@clawops/cli 1.7.9 → 2.0.0

package/dist/chunk-YR3O2I3S.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import {
+  resolveSpecDir
+} from "./chunk-JW5A7E3X.js";
+
+// src/plan/validate.ts
+import Ajv from "ajv/dist/2020";
+import addFormats from "ajv-formats";
+import { readFileSync } from "fs";
+import { join } from "path";
+var _validate;
+function getValidator() {
+  if (_validate) return _validate;
+  const ajv = new Ajv({ strict: false });
+  addFormats(ajv);
+  const schema = JSON.parse(
+    readFileSync(join(resolveSpecDir(), "deploy-plan.schema.json"), "utf-8")
+  );
+  _validate = ajv.compile(schema);
+  return _validate;
+}
+function validatePlan(plan) {
+  const validate = getValidator();
+  const ok = validate(plan);
+  if (ok) return { ok: true, errors: [] };
+  const errors = (validate.errors ?? []).map(
+    (e) => `${e.instancePath} ${e.message ?? ""}`.trim()
+  );
+  return { ok: false, errors };
+}
+function assertValidPlan(plan) {
+  const result = validatePlan(plan);
+  if (!result.ok) {
+    throw new Error(`Invalid deploy plan:
+${result.errors.join("\n")}`);
+  }
+}
+async function validatePlanConfig(plan) {
+  const overlay = plan.spec?.openclaw?.config;
+  if (overlay === void 0 || overlay === null) return { ok: true, errors: [], warnings: [] };
+  const [{ validateConfig }, yaml] = await Promise.all([
+    import("./config-validate-K2N6XLDX.js"),
+    import("./js-yaml-PTEEG4FO.js")
+  ]);
+  const { loadVersionSpec } = await import("./versions-W5LRQCAJ.js");
+  const spec = loadVersionSpec(yaml);
+  const { deepMerge } = await import("./remote-config-Z6IIZR3D.js");
+  const merged = deepMerge(
+    { gateway: { mode: "local" } },
+    overlay
+  );
+  const { errors, warnings } = await validateConfig(merged, {
+    openclawVersion: plan.spec?.openclaw?.version,
+    schemaCapturedFrom: spec.runtime?.configSchemaCapturedFrom
+  });
+  return { ok: errors.length === 0, errors, warnings };
+}
+function validatePlanNetwork(plan) {
+  const net = plan.spec?.network;
+  if (!net) return { ok: true, errors: [], warnings: [] };
+  const errors = [];
+  const warnings = [];
+  const publish = net.publishGateway ?? "loopback";
+  const gatewayCidrs = net.allowedGatewayCidrs ?? [];
+  if (publish === "loopback" && gatewayCidrs.length > 0) {
+    errors.push(
+      `network.allowedGatewayCidrs lists ${gatewayCidrs.length} CIDR(s) but network.publishGateway is "loopback", so the gateway binds 127.0.0.1 on the host and nothing is listening on a routable interface. Those rules would admit traffic to a closed port. Either drop them and reach the gateway with \`clawops tunnel\`, or set publishGateway to "all" \u2014 which serves plaintext HTTP, so put TLS in front of it.`
+    );
+  }
+  for (const [field, cidrs] of [
+    ["allowedSshCidrs", net.allowedSshCidrs ?? []],
+    ["allowedGatewayCidrs", gatewayCidrs]
+  ]) {
+    if (cidrs.some((c) => c === "0.0.0.0/0" || c === "::/0")) {
+      warnings.push(
+        `network.${field} admits the whole internet. clawops will create the rule you asked for, but \`clawops harden\` reports it as a finding.`
+      );
+    }
+  }
+  const configured = gatewayPortFromConfig(plan.spec?.openclaw?.config);
+  if (net.gatewayPort !== void 0 && configured !== void 0 && configured !== net.gatewayPort) {
+    errors.push(
+      `network.gatewayPort is ${net.gatewayPort} but the config overlay sets gateway.port to ${configured}. The container would publish one port while the gateway listened on the other. Set one of them, not both.`
+    );
+  }
+  return { ok: errors.length === 0, errors, warnings };
+}
+function gatewayPortFromConfig(config) {
+  if (config === null || typeof config !== "object") return void 0;
+  const gateway = config["gateway"];
+  if (gateway === null || typeof gateway !== "object") return void 0;
+  const port = gateway["port"];
+  return typeof port === "number" ? port : void 0;
+}
+
+export {
+  validatePlan,
+  assertValidPlan,
+  validatePlanConfig,
+  validatePlanNetwork
+};