@clawops/cli 0.2.0

package/dist/context-T52JWL3P.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  buildContext
+} from "./chunk-PERSDQMT.js";
+import "./chunk-PRYLTCS4.js";
+import "./chunk-ALSUDYA7.js";
+import "./chunk-ZSE4QRKE.js";
+export {
+  buildContext
+};

package/dist/firewall-YYDOWDDP.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+// src/providers/firewall.ts
+function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, detectedIp) {
+  if (portOverride.trim()) {
+    return portOverride.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  switch (accessMode) {
+    case "restricted": {
+      if (!allowedCidrs.trim()) return [];
+      return allowedCidrs.split(",").map((s) => s.trim()).filter(Boolean);
+    }
+    case "auto": {
+      if (!detectedIp.trim()) return [];
+      const ip = detectedIp.trim();
+      return [ip.includes("/") ? ip : `${ip}/32`];
+    }
+    case "open":
+      return ["0.0.0.0/0"];
+    default:
+      return [];
+  }
+}
+async function detectEgressIp(checkUrl) {
+  try {
+    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(5e3) });
+    if (!res.ok) return "";
+    return (await res.text()).trim();
+  } catch {
+    return "";
+  }
+}
+export {
+  detectEgressIp,
+  resolveIngressCidrs
+};

package/dist/gcp-OHWCTFLL.js

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+
+// src/providers/gcp/index.ts
+import process from "process";
+
+// src/providers/gcp/program.ts
+var GATEWAY_PORT = 18789;
+var SSH_PORT = 22;
+var gcpProgram = async () => {
+  const [pulumi, gcp] = await Promise.all([
+    import("@pulumi/pulumi"),
+    import("@pulumi/gcp")
+  ]);
+  const cfg = new pulumi.Config();
+  const instanceType = cfg.get("instanceType") ?? "e2-standard-2";
+  const region = cfg.get("region") ?? "us-central1";
+  const openclawVersion = cfg.get("openclawVersion") ?? "stable";
+  const zone = cfg.get("zone") ?? `${region}-a`;
+  const network = new gcp.compute.Network("clawops-network", {
+    autoCreateSubnetworks: false,
+    description: "clawops managed network"
+  });
+  const subnet = new gcp.compute.Subnetwork("clawops-subnet", {
+    ipCidrRange: "10.0.0.0/24",
+    region,
+    network: network.id
+  });
+  new gcp.compute.Firewall("clawops-firewall", {
+    network: network.selfLink,
+    allows: [
+      {
+        protocol: "tcp",
+        ports: [String(SSH_PORT), String(GATEWAY_PORT)]
+      }
+    ],
+    sourceRanges: ["0.0.0.0/0"],
+    targetTags: ["clawops"]
+  });
+  const address = new gcp.compute.Address("clawops-address", { region });
+  const instance = new gcp.compute.Instance("clawops-instance", {
+    machineType: instanceType,
+    zone,
+    tags: ["clawops"],
+    bootDisk: {
+      initializeParams: {
+        image: "debian-cloud/debian-12",
+        size: 20
+      }
+    },
+    networkInterfaces: [
+      {
+        network: network.id,
+        subnetwork: subnet.id,
+        accessConfigs: [
+          {
+            natIp: address.address,
+            networkTier: "PREMIUM"
+          }
+        ]
+      }
+    ],
+    metadata: {
+      "startup-script": makeStartupScript(openclawVersion)
+    },
+    serviceAccount: {
+      scopes: ["https://www.googleapis.com/auth/cloud-platform"]
+    }
+  });
+  return {
+    instanceId: instance.id,
+    publicIp: address.address,
+    gatewayUrl: pulumi.interpolate`https://${address.address}:${GATEWAY_PORT}`,
+    sshHost: address.address,
+    sshPort: SSH_PORT,
+    sshUser: "clawops",
+    region,
+    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+};
+function makeStartupScript(openclawVersion) {
+  return `#!/bin/bash
+set -euo pipefail
+
+# Create clawops user with SSH access
+id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
+mkdir -p /home/clawops/.ssh
