@clawops/cli 2.0.0 → 2.0.1

package/dist/{chunk-AHAAEXWC.js → chunk-E4NJSJ54.js}

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import {
+  formatKnownHostsLine,
+  keyTypeFromBlob,
+  verifyAgainstKnownHosts
+} from "./chunk-MC5ATCXS.js";
 import {
   NetworkError
 } from "./chunk-KGXPLI7W.js";
@@ -8,98 +13,6 @@ import { readFileSync, appendFileSync, mkdirSync } from "fs";
 import { createServer } from "net";
 import path from "path";
 import { Client } from "ssh2";
-
-// src/transport/known-hosts.ts
-import { createHmac, timingSafeEqual } from "crypto";
-function hostEntryFor(host, port) {
-  return port === 22 ? host : `[${host}]:${port}`;
-}
-function parseKnownHosts(content) {
-  const entries = [];
-  for (const raw of content.split("\n")) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    let parts = line.split(/\s+/);
-    let marker;
-    if (parts[0]?.startsWith("@")) {
-      marker = parts[0];
-      parts = parts.slice(1);
-    }
-    const hostField = parts[0];
-    if (!hostField) continue;
-    const hosts = hostField.split(",");
-    if (parts.length >= 3) {
-      entries.push({ hosts, keyType: parts[1], base64Key: parts[2], ...marker ? { marker } : {} });
-    } else if (parts.length === 2 && /^[0-9a-f]+$/i.test(parts[1] ?? "")) {
-      entries.push({ hosts, hexKey: parts[1], ...marker ? { marker } : {} });
-    }
-  }
-  return entries;
-}
-function hashedHostMatches(token, hostEntry) {
-  const parts = token.split("|");
-  if (parts.length !== 4 || parts[1] !== "1") return false;
-  const salt = parts[2];
-  const expected = parts[3];
-  if (!salt || !expected) return false;
-  try {
-    const actual = createHmac("sha1", Buffer.from(salt, "base64")).update(hostEntry).digest("base64");
-    const a = Buffer.from(actual);
-    const b = Buffer.from(expected);
-    return a.length === b.length && timingSafeEqual(a, b);
-  } catch {
-    return false;
-  }
-}
-function patternToRegExp(pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
-  return new RegExp(`^${escaped}$`, "i");
-}
-var isPattern = (host) => host.includes("*") || host.includes("?");
-function entryMatchesHost(entry, hostEntry) {
-  let matched = false;
-  for (const host of entry.hosts) {
-    if (host.startsWith("|1|")) {
-      if (hashedHostMatches(host, hostEntry)) matched = true;
-      continue;
-    }
-    const negated = host.startsWith("!");
-    const pattern = negated ? host.slice(1) : host;
-    const hit = isPattern(pattern) ? patternToRegExp(pattern).test(hostEntry) : pattern === hostEntry;
-    if (hit) {
-      if (negated) return false;
-      matched = true;
-    }
-  }
-  return matched;
-}
-function verifyAgainstKnownHosts(content, host, port, key) {
-  const hostEntry = hostEntryFor(host, port);
-  const base64Key = key.toString("base64");
-  const hexKey = key.toString("hex");
-  let sawHost = false;
-  for (const entry of parseKnownHosts(content)) {
-    if (!entryMatchesHost(entry, hostEntry)) continue;
-    if (entry.marker === "@cert-authority") continue;
-    sawHost = true;
-    const matches = entry.base64Key ? entry.base64Key === base64Key : entry.hexKey?.toLowerCase() === hexKey.toLowerCase();
-    if (matches) return entry.marker === "@revoked" ? "mismatch" : "match";
-  }
-  return sawHost ? "mismatch" : "unknown";
-}
-function formatKnownHostsLine(host, port, keyType, key) {
-  return `${hostEntryFor(host, port)} ${keyType} ${key.toString("base64")}
-`;
-}
-function keyTypeFromBlob(key) {
-  if (key.length < 4) return void 0;
-  const len = key.readUInt32BE(0);
-  if (len === 0 || len > 64 || key.length < 4 + len) return void 0;
-  const type = key.subarray(4, 4 + len).toString("utf-8");
-  return /^[\x20-\x7e]+$/.test(type) ? type : void 0;
-}
-
-// src/transport/ssh.ts
 var Ssh2Session = class {
   constructor(client) {
     this.client = client;
@@ -240,6 +153,15 @@ var Ssh2Session = class {
     this.client.end();
   }
 };
+function describeConnectError(message, opts) {
+  if (!/host.*(denied|verification)/i.test(message)) {
+    return `SSH connection failed: ${message}`;
+  }
+  const entry = opts.port === 22 ? opts.host : `[${opts.host}]:${opts.port}`;
+  return `the host key for ${opts.host}:${opts.port} does not match the one recorded in ${opts.knownHostsPath}. If your cloud reassigned this address \u2014 the usual cause \u2014 drop the stale entry and retry:
+  ssh-keygen -R ${entry} -f ${opts.knownHostsPath}
+If you did not expect this address to change hands, do not connect.`;
+}
 async function connect(opts) {
   let privateKey;
   try {
@@ -266,7 +188,7 @@ async function connect(opts) {
     });
     client.on("error", (err) => {
       opts.signal?.removeEventListener("abort", onAbort);
-      reject(new NetworkError(`SSH connection failed: ${err.message}`));
+      reject(new NetworkError(describeConnectError(err.message, opts)));
     });
     const config = {
       host: opts.host,
@@ -299,5 +221,6 @@ function verifyHostKey(host, port, keyHash, knownHostsPath) {
 }
 
