@elizaos/plugin-elizacloud 2.0.0-alpha.8 → 2.0.11-beta.7

package/dist/services/cloud-auth.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/types/cloud.ts", "../src/utils/cloud-api.ts", "../src/services/cloud-auth.ts"],
+  "sourcesContent": [
+    "/**\n * Cloud-specific types for ElizaCloud integration.\n *\n * These types mirror the eliza-cloud-v2 database schemas and API contracts\n * for containers, auth, credits, bridge messaging, and agent state snapshots.\n */\n\nexport type {\n  CloudCodingAgent,\n  CloudCodingContainerSession,\n  CloudCodingContainerStatus,\n  CloudCodingPatch,\n  CloudCodingPatchFormat,\n  CloudCodingPromotion,\n  CloudCodingSyncDirection,\n  CloudCodingSyncResult,\n  CloudVfsBundle,\n  CloudVfsDeletedFile,\n  CloudVfsFile,\n  CloudVfsFileEncoding,\n  CloudVfsSourceKind,\n  PromoteVfsToCloudContainerRequest,\n  PromoteVfsToCloudContainerResponse,\n  RequestCodingAgentContainerRequest,\n  RequestCodingAgentContainerResponse,\n  SyncCloudCodingContainerRequest,\n  SyncCloudCodingContainerResponse,\n} from \"@elizaos/shared\";\n\n// ─── Container Types ────────────────────────────────────────────────────────\n\nexport type ContainerStatus =\n  | \"pending\"\n  | \"building\"\n  | \"deploying\"\n  | \"running\"\n  | \"stopped\"\n  | \"failed\"\n  | \"suspended\";\n\nexport type ContainerBillingStatus =\n  | \"active\"\n  | \"warning\"\n  | \"suspended\"\n  | \"shutdown_pending\"\n  | \"archived\";\n\nexport type ContainerArchitecture = \"arm64\" | \"x86_64\";\n\nexport interface CloudContainer {\n  id: string;\n  name: string;\n  project_name: string;\n  description: string | null;\n  organization_id: string;\n  user_id: string;\n  status: ContainerStatus;\n  image_tag: string | null;\n  port: number;\n  desired_count: number;\n  cpu: number;\n  memory: number;\n  architecture: ContainerArchitecture;\n  environment_vars: Record<string, string>;\n  health_check_path: string;\n  load_balancer_url: string | null;\n  ecr_repository_uri: string | null;\n  ecr_image_tag: string | null;\n  cloudformation_stack_name: string | null;\n  billing_status: ContainerBillingStatus;\n  total_billed: string;\n  last_deployed_at: string | null;\n  last_health_check: string | null;\n  deployment_log: string | null;\n  error_message: string | null;\n  metadata: Record<string, unknown>;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface CreateContainerRequest {\n  name: string;\n  project_name: string;\n  description?: string;\n  port?: number;\n  desired_count?: number;\n  cpu?: number;\n  memory?: number;\n  environment_vars?: Record<string, string>;\n  health_check_path?: string;\n  ecr_image_uri: string;\n  ecr_repository_uri?: string;\n  image_tag?: string;\n  architecture?: ContainerArchitecture;\n}\n\nexport interface CreateContainerResponse {\n  success: boolean;\n  data: CloudContainer;\n  message: string;\n  creditsDeducted: number;\n  creditsRemaining: number;\n  stackName: string;\n  polling: {\n    endpoint: string;\n    intervalMs: number;\n    expectedDurationMs: number;\n  };\n}\n\nexport interface ContainerListResponse {\n  success: boolean;\n  data: CloudContainer[];\n}\n\nexport interface ContainerGetResponse {\n  success: boolean;\n  data: CloudContainer;\n}\n\nexport interface ContainerDeleteResponse {\n  success: boolean;\n  message?: string;\n}\n\nexport interface ContainerHealthResponse {\n  success: boolean;\n  data: {\n    status: string;\n    healthy: boolean;\n    lastCheck: string | null;\n    uptime: number | null;\n  };\n}\n\n// ─── Auth Types ─────────────────────────────────────────────────────────────\n\nexport type DevicePlatform = \"ios\" | \"android\" | \"macos\" | \"windows\" | \"linux\" | \"web\";\n\nexport interface DeviceAuthRequest {\n  deviceId: string;\n  platform: DevicePlatform;\n  appVersion: string;\n  deviceName?: string;\n}\n\nexport interface DeviceAuthResponse {\n  success: boolean;\n  data: {\n    apiKey: string;\n    userId: string;\n    organizationId: string;\n    credits: number;\n    isNew: boolean;\n  };\n}\n\nexport interface CloudCredentials {\n  apiKey: string;\n  userId: string;\n  organizationId: string;\n  authenticatedAt: number;\n}\n\n// ─── Credits Types ──────────────────────────────────────────────────────────\n\nexport interface CreditBalanceResponse {\n  success: boolean;\n  data: {\n    balance: number;\n    currency: string;\n  };\n}\n\nexport interface CreditSummaryResponse {\n  success: boolean;\n  data: {\n    balance: number;\n    totalSpent: number;\n    totalAdded: number;\n    recentTransactions: CreditTransaction[];\n  };\n}\n\nexport interface CreditTransaction {\n  id: string;\n  amount: number;\n  description: string;\n  type: \"credit\" | \"debit\";\n  created_at: string;\n}\n\n// ─── Bridge Types ───────────────────────────────────────────────────────────\n\nexport type BridgeConnectionState = \"disconnected\" | \"connecting\" | \"connected\" | \"reconnecting\";\n\nexport interface BridgeMessage {\n  jsonrpc: \"2.0\";\n  id?: string | number;\n  method?: string;\n  params?: Record<string, unknown>;\n  result?: unknown;\n  error?: BridgeError;\n}\n\nexport interface BridgeError {\n  code: number;\n  message: string;\n  data?: unknown;\n}\n\nexport type BridgeMessageHandler = (message: BridgeMessage) => void;\n\nexport interface BridgeConnection {\n  containerId: string;\n  state: BridgeConnectionState;\n  connectedAt: number | null;\n  lastHeartbeat: number | null;\n  reconnectAttempts: number;\n}\n\n// ─── Managed Gateway Relay Types ───────────────────────────────────────────\n\nexport interface GatewayRelaySession {\n  id: string;\n  organizationId: string;\n  userId: string;\n  runtimeAgentId: string;\n  agentName: string | null;\n  platform: \"local-runtime\";\n  createdAt: string;\n  lastSeenAt: string;\n}\n\nexport interface GatewayRelayRequest {\n  jsonrpc: \"2.0\";\n  id?: string | number;\n  method: string;\n  params?: Record<string, unknown>;\n}\n\nexport interface GatewayRelayResponse {\n  jsonrpc: \"2.0\";\n  id?: string | number;\n  result?: Record<string, unknown>;\n  error?: BridgeError;\n}\n\nexport interface GatewayRelayRequestEnvelope {\n  requestId: string;\n  rpc: GatewayRelayRequest;\n  queuedAt: string;\n}\n\nexport interface RegisterGatewayRelaySessionResponse {\n  success: boolean;\n  data: {\n    session: GatewayRelaySession;\n  };\n}\n\nexport interface PollGatewayRelayResponse {\n  success: boolean;\n  data: {\n    request: GatewayRelayRequestEnvelope | null;\n  };\n}\n\n// ─── Snapshot / Backup Types ────────────────────────────────────────────────\n\nexport type SnapshotType = \"manual\" | \"auto\" | \"pre-eviction\";\n\nexport interface AgentSnapshot {\n  id: string;\n  containerId: string;\n  organizationId: string;\n  snapshotType: SnapshotType;\n  storageUrl: string;\n  sizeBytes: number;\n  agentConfig: Record<string, unknown>;\n  metadata: Record<string, unknown>;\n  created_at: string;\n}\n\nexport interface CreateSnapshotRequest {\n  snapshotType?: SnapshotType;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface CreateSnapshotResponse {\n  success: boolean;\n  data: AgentSnapshot;\n}\n\nexport interface SnapshotListResponse {\n  success: boolean;\n  data: AgentSnapshot[];\n}\n\nexport interface RestoreSnapshotRequest {\n  snapshotId: string;\n}\n\nexport interface RestoreSnapshotResponse {\n  success: boolean;\n  message: string;\n}\n\n// ─── Cloud Config Types ─────────────────────────────────────────────────────\n\nexport type InferenceMode = \"cloud\" | \"byok\" | \"local\";\n\nexport interface CloudPluginConfig {\n  /** Enable ElizaCloud integration. */\n  enabled: boolean;\n  /** ElizaCloud API base URL. */\n  baseUrl: string;\n  /** Stored API key for authenticated requests. */\n  apiKey?: string;\n  /** Device ID used for auto-signup authentication. */\n  deviceId?: string;\n  /** Platform identifier. */\n  platform?: DevicePlatform;\n  /** Inference mode: cloud (ElizaCloud proxied), byok (user keys), local (no cloud). */\n  inferenceMode: InferenceMode;\n  /** Auto-deploy agents to cloud on creation. */\n  autoProvision: boolean;\n  /** Bridge reconnection settings. */\n  bridge: {\n    reconnectIntervalMs: number;\n    maxReconnectAttempts: number;\n    heartbeatIntervalMs: number;\n  };\n  /** Auto-backup settings. */\n  backup: {\n    autoBackupIntervalMs: number;\n    maxSnapshots: number;\n  };\n  /** Default container settings for new deployments. */\n  container: {\n    defaultImage: string;\n    defaultArchitecture: ContainerArchitecture;\n    defaultCpu: number;\n    defaultMemory: number;\n    defaultPort: number;\n  };\n}\n\nexport const DEFAULT_CLOUD_CONFIG: CloudPluginConfig = {\n  enabled: false,\n  baseUrl: \"https://www.elizacloud.ai/api/v1\",\n  inferenceMode: \"cloud\",\n  autoProvision: false,\n  bridge: {\n    reconnectIntervalMs: 3000,\n    maxReconnectAttempts: 20,\n    heartbeatIntervalMs: 30_000,\n  },\n  backup: {\n    autoBackupIntervalMs: 3_600_000, // 1 hour\n    maxSnapshots: 10,\n  },\n  container: {\n    defaultImage: \"elizaos/agent:latest\",\n    defaultArchitecture: \"arm64\",\n    defaultCpu: 1792,\n    defaultMemory: 1792,\n    defaultPort: 3000,\n  },\n};\n\n// ─── API Error Types ────────────────────────────────────────────────────────\n\nexport type { CloudApiErrorBody } from \"@elizaos/cloud-sdk\";\nexport {\n  CloudApiError,\n  InsufficientCreditsError,\n} from \"@elizaos/cloud-sdk\";\n",
+    "export type {\n  CloudApiErrorBody,\n  CloudRequestOptions,\n} from \"@elizaos/cloud-sdk\";\nexport {\n  CloudApiClient,\n  CloudApiError,\n  ElizaCloudHttpClient,\n  InsufficientCreditsError,\n} from \"@elizaos/cloud-sdk\";\n",
