@clawops/cli 2.0.0 → 2.0.1

package/dist/context-7EVC6W45.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  buildContext,
+  loadAdapterModule
+} from "./chunk-5XT5IAJK.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+import "./chunk-N4WZLWJ4.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
+export {
+  buildContext,
+  loadAdapterModule
+};

package/dist/docker-3PDO4TS7.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  containerStatus,
+  inspectContainer,
+  looksLikeStillBooting
+} from "./chunk-3OLUJPCB.js";
+import "./chunk-NUDIHZEH.js";
+export {
+  containerStatus,
+  inspectContainer,
+  looksLikeStillBooting
+};

package/dist/{firewall-T3NTPZJD.js → firewall-5VKZ4WBH.js}

@@ -32,7 +32,10 @@ function resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResul
 }
 async function detectEgressIp(checkUrl) {
   try {
-    const res = await fetch(checkUrl, { signal: AbortSignal.timeout(3e3) });
+    const res = await fetch(checkUrl, {
+      signal: AbortSignal.timeout(3e3),
+      headers: { accept: "text/plain" }
+    });
     if (!res.ok) {
       return { ok: false, error: `HTTP ${res.status} from ${checkUrl}` };
     }
@@ -40,11 +43,28 @@ async function detectEgressIp(checkUrl) {
     if (!ip) {
       return { ok: false, error: `empty response from ${checkUrl}` };
     }
+    if (!isIpAddress(ip)) {
+      return {
+        ok: false,
+        error: `${checkUrl} did not return an IP address (got ${summarise(ip)})`
+      };
+    }
     return { ok: true, ip };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
+function isIpAddress(value) {
+  const v = value.trim();
+  if (/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(v)) {
+    return v.split(".").every((o) => Number(o) <= 255);
+  }
+  return /^[0-9a-fA-F:]+$/.test(v) && v.includes(":");
+}
+function summarise(body) {
+  const oneLine = body.replace(/\s+/g, " ").trim();
+  return oneLine.length > 40 ? `${oneLine.slice(0, 40)}\u2026` : oneLine;
+}
 function resolveGatewayIngressCidrs(publishGateway, accessMode, allowedCidrs, portOverride, egressResult) {
   if (publishGateway !== "all") return [];
   return resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResult);
@@ -55,6 +75,7 @@ function resolveGatewayPort(raw, fallback) {
 }
 export {
   detectEgressIp,
+  isIpAddress,
   resolveGatewayIngressCidrs,
   resolveGatewayPort,
   resolveIngressCidrs

package/dist/generate-I6YQ5V2T.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import {
+  INSTANCE_ALIASES,
+  generatePlan,
+  isInstanceAlias,
+  parseDiffForTest,
+  planId
+} from "./chunk-STLRHLLV.js";
+import "./chunk-BSLIYB5Q.js";
+import "./chunk-5XT5IAJK.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+import "./chunk-N4WZLWJ4.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
+export {
+  INSTANCE_ALIASES,
+  generatePlan,
+  isInstanceAlias,
+  parseDiffForTest,
+  planId
+};

package/dist/{harden-PCDK3UQ5.js → harden-72JMRT4E.js}

@@ -2,16 +2,19 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-3WYA2QDM.js";
-import "./chunk-AHAAEXWC.js";
-import "./chunk-KGXPLI7W.js";
+} from "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
 import {
-  GATEWAY_PORT,
   PUBLISH_INSPECT_CMD,
   publishForRestart,
   publishedGatewayPort
-} from "./chunk-6TIYVHPX.js";
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
+import "./chunk-KGXPLI7W.js";
 
 // src/harden/types.ts
 var SENTINEL_DIR = "/etc/clawops/hardening";

