clawdlets 0.2.2 → 0.2.4

package/dist/commands/image.js

@@ -1,133 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { defineCommand } from "citty";
-import { resolveGitRev } from "@clawdlets/core/lib/git";
-import { capture, run } from "@clawdlets/core/lib/run";
-import { withFlakesEnv } from "@clawdlets/core/lib/nix-flakes";
-import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
-import { loadHostContextOrExit } from "../lib/context.js";
-async function buildRawImage(params) {
-    if (process.platform !== "linux") {
-        throw new Error("image build requires Linux; run in CI or a Linux builder");
-    }
-    const attr = `.#packages.x86_64-linux.${params.host}-image`;
-    const out = await capture(params.nixBin, ["build", "--json", "--no-link", attr], {
-        cwd: params.repoRoot,
-        env: withFlakesEnv(process.env),
-    });
-    let parsed;
-    try {
-        parsed = JSON.parse(out);
-    }
-    catch (e) {
-        throw new Error(`nix build --json returned invalid JSON (${String(e?.message || e)})`);
-    }
-    const imagePath = parsed?.[0]?.outputs?.out;
-    if (!imagePath || typeof imagePath !== "string") {
-        throw new Error("nix build did not return an image store path");
-    }
-    if (!fs.existsSync(imagePath))
-        throw new Error(`image path missing: ${imagePath}`);
-    return imagePath;
-}
-const imageBuild = defineCommand({
-    meta: {
-        name: "build",
-        description: "Build a raw NixOS image for a host (nixos-generators).",
-    },
-    args: {
-        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
-        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
-        rev: { type: "string", description: "Git rev to name the image (HEAD/sha/tag).", default: "HEAD" },
-        out: { type: "string", description: "Output path (default: .clawdlets/images/<host>/clawdlets-<host>-<rev>.raw)." },
-        nixBin: { type: "string", description: "Override nix binary (default: nix)." },
-    },
-    async run({ args }) {
-        const cwd = process.cwd();
-        const ctx = loadHostContextOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
-        if (!ctx)
-            return;
-        const { repoRoot, layout, hostName } = ctx;
-        const revRaw = String(args.rev || "").trim() || "HEAD";
-        const resolved = await resolveGitRev(repoRoot, revRaw);
-        if (!resolved)
-            throw new Error(`unable to resolve git rev: ${revRaw}`);
-        const nixBin = String(args.nixBin || process.env.NIX_BIN || "nix").trim() || "nix";
-        const imagePath = await buildRawImage({ repoRoot, nixBin, host: hostName });
-        const outRaw = String(args.out || "").trim();
-        const outPath = outRaw
-            ? (path.isAbsolute(outRaw) ? outRaw : path.resolve(cwd, outRaw))
-            : path.join(layout.runtimeDir, "images", hostName, `clawdlets-${hostName}-${resolved}.raw`);
-        fs.mkdirSync(path.dirname(outPath), { recursive: true });
-        fs.copyFileSync(imagePath, outPath);
-        console.log(`ok: built raw image ${outPath}`);
-    },
-});
-const imageUpload = defineCommand({
-    meta: {
-        name: "upload",
-        description: "Upload a raw image to Hetzner using hcloud-upload-image.",
-    },
-    args: {
-        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
-        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
-        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
-        "image-url": { type: "string", description: "Public URL for the raw image (Hetzner must reach it)." },
-        compression: { type: "string", description: "Compression type (none|gz|bz2|xz).", default: "none" },
-        architecture: { type: "string", description: "Architecture (x86 or arm).", default: "x86" },
-        location: { type: "string", description: "Hetzner location (default: host hetzner.location)." },
-        name: { type: "string", description: "Image name override (optional)." },
-        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
-        bin: { type: "string", description: "Override hcloud-upload-image binary (default: hcloud-upload-image)." },
-    },
-    async run({ args }) {
-        const cwd = process.cwd();
-        const ctx = loadHostContextOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
-        if (!ctx)
-            return;
-        const { hostName, hostCfg } = ctx;
-        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
-        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
-        if (!hcloudToken)
-            throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
-        const imageUrl = String(args["image-url"] || "").trim();
-        if (!imageUrl)
-            throw new Error("missing --image-url");
-        const compression = String(args.compression || "").trim();
-        const compressionArg = compression === "none" ? "" : compression;
-        if (compressionArg && !["gz", "bz2", "xz"].includes(compressionArg)) {
-            throw new Error("invalid --compression (expected none|gz|bz2|xz)");
-        }
-        const architecture = String(args.architecture || "").trim() || "x86";
-        if (!["x86", "arm"].includes(architecture)) {
-            throw new Error("invalid --architecture (expected x86|arm)");
-        }
-        const location = String(args.location || hostCfg.hetzner.location || "nbg1").trim() || "nbg1";
-        const name = String(args.name || "").trim();
-        const bin = String(args.bin || "hcloud-upload-image").trim() || "hcloud-upload-image";
-        const cmd = ["upload", "--image-url", imageUrl, "--architecture", architecture, "--location", location];
-        if (compressionArg)
-            cmd.push("--compression", compressionArg);
-        if (name)
-            cmd.push("--name", name);
-        await run(bin, cmd, {
-            env: { ...process.env, HCLOUD_TOKEN: hcloudToken },
-            dryRun: args.dryRun,
-            redact: [hcloudToken],
-        });
-        console.log(`ok: upload complete for ${hostName}`);
-        console.log(`hint: set hetzner.image in fleet/clawdlets.json to the new image ID/name`);
-    },
-});
-export const image = defineCommand({
-    meta: {
-        name: "image",
-        description: "Image build/upload helpers (Hetzner custom images).",
-    },
-    subCommands: {
-        build: imageBuild,
-        upload: imageUpload,
-    },
-});
-//# sourceMappingURL=image.js.map