+    "/**\n * CloudAuthService — Eliza Cloud authentication entry points.\n *\n * Two distinct auth flows live here:\n *\n * 1. **Device auto-signup** (`authenticateWithDevice`) — convenience-only.\n *    Derives a hardware fingerprint and exchanges it for a free-tier API key\n *    against the cloud signup endpoint. The result is treated as opaque and\n *    is **never** trusted as inbound auth for the local Eliza dashboard.\n *    See `docs/security/remote-auth-hardening-plan.md` §7 for the explicit\n *    demotion rationale.\n *\n * 2. **Eliza Cloud SSO** (`getSsoRedirectUrl` / `exchangeCodeForSession`) —\n *    OAuth-style authorization-code flow against the cloud issuer. The\n *    callback handler in `app-core` (`api/auth/cloud-sso.ts`) consumes these\n *    methods to bind a verified cloud user to a local Identity. All error\n *    paths fail closed: the methods throw and the caller MUST refuse the\n *    request. There is no partial-claims fallback.\n */\n\nimport {\n  type RuntimeEnvRecord,\n  type IAgentRuntime,\n  logger,\n  Service,\n  resolveApiSecurityConfig,\n  resolveDesktopApiPort,\n} from \"@elizaos/core\";\nimport { isCloudReachable } from \"@elizaos/shared\";\nimport { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport type { CloudCredentials, DeviceAuthResponse, DevicePlatform } from \"../types/cloud\";\nimport { DEFAULT_CLOUD_CONFIG } from \"../types/cloud\";\nimport { CloudApiClient } from \"../utils/cloud-api\";\nimport type { CloudBootstrapService } from \"./cloud-bootstrap\";\n\n/** SHA-256 hash of hostname + platform + arch + cpu + memory. */\nasync function deriveDeviceId(): Promise<string> {\n  const os = await import(\"node:os\");\n  const crypto = await import(\"node:crypto\");\n  const cpus = os.cpus();\n  const raw = [\n    os.hostname(),\n    os.platform(),\n    os.arch(),\n    cpus[0]?.model ?? \"?\",\n    cpus.length,\n    os.totalmem(),\n  ].join(\":\");\n  return crypto.createHash(\"sha256\").update(raw).digest(\"hex\");\n}\n\nfunction detectPlatform(): DevicePlatform {\n  if (typeof process === \"undefined\") return \"web\";\n  const map: Record<string, DevicePlatform> = {\n    darwin: \"macos\",\n    win32: \"windows\",\n    linux: \"linux\",\n  };\n  return map[process.platform] ?? \"linux\";\n}\n\n// ─── Eliza Cloud SSO ───────────────────────────────────────────────────────\n\n/**\n * Required ID-token claims for an Eliza Cloud SSO exchange.\n *\n * `sub` is the cloud user id (canonical identity key). `email` and `name`\n * are surfaced for UI display and identity provisioning. Anything else the\n * cloud issuer adds is preserved on `extra` for callers that need it but\n * is never required for auth decisions.\n */\nexport interface CloudSsoIdTokenClaims {\n  iss: string;\n  sub: string;\n  aud: string | string[];\n  exp: number;\n  iat: number;\n  email: string;\n  email_verified?: boolean;\n  name: string;\n  picture?: string;\n  extra: Record<string, unknown>;\n}\n\nexport interface CloudSsoSession {\n  cloudUserId: string;\n  email: string;\n  displayName: string;\n  claims: CloudSsoIdTokenClaims;\n}\n\nexport interface SsoRedirectArgs {\n  /**\n   * Local URL the user should land on after the SSO round-trip\n   * (e.g. `/first-run/setup`). The dashboard's callback route forwards\n   * to this once the session cookie is set; it is NOT sent to the cloud\n   * issuer.\n   */\n  returnTo?: string;\n  /**\n   * State nonce. The caller is responsible for generating this with\n   * `crypto.randomBytes(32)` and storing it server-side keyed by the\n   * issued cookie / pending exchange.\n   */\n  state: string;\n  /**\n   * Override for `ELIZA_CLOUD_CLIENT_ID`. Falls through to the env when\n   * unset; explicitly throws when neither is provided.\n   */\n  clientId?: string;\n  /** Allows tests to inject a synthetic env record. */\n  env?: RuntimeEnvRecord;\n}\n\nexport interface ExchangeCodeArgs {\n  /** Authorization code returned on the SSO callback. */\n  code: string;\n  /** State value the cloud issuer echoed back on the callback. */\n  state: string;\n  /**\n   * State value the caller originally issued. Compared with `state` and\n   * mismatch causes a fail-closed throw before any network call is made.\n   */\n  expectedState: string;\n  /**\n   * Source for `getJwksUrl()`. The caller resolves this from the runtime\n   * service registry (`runtime.getService(\"CLOUD_BOOTSTRAP\")`) so this\n   * file does not import from `app-core` directly.\n   */\n  bootstrap: CloudBootstrapService;\n  /** Allows tests to inject a fake fetch for the token endpoint. */\n  fetchImpl?: typeof fetch;\n  /** Allows tests to inject a synthetic env record. */\n  env?: RuntimeEnvRecord;\n  /** Optional override for the redirect URI; defaults to the local callback. */\n  redirectUri?: string;\n}\n\ninterface RawTokenResponse {\n  id_token?: unknown;\n  access_token?: unknown;\n  token_type?: unknown;\n  expires_in?: unknown;\n  scope?: unknown;\n}\n\ninterface ApiKeyAuthInput {\n  apiKey: string;\n  organizationId?: string;\n  userId?: string;\n}\n\ninterface RawIdTokenPayload {\n  iss?: unknown;\n  sub?: unknown;\n  aud?: unknown;\n  exp?: unknown;\n  iat?: unknown;\n  email?: unknown;\n  email_verified?: unknown;\n  name?: unknown;\n  picture?: unknown;\n  [otherProperty: string]: unknown;\n}\n\nfunction readEnvKey(env: RuntimeEnvRecord, key: string): string | null {\n  const value = env[key];\n  if (typeof value !== \"string\") return null;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction processEnv(): RuntimeEnvRecord {\n  if (typeof process === \"undefined\") return {};\n  return process.env as RuntimeEnvRecord;\n}\n\n/**\n * Build the local SSO callback URL the cloud issuer will redirect back to.\n *\n * Reads `ELIZA_API_BIND` and the desktop API port from `@elizaos/core`'s\n * runtime-env helper so the redirect_uri matches whatever the dashboard\n * is actually serving on. Loopback binds default to `http://127.0.0.1:<port>`;\n * non-loopback binds (cloud-provisioned containers) use `https://`.\n */\nfunction defaultRedirectUri(env: RuntimeEnvRecord): string {\n  const security = resolveApiSecurityConfig(env);\n  const port = resolveDesktopApiPort(env);\n  const scheme = security.isLoopbackBind ? \"http\" : \"https\";\n  // Strip any IPv6 brackets the bind host might already include.\n  const host = security.bindHost.startsWith(\"[\")\n    ? security.bindHost\n    : security.bindHost.includes(\":\") && !security.bindHost.startsWith(\"[\")\n      ? `[${security.bindHost}]`\n      : security.bindHost;\n  return `${scheme}://${host}:${port}/api/auth/login/sso/callback`;\n}\n\n/**\n * Returns the absolute URL the dashboard should redirect the user to in\n * order to start an Eliza Cloud SSO authorization-code flow.\n *\n * Throws when `ELIZA_CLOUD_CLIENT_ID` is unset and no `clientId` override\n * is provided — there is no built-in default. `ELIZA_CLOUD_ISSUER` is read\n * via the `CloudBootstrapService`'s service-port and must already be set;\n * if not, this method throws via the bootstrap's existing fail-closed\n * behaviour.\n *\n * The `state` argument MUST be generated by the caller with a cryptographic\n * RNG and stored server-side bound to the issued cookie. This method does\n * NOT generate or persist state.\n *\n * @param bootstrap - Service-port that exposes `getExpectedIssuer()`.\n * @param args - Required `state`, optional `clientId` / `returnTo` / `env`.\n */\nexport function getSsoRedirectUrl(bootstrap: CloudBootstrapService, args: SsoRedirectArgs): string {\n  const env = args.env ?? processEnv();\n  const clientId = args.clientId ?? readEnvKey(env, \"ELIZA_CLOUD_CLIENT_ID\");\n  if (!clientId) {\n    throw new Error(\"ELIZA_CLOUD_CLIENT_ID is not configured — cannot start Eliza Cloud SSO\");\n  }\n  if (args.state.length === 0) {\n    throw new Error(\"getSsoRedirectUrl requires a non-empty state nonce\");\n  }\n  const issuer = bootstrap.getExpectedIssuer();\n  const redirectUri = defaultRedirectUri(env);\n  const params = new URLSearchParams();\n  params.set(\"response_type\", \"code\");\n  params.set(\"client_id\", clientId);\n  params.set(\"redirect_uri\", redirectUri);\n  params.set(\"scope\", \"openid profile\");\n  params.set(\"state\", args.state);\n  if (args.returnTo) {\n    // Forwarded through state on the cloud side is not safe (issuer-controlled);\n    // we surface it as a separate hint that the local callback honours.\n    params.set(\"eliza_return_to\", args.returnTo);\n  }\n  return `${issuer}/oauth/authorize?${params.toString()}`;\n}\n\nfunction shapeIdTokenClaims(payload: RawIdTokenPayload): CloudSsoIdTokenClaims {\n  if (typeof payload.iss !== \"string\" || payload.iss.length === 0) {\n    throw new Error(\"id_token missing issuer claim\");\n  }\n  if (typeof payload.sub !== \"string\" || payload.sub.length === 0) {\n    throw new Error(\"id_token missing sub claim\");\n  }\n  if (\n    typeof payload.aud !== \"string\" &&\n    !(Array.isArray(payload.aud) && payload.aud.every((value) => typeof value === \"string\"))\n  ) {\n    throw new Error(\"id_token missing or malformed aud claim\");\n  }\n  if (typeof payload.exp !== \"number\" || !Number.isFinite(payload.exp)) {\n    throw new Error(\"id_token missing exp claim\");\n  }\n  if (typeof payload.iat !== \"number\" || !Number.isFinite(payload.iat)) {\n    throw new Error(\"id_token missing iat claim\");\n  }\n  if (typeof payload.email !== \"string\" || payload.email.length === 0) {\n    throw new Error(\"id_token missing email claim — Eliza Cloud SSO requires it\");\n  }\n  if (typeof payload.name !== \"string\" || payload.name.length === 0) {\n    throw new Error(\"id_token missing name claim — Eliza Cloud SSO requires it\");\n  }\n  const extra: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(payload)) {\n    if (\n      key !