package/dist/index.d.ts

@@ -47,6 +47,62 @@ interface ProviderAdapter {
     stateBackendUrl(bucket: string): string;
     /** Validate provider-specific config (env vars, profiles) at startup. */
     validateConfig(): Promise<ValidationResult>;
+    /**
+     * Account-level setup this provider needs before anything can be provisioned.
+     *
+     * Not infrastructure: enabling an API or creating a state bucket happens outside the
+     * Pulumi program, because the state backend has to exist before Pulumi can run at all.
+     * Optional — a provider with nothing to check omits it.
+     */
+    preflight?(opts: PreflightOpts): Promise<PreflightCheck[]>;
+}
+interface PreflightOpts {
+    /** Where the stack will be deployed, when that changes what must be enabled. */
+    region?: string;
+    /** State backend bucket or container, when the check covers it. */
+    bucket?: string;
+    /**
+     * The machine size about to be deployed, when the caller knows it.
+     *
+     * Azure offers SKU families per subscription, so "is this size available here" can only be
+     * answered about a specific size. Without this the check falls back to the provider's
+     * default alias, which is right for a default deploy and wrong for anyone passing
+     * --instance-type: a deployment using an available size would be reported as broken.
+     */
+    instanceType?: string;
+    signal?: AbortSignal;
+}
+interface PreflightCheck {
+    /** Stable kebab-case id, e.g. "compute-api-enabled". */
+    id: string;
+    /** What is being checked, in the operator's terms. */
+    label: string;
+    ok: boolean;
+    /**
+     * clawops could not put the question — a denied read permission, an API that would not
+     * answer. Neither a pass nor a failure: the operator's account may be perfectly set up, and
+     * saying so would be a claim clawops cannot make.
+     *
+     * Dropping the check instead is worse. An operator whose credentials lack a read permission
+     * then sees one fewer line than everyone else and never learns why. The detail field carries
+     * the reason, and doctor renders these as warnings rather than failing the report over a
+     * question it could not ask.
+     */
+    unknown?: boolean;
+    /** Why it failed, and what it means — shown when ok is false. */
+    detail?: string;
+    /**
+     * Applies the fix. Absent when clawops cannot fix it: a missing permission or an unpaid
+     * billing account is not clawops's to resolve, and pretending otherwise wastes a prompt.
+     */
+    fix?: () => Promise<void>;
+    /**
+     * What the fix changes in the operator's cloud account.
+     *
+     * Shown in the prompt, and required alongside fix(): consent to 'fix it' is not consent to
+     * something unnamed.
+     */
+    mutates?: string;
 }
 
 export type { BaseStackOutputs, ConnectionInfo, CredentialSource, InstanceAlias, ProviderAdapter, ProviderName, PulumiFn, StackOutputs, StateBackendScheme, ValidationResult };

package/dist/known-hosts-file-I3Q3NBYQ.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import {
+  withoutHost
+} from "./chunk-MC5ATCXS.js";
+
+// src/transport/known-hosts-file.ts
+import { readFileSync, writeFileSync } from "fs";
+function forgetHost(knownHostsPath, host, port) {
+  let content;
+  try {
+    content = readFileSync(knownHostsPath, "utf-8");
+  } catch {
+    return false;
+  }
+  const next = withoutHost(content, host, port);
+  if (next === content) return false;
+  writeFileSync(knownHostsPath, next, "utf-8");
+  return true;
+}
+export {
+  forgetHost
+};

package/dist/{logs-P7YCKVF4.js → logs-5A7YYA53.js}

@@ -5,7 +5,7 @@ import {
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
-} from "./chunk-SBLQH2TJ.js";
+} from "./chunk-NUL5F6YV.js";
 export {
   GATEWAY_LOGS_PROBE,
   agentAuditCommand,

package/dist/{mcp-wire-BFEY2Y6H.js → mcp-wire-3SWBM7D6.js}

@@ -1,30 +1,40 @@
 #!/usr/bin/env node
 import {
   MCP_HTTP_PORT
-} from "./chunk-AX74VXTV.js";
-import "./chunk-UFRO4H5W.js";
-import "./chunk-N44K3LHE.js";
-import "./chunk-3QJBNAHW.js";
-import "./chunk-WHJMKDV7.js";
-import "./chunk-YR3O2I3S.js";
-import "./chunk-6ZFIFDBJ.js";
-import "./chunk-3WYA2QDM.js";
-import "./chunk-AHAAEXWC.js";
+} from "./chunk-KC3GC3PE.js";
+import "./chunk-LBE6COC4.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-LU2V3LXA.js";
-import "./chunk-GYV4KNW7.js";
-import "./chunk-SBLQH2TJ.js";
-import "./chunk-LT4XMO5D.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-2I7KCMXZ.js";
+import "./chunk-HSPHXG6W.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-STLRHLLV.js";
+import "./chunk-BSLIYB5Q.js";
+import "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import "./chunk-5XT5IAJK.js";
+import "./chunk-IVWP4QUJ.js";
+import "./chunk-NUL5F6YV.js";
+import "./chunk-3OLUJPCB.js";
 import {
   execPrivileged
 } from "./chunk-NUDIHZEH.js";
 import "./chunk-JW5A7E3X.js";
+import "./chunk-LT4XMO5D.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
 import "./chunk-Q7NQY5HV.js";
+import "./chunk-N4WZLWJ4.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
-import "./chunk-6TIYVHPX.js";
-import "./chunk-EI7CQQ7D.js";
+import "./chunk-VUFMZEIM.js";
 
