clawdlets 0.0.1 → 0.2.0

package/dist/commands/image.js

@@ -0,0 +1,133 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { defineCommand } from "citty";
+import { resolveGitRev } from "@clawdlets/core/lib/git";
+import { capture, run } from "@clawdlets/core/lib/run";
+import { withFlakesEnv } from "@clawdlets/core/lib/nix-flakes";
+import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
+import { loadHostContextOrExit } from "../lib/context.js";
+async function buildRawImage(params) {
+    if (process.platform !== "linux") {
+        throw new Error("image build requires Linux; run in CI or a Linux builder");
+    }
+    const attr = `.#packages.x86_64-linux.${params.host}-image`;
+    const out = await capture(params.nixBin, ["build", "--json", "--no-link", attr], {
+        cwd: params.repoRoot,
+        env: withFlakesEnv(process.env),
+    });
+    let parsed;
+    try {
+        parsed = JSON.parse(out);
+    }
+    catch (e) {
+        throw new Error(`nix build --json returned invalid JSON (${String(e?.message || e)})`);
+    }
+    const imagePath = parsed?.[0]?.outputs?.out;
+    if (!imagePath || typeof imagePath !== "string") {
+        throw new Error("nix build did not return an image store path");
+    }
+    if (!fs.existsSync(imagePath))
+        throw new Error(`image path missing: ${imagePath}`);
+    return imagePath;
+}
+const imageBuild = defineCommand({
+    meta: {
+        name: "build",
+        description: "Build a raw NixOS image for a host (nixos-generators).",
+    },
+    args: {
+        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
+        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
+        rev: { type: "string", description: "Git rev to name the image (HEAD/sha/tag).", default: "HEAD" },
+        out: { type: "string", description: "Output path (default: .clawdlets/images/<host>/clawdlets-<host>-<rev>.raw)." },
+        nixBin: { type: "string", description: "Override nix binary (default: nix)." },
+    },
+    async run({ args }) {
+        const cwd = process.cwd();
+        const ctx = loadHostContextOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
+        if (!ctx)
+            return;
+        const { repoRoot, layout, hostName } = ctx;
+        const revRaw = String(args.rev || "").trim() || "HEAD";
+        const resolved = await resolveGitRev(repoRoot, revRaw);
+        if (!resolved)
+            throw new Error(`unable to resolve git rev: ${revRaw}`);
+        const nixBin = String(args.nixBin || process.env.NIX_BIN || "nix").trim() || "nix";
+        const imagePath = await buildRawImage({ repoRoot, nixBin, host: hostName });
+        const outRaw = String(args.out || "").trim();
+        const outPath = outRaw
+            ? (path.isAbsolute(outRaw) ? outRaw : path.resolve(cwd, outRaw))
+            : path.join(layout.runtimeDir, "images", hostName, `clawdlets-${hostName}-${resolved}.raw`);
+        fs.mkdirSync(path.dirname(outPath), { recursive: true });
+        fs.copyFileSync(imagePath, outPath);
+        console.log(`ok: built raw image ${outPath}`);
+    },
+});
+const imageUpload = defineCommand({
+    meta: {
+        name: "upload",
+        description: "Upload a raw image to Hetzner using hcloud-upload-image.",
+    },
+    args: {
+        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
+        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
+        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
+        "image-url": { type: "string", description: "Public URL for the raw image (Hetzner must reach it)." },
+        compression: { type: "string", description: "Compression type (none|gz|bz2|xz).", default: "none" },
+        architecture: { type: "string", description: "Architecture (x86 or arm).", default: "x86" },
+        location: { type: "string", description: "Hetzner location (default: host hetzner.location)." },
+        name: { type: "string", description: "Image name override (optional)." },
+        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
+        bin: { type: "string", description: "Override hcloud-upload-image binary (default: hcloud-upload-image)." },
+    },
+    async run({ args }) {
+        const cwd = process.cwd();
+        const ctx = loadHostContextOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
+        if (!ctx)
+            return;
+        const { hostName, hostCfg } = ctx;
+        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
+        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
+        if (!hcloudToken)
+            throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
+        const imageUrl = String(args["image-url"] || "").trim();
+        if (!imageUrl)
+            throw new Error("missing --image-url");
+        const compression = String(args.compression || "").trim();
+        const compressionArg = compression === "none" ? "" : compression;
+        if (compressionArg && !["gz", "bz2", "xz"].includes(compressionArg)) {
+            throw new Error("invalid --compression (expected none|gz|bz2|xz)");
+        }
+        const architecture = String(args.architecture || "").trim() || "x86";
+        if (!["x86", "arm"].includes(architecture)) {
+            throw new Error("invalid --architecture (expected x86|arm)");
+        }
+        const location = String(args.location || hostCfg.hetzner.location || "nbg1").trim() || "nbg1";
+        const name = String(args.name || "").trim();
+        const bin = String(args.bin || "hcloud-upload-image").trim() || "hcloud-upload-image";
+        const cmd = ["upload", "--image-url", imageUrl, "--architecture", architecture, "--location", location];
+        if (compressionArg)
+            cmd.push("--compression", compressionArg);
+        if (name)
+            cmd.push("--name", name);
+        await run(bin, cmd, {
+            env: { ...process.env, HCLOUD_TOKEN: hcloudToken },
+            dryRun: args.dryRun,
+            redact: [hcloudToken],
+        });
+        console.log(`ok: upload complete for ${hostName}`);
+        console.log(`hint: set hetzner.image in fleet/clawdlets.json to the new image ID/name`);
+    },
+});
+export const image = defineCommand({
+    meta: {
+        name: "image",
+        description: "Image build/upload helpers (Hetzner custom images).",
+    },
+    subCommands: {
+        build: imageBuild,
+        upload: imageUpload,
+    },
+});
+//# sourceMappingURL=image.js.map