 export {
+  describeConnectError,
   connect
 };

package/dist/chunk-FEK7VJAY.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+// src/providers/azure/sizes.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "Standard_B1s",
+  small: "Standard_B2s",
+  medium: "Standard_B4ms",
+  large: "Standard_B8ms",
+  gpu: "Standard_NC6s_v3"
+};
+var DEFAULT_ALIAS = "small";
+
+export {
+  INSTANCE_TYPE_MAP,
+  DEFAULT_ALIAS
+};

package/dist/{chunk-6TIYVHPX.js → chunk-GIEVAGEK.js}

@@ -1,29 +1,7 @@
 #!/usr/bin/env node
 import {
-  err,
-  ok
-} from "./chunk-EI7CQQ7D.js";
-
-// src/openclaw/run-flags.ts
-var CONFIG_MOUNT_PATH = "/app/config.json";
-var GATEWAY_PORT = 18789;
-var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
-var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
-var PORT_PIN = `--port ${GATEWAY_PORT}`;
-var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
-var IMAGE_INSPECT_CMD = `docker inspect openclaw --format '{{.Config.Image}}'`;
-function imageForRestart(inspectStdout) {
-  const image = inspectStdout.trim();
-  if (!image || image.includes("Error") || !image.includes(":")) {
-    return err(
-      "No running OpenClaw container found, so there is no image version to reuse. Deploy one with `clawops up --openclaw-version <version>`. clawops does not fall back to `latest` or `stable` here: both now point at OpenClaw 2.0, which this release line does not support."
-    );
-  }
-  return ok(image);
-}
-function versionOf(image) {
-  return image.split(":")[1] ?? "unknown";
-}
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
 
 // src/openclaw/runtime.ts
 var STATE_DIR_CONTAINER = "/home/node/.openclaw";
@@ -31,7 +9,7 @@ var STATE_DIR_HOST_LINUX = "/var/lib/clawops/openclaw";
 var STATE_DIR_HOST_MACOS = "${HOME}/.clawops/openclaw";
 var CONFIG_FILENAME = "openclaw.json";
 var CONTAINER_UID = 1e3;
-var CONFIG_MOUNT_PATH2 = `${STATE_DIR_CONTAINER}/${CONFIG_FILENAME}`;
+var CONFIG_MOUNT_PATH = `${STATE_DIR_CONTAINER}/${CONFIG_FILENAME}`;
 function stateDirForOS(os) {
   return os === "Darwin" ? STATE_DIR_HOST_MACOS : STATE_DIR_HOST_LINUX;
 }
@@ -46,7 +24,7 @@ var SECURITY_FLAGS = [
   "--pids-limit 512"
 ].join(" ");
 var SUPERVISOR_ENV = "-e OPENCLAW_SUPERVISOR_MODE=external";
-var ADD_HOST_FLAG2 = "--add-host=host.docker.internal:host-gateway";
+var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
 function publishFlag(port, scope) {
   return scope === "loopback" ? `-p 127.0.0.1:${port}:${port}` : `-p ${port}:${port}`;
 }
@@ -73,7 +51,7 @@ function gatewayRunArgs(spec) {
     capacity,
     // No OPENCLAW_CONFIG_PATH: STATE_DIR_CONTAINER is OpenClaw's own default, so mounting
     // it there *is* the configuration. One fewer thing to keep in sync.
-    ADD_HOST_FLAG2,
+    ADD_HOST_FLAG,
     SUPERVISOR_ENV,
     envFileArg,
     // The directory, writable. Never the file, and never :ro — see GatewayRunSpec.stateDir.
@@ -128,22 +106,18 @@ function publishForRestart(inspectStdout) {
 }
 
