clawdlets 0.0.1 → 0.2.0

package/node_modules/@clawdlets/core/dist/lib/template-test-dir.js

@@ -0,0 +1,28 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+export function resolveTemplateTestDir(params) {
+    const repoReal = fs.realpathSync(params.repoRoot);
+    const expected = path.join(repoReal, "packages", "core", "tests", ".template");
+    const destAbs = path.resolve(params.destRoot);
+    const destReal = fs.existsSync(destAbs) ? fs.realpathSync(destAbs) : destAbs;
+    const root = path.parse(destReal).root;
+    if (destReal === root)
+        throw new Error("template test dir cannot be filesystem root");
+    if (destReal === repoReal)
+        throw new Error("template test dir cannot be repo root");
+    if (destReal === os.homedir())
+        throw new Error("template test dir cannot be $HOME");
+    const suffix = path.join("packages", "core", "tests", ".template");
+    if (!destReal.endsWith(path.sep + suffix) && destReal !== expected) {
+        throw new Error(`template test dir must end with ${suffix}`);
+    }
+    const parent = path.dirname(destReal);
+    const parentReal = fs.realpathSync(parent);
+    const resolved = path.join(parentReal, path.basename(destReal));
+    if (resolved !== expected) {
+        throw new Error(`template test dir must resolve to ${expected}`);
+    }
+    return resolved;
+}
+//# sourceMappingURL=template-test-dir.js.map

package/node_modules/@clawdlets/core/dist/lib/template-test-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-test-dir.js","sourceRoot":"","sources":["../../src/lib/template-test-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,sBAAsB,CAAC,MAA8C;IACnF,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACtF,IAAI,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpF,IAAI,QAAQ,KAAK,EAAE,CAAC,OAAO,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAEpF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/ttl.d.ts

@@ -0,0 +1,13 @@
+import { z } from "zod";
+export type ParsedTtl = {
+    raw: string;
+    seconds: number;
+};
+export declare function parseTtlToSeconds(raw: string): ParsedTtl | null;
+export declare function parseTtlToMs(raw: string): {
+    raw: string;
+    ms: number;
+} | null;
+export declare function assertValidTtlString(raw: string): void;
+export declare const TtlStringSchema: z.ZodString;
+//# sourceMappingURL=ttl.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/ttl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl.d.ts","sourceRoot":"","sources":["../../src/lib/ttl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,SAAS,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAsB/D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM5E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED,eAAO,MAAM,eAAe,aAWxB,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/ttl.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+export function parseTtlToSeconds(raw) {
+    const s = String(raw || "").trim();
+    if (!s)
+        return null;
+    const m = s.match(/^(\d+)\s*([smhd])$/i);
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    if (!Number.isFinite(n) || n <= 0)
+        return null;
+    const unit = String(m[2]).toLowerCase();
+    const seconds = unit === "s" ? n :
+        unit === "m" ? n * 60 :
+            unit === "h" ? n * 60 * 60 :
+                unit === "d" ? n * 60 * 60 * 24 :
+                    null;
+    if (seconds == null)
+        return null;
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return null;
+    return { raw: s, seconds };
+}
+export function parseTtlToMs(raw) {
+    const parsed = parseTtlToSeconds(raw);
+    if (!parsed)
+        return null;
+    const ms = parsed.seconds * 1000;
+    if (!Number.isFinite(ms) || ms <= 0)
+        return null;
+    return { raw: parsed.raw, ms };
+}
+export function assertValidTtlString(raw) {
+    if (!parseTtlToSeconds(raw))
+        throw new Error(`invalid ttl: ${String(raw || "").trim()} (expected <n><s|m|h|d>, e.g. 30m, 2h)`);
+}
+export const TtlStringSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .superRefine((value, ctx) => {
+    if (!parseTtlToSeconds(value)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "invalid ttl (expected <n><s|m|h|d>, e.g. 30m, 2h)",
+        });
+    }
+});
+//# sourceMappingURL=ttl.js.map

package/node_modules/@clawdlets/core/dist/lib/ttl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl.js","sourceRoot":"","sources":["../../src/lib/ttl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,OAAO,GACX,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;oBACjC,IAAI,CAAC;IAEP,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/node_modules/@clawdlets/core/dist/lib/yaml-scalar.d.ts

