clawdlets 0.0.1 → 0.2.0

package/node_modules/@clawdlets/core/dist/lib/inline-script-ban.js

@@ -0,0 +1,70 @@
+import fs from "node:fs";
+import path from "node:path";
+const RULES = [
+    { name: "python -c", rx: /\bpython3?\s+-c\b/ },
+    { name: "python heredoc", rx: /\bpython3?\s+.*<<\s*'?PY'?/ },
+    { name: "node -e", rx: /\bnode\s+-e\b/ },
+    { name: "node heredoc", rx: /\bnode\s+.*<<\s*'?NODE'?/ },
+    { name: "PY heredoc label", rx: /<<\s*'?PY'?/ },
+    { name: "NODE heredoc label", rx: /<<\s*'?NODE'?/ },
+];
+function shouldScanFile(filePath) {
+    const base = path.basename(filePath);
+    if (base.startsWith("."))
+        return false;
+    if (base === "node_modules")
+        return false;
+    if (filePath.includes(`${path.sep}node_modules${path.sep}`))
+        return false;
+    if (filePath.includes(`${path.sep}.git${path.sep}`))
+        return false;
+    if (filePath.includes(`${path.sep}.clawdlets${path.sep}`))
+        return false;
+    return filePath.endsWith(".nix") || filePath.endsWith(".sh") || filePath.endsWith(".bash");
+}
+function walk(root) {
+    if (!fs.existsSync(root))
+        return [];
+    const out = [];
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const ent of entries) {
+            const p = path.join(dir, ent.name);
+            if (ent.isDirectory()) {
+                if (ent.name === "node_modules" || ent.name === ".git" || ent.name === ".clawdlets")
+                    continue;
+                stack.push(p);
+                continue;
+            }
+            if (ent.isFile() && shouldScanFile(p))
+                out.push(p);
+        }
+    }
+    return out.sort();
+}
+export function findInlineScriptingViolations(params) {
+    const roots = [path.join(params.repoRoot, "infra"), path.join(params.repoRoot, "scripts")];
+    const files = roots.flatMap((r) => walk(r));
+    const violations = [];
+    for (const filePath of files) {
+        const text = fs.readFileSync(filePath, "utf8");
+        const lines = text.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const lineText = lines[i];
+            for (const rule of RULES) {
+                if (rule.rx.test(lineText)) {
+                    violations.push({
+                        filePath,
+                        line: i + 1,
+                        rule: rule.name,
+                        text: lineText.trim(),
+                    });
+                }
+            }
+        }
+    }
+    return violations;
+}
+//# sourceMappingURL=inline-script-ban.js.map

package/node_modules/@clawdlets/core/dist/lib/inline-script-ban.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-script-ban.js","sourceRoot":"","sources":["../../src/lib/inline-script-ban.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B,MAAM,KAAK,GAAW;IACpB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,mBAAmB,EAAE;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE;IACxC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,0BAA0B,EAAE;IACxD,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,aAAa,EAAE;IAC/C,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,eAAe,EAAE;CACpD,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;oBAAE,SAAS;gBAC9F,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAA4B;IACxE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3B,UAAU,CAAC,IAAI,CAAC;wBACd,QAAQ;wBACR,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/llm-provider-env.d.ts

@@ -0,0 +1,4 @@
+export declare function getLlmProviderFromModelId(modelId: string): string | null;
+export declare function getProviderRequiredEnvVars(provider: string): string[];
+export declare function getModelRequiredEnvVars(modelId: string): string[];
+//# sourceMappingURL=llm-provider-env.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/llm-provider-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-provider-env.d.ts","sourceRoot":"","sources":["../../src/lib/llm-provider-env.ts"],"names":[],"mappings":"AAMA,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOxE;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAGjE"}