 export {
-  GATEWAY_PORT,
-  IMAGE_INSPECT_CMD,
-  imageForRestart,
-  versionOf,
   STATE_DIR_CONTAINER,
   STATE_DIR_HOST_LINUX,
   STATE_DIR_HOST_MACOS,
   CONFIG_FILENAME,
   CONTAINER_UID,
-  CONFIG_MOUNT_PATH2 as CONFIG_MOUNT_PATH,
+  CONFIG_MOUNT_PATH,
   stateDirForOS,
   configPathForOS,
   ENV_FILE_PATH,
   SECURITY_FLAGS,
   SUPERVISOR_ENV,
-  ADD_HOST_FLAG2 as ADD_HOST_FLAG,
+  ADD_HOST_FLAG,
   gatewayRunArgs,
   gatewayRunCommand,
   PUBLISH_INSPECT_CMD,

package/dist/chunk-HSPHXG6W.js

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import {
+  resolvePublicKey
+} from "./chunk-AEEMRFZV.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import {
+  getConfig
+} from "./chunk-CX5SL5HP.js";
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/stack-config.ts
+import process from "process";
+async function writeStackConfig(stack, plan) {
+  const sshPublicKey = plan.spec.ssh?.publicKey ?? fallbackPublicKey();
+  if (!sshPublicKey) {
+    throw new UsageError(
+      "This plan carries no SSH public key, and none could be resolved from `ssh.keyPath` in ~/.clawops/config.json. The instance would have no way to admit anyone. Run `clawops doctor` to see why the key is unusable, then regenerate the plan."
+    );
+  }
+  await stack.setConfig("sshPublicKey", { value: sshPublicKey });
+  await stack.setConfig("instanceType", { value: plan.spec.instanceType });
+  if (plan.spec.region) {
+    await stack.setConfig("region", { value: plan.spec.region });
+  }
+  await stack.setConfig("openclawVersion", { value: plan.spec.openclaw.version });
+  await stack.setConfig("publishGateway", {
+    value: plan.spec.network?.publishGateway ?? "loopback"
+  });
+  await stack.setConfig("gatewayPort", {
+    value: String(plan.spec.network?.gatewayPort ?? GATEWAY_PORT)
+  });
+  if (plan.spec.provider === "gcp") {
+    const { resolveProjectId } = await import("./preflight-EF52S3WW.js");
+    const project = resolveProjectId();
+    if (project) await stack.setConfig("gcp:project", { value: project });
+  }
+  if (plan.spec.provider === "azure") {
+    const { resolveSubscriptionId } = await import("./cli-auth-GD5SK7JU.js");
+    const subscription = resolveSubscriptionId();
+    if (subscription) await stack.setConfig("azure-native:subscriptionId", { value: subscription });
+  }
+  await stack.setConfig("accessMode", { value: "restricted" });
+  await stack.setConfig("sshCidrs", {
+    value: (plan.spec.network?.allowedSshCidrs ?? []).join(",")
+  });
+  await stack.setConfig("gatewayCidrs", {
+    value: (plan.spec.network?.allowedGatewayCidrs ?? []).join(",")
+  });
+  const modelProvider = plan.spec.openclaw.config?.["models"]?.["provider"];
+  if (modelProvider === "bedrock") {
+    await stack.setConfig("bedrockEnabled", { value: "true" });
+  }
+}
+function fallbackPublicKey() {
+  const config = getConfig();
+  if (!config) return void 0;
+  const keyPath = config.ssh.keyPath.replace(/^~/, process.env["HOME"] ?? "~");
+  return resolvePublicKey(keyPath);
+}
+
+export {
+  writeStackConfig
+};

