@elizaos/plugin-elizacloud 2.0.0-beta.1 → 2.0.11-beta.7

package/dist/cloud/null-observer.js

@@ -0,0 +1,45 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/cloud/null-observer.ts
+class NullCloudSetupObserver {
+  onAvailabilityChecked(_result) {}
+  onAuthStart(_loginUrl) {}
+  onAuthBrowserOpenFailed(_loginUrl, _error) {}
+  onAuthPollStatus(_status) {}
+  onAuthSuccess() {}
+  onAuthFailure(_message) {}
+  onProvisionStart(_agentName) {}
+  onProvisionStatus(_status) {}
+  onProvisionTimeout(_agentId, _lastStatus) {}
+  onProvisionFailure(_reason) {}
+  onProvisionSuccess(_result) {}
+  onNotice(_message) {}
+  onFatalError(_error, _context) {}
+  async confirm(_prompt) {
+    return null;
+  }
+  async selectChoice(_prompt) {
+    return null;
+  }
+}
+export {
+  NullCloudSetupObserver
+};
+
+//# debugId=41A094308B5C165F64756E2164756E21

package/dist/cloud/null-observer.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/cloud/null-observer.ts"],
+  "sourcesContent": [
+    "/**\n * Silent `CloudSetupObserver` for tests and headless runs.\n *\n * - All event methods intentionally ignore their inputs.\n * - All prompt methods resolve to `null` (i.e. \"user cancelled\"), which\n *   lets the orchestrator exercise its cancel branches without surfacing\n *   any UI.\n *\n * Tests that want to assert observer calls should use a capturing\n * observer instead.\n *\n * @module cloud/null-observer\n */\nimport type {\n  CloudSetupObserver,\n  ConfirmPrompt,\n  ProvisionSuccessInfo,\n  SelectChoicePrompt,\n} from \"./setup-observer.js\";\n\nexport class NullCloudSetupObserver implements CloudSetupObserver {\n  onAvailabilityChecked(_result: { ok: boolean; reason?: string }): void {}\n  onAuthStart(_loginUrl: string): void {}\n  onAuthBrowserOpenFailed(_loginUrl: string, _error: Error): void {}\n  onAuthPollStatus(_status: string): void {}\n  onAuthSuccess(): void {}\n  onAuthFailure(_message: string): void {}\n  onProvisionStart(_agentName: string): void {}\n  onProvisionStatus(_status: string): void {}\n  onProvisionTimeout(_agentId: string, _lastStatus: string): void {}\n  onProvisionFailure(_reason: string): void {}\n  onProvisionSuccess(_result: ProvisionSuccessInfo): void {}\n  onNotice(_message: string): void {}\n  onFatalError(_error: Error, _context: string): void {}\n\n  async confirm(_prompt: ConfirmPrompt): Promise<boolean | null> {\n    return null;\n  }\n\n  async selectChoice<T extends string>(\n    _prompt: SelectChoicePrompt<T>,\n  ): Promise<T | null> {\n    return null;\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAoBO,MAAM,uBAAqD;AAAA,EAChE,qBAAqB,CAAC,SAAiD;AAAA,EACvE,WAAW,CAAC,WAAyB;AAAA,EACrC,uBAAuB,CAAC,WAAmB,QAAqB;AAAA,EAChE,gBAAgB,CAAC,SAAuB;AAAA,EACxC,aAAa,GAAS;AAAA,EACtB,aAAa,CAAC,UAAwB;AAAA,EACtC,gBAAgB,CAAC,YAA0B;AAAA,EAC3C,iBAAiB,CAAC,SAAuB;AAAA,EACzC,kBAAkB,CAAC,UAAkB,aAA2B;AAAA,EAChE,kBAAkB,CAAC,SAAuB;AAAA,EAC1C,kBAAkB,CAAC,SAAqC;AAAA,EACxD,QAAQ,CAAC,UAAwB;AAAA,EACjC,YAAY,CAAC,QAAe,UAAwB;AAAA,OAE9C,QAAO,CAAC,SAAiD;AAAA,IAC7D,OAAO;AAAA;AAAA,OAGH,aAA8B,CAClC,SACmB;AAAA,IACnB,OAAO;AAAA;AAEX;",
+  "debugId": "41A094308B5C165F64756E2164756E21",
+  "names": []
+}

package/dist/cloud/setup-observer.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Transport-agnostic observer for the cloud setup orchestrator.
+ *
+ * `runCloudSetup` calls into this interface for every user-visible
+ * event and every interactive prompt. CLI provides a `@clack/prompts`-
+ * backed implementation; web/desktop provides an event-bridge
+ * implementation; tests provide a capturing observer.
+ *
+ * The orchestrator MUST stay free of any presentation-layer concerns
+ * (spinners, terminal output, GUI events). It only knows about the
+ * methods defined here.
+ *
+ * @module cloud/setup-observer
+ */
+import type { ProvisionInfo } from "./bridge-client.js";
+export interface AvailabilityResult {
+    ok: boolean;
+    /** Human-readable reason when `ok` is false. */
+    reason?: string;
+}
+export interface ProvisionSuccessInfo {
+    agentId: string;
+    bridgeUrl?: string;
+}
+export interface ConfirmPrompt {
+    message: string;
+    /** Optional override for the default value when the user just presses enter. */
+    defaultValue?: boolean;
+    /** Optional label for the "true" branch. CLI surfaces use this on a toggle. */
+    activeLabel?: string;
+    /** Optional label for the "false" branch. CLI surfaces use this on a toggle. */
+    inactiveLabel?: string;
+}
+export interface SelectChoiceOption<T extends string> {
+    label: string;
+    value: T;
+    hint?: string;
+}
+export interface SelectChoicePrompt<T extends string> {
+    message: string;
+    options: SelectChoiceOption<T>[];
+}
+/**
+ * Sink for every event the cloud setup orchestrator surfaces, plus the
+ * interactive prompts it needs to resolve.
+ *
+ * Implementation contract:
+ *
+ *   - Event methods are fire-and-forget; they MUST NOT throw. Implementations
+ *     that fail to render an event are responsible for their own logging.
+ *   - Prompt methods are async. A `null` return from `selectChoice` or a
+ *     cancellation from `confirm` is interpreted by the orchestrator as
+ *     "user cancelled" — the orchestrator decides what that means for the
+ *     flow. The observer MUST NOT exit the process or throw on cancel.
+ */
+export interface CloudSetupObserver {
+    onAvailabilityChecked(result: AvailabilityResult): void;
+    onAuthStart(loginUrl: string): void;
+    /**
+     * The orchestrator could not spawn the OS browser (no `open` / `xdg-open`
+     * / `cmd.exe` on PATH, etc.). The login URL is unchanged — the observer
+     * can render an inline "visit this URL manually" affordance, retry, or
+     * surface the error however it wants. This was previously swallowed
+     * silently behind a debug log.
+     */
+    onAuthBrowserOpenFailed(loginUrl: string, error: Error): void;
+    onAuthPollStatus(status: string): void;
+    onAuthSuccess(): void;
+    onAuthFailure(message: string): void;
+    onProvisionStart(agentName: string): void;
+    onProvisionStatus(status: string, current?: ProvisionInfo): void;
+    onProvisionTimeout(agentId: string, lastStatus: string): void;
+    onProvisionFailure(reason: string): void;
+    onProvisionSuccess(result: ProvisionSuccessInfo): void;
+    /**
+     * A categorized user-facing message that doesn't map onto a specific
+     * lifecycle event — e.g. "Cloud login was not completed", "Cloud agent
+     * is still starting up. You can try `eliza cloud connect` once it's
+     * ready." The CLI implementation renders these as `log.warn`.
+     */
+    onNotice(message: string): void;
+    /**
+     * An unexpected, non-flow-control error. The orchestrator does not
+     * itself swallow errors — it surfaces them here and lets the observer
+     * decide whether to retry, fall back, or rethrow.
+     */
+    onFatalError(error: Error, context: string): void;
+    /**
+     * Resolve to `true` / `false` for a yes/no decision, or `null` when the
+     * user explicitly cancels (e.g. Ctrl-C on CLI, modal dismiss on GUI).
+     */
+    confirm(prompt: ConfirmPrompt): Promise<boolean | null>;
+    /**
+     * Resolve to the chosen value, or `null` on cancel.
+     */
+    selectChoice<T extends string>(prompt: SelectChoicePrompt<T>): Promise<T | null>;
+}
+//# sourceMappingURL=setup-observer.d.ts.map