package/node_modules/@clawdlets/core/dist/lib/llm-provider-env.js

@@ -0,0 +1,25 @@
+const PROVIDER_ENV_VARS = {
+    anthropic: ["ANTHROPIC_API_KEY"],
+    openai: ["OPENAI_API_KEY", "OPEN_AI_APIKEY"],
+    zai: ["ZAI_API_KEY", "Z_AI_API_KEY"],
+};
+export function getLlmProviderFromModelId(modelId) {
+    const s = String(modelId || "").trim();
+    if (!s)
+        return null;
+    const idx = s.indexOf("/");
+    if (idx <= 0)
+        return null;
+    const provider = s.slice(0, idx).trim().toLowerCase();
+    return provider || null;
+}
+export function getProviderRequiredEnvVars(provider) {
+    const p = String(provider || "").trim().toLowerCase();
+    const v = PROVIDER_ENV_VARS[p];
+    return v ? [...v] : [];
+}
+export function getModelRequiredEnvVars(modelId) {
+    const provider = getLlmProviderFromModelId(modelId);
+    return provider ? getProviderRequiredEnvVars(provider) : [];
+}
+//# sourceMappingURL=llm-provider-env.js.map

package/node_modules/@clawdlets/core/dist/lib/llm-provider-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-provider-env.js","sourceRoot":"","sources":["../../src/lib/llm-provider-env.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAsC;IAC3D,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,GAAG,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;CAC5B,CAAC;AAEX,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/mkpasswd.d.ts

@@ -0,0 +1,3 @@
+import { type NixToolOpts } from "./nix-tools.js";
+export declare function mkpasswdYescryptHash(password: string, opts: NixToolOpts): Promise<string>;
+//# sourceMappingURL=mkpasswd.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/mkpasswd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mkpasswd.d.ts","sourceRoot":"","sources":["../../src/lib/mkpasswd.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE5E,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,CAAC,CAkBjB"}

package/node_modules/@clawdlets/core/dist/lib/mkpasswd.js

@@ -0,0 +1,17 @@
+import { nixShellCaptureWithInput } from "./nix-tools.js";
+export async function mkpasswdYescryptHash(password, opts) {
+    if (opts.dryRun)
+        return "<admin_password_hash>";
+    const out = await nixShellCaptureWithInput("mkpasswd", "mkpasswd", ["-m", "yescrypt", "--stdin"], `${password}\n`, {
+        ...opts,
+        redact: [...(opts.redact ?? []), password],
+    });
+    const hash = out
+        .split("\n")
+        .map((l) => l.trim())
+        .find((l) => l.startsWith("$y$"));
+    if (!hash)
+        throw new Error("mkpasswd returned no yescrypt hash");
+    return hash;
+}
+//# sourceMappingURL=mkpasswd.js.map

package/node_modules/@clawdlets/core/dist/lib/mkpasswd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mkpasswd.js","sourceRoot":"","sources":["../../src/lib/mkpasswd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAoB,MAAM,gBAAgB,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,IAAiB;IAEjB,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,uBAAuB,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,wBAAwB,CACxC,UAAU,EACV,UAAU,EACV,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EAC7B,GAAG,QAAQ,IAAI,EACf;QACE,GAAG,IAAI;QACP,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC;KAC3C,CACF,CAAC;IACF,MAAM,IAAI,GAAG,GAAG;SACb,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/nix-flakes.d.ts

@@ -0,0 +1,2 @@
+export declare function withFlakesEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=nix-flakes.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/nix-flakes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nix-flakes.d.ts","sourceRoot":"","sources":["../../src/lib/nix-flakes.ts"],"names":[],"mappings":"AAMA,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAOxE"}

