@clawops/cli 1.7.9 → 2.0.1

package/dist/config-validate-K2N6XLDX.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import {
+  compareVersions
+} from "./chunk-GAZPPSKU.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/config-validate.ts
+var cached;
+async function getValidator() {
+  if (cached) return cached;
+  const [{ default: Ajv }, { default: addFormats }, { readFileSync }, { join }, { resolveSpecDir }] = await Promise.all([
+    import("ajv"),
+    import("ajv-formats"),
+    import("fs"),
+    import("path"),
+    import("./spec-path-KQOOIQCA.js")
+  ]);
+  const schema = JSON.parse(
+    readFileSync(join(resolveSpecDir(), "openclaw-2.0.config.schema.json"), "utf-8")
+  );
+  const ajv = new Ajv({ strict: false, allErrors: true });
+  addFormats(ajv);
+  cached = ajv.compile(schema);
+  return cached;
+}
+function isUnknownKey(e) {
+  return e.keyword === "additionalProperties";
+}
+function dotPath(instancePath) {
+  if (!instancePath) return "(root)";
+  return instancePath.slice(1).split("/").map((seg) => seg.replace(/~1/g, "/").replace(/~0/g, "~")).join(".");
+}
+function describe(e) {
+  const where = dotPath(e.instancePath);
+  if (isUnknownKey(e)) {
+    const extra = e.params.additionalProperty;
+    return `${where}: unknown key "${extra}"`;
+  }
+  return `${where}: ${e.message ?? "invalid"}`;
+}
+function deploymentContractErrors(cfg) {
+  const errors = [];
+  if (cfg === null || typeof cfg !== "object") return errors;
+  const gateway = cfg["gateway"];
+  const mode = gateway !== null && typeof gateway === "object" ? gateway["mode"] : void 0;
+  if (mode === void 0) {
+    errors.push(
+      'gateway.mode: required by clawops. OpenClaw treats it as optional only because --allow-unconfigured can bypass the check; clawops does not pass that flag, so a config without gateway.mode exits 78 with "Gateway start blocked". Set it to "local".'
+    );
+  }
+  return errors;
+}
+async function validateConfig(cfg, opts = {}) {
+  const validate = await getValidator();
+  const contract = deploymentContractErrors(cfg);
+  if (validate(cfg)) return { errors: contract, warnings: [] };
+  const { openclawVersion, schemaCapturedFrom } = opts;
+  const runtimeIsNewer = openclawVersion !== void 0 && schemaCapturedFrom !== void 0 && compareVersions(openclawVersion, schemaCapturedFrom) > 0;
+  const errors = [...contract];
+  const warnings = [];
+  for (const e of validate.errors ?? []) {
+    const text = describe(e);
+    if (isUnknownKey(e) && runtimeIsNewer) {
+      warnings.push(
+        `${text} \u2014 not in the schema captured from OpenClaw ${schemaCapturedFrom}; you are deploying ${openclawVersion}, so this may be a newer setting clawops does not know about yet.`
+      );
+    } else {
+      errors.push(text);
+    }
+  }
+  return { errors, warnings };
+}
+export {
+  validateConfig
+};

package/dist/context-7EVC6W45.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  buildContext,
+  loadAdapterModule
+} from "./chunk-5XT5IAJK.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+import "./chunk-N4WZLWJ4.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
+export {
+  buildContext,
+  loadAdapterModule
+};

package/dist/docker-3PDO4TS7.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  containerStatus,
+  inspectContainer,
+  looksLikeStillBooting
+} from "./chunk-3OLUJPCB.js";
+import "./chunk-NUDIHZEH.js";
+export {
+  containerStatus,
+  inspectContainer,
+  looksLikeStillBooting
+};

