@clawops/cli 1.7.9 → 2.0.1

package/dist/aws-L4RR2LSE.js

@@ -1,254 +0,0 @@
-#!/usr/bin/env node
-import {
-  makeStartupScript
-} from "./chunk-C5X375RO.js";
-
-// src/providers/aws/index.ts
-import process2 from "process";
-
-// src/providers/aws/program.ts
-var GATEWAY_PORT = 18789;
-var SSH_PORT = 22;
-var awsProgram = async () => {
-  const [pulumi, aws, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
-    import("@pulumi/pulumi"),
-    import("@pulumi/aws"),
-    import("./firewall-XQGO7HWK.js")
-  ]);
-  const cfg = new pulumi.Config();
-  const instanceType = cfg.get("instanceType") ?? "t3.small";
-  const region = cfg.get("region") ?? "us-east-1";
-  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
-  const accessMode = cfg.get("accessMode") ?? "restricted";
-  const allowedCidrs = cfg.get("allowedCidrs") ?? "";
-  const sshCidrs = cfg.get("sshCidrs") ?? "";
-  const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
-  const bedrockEnabled = cfg.get("bedrockEnabled") === "true";
-  const pinnedAmiId = cfg.get("amiId");
-  const sshPublicKey = cfg.get("sshPublicKey");
-  if (!sshPublicKey) {
-    throw new Error(
-      'Stack config "sshPublicKey" is required for the AWS adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
-    );
-  }
-  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
-  if (accessMode === "open") {
-    process.stderr.write(
-      "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
-    );
-  }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
-  const vpc = new aws.ec2.Vpc("clawops-vpc", {
-    cidrBlock: "10.0.0.0/16",
-    enableDnsHostnames: true,
-    enableDnsSupport: true,
-    tags: { Name: "clawops" }
-  });
-  const igw = new aws.ec2.InternetGateway("clawops-igw", {
-    tags: { Name: "clawops" }
-  });
-  new aws.ec2.InternetGatewayAttachment("clawops-igw-attach", {
-    vpcId: vpc.id,
-    internetGatewayId: igw.id
-  });
-  const subnet = new aws.ec2.Subnet("clawops-subnet", {
-    vpcId: vpc.id,
-    cidrBlock: "10.0.1.0/24",
-    mapPublicIpOnLaunch: false,
-    availabilityZone: pulumi.interpolate`${region}a`,
-    tags: { Name: "clawops" }
-  });
-  const routeTable = new aws.ec2.RouteTable("clawops-rt", {
-    vpcId: vpc.id,
-    tags: { Name: "clawops" }
-  });
-  new aws.ec2.Route("clawops-route", {
-    routeTableId: routeTable.id,
-    destinationCidrBlock: "0.0.0.0/0",
-    gatewayId: igw.id
-  });
-  new aws.ec2.RouteTableAssociation("clawops-rta", {
-    subnetId: subnet.id,
-    routeTableId: routeTable.id
-  });
-  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
-    vpcId: vpc.id,
-    description: "clawops managed security group",
-    tags: { Name: "clawops" }
-  });
-  sshIngressCidrs.forEach((cidr, i) => {
-    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-ssh-${i}`, {
-      securityGroupId: sg.id,
-      ipProtocol: "tcp",
-      fromPort: SSH_PORT,
-      toPort: SSH_PORT,
-      cidrIpv4: cidr,
-      tags: { Name: `clawops-ssh-${i}` }
-    });
-  });
-  gatewayIngressCidrs.forEach((cidr, i) => {
-    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-gw-${i}`, {
-      securityGroupId: sg.id,
-      ipProtocol: "tcp",
-      fromPort: GATEWAY_PORT,
-      toPort: GATEWAY_PORT,
-      cidrIpv4: cidr,
-      tags: { Name: `clawops-gateway-${i}` }
-    });
-  });
-  new aws.vpc.SecurityGroupEgressRule("clawops-sg-egress", {
-    securityGroupId: sg.id,
-    ipProtocol: "-1",
-    cidrIpv4: "0.0.0.0/0",
-    tags: { Name: "clawops-egress" }
-  });
-  const role = new aws.iam.Role("clawops-role", {
-    assumeRolePolicy: JSON.stringify({
-      Version: "2012-10-17",
-      Statement: [{
-        Effect: "Allow",
-        Principal: { Service: "ec2.amazonaws.com" },
-        Action: "sts:AssumeRole"