package/node_modules/@clawdlets/core/dist/lib/nix-flakes.js

@@ -0,0 +1,17 @@
+function hasNeededExperimentalFeatures(existing) {
+    const normalized = existing.replace(/\s+/g, " ").toLowerCase();
+    if (!normalized.includes("experimental-features"))
+        return false;
+    return normalized.includes("nix-command") && normalized.includes("flakes");
+}
+export function withFlakesEnv(env) {
+    const base = { ...process.env, ...(env || {}) };
+    const needed = "experimental-features = nix-command flakes";
+    const existing = String(base.NIX_CONFIG || "").trim();
+    if (!existing)
+        return { ...base, NIX_CONFIG: needed };
+    if (hasNeededExperimentalFeatures(existing))
+        return base;
+    return { ...base, NIX_CONFIG: `${existing}\n${needed}` };
+}
+//# sourceMappingURL=nix-flakes.js.map

package/node_modules/@clawdlets/core/dist/lib/nix-flakes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nix-flakes.js","sourceRoot":"","sources":["../../src/lib/nix-flakes.ts"],"names":[],"mappings":"AAAA,SAAS,6BAA6B,CAAC,QAAgB;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAuB;IACnD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,4CAA4C,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACtD,IAAI,6BAA6B,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,KAAK,MAAM,EAAE,EAAE,CAAC;AAC3D,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/nix-host.d.ts

@@ -0,0 +1,6 @@
+export declare function escapeNixString(value: string): string;
+export declare function upsertAdminAuthorizedKey(params: {
+    hostNix: string;
+    sshPubkey: string;
+}): string | null;
+//# sourceMappingURL=nix-host.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/nix-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nix-host.d.ts","sourceRoot":"","sources":["../../src/lib/nix-host.ts"],"names":[],"mappings":"AAEA,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,GAAG,IAAI,CAmBhB"}

package/node_modules/@clawdlets/core/dist/lib/nix-host.js

@@ -0,0 +1,23 @@
+import { normalizeSshPublicKey } from "./ssh.js";
+export function escapeNixString(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+export function upsertAdminAuthorizedKey(params) {
+    const normalized = normalizeSshPublicKey(params.sshPubkey);
+    if (!normalized)
+        return null;
+    if (params.hostNix.includes(normalized))
+        return params.hostNix;
+    const rx = /(^\s*openssh\.authorizedKeys\.keys\s*=\s*\[\s*\n)([\s\S]*?)(^\s*\];)/m;
+    const m = params.hostNix.match(rx);
+    if (!m)
+        return null;
+    const indent = m[1]?.match(/^\s*/)?.[0] ?? "";
+    const itemIndent = `${indent}  `;
+    const keyLine = `${itemIndent}"${escapeNixString(params.sshPubkey.trim())}"\n`;
+    const body = m[2] ?? "";
+    const bodyTrimEnd = body.replace(/\s*$/, "");
+    const bodyNext = bodyTrimEnd.length > 0 ? `${bodyTrimEnd}\n${keyLine}` : keyLine;
+    return params.hostNix.replace(rx, `${m[1]}${bodyNext}${m[3]}`);
+}
+//# sourceMappingURL=nix-host.js.map

package/node_modules/@clawdlets/core/dist/lib/nix-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nix-host.js","sourceRoot":"","sources":["../../src/lib/nix-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAGxC;IACC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAE/D,MAAM,EAAE,GACN,uEAAuE,CAAC;IAC1E,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;IAE/E,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEjF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/nix-tools.d.ts

@@ -0,0 +1,12 @@
+export type NixToolOpts = {
+    nixBin: string;
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    dryRun?: boolean;
+    redact?: string[];
+};
+export declare function nixRunCapture(pkg: string, args: string[], opts: NixToolOpts): Promise<string>;
+export declare function nixRun(pkg: string, args: string[], opts: NixToolOpts): Promise<void>;
+export declare function nixShellCapture(pkg: string, cmd: string, args: string[], opts: NixToolOpts): Promise<string>;
+export declare function nixShellCaptureWithInput(pkg: string, cmd: string, args: string[], input: string, opts: NixToolOpts): Promise<string>;
+//# sourceMappingURL=nix-tools.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/nix-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nix-tools.d.ts","sourceRoot":"","sources":["../../src/lib/nix-tools.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAsB,MAAM,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,CAAC,CAGjB"}

