@clawops/cli 1.7.9 → 2.0.1

package/dist/chunk-LT4XMO5D.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+// src/openclaw/health.ts
+var HEALTH_PATHS = {
+  /** Process is up and serving. `{"ok":true,"status":"live"}` */
+  live: "/health",
+  /** Startup completed — the gate for "is this deploy finished". `{"ok":true,"status":"started"}` */
+  started: "/startupz",
+  /** Accepting work. `{"ready":true}` */
+  ready: "/readyz"
+};
+function probeCommand(kind, port, pathPrefix = "") {
+  return `${pathPrefix}curl -fsS -m 5 http://127.0.0.1:${port}${HEALTH_PATHS[kind]} 2>/dev/null || true`;
+}
+function interpretProbe(kind, body) {
+  const text = body.trim();
+  if (text === "") return { ok: false, reason: "no response from the gateway" };
+  if (text.startsWith("<")) {
+    return {
+      ok: false,
+      reason: `${HEALTH_PATHS[kind]} returned HTML, not JSON \u2014 the gateway serves its Control UI on a catch-all route, so an unknown path answers 200 with the SPA. The endpoint is missing or renamed on this OpenClaw version.`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { ok: false, reason: `${HEALTH_PATHS[kind]} returned unparseable JSON: ${text.slice(0, 80)}` };
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    return { ok: false, reason: `${HEALTH_PATHS[kind]} returned ${text.slice(0, 40)}` };
+  }
+  const obj = parsed;
+  if (kind === "ready") {
+    return obj["ready"] === true ? { ok: true } : { ok: false, reason: `gateway is not ready: ${text.slice(0, 80)}` };
+  }
+  if (obj["ok"] !== true) {
+    return { ok: false, reason: `gateway reported not ok: ${text.slice(0, 80)}` };
+  }
+  if (kind === "started" && obj["status"] !== "started") {
+    return { ok: false, reason: `gateway is still starting (status: ${String(obj["status"])})` };
+  }
+  return { ok: true };
+}
+
+export {
+  HEALTH_PATHS,
+  probeCommand,
+  interpretProbe
+};