@@ -0,0 +1,5 @@
+export declare function readYamlScalarFromMapping(params: {
+    yamlText: string;
+    key: string;
+}): string | null;
+//# sourceMappingURL=yaml-scalar.d.ts.map

package/node_modules/@clawdlets/core/dist/lib/yaml-scalar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-scalar.d.ts","sourceRoot":"","sources":["../../src/lib/yaml-scalar.ts"],"names":[],"mappings":"AAEA,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAmBlG"}

package/node_modules/@clawdlets/core/dist/lib/yaml-scalar.js

@@ -0,0 +1,26 @@
+import YAML from "yaml";
+export function readYamlScalarFromMapping(params) {
+    const key = String(params.key || "").trim();
+    if (!key)
+        return null;
+    let parsed;
+    try {
+        parsed = YAML.parse(String(params.yamlText ?? ""));
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    if (!Object.prototype.hasOwnProperty.call(parsed, key))
+        return null;
+    const value = parsed[key];
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (value === null)
+        return "";
+    return null;
+}
+//# sourceMappingURL=yaml-scalar.js.map

package/node_modules/@clawdlets/core/dist/lib/yaml-scalar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-scalar.js","sourceRoot":"","sources":["../../src/lib/yaml-scalar.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,yBAAyB,CAAC,MAAyC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,MAAM,KAAK,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@clawdlets/core/dist/repo-layout.d.ts

@@ -0,0 +1,31 @@
+export type RepoLayout = {
+    repoRoot: string;
+    runtimeDir: string;
+    envFilePath: string;
+    cattleDir: string;
+    cattleDbPath: string;
+    runtimeInfraDir: string;
+    opentofuDir: string;
+    fleetDir: string;
+    clawdletsConfigPath: string;
+    bundledSkillsPath: string;
+    secretsDir: string;
+    secretsHostsDir: string;
+    secretsKeysDir: string;
+    secretsHostKeysDir: string;
+    extraFilesDir: string;
+    sopsConfigPath: string;
+    localKeysDir: string;
+    localOperatorKeysDir: string;
+};
+export declare function getRepoLayout(repoRoot: string, runtimeDir?: string): RepoLayout;
+export declare function getHostOpenTofuDir(layout: RepoLayout, host: string): string;
+export declare function getHostSecretsDir(layout: RepoLayout, host: string): string;
+export declare function getHostSecretFile(layout: RepoLayout, host: string, secretName: string): string;
+export declare function getHostExtraFilesDir(layout: RepoLayout, host: string): string;
+export declare function getHostExtraFilesKeyPath(layout: RepoLayout, host: string): string;
+export declare function getHostExtraFilesSecretsDir(layout: RepoLayout, host: string): string;
+export declare function getHostRemoteSecretsDir(host: string): string;
+export declare function getLocalOperatorAgeKeyPath(layout: RepoLayout, operatorId: string): string;
+export declare function getHostEncryptedAgeKeyFile(layout: RepoLayout, host: string): string;
+//# sourceMappingURL=repo-layout.d.ts.map

package/node_modules/@clawdlets/core/dist/repo-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-layout.d.ts","sourceRoot":"","sources":["../src/repo-layout.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IAGjB,UAAU,EAAE,MAAM,CAAC;IAGnB,WAAW,EAAE,MAAM,CAAC;IAGpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IAGrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IAGpB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAG1B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IAGvB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CAuC/E;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG1E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI9F;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGzF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnF"}