package/node_modules/@clawdlets/core/dist/lib/nix-tools.js

@@ -0,0 +1,20 @@
+import { capture, captureWithInput, run } from "./run.js";
+import { withFlakesEnv } from "./nix-flakes.js";
+export async function nixRunCapture(pkg, args, opts) {
+    const nixArgs = ["run", "--impure", `nixpkgs#${pkg}`, "--", ...args];
+    return await capture(opts.nixBin, nixArgs, { ...opts, env: withFlakesEnv(opts.env) });
+}
+export async function nixRun(pkg, args, opts) {
+    const nixArgs = ["run", "--impure", `nixpkgs#${pkg}`, "--", ...args];
+    const runOpts = { ...opts, env: withFlakesEnv(opts.env) };
+    await run(opts.nixBin, nixArgs, runOpts);
+}
+export async function nixShellCapture(pkg, cmd, args, opts) {
+    const nixArgs = ["shell", `nixpkgs#${pkg}`, "-c", cmd, ...args];
+    return await capture(opts.nixBin, nixArgs, { ...opts, env: withFlakesEnv(opts.env) });
+}
+export async function nixShellCaptureWithInput(pkg, cmd, args, input, opts) {
+    const nixArgs = ["shell", `nixpkgs#${pkg}`, "-c", cmd, ...args];
+    return await captureWithInput(opts.nixBin, nixArgs, input, { ...opts, env: withFlakesEnv(opts.env) });
+}
+//# sourceMappingURL=nix-tools.js.map

package/node_modules/@clawdlets/core/dist/lib/nix-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nix-tools.js","sourceRoot":"","sources":["../../src/lib/nix-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAgB,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAUhD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAc,EACd,IAAiB;IAEjB,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAW,EACX,IAAc,EACd,IAAiB;IAEjB,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAY,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnE,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,GAAW,EACX,IAAc,EACd,IAAiB;IAEjB,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,GAAW,EACX,IAAc,EACd,KAAa,EACb,IAAiB;IAEjB,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/opentofu.d.ts

@@ -0,0 +1,28 @@
+import type { SshExposureMode, TailnetMode } from "./clawdlets-config.js";
+export type OpenTofuApplyVars = {
+    hostName: string;
+    hcloudToken: string;
+    adminCidr: string;
+    adminCidrIsWorldOpen: boolean;
+    sshPubkeyFile: string;
+    serverType?: string;
+    image?: string;
+    location?: string;
+    sshExposureMode: SshExposureMode;
+    tailnetMode: TailnetMode;
+};
+export declare function applyOpenTofuVars(params: {
+    opentofuDir: string;
+    vars: OpenTofuApplyVars;
+    nixBin?: string;
+    dryRun?: boolean;
+    redact?: string[];
+}): Promise<void>;
+export declare function destroyOpenTofuVars(params: {
+    opentofuDir: string;
+    vars: OpenTofuApplyVars;
+    nixBin?: string;
+    dryRun?: boolean;
+    redact?: string[];
+}): Promise<void>;
+//# sourceMappingURL=opentofu.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/opentofu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opentofu.d.ts","sourceRoot":"","sources":["../../src/lib/opentofu.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAsB1E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EhB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EhB"}