package/dist/cloud/setup-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-observer.d.ts","sourceRoot":"","sources":["../../src/cloud/setup-observer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,MAAM;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,CAAC,CAAC;IACT,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,MAAM;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;CAClC;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IAEjC,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAExD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;;;OAMG;IACH,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC9D,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,aAAa,IAAI,IAAI,CAAC;IACtB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAErC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACjE,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAEvD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEhC;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAGlD;;;OAGG;IACH,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAExD;;OAEG;IACH,YAAY,CAAC,CAAC,SAAS,MAAM,EAC3B,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACtB"}

package/dist/cloud/setup-observer.js

@@ -0,0 +1,2 @@
+
+//# debugId=F6EBC316424461C464756E2164756E21

package/dist/cloud/setup-observer.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "F6EBC316424461C464756E2164756E21",
+  "names": []
+}

package/dist/cloud/validate-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-url.d.ts","sourceRoot":"","sources":["../../src/cloud/validate-url.ts"],"names":[],"mappings":"AA4HA,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB"}
+{"version":3,"file":"validate-url.d.ts","sourceRoot":"","sources":["../../src/cloud/validate-url.ts"],"names":[],"mappings":"AA4HA,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4DxB"}

package/dist/cloud/validate-url.js

@@ -125,6 +125,7 @@ async function validateCloudBaseUrl(rawUrl) {
   if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
     return `Cloud base URL "${rawUrl}" points to a blocked local hostname.`;
   }
+  const elizaDev = process.env.ELIZA_DEV?.trim().toLowerCase();
   if (true) {
     return null;
   }
@@ -171,4 +172,4 @@ export {
   validateCloudBaseUrl
 };
 
-//# debugId=A6F87DAF3800D9FC64756E2164756E21
+//# debugId=4ADEDB99210B0D5564756E2164756E21