package/node_modules/@clawdlets/core/dist/repo-layout.js

@@ -0,0 +1,79 @@
+import path from "node:path";
+import { assertSafeHostName, assertSafeOperatorId, assertSafeSecretName } from "./lib/identifiers.js";
+export function getRepoLayout(repoRoot, runtimeDir) {
+    const resolvedRuntimeDir = runtimeDir ?? path.join(repoRoot, ".clawdlets");
+    const envFilePath = path.join(resolvedRuntimeDir, "env");
+    const cattleDir = path.join(resolvedRuntimeDir, "cattle");
+    const cattleDbPath = path.join(cattleDir, "state.sqlite");
+    const runtimeInfraDir = path.join(resolvedRuntimeDir, "infra");
+    const opentofuDir = path.join(runtimeInfraDir, "opentofu");
+    const fleetDir = path.join(repoRoot, "fleet");
+    const clawdletsConfigPath = path.join(fleetDir, "clawdlets.json");
+    const bundledSkillsPath = path.join(fleetDir, "bundled-skills.json");
+    const secretsDir = path.join(repoRoot, "secrets");
+    const secretsHostsDir = path.join(secretsDir, "hosts");
+    const extraFilesDir = path.join(resolvedRuntimeDir, "extra-files");
+    const secretsKeysDir = path.join(secretsDir, "keys");
+    const secretsHostKeysDir = path.join(secretsKeysDir, "hosts");
+    const sopsConfigPath = path.join(secretsDir, ".sops.yaml");
+    const localKeysDir = path.join(resolvedRuntimeDir, "keys");
+    const localOperatorKeysDir = path.join(localKeysDir, "operators");
+    return {
+        repoRoot,
+        runtimeDir: resolvedRuntimeDir,
+        envFilePath,
+        cattleDir,
+        cattleDbPath,
+        runtimeInfraDir,
+        opentofuDir,
+        fleetDir,
+        clawdletsConfigPath,
+        bundledSkillsPath,
+        secretsDir,
+        secretsHostsDir,
+        secretsKeysDir,
+        secretsHostKeysDir,
+        extraFilesDir,
+        sopsConfigPath,
+        localKeysDir,
+        localOperatorKeysDir,
+    };
+}
+export function getHostOpenTofuDir(layout, host) {
+    assertSafeHostName(host);
+    return path.join(layout.opentofuDir, host);
+}
+export function getHostSecretsDir(layout, host) {
+    assertSafeHostName(host);
+    return path.join(layout.secretsHostsDir, host);
+}
+export function getHostSecretFile(layout, host, secretName) {
+    assertSafeHostName(host);
+    assertSafeSecretName(secretName);
+    return path.join(getHostSecretsDir(layout, host), `${secretName}.yaml`);
+}
+export function getHostExtraFilesDir(layout, host) {
+    assertSafeHostName(host);
+    return path.join(layout.extraFilesDir, host);
+}
+export function getHostExtraFilesKeyPath(layout, host) {
+    assertSafeHostName(host);
+    return path.join(getHostExtraFilesDir(layout, host), "var", "lib", "sops-nix", "key.txt");
+}
+export function getHostExtraFilesSecretsDir(layout, host) {
+    assertSafeHostName(host);
+    return path.join(getHostExtraFilesDir(layout, host), "var", "lib", "clawdlets", "secrets", "hosts", host);
+}
+export function getHostRemoteSecretsDir(host) {
+    assertSafeHostName(host);
+    return `/var/lib/clawdlets/secrets/hosts/${host}`;
+}
+export function getLocalOperatorAgeKeyPath(layout, operatorId) {
+    assertSafeOperatorId(operatorId);
+    return path.join(layout.localOperatorKeysDir, `${operatorId}.agekey`);
+}
+export function getHostEncryptedAgeKeyFile(layout, host) {
+    assertSafeHostName(host);
+    return path.join(layout.secretsHostKeysDir, `${host}.agekey.yaml`);
+}
+//# sourceMappingURL=repo-layout.js.map

package/node_modules/@clawdlets/core/dist/repo-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-layout.js","sourceRoot":"","sources":["../src/repo-layout.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAqCtG,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,UAAmB;IACjE,MAAM,kBAAkB,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAElE,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,kBAAkB;QAC9B,WAAW;QACX,SAAS;QACT,YAAY;QACZ,eAAe;QACf,WAAW;QACX,QAAQ;QACR,mBAAmB;QACnB,iBAAiB;QACjB,UAAU;QACV,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,aAAa;QACb,cAAc;QACd,YAAY;QACZ,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,IAAY;IACjE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,IAAY;IAChE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,IAAY,EAAE,UAAkB;IACpF,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,IAAY;IACnE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAkB,EAAE,IAAY;IACvE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAkB,EAAE,IAAY;IAC1E,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,oCAAoC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAkB,EAAE,UAAkB;IAC/E,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,UAAU,SAAS,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAkB,EAAE,IAAY;IACzE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;AACrE,CAAC"}

package/node_modules/@clawdlets/core/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@clawdlets/core",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./dist/index.js",
+    "./doctor": "./dist/doctor.js",
+    "./repo-layout": "./dist/repo-layout.js",
+    "./lib/*": "./dist/lib/*.js"
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node ../../scripts/copy-core-assets.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "pretest": "pnpm -C . build && node ../../scripts/fetch-template-for-tests.mjs",
+    "test": "vitest",
+    "pretest:run": "pnpm -C . build && node ../../scripts/fetch-template-for-tests.mjs",
+    "test:run": "vitest run",
+    "precoverage": "pnpm -C . build && node ../../scripts/fetch-template-for-tests.mjs",
+    "coverage": "vitest run --coverage"
+  },
+  "dependencies": {
+    "better-sqlite3": "^12.6.2",
+    "dotenv": "^17.2.3",
+    "zod": "^4.3.5",
+    "yaml": "^2.8.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^25.0.9",
+    "@vitest/coverage-v8": "^4.0.17",
+    "typescript": "^5.6.3",
+    "vitest": "^4.0.17"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "packageManager": "pnpm@10.25.0"
+}

package/node_modules/better-sqlite3/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Joshua Wise
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/better-sqlite3/README.md