package/dist/{firewall-XQGO7HWK.js → firewall-5VKZ4WBH.js}

@@ -32,7 +32,10 @@ function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResul
 }
 async function detectEgressIp(checkUrl) {
   try {
-    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(3e3) });
+    const res = await fetch(checkUrl, {
+      signal: AbortSignal.timeout(3e3),
+      headers: { accept: "text/plain" }
+    });
     if (!res.ok) {
       return { ok: false, error: `HTTP ${res.status} from ${checkUrl}` };
     }
@@ -40,12 +43,40 @@ async function detectEgressIp(checkUrl) {
     if (!ip) {
       return { ok: false, error: `empty response from ${checkUrl}` };
     }
+    if (!isIpAddress(ip)) {
+      return {
+        ok: false,
+        error: `${checkUrl} did not return an IP address (got ${summarise(ip)})`
+      };
+    }
     return { ok: true, ip };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
+function isIpAddress(value) {
+  const v = value.trim();
+  if (/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(v)) {
+    return v.split(".").every((o) => Number(o) <= 255);
+  }
+  return /^[0-9a-fA-F:]+$/.test(v) && v.includes(":");
+}
+function summarise(body) {
+  const oneLine = body.replace(/\s+/g, " ").trim();
+  return oneLine.length > 40 ? `${oneLine.slice(0, 40)}\u2026` : oneLine;
+}
+function resolveGatewayIngressCidrs(publishGateway, accessMode, allowedCidrs, portOverride, egressResult) {
+  if (publishGateway !== "all") return [];
+  return resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResult);
+}
+function resolveGatewayPort(raw, fallback) {
+  const port = Number(raw);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : fallback;
+}
 export {
   detectEgressIp,
+  isIpAddress,
+  resolveGatewayIngressCidrs,
+  resolveGatewayPort,
   resolveIngressCidrs
 };

package/dist/generate-I6YQ5V2T.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import {
+  INSTANCE_ALIASES,
+  generatePlan,
+  isInstanceAlias,
+  parseDiffForTest,
+  planId
+} from "./chunk-STLRHLLV.js";
+import "./chunk-BSLIYB5Q.js";
+import "./chunk-5XT5IAJK.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+import "./chunk-N4WZLWJ4.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
+export {
+  INSTANCE_ALIASES,
+  generatePlan,
+  isInstanceAlias,
+  parseDiffForTest,
+  planId
+};

package/dist/{harden-URPXLSVF.js → harden-72JMRT4E.js}

@@ -2,8 +2,18 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-DQDAWNGB.js";
-import "./chunk-3XK66DKK.js";
+} from "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import {
+  PUBLISH_INSPECT_CMD,
+  publishForRestart,
+  publishedGatewayPort
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/harden/types.ts
@@ -154,7 +164,11 @@ var sshModule = {
 
 // src/harden/modules/ufw.ts
 var SENTINEL2 = `${SENTINEL_DIR}/ufw.applied`;
-var GATEWAY_PORT = 18789;
+async function publishedGateway(exec) {
+  const { stdout } = await exec(`${PUBLISH_INSPECT_CMD} 2>/dev/null || true`);
+  if (publishForRestart(stdout) !== "all") return { exposed: false };
+  return { exposed: true, port: publishedGatewayPort(stdout) };
+}
 function makeUfwModule(sshPort = 22) {
   return {
     id: "ufw",
@@ -176,14 +190,24 @@ function makeUfwModule(sshPort = 22) {
       return { status: "missing", detail: "UFW installed but not active" };
     },
     async apply(exec) {
+      const gateway = await publishedGateway(exec);
+      const rules = [`ufw allow ${sshPort}/tcp comment "clawops SSH"`];
+      let gatewayNote;
+      if (!gateway.exposed) {
+        gatewayNote = "gateway port not opened (published on 127.0.0.1 \u2014 reach it with `clawops tunnel`)";
+      } else if (gateway.port === void 0) {
+        gatewayNote = "gateway published on every interface but its port could not be read \u2014 no rule added; run `clawops doctor --stack <name>` and open it yourself if that is intended";
+      } else {
+        rules.push(`ufw allow ${gateway.port}/tcp comment "OpenClaw gateway"`);
+        gatewayNote = `allow ${gateway.port}/tcp`;
+      }
       const script = [
         `mkdir -p ${SENTINEL_DIR}`,
         "apt-get install -y -q ufw",
         "ufw --force reset",
         "ufw default deny incoming",
         "ufw default allow outgoing",
-        `ufw allow ${sshPort}/tcp comment "clawops SSH"`,
-        `ufw allow ${GATEWAY_PORT}/tcp comment "OpenClaw gateway"`,
+        ...rules,
         "ufw --force enable",
         `touch ${SENTINEL2}`
       ].join(" && ");
@@ -191,7 +215,10 @@ function makeUfwModule(sshPort = 22) {
       if (code !== 0) {
         throw new Error(`UFW setup failed (exit ${code}): ${stderr.slice(0, 200)}`);
       }
-      return { changed: true, detail: `UFW enabled: deny-all in, allow ${sshPort}/tcp + ${GATEWAY_PORT}/tcp` };
+      return {
+        changed: true,
+        detail: `UFW enabled: deny-all in, allow ${sshPort}/tcp; ${gatewayNote}`
+      };
     }
   };
 }
@@ -473,7 +500,14 @@ var sysctlModule = {
 };
 