== \"iss\" &&\n      key !== \"sub\" &&\n      key !== \"aud\" &&\n      key !== \"exp\" &&\n      key !== \"iat\" &&\n      key !== \"email\" &&\n      key !== \"email_verified\" &&\n      key !== \"name\" &&\n      key !== \"picture\"\n    ) {\n      extra[key] = value;\n    }\n  }\n  return {\n    iss: payload.iss,\n    sub: payload.sub,\n    aud: payload.aud as string | string[],\n    exp: payload.exp,\n    iat: payload.iat,\n    email: payload.email,\n    email_verified:\n      typeof payload.email_verified === \"boolean\" ? payload.email_verified : undefined,\n    name: payload.name,\n    picture: typeof payload.picture === \"string\" ? payload.picture : undefined,\n    extra,\n  };\n}\n\nfunction shapeTokenResponse(payload: unknown): { idToken: string } {\n  if (!payload || typeof payload !== \"object\") {\n    throw new Error(\"Eliza Cloud token endpoint returned a non-object body\");\n  }\n  const raw = payload as RawTokenResponse;\n  if (typeof raw.id_token !== \"string\" || raw.id_token.length === 0) {\n    throw new Error(\"Eliza Cloud token endpoint did not return an id_token\");\n  }\n  return { idToken: raw.id_token };\n}\n\n/**\n * Exchange an authorization code for a verified Eliza Cloud session.\n *\n * Steps:\n *   1. Compare `state === expectedState`. Mismatch throws.\n *   2. POST to `${ELIZA_CLOUD_ISSUER}/oauth/token` with the code,\n *      `client_id`, and `client_secret` (the latter from\n *      `ELIZA_CLOUD_CLIENT_SECRET`).\n *   3. Verify the returned `id_token` against the JWKS exposed by\n *      `CloudBootstrapService.getJwksUrl()`. RS256 only.\n *   4. Project the claims onto a `CloudSsoSession`.\n *\n * Any error in fetch / signature verify / claim shape throws — this method\n * NEVER returns a partial or fallback session.\n */\nexport async function exchangeCodeForSession(args: ExchangeCodeArgs): Promise<CloudSsoSession> {\n  if (args.code.length === 0) {\n    throw new Error(\"exchangeCodeForSession requires a non-empty code\");\n  }\n  if (!args.state || !args.expectedState || args.state !== args.expectedState) {\n    throw new Error(\"Eliza Cloud SSO state mismatch — refusing to exchange code (possible CSRF)\");\n  }\n\n  const env = args.env ?? processEnv();\n  const clientId = readEnvKey(env, \"ELIZA_CLOUD_CLIENT_ID\");\n  if (!clientId) {\n    throw new Error(\"ELIZA_CLOUD_CLIENT_ID is not configured — cannot complete Eliza Cloud SSO\");\n  }\n  const clientSecret = readEnvKey(env, \"ELIZA_CLOUD_CLIENT_SECRET\");\n  if (!clientSecret) {\n    throw new Error(\n      \"ELIZA_CLOUD_CLIENT_SECRET is not configured — cannot complete Eliza Cloud SSO\"\n    );\n  }\n\n  const issuer = args.bootstrap.getExpectedIssuer();\n  const redirectUri = args.redirectUri ?? defaultRedirectUri(env);\n  const tokenUrl = `${issuer}/oauth/token`;\n\n  const fetchImpl = args.fetchImpl ?? fetch;\n  const body = new URLSearchParams();\n  body.set(\"grant_type\", \"authorization_code\");\n  body.set(\"code\", args.code);\n  body.set(\"redirect_uri\", redirectUri);\n  body.set(\"client_id\", clientId);\n  body.set(\"client_secret\", clientSecret);\n\n  const response = await fetchImpl(tokenUrl, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/x-www-form-urlencoded\",\n      accept: \"application/json\",\n    },\n    body: body.toString(),\n  });\n  if (!response.ok) {\n    throw new Error(\n      `Eliza Cloud token endpoint returned HTTP ${response.status} for code exchange`\n    );\n  }\n  const payload: unknown = await response.json();\n  const { idToken } = shapeTokenResponse(payload);\n\n  const jwksUrl = args.bootstrap.getJwksUrl();\n  const remoteJwks = createRemoteJWKSet(new URL(jwksUrl));\n\n  const verified = await jwtVerify(idToken, remoteJwks, {\n    algorithms: [\"RS256\"],\n    issuer,\n    audience: clientId,\n  });\n\n  const claims = shapeIdTokenClaims(verified.payload as RawIdTokenPayload);\n\n  return {\n    cloudUserId: claims.sub,\n    email: claims.email,\n    displayName: claims.name,\n    claims,\n  };\n}\n\n// ─── Service ───────────────────────────────────────────────────────────────\n\nexport class CloudAuthService extends Service {\n  static serviceType = \"CLOUD_AUTH\";\n  capabilityDescription = \"Eliza Cloud device authentication and SSO session helpers\";\n\n  private client: CloudApiClient;\n  private credentials: CloudCredentials | null = null;\n\n  constructor(runtime?: IAgentRuntime) {\n    super(runtime);\n    this.client = new CloudApiClient(DEFAULT_CLOUD_CONFIG.baseUrl);\n  }\n\n  static async start(runtime: IAgentRuntime): Promise<Service> {\n    const service = new CloudAuthService(runtime);\n    await service.initialize();\n    return service;\n  }\n\n  async stop(): Promise<void> {\n    this.credentials = null;\n  }\n\n  private async initialize(): Promise<void> {\n    const baseUrl = String(\n      this.runtime.getSetting(\"ELIZAOS_CLOUD_BASE_URL\") ?? DEFAULT_CLOUD_CONFIG.baseUrl\n    );\n    this.client.setBaseUrl(baseUrl);\n\n    // Try existing API key first.  If the key is present in settings\n    // (persisted via config file or character secrets in the DB), trust it\n    // immediately so the agent is functional even when the cloud API is\n    // temporarily unreachable.  A background validation fires to confirm\n    // the key — if it turns out to be revoked the next model call will\n    // surface the error, but the agent won't stall on startup.\n    const existingKey = this.runtime.getSetting(\"ELIZAOS_CLOUD_API_KEY\");\n    if (existingKey) {\n      const key = String(existingKey);\n      this.client.setApiKey(key);\n\n      // Accept the key optimistically — no blocking network call.\n      this.credentials = {\n        apiKey: key,\n        userId: String(this.runtime.getSetting(\"ELIZAOS_CLOUD_USER_ID\") ?? \"\"),\n        organizationId: String(\n          this.runtime.getSetting(\"ELIZAOS_CLOUD_ORG_ID\") ??\n            this.runtime.getSetting(\"ELIZA_CLOUD_ORGANIZATION_ID\") ??\n            \"\"\n        ),\n        authenticatedAt: Date.now(),\n      };\n      logger.info(\"[CloudAuth] Authenticated with saved API key\");\n\n      // Non-blocking validation — if the key is invalid the next model\n      // call will surface the error; we just log a warning here.\n      this.validateApiKey(key)\n        .then((valid) => {\n          if (!valid) {\n            logger.warn(\n              \"[CloudAuth] Saved API key could not be validated (cloud may be unreachable or key revoked) — model calls will use the key anyway\"\n            );\n          }\n        })\n        .catch(() => {\n          // Swallow — already logged inside validateApiKey\n        });\n      return;\n    }\n\n    // Device-based auto-signup when explicitly enabled\n    const enabled = this.runtime.getSetting(\"ELIZAOS_CLOUD_ENABLED\");\n    if (enabled === \"true\" || enabled === \"1\") {\n      try {\n        await this.authenticateWithDevice();\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        logger.warn(`[CloudAuth] Device auth failed (cloud may be unreachable): ${msg}`);\n        logger.info(\n          \"[CloudAuth] Service will start unauthenticated — cloud features disabled until connectivity is restored\"\n        );\n      }\n    } else {\n      logger.info(\"[CloudAuth] Cloud not enabled (set ELIZAOS_CLOUD_ENABLED=true)\");\n    }\n  }\n\n  private async validateApiKey(key: string): Promise<boolean> {\n    if (!(await isCloudReachable())) {\n      logger.warn(\n        \"[CloudAuth] Cloud unreachable at boot — skipping API key validation; key will be used as-is\"\n      );\n      return false;\n    }\n    try {\n      const validationClient = new CloudApiClient(this.client.getBaseUrl(), key);\n      await validationClient.get(\"/models\", { timeoutMs: 2_500 });\n      return true;\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      logger.warn(`[CloudAuth] Could not reach cloud API to validate key: ${msg}`);\n      return false;\n    }\n  }\n\n  /**\n   * Free-tier device auto-signup. **Convenience only — not a security\n   * primitive.** The hardware fingerprint is treated as opaque material the\n   * cloud signup endpoint can use to mint a fresh API key + $5 free credit\n   * for new installs. The result is usable for outbound LLM calls; it never\n   * authorizes inbound dashboard access.\n   *\n   * See `docs/security/remote-auth-hardening-plan.md` §7.\n   */\n  async authenticateWithDevice(): Promise<CloudCredentials> {\n    const deviceId = await deriveDeviceId();\n    const platform = detectPlatform();\n    const appVersion = process.env.ELIZAOS_CLOUD_APP_VERSION ?? \"2.0.0-beta.0\";\n    const os = await import(\"node:os\");\n\n    logger.info(`[CloudAuth] Authenticating device (platform=${platform})`);\n\n    const response = await this.client.postUnauthenticated<DeviceAuthResponse>(\"/device-auth\", {\n      deviceId,\n      platform,\n      appVersion,\n      deviceName: os.hostname(),\n    });\n\n    this.credentials = {\n      apiKey: response.data.apiKey,\n      userId: response.data.userId,\n      organizationId: response.data.organizationId,\n      authenticatedAt: Date.now(),\n    };\n    this.client.setApiKey(response.data.apiKey);\n\n    const action = response.data.isNew ? \"New account created\" : \"Authenticated\";\n    logger.info(`[CloudAuth] ${action} (credits: $${response.data.credits.toFixed(2)})`);\n\n    return this.credentials;\n  }\n\n  authenticateWithApiKey(input: ApiKeyAuthInput): CloudCredentials {\n    const apiKey = input.apiKey.trim();\n    if (!apiKey) {\n      throw new Error(\"Eliza Cloud API key is required\");\n    }\n\n    this.client.setApiKey(apiKey);\n    this.credentials = {\n      apiKey,\n      userId: input.userId ?? \"\",\n      organizationId: input.organizationId ?? \"\",\n      authenticatedAt: Date.now(),\n    };\n\n    logger.info(\"[CloudAuth] Authenticated with API key\");\n    return this.credentials;\n  }\n\n  clearAuth(): void {\n    this.credentials = null;\n    this.client.setApiKey(undefined);\n  }\n\n  isAuthenticated(): boolean {\n    return this.credentials !