package/dist/chunk-MC5ATCXS.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+// src/transport/known-hosts.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function hostEntryFor(host, port) {
+  return port === 22 ? host : `[${host}]:${port}`;
+}
+function parseKnownHosts(content) {
+  const entries = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    let parts = line.split(/\s+/);
+    let marker;
+    if (parts[0]?.startsWith("@")) {
+      marker = parts[0];
+      parts = parts.slice(1);
+    }
+    const hostField = parts[0];
+    if (!hostField) continue;
+    const hosts = hostField.split(",");
+    if (parts.length >= 3) {
+      entries.push({ hosts, keyType: parts[1], base64Key: parts[2], ...marker ? { marker } : {} });
+    } else if (parts.length === 2 && /^[0-9a-f]+$/i.test(parts[1] ?? "")) {
+      entries.push({ hosts, hexKey: parts[1], ...marker ? { marker } : {} });
+    }
+  }
+  return entries;
+}
+function hashedHostMatches(token, hostEntry) {
+  const parts = token.split("|");
+  if (parts.length !== 4 || parts[1] !== "1") return false;
+  const salt = parts[2];
+  const expected = parts[3];
+  if (!salt || !expected) return false;
+  try {
+    const actual = createHmac("sha1", Buffer.from(salt, "base64")).update(hostEntry).digest("base64");
+    const a = Buffer.from(actual);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function patternToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+var isPattern = (host) => host.includes("*") || host.includes("?");
+function entryMatchesHost(entry, hostEntry) {
+  let matched = false;
+  for (const host of entry.hosts) {
+    if (host.startsWith("|1|")) {
+      if (hashedHostMatches(host, hostEntry)) matched = true;
+      continue;
+    }
+    const negated = host.startsWith("!");
+    const pattern = negated ? host.slice(1) : host;
+    const hit = isPattern(pattern) ? patternToRegExp(pattern).test(hostEntry) : pattern === hostEntry;
+    if (hit) {
+      if (negated) return false;
+      matched = true;
+    }
+  }
+  return matched;
+}
+function verifyAgainstKnownHosts(content, host, port, key) {
+  const hostEntry = hostEntryFor(host, port);
+  const base64Key = key.toString("base64");
+  const hexKey = key.toString("hex");
+  let sawHost = false;
+  for (const entry of parseKnownHosts(content)) {
+    if (!entryMatchesHost(entry, hostEntry)) continue;
+    if (entry.marker === "@cert-authority") continue;
+    sawHost = true;
+    const matches = entry.base64Key ? entry.base64Key === base64Key : entry.hexKey?.toLowerCase() === hexKey.toLowerCase();
+    if (matches) return entry.marker === "@revoked" ? "mismatch" : "match";
+  }
+  return sawHost ? "mismatch" : "unknown";
+}
+function withoutHost(content, host, port) {
+  const hostEntry = hostEntryFor(host, port);
+  const kept = [];
+  for (const raw of content.split("\n")) {
+    const [entry] = parseKnownHosts(raw);
+    if (entry && entryMatchesHost(entry, hostEntry)) continue;
+    kept.push(raw);
+  }
+  return kept.join("\n");
+}
+function formatKnownHostsLine(host, port, keyType, key) {
+  return `${hostEntryFor(host, port)} ${keyType} ${key.toString("base64")}
+`;
+}
+function keyTypeFromBlob(key) {
+  if (key.length < 4) return void 0;
+  const len = key.readUInt32BE(0);
+  if (len === 0 || len > 64 || key.length < 4 + len) return void 0;
+  const type = key.subarray(4, 4 + len).toString("utf-8");
+  return /^[\x20-\x7e]+$/.test(type) ? type : void 0;
+}
+
+export {
+  verifyAgainstKnownHosts,
+  withoutHost,
+  formatKnownHostsLine,
+  keyTypeFromBlob
+};

package/dist/chunk-N4WZLWJ4.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+// src/providers/aws/sizes.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "t3.micro",
+  small: "t3.small",
+  medium: "t3.medium",
+  large: "t3.large",
+  gpu: "g4dn.xlarge"
+};
+var DEFAULT_ALIAS = "small";
+
+export {
+  INSTANCE_TYPE_MAP,
+  DEFAULT_ALIAS
+};

package/dist/chunk-NUDIHZEH.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+
+// src/transport/privileged.ts
+function shellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function sudoWrap(cmd) {
+  return `sudo -n bash -c ${shellQuote(cmd)}`;
+}
+function looksLikePermissionDenied(result) {
+  if (result.code === 0) return false;
+  const text = `${result.stderr} ${result.stdout}`.toLowerCase();
+  return text.includes("permission denied") || text.includes("docker.sock") || text.includes("operation not permitted");
+}
+var sudoNeeded = /* @__PURE__ */ new WeakMap();
+function resetPrivilegeCache(session) {
+  sudoNeeded.delete(session);
+}
+async function execPrivileged(session, cmd, signal) {
+  const key = session;
+  if (sudoNeeded.get(key) === true) return session.exec(sudoWrap(cmd), signal);
+  const direct = await session.exec(cmd, signal);
+  if (!looksLikePermissionDenied(direct)) {
+    if (direct.code === 0) sudoNeeded.set(key, false);
+    return direct;
+  }
+  const escalated = await session.exec(sudoWrap(cmd), signal);
+  if (escalated.code === 0) sudoNeeded.set(key, true);
+  return escalated;
+}
+async function streamPrivileged(session, cmd, signal) {
+  const key = session;
+  if (sudoNeeded.get(key) === void 0) {
+    const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
+    sudoNeeded.set(key, looksLikePermissionDenied(probe));
+  }
+  return session.stream(sudoNeeded.get(key) ? sudoWrap(cmd) : cmd, signal);
+}
+async function execPrivilegedWithInput(session, cmd, input, signal) {
+  const key = session;
+  if (sudoNeeded.get(key) === void 0) {
+    const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
+    sudoNeeded.set(key, looksLikePermissionDenied(probe));
+  }
+  return session.execWithInput(sudoNeeded.get(key) ? sudoWrap(cmd) : cmd, input, signal);
+}
+
+export {
+  shellQuote,
+  sudoWrap,
+  resetPrivilegeCache,
+  execPrivileged,
+  streamPrivileged,
+  execPrivilegedWithInput
+};