package/dist/commands/image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../src/commands/image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,KAAK,UAAU,aAAa,CAAC,MAA0D;IACrF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,2BAA2B,MAAM,CAAC,IAAI,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE;QAC/E,GAAG,EAAE,MAAM,CAAC,QAAQ;QACpB,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAE,CAAW,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAI,MAAc,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,wDAAwD;KACtE;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE,OAAO,EAAE,MAAM,EAAE;QAClG,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6EAA6E,EAAE;QACnH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;KAC/E;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC;QACnF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,QAAQ,IAAI,QAAQ,MAAM,CAAC,CAAC;QAE9F,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,aAAa,CAAC;IAChC,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0DAA0D;KACxE;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;QACrG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE,OAAO,EAAE,MAAM,EAAE;QACnG,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC/F,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;QACxE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7F,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qEAAqE,EAAE;KAC5G;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAElC,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAEtH,MAAM,QAAQ,GAAG,MAAM,CAAE,IAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,cAAc,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACjE,IAAI,cAAc,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC;QACrE,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;QAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,IAAI,qBAAqB,CAAC;QAEtF,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACxG,IAAI,cAAc;YAAE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YAClB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE;YAClD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,WAAW,CAAC;SACtB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qDAAqD;KACnE;IACD,WAAW,EAAE;QACX,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,WAAW;KACpB;CACF,CAAC,CAAC"}

package/dist/commands/infra.d.ts

@@ -0,0 +1,2 @@
+export declare const infra: import("citty").CommandDef<import("citty").ArgsDef>;
+//# sourceMappingURL=infra.d.ts.map

package/dist/commands/infra.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../../src/commands/infra.ts"],"names":[],"mappings":"AA+JA,eAAO,MAAM,KAAK,qDAShB,CAAC"}