package/dist/cloud/validate-url.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/cloud/validate-url.ts"],
   "sourcesContent": [
-    "import dns from \"node:dns\";\nimport net from \"node:net\";\nimport { promisify } from \"node:util\";\n\nconst dnsLookupAll = promisify(dns.lookup);\n\nconst BLOCKED_IPV4_CIDRS: Array<{ base: number; mask: number }> = [\n  cidrV4(\"0.0.0.0\", 8),\n  cidrV4(\"10.0.0.0\", 8),\n  cidrV4(\"172.16.0.0\", 12),\n  cidrV4(\"192.168.0.0\", 16),\n  cidrV4(\"100.64.0.0\", 10),\n  cidrV4(\"127.0.0.0\", 8),\n  cidrV4(\"169.254.0.0\", 16),\n  cidrV4(\"192.0.0.0\", 24),\n  cidrV4(\"198.18.0.0\", 15),\n  cidrV4(\"192.0.2.0\", 24),\n  cidrV4(\"198.51.100.0\", 24),\n  cidrV4(\"203.0.113.0\", 24),\n  cidrV4(\"224.0.0.0\", 4),\n  cidrV4(\"240.0.0.0\", 4),\n];\n\nfunction normalizeHostLike(value: string): string {\n  return value\n    .trim()\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction decodeIpv6MappedHex(mapped: string): string | null {\n  const parts = mapped.split(\":\");\n  if (parts.length < 1 || parts.length > 2) return null;\n\n  const parsed = parts.map((part) => {\n    if (!/^[0-9a-f]{1,4}$/i.test(part)) return Number.NaN;\n    return Number.parseInt(part, 16);\n  });\n  if (parsed.some((value) => !Number.isFinite(value))) return null;\n\n  const [hi, lo] = parsed.length === 1 ? [0, parsed[0]] : parsed;\n  const octets = [hi >> 8, hi & 0xff, lo >> 8, lo & 0xff];\n  return octets.join(\".\");\n}\n\nfunction canonicalizeIpv6(ip: string): string | null {\n  try {\n    return new URL(`http://[${ip}]/`).hostname.replace(/^\\[|\\]$/g, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeIpForPolicy(ip: string): string {\n  const base = normalizeHostLike(ip).split(\"%\")[0];\n  if (!base) return base;\n\n  let normalized = base;\n  if (net.isIP(normalized) === 6) {\n    normalized = canonicalizeIpv6(normalized) ?? normalized;\n  }\n\n  let mapped: string | null = null;\n  if (normalized.startsWith(\"::ffff:\")) {\n    mapped = normalized.slice(\"::ffff:\".length);\n  } else if (normalized.startsWith(\"0:0:0:0:0:ffff:\")) {\n    mapped = normalized.slice(\"0:0:0:0:0:ffff:\".length);\n  }\n  if (!mapped) return normalized;\n\n  if (net.isIP(mapped) === 4) return mapped;\n  return decodeIpv6MappedHex(mapped) ?? normalized;\n}\n\nfunction cidrV4(base: string, prefix: number): { base: number; mask: number } {\n  const parsed = parseIpv4ToInt(base);\n  if (parsed === null) {\n    throw new Error(`Invalid CIDR base IPv4 address: ${base}`);\n  }\n  const shift = 32 - prefix;\n  const mask = shift === 32 ? 0 : (0xffffffff << shift) >>> 0;\n  return { base: parsed & mask, mask };\n}\n\nfunction parseIpv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n  if (parts.length !== 4) return null;\n\n  let value = 0;\n  for (const part of parts) {\n    if (!/^\\d{1,3}$/.test(part)) return null;\n    const octet = Number.parseInt(part, 10);\n    if (!Number.isInteger(octet) || octet < 0 || octet > 255) return null;\n    value = (value << 8) | octet;\n  }\n\n  return value >>> 0;\n}\n\nfunction isBlockedIpv4(ip: string): boolean {\n  const asInt = parseIpv4ToInt(ip);\n  if (asInt === null) return true;\n  return BLOCKED_IPV4_CIDRS.some((cidr) => (asInt & cidr.mask) === cidr.base);\n}\n\nfunction isBlockedIpv6(ip: string): boolean {\n  const normalized = ip.toLowerCase();\n  return (\n    normalized === \"::\" ||\n    normalized === \"::1\" ||\n    /^fe[89ab][0-9a-f]:/.test(normalized) ||\n    /^f[cd][0-9a-f]{2}:/i.test(normalized) ||\n    normalized.startsWith(\"ff\")\n  );\n}\n\nfunction isBlockedIp(ip: string): boolean {\n  const normalized = normalizeIpForPolicy(ip);\n  const family = net.isIP(normalized);\n  if (family === 4) return isBlockedIpv4(normalized);\n  if (family === 6) return isBlockedIpv6(normalized);\n  return false;\n}\n\nexport async function validateCloudBaseUrl(\n  rawUrl: string,\n): Promise<string | null> {\n  let parsed: URL;\n  try {\n    parsed = new URL(rawUrl);\n  } catch {\n    return `Invalid cloud base URL: \"${rawUrl}\"`;\n  }\n\n  if (parsed.protocol !== \"https:\") {\n    return `Cloud base URL must use HTTPS, got \"${parsed.protocol}\" in \"${rawUrl}\"`;\n  }\n\n  const hostname = normalizeHostLike(parsed.hostname);\n  if (!hostname) {\n    return `Invalid cloud base URL: \"${rawUrl}\"`;\n  }\n\n  if (\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\") ||\n    hostname.endsWith(\".local\")\n  ) {\n    return `Cloud base URL \"${rawUrl}\" points to a blocked local hostname.`;\n  }\n\n  // Dev-mode bypass: skip IP-range blocking but keep URL format checks above.\n  if (process.env.NODE_ENV === \"development\" || process.env.ELIZA_DEV) {\n    return null;\n  }\n\n  if (isBlockedIp(hostname)) {\n    return `Cloud base URL \"${rawUrl}\" points to a blocked address.`;\n  }\n\n  try {\n    const results = await dnsLookupAll(hostname, { all: true });\n    const addresses = Array.isArray(results) ? results : [results];\n    for (const entry of addresses) {\n      const ip =\n        typeof entry === \"string\"\n          ? entry\n          : (entry as { address: string }).address;\n      if (isBlockedIp(ip)) {\n        return (\n          `Cloud base URL \"${rawUrl}\" resolves to ${ip}, ` +\n          \"which is a blocked internal/metadata address.\"\n        );\n      }\n    }\n  } catch {\n    return `Cloud base URL \"${rawUrl}\" could not be resolved via DNS.`;\n  }\n\n  return null;\n}\n"
+    "import dns from \"node:dns\";\nimport net from \"node:net\";\nimport { promisify } from \"node:util\";\n\nconst dnsLookupAll = promisify(dns.lookup);\n\nconst BLOCKED_IPV4_CIDRS: Array<{ base: number; mask: number }> = [\n  cidrV4(\"0.0.0.0\", 8),\n  cidrV4(\"10.0.0.0\", 8),\n  cidrV4(\"172.16.0.0\", 12),\n  cidrV4(\"192.168.0.0\", 16),\n  cidrV4(\"100.64.0.0\", 10),\n  cidrV4(\"127.0.0.0\", 8),\n  cidrV4(\"169.254.0.0\", 16),\n  cidrV4(\"192.0.0.0\", 24),\n  cidrV4(\"198.18.0.0\", 15),\n  cidrV4(\"192.0.2.0\", 24),\n  cidrV4(\"198.51.100.0\", 24),\n  cidrV4(\"203.0.113.0\", 24),\n  cidrV4(\"224.0.0.0\", 4),\n  cidrV4(\"240.0.0.0\", 4),\n];\n\nfunction normalizeHostLike(value: string): string {\n  return value\n    .trim()\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction decodeIpv6MappedHex(mapped: string): string | null {\n  const parts = mapped.split(\":\");\n  if (parts.length < 1 || parts.length > 2) return null;\n\n  const parsed = parts.map((part) => {\n    if (!