-      }]
-    }),
-    tags: { Name: "clawops" }
-  });
-  new aws.iam.RolePolicyAttachment("clawops-ssm", {
-    role: role.name,
-    policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
-  });
-  if (bedrockEnabled) {
-    new aws.iam.RolePolicy("clawops-bedrock-invoke", {
-      role: role.name,
-      policy: JSON.stringify({
-        Version: "2012-10-17",
-        Statement: [{
-          Effect: "Allow",
-          Action: [
-            "bedrock:InvokeModel",
-            "bedrock:InvokeModelWithResponseStream"
-          ],
-          Resource: "*"
-        }]
-      })
-    });
-  }
-  const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
-    role: role.name
-  });
-  const keyPair = new aws.ec2.KeyPair("clawops-keypair", {
-    publicKey: sshPublicKey,
-    tags: { Name: "clawops" }
-  });
-  const amiId = pinnedAmiId ?? (await aws.ec2.getAmi({
-    mostRecent: true,
-    owners: ["099720109477"],
-    // Canonical
-    filters: [
-      { name: "name", values: ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] },
-      { name: "virtualization-type", values: ["hvm"] }
-    ]
-  })).id;
-  process.stderr.write(`[clawops] Using AMI: ${amiId}
-`);
-  const instance = new aws.ec2.Instance("clawops-instance", {
-    ami: amiId,
-    instanceType,
-    subnetId: subnet.id,
-    vpcSecurityGroupIds: [sg.id],
-    iamInstanceProfile: instanceProfile.name,
-    keyName: keyPair.keyName,
-    userData: makeStartupScript({ openclawVersion, os: "ubuntu", bedrockEnabled }),
-    // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
-    // and obtain the instance role credentials (required for Bedrock access).
-    metadataOptions: {
-      httpTokens: "required",
-      httpPutResponseHopLimit: 2
-    },
-    tags: { Name: "clawops" }
-  });
-  const eip = new aws.ec2.Eip("clawops-eip", {
-    domain: "vpc",
-    tags: { Name: "clawops" }
-  });
-  new aws.ec2.EipAssociation("clawops-eip-assoc", {
-    instanceId: instance.id,
-    allocationId: eip.id
-  });
-  return {
-    instanceId: instance.id,
-    publicIp: eip.publicIp,
-    gatewayUrl: pulumi.interpolate`https://${eip.publicIp}:${GATEWAY_PORT}`,
-    sshHost: eip.publicIp,
-    sshPort: SSH_PORT,
-    sshUser: "ubuntu",
-    region,
-    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-};
-
-// src/providers/aws/index.ts
-var INSTANCE_TYPE_MAP = {
-  micro: "t3.micro",
-  small: "t3.small",
-  medium: "t3.medium",
-  large: "t3.large",
-  gpu: "g4dn.xlarge"
-};
-var awsAdapter = {
-  name: "aws",
-  get program() {
-    return awsProgram;
-  },
-  getConnectionInfo(outputs) {
-    return {
-      host: String(outputs["sshHost"] ?? ""),
-      port: Number(outputs["sshPort"] ?? 22),
-      user: String(outputs["sshUser"] ?? "ubuntu"),
-      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
-      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
-    };
-  },
-  normalizeInstanceType(alias) {
-    const mapped = INSTANCE_TYPE_MAP[alias];
-    if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
-    return mapped;
-  },
-  defaultRegion() {
-    return "us-east-1";
-  },
-  stateBackendUrl(bucket) {
-    return `s3://${bucket}`;
-  },
-  async validateConfig() {
-    const errors = [];
-    const hasProfile = Boolean(process2.env["AWS_PROFILE"]);
-    const hasKeyId = Boolean(process2.env["AWS_ACCESS_KEY_ID"]);
-    const hasOidc = Boolean(process2.env["AWS_ROLE_ARN"] && process2.env["AWS_WEB_IDENTITY_TOKEN_FILE"]);
-    if (!hasProfile && !hasKeyId && !hasOidc) {
-      const onAws = await checkImds();
-      if (!onAws) {
-        errors.push(
-          "No AWS credentials found. Set AWS_PROFILE, AWS_ACCESS_KEY_ID, or AWS_ROLE_ARN + AWS_WEB_IDENTITY_TOKEN_FILE, or run on an EC2 instance with an IAM instance role."