+chmod 700 /home/clawops/.ssh
+
+# Install Docker if not present
+if ! command -v docker &>/dev/null; then
+  apt-get update -q
+  apt-get install -y -q ca-certificates curl gnupg lsb-release
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/debian/gpg \\
+    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+  chmod a+r /etc/apt/keyrings/docker.gpg
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
+    https://download.docker.com/linux/debian $(lsb_release -cs) stable" \\
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update -q
+  apt-get install -y -q docker-ce docker-ce-cli containerd.io
+  systemctl enable --now docker
+fi
+
+usermod -aG docker clawops
+
+# Pull OpenClaw image
+OPENCLAW_VERSION="${openclawVersion}"
+docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+
+# Create default openclaw.json if not present
+OPENCLAW_CONFIG=/home/clawops/openclaw.json
+if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
+  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
+{"version":"2026.4","gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":[]}
+OPENCLAWJSON
+  chown clawops:clawops "\${OPENCLAW_CONFIG}"
+fi
+
+# Start OpenClaw container
+docker stop openclaw 2>/dev/null || true
+docker rm   openclaw 2>/dev/null || true
+docker run -d \\
+  --name openclaw \\
+  --restart unless-stopped \\
+  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
+  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
+  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
+`;
+}
+
+// src/providers/gcp/index.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "e2-micro",
+  small: "e2-standard-2",
+  medium: "e2-standard-4",
+  large: "e2-standard-8",
+  gpu: "n1-standard-4"
+  // TODO M3: add accelerator config for GPU instances
+};
+var gcpAdapter = {
+  name: "gcp",
+  get program() {
+    return gcpProgram;
+  },
+  getConnectionInfo(outputs) {
+    return {
+      host: String(outputs["sshHost"]),
+      port: Number(outputs["sshPort"]),
+      user: String(outputs["sshUser"]),
+      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
+      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
+    };
+  },
+  normalizeInstanceType(alias) {
+    const mapped = INSTANCE_TYPE_MAP[alias];
+    if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
+    return mapped;
+  },
+  defaultRegion() {
+    return "us-central1";
+  },
+  stateBackendUrl(bucket) {
+    return `gs://${bucket}`;
+  },
+  async validateConfig() {
+    const errors = [];
+    const hasKeyFile = Boolean(process.env["GOOGLE_APPLICATION_CREDENTIALS"]);
+    const hasUserCreds = Boolean(process.env["CLOUDSDK_AUTH_ACCESS_TOKEN"]);
+    if (!hasKeyFile && !hasUserCreds) {
+      const onGcp = await checkInstanceMetadata();
+      if (!onGcp) {
+        errors.push(
+          "No GCP credentials found. Set GOOGLE_APPLICATION_CREDENTIALS to a service account key file, or run `gcloud auth application-default login`."
+        );
+      }
+    }
+    return { ok: errors.length === 0, errors };
+  }
+};
+async function checkInstanceMetadata() {
+  try {
+    const res = await fetch(
+      "http://metadata.google.internal/computeMetadata/v1/instance/id",
+      {
+        headers: { "Metadata-Flavor": "Google" },
+        signal: AbortSignal.timeout(1e3)
+      }
+    );
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+var gcp_default = gcpAdapter;
+export {
+  gcp_default as default
+};

package/dist/generate-Y6O465VB.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import {
+  generatePlan,
+  planId
+} from "./chunk-ENQY5OW2.js";
+import "./chunk-PERSDQMT.js";
+import "./chunk-PRYLTCS4.js";
+import "./chunk-YTH4L2GN.js";
+import "./chunk-ALSUDYA7.js";
+import "./chunk-ZSE4QRKE.js";
+export {
+  generatePlan,
+  planId
+};