/^[0-9a-f]{1,4}$/i.test(part)) return Number.NaN;\n    return Number.parseInt(part, 16);\n  });\n  if (parsed.some((value) => !Number.isFinite(value))) return null;\n\n  const [hi, lo] = parsed.length === 1 ? [0, parsed[0]] : parsed;\n  const octets = [hi >> 8, hi & 0xff, lo >> 8, lo & 0xff];\n  return octets.join(\".\");\n}\n\nfunction canonicalizeIpv6(ip: string): string | null {\n  try {\n    return new URL(`http://[${ip}]/`).hostname.replace(/^\\[|\\]$/g, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeIpForPolicy(ip: string): string {\n  const base = normalizeHostLike(ip).split(\"%\")[0];\n  if (!base) return base;\n\n  let normalized = base;\n  if (net.isIP(normalized) === 6) {\n    normalized = canonicalizeIpv6(normalized) ?? normalized;\n  }\n\n  let mapped: string | null = null;\n  if (normalized.startsWith(\"::ffff:\")) {\n    mapped = normalized.slice(\"::ffff:\".length);\n  } else if (normalized.startsWith(\"0:0:0:0:0:ffff:\")) {\n    mapped = normalized.slice(\"0:0:0:0:0:ffff:\".length);\n  }\n  if (!mapped) return normalized;\n\n  if (net.isIP(mapped) === 4) return mapped;\n  return decodeIpv6MappedHex(mapped) ?? normalized;\n}\n\nfunction cidrV4(base: string, prefix: number): { base: number; mask: number } {\n  const parsed = parseIpv4ToInt(base);\n  if (parsed === null) {\n    throw new Error(`Invalid CIDR base IPv4 address: ${base}`);\n  }\n  const shift = 32 - prefix;\n  const mask = shift === 32 ? 0 : (0xffffffff << shift) >>> 0;\n  return { base: parsed & mask, mask };\n}\n\nfunction parseIpv4ToInt(ip: string): number | null {\n  const parts = ip.split(\".\");\n  if (parts.length !== 4) return null;\n\n  let value = 0;\n  for (const part of parts) {\n    if (!/^\\d{1,3}$/.test(part)) return null;\n    const octet = Number.parseInt(part, 10);\n    if (!Number.isInteger(octet) || octet < 0 || octet > 255) return null;\n    value = (value << 8) | octet;\n  }\n\n  return value >>> 0;\n}\n\nfunction isBlockedIpv4(ip: string): boolean {\n  const asInt = parseIpv4ToInt(ip);\n  if (asInt === null) return true;\n  return BLOCKED_IPV4_CIDRS.some((cidr) => (asInt & cidr.mask) === cidr.base);\n}\n\nfunction isBlockedIpv6(ip: string): boolean {\n  const normalized = ip.toLowerCase();\n  return (\n    normalized === \"::\" ||\n    normalized === \"::1\" ||\n    /^fe[89ab][0-9a-f]:/.test(normalized) ||\n    /^f[cd][0-9a-f]{2}:/i.test(normalized) ||\n    normalized.startsWith(\"ff\")\n  );\n}\n\nfunction isBlockedIp(ip: string): boolean {\n  const normalized = normalizeIpForPolicy(ip);\n  const family = net.isIP(normalized);\n  if (family === 4) return isBlockedIpv4(normalized);\n  if (family === 6) return isBlockedIpv6(normalized);\n  return false;\n}\n\nexport async function validateCloudBaseUrl(\n  rawUrl: string,\n): Promise<string | null> {\n  let parsed: URL;\n  try {\n    parsed = new URL(rawUrl);\n  } catch {\n    return `Invalid cloud base URL: \"${rawUrl}\"`;\n  }\n\n  if (parsed.protocol !== \"https:\") {\n    return `Cloud base URL must use HTTPS, got \"${parsed.protocol}\" in \"${rawUrl}\"`;\n  }\n\n  const hostname = normalizeHostLike(parsed.hostname);\n  if (!hostname) {\n    return `Invalid cloud base URL: \"${rawUrl}\"`;\n  }\n\n  if (\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\") ||\n    hostname.endsWith(\".local\")\n  ) {\n    return `Cloud base URL \"${rawUrl}\" points to a blocked local hostname.`;\n  }\n\n  // Dev-mode bypass: skip IP-range blocking but keep URL format checks above.\n  const elizaDev = process.env.ELIZA_DEV?.trim().toLowerCase();\n  if (\n    process.env.NODE_ENV === \"development\" ||\n    elizaDev === \"1\" ||\n    elizaDev === \"true\" ||\n    elizaDev === \"yes\"\n  ) {\n    return null;\n  }\n\n  if (isBlockedIp(hostname)) {\n    return `Cloud base URL \"${rawUrl}\" points to a blocked address.`;\n  }\n\n  try {\n    const results = await dnsLookupAll(hostname, { all: true });\n    const addresses = Array.isArray(results) ? results : [results];\n    for (const entry of addresses) {\n      const ip =\n        typeof entry === \"string\"\n          ? entry\n          : (entry as { address: string }).address;\n      if (isBlockedIp(ip)) {\n        return (\n          `Cloud base URL \"${rawUrl}\" resolves to ${ip}, ` +\n          \"which is a blocked internal/metadata address.\"\n        );\n      }\n    }\n  } catch {\n    return `Cloud base URL \"${rawUrl}\" could not be resolved via DNS.`;\n  }\n\n  return null;\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAqBA,SAAS,iBAAiB,CAAC,OAAuB;AAAA,EAChD,OAAO,MACJ,KAAK,EACL,YAAY,EACZ,QAAQ,YAAY,EAAE;AAAA;AAG3B,SAAS,mBAAmB,CAAC,QAA+B;AAAA,EAC1D,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,EAC9B,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS;AAAA,IAAG,OAAO;AAAA,EAEjD,MAAM,SAAS,MAAM,IAAI,CAAC,SAAS;AAAA,IACjC,IAAI,CAAC,mBAAmB,KAAK,IAAI;AAAA,MAAG,OAAO,OAAO;AAAA,IAClD,OAAO,OAAO,SAAS,MAAM,EAAE;AAAA,GAChC;AAAA,EACD,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,SAAS,KAAK,CAAC;AAAA,IAAG,OAAO;AAAA,EAE5D,OAAO,IAAI,MAAM,OAAO,WAAW,IAAI,CAAC,GAAG,OAAO,EAAE,IAAI;AAAA,EACxD,MAAM,SAAS,CAAC,MAAM,GAAG,KAAK,KAAM,MAAM,GAAG,KAAK,GAAI;AAAA,EACtD,OAAO,OAAO,KAAK,GAAG;AAAA;AAGxB,SAAS,gBAAgB,CAAC,IAA2B;AAAA,EACnD,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,WAAW,MAAM,EAAE,SAAS,QAAQ,YAAY,EAAE;AAAA,IACjE,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIX,SAAS,oBAAoB,CAAC,IAAoB;AAAA,EAChD,MAAM,OAAO,kBAAkB,EAAE,EAAE,MAAM,GAAG,EAAE;AAAA,EAC9C,IAAI,CAAC;AAAA,IAAM,OAAO;AAAA,EAElB,IAAI,aAAa;AAAA,EACjB,IAAI,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,IAC9B,aAAa,iBAAiB,UAAU,KAAK;AAAA,EAC/C;AAAA,EAEA,IAAI,SAAwB;AAAA,EAC5B,IAAI,WAAW,WAAW,SAAS,GAAG;AAAA,IACpC,SAAS,WAAW,MAAM,UAAU,MAAM;AAAA,EAC5C,EAAO,SAAI,WAAW,WAAW,iBAAiB,GAAG;AAAA,IACnD,SAAS,WAAW,MAAM,kBAAkB,MAAM;AAAA,EACpD;AAAA,EACA,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EAEpB,IAAI,IAAI,KAAK,MAAM,MAAM;AAAA,IAAG,OAAO;AAAA,EACnC,OAAO,oBAAoB,MAAM,KAAK;AAAA;AAGxC,SAAS,MAAM,CAAC,MAAc,QAAgD;AAAA,EAC5E,MAAM,SAAS,eAAe,IAAI;AAAA,EAClC,IAAI,WAAW,MAAM;AAAA,IACnB,MAAM,IAAI,MAAM,mCAAmC,MAAM;AAAA,EAC3D;AAAA,EACA,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,UAAU,KAAK,IAAK,cAAc,UAAW;AAAA,EAC1D,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK;AAAA;AAGrC,SAAS,cAAc,CAAC,IAA2B;AAAA,EACjD,MAAM,QAAQ,GAAG,MAAM,GAAG;AAAA,EAC1B,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EAE/B,IAAI,QAAQ;AAAA,EACZ,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