== null;\n  }\n  getCredentials(): CloudCredentials | null {\n    return this.credentials;\n  }\n  getApiKey(): string | undefined {\n    return this.credentials?.apiKey ?? this.client.getApiKey();\n  }\n  getClient(): CloudApiClient {\n    return this.client;\n  }\n  getUserId(): string | undefined {\n    return this.credentials?.userId;\n  }\n  getOrganizationId(): string | undefined {\n    return this.credentials?.organizationId;\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAsXA;AAAA;AAAA;AAAA;AA1BO,IAAM,uBAA0C;AAAA,EACrD,SAAS;AAAA,EACT,SAAS;AAAA,EACT,eAAe;AAAA,EACf,eAAe;AAAA,EACf,QAAQ;AAAA,IACN,qBAAqB;AAAA,IACrB,sBAAsB;AAAA,IACtB,qBAAqB;AAAA,EACvB;AAAA,EACA,QAAQ;AAAA,IACN,sBAAsB;AAAA,IACtB,cAAc;AAAA,EAChB;AAAA,EACA,WAAW;AAAA,IACT,cAAc;AAAA,IACd,qBAAqB;AAAA,IACrB,YAAY;AAAA,IACZ,eAAe;AAAA,IACf,aAAa;AAAA,EACf;AACF;;;AC7WA;AAAA;AAAA,mBAEE;AAAA;AAAA,8BAEA;AAAA;;;ACYF;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AACA;AAOA,eAAe,cAAc,GAAoB;AAAA,EAC/C,MAAM,KAAK,MAAa;AAAA,EACxB,MAAM,SAAS,MAAa;AAAA,EAC5B,MAAM,OAAO,GAAG,KAAK;AAAA,EACrB,MAAM,MAAM;AAAA,IACV,GAAG,SAAS;AAAA,IACZ,GAAG,SAAS;AAAA,IACZ,GAAG,KAAK;AAAA,IACR,KAAK,IAAI,SAAS;AAAA,IAClB,KAAK;AAAA,IACL,GAAG,SAAS;AAAA,EACd,EAAE,KAAK,GAAG;AAAA,EACV,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK;AAAA;AAG7D,SAAS,cAAc,GAAmB;AAAA,EACxC,IAAI,OAAO,YAAY;AAAA,IAAa,OAAO;AAAA,EAC3C,MAAM,MAAsC;AAAA,IAC1C,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AAAA,EACA,OAAO,IAAI,QAAQ,aAAa;AAAA;AA2GlC,SAAS,UAAU,CAAC,KAAuB,KAA4B;AAAA,EACrE,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AAAA;AAGxC,SAAS,UAAU,GAAqB;AAAA,EACtC,IAAI,OAAO,YAAY;AAAA,IAAa,OAAO,CAAC;AAAA,EAC5C,OAAO,QAAQ;AAAA;AAWjB,SAAS,kBAAkB,CAAC,KAA+B;AAAA,EACzD,MAAM,WAAW,yBAAyB,GAAG;AAAA,EAC7C,MAAM,OAAO,sBAAsB,GAAG;AAAA,EACtC,MAAM,SAAS,SAAS,iBAAiB,SAAS;AAAA,EAElD,MAAM,OAAO,SAAS,SAAS,WAAW,GAAG,IACzC,SAAS,WACT,SAAS,SAAS,SAAS,GAAG,KAAK,CAAC,SAAS,SAAS,WAAW,GAAG,IAClE,IAAI,SAAS,cACb,SAAS;AAAA,EACf,OAAO,GAAG,YAAY,QAAQ;AAAA;AAoBzB,SAAS,iBAAiB,CAAC,WAAkC,MAA+B;AAAA,EACjG,MAAM,MAAM,KAAK,OAAO,WAAW;AAAA,EACnC,MAAM,WAAW,KAAK,YAAY,WAAW,KAAK,uBAAuB;AAAA,EACzE,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,IAAI,MAAM,wEAAuE;AAAA,EACzF;AAAA,EACA,IAAI,KAAK,MAAM,WAAW,GAAG;AAAA,IAC3B,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EACA,MAAM,SAAS,UAAU,kBAAkB;AAAA,EAC3C,MAAM,cAAc,mBAAmB,GAAG;AAAA,EAC1C,MAAM,SAAS,IAAI;AAAA,EACnB,OAAO,IAAI,iBAAiB,MAAM;AAAA,EAClC,OAAO,IAAI,aAAa,QAAQ;AAAA,EAChC,OAAO,IAAI,gBAAgB,WAAW;AAAA,EACtC,OAAO,IAAI,SAAS,gBAAgB;AAAA,EACpC,OAAO,IAAI,SAAS,KAAK,KAAK;AAAA,EAC9B,IAAI,KAAK,UAAU;AAAA,IAGjB,OAAO,IAAI,mBAAmB,KAAK,QAAQ;AAAA,EAC7C;AAAA,EACA,OAAO,GAAG,0BAA0B,OAAO,SAAS;AAAA;AAGtD,SAAS,kBAAkB,CAAC,SAAmD;AAAA,EAC7E,IAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,WAAW,GAAG;AAAA,IAC/D,MAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AAAA,EACA,IAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,WAAW,GAAG;AAAA,IAC/D,MAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,IACE,OAAO,QAAQ,QAAQ,YACvB,EAAE,MAAM,QAAQ,QAAQ,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,IACtF;AAAA,IACA,MAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAAA,EACA,IAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,OAAO,SAAS,QAAQ,GAAG,GAAG;AAAA,IACpE,MAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,IAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,OAAO,SAAS,QAAQ,GAAG,GAAG;AAAA,IACpE,MAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,IAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,WAAW,GAAG;AAAA,IACnE,MAAM,IAAI,MAAM,4DAA2D;AAAA,EAC7E;AAAA,EACA,IAAI,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,WAAW,GAAG;AAAA,IACjE,MAAM,IAAI,MAAM,2DAA0D;AAAA,EAC5E;AAAA,EACA,MAAM,QAAiC,CAAC;AAAA,EACxC,YAAY,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;AAAA,IAClD,IACE,QAAQ,SACR,QAAQ,SACR,QAAQ,SACR,QAAQ,SACR,QAAQ,SACR,QAAQ,WACR,QAAQ,oBACR,QAAQ,UACR,QAAQ,WACR;AAAA,MACA,MAAM,OAAO;AAAA,IACf;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ;AAAA,IACf,gBACE,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,iBAAiB;AAAA,IACzE,MAAM,QAAQ;AAAA,IACd,SAAS,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU;AAAA,IACjE;AAAA,EACF;AAAA;AAGF,SAAS,kBAAkB,CAAC,SAAuC;AAAA,EACjE,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAAA,IAC3C,MAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAAA,EACA,MAAM,MAAM;AAAA,EACZ,IAAI,OAAO,IAAI,aAAa,YAAY,IAAI,SAAS,WAAW,GAAG;AAAA,IACjE,MAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAAA,EACA,OAAO,EAAE,SAAS,IAAI,SAAS;AAAA;AAkBjC,eAAsB,sBAAsB,CAAC,MAAkD;AAAA,EAC7F,IAAI,KAAK,KAAK,WAAW,GAAG;AAAA,IAC1B,MAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAAA,EACA,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,iBAAiB,KAAK,UAAU,KAAK,eAAe;AAAA,IAC3E,MAAM,IAAI,MAAM,4EAA2E;AAAA,EAC7F;AAAA,EAEA,MAAM,MAAM,KAAK,OAAO,WAAW;AAAA,EACnC,MAAM,WAAW,WAAW,KAAK,uBAAuB;AAAA,EACxD,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,IAAI,MAAM,2EAA0E;AAAA,EAC5F;AAAA,EACA,MAAM,eAAe,WAAW,KAAK,2BAA2B;AAAA,EAChE,IAAI,CAAC,cAAc;AAAA,IACjB,MAAM,IAAI,MACR,+EACF;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,KAAK,UAAU,kBAAkB;AAAA,EAChD,MAAM,cAAc,KAAK,eAAe,mBAAmB,GAAG;AAAA,EAC9D,MAAM,WAAW,GAAG;AAAA,EAEpB,MAAM,YAAY,KAAK,aAAa;AAAA,EACpC,MAAM,OAAO,IAAI;AAAA,EACjB,KAAK,IAAI,cAAc,oBAAoB;AAAA,EAC3C,KAAK,IAAI,QAAQ,KAAK,IAAI;AAAA,EAC1B,KAAK,IAAI,gBAAgB,WAAW;AAAA,EACpC,KAAK,IAAI,aAAa,QAAQ;AAAA,EAC9B,KAAK,IAAI,iBAAiB,YAAY;AAAA,EAEtC,MAAM,WAAW,MAAM,UAAU,UAAU;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AAAA,EACD,IAAI,CAAC,SAAS,IAAI;AAAA,IAChB,MAAM,IAAI,MACR,4CAA4C,SAAS,0BACvD;AAAA,EACF;AAAA,EACA,MAAM,UAAmB,MAAM,SAAS,KAAK;AAAA,EAC7C,QAAQ,YAAY,mBAAmB,OAAO;AAAA,EAE9C,MAAM,UAAU,KAAK,UAAU,WAAW;AAAA,EAC1C,MAAM,aAAa,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAAA,EAEtD,MAAM,WAAW,MAAM,UAAU,SAAS,YAAY;AAAA,IACpD,YAAY,CAAC,OAAO;AAAA,IACpB;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AAAA,EAED,MAAM,SAAS,mBAAmB,SAAS,OAA4B;AAAA,EAEvE,OAAO;AAAA,IACL,aAAa,OAAO;AAAA,IACpB,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAKK,MAAM,yBAAyB,QAAQ;AAAA,SACrC,cAAc;AAAA,EACrB,wBAAwB;AAAA,EAEhB;AAAA,EACA,cAAuC;AAAA,EAE/C,WAAW,CAAC,SAAyB;AAAA,IACnC,MAAM,OAAO;AAAA,IACb,KAAK,SAAS,IAAI,eAAe,qBAAqB,OAAO;AAAA;AAAA,cAGlD,MAAK,CAAC,SAA0C;AAAA,IAC3D,MAAM,UAAU,IAAI,iBAAiB,OAAO;AAAA,IAC5C,MAAM,QAAQ,WAAW;AAAA,IACzB,OAAO;AAAA;AAAA,OAGH,KAAI,GAAkB;AAAA,IAC1B,KAAK,cAAc;AAAA;AAAA,OAGP,WAAU,GAAkB;AAAA,IACxC,MAAM,UAAU,OACd,KAAK,QAAQ,WAAW,wBAAwB,KAAK,qBAAqB,OAC5E;AAAA,IACA,KAAK,OAAO,WAAW,OAAO;AAAA,IAQ9B,MAAM,cAAc,KAAK,QAAQ,WAAW,uBAAuB;AAAA,IACnE,IAAI,aAAa;AAAA,MACf,MAAM,MAAM,OAAO,WAAW;AAAA,MAC9B,KAAK,OAAO,UAAU,GAAG;AAAA,MAGzB,KAAK,cAAc;AAAA,QACjB,QAAQ;AAAA,QACR,QAAQ,OAAO,KAAK,QAAQ,WAAW,uBAAuB,KAAK,EAAE;AAAA,QACrE,gBAAgB,OACd,KAAK,QAAQ,WAAW,sBAAsB,KAC5C,KAAK,QAAQ,WAAW,6BAA6B,KACrD,EACJ;AAAA,QACA,iBAAiB,KAAK,IAAI;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,8CAA8C;AAAA,MAI1D,KAAK,eAAe,GAAG,EACpB,KAAK,CAAC,UAAU;AAAA,QACf,IAAI,CAAC,OAAO;AAAA,UACV,OAAO,KACL,kIACF;AAAA,QACF;AAAA,OACD,EACA,MAAM,MAAM,EAEZ;AAAA,MACH;AAAA,IACF;AAAA,IAGA,MAAM,UAAU,KAAK,QAAQ,WAAW,uBAAuB;AAAA,IAC/D,IAAI,YAAY,UAAU,YAAY,KAAK;AAAA,MACzC,IAAI;AAAA,QACF,MAAM,KAAK,uBAAuB;AAAA,QAClC,OAAO,KAAK;AAAA,QACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QAC3D,OAAO,KAAK,8DAA8D,KAAK;AAAA,QAC/E,OAAO,KACL,yGACF;AAAA;AAAA,IAEJ,EAAO;AAAA,MACL,OAAO,KAAK,gEAAgE;AAAA;AAAA;AAAA,OAIlE,eAAc,CAAC,KAA+B;AAAA,IAC1D,IAAI,CAAE,MAAM,iBAAiB,GAAI;AAAA,MAC/B,OAAO,KACL,6FACF;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,IAAI;AAAA,MACF,MAAM,mBAAmB,IAAI,eAAe,KAAK,OAAO,WAAW,GAAG,GAAG;AAAA,MACzE,MAAM,iBAAiB,IAAI,WAAW,EAAE,WAAW,KAAM,CAAC;AAAA,MAC1D,OAAO;AAAA,MACP,OAAO,KAAK;AAAA,MACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC3D,OAAO,KAAK,0DAA0D,KAAK;AAAA,MAC3E,OAAO;AAAA;AAAA;AAAA,OAaL,uBAAsB,GAA8B;AAAA,IACxD,MAAM,WAAW,MAAM,eAAe;AAAA,IACtC,MAAM,WAAW,eAAe;AAAA,IAChC,MAAM,aAAa,QAAQ,IAAI,6BAA6B;AAAA,IAC5D,MAAM,KAAK,MAAa;AAAA,IAExB,OAAO,KAAK,+CAA+C,WAAW;AAAA,IAEtE,MAAM,WAAW,MAAM,KAAK,OAAO,oBAAwC,gBAAgB;AAAA,MACzF;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY,GAAG,SAAS;AAAA,IAC1B,CAAC;AAAA,IAED,KAAK,cAAc;AAAA,MACjB,QAAQ,SAAS,KAAK;AAAA,MACtB,QAAQ,SAAS,KAAK;AAAA,MACtB,gBAAgB,SAAS,KAAK;AAAA,MAC9B,iBAAiB,KAAK,IAAI;AAAA,IAC5B;AAAA,IACA,KAAK,OAAO,UAAU,SAAS,KAAK,MAAM;AAAA,IAE1C,MAAM,SAAS,SAAS,KAAK,QAAQ,wBAAwB;AAAA,IAC7D,OAAO,KAAK,eAAe,qBAAqB,SAAS,KAAK,QAAQ,QAAQ,CAAC,IAAI;AAAA,IAEnF,OAAO,KAAK;AAAA;AAAA,EAGd,sBAAsB,CAAC,OAA0C;AAAA,IAC/D,MAAM,SAAS,MAAM,OAAO,KAAK;AAAA,IACjC,IAAI,CAAC,QAAQ;AAAA,MACX,MAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AAAA,IAEA,KAAK,OAAO,UAAU,MAAM;AAAA,IAC5B,KAAK,cAAc;AAAA,MACjB;AAAA,MACA,QAAQ,MAAM,UAAU;AAAA,MACxB,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,iBAAiB,KAAK,IAAI;AAAA,IAC5B;AAAA,IAEA,OAAO,KAAK,wCAAwC;AAAA,IACpD,OAAO,KAAK;AAAA;AAAA,EAGd,SAAS,GAAS;AAAA,IAChB,KAAK,cAAc;AAAA,IACnB,KAAK,OAAO,UAAU,SAAS;AAAA;AAAA,EAGjC,eAAe,GAAY;AAAA,IACzB,OAAO,KAAK,gBAAgB;AAAA;AAAA,EAE9B,cAAc,GAA4B;AAAA,IACxC,OAAO,KAAK;AAAA;AAAA,EAEd,SAAS,GAAuB;AAAA,IAC9B,OAAO,KAAK,aAAa,UAAU,KAAK,OAAO,UAAU;AAAA;AAAA,EAE3D,SAAS,GAAmB;AAAA,IAC1B,OAAO,KAAK;AAAA;AAAA,EAEd,SAAS,GAAuB;AAAA,IAC9B,OAAO,KAAK,aAAa;AAAA;AAAA,EAE3B,iBAAiB,GAAuB;AAAA,IACtC,OAAO,KAAK,aAAa;AAAA;AAE7B;",
+  "debugId": "C706585F0178D71764756E2164756E21",
+  "names": []
+}