package/dist/chunk-NUL5F6YV.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+// src/openclaw/logs.ts
+var GATEWAY_LOGS_PROBE = "docker exec openclaw openclaw logs --limit 1 >/dev/null";
+function gatewayLogsCommand(opts) {
+  return [
+    "docker exec openclaw openclaw logs",
+    `--limit ${opts.tail}`,
+    opts.follow ? "--follow" : "",
+    opts.json ? "--json" : ""
+  ].filter(Boolean).join(" ");
+}
+function containerLogsCommand(opts) {
+  return [
+    "docker logs openclaw",
+    `-n ${opts.tail}`,
+    opts.follow ? "-f" : "",
+    opts.since ? `--since ${shellQuote(opts.since)}` : ""
+  ].filter(Boolean).join(" ");
+}
+function chooseLogSource(opts) {
+  if (opts.since) {
+    return {
+      source: "container",
+      reason: "--since is a container-log filter; the gateway log command has no equivalent"
+    };
+  }
+  if (!opts.gatewayReachable) {
+    return {
+      source: "container",
+      reason: "the gateway is not answering, so its own logs cannot be read \u2014 showing container output"
+    };
+  }
+  return { source: "gateway", reason: "read from the gateway over RPC" };
+}
+function agentAuditCommand(opts) {
+  return [
+    "docker exec openclaw openclaw audit",
+    `--agent ${shellQuote(opts.agentId)}`,
+    "--kind agent_run",
+    "--json",
+    `--limit ${opts.limit}`,
+    opts.cursor ? `--cursor ${shellQuote(opts.cursor)}` : ""
+  ].filter(Boolean).join(" ");
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+export {
+  GATEWAY_LOGS_PROBE,
+  gatewayLogsCommand,
+  containerLogsCommand,
+  chooseLogSource,
+  agentAuditCommand
+};

package/dist/chunk-RHOWYIWT.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+// src/providers/azure/cli-auth.ts
+import path from "path";
+import process from "process";
+import { readFileSync } from "fs";
+function azureConfigDir() {
+  const explicit = process.env["AZURE_CONFIG_DIR"];
+  if (explicit) return explicit;
+  const home = process.env["HOME"] ?? process.env["USERPROFILE"];
+  return home ? path.join(home, ".azure") : void 0;
+}
+function accountFromProfile(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body.replace(/^\uFEFF/, ""));
+  } catch {
+    return void 0;
+  }
+  const subscriptions = parsed?.subscriptions;
+  if (!Array.isArray(subscriptions)) return void 0;
+  const entries = subscriptions;
+  const chosen = entries.find((s) => s["isDefault"] === true) ?? entries[0];
+  if (!chosen) return void 0;
+  const id = typeof chosen["id"] === "string" ? chosen["id"] : void 0;
+  if (!id) return void 0;
+  const user = chosen["user"];
+  return {
+    subscriptionId: id,
+    name: typeof chosen["name"] === "string" ? chosen["name"] : id,
+    ...typeof user?.name === "string" ? { user: user.name } : {}
+  };
+}
+function azureCliAccount() {
+  const dir = azureConfigDir();
+  if (!dir) return void 0;
+  try {
+    return accountFromProfile(readFileSync(path.join(dir, "azureProfile.json"), "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function resolveSubscriptionId() {
+  return process.env["ARM_SUBSCRIPTION_ID"] ?? process.env["AZURE_SUBSCRIPTION_ID"] ?? azureCliAccount()?.subscriptionId;
+}
+
+export {
+  azureConfigDir,
+  accountFromProfile,
+  azureCliAccount,
+  resolveSubscriptionId
+};