,YAAY,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACpC,MAAM,QAAQ,OAAO,SAAS,MAAM,EAAE;AAAA,IACtC,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ;AAAA,MAAK,OAAO;AAAA,IACjE,QAAS,SAAS,IAAK;AAAA,EACzB;AAAA,EAEA,OAAO,UAAU;AAAA;AAGnB,SAAS,aAAa,CAAC,IAAqB;AAAA,EAC1C,MAAM,QAAQ,eAAe,EAAE;AAAA,EAC/B,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,OAAO,mBAAmB,KAAK,CAAC,UAAU,QAAQ,KAAK,UAAU,KAAK,IAAI;AAAA;AAG5E,SAAS,aAAa,CAAC,IAAqB;AAAA,EAC1C,MAAM,aAAa,GAAG,YAAY;AAAA,EAClC,OACE,eAAe,QACf,eAAe,SACf,qBAAqB,KAAK,UAAU,KACpC,sBAAsB,KAAK,UAAU,KACrC,WAAW,WAAW,IAAI;AAAA;AAI9B,SAAS,WAAW,CAAC,IAAqB;AAAA,EACxC,MAAM,aAAa,qBAAqB,EAAE;AAAA,EAC1C,MAAM,SAAS,IAAI,KAAK,UAAU;AAAA,EAClC,IAAI,WAAW;AAAA,IAAG,OAAO,cAAc,UAAU;AAAA,EACjD,IAAI,WAAW;AAAA,IAAG,OAAO,cAAc,UAAU;AAAA,EACjD,OAAO;AAAA;AAGT,eAAsB,oBAAoB,CACxC,QACwB;AAAA,EACxB,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,IAAI,IAAI,MAAM;AAAA,IACvB,MAAM;AAAA,IACN,OAAO,4BAA4B;AAAA;AAAA,EAGrC,IAAI,OAAO,aAAa,UAAU;AAAA,IAChC,OAAO,uCAAuC,OAAO,iBAAiB;AAAA,EACxE;AAAA,EAEA,MAAM,WAAW,kBAAkB,OAAO,QAAQ;AAAA,EAClD,IAAI,CAAC,UAAU;AAAA,IACb,OAAO,4BAA4B;AAAA,EACrC;AAAA,EAEA,IACE,aAAa,eACb,SAAS,SAAS,YAAY,KAC9B,SAAS,SAAS,QAAQ,GAC1B;AAAA,IACA,OAAO,mBAAmB;AAAA,EAC5B;AAAA,EAGA,IAAI,MAAiE;AAAA,IACnE,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,YAAY,QAAQ,GAAG;AAAA,IACzB,OAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,UAAU,MAAM,aAAa,UAAU,EAAE,KAAK,KAAK,CAAC;AAAA,IAC1D,MAAM,YAAY,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AAAA,IAC7D,WAAW,SAAS,WAAW;AAAA,MAC7B,MAAM,KACJ,OAAO,UAAU,WACb,QACC,MAA8B;AAAA,MACrC,IAAI,YAAY,EAAE,GAAG;AAAA,QACnB,OACE,mBAAmB,uBAAuB,SAC1C;AAAA,MAEJ;AAAA,IACF;AAAA,IACA,MAAM;AAAA,IACN,OAAO,mBAAmB;AAAA;AAAA,EAG5B,OAAO;AAAA;AAAA,IA/KH,cAEA;AAAA;AAAA,EAFA,eAAe,UAAU,IAAI,MAAM;AAAA,EAEnC,qBAA4D;AAAA,IAChE,OAAO,WAAW,CAAC;AAAA,IACnB,OAAO,YAAY,CAAC;AAAA,IACpB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,aAAa,CAAC;AAAA,IACrB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,aAAa,EAAE;AAAA,IACtB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,aAAa,EAAE;AAAA,IACtB,OAAO,gBAAgB,EAAE;AAAA,IACzB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,aAAa,CAAC;AAAA,IACrB,OAAO,aAAa,CAAC;AAAA,EACvB;AAAA;",
-  "debugId": "A6F87DAF3800D9FC64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAqBA,SAAS,iBAAiB,CAAC,OAAuB;AAAA,EAChD,OAAO,MACJ,KAAK,EACL,YAAY,EACZ,QAAQ,YAAY,EAAE;AAAA;AAG3B,SAAS,mBAAmB,CAAC,QAA+B;AAAA,EAC1D,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,EAC9B,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS;AAAA,IAAG,OAAO;AAAA,EAEjD,MAAM,SAAS,MAAM,IAAI,CAAC,SAAS;AAAA,IACjC,IAAI,CAAC,mBAAmB,KAAK,IAAI;AAAA,MAAG,OAAO,OAAO;AAAA,IAClD,OAAO,OAAO,SAAS,MAAM,EAAE;AAAA,GAChC;AAAA,EACD,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,SAAS,KAAK,CAAC;AAAA,IAAG,OAAO;AAAA,EAE5D,OAAO,IAAI,MAAM,OAAO,WAAW,IAAI,CAAC,GAAG,OAAO,EAAE,IAAI;AAAA,EACxD,MAAM,SAAS,CAAC,MAAM,GAAG,KAAK,KAAM,MAAM,GAAG,KAAK,GAAI;AAAA,EACtD,OAAO,OAAO,KAAK,GAAG;AAAA;AAGxB,SAAS,gBAAgB,CAAC,IAA2B;AAAA,EACnD,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,WAAW,MAAM,EAAE,SAAS,QAAQ,YAAY,EAAE;AAAA,IACjE,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIX,SAAS,oBAAoB,CAAC,IAAoB;AAAA,EAChD,MAAM,OAAO,kBAAkB,EAAE,EAAE,MAAM,GAAG,EAAE;AAAA,EAC9C,IAAI,CAAC;AAAA,IAAM,OAAO;AAAA,EAElB,IAAI,aAAa;AAAA,EACjB,IAAI,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,IAC9B,aAAa,iBAAiB,UAAU,KAAK;AAAA,EAC/C;AAAA,EAEA,IAAI,SAAwB;AAAA,EAC5B,IAAI,WAAW,WAAW,SAAS,GAAG;AAAA,IACpC,SAAS,WAAW,MAAM,UAAU,MAAM;AAAA,EAC5C,EAAO,SAAI,WAAW,WAAW,iBAAiB,GAAG;AAAA,IACnD,SAAS,WAAW,MAAM,kBAAkB,MAAM;AAAA,EACpD;AAAA,EACA,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EAEpB,IAAI,IAAI,KAAK,MAAM,MAAM;AAAA,IAAG,OAAO;AAAA,EACnC,OAAO,oBAAoB,MAAM,KAAK;AAAA;AAGxC,SAAS,MAAM,CAAC,MAAc,QAAgD;AAAA,EAC5E,MAAM,SAAS,eAAe,IAAI;AAAA,EAClC,IAAI,WAAW,MAAM;AAAA,IACnB,MAAM,IAAI,MAAM,mCAAmC,MAAM;AAAA,EAC3D;AAAA,EACA,MAAM,QAAQ,KAAK;AAAA,EACnB,MAAM,OAAO,UAAU,KAAK,IAAK,cAAc,UAAW;AAAA,EAC1D,OAAO,EAAE,MAAM,SAAS,MAAM,KAAK;AAAA;AAGrC,SAAS,cAAc,CAAC,IAA2B;AAAA,EACjD,MAAM,QAAQ,GAAG,MAAM,GAAG;AAAA,EAC1B,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EAE/B,IAAI,QAAQ;AAAA,EACZ,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,YAAY,KAAK,IAAI;AAAA,MAAG,OAAO;AAAA,IACpC,MAAM,QAAQ,OAAO,SAAS,MAAM,EAAE;AAAA,IACtC,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ;AAAA,MAAK,OAAO;AAAA,IACjE,QAAS,SAAS,IAAK;AAAA,EACzB;AAAA,EAEA,OAAO,UAAU;AAAA;AAGnB,SAAS,aAAa,CAAC,IAAqB;AAAA,EAC1C,MAAM,QAAQ,eAAe,EAAE;AAAA,EAC/B,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,OAAO,mBAAmB,KAAK,CAAC,UAAU,QAAQ,KAAK,UAAU,KAAK,IAAI;AAAA;AAG5E,SAAS,aAAa,CAAC,IAAqB;AAAA,EAC1C,MAAM,aAAa,GAAG,YAAY;AAAA,EAClC,OACE,eAAe,QACf,eAAe,SACf,qBAAqB,KAAK,UAAU,KACpC,sBAAsB,KAAK,UAAU,KACrC,WAAW,WAAW,IAAI;AAAA;AAI9B,SAAS,WAAW,CAAC,IAAqB;AAAA,EACxC,MAAM,aAAa,qBAAqB,EAAE;AAAA,EAC1C,MAAM,SAAS,IAAI,KAAK,UAAU;AAAA,EAClC,IAAI,WAAW;AAAA,IAAG,OAAO,cAAc,UAAU;AAAA,EACjD,IAAI,WAAW;AAAA,IAAG,OAAO,cAAc,UAAU;AAAA,EACjD,OAAO;AAAA;AAGT,eAAsB,oBAAoB,CACxC,QACwB;AAAA,EACxB,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,IAAI,IAAI,MAAM;AAAA,IACvB,MAAM;AAAA,IACN,OAAO,4BAA4B;AAAA;AAAA,EAGrC,IAAI,OAAO,aAAa,UAAU;AAAA,IAChC,OAAO,uCAAuC,OAAO,iBAAiB;AAAA,EACxE;AAAA,EAEA,MAAM,WAAW,kBAAkB,OAAO,QAAQ;AAAA,EAClD,IAAI,CAAC,UAAU;AAAA,IACb,OAAO,4BAA4B;AAAA,EACrC;AAAA,EAEA,IACE,aAAa,eACb,SAAS,SAAS,YAAY,KAC9B,SAAS,SAAS,QAAQ,GAC1B;AAAA,IACA,OAAO,mBAAmB;AAAA,EAC5B;AAAA,EAGA,MAAM,WAAW,QAAQ,IAAI,WAAW,KAAK,EAAE,YAAY;AAAA,EAC3D,IACE,MAIA;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,YAAY,QAAQ,GAAG;AAAA,IACzB,OAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,UAAU,MAAM,aAAa,UAAU,EAAE,KAAK,KAAK,CAAC;AAAA,IAC1D,MAAM,YAAY,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AAAA,IAC7D,WAAW,SAAS,WAAW;AAAA,MAC7B,MAAM,KACJ,OAAO,UAAU,WACb,QACC,MAA8B;AAAA,MACrC,IAAI,YAAY,EAAE,GAAG;AAAA,QACnB,OACE,mBAAmB,uBAAuB,SAC1C;AAAA,MAEJ;AAAA,IACF;AAAA,IACA,MAAM;AAAA,IACN,OAAO,mBAAmB;AAAA;AAAA,EAG5B,OAAO;AAAA;AAAA,IArLH,cAEA;AAAA;AAAA,EAFA,eAAe,UAAU,IAAI,MAAM;AAAA,EAEnC,qBAA4D;AAAA,IAChE,OAAO,WAAW,CAAC;AAAA,IACnB,OAAO,YAAY,CAAC;AAAA,IACpB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,aAAa,CAAC;AAAA,IACrB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,aAAa,EAAE;AAAA,IACtB,OAAO,cAAc,EAAE;AAAA,IACvB,OAAO,aAAa,EAAE;AAAA,IACtB,OAAO,gBAAgB,EAAE;AAAA,IACzB,OAAO,eAAe,EAAE;AAAA,IACxB,OAAO,aAAa,CAAC;AAAA,IACrB,OAAO,aAAa,CAAC;AAAA,EACvB;AAAA;",
+  "debugId": "4ADEDB99210B0D5564756E2164756E21",
   "names": []
 }