-        );
-      }
-    }
-    return { ok: errors.length === 0, errors };
-  }
-};
-async function checkImds() {
-  try {
-    const res = await fetch(
-      "http://169.254.169.254/latest/meta-data/instance-id",
-      { signal: AbortSignal.timeout(1e3) }
-    );
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-var aws_default = awsAdapter;
-export {
-  aws_default as default
-};

package/dist/azure-7OXQENQL.js

@@ -1,262 +0,0 @@
-#!/usr/bin/env node
-import {
-  makeStartupScript
-} from "./chunk-C5X375RO.js";
-
-// src/providers/azure/index.ts
-import process2 from "process";
-
-// src/providers/azure/program.ts
-import { createHash } from "crypto";
-var GATEWAY_PORT = 18789;
-var SSH_PORT = 22;
-var azureProgram = async () => {
-  const [pulumi, azure, random, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
-    import("@pulumi/pulumi"),
-    import("@pulumi/azure-native"),
-    import("@pulumi/random"),
-    import("./firewall-XQGO7HWK.js")
-  ]);
-  const cfg = new pulumi.Config();
-  const stackName = pulumi.getStack();
-  const instanceType = cfg.get("instanceType") ?? "Standard_B2s";
-  const location = cfg.get("region") ?? "eastus";
-  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
-  const accessMode = cfg.get("accessMode") ?? "restricted";
-  const allowedCidrs = cfg.get("allowedCidrs") ?? "";
-  const sshCidrs = cfg.get("sshCidrs") ?? "";
-  const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
-  const keyVaultEnabled = cfg.get("keyVaultEnabled") === "true";
-  const resourceGroupName = cfg.get("resourceGroupName") ?? `clawops-${stackName}`;
-  const sshPublicKey = cfg.get("sshPublicKey");
-  if (!sshPublicKey) {
-    throw new Error(
-      'Stack config "sshPublicKey" is required for the Azure adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
-    );
-  }
-  const clientConfig = await azure.authorization.getClientConfig({});
-  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
-  if (accessMode === "open") {
-    process.stderr.write(
-      "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
-    );
-  }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
-  const rg = new azure.resources.ResourceGroup("clawops-rg", {
-    resourceGroupName,
-    location
-  });
-  const vnet = new azure.network.VirtualNetwork("clawops-vnet", {
-    resourceGroupName: rg.name,
-    location: rg.location,
-    addressSpace: { addressPrefixes: ["10.0.0.0/16"] }
-  });
-  const subnet = new azure.network.Subnet("clawops-subnet", {
-    resourceGroupName: rg.name,
-    virtualNetworkName: vnet.name,
-    addressPrefix: "10.0.1.0/24"
-  });
-  const securityRules = [];
-  let priority = 100;
-  for (const cidr of sshIngressCidrs) {
-    securityRules.push({
-      name: `allow-ssh-${priority}`,
-      priority: priority++,
-      direction: "Inbound",
-      access: "Allow",
-      protocol: "Tcp",
-      sourceAddressPrefix: cidr,
-      sourcePortRange: "*",
-      destinationAddressPrefix: "*",
-      destinationPortRange: String(SSH_PORT)
-    });
-  }
-  for (const cidr of gatewayIngressCidrs) {
-    securityRules.push({
-      name: `allow-gateway-${priority}`,
-      priority: priority++,
-      direction: "Inbound",
-      access: "Allow",
-      protocol: "Tcp",
-      sourceAddressPrefix: cidr,
-      sourcePortRange: "*",
-      destinationAddressPrefix: "*",
-      destinationPortRange: String(GATEWAY_PORT)
-    });
-  }
-  const nsg = new azure.network.NetworkSecurityGroup("clawops-nsg", {
-    resourceGroupName: rg.name,
-    location: rg.location,
-    securityRules
-  });
-  const publicIp = new azure.network.PublicIPAddress("clawops-pip", {
-    resourceGroupName: rg.name,
-    location: rg.location,
-    publicIPAllocationMethod: "Static",
-    sku: { name: "Standard" }