package/dist/commands/infra.js

@@ -0,0 +1,171 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { defineCommand } from "citty";
+import * as p from "@clack/prompts";
+import { applyOpenTofuVars, destroyOpenTofuVars } from "@clawdlets/core/lib/opentofu";
+import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
+import { expandPath } from "@clawdlets/core/lib/path-expand";
+import { findRepoRoot } from "@clawdlets/core/lib/repo";
+import { getSshExposureMode, getTailnetMode, loadClawdletsConfig } from "@clawdlets/core/lib/clawdlets-config";
+import { getHostOpenTofuDir } from "@clawdlets/core/repo-layout";
+import { resolveHostNameOrExit } from "../lib/host-resolve.js";
+const infraApply = defineCommand({
+    meta: {
+        name: "apply",
+        description: "Apply Hetzner OpenTofu for a host (driven by fleet/clawdlets.json).",
+    },
+    args: {
+        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
+        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
+        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
+        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
+    },
+    async run({ args }) {
+        const cwd = process.cwd();
+        const repoRoot = findRepoRoot(cwd);
+        const hostName = resolveHostNameOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
+        if (!hostName)
+            return;
+        const { layout, config: clawdletsConfig } = loadClawdletsConfig({ repoRoot, runtimeDir: args.runtimeDir });
+        const hostCfg = clawdletsConfig.hosts[hostName];
+        if (!hostCfg)
+            throw new Error(`missing host in fleet/clawdlets.json: ${hostName}`);
+        const opentofuDir = getHostOpenTofuDir(layout, hostName);
+        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
+        if (deployCreds.envFile?.status === "invalid")
+            throw new Error(`deploy env file rejected: ${deployCreds.envFile.path} (${deployCreds.envFile.error || "invalid"})`);
+        if (deployCreds.envFile?.status === "missing")
+            throw new Error(`missing deploy env file: ${deployCreds.envFile.path}`);
+        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
+        if (!hcloudToken)
+            throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
+        const adminCidr = String(hostCfg.provisioning.adminCidr || "").trim();
+        if (!adminCidr)
+            throw new Error(`missing provisioning.adminCidr for ${hostName} (set via: clawdlets host set --admin-cidr ...)`);
+        const sshPubkeyFileRaw = String(hostCfg.provisioning.sshPubkeyFile || "").trim();
+        if (!sshPubkeyFileRaw)
+            throw new Error(`missing provisioning.sshPubkeyFile for ${hostName} (set via: clawdlets host set --ssh-pubkey-file ...)`);
+        const sshPubkeyFileExpanded = expandPath(sshPubkeyFileRaw);
+        const sshPubkeyFile = path.isAbsolute(sshPubkeyFileExpanded)
+            ? sshPubkeyFileExpanded
+            : path.resolve(repoRoot, sshPubkeyFileExpanded);
+        if (!fs.existsSync(sshPubkeyFile))
+            throw new Error(`ssh pubkey file not found: ${sshPubkeyFile}`);
+        const image = String(hostCfg.hetzner.image || "").trim();
+        const location = String(hostCfg.hetzner.location || "").trim();
+        await applyOpenTofuVars({
+            opentofuDir,
+            vars: {
+                hostName,
+                hcloudToken,
+                adminCidr,
+                adminCidrIsWorldOpen: Boolean(hostCfg.provisioning.adminCidrAllowWorldOpen),
+                sshPubkeyFile,
+                serverType: hostCfg.hetzner.serverType,
+                image,
+                location,
+                sshExposureMode: getSshExposureMode(hostCfg),
+                tailnetMode: getTailnetMode(hostCfg),
+            },
+            nixBin: String(deployCreds.values.NIX_BIN || "nix").trim() || "nix",
+            dryRun: args.dryRun,
+            redact: [hcloudToken, deployCreds.values.GITHUB_TOKEN].filter(Boolean),
+        });
+        console.log(`ok: provisioning applied for ${hostName}`);
+        console.log(`hint: outputs in ${opentofuDir}`);
+    },
+});
+const infraDestroy = defineCommand({
+    meta: {
+        name: "destroy",
+        description: "Destroy Hetzner OpenTofu resources for a host (DANGEROUS).",