package/dist/services/cloud-backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-backup.d.ts","sourceRoot":"","sources":["../../services/cloud-backup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EACV,aAAa,EAIb,YAAY,EACb,MAAM,gBAAgB,CAAC;AAUxB,qBAAa,kBAAmB,SAAQ,OAAO;IAC7C,MAAM,CAAC,WAAW,SAAkB;IACpC,qBAAqB,SAA+C;IAEpE,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,WAAW,CAA2C;IAC9D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoD;WAExE,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,UAAU;IAYlB,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,YAAuB,EACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,aAAa,CAAC;IAoBnB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ5D,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAW3E,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAgClE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAS3C;;;OAGG;IACG,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAU5E;;;OAGG;YACW,cAAc;IAqB5B,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAInD,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAGtD"}
+{"version":3,"file":"cloud-backup.d.ts","sourceRoot":"","sources":["../../src/services/cloud-backup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EACV,aAAa,EAIb,YAAY,EACb,MAAM,gBAAgB,CAAC;AAUxB,qBAAa,kBAAmB,SAAQ,OAAO;IAC7C,MAAM,CAAC,WAAW,SAAkB;IACpC,qBAAqB,SAA+C;IAEpE,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,WAAW,CAA2C;IAC9D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoD;WAExE,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,UAAU;IAYlB,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,YAAuB,EACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,aAAa,CAAC;IAoBnB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ5D,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAW3E,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAgClE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAS3C;;;OAGG;IACG,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAU5E;;;OAGG;YACW,cAAc;IAqB5B,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAInD,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAGtD"}

package/dist/services/cloud-backup.js

@@ -0,0 +1,176 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/types/cloud.ts
+import {
+  CloudApiError,
+  InsufficientCreditsError
+} from "@elizaos/cloud-sdk";
+var DEFAULT_CLOUD_CONFIG = {
+  enabled: false,
+  baseUrl: "https://www.elizacloud.ai/api/v1",
+  inferenceMode: "cloud",
+  autoProvision: false,
+  bridge: {
+    reconnectIntervalMs: 3000,
+    maxReconnectAttempts: 20,
+    heartbeatIntervalMs: 30000
+  },
+  backup: {
+    autoBackupIntervalMs: 3600000,
+    maxSnapshots: 10
+  },
+  container: {
+    defaultImage: "elizaos/agent:latest",
+    defaultArchitecture: "arm64",
+    defaultCpu: 1792,
+    defaultMemory: 1792,
+    defaultPort: 3000
+  }
+};
+
+// src/services/cloud-backup.ts
+import { logger, Service } from "@elizaos/core";
+class CloudBackupService extends Service {
+  static serviceType = "CLOUD_BACKUP";
+  capabilityDescription = "ElizaCloud agent state backup and restore";
+  authService;
+  autoBackups = new Map;
+  maxSnapshots = DEFAULT_CLOUD_CONFIG.backup.maxSnapshots;
+  backupIntervalMs = DEFAULT_CLOUD_CONFIG.backup.autoBackupIntervalMs;
+  static async start(runtime) {
+    const service = new CloudBackupService(runtime);
+    await service.initialize();
+    return service;
+  }
+  async stop() {
+    for (const [, entry] of this.autoBackups) {
+      clearInterval(entry.timer);
+    }
+    this.autoBackups.clear();
+    logger.info("[CloudBackup] Service stopped");
+  }
+  async initialize() {
+    const auth = this.runtime.getService("CLOUD_AUTH");
+    if (!auth) {
+      logger.debug("[CloudBackup] CloudAuthService not available");
+      return;
+    }
+    this.authService = auth;
+    logger.info("[CloudBackup] Service initialized");
+  }
+  async createSnapshot(containerId, snapshotType = "manual", metadata) {
+    const client = this.authService.getClient();
+    const response = await client.post(`/agent-state/${containerId}/snapshot`, { snapshotType, metadata });
+    logger.info(`[CloudBackup] Created ${snapshotType} snapshot for container ${containerId} (id=${response.data.id}, size=${formatBytes(response.data.sizeBytes)})`);
+    const autoEntry = this.autoBackups.get(containerId);
+    if (autoEntry) {
+      autoEntry.lastBackupAt = Date.now();
+    }
+    return response.data;
+  }
+  async listSnapshots(containerId) {
+    const client = this.authService.getClient();
+    const response = await client.get(`/agent-state/${containerId}/snapshots`);
+    return response.data;
+  }
+  async restoreSnapshot(containerId, snapshotId) {
+    const client = this.authService.getClient();
+    await client.post(`/agent-state/${containerId}/restore`, {
+      snapshotId
+    });
+    logger.info(`[CloudBackup] Restored snapshot ${snapshotId} for container ${containerId}`);
+  }
+  async getLatestSnapshot(containerId) {
+    const snapshots = await this.listSnapshots(containerId);
+    if (snapshots.length === 0)
+      return null;
+    snapshots.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());
+    return snapshots[0];
+  }
+  scheduleAutoBackup(containerId, intervalMs) {
+    if (this.autoBackups.has(containerId)) {
+      logger.debug(`[CloudBackup] Auto-backup already scheduled for ${containerId}`);
+      return;
+    }
+    const interval = intervalMs ?? this.backupIntervalMs;
+    const timer = setInterval(() => {
+      logger.debug(`[CloudBackup] Running auto-backup for container ${containerId}`);
+      this.createSnapshot(containerId, "auto", {
+        trigger: "scheduled",
+        scheduledIntervalMs: interval
+      }).then(() => this.pruneSnapshots(containerId)).catch((err) => {
+        logger.error(`[CloudBackup] Auto-backup failed for ${containerId}: ${err.message}`);
+      });
+    }, interval);
+    this.autoBackups.set(containerId, {
+      containerId,
+      timer,
+      lastBackupAt: null
+    });
+    logger.info(`[CloudBackup] Scheduled auto-backup for ${containerId} every ${Math.round(interval / 60000)} minutes`);
+  }
+  cancelAutoBackup(containerId) {
+    const entry = this.autoBackups.get(containerId);
+    if (!entry)
+      return;
+    clearInterval(entry.timer);
+    this.autoBackups.delete(containerId);
+    logger.info(`[CloudBackup] Cancelled auto-backup for ${containerId}`);
+  }
+  async createPreEvictionSnapshot(containerId) {
+    logger.info(`[CloudBackup] Creating pre-eviction snapshot for ${containerId}`);
+    return this.createSnapshot(containerId, "pre-eviction", {
+      trigger: "billing-eviction",
+      createdAt: new Date().toISOString()
+    });
+  }
+  async pruneSnapshots(containerId) {
+    const snapshots = await this.listSnapshots(containerId);
+    const autoSnapshots = snapshots.filter((s) => s.snapshotType === "auto").sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());
+    const excess = autoSnapshots.slice(this.maxSnapshots);
+    if (excess.length === 0)
+      return;
+    const client = this.authService.getClient();
+    for (const snapshot of excess) {
+      await client.delete(`/agent-state/${containerId}/snapshots/${snapshot.id}`);
+      logger.debug(`[CloudBackup] Pruned old auto snapshot ${snapshot.id} for ${containerId}`);
+    }
+    logger.info(`[CloudBackup] Pruned ${excess.length} old auto snapshot(s) for ${containerId}`);
+  }
+  isAutoBackupScheduled(containerId) {
+    return this.autoBackups.has(containerId);
+  }
+  getLastBackupTime(containerId) {
+    return this.autoBackups.get(containerId)?.lastBackupAt ?? null;
+  }
+}
+function formatBytes(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  if (bytes < 1024 * 1024)
+    return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024)
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+export {
+  CloudBackupService
+};
+
+//# debugId=3A3130D224AC9DB064756E2164756E21

package/dist/services/cloud-backup.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/types/cloud.ts", "../src/services/cloud-backup.ts"],
+  "sourcesContent": [
+    "/**\n * Cloud-specific types for ElizaCloud integration.\n *\n * These types mirror the eliza-cloud-v2 database schemas and API contracts\n * for containers, auth, credits, bridge messaging, and agent state snapshots.