package/dist/index.d.ts

@@ -0,0 +1,52 @@
+/** Inline Pulumi program — a closure that creates resources when called. */
+type PulumiFn = () => Promise<Record<string, unknown> | void>;
+/** Lowercase provider id matching the schema enum. */
+type ProviderName = 'aws' | 'gcp' | 'azure' | 'local';
+/** Normalised clawops instance-size alias. */
+type InstanceAlias = 'micro' | 'small' | 'medium' | 'large' | 'gpu';
+/** How this provider's credentials are sourced (R6: never in tool args). */
+type CredentialSource = 'env' | 'cli-profile' | 'file' | 'instance-metadata';
+/** Pulumi state backend URL scheme. */
+type StateBackendScheme = 's3' | 'gs' | 'azblob' | 'file';
+interface ConnectionInfo {
+    host: string;
+    port: number;
+    user: string;
+    privateKeyPath: string;
+    knownHostsPath: string;
+}
+interface BaseStackOutputs {
+    instanceId: string;
+    publicIp: string;
+    gatewayUrl: string;
+    sshHost: string;
+    sshPort: number;
+    sshUser: string;
+    region: string;
+    /** ISO-8601 timestamp */
+    provisionedAt: string;
+}
+type StackOutputs = BaseStackOutputs & Record<string, unknown>;
+interface ValidationResult {
+    ok: boolean;
+    errors: string[];
+}
+/** Contract every cloud provider adapter must satisfy. Per R-meta-1. */
+interface ProviderAdapter {
+    /** Lowercase provider id matching the schema enum. */
+    readonly name: ProviderName;
+    /** Inline Pulumi program for this provider's stack. */
+    readonly program: PulumiFn;
+    /** Extract connection details from a deployed stack's outputs. */
+    getConnectionInfo(outputs: StackOutputs): ConnectionInfo;
+    /** Map an alias like "small" to the provider's native instance type. */
+    normalizeInstanceType(alias: InstanceAlias): string;
+    /** Provider-default region if user didn't specify. */
+    defaultRegion(): string;
+    /** State backend URL prefix for this provider. */
+    stateBackendUrl(bucket: string): string;
+    /** Validate provider-specific config (env vars, profiles) at startup. */
+    validateConfig(): Promise<ValidationResult>;
+}
+
+export type { BaseStackOutputs, ConnectionInfo, CredentialSource, InstanceAlias, ProviderAdapter, ProviderName, PulumiFn, StackOutputs, StateBackendScheme, ValidationResult };

package/dist/local-DXBEVZ5C.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+// src/providers/local/index.ts
+import { accessSync } from "fs";
+var localAdapter = {
+  name: "local",
+  /** Never called — local stacks bypass Pulumi entirely. */
+  get program() {
+    return async () => ({});
+  },
+  getConnectionInfo(outputs) {
+    return {
+      host: String(outputs["sshHost"] ?? ""),
+      port: Number(outputs["sshPort"] ?? 22),
+      user: String(outputs["sshUser"] ?? "root"),
+      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
+      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
+    };
+  },
+  normalizeInstanceType(_alias) {
+    return "local";
+  },
+  defaultRegion() {
+    return "local";
+  },
+  stateBackendUrl(_bucket) {
+    return "file://~/.clawops/state";
+  },
+  async validateConfig() {
+    const keyPath = process.env["CLAWOPS_SSH_KEY_PATH"];
+    if (keyPath) {
+      try {
+        accessSync(keyPath);
+      } catch {
+        return {
+          ok: false,
+          errors: [`SSH key not readable: ${keyPath}`]
+        };
+      }
+    }
+    return { ok: true, errors: [] };
+  }
+};
+var local_default = localAdapter;
+export {
+  local_default as default
+};

package/dist/outputs-6DAVEEAZ.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import {
+  extractBaseOutputs
+} from "./chunk-LT24GUUO.js";
+import "./chunk-ZSE4QRKE.js";
+export {
+  extractBaseOutputs
+};