package/dist/cloud/x402-payment-handler.d.ts

@@ -0,0 +1,85 @@
+/**
+ * x402 (HTTP 402 Payment Required) handler for Eliza Cloud relays.
+ *
+ * Spec reference: https://www.x402.org
+ *
+ * When the user's Cloud credit balance can't cover a metered call, the
+ * Cloud relay returns HTTP 402 with a `payment-requirements` envelope —
+ * either as a `WWW-Authenticate: x402 <json>` header or as a JSON body
+ * with a top-level `paymentRequirements` array. Each requirement
+ * describes one acceptable payment option (asset, network, recipient,
+ * amount).
+ *
+ * This module is intentionally thin:
+ *   - `parseX402Response` extracts requirements from a Response.
+ *   - `PaymentRequiredError` carries them up to the action layer.
+ *   - `requestPayment` is the agent-side bridge: today it surfaces the
+ *     requirement back to the owner via the runtime logger so the UI /
+ *     planner can route the user to the existing wallet top-up flow.
+ *     Auto-pay intentionally lives outside this bridge — the actual money
+ *     movement is Cloud-side and gated by the wallet UI (commandment 4).
+ *
+ * No silent failures: a malformed 402 throws so the action layer can
+ * surface a clear "payment-required" message rather than treating the
+ * upstream as a generic HTTP error.
+ */
+import { type IAgentRuntime } from "@elizaos/core";
+/**
+ * One acceptable payment option as advertised by the server.
+ *
+ * Fields mirror the x402 spec's `paymentRequirements` entry. We type
+ * everything as required so silent partial parses are impossible — the
+ * parser either yields a complete requirement or rejects it.
+ */
+export interface X402PaymentRequirement {
+    /** Decimal amount in the asset's smallest unit (e.g. "1500000" for
+     *  1.50 USDC). String, not number, to preserve precision. */
+    readonly amount: string;
+    /** Asset symbol or ERC-20 contract address (e.g. "USDC"). */
+    readonly asset: string;
+    /** Network identifier (e.g. "base", "ethereum", "solana"). */
+    readonly network: string;
+    /** Recipient address that should receive the payment. */
+    readonly payTo: string;
+    /** Payment scheme — currently x402 supports "exact" only. */
+    readonly scheme: string;
+    /** ISO-8601 deadline after which the requirement is no longer valid. */
+    readonly expiresAt: string | null;
+    /** Human-readable description of the resource being purchased. */
+    readonly description: string | null;
+}
+/**
+ * Pull payment requirements out of an x402 response. Tries the header
+ * form first (lowest-overhead per spec), then falls back to the JSON
+ * body. Returns `null` when the response carries no parseable
+ * requirements — callers should treat that as a generic 402 and
+ * surface the upstream status text.
+ */
+export declare function parseX402Response(response: Response): Promise<X402PaymentRequirement[] | null>;
+/**
+ * Thrown by adapters when an upstream metered call returns 402 with
+ * actionable payment requirements. Action handlers convert this into an
+ * approval-queue entry so the user sees both the cost and the
+ * top-up prompt together.
+ */
+export declare class PaymentRequiredError extends Error {
+    readonly code: "PAYMENT_REQUIRED";
+    readonly requirements: ReadonlyArray<X402PaymentRequirement>;
+    constructor(requirements: ReadonlyArray<X402PaymentRequirement>, message?: string);
+}
+export interface PaymentReceipt {
+    readonly status: "surfaced" | "paid";
+    readonly requirement: X402PaymentRequirement;
+    /** Transaction id when status === "paid", null when only surfaced. */
+    readonly txId: string | null;
+}
+/**
+ * Bridge from a raw payment requirement to user action. For now this
+ * does not auto-pay: the actual money movement happens in the existing
+ * wallet UI (Cloud-side). We log the requirement so the agent's
+ * messaging surface and the desktop dev console both pick it up, then
+ * return a "surfaced" receipt for the action layer to forward into the
+ * approval queue.
+ */
+export declare function requestPayment(runtime: IAgentRuntime, requirements: ReadonlyArray<X402PaymentRequirement>): Promise<PaymentReceipt>;
+//# sourceMappingURL=x402-payment-handler.d.ts.map

package/dist/cloud/x402-payment-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x402-payment-handler.d.ts","sourceRoot":"","sources":["../../src/cloud/x402-payment-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,MAAM,eAAe,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;iEAC6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAuED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,CAqB1C;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;IAC5C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;gBAG3D,YAAY,EAAE,aAAa,CAAC,sBAAsB,CAAC,EACnD,OAAO,CAAC,EAAE,MAAM;CASnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,aAAa,CAAC,sBAAsB,CAAC,GAClD,OAAO,CAAC,cAAc,CAAC,CAmBzB"}

package/dist/cloud/x402-payment-handler.js

@@ -0,0 +1,119 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/cloud/x402-payment-handler.ts
+import { logger } from "@elizaos/core";
+function readString(value) {
+  if (typeof value !== "string")
+    return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readAmount(value) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return String(value);
+  }
+  return null;
+}
+function normalizeRequirement(raw) {
+  if (!raw || typeof raw !== "object")
+    return null;
+  const amount = readAmount(raw.amount);
+  const asset = readString(raw.asset);
+  const network = readString(raw.network);
+  const payTo = readString(raw.payTo);
+  if (!amount || !asset || !network || !payTo)
+    return null;
+  const scheme = readString(raw.scheme) ?? "exact";
+  return {
+    amount,
+    asset,
+    network,
+    payTo,
+    scheme,
+    expiresAt: readString(raw.expiresAt),
+    description: readString(raw.description)
+  };
+}
+function parseRequirementsArray(raw) {
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  for (const entry of raw) {
+    const normalized = normalizeRequirement(entry);
+    if (normalized)
+      out.push(normalized);
+  }
+  return out;
+}
+async function parseX402Response(response) {
+  const headerValue = response.headers.get("www-authenticate");
+  if (headerValue?.toLowerCase().startsWith("x402")) {
+    const jsonPart = headerValue.slice(4).trim();
+    if (jsonPart.length > 0) {
+      const parsed = JSON.parse(jsonPart);
+      const requirements2 = Array.isArray(parsed) ? parseRequirementsArray(parsed) : parseRequirementsArray(parsed.paymentRequirements ?? parsed.accepts);
+      if (requirements2.length > 0)
+        return requirements2;
+    }
+  }
+  const cloned = response.clone();
+  const text = await cloned.text();
+  if (text.length === 0)
+    return null;
+  const body = JSON.parse(text);
+  const requirements = parseRequirementsArray(body.paymentRequirements ?? body.accepts);
+  return requirements.length > 0 ? requirements : null;
+}
+
+class PaymentRequiredError extends Error {
+  code = "PAYMENT_REQUIRED";
+  requirements;
+  constructor(requirements, message) {
+    const text = message ?? `Eliza Cloud returned HTTP 402 — your credit balance can't cover this call. ${requirements.length} payment option(s) available.`;
+    super(text);
+    this.name = "PaymentRequiredError";
+    this.requirements = requirements;
+  }
+}
+async function requestPayment(runtime, requirements) {
+  if (requirements.length === 0) {
+    throw new Error("[x402] requestPayment called with no requirements — adapter bug");
+  }
+  const preferred = requirements[0];
+  logger.warn({
+    boundary: "elizacloud",
+    integration: "x402",
+    asset: preferred.asset,
+    network: preferred.network,
+    amount: preferred.amount,
+    runtimeId: runtime.agentId
+  }, `[x402] payment-required: ${preferred.amount} ${preferred.asset} on ${preferred.network} → ${preferred.payTo}${preferred.description ? ` (${preferred.description})` : ""}`);
+  return { status: "surfaced", requirement: preferred, txId: null };
+}
+export {
+  requestPayment,
+  parseX402Response,
+  PaymentRequiredError
+};
+
+//# debugId=E9FC6AAB3C2B9DD164756E2164756E21