\n */\n\nexport type {\n  CloudCodingAgent,\n  CloudCodingContainerSession,\n  CloudCodingContainerStatus,\n  CloudCodingPatch,\n  CloudCodingPatchFormat,\n  CloudCodingPromotion,\n  CloudCodingSyncDirection,\n  CloudCodingSyncResult,\n  CloudVfsBundle,\n  CloudVfsDeletedFile,\n  CloudVfsFile,\n  CloudVfsFileEncoding,\n  CloudVfsSourceKind,\n  PromoteVfsToCloudContainerRequest,\n  PromoteVfsToCloudContainerResponse,\n  RequestCodingAgentContainerRequest,\n  RequestCodingAgentContainerResponse,\n  SyncCloudCodingContainerRequest,\n  SyncCloudCodingContainerResponse,\n} from \"@elizaos/shared\";\n\n// ─── Container Types ────────────────────────────────────────────────────────\n\nexport type ContainerStatus =\n  | \"pending\"\n  | \"building\"\n  | \"deploying\"\n  | \"running\"\n  | \"stopped\"\n  | \"failed\"\n  | \"suspended\";\n\nexport type ContainerBillingStatus =\n  | \"active\"\n  | \"warning\"\n  | \"suspended\"\n  | \"shutdown_pending\"\n  | \"archived\";\n\nexport type ContainerArchitecture = \"arm64\" | \"x86_64\";\n\nexport interface CloudContainer {\n  id: string;\n  name: string;\n  project_name: string;\n  description: string | null;\n  organization_id: string;\n  user_id: string;\n  status: ContainerStatus;\n  image_tag: string | null;\n  port: number;\n  desired_count: number;\n  cpu: number;\n  memory: number;\n  architecture: ContainerArchitecture;\n  environment_vars: Record<string, string>;\n  health_check_path: string;\n  load_balancer_url: string | null;\n  ecr_repository_uri: string | null;\n  ecr_image_tag: string | null;\n  cloudformation_stack_name: string | null;\n  billing_status: ContainerBillingStatus;\n  total_billed: string;\n  last_deployed_at: string | null;\n  last_health_check: string | null;\n  deployment_log: string | null;\n  error_message: string | null;\n  metadata: Record<string, unknown>;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface CreateContainerRequest {\n  name: string;\n  project_name: string;\n  description?: string;\n  port?: number;\n  desired_count?: number;\n  cpu?: number;\n  memory?: number;\n  environment_vars?: Record<string, string>;\n  health_check_path?: string;\n  ecr_image_uri: string;\n  ecr_repository_uri?: string;\n  image_tag?: string;\n  architecture?: ContainerArchitecture;\n}\n\nexport interface CreateContainerResponse {\n  success: boolean;\n  data: CloudContainer;\n  message: string;\n  creditsDeducted: number;\n  creditsRemaining: number;\n  stackName: string;\n  polling: {\n    endpoint: string;\n    intervalMs: number;\n    expectedDurationMs: number;\n  };\n}\n\nexport interface ContainerListResponse {\n  success: boolean;\n  data: CloudContainer[];\n}\n\nexport interface ContainerGetResponse {\n  success: boolean;\n  data: CloudContainer;\n}\n\nexport interface ContainerDeleteResponse {\n  success: boolean;\n  message?: string;\n}\n\nexport interface ContainerHealthResponse {\n  success: boolean;\n  data: {\n    status: string;\n    healthy: boolean;\n    lastCheck: string | null;\n    uptime: number | null;\n  };\n}\n\n// ─── Auth Types ─────────────────────────────────────────────────────────────\n\nexport type DevicePlatform = \"ios\" | \"android\" | \"macos\" | \"windows\" | \"linux\" | \"web\";\n\nexport interface DeviceAuthRequest {\n  deviceId: string;\n  platform: DevicePlatform;\n  appVersion: string;\n  deviceName?: string;\n}\n\nexport interface DeviceAuthResponse {\n  success: boolean;\n  data: {\n    apiKey: string;\n    userId: string;\n    organizationId: string;\n    credits: number;\n    isNew: boolean;\n  };\n}\n\nexport interface CloudCredentials {\n  apiKey: string;\n  userId: string;\n  organizationId: string;\n  authenticatedAt: number;\n}\n\n// ─── Credits Types ──────────────────────────────────────────────────────────\n\nexport interface CreditBalanceResponse {\n  success: boolean;\n  data: {\n    balance: number;\n    currency: string;\n  };\n}\n\nexport interface CreditSummaryResponse {\n  success: boolean;\n  data: {\n    balance: number;\n    totalSpent: number;\n    totalAdded: number;\n    recentTransactions: CreditTransaction[];\n  };\n}\n\nexport interface CreditTransaction {\n  id: string;\n  amount: number;\n  description: string;\n  type: \"credit\" | \"debit\";\n  created_at: string;\n}\n\n// ─── Bridge Types ───────────────────────────────────────────────────────────\n\nexport type BridgeConnectionState = \"disconnected\" | \"connecting\" | \"connected\" | \"reconnecting\";\n\nexport interface BridgeMessage {\n  jsonrpc: \"2.0\";\n  id?: string | number;\n  method?: string;\n  params?: Record<string, unknown>;\n  result?: unknown;\n  error?: BridgeError;\n}\n\nexport interface BridgeError {\n  code: number;\n  message: string;\n  data?: unknown;\n}\n\nexport type BridgeMessageHandler = (message: BridgeMessage) => void;\n\nexport interface BridgeConnection {\n  containerId: string;\n  state: BridgeConnectionState;\n  connectedAt: number | null;\n  lastHeartbeat: number | null;\n  reconnectAttempts: number;\n}\n\n// ─── Managed Gateway Relay Types ───────────────────────────────────────────\n\nexport interface GatewayRelaySession {\n  id: string;\n  organizationId: string;\n  userId: string;\n  runtimeAgentId: string;\n  agentName: string | null;\n  platform: \"local-runtime\";\n  createdAt: string;\n  lastSeenAt: string;\n}\n\nexport interface GatewayRelayRequest {\n  jsonrpc: \"2.0\";\n  id?: string | number;\n  method: string;\n  params?: Record<string, unknown>;\n}\n\nexport interface GatewayRelayResponse {\n  jsonrpc: \"2.0\";\n  id?: string | number;\n  result?: Record<string, unknown>;\n  error?: BridgeError;\n}\n\nexport interface GatewayRelayRequestEnvelope {\n  requestId: string;\n  rpc: GatewayRelayRequest;\n  queuedAt: string;\n}\n\nexport interface RegisterGatewayRelaySessionResponse {\n  success: boolean;\n  data: {\n    session: GatewayRelaySession;\n  };\n}\n\nexport interface PollGatewayRelayResponse {\n  success: boolean;\n  data: {\n    request: GatewayRelayRequestEnvelope | null;\n  };\n}\n\n// ─── Snapshot / Backup Types ────────────────────────────────────────────────\n\nexport type SnapshotType = \"manual\" | \"auto\" | \"pre-eviction\";\n\nexport interface AgentSnapshot {\n  id: string;\n  containerId: string;\n  organizationId: string;\n  snapshotType: SnapshotType;\n  storageUrl: string;\n  sizeBytes: number;\n  agentConfig: Record<string, unknown>;\n  metadata: Record<string, unknown>;\n  created_at: string;\n}\n\nexport interface CreateSnapshotRequest {\n  snapshotType?: SnapshotType;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface CreateSnapshotResponse {\n  success: boolean;\n  data: AgentSnapshot;\n}\n\nexport interface SnapshotListResponse {\n  success: boolean;\n  data: AgentSnapshot[];\n}\n\nexport interface RestoreSnapshotRequest {\n  snapshotId: string;\n}\n\nexport interface RestoreSnapshotResponse {\n  success: boolean;\n  message: string;\n}\n\n// ─── Cloud Config Types ─────────────────────────────────────────────────────\n\nexport type InferenceMode = \"cloud\" | \"byok\" | \"local\";\n\nexport interface CloudPluginConfig {\n  /** Enable ElizaCloud integration. */\n  enabled: boolean;\n  /** ElizaCloud API base URL. */\n  baseUrl: string;\n  /** Stored API key for authenticated requests. */\n  apiKey?: string;\n  /** Device ID used for auto-signup authentication. */\n  deviceId?: string;\n  /** Platform identifier. */\n  platform?: DevicePlatform;\n  /** Inference mode: cloud (ElizaCloud proxied), byok (user keys), local (no cloud). */\n  inferenceMode: InferenceMode;\n  /** Auto-deploy agents to cloud on creation. */\n  autoProvision: boolean;\n  /** Bridge reconnection settings. */\n  bridge: {\n    reconnectIntervalMs: number;\n    maxReconnectAttempts: number;\n    heartbeatIntervalMs: number;\n  };\n  /** Auto-backup settings. */\n  backup: {\n    autoBackupIntervalMs: number;\n    maxSnapshots: number;\n  };\n  /** Default container settings for new deployments. */\n  container: {\n    defaultImage: string;\n    defaultArchitecture: ContainerArchitecture;\n    defaultCpu: number;\n    defaultMemory: number;\n    defaultPort: number;\n  };\n}\n\nexport const DEFAULT_CLOUD_CONFIG: CloudPluginConfig = {\n  enabled: false,\n  baseUrl: \"https://www.elizacloud.ai/api/v1\",\n  inferenceMode: \"cloud\",\n  autoProvision: false,\n  bridge: {\n    reconnectIntervalMs: 3000,\n    maxReconnectAttempts: 20,\n    heartbeatIntervalMs: 30_000,\n  },\n  backup: {\n    autoBackupIntervalMs: 3_600_000, // 1 hour\n    maxSnapshots: 10,\n  },\n  container: {\n    defaultImage: \"elizaos/agent:latest\",\n    defaultArchitecture: \"arm64\",\n    defaultCpu: 1792,\n    defaultMemory: 1792,\n    defaultPort: 3000,\n  },\n};\n\n// ─── API Error Types ────────────────────────────────────────────────────────\n\nexport type { CloudApiErrorBody } from \"@elizaos/cloud-sdk\";\nexport {\n  CloudApiError,\n  InsufficientCreditsError,\n} from \"@elizaos/cloud-sdk\";\n",
+    "/**\n * CloudBackupService — Agent state snapshots and restore.\n *\n * Creates, lists, and restores agent state snapshots through the ElizaCloud\n * API. Supports manual snapshots, periodic auto-backup, and pre-eviction\n * snapshots triggered by the billing system's low-credit warning.\n */\n\nimport { type IAgentRuntime, logger, Service } from \"@elizaos/core\";\nimport type {\n  AgentSnapshot,\n  CreateSnapshotResponse,\n  RestoreSnapshotResponse,\n  SnapshotListResponse,\n  SnapshotType,\n} from \"../types/cloud\";\nimport { DEFAULT_CLOUD_CONFIG } from \"../types/cloud\";\nimport type { CloudAuthService } from \"./cloud-auth\";\n\ninterface AutoBackupEntry {\n  containerId: string;\n  timer: ReturnType<typeof setInterval>;\n  lastBackupAt: number | null;\n}\n\nexport class CloudBackupService extends Service {\n  static serviceType = \"CLOUD_BACKUP\";\n  capabilityDescription = \"ElizaCloud agent state backup and restore\";\n\n  private authService!: CloudAuthService;\n  private autoBackups: Map<string, AutoBackupEntry> = new Map();\n  private readonly maxSnapshots = DEFAULT_CLOUD_CONFIG.backup.maxSnapshots;\n  private readonly backupIntervalMs = DEFAULT_CLOUD_CONFIG.backup.autoBackupIntervalMs;\n\n  static async start(runtime: IAgentRuntime): Promise<Service> {\n    const service = new CloudBackupService(runtime);\n    await service.initialize();\n    return service;\n  }\n\n  async stop(): Promise<void> {\n    for (const [, entry] of this.autoBackups) {\n      clearInterval(entry.timer);\n    }\n    this.autoBackups.clear();\n    logger.info(\"[CloudBackup] Service stopped\");\n  }\n\n  private async initialize(): Promise<void> {\n    const auth = this.runtime.getService(\"CLOUD_AUTH\");\n    if (!auth) {\n      logger.debug(\"[CloudBackup] CloudAuthService not available\");\n      return;\n    }\n    this.authService = auth as CloudAuthService;\n    logger.info(\"[CloudBackup] Service initialized\");\n  }\n\n  // ─── Snapshot CRUD ─────────────────────────────────────────────────────\n\n  async createSnapshot(\n    containerId: string,\n    snapshotType: SnapshotType = \"manual\",\n    metadata?: Record<string, unknown>\n  ): Promise<AgentSnapshot> {\n    const client = this.authService.getClient();\n    const response = await client.post<CreateSnapshotResponse>(\n      `/agent-state/${containerId}/snapshot`,\n      { snapshotType, metadata }\n    );\n\n    logger.info(\n      `[CloudBackup] Created ${snapshotType} snapshot for container ${containerId} (id=${response.data.id}, size=${formatBytes(response.data.sizeBytes)})`\n    );\n\n    // Update last backup timestamp for auto-backup tracking\n    const autoEntry = this.autoBackups.get(containerId);\n    if (autoEntry) {\n      autoEntry.lastBackupAt = Date.now();\n    }\n\n    return response.data;\n  }\n\n  async listSnapshots(containerId: string): Promise<AgentSnapshot[]> {\n    const client = this.authService.getClient();\n    const response = await client.get<SnapshotListResponse>(\n      `/agent-state/${containerId}/snapshots`\n    );\n    return response.data;\n  }\n\n  async restoreSnapshot(containerId: string, snapshotId: string): Promise<void> {\n    const client = this.authService.getClient();\n\n    await client.post<RestoreSnapshotResponse>(`/agent-state/${containerId}/restore`, {\n      snapshotId,\n    });\n\n    logger.info(`[CloudBackup] Restored snapshot ${snapshotId} for container ${containerId}`);\n  }\n\n  async getLatestSnapshot(containerId: string): Promise<AgentSnapshot | null> {\n    const snapshots = await this.listSnapshots(containerId);\n    if (snapshots.length === 0) return null;\n\n    // Sort by created_at descending and return the most recent\n    snapshots.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());\n    return snapshots[0];\n  }\n\n  // ─── Auto-Backup Scheduling ────────────────────────────────────────────\n\n  scheduleAutoBackup(containerId: string, intervalMs?: number): void {\n    // Don't double-schedule\n    if (this.autoBackups.has(containerId)) {\n      logger.debug(`[CloudBackup] Auto-backup already scheduled for ${containerId}`);\n      return;\n    }\n\n    const interval = intervalMs ?? this.backupIntervalMs;\n\n    const timer = setInterval(() => {\n      logger.debug(`[CloudBackup] Running auto-backup for container ${containerId}`);\n      this.createSnapshot(containerId, \"auto\", {\n        trigger: \"scheduled\",\n        scheduledIntervalMs: interval,\n      })\n        .then(() => this.pruneSnapshots(containerId))\n        .catch((err: Error) => {\n          logger.error(`[CloudBackup] Auto-backup failed for ${containerId}: ${err.message}`);\n        });\n    }, interval);\n\n    this.autoBackups.set(containerId, {\n      containerId,\n      timer,\n      lastBackupAt: null,\n    });\n\n    logger.info(\n      `[CloudBackup] Scheduled auto-backup for ${containerId} every ${Math.round(interval / 60_000)} minutes`\n    );\n  }\n\n  cancelAutoBackup(containerId: string): void {\n    const entry = this.autoBackups.get(containerId);\n    if (!entry) return;\n\n    clearInterval(entry.timer);\n    this.autoBackups.delete(containerId);\n    logger.info(`[CloudBackup] Cancelled auto-backup for ${containerId}`);\n  }\n\n  /**\n   * Create a pre-eviction snapshot. Called when the billing system sends\n   * a low-credit warning before shutting down the container.\n   */\n  async createPreEvictionSnapshot(containerId: string): Promise<AgentSnapshot> {\n    logger.info(`[CloudBackup] Creating pre-eviction snapshot for ${containerId}`);\n    return this.createSnapshot(containerId, \"pre-eviction\", {\n      trigger: \"billing-eviction\",\n      createdAt: new Date().toISOString(),\n    });\n  }\n\n  // ─── Snapshot Pruning ──────────────────────────────────────────────────\n\n  /**\n   * Remove the oldest auto snapshots beyond maxSnapshots limit.\n   * Manual and pre-eviction snapshots are never pruned.\n   */\n  private async pruneSnapshots(containerId: string): Promise<void> {\n    const snapshots = await this.listSnapshots(containerId);\n\n    const autoSnapshots = snapshots\n      .filter((s) => s.snapshotType === \"auto\")\n      .sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());\n\n    const excess = autoSnapshots.slice(this.maxSnapshots);\n    if (excess.length === 0) return;\n\n    const client = this.authService.getClient();\n    for (const snapshot of excess) {\n      await client.delete(`/agent-state/${containerId}/snapshots/${snapshot.id}`);\n      logger.debug(`[CloudBackup] Pruned old auto snapshot ${snapshot.id} for ${containerId}`);\n    }\n\n    logger.info(`[CloudBackup] Pruned ${excess.length} old auto snapshot(s) for ${containerId}`);\n  }\n\n  // ─── Accessors ─────────────────────────────────────────────────────────\n\n  isAutoBackupScheduled(containerId: string): boolean {\n    return this.autoBackups.has(containerId);\n  }\n\n  getLastBackupTime(containerId: string): number | null {\n    return this.autoBackups.get(containerId)?.lastBackupAt ?? null;\n  }\n}\n\nfunction formatBytes(bytes: number): string {\n  if (bytes < 1024) return `${bytes} B`;\n  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAsXA;AAAA;AAAA;AAAA;AA1BO,IAAM,uBAA0C;AAAA,EACrD,SAAS;AAAA,EACT,SAAS;AAAA,EACT,eAAe;AAAA,EACf,eAAe;AAAA,EACf,QAAQ;AAAA,IACN,qBAAqB;AAAA,IACrB,sBAAsB;AAAA,IACtB,qBAAqB;AAAA,EACvB;AAAA,EACA,QAAQ;AAAA,IACN,sBAAsB;AAAA,IACtB,cAAc;AAAA,EAChB;AAAA,EACA,WAAW;AAAA,IACT,cAAc;AAAA,IACd,qBAAqB;AAAA,IACrB,YAAY;AAAA,IACZ,eAAe;AAAA,IACf,aAAa;AAAA,EACf;AACF;;;ACzWA;AAiBO,MAAM,2BAA2B,QAAQ;AAAA,SACvC,cAAc;AAAA,EACrB,wBAAwB;AAAA,EAEhB;AAAA,EACA,cAA4C,IAAI;AAAA,EACvC,eAAe,qBAAqB,OAAO;AAAA,EAC3C,mBAAmB,qBAAqB,OAAO;AAAA,cAEnD,MAAK,CAAC,SAA0C;AAAA,IAC3D,MAAM,UAAU,IAAI,mBAAmB,OAAO;AAAA,IAC9C,MAAM,QAAQ,WAAW;AAAA,IACzB,OAAO;AAAA;AAAA,OAGH,KAAI,GAAkB;AAAA,IAC1B,cAAc,UAAU,KAAK,aAAa;AAAA,MACxC,cAAc,MAAM,KAAK;AAAA,IAC3B;AAAA,IACA,KAAK,YAAY,MAAM;AAAA,IACvB,OAAO,KAAK,+BAA+B;AAAA;AAAA,OAG/B,WAAU,GAAkB;AAAA,IACxC,MAAM,OAAO,KAAK,QAAQ,WAAW,YAAY;AAAA,IACjD,IAAI,CAAC,MAAM;AAAA,MACT,OAAO,MAAM,8CAA8C;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,KAAK,cAAc;AAAA,IACnB,OAAO,KAAK,mCAAmC;AAAA;AAAA,OAK3C,eAAc,CAClB,aACA,eAA6B,UAC7B,UACwB;AAAA,IACxB,MAAM,SAAS,KAAK,YAAY,UAAU;AAAA,IAC1C,MAAM,WAAW,MAAM,OAAO,KAC5B,gBAAgB,wBAChB,EAAE,cAAc,SAAS,CAC3B;AAAA,IAEA,OAAO,KACL,yBAAyB,uCAAuC,mBAAmB,SAAS,KAAK,YAAY,YAAY,SAAS,KAAK,SAAS,IAClJ;AAAA,IAGA,MAAM,YAAY,KAAK,YAAY,IAAI,WAAW;AAAA,IAClD,IAAI,WAAW;AAAA,MACb,UAAU,eAAe,KAAK,IAAI;AAAA,IACpC;AAAA,IAEA,OAAO,SAAS;AAAA;AAAA,OAGZ,cAAa,CAAC,aAA+C;AAAA,IACjE,MAAM,SAAS,KAAK,YAAY,UAAU;AAAA,IAC1C,MAAM,WAAW,MAAM,OAAO,IAC5B,gBAAgB,uBAClB;AAAA,IACA,OAAO,SAAS;AAAA;AAAA,OAGZ,gBAAe,CAAC,aAAqB,YAAmC;AAAA,IAC5E,MAAM,SAAS,KAAK,YAAY,UAAU;AAAA,IAE1C,MAAM,OAAO,KAA8B,gBAAgB,uBAAuB;AAAA,MAChF;AAAA,IACF,CAAC;AAAA,IAED,OAAO,KAAK,mCAAmC,4BAA4B,aAAa;AAAA;AAAA,OAGpF,kBAAiB,CAAC,aAAoD;AAAA,IAC1E,MAAM,YAAY,MAAM,KAAK,cAAc,WAAW;AAAA,IACtD,IAAI,UAAU,WAAW;AAAA,MAAG,OAAO;AAAA,IAGnC,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC;AAAA,IAC5F,OAAO,UAAU;AAAA;AAAA,EAKnB,kBAAkB,CAAC,aAAqB,YAA2B;AAAA,IAEjE,IAAI,KAAK,YAAY,IAAI,WAAW,GAAG;AAAA,MACrC,OAAO,MAAM,mDAAmD,aAAa;AAAA,MAC7E;AAAA,IACF;AAAA,IAEA,MAAM,WAAW,cAAc,KAAK;AAAA,IAEpC,MAAM,QAAQ,YAAY,MAAM;AAAA,MAC9B,OAAO,MAAM,mDAAmD,aAAa;AAAA,MAC7E,KAAK,eAAe,aAAa,QAAQ;AAAA,QACvC,SAAS;AAAA,QACT,qBAAqB;AAAA,MACvB,CAAC,EACE,KAAK,MAAM,KAAK,eAAe,WAAW,CAAC,EAC3C,MAAM,CAAC,QAAe;AAAA,QACrB,OAAO,MAAM,wCAAwC,gBAAgB,IAAI,SAAS;AAAA,OACnF;AAAA,OACF,QAAQ;AAAA,IAEX,KAAK,YAAY,IAAI,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAAA,IAED,OAAO,KACL,2CAA2C,qBAAqB,KAAK,MAAM,WAAW,KAAM,WAC9F;AAAA;AAAA,EAGF,gBAAgB,CAAC,aAA2B;AAAA,IAC1C,MAAM,QAAQ,KAAK,YAAY,IAAI,WAAW;AAAA,IAC9C,IAAI,CAAC;AAAA,MAAO;AAAA,IAEZ,cAAc,MAAM,KAAK;AAAA,IACzB,KAAK,YAAY,OAAO,WAAW;AAAA,IACnC,OAAO,KAAK,2CAA2C,aAAa;AAAA;AAAA,OAOhE,0BAAyB,CAAC,aAA6C;AAAA,IAC3E,OAAO,KAAK,oDAAoD,aAAa;AAAA,IAC7E,OAAO,KAAK,eAAe,aAAa,gBAAgB;AAAA,MACtD,SAAS;AAAA,MACT,WAAW,IAAI,KAAK,EAAE,YAAY;AAAA,IACpC,CAAC;AAAA;AAAA,OASW,eAAc,CAAC,aAAoC;AAAA,IAC/D,MAAM,YAAY,MAAM,KAAK,cAAc,WAAW;AAAA,IAEtD,MAAM,gBAAgB,UACnB,OAAO,CAAC,MAAM,EAAE,iBAAiB,MAAM,EACvC,KAAK,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC;AAAA,IAErF,MAAM,SAAS,cAAc,MAAM,KAAK,YAAY;AAAA,IACpD,IAAI,OAAO,WAAW;AAAA,MAAG;AAAA,IAEzB,MAAM,SAAS,KAAK,YAAY,UAAU;AAAA,IAC1C,WAAW,YAAY,QAAQ;AAAA,MAC7B,MAAM,OAAO,OAAO,gBAAgB,yBAAyB,SAAS,IAAI;AAAA,MAC1E,OAAO,MAAM,0CAA0C,SAAS,UAAU,aAAa;AAAA,IACzF;AAAA,IAEA,OAAO,KAAK,wBAAwB,OAAO,mCAAmC,aAAa;AAAA;AAAA,EAK7F,qBAAqB,CAAC,aAA8B;AAAA,IAClD,OAAO,KAAK,YAAY,IAAI,WAAW;AAAA;AAAA,EAGzC,iBAAiB,CAAC,aAAoC;AAAA,IACpD,OAAO,KAAK,YAAY,IAAI,WAAW,GAAG,gBAAgB;AAAA;AAE9D;AAEA,SAAS,WAAW,CAAC,OAAuB;AAAA,EAC1C,IAAI,QAAQ;AAAA,IAAM,OAAO,GAAG;AAAA,EAC5B,IAAI,QAAQ,OAAO;AAAA,IAAM,OAAO,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,EAC3D,IAAI,QAAQ,OAAO,OAAO;AAAA,IAAM,OAAO,IAAI,SAAS,OAAO,OAAO,QAAQ,CAAC;AAAA,EAC3E,OAAO,IAAI,SAAS,OAAO,OAAO,OAAO,QAAQ,CAAC;AAAA;",
+  "debugId": "3A3130D224AC9DB064756E2164756E21",
+  "names": []
+}

package/dist/services/cloud-bootstrap.d.ts

@@ -0,0 +1,38 @@
+/**
+ * CloudBootstrapService — service-port that exposes Eliza Cloud bootstrap
+ * verification endpoints to `app-core` via the runtime service registry.
+ *
+ * The actual JWKS fetch / cache and bootstrap-token verify path lives in
+ * `app-core` (`services/cloud-jwks-store.ts` and `api/auth/bootstrap-token.ts`).
+ * This service intentionally has a minimal surface: it answers questions
+ * about the cloud trust anchor (issuer, JWKS URL, revocation list URL,
+ * expected container id) so that `app-core` does not need to import
+ * directly from `@elizaos/plugin-elizacloud`.
+ *
+ * Hard rule (per remote-auth-hardening-plan §3.2): no fail-open. If the
+ * cloud issuer is not configured, `getExpectedIssuer()` throws and the
+ * consumer must reject the bootstrap exchange — the runtime never silently
+ * trusts a default URL.