package/dist/chunk-STLRHLLV.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+import {
+  validatePlan
+} from "./chunk-BSLIYB5Q.js";
+import {
+  buildContext,
+  loadAdapterModule
+} from "./chunk-5XT5IAJK.js";
+import {
+  getConfig
+} from "./chunk-CX5SL5HP.js";
+import {
+  StateError,
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/generate.ts
+import { randomUUID } from "crypto";
+var PREVIEW_LINE_RE = /^([+~-])\s+(\S+)\s+(\S+)?/;
+function parseDiff(lines) {
+  const create = [];
+  const update = [];
+  const del = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const m = PREVIEW_LINE_RE.exec(line.trimStart());
+    if (!m) continue;
+    const [, op, resourceType, name] = m;
+    const urn = `urn:pulumi:::clawops::${resourceType}::${name ?? ""}`;
+    if (seen.has(`${op}${urn}`)) continue;
+    seen.add(`${op}${urn}`);
+    const ref = {
+      urn,
+      type: resourceType,
+      ...name ? { name } : {}
+    };
+    if (op === "+") create.push(ref);
+    else if (op === "~") update.push({ resource: ref, before: null, after: null });
+    else if (op === "-") del.push(ref);
+  }
+  return {
+    create,
+    update,
+    delete: del,
+    totalChanges: create.length + update.length + del.length
+  };
+}
+var INSTANCE_ALIASES = ["micro", "small", "medium", "large", "gpu"];
+function isInstanceAlias(value) {
+  return INSTANCE_ALIASES.includes(value);
+}
+async function resolveInstanceType(intent) {
+  const requested = intent.instanceType ?? "small";
+  if (!isInstanceAlias(requested)) {
+    process.stderr.write(
+      `[clawops] note: "${requested}" is not a clawops size (${INSTANCE_ALIASES.join(", ")}), so it is passed to ${intent.provider} as written.
+`
+    );
+    return requested;
+  }
+  const adapter = await loadAdapterModule(intent.provider);
+  return adapter.normalizeInstanceType(requested);
+}
+var parseDiffForTest = parseDiff;
+async function generatePlan(intent, _opts) {
+  if (intent.provider === "local") {
+    throw new UsageError(
+      "plan/apply is not supported for the local provider. Use `clawops up` directly."
+    );
+  }
+  const { version } = await import("./package-5BCMEBTE.js");
+  const config = getConfig();
+  const instanceType = await resolveInstanceType(intent);
+  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
+  const openclawVersion = await guardOpenclawVersion(
+    intent.openclawVersion ?? await defaultOpenclawVersion()
+  );
+  const network = intent.network ?? {
+    allowedSshCidrs: [],
+    allowedGatewayCidrs: []
+  };
+  const { resolvePublicKey } = await import("./ssh-key-DUO6OKOI.js");
+  const publicKey = config ? resolvePublicKey(expandHome(config.ssh.keyPath)) : void 0;
+  if (!publicKey) {
+    process.stderr.write(
+      "[clawops] warning: no SSH public key could be resolved" + (config ? ` from ${config.ssh.keyPath}` : " \u2014 no config file") + ". `clawops apply` will refuse this plan: the instance would have no way to admit anyone. Run `clawops doctor` to see why the key is unusable.\n"
+    );
+  }
+  const stackName = intent.stackName;
+  const region = intent.region ?? config?.stacks[stackName]?.region;
+  const plan = {
+    apiVersion: "clawops.dev/v1",
+    kind: "DeployPlan",
+    metadata: {
+      name: stackName,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      generator: "clawops",
+      generatorVersion: version
+    },
+    spec: {
+      provider: intent.provider,
+      region,
+      stackName,
+      instanceType,
+      openclaw: { version: openclawVersion },
+      network,
+      ...publicKey ? { ssh: { publicKey } } : {},
+      ...intent.tags ? { tags: intent.tags } : {}
+    }
+  };
+  let stack;
+  try {
+    const ctx = buildContext({ stack: stackName, provider: intent.provider });
+    stack = await ctx.getStack();
+  } catch (err) {
+    if (err instanceof UsageError) throw err;
+    throw new StateError(
+      `Cannot open the state backend for stack "${stackName}": ${messageOf(err)}
+A plan is only as good as the state it was computed against, so this is not a plan clawops will write. Check the stateUrl in ~/.clawops/config.json, and that the bucket or container exists and your credentials can read it.`
+    );
+  }
+  try {
+    const { writeStackConfig } = await import("./stack-config-R4SPSUQZ.js");
+    await writeStackConfig(stack, plan);
+    const outputLines = [];
+    const preview = await stack.preview({
+      onOutput: (line) => outputLines.push(line)
+    });
+    const diff = parseDiff(outputLines);
+    if (diff.totalChanges === 0 && preview.changeSummary) {
+      const summary = preview.changeSummary;
+      diff.totalChanges = (summary["create"] ?? 0) + (summary["update"] ?? 0) + (summary["delete"] ?? 0);
+    }
+    plan.diff = diff;
+    const info = await stack.info();
+    if (info !== void 0) {
+      plan.metadata.stackVersion = info.version;
+    }
+  } catch (err) {
+    if (err instanceof UsageError) throw err;
+    process.stderr.write(
+      `[clawops] Warning: preview failed, diff section omitted: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+  const validation = validatePlan(plan);
+  if (!validation.ok) {
+    throw new Error(`Generated plan failed schema validation:
+${validation.errors.join("\n")}`);
+  }
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-YVI3BJ55.js");
+  const cfgCheck = await validatePlanConfig(plan);
+  for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
+`);
+  if (!cfgCheck.ok) {
+    throw new Error(
+      `The OpenClaw config in this plan would be rejected:
+` + cfgCheck.errors.map((e) => `  - ${e}`).join("\n") + `
+Fix spec.openclaw.config before applying \u2014 the gateway reads it verbatim.`
+    );
+  }
+  const netCheck = validatePlanNetwork(plan);
+  for (const w of netCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
+`);
+  if (!netCheck.ok) {
+    throw new Error(
+      `This plan's network settings contradict each other:
+` + netCheck.errors.map((e) => `  - ${e}`).join("\n")
+    );
+  }
+  return plan;
+}
+function planId() {
+  return randomUUID().slice(0, 8);
+}
+function expandHome(p) {
+  return p.replace(/^~/, process.env["HOME"] ?? "~");
+}
+function messageOf(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  const lines = raw.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+  const explained = lines.find((l) => /(^|\s)error:/i.test(l));
+  if (explained) return explained.replace(/^.*?error:\s*/i, "");
+  return lines[0] ?? raw;
+}
+
+export {
+  INSTANCE_ALIASES,
+  isInstanceAlias,
+  parseDiffForTest,
+  generatePlan,
+  planId
+};