package/dist/{chunk-GYV4KNW7.js → chunk-IVWP4QUJ.js}

@@ -1,22 +1,27 @@
 #!/usr/bin/env node
 import {
-  interpretProbe,
-  probeCommand
-} from "./chunk-LT4XMO5D.js";
+  inspectContainer
+} from "./chunk-3OLUJPCB.js";
 import {
   execPrivileged
 } from "./chunk-NUDIHZEH.js";
 import {
-  chalk,
-  failure
-} from "./chunk-Q7NQY5HV.js";
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
 import {
-  GATEWAY_PORT,
   PUBLISH_INSPECT_CMD,
   STATE_DIR_HOST_LINUX,
   configPathForOS,
   publishForRestart
-} from "./chunk-6TIYVHPX.js";
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import {
+  chalk,
+  failure
+} from "./chunk-Q7NQY5HV.js";
 
 // src/cli/commands/monitor.ts
 import { defineCommand } from "citty";
@@ -36,11 +41,19 @@ function formatUptime(startedAt) {
 async function gatherSnapshot(session, signal, tailLines = 10) {
   const DOCKER = "PATH=/usr/local/bin:/opt/homebrew/bin:$PATH docker";
   const [inspectRaw, statsRaw, healthRaw, configRaw, diskRaw, logsRaw] = await Promise.all([
-    execPrivileged(
+    inspectContainer(
       session,
-      `${DOCKER} inspect openclaw --format '{{.State.Status}}|{{.Config.Image}}|{{.State.StartedAt}}|{{.RestartCount}}' 2>/dev/null || echo 'not found|||0'`,
-      signal
-    ),
+      "openclaw",
+      "{{.State.Status}}|{{.Config.Image}}|{{.State.StartedAt}}|{{.RestartCount}}",
+      signal,
+      DOCKER
+    ).then((r) => ({
+      // The dashboard shows a word per field; a refusal says so rather than borrowing
+      // "not found", which would claim the container is gone.
+      stdout: r.kind === "ok" ? r.value : r.kind === "missing" ? "not found|||0" : "unreachable|||0",
+      stderr: r.kind === "error" ? r.detail : "",
+      code: r.kind === "ok" ? 0 : 1
+    })),
     execPrivileged(
       session,
       `${DOCKER} stats openclaw --no-stream --format '{{.MemUsage}}|{{.CPUPerc}}' 2>/dev/null || echo '\u2014|\u2014'`,
@@ -133,7 +146,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext } = await import("./context-KHKWJJMC.js");
+  const { buildContext } = await import("./context-7EVC6W45.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -360,8 +373,8 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext } = await import("./context-KHKWJJMC.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
     process.on("SIGTERM", () => ac.abort());
@@ -491,13 +504,14 @@ var monitor_default = defineCommand({
 