+    },
+    args: {
+        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
+        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
+        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
+        force: { type: "boolean", description: "Skip confirmation prompt (non-interactive).", default: false },
+        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
+    },
+    async run({ args }) {
+        const cwd = process.cwd();
+        const repoRoot = findRepoRoot(cwd);
+        const hostName = resolveHostNameOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
+        if (!hostName)
+            return;
+        const { layout, config: clawdletsConfig } = loadClawdletsConfig({ repoRoot, runtimeDir: args.runtimeDir });
+        const hostCfg = clawdletsConfig.hosts[hostName];
+        if (!hostCfg)
+            throw new Error(`missing host in fleet/clawdlets.json: ${hostName}`);
+        const opentofuDir = getHostOpenTofuDir(layout, hostName);
+        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
+        if (deployCreds.envFile?.status === "invalid")
+            throw new Error(`deploy env file rejected: ${deployCreds.envFile.path} (${deployCreds.envFile.error || "invalid"})`);
+        if (deployCreds.envFile?.status === "missing")
+            throw new Error(`missing deploy env file: ${deployCreds.envFile.path}`);
+        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
+        if (!hcloudToken)
+            throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
+        const adminCidr = String(hostCfg.provisioning.adminCidr || "").trim();
+        if (!adminCidr)
+            throw new Error(`missing provisioning.adminCidr for ${hostName} (set via: clawdlets host set --admin-cidr ...)`);
+        const sshPubkeyFileRaw = String(hostCfg.provisioning.sshPubkeyFile || "").trim();
+        if (!sshPubkeyFileRaw)
+            throw new Error(`missing provisioning.sshPubkeyFile for ${hostName} (set via: clawdlets host set --ssh-pubkey-file ...)`);
+        const sshPubkeyFileExpanded = expandPath(sshPubkeyFileRaw);
+        const sshPubkeyFile = path.isAbsolute(sshPubkeyFileExpanded)
+            ? sshPubkeyFileExpanded
+            : path.resolve(repoRoot, sshPubkeyFileExpanded);
+        if (!fs.existsSync(sshPubkeyFile))
+            throw new Error(`ssh pubkey file not found: ${sshPubkeyFile}`);
+        const image = String(hostCfg.hetzner.image || "").trim();
+        const location = String(hostCfg.hetzner.location || "").trim();
+        const force = Boolean(args.force);
+        const interactive = process.stdin.isTTY && process.stdout.isTTY;
+        if (!force) {
+            if (!interactive)
+                throw new Error("refusing to destroy without --force (no TTY)");
+            p.intro("clawdlets infra destroy");
+            const ok = await p.confirm({
+                message: `Destroy Hetzner resources for host ${hostName}?`,
+                initialValue: false,
+            });
+            if (p.isCancel(ok) || !ok) {
+                p.cancel("canceled");
+                return;
+            }
+        }
+        await destroyOpenTofuVars({
+            opentofuDir,
+            vars: {
+                hostName,
+                hcloudToken,
+                adminCidr,
+                adminCidrIsWorldOpen: Boolean(hostCfg.provisioning.adminCidrAllowWorldOpen),
+                sshPubkeyFile,
+                serverType: hostCfg.hetzner.serverType,
+                image,
+                location,
+                sshExposureMode: getSshExposureMode(hostCfg),
+                tailnetMode: getTailnetMode(hostCfg),
+            },
+            nixBin: String(deployCreds.values.NIX_BIN || "nix").trim() || "nix",
+            dryRun: args.dryRun,
+            redact: [hcloudToken, deployCreds.values.GITHUB_TOKEN].filter(Boolean),
+        });
+        console.log(`ok: provisioning destroyed for ${hostName}`);
+        console.log(`hint: state in ${opentofuDir}`);
+    },
+});
+export const infra = defineCommand({
+    meta: {
+        name: "infra",
+        description: "Infrastructure operations (Hetzner OpenTofu).",
+    },
+    subCommands: {
+        apply: infraApply,
+        destroy: infraDestroy,
+    },
+});
+//# sourceMappingURL=infra.js.map