 // src/harden/modules/aws-sg-audit.ts
-var EXPECTED_OPEN_PORTS = /* @__PURE__ */ new Set([22, 18789]);
+var WORLD = /* @__PURE__ */ new Set(["0.0.0.0/0"]);
+var WORLD_V6 = /* @__PURE__ */ new Set(["::/0"]);
+var NAMED_PORTS = { 22: "SSH", [GATEWAY_PORT]: "the OpenClaw gateway" };
+function describe(fromPort, toPort) {
+  const range = fromPort === toPort ? `port ${fromPort}` : `ports ${fromPort}-${toPort}`;
+  const named = NAMED_PORTS[fromPort];
+  return named && fromPort === toPort ? `${range} (${named})` : range;
+}
 var awsSgAuditModule = {
   id: "aws-sg-audit",
   label: "AWS SG audit (check-only)",
@@ -492,19 +526,25 @@ var awsSgAuditModule = {
         for (const rule of sg.IpPermissions ?? []) {
           const fromPort = rule.FromPort ?? 0;
           const toPort = rule.ToPort ?? 65535;
+          const where = describe(fromPort, toPort);
           for (const range of rule.IpRanges ?? []) {
-            if (range.CidrIp === "0.0.0.0/0" && !EXPECTED_OPEN_PORTS.has(fromPort)) {
-              openRules.push(`port ${fromPort}\u2013${toPort} open to 0.0.0.0/0 in ${sg.GroupId}`);
+            if (range.CidrIp && WORLD.has(range.CidrIp)) {
+              openRules.push(`${where} open to ${range.CidrIp} in ${sg.GroupId}`);
+            }
+          }
+          for (const range of rule.Ipv6Ranges ?? []) {
+            if (range.CidrIpv6 && WORLD_V6.has(range.CidrIpv6)) {
+              openRules.push(`${where} open to ${range.CidrIpv6} in ${sg.GroupId}`);
             }
           }
         }
       }
       if (openRules.length === 0) {
-        return { status: "applied", detail: "No unexpected open ingress rules found" };
+        return { status: "applied", detail: "No ingress rule admits the whole internet" };
       }
       return {
         status: "drifted",
-        detail: `Open ingress rules detected: ${openRules.join("; ")}`
+        detail: `Ingress open to the internet: ${openRules.join("; ")}`
       };
     } catch (err) {
       return {

package/dist/health-5CCOXYGG.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  HEALTH_PATHS,
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+export {
+  HEALTH_PATHS,
+  interpretProbe,
+  probeCommand
+};