@@ -0,0 +1,99 @@
+# better-sqlite3 [![Build Status](https://github.com/JoshuaWise/better-sqlite3/actions/workflows/build.yml/badge.svg)](https://github.com/JoshuaWise/better-sqlite3/actions/workflows/build.yml?query=branch%3Amaster)
+
+The fastest and simplest library for SQLite in Node.js.
+
+- Full transaction support
+- High performance, efficiency, and safety
+- Easy-to-use synchronous API *(better concurrency than an asynchronous API... yes, you read that correctly)*
+- Support for user-defined functions, aggregates, virtual tables, and extensions
+- 64-bit integers *(invisible until you need them)*
+- Worker thread support *(for large/slow queries)*
+
+## Help this project stay strong! 💪
+
+`better-sqlite3` is used by thousands of developers and engineers on a daily basis. Long nights and weekends were spent keeping this project strong and dependable, with no ask for compensation or funding, until now. If your company uses `better-sqlite3`, ask your manager to consider supporting the project:
+
+- [Become a GitHub sponsor](https://github.com/sponsors/JoshuaWise)
+- [Become a backer on Patreon](https://www.patreon.com/joshuawise)
+- [Make a one-time donation on PayPal](https://www.paypal.me/joshuathomaswise)
+
+## How other libraries compare
+
+|   |select 1 row  `get()` |select 100 rows   `all()`  |select 100 rows `iterate()` 1-by-1|insert 1 row `run()`|insert 100 rows in a transaction|
+|---|---|---|---|---|---|
+|better-sqlite3|1x|1x|1x|1x|1x|
+|[sqlite](https://www.npmjs.com/package/sqlite) and [sqlite3](https://www.npmjs.com/package/sqlite3)|11.7x slower|2.9x slower|24.4x slower|2.8x slower|15.6x slower|
+
+> You can verify these results by [running the benchmark yourself](./docs/benchmark.md).
+
+## Installation
+
+```bash
+npm install better-sqlite3
+```
+
+> Requires Node.js v14.21.1 or later. Prebuilt binaries are available for [LTS versions](https://nodejs.org/en/about/releases/). If you have trouble installing, check the [troubleshooting guide](./docs/troubleshooting.md).
+
+## Usage
+
+```js
+const db = require('better-sqlite3')('foobar.db', options);
+
+const row = db.prepare('SELECT * FROM users WHERE id = ?').get(userId);
+console.log(row.firstName, row.lastName, row.email);
+```
+
+Though not required, [it is generally important to set the WAL pragma for performance reasons](https://github.com/WiseLibs/better-sqlite3/blob/master/docs/performance.md).
+
+```js
+db.pragma('journal_mode = WAL');
+```
+
+##### In ES6 module notation:
+
+```js
+import Database from 'better-sqlite3';
+const db = new Database('foobar.db', options);
+db.pragma('journal_mode = WAL');
+```
+
+## Why should I use this instead of [node-sqlite3](https://github.com/mapbox/node-sqlite3)?
+
+- `node-sqlite3` uses asynchronous APIs for tasks that are either CPU-bound or serialized. That's not only bad design, but it wastes tons of resources. It also causes [mutex thrashing](https://en.wikipedia.org/wiki/Resource_contention) which has devastating effects on performance.
+- `node-sqlite3` exposes low-level (C language) memory management functions. `better-sqlite3` does it the JavaScript way, allowing the garbage collector to worry about memory management.
+- `better-sqlite3` is simpler to use, and it provides nice utilities for some operations that are very difficult or impossible in `node-sqlite3`.
+- `better-sqlite3` is much faster than `node-sqlite3` in most cases, and just as fast in all other cases.
+
+#### When is this library not appropriate?
+
+In most cases, if you're attempting something that cannot be reasonably accomplished with `better-sqlite3`, it probably cannot be reasonably accomplished with SQLite in general. For example, if you're executing queries that take one second to complete, and you expect to have many concurrent users executing those queries, no amount of asynchronicity will save you from SQLite's serialized nature. Fortunately, SQLite is very *very* fast. With proper indexing, we've been able to achieve upward of 2000 queries per second with 5-way-joins in a 60 GB database, where each query was handling 5–50 kilobytes of real data.
+
+If you have a performance problem, the most likely causes are inefficient queries, improper indexing, or a lack of [WAL mode](./docs/performance.md)—not `better-sqlite3` itself. However, there are some cases where `better-sqlite3` could be inappropriate:
+
+- If you expect a high volume of concurrent reads each returning many megabytes of data (i.e., videos)
+- If you expect a high volume of concurrent writes (i.e., a social media site)
+- If your database's size is near the terabyte range
+
+For these situations, you should probably use a full-fledged RDBMS such as [PostgreSQL](https://www.postgresql.org/).
+
+## Upgrading
+
+Upgrading your `better-sqlite3` dependency can potentially introduce breaking changes, either in the `better-sqlite3` API (if you upgrade to a new [major version](https://semver.org/)), or between your existing database(s) and the underlying version of SQLite. Before upgrading, review:
+
+* [`better-sqlite3` release notes](https://github.com/WiseLibs/better-sqlite3/releases)
+* [SQLite release history](https://www.sqlite.org/changes.html)
+
+# Documentation
+
+- [API documentation](./docs/api.md)
+- [Performance](./docs/performance.md) (also see [benchmark results](./docs/benchmark.md))
+- [64-bit integer support](./docs/integer.md)
+- [Worker thread support](./docs/threads.md)
+- [Unsafe mode (advanced)](./docs/unsafe.md)
+- [SQLite compilation (advanced)](./docs/compilation.md)
+- [Contribution rules](./docs/contribution.md)
+- [Code of conduct](./docs/conduct.md)
+
+# License
+
+[MIT](./LICENSE)