-  });
-  const nic = new azure.network.NetworkInterface("clawops-nic", {
-    resourceGroupName: rg.name,
-    location: rg.location,
-    networkSecurityGroup: { id: nsg.id },
-    ipConfigurations: [{
-      name: "clawops-ipconfig",
-      subnet: { id: subnet.id },
-      publicIPAddress: { id: publicIp.id },
-      privateIPAllocationMethod: "Dynamic"
-    }]
-  });
-  const vm = new azure.compute.VirtualMachine("clawops-vm", {
-    resourceGroupName: rg.name,
-    location: rg.location,
-    hardwareProfile: { vmSize: instanceType },
-    identity: { type: "SystemAssigned" },
-    osProfile: {
-      adminUsername: "clawops",
-      computerName: "clawops",
-      customData: Buffer.from(makeStartupScript({ openclawVersion, os: "ubuntu" })).toString("base64"),
-      linuxConfiguration: {
-        disablePasswordAuthentication: true,
-        ssh: {
-          publicKeys: [{
-            keyData: sshPublicKey,
-            path: "/home/clawops/.ssh/authorized_keys"
-          }]
-        }
-      }
-    },
-    storageProfile: {
-      imageReference: {
-        publisher: "Canonical",
-        // Ubuntu 22.04 LTS — Canonical migrated from the legacy 'UbuntuServer'
-        // offer to this naming scheme. 22_04-lts-gen2 is available in all regions.
-        offer: "0001-com-ubuntu-server-jammy",
-        sku: "22_04-lts-gen2",
-        version: "latest"
-      },
-      osDisk: {
-        createOption: "FromImage",
-        managedDisk: { storageAccountType: "Premium_LRS" },
-        diskSizeGB: 30
-      }
-    },
-    networkProfile: {
-      networkInterfaces: [{ id: nic.id, primary: true }]
-    }
-  });
-  if (keyVaultEnabled) {
-    const safeName = stackName.replace(/[^a-zA-Z0-9-]/g, "-");
-    const rawKvName = `clawops-${safeName}-kv`;
-    const kvName = rawKvName.length > 24 ? `cl-${createHash("sha256").update(stackName).digest("hex").slice(0, 20)}` : rawKvName;
-    const kv = new azure.keyvault.Vault("clawops-kv", {
-      resourceGroupName: rg.name,
-      location: rg.location,
-      vaultName: kvName,
-      properties: {
-        sku: { family: "A", name: "standard" },
-        tenantId: pulumi.output(vm.identity).apply((i) => i?.tenantId ?? ""),
-        enableRbacAuthorization: true
-      }
-    });
-    const kvSecretsUserRoleId = `/subscriptions/${clientConfig.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6`;
-    new azure.authorization.RoleAssignment("clawops-kv-role", {
-      scope: kv.id,
-      roleDefinitionId: kvSecretsUserRoleId,
-      principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
-      principalType: "ServicePrincipal"
-    });
-    const gatewayToken = new random.RandomPassword("clawops-kv-gateway-token", {
-      length: 32,
-      special: false
-    });
-    new azure.keyvault.Secret("clawops-gateway-token", {
-      resourceGroupName: rg.name,
-      vaultName: kv.name,
-      secretName: "gateway-token",
-      properties: { value: gatewayToken.result }
-    });
-  }
-  const resolvedIp = pulumi.output(publicIp.ipAddress).apply((ip) => ip ?? "");
-  return {
-    instanceId: vm.id,
-    publicIp: resolvedIp,
-    gatewayUrl: pulumi.interpolate`https://${resolvedIp}:${GATEWAY_PORT}`,
-    sshHost: resolvedIp,
-    sshPort: SSH_PORT,
-    sshUser: "clawops",
-    region: location,
-    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-};
-
-// src/providers/azure/index.ts
-var INSTANCE_TYPE_MAP = {
-  micro: "Standard_B1s",
-  small: "Standard_B2s",
-  medium: "Standard_B4ms",
-  large: "Standard_B8ms",
-  gpu: "Standard_NC6s_v3"
-};
-var azureAdapter = {
-  name: "azure",
-  get program() {
-    return azureProgram;
-  },
-  getConnectionInfo(outputs) {
-    return {
-      host: String(outputs["sshHost"] ?? ""),
