAA,IACjE,sBAAsB,QAAQ,KAAK,gBAAgB,KAAK,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,iBAAiB,CAAC,OAAoC;AAAA,EACpE,IAAI,OAAO,UAAU;AAAA,IAAU;AAAA,EAC/B,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,OAAO,WAAW;AAAA;AAGb,SAAS,cAAc,CAAC,OAAyB;AAAA,EACtD,IAAI,EAAE,iBAAiB;AAAA,IAAQ,OAAO;AAAA,EACtC,IAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS;AAAA,IAAc,OAAO;AAAA,EACzE,MAAM,UAAU,MAAM,QAAQ,YAAY;AAAA,EAC1C,OAAO,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,SAAS;AAAA;",
+  "debugId": "DC75593A0040E29E64756E2164756E21",
+  "names": []
+}

package/dist/lib/credential-type-map.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Mapping from workflow-plugin credential type names → Eliza Cloud connector slugs.
+ *
+ * The workflow plugin's LLM emits credential type strings (e.g. `gmailOAuth2`,
+ * `slackOAuth2Api`) on each node that needs an external account. The cloud
+ * exposes per-connector OAuth flows under `/api/v1/eliza/<connector>/...`.
+ *
+ * This map is the single source of truth for which workflow credential type
+ * resolves through which cloud connector + with which OAuth scopes. Add new
+ * entries when the cloud gains support for additional connectors; do not
+ * scatter cred-type → connector logic elsewhere.
+ *
+ * Cloud-side endpoint convention (see packages/cloud-api/v1/eliza/<connector>/):
+ *   POST /api/v1/eliza/<connector>/connect/initiate     → { authUrl }
+ *   GET  /api/v1/eliza/<connector>/status               → { connected, ... }
+ *
+ * Not every connector below has a fully-implemented cloud endpoint yet — the
+ * provider returns `null` for unmapped types and `needs_auth` (with the
+ * cloud-issued OAuth URL) for mapped-but-not-connected accounts. See
+ * `cloud-credential-provider.ts` for the resolution logic.
+ */
+export interface CredentialTypeMapping {
+    /**
+     * Cloud connector slug used in the URL path
+     * (`/api/v1/eliza/<connector>/connect/initiate`).
+     */
+    connector: string;
+    /**
+     * Optional capability tokens passed to the cloud's `connect/initiate`
+     * endpoint. The cloud translates these to provider-specific OAuth scopes
+     * (e.g. Google's `google.gmail.send` → `https://www.googleapis.com/auth/gmail.send`).
+     */
+    capabilities?: string[];
+    /**
+     * Friendly description used in `needs_auth` UI prompts. The runtime may
+     * surface this verbatim to the end-user.
+     */
+    friendlyName: string;
+}
+/**
+ * Workflow credential type → cloud connector mapping.
+ *
+ * Names mirror the n8n / workflows-plugin convention used by the LLM in
+ * `plugins/plugin-workflow/src/utils/workflow-prompts/workflowGeneration.ts`.
+ * Both `gmailOAuth2` and `gmailOAuth2Api` map to the same connector — the
+ * workflow resolver does fuzzy `Api`-suffix matching upstream, but we keep
+ * both keys here so `checkCredentialTypes` answers truthfully without the
+ * caller having to know about that fuzziness.
+ */
+export declare const credTypeToConnector: ReadonlyMap<string, CredentialTypeMapping>;
+/** Set used by `checkCredentialTypes` for O(1) supported-set membership. */
+export declare const supportedCredTypes: ReadonlySet<string>;
+//# sourceMappingURL=credential-type-map.d.ts.map

package/dist/lib/credential-type-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-type-map.d.ts","sourceRoot":"","sources":["../../src/lib/credential-type-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CA2EzE,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC"}