package/node_modules/better-sqlite3/binding.gyp

@@ -0,0 +1,38 @@
+# ===
+# This is the main GYP file, which builds better-sqlite3 with SQLite itself.
+# ===
+
+{
+  'includes': ['deps/common.gypi'],
+  'targets': [
+    {
+      'target_name': 'better_sqlite3',
+      'dependencies': ['deps/sqlite3.gyp:sqlite3'],
+      'sources': ['src/better_sqlite3.cpp'],
+      'cflags_cc': ['-std=c++20'],
+      'xcode_settings': {
+        'OTHER_CPLUSPLUSFLAGS': ['-std=c++20', '-stdlib=libc++'],
+      },
+      'msvs_settings': {
+        'VCCLCompilerTool': {
+          'AdditionalOptions': [
+            '/std:c++20',
+          ],
+        },
+      },
+      'conditions': [
+        ['OS=="linux"', {
+          'ldflags': [
+            '-Wl,-Bsymbolic',
+            '-Wl,--exclude-libs,ALL',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'test_extension',
+      'dependencies': ['deps/sqlite3.gyp:sqlite3'],
+      'conditions': [['sqlite3 == ""', { 'sources': ['deps/test_extension.c'] }]],
+    },
+  ],
+}

package/node_modules/better-sqlite3/deps/common.gypi

@@ -0,0 +1,68 @@
+# ===
+# This configuration defines the differences between Release and Debug builds.
+# Some miscellaneous Windows settings are also defined here.
+# ===
+
+{
+  'variables': { 'sqlite3%': '' },
+  'target_defaults': {
+    'default_configuration': 'Release',
+    'msvs_settings': {
+      'VCCLCompilerTool': {
+        'ExceptionHandling': 1,
+      },
+    },
+    'conditions': [
+      ['OS == "win"', {
+        'defines': ['WIN32'],
+      }],
+    ],
+    'configurations': {
+      'Debug': {
+        'defines!': [
+          'NDEBUG',
+        ],
+        'defines': [
+          'DEBUG',
+          '_DEBUG',
+          'SQLITE_DEBUG',
+          'SQLITE_MEMDEBUG',
+          'SQLITE_ENABLE_API_ARMOR',
+          'SQLITE_WIN32_MALLOC_VALIDATE',
+        ],
+        'cflags': [
+          '-O0',
+        ],
+        'xcode_settings': {
+          'MACOSX_DEPLOYMENT_TARGET': '10.7',
+          'GCC_OPTIMIZATION_LEVEL': '0',
+          'GCC_GENERATE_DEBUGGING_SYMBOLS': 'YES',
+        },
+        'msvs_settings': {
+          'VCLinkerTool': {
+            'GenerateDebugInformation': 'true',
+          },
+        },
+      },
+      'Release': {
+        'defines!': [
+          'DEBUG',
+          '_DEBUG',
+        ],
+        'defines': [
+          'NDEBUG',
+        ],
+        'cflags': [
+          '-O3',
+        ],
+        'xcode_settings': {
+          'MACOSX_DEPLOYMENT_TARGET': '10.7',
+          'GCC_OPTIMIZATION_LEVEL': '3',
+          'GCC_GENERATE_DEBUGGING_SYMBOLS': 'NO',
+          'DEAD_CODE_STRIPPING': 'YES',
+          'GCC_INLINES_ARE_PRIVATE_EXTERN': 'YES',
+        },
+      },
+    },
+  },
+}