package/node_modules/@clawdlets/core/dist/lib/opentofu.js

@@ -0,0 +1,173 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ensureHcloudSshKeyId } from "./hcloud.js";
+import { run } from "./run.js";
+import { withFlakesEnv } from "./nix-flakes.js";
+function resolveBundledOpenTofuDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "assets", "opentofu");
+}
+function ensureOpenTofuWorkDir(opentofuDir) {
+    const srcDir = resolveBundledOpenTofuDir();
+    if (!fs.existsSync(srcDir))
+        throw new Error(`missing bundled OpenTofu module dir: ${srcDir}`);
+    fs.mkdirSync(opentofuDir, { recursive: true });
+    const entries = fs.readdirSync(srcDir, { withFileTypes: true });
+    for (const e of entries) {
+        const src = path.join(srcDir, e.name);
+        const dest = path.join(opentofuDir, e.name);
+        fs.cpSync(src, dest, { recursive: true });
+    }
+}
+export async function applyOpenTofuVars(params) {
+    const opentofuDir = params.opentofuDir;
+    ensureOpenTofuWorkDir(opentofuDir);
+    const hostName = String(params.vars.hostName || "").trim();
+    if (!hostName)
+        throw new Error("missing OpenTofu hostName");
+    const resolvedServerType = params.vars.serverType?.trim() || "";
+    const resolvedImage = params.vars.image?.trim() || "";
+    const resolvedLocation = params.vars.location?.trim() || "";
+    const env = {
+        ...process.env,
+        HCLOUD_TOKEN: params.vars.hcloudToken,
+        ADMIN_CIDR: params.vars.adminCidr,
+        SSH_PUBKEY_FILE: params.vars.sshPubkeyFile,
+        SERVER_TYPE: resolvedServerType,
+    };
+    const nixBin = params.nixBin || "nix";
+    const tofuEnv = {
+        ...env,
+    };
+    const tofuEnvWithFlakes = withFlakesEnv(tofuEnv);
+    const tofuArgs = (tfArgs) => [
+        "run",
+        "--impure",
+        "nixpkgs#opentofu",
+        "--",
+        ...tfArgs,
+    ];
+    const redact = (params.redact || []).filter((value) => Boolean(value && value.trim()));
+    await run(nixBin, tofuArgs(["init", "-input=false"]), {
+        cwd: opentofuDir,
+        env: tofuEnvWithFlakes,
+        dryRun: params.dryRun,
+        redact,
+    });
+    const sshPublicKey = fs.readFileSync(params.vars.sshPubkeyFile, "utf8").trim();
+    const sshKeyId = params.dryRun
+        ? "<hcloud-ssh-key-id>"
+        : await ensureHcloudSshKeyId({
+            token: params.vars.hcloudToken,
+            name: "clawdbot-admin",
+            publicKey: sshPublicKey,
+        });
+    const tfApplyArgs = [
+        "apply",
+        "-auto-approve",
+        "-input=false",
+        "-var",
+        `host_name=${hostName}`,
+        "-var",
+        `hcloud_token=${env.HCLOUD_TOKEN}`,
+        "-var",
+        `admin_cidr=${env.ADMIN_CIDR}`,
+        "-var",
+        `admin_cidr_is_world_open=${params.vars.adminCidrIsWorldOpen ? "true" : "false"}`,
+        "-var",
+        `ssh_key_id=${sshKeyId}`,
+        "-var",
+        `ssh_exposure_mode=${params.vars.sshExposureMode}`,
+        "-var",
+        `tailnet_mode=${params.vars.tailnetMode}`,
+    ];
+    if (env.SERVER_TYPE)
+        tfApplyArgs.push("-var", `server_type=${env.SERVER_TYPE}`);
+    if (resolvedImage)
+        tfApplyArgs.push("-var", `image=${resolvedImage}`);
+    if (resolvedLocation)
+        tfApplyArgs.push("-var", `location=${resolvedLocation}`);
+    await run(nixBin, tofuArgs(tfApplyArgs), {
+        cwd: opentofuDir,
+        env: tofuEnvWithFlakes,
+        dryRun: params.dryRun,
+        redact,
+    });
+}
+export async function destroyOpenTofuVars(params) {
+    const opentofuDir = params.opentofuDir;
+    ensureOpenTofuWorkDir(opentofuDir);
+    const hostName = String(params.vars.hostName || "").trim();
+    if (!hostName)
+        throw new Error("missing OpenTofu hostName");
+    const resolvedServerType = params.vars.serverType?.trim() || "";
+    const resolvedImage = params.vars.image?.trim() || "";
+    const resolvedLocation = params.vars.location?.trim() || "";
+    const env = {
+        ...process.env,
+        HCLOUD_TOKEN: params.vars.hcloudToken,
+        ADMIN_CIDR: params.vars.adminCidr,
+        SSH_PUBKEY_FILE: params.vars.sshPubkeyFile,
+        SERVER_TYPE: resolvedServerType,
+    };
+    const nixBin = params.nixBin || "nix";
+    const tofuEnv = {
+        ...env,
+    };
+    const tofuEnvWithFlakes = withFlakesEnv(tofuEnv);
+    const tofuArgs = (tfArgs) => [
+        "run",
+        "--impure",
+        "nixpkgs#opentofu",
+        "--",
+        ...tfArgs,
+    ];
+    const redact = (params.redact || []).filter((value) => Boolean(value && value.trim()));
+    await run(nixBin, tofuArgs(["init", "-input=false"]), {
+        cwd: opentofuDir,
+        env: tofuEnvWithFlakes,
+        dryRun: params.dryRun,
+        redact,
+    });
+    const sshPublicKey = fs.readFileSync(params.vars.sshPubkeyFile, "utf8").trim();
+    const sshKeyId = params.dryRun
+        ? "<hcloud-ssh-key-id>"
+        : await ensureHcloudSshKeyId({
+            token: params.vars.hcloudToken,
+            name: "clawdbot-admin",
+            publicKey: sshPublicKey,
+        });
+    const tfDestroyArgs = [
+        "destroy",
+        "-auto-approve",
+        "-input=false",
+        "-var",
+        `host_name=${hostName}`,
+        "-var",
+        `hcloud_token=${env.HCLOUD_TOKEN}`,
+        "-var",
+        `admin_cidr=${env.ADMIN_CIDR}`,
+        "-var",
+        `admin_cidr_is_world_open=${params.vars.adminCidrIsWorldOpen ? "true" : "false"}`,
+        "-var",
+        `ssh_key_id=${sshKeyId}`,
+        "-var",
+        `ssh_exposure_mode=${params.vars.sshExposureMode}`,
+        "-var",
+        `tailnet_mode=${params.vars.tailnetMode}`,
+    ];
+    if (env.SERVER_TYPE)
+        tfDestroyArgs.push("-var", `server_type=${env.SERVER_TYPE}`);
+    if (resolvedImage)
+        tfDestroyArgs.push("-var", `image=${resolvedImage}`);
+    if (resolvedLocation)
+        tfDestroyArgs.push("-var", `location=${resolvedLocation}`);
+    await run(nixBin, tofuArgs(tfDestroyArgs), {
+        cwd: opentofuDir,
+        env: tofuEnvWithFlakes,
+        dryRun: params.dryRun,
+        redact,
+    });
+}
+//# sourceMappingURL=opentofu.js.map