package/dist/index.d.ts

@@ -47,6 +47,62 @@ interface ProviderAdapter {
     stateBackendUrl(bucket: string): string;
     /** Validate provider-specific config (env vars, profiles) at startup. */
     validateConfig(): Promise<ValidationResult>;
+    /**
+     * Account-level setup this provider needs before anything can be provisioned.
+     *
+     * Not infrastructure: enabling an API or creating a state bucket happens outside the
+     * Pulumi program, because the state backend has to exist before Pulumi can run at all.
+     * Optional — a provider with nothing to check omits it.
+     */
+    preflight?(opts: PreflightOpts): Promise<PreflightCheck[]>;
+}
+interface PreflightOpts {
+    /** Where the stack will be deployed, when that changes what must be enabled. */
+    region?: string;
+    /** State backend bucket or container, when the check covers it. */
+    bucket?: string;
+    /**
+     * The machine size about to be deployed, when the caller knows it.
+     *
+     * Azure offers SKU families per subscription, so "is this size available here" can only be
+     * answered about a specific size. Without this the check falls back to the provider's
+     * default alias, which is right for a default deploy and wrong for anyone passing
+     * --instance-type: a deployment using an available size would be reported as broken.
+     */
+    instanceType?: string;
+    signal?: AbortSignal;
+}
+interface PreflightCheck {
+    /** Stable kebab-case id, e.g. "compute-api-enabled". */
+    id: string;
+    /** What is being checked, in the operator's terms. */
+    label: string;
+    ok: boolean;
+    /**
+     * clawops could not put the question — a denied read permission, an API that would not
+     * answer. Neither a pass nor a failure: the operator's account may be perfectly set up, and
+     * saying so would be a claim clawops cannot make.
+     *
+     * Dropping the check instead is worse. An operator whose credentials lack a read permission
+     * then sees one fewer line than everyone else and never learns why. The detail field carries
+     * the reason, and doctor renders these as warnings rather than failing the report over a
+     * question it could not ask.
+     */
+    unknown?: boolean;
+    /** Why it failed, and what it means — shown when ok is false. */
+    detail?: string;
+    /**
+     * Applies the fix. Absent when clawops cannot fix it: a missing permission or an unpaid
+     * billing account is not clawops's to resolve, and pretending otherwise wastes a prompt.
+     */
+    fix?: () => Promise<void>;
+    /**
+     * What the fix changes in the operator's cloud account.
+     *
+     * Shown in the prompt, and required alongside fix(): consent to 'fix it' is not consent to
+     * something unnamed.
+     */
+    mutates?: string;
 }
 
 export type { BaseStackOutputs, ConnectionInfo, CredentialSource, InstanceAlias, ProviderAdapter, ProviderName, PulumiFn, StackOutputs, StateBackendScheme, ValidationResult };

package/dist/known-hosts-file-I3Q3NBYQ.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import {
+  withoutHost
+} from "./chunk-MC5ATCXS.js";
+
+// src/transport/known-hosts-file.ts
+import { readFileSync, writeFileSync } from "fs";
+function forgetHost(knownHostsPath, host, port) {
+  let content;
+  try {
+    content = readFileSync(knownHostsPath, "utf-8");
+  } catch {
+    return false;
+  }
+  const next = withoutHost(content, host, port);
+  if (next === content) return false;
+  writeFileSync(knownHostsPath, next, "utf-8");
+  return true;
+}
+export {
+  forgetHost
+};

package/dist/logs-5A7YYA53.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import {
+  GATEWAY_LOGS_PROBE,
+  agentAuditCommand,
+  chooseLogSource,
+  containerLogsCommand,
+  gatewayLogsCommand
+} from "./chunk-NUL5F6YV.js";
+export {
+  GATEWAY_LOGS_PROBE,
+  agentAuditCommand,
+  chooseLogSource,
+  containerLogsCommand,
+  gatewayLogsCommand
+};

package/dist/{mcp-wire-7E5JQY47.js → mcp-wire-3SWBM7D6.js}

@@ -1,24 +1,40 @@
 #!/usr/bin/env node
 import {
   MCP_HTTP_PORT
-} from "./chunk-GZN7PKP4.js";
-import "./chunk-35WVQY3X.js";
-import "./chunk-6ZFIFDBJ.js";
+} from "./chunk-KC3GC3PE.js";
+import "./chunk-LBE6COC4.js";
 import "./chunk-BOPSG2LI.js";
+import "./chunk-6ZFIFDBJ.js";
 import "./chunk-3QJBNAHW.js";
-import "./chunk-A4QR4TXW.js";
-import "./chunk-6X45DDGH.js";
-import "./chunk-FNS56UQY.js";
-import "./chunk-DQDAWNGB.js";
-import "./chunk-SEZMVVAS.js";
-import "./chunk-P5LKWRPL.js";
+import "./chunk-2I7KCMXZ.js";
+import "./chunk-HSPHXG6W.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-STLRHLLV.js";
+import "./chunk-BSLIYB5Q.js";
+import "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import "./chunk-5XT5IAJK.js";
+import "./chunk-IVWP4QUJ.js";
+import "./chunk-NUL5F6YV.js";
+import "./chunk-3OLUJPCB.js";
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-LT4XMO5D.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
-import "./chunk-3XK66DKK.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
 import "./chunk-Q7NQY5HV.js";
+import "./chunk-N4WZLWJ4.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
 