package/dist/chunk-V25QRZRB.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+// src/pulumi/passphrase.ts
+import path from "path";
+import process from "process";
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+var PASSPHRASE_FILE = "pulumi-passphrase";
+function passphrasePath(configDir) {
+  return path.join(configDir, "secrets", PASSPHRASE_FILE);
+}
+function passphraseInEnvironment() {
+  return Boolean(
+    process.env["PULUMI_CONFIG_PASSPHRASE"] ?? process.env["PULUMI_CONFIG_PASSPHRASE_FILE"]
+  );
+}
+function passphraseStatus(configDir) {
+  if (passphraseInEnvironment()) return "environment";
+  return existsSync(passphrasePath(configDir)) ? "stored" : "absent";
+}
+function ensurePassphrase(configDir) {
+  if (passphraseInEnvironment()) return void 0;
+  const file = passphrasePath(configDir);
+  if (existsSync(file)) {
+    const stored = readFileSync(file, "utf-8").trim();
+    if (stored !== "") return stored;
+  }
+  const dir = path.dirname(file);
+  mkdirSync(dir, { recursive: true });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  const generated = randomBytes(32).toString("base64url");
+  writeFileSync(file, generated + "\n", { encoding: "utf-8", mode: 384 });
+  return generated;
+}
+
+export {
+  PASSPHRASE_FILE,
+  passphrasePath,
+  passphraseInEnvironment,
+  passphraseStatus,
+  ensurePassphrase
+};