package/dist/commands/infra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra.js","sourceRoot":"","sources":["../../src/commands/infra.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,UAAU,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qEAAqE;KACnF;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9F;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACpK,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAEtH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,iDAAiD,CAAC,CAAC;QAEjI,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,sDAAsD,CAAC,CAAC;QACjJ,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/D,MAAM,iBAAiB,CAAC;YACtB,WAAW;YACX,IAAI,EAAE;gBACJ,QAAQ;gBACR,WAAW;gBACX,SAAS;gBACT,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;gBAC3E,aAAa;gBACb,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;gBACtC,KAAK;gBACL,QAAQ;gBACR,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC;gBAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;aACrC;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;SACnF,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,oBAAoB,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,aAAa,CAAC;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,4DAA4D;KAC1E;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6CAA6C,EAAE,OAAO,EAAE,KAAK,EAAE;QACtG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9F;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACpK,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAEtH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,iDAAiD,CAAC,CAAC;QAEjI,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,sDAAsD,CAAC,CAAC;QACjJ,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/D,MAAM,KAAK,GAAG,OAAO,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClF,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;gBACzB,OAAO,EAAE,sCAAsC,QAAQ,GAAG;gBAC1D,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,mBAAmB,CAAC;YACxB,WAAW;YACX,IAAI,EAAE;gBACJ,QAAQ;gBACR,WAAW;gBACX,SAAS;gBACT,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;gBAC3E,aAAa;gBACb,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;gBACtC,KAAK;gBACL,QAAQ;gBACR,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC;gBAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;aACrC;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;SACnF,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,+CAA+C;KAC7D;IACD,WAAW,EAAE;QACX,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,YAAY;KACtB;CACF,CAAC,CAAC"}