 // src/cli/mcp-wire.ts
 var GATEWAY_MCP_NAME = "clawops";
@@ -30,17 +46,17 @@ function shellQuote(value) {
 }
 var OC = "docker exec openclaw openclaw mcp";
 async function supportsMcpAdd(session, signal) {
-  const help = await session.exec(`${OC} add --help`, signal);
+  const help = await execPrivileged(session, `${OC} add --help`, signal);
   return help.code === 0;
 }
 async function wireGatewayMcp(session, signal, opts = {}) {
   const url = opts.url ?? defaultGatewayMcpUrl();
   if (!await supportsMcpAdd(session, signal)) return { status: "unsupported", url };
-  const existing = await session.exec(`${OC} show ${GATEWAY_MCP_NAME}`, signal);
+  const existing = await execPrivileged(session, `${OC} show ${GATEWAY_MCP_NAME}`, signal);
   const alreadyWired = existing.code === 0;
   if (alreadyWired && !opts.rewire) return { status: "exists", url };
   if (alreadyWired) {
-    const removed = await session.exec(`${OC} unset ${GATEWAY_MCP_NAME}`, signal);
+    const removed = await execPrivileged(session, `${OC} unset ${GATEWAY_MCP_NAME}`, signal);
     if (removed.code !== 0) {
       return {
         status: "probe-failed",
@@ -54,7 +70,7 @@ async function wireGatewayMcp(session, signal, opts = {}) {
     `--url ${shellQuote(url)}`,
     ...opts.token ? [`--header ${shellQuote(`Authorization=Bearer ${opts.token}`)}`] : []
   ].join(" ");
-  const added = await session.exec(`${OC} add ${GATEWAY_MCP_NAME} ${flags}`, signal);
+  const added = await execPrivileged(session, `${OC} add ${GATEWAY_MCP_NAME} ${flags}`, signal);
   if (added.code !== 0) {
     return {
       status: "probe-failed",
@@ -62,7 +78,7 @@ async function wireGatewayMcp(session, signal, opts = {}) {
       url
     };
   }
-  await session.exec(`${OC} reload`, signal);
+  await execPrivileged(session, `${OC} reload`, signal);
   return { status: "wired", rewired: alreadyWired, url };
 }
 export {

package/dist/models-AGTQWYDL.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+// src/openclaw/models.ts
+function providerKeyOf(provider) {
+  const fromPath = provider.configPath?.split(".").pop();
+  return fromPath && fromPath.length > 0 ? fromPath : provider.id;
+}
+function buildModelsBlock(opts) {
+  const { provider, model, apiKeyRef, baseUrl, region } = opts;
+  const key = providerKeyOf(provider);
+  const modelId = opts.resolvedModelId ?? model.modelId ?? model.id;
+  const entry = {};
+  if (provider.api) entry["api"] = provider.api;
+  if (region) entry["region"] = region;
+  if (apiKeyRef) entry["apiKey"] = apiKeyRef;
+  if (baseUrl) entry["baseUrl"] = baseUrl;
+  if (provider.credentialSource === "aws-profile") {
+    entry["auth"] = "aws-sdk";
+  }
+  entry["models"] = [
+    {
+      id: modelId,
+      name: model.displayName,
+      ...provider.api ? { api: provider.api } : {}
+    }
+  ];
+  return { providers: { [key]: entry } };
+}
+export {
+  buildModelsBlock,
+  providerKeyOf
+};