package/node_modules/@clawdlets/core/dist/lib/opentofu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opentofu.js","sourceRoot":"","sources":["../../src/lib/opentofu.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,SAAS,yBAAyB;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;IAE9F,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAMvC;IACC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAE5D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAsB;QAC7B,GAAG,OAAO,CAAC,GAAG;QACd,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACrC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QACjC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;QAC1C,WAAW,EAAE,kBAAkB;KAChC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG;QACd,GAAG,GAAG;KACP,CAAC;IACF,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAgB,EAAY,EAAE,CAAC;QAC/C,KAAK;QACL,UAAU;QACV,kBAAkB;QAClB,IAAI;QACJ,GAAG,MAAM;KACV,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvF,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE;QACpD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,iBAAiB;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;QAC5B,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,MAAM,oBAAoB,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YAC9B,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;IAEP,MAAM,WAAW,GAAG;QAClB,OAAO;QACP,eAAe;QACf,cAAc;QACd,MAAM;QACN,aAAa,QAAQ,EAAE;QACvB,MAAM;QACN,gBAAgB,GAAG,CAAC,YAAY,EAAE;QAClC,MAAM;QACN,cAAc,GAAG,CAAC,UAAU,EAAE;QAC9B,MAAM;QACN,4BAA4B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACjF,MAAM;QACN,cAAc,QAAQ,EAAE;QACxB,MAAM;QACN,qBAAqB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;QAClD,MAAM;QACN,gBAAgB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;KAC1C,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC,CAAC;IACtE,IAAI,gBAAgB;QAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,gBAAgB,EAAE,CAAC,CAAC;IAE/E,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE;QACvC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,iBAAiB;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAMzC;IACC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAE5D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAsB;QAC7B,GAAG,OAAO,CAAC,GAAG;QACd,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACrC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QACjC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;QAC1C,WAAW,EAAE,kBAAkB;KAChC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG;QACd,GAAG,GAAG;KACP,CAAC;IACF,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAgB,EAAY,EAAE,CAAC;QAC/C,KAAK;QACL,UAAU;QACV,kBAAkB;QAClB,IAAI;QACJ,GAAG,MAAM;KACV,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvF,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE;QACpD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,iBAAiB;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;QAC5B,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,MAAM,oBAAoB,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YAC9B,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG;QACpB,SAAS;QACT,eAAe;QACf,cAAc;QACd,MAAM;QACN,aAAa,QAAQ,EAAE;QACvB,MAAM;QACN,gBAAgB,GAAG,CAAC,YAAY,EAAE;QAClC,MAAM;QACN,cAAc,GAAG,CAAC,UAAU,EAAE;QAC9B,MAAM;QACN,4BAA4B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACjF,MAAM;QACN,cAAc,QAAQ,EAAE;QACxB,MAAM;QACN,qBAAqB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;QAClD,MAAM;QACN,gBAAgB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;KAC1C,CAAC;IACF,IAAI,GAAG,CAAC,WAAW;QAAE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAClF,IAAI,aAAa;QAAE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC,CAAC;IACxE,IAAI,gBAAgB;QAAE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,gBAAgB,EAAE,CAAC,CAAC;IAEjF,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE;QACzC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,iBAAiB;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/path-expand.d.ts