package/dist/cloud/x402-payment-handler.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/cloud/x402-payment-handler.ts"],
+  "sourcesContent": [
+    "/**\n * x402 (HTTP 402 Payment Required) handler for Eliza Cloud relays.\n *\n * Spec reference: https://www.x402.org\n *\n * When the user's Cloud credit balance can't cover a metered call, the\n * Cloud relay returns HTTP 402 with a `payment-requirements` envelope —\n * either as a `WWW-Authenticate: x402 <json>` header or as a JSON body\n * with a top-level `paymentRequirements` array. Each requirement\n * describes one acceptable payment option (asset, network, recipient,\n * amount).\n *\n * This module is intentionally thin:\n *   - `parseX402Response` extracts requirements from a Response.\n *   - `PaymentRequiredError` carries them up to the action layer.\n *   - `requestPayment` is the agent-side bridge: today it surfaces the\n *     requirement back to the owner via the runtime logger so the UI /\n *     planner can route the user to the existing wallet top-up flow.\n *     Auto-pay intentionally lives outside this bridge — the actual money\n *     movement is Cloud-side and gated by the wallet UI (commandment 4).\n *\n * No silent failures: a malformed 402 throws so the action layer can\n * surface a clear \"payment-required\" message rather than treating the\n * upstream as a generic HTTP error.\n */\n\nimport { type IAgentRuntime, logger } from \"@elizaos/core\";\n\n/**\n * One acceptable payment option as advertised by the server.\n *\n * Fields mirror the x402 spec's `paymentRequirements` entry. We type\n * everything as required so silent partial parses are impossible — the\n * parser either yields a complete requirement or rejects it.\n */\nexport interface X402PaymentRequirement {\n  /** Decimal amount in the asset's smallest unit (e.g. \"1500000\" for\n   *  1.50 USDC). String, not number, to preserve precision. */\n  readonly amount: string;\n  /** Asset symbol or ERC-20 contract address (e.g. \"USDC\"). */\n  readonly asset: string;\n  /** Network identifier (e.g. \"base\", \"ethereum\", \"solana\"). */\n  readonly network: string;\n  /** Recipient address that should receive the payment. */\n  readonly payTo: string;\n  /** Payment scheme — currently x402 supports \"exact\" only. */\n  readonly scheme: string;\n  /** ISO-8601 deadline after which the requirement is no longer valid. */\n  readonly expiresAt: string | null;\n  /** Human-readable description of the resource being purchased. */\n  readonly description: string | null;\n}\n\n/**\n * Wire shape we accept from JSON bodies. Loose at the boundary, strict\n * after parsing.\n */\ninterface RawRequirement {\n  readonly amount?: unknown;\n  readonly asset?: unknown;\n  readonly network?: unknown;\n  readonly payTo?: unknown;\n  readonly scheme?: unknown;\n  readonly expiresAt?: unknown;\n  readonly description?: unknown;\n}\n\ninterface RawX402Body {\n  readonly paymentRequirements?: ReadonlyArray<RawRequirement>;\n  readonly accepts?: ReadonlyArray<RawRequirement>;\n}\n\nfunction readString(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction readAmount(value: unknown): string | null {\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : null;\n  }\n  if (typeof value === \"number\" && Number.isFinite(value)) {\n    return String(value);\n  }\n  return null;\n}\n\nfunction normalizeRequirement(\n  raw: RawRequirement | null | undefined,\n): X402PaymentRequirement | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const amount = readAmount(raw.amount);\n  const asset = readString(raw.asset);\n  const network = readString(raw.network);\n  const payTo = readString(raw.payTo);\n  if (!amount || !asset || !network || !payTo) return null;\n  const scheme = readString(raw.scheme) ?? \"exact\";\n  return {\n    amount,\n    asset,\n    network,\n    payTo,\n    scheme,\n    expiresAt: readString(raw.expiresAt),\n    description: readString(raw.description),\n  };\n}\n\nfunction parseRequirementsArray(\n  raw: ReadonlyArray<RawRequirement> | undefined,\n): X402PaymentRequirement[] {\n  if (!Array.isArray(raw)) return [];\n  const out: X402PaymentRequirement[] = [];\n  for (const entry of raw) {\n    const normalized = normalizeRequirement(entry);\n    if (normalized) out.push(normalized);\n  }\n  return out;\n}\n\n/**\n * Pull payment requirements out of an x402 response. Tries the header\n * form first (lowest-overhead per spec), then falls back to the JSON\n * body. Returns `null` when the response carries no parseable\n * requirements — callers should treat that as a generic 402 and\n * surface the upstream status text.\n */\nexport async function parseX402Response(\n  response: Response,\n): Promise<X402PaymentRequirement[] | null> {\n  const headerValue = response.headers.get(\"www-authenticate\");\n  if (headerValue?.toLowerCase().startsWith(\"x402\")) {\n    const jsonPart = headerValue.slice(4).trim();\n    if (jsonPart.length > 0) {\n      const parsed = JSON.parse(jsonPart) as RawX402Body | RawRequirement[];\n      const requirements = Array.isArray(parsed)\n        ? parseRequirementsArray(parsed)\n        : parseRequirementsArray(parsed.paymentRequirements ?? parsed.accepts);\n      if (requirements.length > 0) return requirements;\n    }\n  }\n  // Fall back to body parse. Clone so the caller can still read it.\n  const cloned = response.clone();\n  const text = await cloned.text();\n  if (text.length === 0) return null;\n  const body = JSON.parse(text) as RawX402Body;\n  const requirements = parseRequirementsArray(\n    body.paymentRequirements ?? body.accepts,\n  );\n  return requirements.length > 0 ? requirements : null;\n}\n\n/**\n * Thrown by adapters when an upstream metered call returns 402 with\n * actionable payment requirements. Action handlers convert this into an\n * approval-queue entry so the user sees both the cost and the\n * top-up prompt together.\n */\nexport class PaymentRequiredError extends Error {\n  readonly code = \"PAYMENT_REQUIRED\" as const;\n  readonly requirements: ReadonlyArray<X402PaymentRequirement>;\n\n  constructor(\n    requirements: ReadonlyArray<X402PaymentRequirement>,\n    message?: string,\n  ) {\n    const text =\n      message ??\n      `Eliza Cloud returned HTTP 402 — your credit balance can't cover this call. ${requirements.length} payment option(s) available.`;\n    super(text);\n    this.name = \"PaymentRequiredError\";\n    this.requirements = requirements;\n  }\n}\n\nexport interface PaymentReceipt {\n  readonly status: \"surfaced\" | \"paid\";\n  readonly requirement: X402PaymentRequirement;\n  /** Transaction id when status === \"paid\", null when only surfaced. */\n  readonly txId: string | null;\n}\n\n/**\n * Bridge from a raw payment requirement to user action. For now this\n * does not auto-pay: the actual money movement happens in the existing\n * wallet UI (Cloud-side). We log the requirement so the agent's\n * messaging surface and the desktop dev console both pick it up, then\n * return a \"surfaced\" receipt for the action layer to forward into the\n * approval queue.\n */\nexport async function requestPayment(\n  runtime: IAgentRuntime,\n  requirements: ReadonlyArray<X402PaymentRequirement>,\n): Promise<PaymentReceipt> {\n  if (requirements.length === 0) {\n    throw new Error(\n      \"[x402] requestPayment called with no requirements — adapter bug\",\n    );\n  }\n  const preferred = requirements[0];\n  logger.warn(\n    {\n      boundary: \"elizacloud\",\n      integration: \"x402\",\n      asset: preferred.asset,\n      network: preferred.network,\n      amount: preferred.amount,\n      runtimeId: runtime.agentId,\n    },\n    `[x402] payment-required: ${preferred.amount} ${preferred.asset} on ${preferred.network} → ${preferred.payTo}${preferred.description ? ` (${preferred.description})` : \"\"}`,\n  );\n  return { status: \"surfaced\", requirement: preferred, txId: null };\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AA0BA;AA8CA,SAAS,UAAU,CAAC,OAA+B;AAAA,EACjD,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,UAAU,MAAM,KAAK;AAAA,EAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AAAA;AAGxC,SAAS,UAAU,CAAC,OAA+B;AAAA,EACjD,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK;AAAA,IAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAAA,EACA,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AAAA,IACvD,OAAO,OAAO,KAAK;AAAA,EACrB;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,oBAAoB,CAC3B,KAC+B;AAAA,EAC/B,IAAI,CAAC,OAAO,OAAO,QAAQ;AAAA,IAAU,OAAO;AAAA,EAC5C,MAAM,SAAS,WAAW,IAAI,MAAM;AAAA,EACpC,MAAM,QAAQ,WAAW,IAAI,KAAK;AAAA,EAClC,MAAM,UAAU,WAAW,IAAI,OAAO;AAAA,EACtC,MAAM,QAAQ,WAAW,IAAI,KAAK;AAAA,EAClC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC;AAAA,IAAO,OAAO;AAAA,EACpD,MAAM,SAAS,WAAW,IAAI,MAAM,KAAK;AAAA,EACzC,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW,IAAI,SAAS;AAAA,IACnC,aAAa,WAAW,IAAI,WAAW;AAAA,EACzC;AAAA;AAGF,SAAS,sBAAsB,CAC7B,KAC0B;AAAA,EAC1B,IAAI,CAAC,MAAM,QAAQ,GAAG;AAAA,IAAG,OAAO,CAAC;AAAA,EACjC,MAAM,MAAgC,CAAC;AAAA,EACvC,WAAW,SAAS,KAAK;AAAA,IACvB,MAAM,aAAa,qBAAqB,KAAK;AAAA,IAC7C,IAAI;AAAA,MAAY,IAAI,KAAK,UAAU;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAUT,eAAsB,iBAAiB,CACrC,UAC0C;AAAA,EAC1C,MAAM,cAAc,SAAS,QAAQ,IAAI,kBAAkB;AAAA,EAC3D,IAAI,aAAa,YAAY,EAAE,WAAW,MAAM,GAAG;AAAA,IACjD,MAAM,WAAW,YAAY,MAAM,CAAC,EAAE,KAAK;AAAA,IAC3C,IAAI,SAAS,SAAS,GAAG;AAAA,MACvB,MAAM,SAAS,KAAK,MAAM,QAAQ;AAAA,MAClC,MAAM,gBAAe,MAAM,QAAQ,MAAM,IACrC,uBAAuB,MAAM,IAC7B,uBAAuB,OAAO,uBAAuB,OAAO,OAAO;AAAA,MACvE,IAAI,cAAa,SAAS;AAAA,QAAG,OAAO;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,SAAS,MAAM;AAAA,EAC9B,MAAM,OAAO,MAAM,OAAO,KAAK;AAAA,EAC/B,IAAI,KAAK,WAAW;AAAA,IAAG,OAAO;AAAA,EAC9B,MAAM,OAAO,KAAK,MAAM,IAAI;AAAA,EAC5B,MAAM,eAAe,uBACnB,KAAK,uBAAuB,KAAK,OACnC;AAAA,EACA,OAAO,aAAa,SAAS,IAAI,eAAe;AAAA;AAAA;AAS3C,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAO;AAAA,EACP;AAAA,EAET,WAAW,CACT,cACA,SACA;AAAA,IACA,MAAM,OACJ,WACA,8EAA6E,aAAa;AAAA,IAC5F,MAAM,IAAI;AAAA,IACV,KAAK,OAAO;AAAA,IACZ,KAAK,eAAe;AAAA;AAExB;AAiBA,eAAsB,cAAc,CAClC,SACA,cACyB;AAAA,EACzB,IAAI,aAAa,WAAW,GAAG;AAAA,IAC7B,MAAM,IAAI,MACR,iEACF;AAAA,EACF;AAAA,EACA,MAAM,YAAY,aAAa;AAAA,EAC/B,OAAO,KACL;AAAA,IACE,UAAU;AAAA,IACV,aAAa;AAAA,IACb,OAAO,UAAU;AAAA,IACjB,SAAS,UAAU;AAAA,IACnB,QAAQ,UAAU;AAAA,IAClB,WAAW,QAAQ;AAAA,EACrB,GACA,4BAA4B,UAAU,UAAU,UAAU,YAAY,UAAU,aAAY,UAAU,QAAQ,UAAU,cAAc,KAAK,UAAU,iBAAiB,IACxK;AAAA,EACA,OAAO,EAAE,QAAQ,YAAY,aAAa,WAAW,MAAM,KAAK;AAAA;",
+  "debugId": "E9FC6AAB3C2B9DD164756E2164756E21",
+  "names": []
+}