package/dist/package-YZFYSSQM.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+
+// package.json
+var name = "@clawops/cli";
+var version = "0.2.0";
+var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
+var type = "module";
+var bin = {
+  clawops: "./dist/cli.js"
+};
+var exports = {
+  ".": "./dist/index.js"
+};
+var files = [
+  "dist"
+];
+var engines = {
+  node: ">=22"
+};
+var packageManager = "pnpm@10.12.1";
+var scripts = {
+  dev: "tsx src/cli/index.ts",
+  build: "tsup",
+  test: "vitest run",
+  "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
+  "test:changed": "vitest --changed",
+  typecheck: "tsc --noEmit",
+  lint: "eslint --max-warnings=0 src tests scripts",
+  "gen:schemas": "tsx scripts/gen-schemas.ts",
+  changeset: "changeset",
+  release: "pnpm build && changeset publish"
+};
+var dependencies = {
+  "@modelcontextprotocol/sdk": "^1.0.0",
+  "@pulumi/aws": "^6.0.0",
+  "@pulumi/azure-native": "^2.0.0",
+  "@pulumi/command": "^1.0.0",
+  "@pulumi/docker": "^4.0.0",
+  "@pulumi/gcp": "^7.0.0",
+  "@pulumi/pulumi": "^3.0.0",
+  ajv: "^8.0.0",
+  "ajv-formats": "^3.0.0",
+  chalk: "^5.0.0",
+  citty: "^0.1.0",
+  conf: "^12.0.0",
+  inquirer: "^9.0.0",
+  ora: "^8.0.0",
+  ssh2: "^1.0.0",
+  zod: "^3.0.0"
+};
+var devDependencies = {
+  "aws-sdk-client-mock": "^4.0.0",
+  "@changesets/cli": "^2.0.0",
+  "@types/js-yaml": "^4.0.0",
+  "@types/node": "^22.0.0",
+  "@types/ssh2": "^1.0.0",
+  "@vitest/coverage-v8": "^2.0.0",
+  eslint: "^9.0.0",
+  "js-yaml": "^4.0.0",
+  nock: "^14.0.0",
+  tsup: "^8.0.0",
+  tsx: "^4.0.0",
+  typescript: "^5.0.0",
+  "typescript-eslint": "^8.0.0",
+  vitest: "^2.0.0"
+};
+var pnpm = {
+  overrides: {
+    "@pulumi/pulumi": "^3.0.0"
+  },
+  onlyBuiltDependencies: [
+    "@pulumi/command",
+    "cpu-features",
+    "esbuild",
+    "protobufjs",
+    "ssh2"
+  ]
+};
+var package_default = {
+  name,
+  version,
+  description,
+  type,
+  bin,
+  exports,
+  files,
+  engines,
+  packageManager,
+  scripts,
+  dependencies,
+  devDependencies,
+  pnpm
+};
+export {
+  bin,
+  package_default as default,
+  dependencies,
+  description,
+  devDependencies,
+  engines,
+  exports,
+  files,
+  name,
+  packageManager,
+  pnpm,
+  scripts,
+  type,
+  version
+};

package/dist/pool-D4JCUA2V.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  acquireSession,
+  drainPool
+} from "./chunk-5XEZAU7V.js";
+import "./chunk-ZSE4QRKE.js";
+export {
+  acquireSession,
+  drainPool
+};

package/dist/providers-2OABPW2E.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+// src/providers/index.ts
+var registry = /* @__PURE__ */ new Map();
+function registerProvider(adapter) {
+  registry.set(adapter.name, adapter);
+}
+function getProvider(name) {
+  const adapter = registry.get(name);
+  if (!adapter) {
+    throw new Error(
+      `No provider adapter registered for '${name}'. Run \`clawops init\` to configure a provider.`
+    );
+  }
+  return adapter;
+}
+function listProviders() {
+  return Array.from(registry.keys());
+}
+export {
+  getProvider,
+  listProviders,
+  registerProvider
+};