@@ -0,0 +1,2 @@
+export declare function expandPath(input: string): string;
+//# sourceMappingURL=path-expand.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/path-expand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-expand.d.ts","sourceRoot":"","sources":["../../src/lib/path-expand.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAahD"}

package/node_modules/@clawdlets/core/dist/lib/path-expand.js

@@ -0,0 +1,15 @@
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+export function expandPath(input) {
+    const trimmed = input.trim();
+    if (trimmed.startsWith("~/")) {
+        return path.join(os.homedir(), trimmed.slice(2));
+    }
+    const home = process.env.HOME?.trim();
+    if (home && (trimmed.startsWith("$HOME/") || trimmed.startsWith("${HOME}/"))) {
+        return path.join(home, trimmed.replace(/^\$\{?HOME\}?\//, ""));
+    }
+    return trimmed;
+}
+//# sourceMappingURL=path-expand.js.map

package/node_modules/@clawdlets/core/dist/lib/path-expand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-expand.js","sourceRoot":"","sources":["../../src/lib/path-expand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/persona-loader.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+export declare const PERSONA_CONFIG_SCHEMA_VERSION: 1;
+export declare const PersonaConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+    model: z.ZodDefault<z.ZodObject<{
+        primary: z.ZodDefault<z.ZodString>;
+        fallbacks: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$loose>;
+export type PersonaConfig = z.infer<typeof PersonaConfigSchema>;
+export type LoadedPersona = {
+    name: string;
+    personaDir: string;
+    soulPath: string;
+    soulText: string;
+    configPath: string;
+    configRaw: string;
+    config: PersonaConfig;
+    cloudInitFiles: Array<{
+        path: string;
+        permissions: string;
+        owner: string;
+        content: string;
+    }>;
+};
+export declare function getPersonaDir(repoRoot: string, personaName: string): string;
+export declare function loadPersona(params: {
+    personaName: string;
+    repoRoot?: string;
+    personasRoot?: string;
+    maxSoulBytes?: number;
+    maxConfigBytes?: number;
+}): LoadedPersona;
+//# sourceMappingURL=persona-loader.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/persona-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persona-loader.d.ts","sourceRoot":"","sources":["../../src/lib/persona-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,eAAO,MAAM,mBAAmB;;;;;;iBAUhB,CAAC;AAEjB,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F,CAAC;AASF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,aAAa,CA8ChB"}