 // src/cli/mcp-wire.ts
 var GATEWAY_MCP_NAME = "clawops";

package/dist/models-AGTQWYDL.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+// src/openclaw/models.ts
+function providerKeyOf(provider) {
+  const fromPath = provider.configPath?.split(".").pop();
+  return fromPath && fromPath.length > 0 ? fromPath : provider.id;
+}
+function buildModelsBlock(opts) {
+  const { provider, model, apiKeyRef, baseUrl, region } = opts;
+  const key = providerKeyOf(provider);
+  const modelId = opts.resolvedModelId ?? model.modelId ?? model.id;
+  const entry = {};
+  if (provider.api) entry["api"] = provider.api;
+  if (region) entry["region"] = region;
+  if (apiKeyRef) entry["apiKey"] = apiKeyRef;
+  if (baseUrl) entry["baseUrl"] = baseUrl;
+  if (provider.credentialSource === "aws-profile") {
+    entry["auth"] = "aws-sdk";
+  }
+  entry["models"] = [
+    {
+      id: modelId,
+      name: model.displayName,
+      ...provider.api ? { api: provider.api } : {}
+    }
+  ];
+  return { providers: { [key]: entry } };
+}
+export {
+  buildModelsBlock,
+  providerKeyOf
+};

package/dist/network-args-PYJRJBYO.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/network-args.ts
+function isCidr(value) {
+  const v = value.trim();
+  if (v.includes(":")) return true;
+  return /^(\d{1,3}\.){3}\d{1,3}\/(3[0-2]|[12]?\d)$/.test(v);
+}
+function parseCidrList(flag, value) {
+  const parts = value.split(",").map((s) => s.trim()).filter((s) => s !== "");
+  for (const p of parts) {
+    if (!isCidr(p)) {
+      throw new UsageError(
+        `${flag}: "${p}" is not a CIDR. Use an address and a prefix, e.g. 203.0.113.4/32.`
+      );
+    }
+  }
+  return parts;
+}
+function parsePublishGateway(value) {
+  const v = value.trim();
+  if (v === "loopback" || v === "all") return v;
+  throw new UsageError(`--publish-gateway: expected "loopback" or "all", got "${v}".`);
+}
+async function resolveNetworkFlags(flags, deps) {
+  const resolved = { allowedSshCidrs: [], allowedGatewayCidrs: [] };
+  for (const [flag, raw, key] of [
+    ["--ssh-cidr", flags.sshCidr, "allowedSshCidrs"],
+    ["--gateway-cidr", flags.gatewayCidr, "allowedGatewayCidrs"]
+  ]) {
+    if (raw === void 0) continue;
+    resolved[key] = raw.trim() === "auto" ? [await autoCidr(flag, deps.detectEgressIp)] : parseCidrList(flag, raw);
+  }
+  if (flags.publishGateway !== void 0) {
+    resolved.publishGateway = parsePublishGateway(flags.publishGateway);
+  }
+  return resolved;
+}
+async function autoCidr(flag, detect) {
+  const result = await detect();
+  if (!result.ok || result.ip.trim() === "") {
+    const why = result.ok ? "the lookup returned an empty address" : result.error;
+    throw new UsageError(
+      `${flag} auto: could not detect this machine's public IP \u2014 ${why}. Pass the CIDR explicitly, e.g. 203.0.113.4/32.`
+    );
+  }
+  const ip = result.ip.trim();
+  const cidr = ip.includes("/") ? ip : `${ip}/32`;
+  if (!isCidr(cidr)) {
+    throw new UsageError(
+      `${flag} auto: the detected address "${ip}" is not usable as a CIDR. Pass the CIDR explicitly, e.g. 203.0.113.4/32.`
+    );
+  }
+  return cidr;
+}
+export {
+  isCidr,
+  parseCidrList,
+  parsePublishGateway,
+  resolveNetworkFlags
+};