package/dist/commands/lockdown.d.ts

@@ -0,0 +1,25 @@
+export declare const lockdown: import("citty").CommandDef<{
+    runtimeDir: {
+        type: "string";
+        description: string;
+    };
+    envFile: {
+        type: "string";
+        description: string;
+    };
+    host: {
+        type: "string";
+        description: string;
+    };
+    skipTofu: {
+        type: "boolean";
+        description: string;
+        default: false;
+    };
+    dryRun: {
+        type: "boolean";
+        description: string;
+        default: false;
+    };
+}>;
+//# sourceMappingURL=lockdown.d.ts.map

package/dist/commands/lockdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockdown.d.ts","sourceRoot":"","sources":["../../src/commands/lockdown.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;EA6EnB,CAAC"}

package/dist/commands/lockdown.js

@@ -0,0 +1,93 @@
+import fs from "node:fs";
+import process from "node:process";
+import path from "node:path";
+import { defineCommand } from "citty";
+import { applyOpenTofuVars } from "@clawdlets/core/lib/opentofu";
+import { expandPath } from "@clawdlets/core/lib/path-expand";
+import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
+import { findRepoRoot } from "@clawdlets/core/lib/repo";
+import { getSshExposureMode, getTailnetMode, loadClawdletsConfig } from "@clawdlets/core/lib/clawdlets-config";
+import { getHostOpenTofuDir } from "@clawdlets/core/repo-layout";
+import { requireDeployGate } from "../lib/deploy-gate.js";
+import { resolveHostNameOrExit } from "../lib/host-resolve.js";
+export const lockdown = defineCommand({
+    meta: {
+        name: "lockdown",
+        description: "Remove public SSH from Hetzner firewall (OpenTofu only).",
+    },
+    args: {
+        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
+        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
+        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
+        skipTofu: { type: "boolean", description: "Skip provisioning apply.", default: false },
+        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
+    },
+    async run({ args }) {
+        const cwd = process.cwd();
+        const repoRoot = findRepoRoot(cwd);
+        const hostName = resolveHostNameOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
+        if (!hostName)
+            return;
+        const { layout, config: clawdletsConfig } = loadClawdletsConfig({ repoRoot, runtimeDir: args.runtimeDir });
+        const hostCfg = clawdletsConfig.hosts[hostName];
+        if (!hostCfg)
+            throw new Error(`missing host in fleet/clawdlets.json: ${hostName}`);
+        const opentofuDir = getHostOpenTofuDir(layout, hostName);
+        const sshExposureMode = getSshExposureMode(hostCfg);
+        if (sshExposureMode !== "tailnet") {
+            throw new Error(`sshExposure.mode=${sshExposureMode}; set sshExposure.mode=tailnet before lockdown (clawdlets host set --host ${hostName} --ssh-exposure tailnet)`);
+        }
+        await requireDeployGate({
+            runtimeDir: args.runtimeDir,
+            envFile: args.envFile,
+            host: hostName,
+            scope: "server-deploy",
+            strict: true,
+            skipGithubTokenCheck: true,
+        });
+        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
+        if (deployCreds.envFile?.status === "invalid")
+            throw new Error(`deploy env file rejected: ${deployCreds.envFile.path} (${deployCreds.envFile.error || "invalid"})`);
+        if (deployCreds.envFile?.status === "missing")
+            throw new Error(`missing deploy env file: ${deployCreds.envFile.path}`);
+        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
+        const githubToken = String(deployCreds.values.GITHUB_TOKEN || "").trim();
+        if (!args.skipTofu) {
+            if (!hcloudToken)
+                throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
+            const adminCidr = String(hostCfg.provisioning.adminCidr || "").trim();
+            if (!adminCidr)
+                throw new Error(`missing provisioning.adminCidr for ${hostName} (set via: clawdlets host set --admin-cidr ...)`);
+            const sshPubkeyFileRaw = String(hostCfg.provisioning.sshPubkeyFile || "").trim();
+            if (!sshPubkeyFileRaw)
+                throw new Error(`missing provisioning.sshPubkeyFile for ${hostName} (set via: clawdlets host set --ssh-pubkey-file ...)`);
+            const sshPubkeyFileExpanded = expandPath(sshPubkeyFileRaw);
+            const sshPubkeyFile = path.isAbsolute(sshPubkeyFileExpanded)
+                ? sshPubkeyFileExpanded
+                : path.resolve(repoRoot, sshPubkeyFileExpanded);
+            if (!fs.existsSync(sshPubkeyFile))
+                throw new Error(`ssh pubkey file not found: ${sshPubkeyFile}`);
+            const image = String(hostCfg.hetzner.image || "").trim();
+            const location = String(hostCfg.hetzner.location || "").trim();
+            await applyOpenTofuVars({
+                opentofuDir,
+                vars: {
+                    hostName,
+                    hcloudToken,
+                    adminCidr,
+                    adminCidrIsWorldOpen: Boolean(hostCfg.provisioning.adminCidrAllowWorldOpen),
+                    sshPubkeyFile,
+                    serverType: hostCfg.hetzner.serverType,
+                    image,
+                    location,
+                    sshExposureMode,
+                    tailnetMode: getTailnetMode(hostCfg),
+                },
+                nixBin: String(deployCreds.values.NIX_BIN || "nix").trim() || "nix",
+                dryRun: args.dryRun,
+                redact: [hcloudToken, githubToken].filter(Boolean),
+            });
+        }
+    },
+});
+//# sourceMappingURL=lockdown.js.map

package/dist/commands/lockdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockdown.js","sourceRoot":"","sources":["../../src/commands/lockdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IACpC,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,0DAA0D;KACxE;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE;QACtF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9F;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,eAAe,6EAA6E,QAAQ,0BAA0B,CAAC,CAAC;QACtK,CAAC;QAED,MAAM,iBAAiB,CAAC;YACtB,UAAU,EAAG,IAAY,CAAC,UAAU;YACpC,OAAO,EAAG,IAAY,CAAC,OAAO;YAC9B,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,IAAI;YACZ,oBAAoB,EAAE,IAAI;SAC3B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACpK,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAEtH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,iDAAiD,CAAC,CAAC;YAEnI,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjF,IAAI,CAAC,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,sDAAsD,CAAC,CAAC;YACjJ,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBAC1D,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;YAChG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,iBAAiB,CAAC;gBACtB,WAAW;gBACX,IAAI,EAAE;oBACJ,QAAQ;oBACR,WAAW;oBACX,SAAS;oBACT,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;oBAC3E,aAAa;oBACb,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;oBACtC,KAAK;oBACL,QAAQ;oBACR,eAAe;oBACf,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;iBACrC;gBACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;gBACnE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/commands/project.d.ts

@@ -0,0 +1,2 @@
+export declare const project: import("citty").CommandDef<import("citty").ArgsDef>;
+//# sourceMappingURL=project.d.ts.map

package/dist/commands/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../src/commands/project.ts"],"names":[],"mappings":"AAgRA,eAAO,MAAM,OAAO,qDAGlB,CAAC"}