package/node_modules/@clawdlets/core/dist/lib/persona-loader.js

@@ -0,0 +1,72 @@
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { assertSafePersonaName } from "./identifiers.js";
+export const PERSONA_CONFIG_SCHEMA_VERSION = 1;
+export const PersonaConfigSchema = z
+    .object({
+    schemaVersion: z.literal(PERSONA_CONFIG_SCHEMA_VERSION).default(PERSONA_CONFIG_SCHEMA_VERSION),
+    model: z
+        .object({
+        primary: z.string().trim().default(""),
+        fallbacks: z.array(z.string().trim().min(1)).default([]),
+    })
+        .default({ primary: "", fallbacks: [] }),
+})
+    .passthrough();
+function readTextFileLimited(filePath, maxBytes) {
+    const st = fs.statSync(filePath);
+    if (!st.isFile())
+        throw new Error(`not a file: ${filePath}`);
+    if (st.size > maxBytes)
+        throw new Error(`file too large: ${filePath} (${st.size} bytes; max ${maxBytes})`);
+    return fs.readFileSync(filePath, "utf8");
+}
+export function getPersonaDir(repoRoot, personaName) {
+    assertSafePersonaName(personaName);
+    return path.join(repoRoot, "cattle", "personas", personaName);
+}
+export function loadPersona(params) {
+    const personaName = String(params.personaName || "").trim();
+    assertSafePersonaName(personaName);
+    const personasRoot = String(params.personasRoot || "").trim();
+    const repoRoot = String(params.repoRoot || "").trim();
+    if (!personasRoot && !repoRoot) {
+        throw new Error("loadPersona requires either personasRoot or repoRoot");
+    }
+    const personaDir = personasRoot ? path.join(personasRoot, personaName) : getPersonaDir(repoRoot, personaName);
+    const soulPath = path.join(personaDir, "SOUL.md");
+    const configPath = path.join(personaDir, "config.json");
+    if (!fs.existsSync(personaDir)) {
+        throw new Error(`persona not found: ${personaName} (missing dir ${personaDir})`);
+    }
+    if (!fs.existsSync(soulPath))
+        throw new Error(`persona missing SOUL.md: ${soulPath}`);
+    if (!fs.existsSync(configPath))
+        throw new Error(`persona missing config.json: ${configPath}`);
+    const soulText = readTextFileLimited(soulPath, params.maxSoulBytes ?? 16 * 1024);
+    const configRaw = readTextFileLimited(configPath, params.maxConfigBytes ?? 16 * 1024);
+    let configJson;
+    try {
+        configJson = JSON.parse(configRaw);
+    }
+    catch (e) {
+        throw new Error(`persona config.json invalid JSON: ${configPath} (${String(e?.message || e)})`);
+    }
+    const config = PersonaConfigSchema.parse(configJson);
+    const cloudInitFiles = [
+        { path: "/var/lib/clawdlets/cattle/persona/SOUL.md", permissions: "0600", owner: "root:root", content: `${soulText}\n` },
+        { path: "/var/lib/clawdlets/cattle/persona/config.json", permissions: "0600", owner: "root:root", content: `${JSON.stringify(configJson, null, 2)}\n` },
+    ];
+    return {
+        name: personaName,
+        personaDir,
+        soulPath,
+        soulText,
+        configPath,
+        configRaw,
+        config,
+        cloudInitFiles,
+    };
+}
+//# sourceMappingURL=persona-loader.js.map