package/dist/cloud-setup.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Cloud setup flow for Eliza Cloud integration.
+ *
+ * Handles availability check → browser-based auth → agent provisioning
+ * during `runFirstTimeSetup()`. Transport-agnostic: every user-visible
+ * event and every interactive prompt is funneled through a
+ * `CloudSetupObserver`. CLI callers wrap their clack instance in
+ * `ClackObserver`; web/desktop callers provide an event-bridge observer.
+ *
+ * @module cloud-setup
+ */
+import type { StylePreset } from "@elizaos/core";
+import type { CloudSetupObserver } from "./cloud/setup-observer.js";
+/** Result of a successful cloud setup flow. */
+export interface CloudSetupResult {
+    apiKey: string;
+    agentId: string | undefined;
+    baseUrl: string;
+    bridgeUrl?: string;
+}
+/**
+ * Quick pre-flight check: is Eliza Cloud accepting new agents?
+ * Returns null if available, or an error message string if not.
+ */
+export declare function checkCloudAvailability(baseUrl: string): Promise<string | null>;
+/**
+ * Run the full cloud setup flow:
+ * 1. Check availability
+ * 2. Authenticate via browser
+ * 3. Create + provision agent
+ *
+ * Returns the result or null if the user cancels / an error occurs.
+ * On failure, the caller should fall back to local mode.
+ */
+export declare function runCloudSetup(observer: CloudSetupObserver, agentName: string, preset?: StylePreset, baseUrl?: string): Promise<CloudSetupResult | null>;
+//# sourceMappingURL=cloud-setup.d.ts.map

package/dist/cloud-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-setup.d.ts","sourceRoot":"","sources":["../src/cloud-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAOjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAMpE,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAwBD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BxB;AAyPD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAkElC"}