package/dist/{package-3HUW57XH.js → package-5BCMEBTE.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "2.0.0";
+var version = "2.0.1";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {
@@ -36,18 +36,23 @@ var scripts = {
   "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
   "test:changed": "vitest --changed",
   "test:integration": "vitest run --config vitest.integration.config.ts",
+  "test:cloud": "bash scripts/e2e/cloud.sh",
   typecheck: "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
   lint: "eslint --max-warnings=0 src tests scripts",
   "gen:schemas": "tsx scripts/gen-schemas.ts",
   changeset: "changeset",
   release: "pnpm build && changeset publish",
-  "test:mutation": "node scripts/dev/mutation-check.mjs"
+  "test:mutation": "node scripts/dev/mutation-check.mjs",
+  graph: "node scripts/dev/graph.mjs"
 };
 var dependencies = {
+  "@aws-sdk/client-bedrock": "^3.1063.0",
   "@aws-sdk/client-cloudwatch-logs": "^3.1063.0",
   "@aws-sdk/client-ec2": "^3.1063.0",
   "@aws-sdk/client-guardduty": "^3.1063.0",
   "@aws-sdk/client-iam": "^3.1063.0",
+  "@aws-sdk/client-s3": "3.1132.0",
+  "@aws-sdk/client-sts": "3.1132.0",
   "@modelcontextprotocol/sdk": "^1.0.0",
   "@pulumi/aws": "^6.0.0",
   "@pulumi/azure-native": "^2.0.0",
@@ -61,6 +66,7 @@ var dependencies = {
   chalk: "^5.0.0",
   citty: "^0.1.0",
   conf: "^12.0.0",
+  "google-auth-library": "^11.0.2",
   inquirer: "^9.0.0",
   ora: "^8.0.0",
   ssh2: "^1.0.0",
@@ -85,7 +91,8 @@ var devDependencies = {
 };
 var pnpm = {
   overrides: {
-    "@pulumi/pulumi": "^3.0.0"
+    "@pulumi/pulumi": "^3.0.0",
+    "@smithy/types": "4.14.3"
   },
   onlyBuiltDependencies: [
     "@pulumi/command",

package/dist/passphrase-MJBE45N7.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import {
+  PASSPHRASE_FILE,
+  ensurePassphrase,
+  passphraseInEnvironment,
+  passphrasePath,
+  passphraseStatus
+} from "./chunk-V25QRZRB.js";
+export {
+  PASSPHRASE_FILE,
+  ensurePassphrase,
+  passphraseInEnvironment,
+  passphrasePath,
+  passphraseStatus
+};

package/dist/{pool-EX4ZTA5P.js → pool-PIIKJ4L2.js}

@@ -2,8 +2,9 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-3WYA2QDM.js";
-import "./chunk-AHAAEXWC.js";
+} from "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
 import "./chunk-KGXPLI7W.js";
 export {
   acquireSession,