package/dist/commands/image.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../../src/commands/image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,KAAK,UAAU,aAAa,CAAC,MAA0D;IACrF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,2BAA2B,MAAM,CAAC,IAAI,QAAQ,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE;QAC/E,GAAG,EAAE,MAAM,CAAC,QAAQ;QACpB,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAE,CAAW,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAI,MAAc,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,wDAAwD;KACtE;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2CAA2C,EAAE,OAAO,EAAE,MAAM,EAAE;QAClG,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6EAA6E,EAAE;QACnH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;KAC/E;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC;QACnF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,QAAQ,IAAI,QAAQ,MAAM,CAAC,CAAC;QAE9F,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,aAAa,CAAC;IAChC,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0DAA0D;KACxE;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;QACrG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE,OAAO,EAAE,MAAM,EAAE;QACnG,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC/F,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;QACxE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7F,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qEAAqE,EAAE;KAC5G;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAElC,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAEtH,MAAM,QAAQ,GAAG,MAAM,CAAE,IAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,cAAc,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACjE,IAAI,cAAc,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC;QACrE,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;QAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,IAAI,qBAAqB,CAAC;QAEtF,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACxG,IAAI,cAAc;YAAE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YAClB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE;YAClD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,WAAW,CAAC;SACtB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qDAAqD;KACnE;IACD,WAAW,EAAE;QACX,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,WAAW;KACpB;CACF,CAAC,CAAC"}

package/dist/commands/infra.d.ts

@@ -1,2 +0,0 @@
-export declare const infra: import("citty").CommandDef<import("citty").ArgsDef>;
-//# sourceMappingURL=infra.d.ts.map

package/dist/commands/infra.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../../src/commands/infra.ts"],"names":[],"mappings":"AA+JA,eAAO,MAAM,KAAK,qDAShB,CAAC"}