 // src/diagnostics/index.ts
 import process2 from "process";
-import { accessSync, mkdirSync, constants } from "fs";
+import { accessSync, mkdirSync, readFileSync, constants } from "fs";
+import ssh2 from "ssh2";
 import path from "path";
 async function runDiagnostics(opts = {}, deps = {}) {
   const { getConfig, getConfigDir } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   const sections = [];
-  sections.push({ title: "Runtime", checks: runtimeChecks(getConfigDir()) });
+  sections.push({ title: "Runtime", checks: await runtimeChecks(getConfigDir()) });
   sections.push({
     title: "Config",
     checks: [
@@ -505,8 +519,10 @@ async function runDiagnostics(opts = {}, deps = {}) {
     ]
   });
   sections.push({ title: "SSH", checks: sshChecks(config) });
-  sections.push({ title: "Credentials", checks: await credentialChecks(config) });
+  sections.push({ title: "Credentials", checks: await credentialChecks(config, opts.provider) });
   sections.push({ title: "OpenClaw", checks: await versionChecks() });
+  const account = await accountChecks(config, opts.stack, opts.provider, opts.instanceType);
+  if (account.length > 0) sections.push({ title: "Cloud account", checks: account });
   if (opts.stack) {
     const open = deps.openSession ?? defaultOpenSession;
     let handle;
@@ -530,7 +546,7 @@ async function runDiagnostics(opts = {}, deps = {}) {
         });
       } finally {
         handle.release();
-        const { drainPool } = await import("./pool-EX4ZTA5P.js");
+        const { drainPool } = await import("./pool-PIIKJ4L2.js");
         drainPool();
       }
     }
@@ -542,7 +558,7 @@ function summarise(sections) {
   for (const s of sections) for (const c of s.checks) counts[c.status]++;
   return { sections, ok: counts.fail === 0, counts };
 }
-function runtimeChecks(configDir) {
+async function runtimeChecks(configDir) {
   const checks = [];
   const nodeMajor = parseInt(process2.version.slice(1).split(".")[0] ?? "0", 10);
   checks.push(
@@ -560,6 +576,35 @@ function runtimeChecks(configDir) {
   } catch {
     checks.push({ name: "Pulumi home", status: "fail", detail: `${pulumiHome} (not writable)` });
   }
+  const { pulumiCliStatus } = await import("./cli-WLD3EBEM.js");
+  const cli = await pulumiCliStatus(configDir);
+  checks.push(
+    cli.kind === "managed" ? { name: "Pulumi CLI", status: "pass", detail: `${cli.version} (${cli.root})` } : cli.kind === "path" ? { name: "Pulumi CLI", status: "pass", detail: `${cli.version} (on PATH)` } : {
+      name: "Pulumi CLI",
+      status: "warn",
+      detail: "not installed",
+      remedy: `clawops installs it into ${path.join(configDir, ".pulumi-cli")} on first apply`
+    }
+  );
+  const { passphraseStatus, passphrasePath } = await import("./passphrase-MJBE45N7.js");
+  const passphrase = passphraseStatus(configDir);
+  checks.push(
+    passphrase === "environment" ? {
+      name: "State passphrase",
+      status: "pass",
+      detail: "PULUMI_CONFIG_PASSPHRASE set in the environment"
+    } : passphrase === "stored" ? {
+      name: "State passphrase",
+      status: "pass",
+      detail: passphrasePath(configDir),
+      remedy: "back this up \u2014 without it, an existing stack's secrets cannot be read"
+    } : {
+      name: "State passphrase",
+      status: "warn",
+      detail: "not created yet",
+      remedy: `clawops generates one at ${passphrasePath(configDir)} on first apply`
+    }
+  );
   return checks;
 }
 function expandHome(p) {
@@ -571,7 +616,15 @@ function sshChecks(config) {
   const keyPath = expandHome(config.ssh.keyPath);
   try {
     accessSync(keyPath, constants.R_OK);
-    checks.push({ name: "SSH key", status: "pass", detail: keyPath });
+    const parsed = ssh2.utils.parseKey(readFileSync(keyPath));
+    checks.push(
+      parsed instanceof Error ? {
+        name: "SSH key",
+        status: "fail",
+        detail: `${keyPath} (${parsed.message.toLowerCase()})`,
+        remedy: `clawops connects with ssh2. Regenerate in OpenSSH format: ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops`
+      } : { name: "SSH key", status: "pass", detail: `${keyPath} (${parsed.type})` }
+    );
   } catch {
     checks.push({
       name: "SSH key",
@@ -592,15 +645,23 @@ function sshChecks(config) {
   }
   return checks;
 }
-async function credentialChecks(config) {
+async function providerCredentialCheck(provider, why) {
+  if (provider === "local") {
+    return { name: "local", status: "pass", detail: "SSH-only, no cloud credentials required" };
+  }
+  const { getProvider } = await import("./providers-FW6H6OPF.js");
+  try {
+    const adapter = getProvider(provider);
+    const result = await adapter.validateConfig();
+    return result.ok ? { name: provider, status: "pass", detail: why } : { name: provider, status: "fail", detail: result.errors.join("; ") };