package/dist/chunk-VOEJYRIK.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import {
+  err,
+  ok
+} from "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/run-flags.ts
+var CONFIG_MOUNT_PATH = "/app/config.json";
+var GATEWAY_PORT = 18789;
+var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
+var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
+var PORT_PIN = `--port ${GATEWAY_PORT}`;
+var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
+var IMAGE_INSPECT_CMD = `docker inspect openclaw --format '{{.Config.Image}}'`;
+function imageForRestart(inspectStdout) {
+  const image = inspectStdout.trim();
+  if (!image || image.includes("Error") || !image.includes(":")) {
+    return err(
+      "No running OpenClaw container found, so there is no image version to reuse. Deploy one with `clawops up --openclaw-version <version>`. clawops does not fall back to `latest` or `stable` here: both now point at OpenClaw 2.0, which this release line does not support."
+    );
+  }
+  return ok(image);
+}
+function versionOf(image) {
+  return image.split(":")[1] ?? "unknown";
+}
+
+export {
+  GATEWAY_PORT,
+  IMAGE_INSPECT_CMD,
+  imageForRestart,
+  versionOf
+};

package/dist/{providers-2OABPW2E.js → chunk-VUFMZEIM.js}

@@ -17,8 +17,9 @@ function getProvider(name) {
 function listProviders() {
   return Array.from(registry.keys());
 }
+
 export {
+  registerProvider,
   getProvider,
-  listProviders,
-  registerProvider
+  listProviders
 };

package/dist/chunk-W3OLNNJW.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+// src/pulumi/cli.ts
+import path from "path";
+import process from "process";
+import { PulumiCommand } from "@pulumi/pulumi/automation";
+function pulumiCliRoot(configDir) {
+  return path.join(configDir, ".pulumi-cli");
+}
+function versionOf(cmd) {
+  return cmd.version ? `v${cmd.version.toString()}` : "unknown version";
+}
+async function pulumiCliStatus(configDir) {
+  const root = pulumiCliRoot(configDir);
+  try {
+    return { kind: "managed", version: versionOf(await PulumiCommand.get({ root })), root };
+  } catch {
+  }
+  try {
+    return { kind: "path", version: versionOf(await PulumiCommand.get()) };
+  } catch {
+    return { kind: "missing" };
+  }
+}
+async function ensurePulumiCli(opts) {
+  const root = pulumiCliRoot(opts.configDir);
+  const status = await pulumiCliStatus(opts.configDir);
+  if (status.kind === "managed") return await PulumiCommand.get({ root });
+  if (status.kind === "path") return await PulumiCommand.get();
+  const announce = opts.onInstall ?? defaultAnnounce;
+  announce({ root });
+  try {
+    return await PulumiCommand.install({ root });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `could not install the Pulumi CLI into ${root}: ${reason}
+Install it yourself and clawops will use it: https://www.pulumi.com/docs/install/`
+    );
+  }
+}
+function defaultAnnounce({ root }) {
+  process.stderr.write(`Pulumi CLI not found \u2014 installing it into ${root} (one time).
+`);
+}
+
+export {
+  pulumiCliRoot,
+  pulumiCliStatus,
+  ensurePulumiCli
+};

package/dist/cli-WLD3EBEM.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  ensurePulumiCli,
+  pulumiCliRoot,
+  pulumiCliStatus
+} from "./chunk-W3OLNNJW.js";
+export {
+  ensurePulumiCli,
+  pulumiCliRoot,
+  pulumiCliStatus
+};