package/dist/commands/infra.js

@@ -1,171 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { defineCommand } from "citty";
-import * as p from "@clack/prompts";
-import { applyOpenTofuVars, destroyOpenTofuVars } from "@clawdlets/core/lib/opentofu";
-import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
-import { expandPath } from "@clawdlets/core/lib/path-expand";
-import { findRepoRoot } from "@clawdlets/core/lib/repo";
-import { getSshExposureMode, getTailnetMode, loadClawdletsConfig } from "@clawdlets/core/lib/clawdlets-config";
-import { getHostOpenTofuDir } from "@clawdlets/core/repo-layout";
-import { resolveHostNameOrExit } from "../lib/host-resolve.js";
-const infraApply = defineCommand({
-    meta: {
-        name: "apply",
-        description: "Apply Hetzner OpenTofu for a host (driven by fleet/clawdlets.json).",
-    },
-    args: {
-        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
-        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
-        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
-        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
-    },
-    async run({ args }) {
-        const cwd = process.cwd();
-        const repoRoot = findRepoRoot(cwd);
-        const hostName = resolveHostNameOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
-        if (!hostName)
-            return;
-        const { layout, config: clawdletsConfig } = loadClawdletsConfig({ repoRoot, runtimeDir: args.runtimeDir });
-        const hostCfg = clawdletsConfig.hosts[hostName];
-        if (!hostCfg)
-            throw new Error(`missing host in fleet/clawdlets.json: ${hostName}`);
-        const opentofuDir = getHostOpenTofuDir(layout, hostName);
-        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
-        if (deployCreds.envFile?.status === "invalid")
-            throw new Error(`deploy env file rejected: ${deployCreds.envFile.path} (${deployCreds.envFile.error || "invalid"})`);
-        if (deployCreds.envFile?.status === "missing")
-            throw new Error(`missing deploy env file: ${deployCreds.envFile.path}`);
-        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
-        if (!hcloudToken)
-            throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
-        const adminCidr = String(hostCfg.provisioning.adminCidr || "").trim();
-        if (!adminCidr)
-            throw new Error(`missing provisioning.adminCidr for ${hostName} (set via: clawdlets host set --admin-cidr ...)`);
-        const sshPubkeyFileRaw = String(hostCfg.provisioning.sshPubkeyFile || "").trim();
-        if (!sshPubkeyFileRaw)
-            throw new Error(`missing provisioning.sshPubkeyFile for ${hostName} (set via: clawdlets host set --ssh-pubkey-file ...)`);
-        const sshPubkeyFileExpanded = expandPath(sshPubkeyFileRaw);
-        const sshPubkeyFile = path.isAbsolute(sshPubkeyFileExpanded)
-            ? sshPubkeyFileExpanded
-            : path.resolve(repoRoot, sshPubkeyFileExpanded);
-        if (!fs.existsSync(sshPubkeyFile))
-            throw new Error(`ssh pubkey file not found: ${sshPubkeyFile}`);
-        const image = String(hostCfg.hetzner.image || "").trim();
-        const location = String(hostCfg.hetzner.location || "").trim();
-        await applyOpenTofuVars({
-            opentofuDir,
-            vars: {
-                hostName,
-                hcloudToken,
-                adminCidr,
-                adminCidrIsWorldOpen: Boolean(hostCfg.provisioning.adminCidrAllowWorldOpen),
-                sshPubkeyFile,
-                serverType: hostCfg.hetzner.serverType,
-                image,
-                location,
-                sshExposureMode: getSshExposureMode(hostCfg),
-                tailnetMode: getTailnetMode(hostCfg),
-            },
-            nixBin: String(deployCreds.values.NIX_BIN || "nix").trim() || "nix",
-            dryRun: args.dryRun,
-            redact: [hcloudToken, deployCreds.values.GITHUB_TOKEN].filter(Boolean),
-        });
-        console.log(`ok: provisioning applied for ${hostName}`);
-        console.log(`hint: outputs in ${opentofuDir}`);
-    },
-});
-const infraDestroy = defineCommand({
-    meta: {
-        name: "destroy",
-        description: "Destroy Hetzner OpenTofu resources for a host (DANGEROUS).",
-    },
-    args: {
-        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
-        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
-        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
-        force: { type: "boolean", description: "Skip confirmation prompt (non-interactive).", default: false },
-        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
-    },
-    async run({ args }) {
-        const cwd = process.cwd();
-        const repoRoot = findRepoRoot(cwd);
-        const hostName = resolveHostNameOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
-        if (!hostName)
-            return;
-        const { layout, config: clawdletsConfig } = loadClawdletsConfig({ repoRoot, runtimeDir: args.runtimeDir });
-        const hostCfg = clawdletsConfig.hosts[hostName];
-        if (!hostCfg)
-            throw new Error(`missing host in fleet/clawdlets.json: ${hostName}`);
-        const opentofuDir = getHostOpenTofuDir(layout, hostName);
-        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
-        if (deployCreds.envFile?.status === "invalid")
-            throw new Error(`deploy env file rejected: ${deployCreds.envFile.path} (${deployCreds.envFile.error || "invalid"})`);
-        if (deployCreds.envFile?.status === "missing")
-            throw new Error(`missing deploy env file: ${deployCreds.envFile.path}`);
-        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
-        if (!hcloudToken)
-            throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
-        const adminCidr = String(hostCfg.provisioning.adminCidr || "").trim();
-        if (!adminCidr)
-            throw new Error(`missing provisioning.adminCidr for ${hostName} (set via: clawdlets host set --admin-cidr ...)`);
-        const sshPubkeyFileRaw = String(hostCfg.provisioning.sshPubkeyFile || "").trim();
-        if (!sshPubkeyFileRaw)
-            throw new Error(`missing provisioning.sshPubkeyFile for ${hostName} (set via: clawdlets host set --ssh-pubkey-file ...)`);
-        const sshPubkeyFileExpanded = expandPath(sshPubkeyFileRaw);
-        const sshPubkeyFile = path.isAbsolute(sshPubkeyFileExpanded)
-            ? sshPubkeyFileExpanded
-            : path.resolve(repoRoot, sshPubkeyFileExpanded);
-        if (!fs.existsSync(sshPubkeyFile))
-            throw new Error(`ssh pubkey file not found: ${sshPubkeyFile}`);
-        const image = String(hostCfg.hetzner.image || "").trim();
-        const location = String(hostCfg.hetzner.location || "").trim();
-        const force = Boolean(args.force);
-        const interactive = process.stdin.isTTY && process.stdout.isTTY;
-        if (!force) {
-            if (!interactive)
-                throw new Error("refusing to destroy without --force (no TTY)");
-            p.intro("clawdlets infra destroy");
-            const ok = await p.confirm({
-                message: `Destroy Hetzner resources for host ${hostName}?`,
-                initialValue: false,
-            });
-            if (p.isCancel(ok) || !ok) {
-                p.cancel("canceled");
-                return;
-            }
-        }
-        await destroyOpenTofuVars({
-            opentofuDir,
-            vars: {
-                hostName,
-                hcloudToken,
-                adminCidr,
-                adminCidrIsWorldOpen: Boolean(hostCfg.provisioning.adminCidrAllowWorldOpen),
-                sshPubkeyFile,
-                serverType: hostCfg.hetzner.serverType,
-                image,
-                location,
-                sshExposureMode: getSshExposureMode(hostCfg),
-                tailnetMode: getTailnetMode(hostCfg),
-            },
-            nixBin: String(deployCreds.values.NIX_BIN || "nix").trim() || "nix",
-            dryRun: args.dryRun,
-            redact: [hcloudToken, deployCreds.values.GITHUB_TOKEN].filter(Boolean),
-        });
-        console.log(`ok: provisioning destroyed for ${hostName}`);
-        console.log(`hint: state in ${opentofuDir}`);
-    },
-});
-export const infra = defineCommand({
-    meta: {
-        name: "infra",
-        description: "Infrastructure operations (Hetzner OpenTofu).",
-    },
-    subCommands: {
-        apply: infraApply,
-        destroy: infraDestroy,
-    },
-});
-//# sourceMappingURL=infra.js.map