-      port: Number(outputs["sshPort"] ?? 22),
-      user: String(outputs["sshUser"] ?? "clawops"),
-      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
-      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
-    };
-  },
-  normalizeInstanceType(alias) {
-    const mapped = INSTANCE_TYPE_MAP[alias];
-    if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
-    return mapped;
-  },
-  defaultRegion() {
-    return "eastus";
-  },
-  stateBackendUrl(bucket) {
-    return `azblob://${bucket}`;
-  },
-  async validateConfig() {
-    const errors = [];
-    const clientId = process2.env["AZURE_CLIENT_ID"];
-    const tenantId = process2.env["AZURE_TENANT_ID"];
-    const clientSecret = process2.env["AZURE_CLIENT_SECRET"];
-    const federatedToken = process2.env["AZURE_FEDERATED_TOKEN_FILE"];
-    const hasServicePrincipal = Boolean(clientId && tenantId && clientSecret);
-    const hasOidc = Boolean(clientId && tenantId && federatedToken);
-    if (!hasServicePrincipal && !hasOidc) {
-      const onAzure = await checkImds();
-      if (!onAzure) {
-        errors.push(
-          "No Azure credentials found. Set AZURE_CLIENT_ID + AZURE_TENANT_ID + AZURE_CLIENT_SECRET (service principal), or AZURE_CLIENT_ID + AZURE_TENANT_ID + AZURE_FEDERATED_TOKEN_FILE (OIDC), or run on an Azure VM with a managed identity."
-        );
-      }
-    }
-    return { ok: errors.length === 0, errors };
-  }
-};
-async function checkImds() {
-  try {
-    const res = await fetch(
-      "http://169.254.169.254/metadata/instance?api-version=2021-02-01",
-      {
-        headers: { Metadata: "true" },
-        signal: AbortSignal.timeout(1e3)
-      }
-    );
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-var azure_default = azureAdapter;
-export {
-  azure_default as default
-};

package/dist/chunk-35WVQY3X.js

@@ -1,122 +0,0 @@
-#!/usr/bin/env node
-import {
-  saveOverlay
-} from "./chunk-6ZFIFDBJ.js";
-import {
-  resolveSecrets
-} from "./chunk-BOPSG2LI.js";
-import {
-  validatePlan
-} from "./chunk-6X45DDGH.js";
-import {
-  atomicWriteConfig,
-  deepMerge,
-  readRemoteConfig,
-  restartGateway
-} from "./chunk-SEZMVVAS.js";
-import {
-  buildContext
-} from "./chunk-P5LKWRPL.js";
-import {
-  UsageError
-} from "./chunk-KGXPLI7W.js";
-
-// src/plan/apply.ts
-async function applyPlan(plan, opts) {
-  const validation = validatePlan(plan);
-  if (!validation.ok) {
-    throw new UsageError(
-      `Invalid deploy plan:
-${validation.errors.join("\n")}`
-    );
-  }
-  if (plan.spec.provider === "local") {
-    throw new UsageError(
-      "plan/apply is not supported for the local provider. Use `clawops up` directly."
-    );
-  }
-  const { guardOpenclawVersion } = await import("./version-guard-VUCNZXQS.js");
-  await guardOpenclawVersion(plan.spec.openclaw.version);
-  const ctx = buildContext({
-    stack: plan.spec.stackName,
-    provider: plan.spec.provider
-  });
-  const stack = await ctx.getStack();
-  await stack.setConfig("instanceType", { value: plan.spec.instanceType });
-  if (plan.spec.region) {
-    await stack.setConfig("region", { value: plan.spec.region });
-  }
-  await stack.setConfig("openclawVersion", { value: plan.spec.openclaw.version });
-  const modelProvider = plan.spec.openclaw.config?.["models"]?.["provider"];
-  if (modelProvider === "bedrock") {
-    await stack.setConfig("bedrockEnabled", { value: "true" });
-  }
-  if (plan.metadata.stackVersion !== void 0) {
-    const currentInfo = await stack.info();
-    if (currentInfo !== void 0 && currentInfo.version !== plan.metadata.stackVersion) {
-      process.stderr.write(
-        `
-Warning: stack "${plan.spec.stackName}" has changed since this plan was generated (plan version: ${plan.metadata.stackVersion}, current: ${currentInfo.version}).