package/dist/network-args-PYJRJBYO.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/network-args.ts
+function isCidr(value) {
+  const v = value.trim();
+  if (v.includes(":")) return true;
+  return /^(\d{1,3}\.){3}\d{1,3}\/(3[0-2]|[12]?\d)$/.test(v);
+}
+function parseCidrList(flag, value) {
+  const parts = value.split(",").map((s) => s.trim()).filter((s) => s !== "");
+  for (const p of parts) {
+    if (!isCidr(p)) {
+      throw new UsageError(
+        `${flag}: "${p}" is not a CIDR. Use an address and a prefix, e.g. 203.0.113.4/32.`
+      );
+    }
+  }
+  return parts;
+}
+function parsePublishGateway(value) {
+  const v = value.trim();
+  if (v === "loopback" || v === "all") return v;
+  throw new UsageError(`--publish-gateway: expected "loopback" or "all", got "${v}".`);
+}
+async function resolveNetworkFlags(flags, deps) {
+  const resolved = { allowedSshCidrs: [], allowedGatewayCidrs: [] };
+  for (const [flag, raw, key] of [
+    ["--ssh-cidr", flags.sshCidr, "allowedSshCidrs"],
+    ["--gateway-cidr", flags.gatewayCidr, "allowedGatewayCidrs"]
+  ]) {
+    if (raw === void 0) continue;
+    resolved[key] = raw.trim() === "auto" ? [await autoCidr(flag, deps.detectEgressIp)] : parseCidrList(flag, raw);
+  }
+  if (flags.publishGateway !== void 0) {
+    resolved.publishGateway = parsePublishGateway(flags.publishGateway);
+  }
+  return resolved;
+}
+async function autoCidr(flag, detect) {
+  const result = await detect();
+  if (!result.ok || result.ip.trim() === "") {
+    const why = result.ok ? "the lookup returned an empty address" : result.error;
+    throw new UsageError(
+      `${flag} auto: could not detect this machine's public IP \u2014 ${why}. Pass the CIDR explicitly, e.g. 203.0.113.4/32.`
+    );
+  }
+  const ip = result.ip.trim();
+  const cidr = ip.includes("/") ? ip : `${ip}/32`;
+  if (!isCidr(cidr)) {
+    throw new UsageError(
+      `${flag} auto: the detected address "${ip}" is not usable as a CIDR. Pass the CIDR explicitly, e.g. 203.0.113.4/32.`
+    );
+  }
+  return cidr;
+}
+export {
+  isCidr,
+  parseCidrList,
+  parsePublishGateway,
+  resolveNetworkFlags
+};

package/dist/{package-5AR4ZPK4.js → package-5BCMEBTE.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.7.9";
+var version = "2.0.1";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {
@@ -35,19 +35,24 @@ var scripts = {
   test: "vitest run",
   "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
   "test:changed": "vitest --changed",
-  "test:mutation": "node scripts/dev/mutation-check.mjs",
   "test:integration": "vitest run --config vitest.integration.config.ts",
+  "test:cloud": "bash scripts/e2e/cloud.sh",
   typecheck: "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
   lint: "eslint --max-warnings=0 src tests scripts",
   "gen:schemas": "tsx scripts/gen-schemas.ts",
   changeset: "changeset",
-  release: "pnpm build && changeset publish"
+  release: "pnpm build && changeset publish",
+  "test:mutation": "node scripts/dev/mutation-check.mjs",
+  graph: "node scripts/dev/graph.mjs"
 };
 var dependencies = {
+  "@aws-sdk/client-bedrock": "^3.1063.0",
   "@aws-sdk/client-cloudwatch-logs": "^3.1063.0",
   "@aws-sdk/client-ec2": "^3.1063.0",
   "@aws-sdk/client-guardduty": "^3.1063.0",
   "@aws-sdk/client-iam": "^3.1063.0",
+  "@aws-sdk/client-s3": "3.1132.0",
+  "@aws-sdk/client-sts": "3.1132.0",
   "@modelcontextprotocol/sdk": "^1.0.0",
   "@pulumi/aws": "^6.0.0",
   "@pulumi/azure-native": "^2.0.0",
@@ -61,6 +66,7 @@ var dependencies = {
   chalk: "^5.0.0",
   citty: "^0.1.0",
   conf: "^12.0.0",
+  "google-auth-library": "^11.0.2",
   inquirer: "^9.0.0",
   ora: "^8.0.0",
   ssh2: "^1.0.0",
@@ -85,7 +91,8 @@ var devDependencies = {
 };
 var pnpm = {
   overrides: {
-    "@pulumi/pulumi": "^3.0.0"
+    "@pulumi/pulumi": "^3.0.0",
+    "@smithy/types": "4.14.3"
   },
   onlyBuiltDependencies: [
     "@pulumi/command",