package/dist/preflight-EF52S3WW.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+
+// src/providers/gcp/preflight.ts
+import process from "process";
+import path from "path";
+import { readFileSync } from "fs";
+var REQUIRED_APIS = [
+  { service: "compute.googleapis.com", why: "Instance, Network, Subnetwork, Firewall, Address" },
+  { service: "storage.googleapis.com", why: "the GCS state backend" }
+];
+async function accessToken() {
+  try {
+    const { GoogleAuth } = await import("google-auth-library");
+    const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });
+    const client = await auth.getClient();
+    const token = await client.getAccessToken();
+    return typeof token === "string" ? token : token.token ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveProjectId() {
+  return process.env["GOOGLE_PROJECT"] ?? process.env["GOOGLE_CLOUD_PROJECT"] ?? process.env["GCLOUD_PROJECT"] ?? process.env["CLOUDSDK_CORE_PROJECT"] ?? gcloudConfiguredProject() ?? void 0;
+}
+function gcloudConfiguredProject() {
+  try {
+    const home = process.env["HOME"] ?? process.env["USERPROFILE"];
+    const dir = process.env["CLOUDSDK_CONFIG"] ?? (home ? path.join(home, ".config", "gcloud") : void 0);
+    if (!dir) return void 0;
+    const active = process.env["CLOUDSDK_ACTIVE_CONFIG_NAME"] ?? readFileSync(path.join(dir, "active_config"), "utf-8").trim() ?? "default";
+    if (!active) return void 0;
+    const ini = readFileSync(path.join(dir, "configurations", `config_${active}`), "utf-8");
+    return projectFromIni(ini);
+  } catch {
+    return void 0;
+  }
+}
+function projectFromIni(ini) {
+  let section = "";
+  for (const line of ini.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+    const header = /^\[(.+)\]$/.exec(trimmed);
+    if (header) {
+      section = header[1]?.trim() ?? "";
+      continue;
+    }
+    if (section !== "core") continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    if (trimmed.slice(0, eq).trim() !== "project") continue;
+    const value = trimmed.slice(eq + 1).trim();
+    return value === "" ? void 0 : value;
+  }
+  return void 0;
+}
+async function gcpPreflight(opts = {}) {
+  const checks = [];
+  const project = resolveProjectId();
+  checks.push({
+    id: "project-resolved",
+    label: "GCP project is set",
+    ok: Boolean(project),
+    detail: project ? `Deploying into ${project}` : "No project resolved. Run `gcloud config set project <id>`, or set GOOGLE_PROJECT."
+  });
+  if (!project) return checks;
+  const token = await accessToken();
+  if (!token) {
+    checks.push({
+      id: "adc-usable",
+      label: "Application Default Credentials resolve",
+      ok: false,
+      detail: "Could not obtain a token from ADC. Run `gcloud auth application-default login` \u2014 `gcloud auth login` alone authenticates the CLI and leaves ADC unset."
+    });
+    return checks;
+  }
+  const enabled = await enabledServices(project, token, opts.signal);
+  for (const api of REQUIRED_APIS) {
+    const on = enabled?.has(api.service) ?? false;
+    checks.push({
+      id: `api-${api.service.split(".")[0]}`,
+      label: `${api.service} enabled`,
+      ok: on,
+      detail: on ? void 0 : `Needed for ${api.why}. Nothing can be provisioned without it.`,
+      mutates: on ? void 0 : `Enables ${api.service} on project ${project}`,
+      fix: on ? void 0 : async () => {
+        await enableService(project, api.service, token);
+      }
+    });
+  }
+  if (opts.bucket) {
+    const exists = await bucketExists(opts.bucket, token, opts.signal);
+    checks.push({
+      id: "state-bucket",
+      label: `State bucket gs://${opts.bucket} exists`,
+      ok: exists,
+      detail: exists ? void 0 : "Pulumi needs its state backend before it can run, so clawops cannot create this as part of a deploy.",
+      mutates: exists ? void 0 : `Creates bucket gs://${opts.bucket} in project ${project}${opts.region ? ` (${opts.region})` : ""}, with versioning on`,
+      fix: exists ? void 0 : async () => {
+        await createBucket(opts.bucket, project, token, opts.region);
+      }
+    });
+  }
+  return checks;
+}
+async function enabledServices(project, token, signal) {
+  try {
+    const out = /* @__PURE__ */ new Set();
+    let pageToken;
+    do {
+      const url = `https://serviceusage.googleapis.com/v1/projects/${project}/services?filter=state:ENABLED&pageSize=200${pageToken ? `&pageToken=${pageToken}` : ""}`;
+      const res = await fetch(url, { headers: { authorization: `Bearer ${token}` }, signal });
+      if (!res.ok) return void 0;
+      const body = await res.json();
+      for (const s of body.services ?? []) if (s.config?.name) out.add(s.config.name);
+      pageToken = body.nextPageToken;
+    } while (pageToken);
+    return out;
+  } catch {
+    return void 0;
+  }
+}
+async function enableService(project, service, token) {
+  const res = await fetch(
+    `https://serviceusage.googleapis.com/v1/projects/${project}/services/${service}:enable`,
+    { method: "POST", headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new Error(`Could not enable ${service}: ${res.status} ${await res.text()}`);
+  }
+}
+async function bucketExists(bucket, token, signal) {
+  const res = await fetch(`https://storage.googleapis.com/storage/v1/b/${bucket}`, {
+    headers: { authorization: `Bearer ${token}` },
+    signal
+  });
+  return res.ok;
+}
+async function createBucket(bucket, project, token, region) {
+  const res = await fetch(
+    `https://storage.googleapis.com/storage/v1/b?project=${project}`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        name: bucket,
+        location: (region ?? "US").toUpperCase(),
+        // Versioning on, because this holds Pulumi state: a corrupted or truncated write
+        // with no history is a stack that can no longer be updated or destroyed.
+        versioning: { enabled: true },
+        iamConfiguration: { uniformBucketLevelAccess: { enabled: true } }
+      })
+    }
+  );
+  if (!res.ok) throw new Error(`Could not create gs://${bucket}: ${res.status} ${await res.text()}`);
+}
+export {
+  gcloudConfiguredProject,
+  gcpPreflight,
+  projectFromIni,
+  resolveProjectId
+};