-The diff you reviewed may no longer reflect what will be applied.
-
-`
-      );
-      if (opts?.confirmDrift) {
-        await opts.confirmDrift();
-      }
-    }
-  }
-  const start = Date.now();
-  const result = await stack.up({ onOutput: opts?.onOutput, signal: opts?.signal });
-  const outputs = Object.fromEntries(
-    Object.entries(result.outputs).map(([k, v]) => [k, v.value])
-  );
-  const changeSummary = {};
-  if (result.summary.resourceChanges) {
-    for (const [op, count] of Object.entries(result.summary.resourceChanges)) {
-      changeSummary[op] = count;
-    }
-  }
-  const hasOverlay = plan.spec.openclaw.config !== void 0 || plan.spec.openclaw.channels !== void 0;
-  if (hasOverlay) {
-    await applyConfigOverlay(plan, outputs, ctx, opts?.signal);
-  }
-  return {
-    outputs,
-    changeSummary,
-    durationMs: Date.now() - start
-  };
-}
-async function applyConfigOverlay(plan, outputs, ctx, signal) {
-  const { connect } = await import("./ssh-CNJNLM3E.js");
-  const connInfo = ctx.adapter.getConnectionInfo(outputs);
-  const session = await connect({
-    host: connInfo.host,
-    port: connInfo.port,
-    user: connInfo.user,
-    privateKeyPath: connInfo.privateKeyPath,
-    knownHostsPath: connInfo.knownHostsPath,
-    signal
-  });
-  try {
-    const remote = await readRemoteConfig(session, signal);
-    const configOverlay = plan.spec.openclaw.config ?? {};
-    const resolvedOverlay = resolveSecrets(
-      configOverlay,
-      plan.spec.secrets ?? []
-    );
-    const merged = deepMerge(remote, {
-      ...resolvedOverlay,
-      ...plan.spec.openclaw.channels !== void 0 ? { channels: plan.spec.openclaw.channels } : {}
-    });
-    await atomicWriteConfig(session, merged, signal);
-    await restartGateway(session, signal);
-    saveOverlay(plan.spec.stackName, configOverlay, plan.spec.secrets ?? []);
-  } finally {
-    session.close();
-  }
-}
-
-export {
-  applyPlan
-};

package/dist/chunk-6X45DDGH.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-import {
-  resolveSpecDir
-} from "./chunk-PVUVI35Y.js";
-
-// src/plan/validate.ts
-import Ajv from "ajv/dist/2020";
-import addFormats from "ajv-formats";
-import { readFileSync } from "fs";
-import { join } from "path";
-var _validate;
-function getValidator() {
-  if (_validate) return _validate;
-  const ajv = new Ajv({ strict: false });
-  addFormats(ajv);
-  const schema = JSON.parse(
-    readFileSync(join(resolveSpecDir(), "deploy-plan.schema.json"), "utf-8")
-  );
-  _validate = ajv.compile(schema);
-  return _validate;
-}
-function validatePlan(plan) {
-  const validate = getValidator();
-  const ok = validate(plan);
-  if (ok) return { ok: true, errors: [] };
-  const errors = (validate.errors ?? []).map(
-    (e) => `${e.instancePath} ${e.message ?? ""}`.trim()
-  );
-  return { ok: false, errors };
-}
-function assertValidPlan(plan) {
-  const result = validatePlan(plan);
-  if (!result.ok) {
-    throw new Error(`Invalid deploy plan:
-${result.errors.join("\n")}`);
-  }
-}
-
-export {
-  validatePlan,
-  assertValidPlan
-};