+  } catch (err) {
+    return { name: provider, status: "fail", detail: messageOf(err) };
+  }
+}
+async function credentialChecks(config, provider) {
+  if (provider) return [await providerCredentialCheck(provider, "requested with --provider")];
   if (!config) return [{ name: "Credentials", status: "info", detail: "skipped \u2014 no config" }];
-  const { getProvider } = await import("./providers-2OABPW2E.js");
-  await Promise.all([
-    import("./aws-AMON7DA7.js"),
-    import("./gcp-2JBTD7ZM.js"),
-    import("./azure-T4G6OBJQ.js"),
-    import("./local-DXBEVZ5C.js")
-  ]);
+  const { getProvider } = await import("./providers-FW6H6OPF.js");
   const checks = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
@@ -664,14 +725,16 @@ async function versionChecks() {
 }
 async function remoteChecks(session, signal) {
   const checks = [];
-  const containerResult = await execPrivileged(
-    session,
-    `docker inspect openclaw --format '{{.State.Status}}' 2>/dev/null || echo 'not found'`,
-    signal
-  );
-  const containerStatus = containerResult.stdout.trim();
+  const { containerStatus } = await import("./docker-3PDO4TS7.js");
+  const container = await containerStatus(session, "openclaw", signal);
   checks.push(
-    containerStatus === "running" ? { name: "Container", status: "pass", detail: "running" } : { name: "Container", status: "fail", detail: containerStatus || "unknown" }
+    container.error ? {
+      // "not found" would be a claim about the deployment. This is a claim about clawops.
+      name: "Container",
+      status: "fail",
+      detail: `could not ask docker \u2014 ${container.error}`,
+      remedy: "the SSH user may have been added to the docker group after this session opened"
+    } : container.status === "running" ? { name: "Container", status: "pass", detail: "running" } : { name: "Container", status: "fail", detail: container.status }
   );
   const imageResult = await execPrivileged(
     session,
@@ -745,8 +808,8 @@ async function deployedVersionCheck(image, deployedVersion) {
 }
 async function hardeningChecks(conn, stack, signal) {
   try {
-    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-PCDK3UQ5.js");
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-72JMRT4E.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const provider = buildContext({ stack }).adapter.name;
     const modules = resolveModules(MODULE_CATALOG, void 0, provider);
     const checks = [];
@@ -769,9 +832,9 @@ async function hardeningChecks(conn, stack, signal) {
 }
 async function defaultOpenSession(stack, signal) {
   const { getConfig } = await import("./store-SDUR52Z5.js");
-  const { buildContext } = await import("./context-KHKWJJMC.js");
+  const { buildContext } = await import("./context-7EVC6W45.js");
   const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-  const { acquireSession } = await import("./pool-EX4ZTA5P.js");
+  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
   const config = getConfig();
   if (!config) throw new Error("no config \u2014 run `clawops init`");
   const ctx = buildContext({ stack });
@@ -799,6 +862,36 @@ async function defaultOpenSession(stack, signal) {
 function messageOf(err) {
   return err instanceof Error ? err.message : String(err);
 }
+async function accountChecks(config, stack, provider, instanceType) {
+  if (!config && !provider) return [];
+  const stackName = stack ?? config?.defaults?.stack;
+  const fromStack = stackName ? config?.stacks[stackName] : void 0;
+  const stackCfg = provider && fromStack?.provider !== provider ? Object.values(config?.stacks ?? {}).find((s) => s.provider === provider) : fromStack;
+  const providerName = provider ?? stackCfg?.provider;
+  if (!providerName || providerName === "local") return [];
+  try {
+    const { getProvider } = await import("./providers-FW6H6OPF.js");
+    const adapter = getProvider(providerName);
+    if (!adapter.preflight) return [];
+    const bucket = stackCfg ? bucketFromStateUrl(stackCfg.stateUrl) : void 0;
+    const results = await adapter.preflight({ region: stackCfg?.region, bucket, instanceType });
+    return results.map((r) => ({
+      name: r.label,
+      // A question clawops could not ask is not an answer about the account. Failing the
+      // report over a denied read permission would be as wrong as passing it.
+      status: r.unknown ? "warn" : r.ok ? "pass" : "fail",
+      detail: r.detail,
+      remedy: r.mutates ? `clawops setup can fix this: ${r.mutates}` : void 0
+    }));
+  } catch (err) {
+    return [{ name: "Account preflight", status: "warn", detail: messageOf(err) }];
+  }
+}
+function bucketFromStateUrl(stateUrl) {
+  if (!stateUrl) return void 0;
+  const match = /^[a-z0-9]+:\/\/([^/]+)/.exec(stateUrl);
+  return match?.[1];
+}
 
 export {
   runDiagnostics,