package/node_modules/better-sqlite3/deps/copy.js

@@ -0,0 +1,31 @@
+'use strict';
+const path = require('path');
+const fs = require('fs');
+
+const dest = process.argv[2];
+const source = path.resolve(path.sep, process.argv[3] || path.join(__dirname, 'sqlite3'));
+const files = [
+	{ filename: 'sqlite3.c', optional: false },
+	{ filename: 'sqlite3.h', optional: false },
+];
+
+if (process.argv[3]) {
+	// Support "_HAVE_SQLITE_CONFIG_H" in custom builds.
+	files.push({ filename: 'config.h', optional: true });
+} else {
+	// Required for some tests.
+	files.push({ filename: 'sqlite3ext.h', optional: false });
+}
+
+for (const { filename, optional } of files) {
+	const sourceFilepath = path.join(source, filename);
+	const destFilepath = path.join(dest, filename);
+
+	if (optional && !fs.existsSync(sourceFilepath)) {
+		continue;
+	}
+
+	fs.accessSync(sourceFilepath);
+	fs.mkdirSync(path.dirname(destFilepath), { recursive: true });
+	fs.copyFileSync(sourceFilepath, destFilepath);
+}

package/node_modules/better-sqlite3/deps/defines.gypi

@@ -0,0 +1,41 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY deps/download.sh (DO NOT EDIT)
+
+{
+  'defines': [
+    'HAVE_INT16_T=1',
+    'HAVE_INT32_T=1',
+    'HAVE_INT8_T=1',
+    'HAVE_STDINT_H=1',
+    'HAVE_UINT16_T=1',
+    'HAVE_UINT32_T=1',
+    'HAVE_UINT8_T=1',
+    'HAVE_USLEEP=1',
+    'SQLITE_DEFAULT_CACHE_SIZE=-16000',
+    'SQLITE_DEFAULT_FOREIGN_KEYS=1',
+    'SQLITE_DEFAULT_MEMSTATUS=0',
+    'SQLITE_DEFAULT_WAL_SYNCHRONOUS=1',
+    'SQLITE_DQS=0',
+    'SQLITE_ENABLE_COLUMN_METADATA',
+    'SQLITE_ENABLE_DBSTAT_VTAB',
+    'SQLITE_ENABLE_DESERIALIZE',
+    'SQLITE_ENABLE_FTS3',
+    'SQLITE_ENABLE_FTS3_PARENTHESIS',
+    'SQLITE_ENABLE_FTS4',
+    'SQLITE_ENABLE_FTS5',
+    'SQLITE_ENABLE_GEOPOLY',
+    'SQLITE_ENABLE_JSON1',
+    'SQLITE_ENABLE_MATH_FUNCTIONS',
+    'SQLITE_ENABLE_RTREE',
+    'SQLITE_ENABLE_STAT4',
+    'SQLITE_ENABLE_UPDATE_DELETE_LIMIT',
+    'SQLITE_LIKE_DOESNT_MATCH_BLOBS',
+    'SQLITE_OMIT_DEPRECATED',
+    'SQLITE_OMIT_PROGRESS_CALLBACK',
+    'SQLITE_OMIT_SHARED_CACHE',
+    'SQLITE_OMIT_TCL_VARIABLE',
+    'SQLITE_SOUNDEX',
+    'SQLITE_THREADSAFE=2',
+    'SQLITE_TRACE_SIZE_LIMIT=32',
+    'SQLITE_USE_URI=0',
+  ],
+}