+ */
+import { type IAgentRuntime, Service } from "@elizaos/core";
+export interface CloudBootstrapService {
+    /** Returns `${ELIZA_CLOUD_ISSUER}/.well-known/jwks.json`. */
+    getJwksUrl(): string;
+    /** Returns `${ELIZA_CLOUD_ISSUER}/.well-known/revocations.json`. */
+    getRevocationListUrl(): string;
+    /** Returns the configured `ELIZA_CLOUD_ISSUER`. Throws when unset. */
+    getExpectedIssuer(): string;
+    /** Returns the configured `ELIZA_CLOUD_CONTAINER_ID`, or `null` when unset. */
+    getExpectedContainerId(): string | null;
+}
+export declare class CloudBootstrapServiceImpl extends Service implements CloudBootstrapService {
+    static serviceType: string;
+    capabilityDescription: string;
+    static start(runtime: IAgentRuntime): Promise<Service>;
+    stop(): Promise<void>;
+    getExpectedIssuer(): string;
+    getJwksUrl(): string;
+    getRevocationListUrl(): string;
+    getExpectedContainerId(): string | null;
+}
+//# sourceMappingURL=cloud-bootstrap.d.ts.map

package/dist/services/cloud-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-bootstrap.d.ts","sourceRoot":"","sources":["../../src/services/cloud-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,aAAa,EAA+B,OAAO,EAAE,MAAM,eAAe,CAAC;AAEzF,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,UAAU,IAAI,MAAM,CAAC;IACrB,oEAAoE;IACpE,oBAAoB,IAAI,MAAM,CAAC;IAC/B,sEAAsE;IACtE,iBAAiB,IAAI,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAAC;CACzC;AA+BD,qBAAa,yBAA0B,SAAQ,OAAQ,YAAW,qBAAqB;IACrF,MAAM,CAAC,WAAW,SAAqB;IACvC,qBAAqB,SAC2G;WAEnH,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,iBAAiB,IAAI,MAAM;IAU3B,UAAU,IAAI,MAAM;IAIpB,oBAAoB,IAAI,MAAM;IAI9B,sBAAsB,IAAI,MAAM,GAAG,IAAI;CAGxC"}

package/dist/services/cloud-bootstrap.js

@@ -0,0 +1,84 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/services/cloud-bootstrap.ts
+import { logger, Service } from "@elizaos/core";
+function readEnv() {
+  if (typeof process === "undefined") {
+    return {};
+  }
+  return process.env;
+}
+function readSetting(runtime, key) {
+  if (runtime && typeof runtime.getSetting === "function") {
+    const value = runtime.getSetting(key);
+    if (typeof value === "string" && value.length > 0) {
+      return value;
+    }
+  }
+  const fromEnv = readEnv()[key];
+  if (typeof fromEnv === "string" && fromEnv.length > 0) {
+    return fromEnv;
+  }
+  return null;
+}
+function trimTrailingSlash(input) {
+  let end = input.length;
+  while (end > 0 && input.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === input.length ? input : input.slice(0, end);
+}
+
+class CloudBootstrapServiceImpl extends Service {
+  static serviceType = "CLOUD_BOOTSTRAP";
+  capabilityDescription = "Exposes Eliza Cloud bootstrap-token trust anchor (issuer, JWKS URL, revocation list URL, expected container id) to app-core";
+  static async start(runtime) {
+    const service = new CloudBootstrapServiceImpl(runtime);
+    const issuer = readSetting(runtime, "ELIZA_CLOUD_ISSUER");
+    const containerId = readSetting(runtime, "ELIZA_CLOUD_CONTAINER_ID");
+    if (issuer) {
+      logger.info(`[CloudBootstrap] Trust anchor configured (issuer=${issuer}, containerId=${containerId ?? "<unset>"})`);
+    } else {
+      logger.debug("[CloudBootstrap] ELIZA_CLOUD_ISSUER unset — bootstrap-token verification will reject until configured");
+    }
+    return service;
+  }
+  async stop() {}
+  getExpectedIssuer() {
+    const issuer = readSetting(this.runtime, "ELIZA_CLOUD_ISSUER");
+    if (!issuer) {
+      throw new Error("ELIZA_CLOUD_ISSUER is not configured — bootstrap-token verification cannot proceed");
+    }
+    return trimTrailingSlash(issuer);
+  }
+  getJwksUrl() {
+    return `${this.getExpectedIssuer()}/.well-known/jwks.json`;
+  }
+  getRevocationListUrl() {
+    return `${this.getExpectedIssuer()}/.well-known/revocations.json`;
+  }
+  getExpectedContainerId() {
+    return readSetting(this.runtime, "ELIZA_CLOUD_CONTAINER_ID");
+  }
+}
+export {
+  CloudBootstrapServiceImpl
+};
+
+//# debugId=8AC6CE0E4399D14364756E2164756E21

package/dist/services/cloud-bootstrap.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/services/cloud-bootstrap.ts"],
+  "sourcesContent": [
+    "/**\n * CloudBootstrapService — service-port that exposes Eliza Cloud bootstrap\n * verification endpoints to `app-core` via the runtime service registry.\n *\n * The actual JWKS fetch / cache and bootstrap-token verify path lives in\n * `app-core` (`services/cloud-jwks-store.ts` and `api/auth/bootstrap-token.ts`).\n * This service intentionally has a minimal surface: it answers questions\n * about the cloud trust anchor (issuer, JWKS URL, revocation list URL,\n * expected container id) so that `app-core` does not need to import\n * directly from `@elizaos/plugin-elizacloud`.\n *\n * Hard rule (per remote-auth-hardening-plan §3.2): no fail-open. If the\n * cloud issuer is not configured, `getExpectedIssuer()` throws and the\n * consumer must reject the bootstrap exchange — the runtime never silently\n * trusts a default URL.\n */\n\nimport { type IAgentRuntime, logger, type ProcessEnvLike, Service } from \"@elizaos/core\";\n\nexport interface CloudBootstrapService {\n  /** Returns `${ELIZA_CLOUD_ISSUER}/.well-known/jwks.json`. */\n  getJwksUrl(): string;\n  /** Returns `${ELIZA_CLOUD_ISSUER}/.well-known/revocations.json`. */\n  getRevocationListUrl(): string;\n  /** Returns the configured `ELIZA_CLOUD_ISSUER`. Throws when unset. */\n  getExpectedIssuer(): string;\n  /** Returns the configured `ELIZA_CLOUD_CONTAINER_ID`, or `null` when unset. */\n  getExpectedContainerId(): string | null;\n}\n\nfunction readEnv(): ProcessEnvLike {\n  if (typeof process === \"undefined\") {\n    return {};\n  }\n  return process.env as ProcessEnvLike;\n}\n\nfunction readSetting(runtime: IAgentRuntime | undefined, key: string): string | null {\n  if (runtime && typeof runtime.getSetting === \"function\") {\n    const value = runtime.getSetting(key);\n    if (typeof value === \"string\" && value.length > 0) {\n      return value;\n    }\n  }\n  const fromEnv = readEnv()[key];\n  if (typeof fromEnv === \"string\" && fromEnv.length > 0) {\n    return fromEnv;\n  }\n  return null;\n}\n\nfunction trimTrailingSlash(input: string): string {\n  let end = input.length;\n  while (end > 0 && input.charCodeAt(end - 1) === 0x2f) {\n    end -= 1;\n  }\n  return end === input.length ? input : input.slice(0, end);\n}\n\nexport class CloudBootstrapServiceImpl extends Service implements CloudBootstrapService {\n  static serviceType = \"CLOUD_BOOTSTRAP\";\n  capabilityDescription =\n    \"Exposes Eliza Cloud bootstrap-token trust anchor (issuer, JWKS URL, revocation list URL, expected container id) to app-core\";\n\n  static async start(runtime: IAgentRuntime): Promise<Service> {\n    const service = new CloudBootstrapServiceImpl(runtime);\n    const issuer = readSetting(runtime, \"ELIZA_CLOUD_ISSUER\");\n    const containerId = readSetting(runtime, \"ELIZA_CLOUD_CONTAINER_ID\");\n    if (issuer) {\n      logger.info(\n        `[CloudBootstrap] Trust anchor configured (issuer=${issuer}, containerId=${containerId ?? \"<unset>\"})`\n      );\n    } else {\n      logger.debug(\n        \"[CloudBootstrap] ELIZA_CLOUD_ISSUER unset — bootstrap-token verification will reject until configured\"\n      );\n    }\n    return service;\n  }\n\n  async stop(): Promise<void> {\n    // No persistent state to tear down.\n  }\n\n  getExpectedIssuer(): string {\n    const issuer = readSetting(this.runtime, \"ELIZA_CLOUD_ISSUER\");\n    if (!issuer) {\n      throw new Error(\n        \"ELIZA_CLOUD_ISSUER is not configured — bootstrap-token verification cannot proceed\"\n      );\n    }\n    return trimTrailingSlash(issuer);\n  }\n\n  getJwksUrl(): string {\n    return `${this.getExpectedIssuer()}/.well-known/jwks.json`;\n  }\n\n  getRevocationListUrl(): string {\n    return `${this.getExpectedIssuer()}/.well-known/revocations.json`;\n  }\n\n  getExpectedContainerId(): string | null {\n    return readSetting(this.runtime, \"ELIZA_CLOUD_CONTAINER_ID\");\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAiBA;AAaA,SAAS,OAAO,GAAmB;AAAA,EACjC,IAAI,OAAO,YAAY,aAAa;AAAA,IAClC,OAAO,CAAC;AAAA,EACV;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,WAAW,CAAC,SAAoC,KAA4B;AAAA,EACnF,IAAI,WAAW,OAAO,QAAQ,eAAe,YAAY;AAAA,IACvD,MAAM,QAAQ,QAAQ,WAAW,GAAG;AAAA,IACpC,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AAAA,MACjD,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,MAAM,UAAU,QAAQ,EAAE;AAAA,EAC1B,IAAI,OAAO,YAAY,YAAY,QAAQ,SAAS,GAAG;AAAA,IACrD,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,iBAAiB,CAAC,OAAuB;AAAA,EAChD,IAAI,MAAM,MAAM;AAAA,EAChB,OAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM,IAAM;AAAA,IACpD,OAAO;AAAA,EACT;AAAA,EACA,OAAO,QAAQ,MAAM,SAAS,QAAQ,MAAM,MAAM,GAAG,GAAG;AAAA;AAAA;AAGnD,MAAM,kCAAkC,QAAyC;AAAA,SAC/E,cAAc;AAAA,EACrB,wBACE;AAAA,cAEW,MAAK,CAAC,SAA0C;AAAA,IAC3D,MAAM,UAAU,IAAI,0BAA0B,OAAO;AAAA,IACrD,MAAM,SAAS,YAAY,SAAS,oBAAoB;AAAA,IACxD,MAAM,cAAc,YAAY,SAAS,0BAA0B;AAAA,IACnE,IAAI,QAAQ;AAAA,MACV,OAAO,KACL,oDAAoD,uBAAuB,eAAe,YAC5F;AAAA,IACF,EAAO;AAAA,MACL,OAAO,MACL,uGACF;AAAA;AAAA,IAEF,OAAO;AAAA;AAAA,OAGH,KAAI,GAAkB;AAAA,EAI5B,iBAAiB,GAAW;AAAA,IAC1B,MAAM,SAAS,YAAY,KAAK,SAAS,oBAAoB;AAAA,IAC7D,IAAI,CAAC,QAAQ;AAAA,MACX,MAAM,IAAI,MACR,oFACF;AAAA,IACF;AAAA,IACA,OAAO,kBAAkB,MAAM;AAAA;AAAA,EAGjC,UAAU,GAAW;AAAA,IACnB,OAAO,GAAG,KAAK,kBAAkB;AAAA;AAAA,EAGnC,oBAAoB,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,kBAAkB;AAAA;AAAA,EAGnC,sBAAsB,GAAkB;AAAA,IACtC,OAAO,YAAY,KAAK,SAAS,0BAA0B;AAAA;AAE/D;",
+  "debugId": "8AC6CE0E4399D14364756E2164756E21",
+  "names": []
+}

package/dist/services/cloud-bridge.d.ts

@@ -2,7 +2,7 @@
  * CloudBridgeService — WebSocket bridge to cloud-hosted agents.
  *
  * Establishes a JSON-RPC 2.0 WebSocket connection per container, allowing
- * the local milady client to send messages to and receive events from
+ * the local eliza client to send messages to and receive events from
  * cloud-hosted ElizaOS agents. Handles reconnection with exponential
  * backoff and heartbeat keepalive.
  */

package/dist/services/cloud-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-bridge.d.ts","sourceRoot":"","sources":["../../services/cloud-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EAErB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAwBxB,qBAAa,kBAAmB,SAAQ,OAAO;IAC7C,MAAM,CAAC,WAAW,SAAkB;IACpC,qBAAqB,SAAqD;IAE1E,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,WAAW,CAA4C;WAElD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,UAAU;IAYlB,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAsBtC,mBAAmB;IAyFjC,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,aAAa;IAerB;;OAEG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,SAAS,GACjB,OAAO,CAAC,OAAO,CAAC;IAyBnB;;OAEG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAe5F;;OAEG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAShE;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAK3E;;OAEG;IACG,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5F,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI;IA6BzE,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAI9D,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAa/D,wBAAwB,IAAI,MAAM,EAAE;CAOrC"}
+{"version":3,"file":"cloud-bridge.d.ts","sourceRoot":"","sources":["../../src/services/cloud-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EAErB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AA+BxB,qBAAa,kBAAmB,SAAQ,OAAO;IAC7C,MAAM,CAAC,WAAW,SAAkB;IACpC,qBAAqB,SAAqD;IAE1E,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,WAAW,CAA4C;WAElD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,UAAU;IAYlB,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAuBtC,mBAAmB;IA0FjC,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,aAAa;IAerB;;OAEG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,SAAS,GACjB,OAAO,CAAC,OAAO,CAAC;IAyBnB;;OAEG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAe5F;;OAEG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAShE;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAK3E;;OAEG;IACG,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5F,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI;IA6BzE,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB;IAI9D,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAa/D,wBAAwB,IAAI,MAAM,EAAE;CAOrC"}