package/dist/commands/infra.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"infra.js","sourceRoot":"","sources":["../../src/commands/infra.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,UAAU,GAAG,aAAa,CAAC;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qEAAqE;KACnF;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9F;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACpK,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAEtH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,iDAAiD,CAAC,CAAC;QAEjI,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,sDAAsD,CAAC,CAAC;QACjJ,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/D,MAAM,iBAAiB,CAAC;YACtB,WAAW;YACX,IAAI,EAAE;gBACJ,QAAQ;gBACR,WAAW;gBACX,SAAS;gBACT,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;gBAC3E,aAAa;gBACb,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;gBACtC,KAAK;gBACL,QAAQ;gBACR,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC;gBAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;aACrC;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;SACnF,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,oBAAoB,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,aAAa,CAAC;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,4DAA4D;KAC1E;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6CAA6C,EAAE,OAAO,EAAE,KAAK,EAAE;QACtG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9F;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACpK,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAEtH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,iDAAiD,CAAC,CAAC;QAEjI,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,sDAAsD,CAAC,CAAC;QACjJ,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/D,MAAM,KAAK,GAAG,OAAO,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClF,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;gBACzB,OAAO,EAAE,sCAAsC,QAAQ,GAAG;gBAC1D,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,mBAAmB,CAAC;YACxB,WAAW;YACX,IAAI,EAAE;gBACJ,QAAQ;gBACR,WAAW;gBACX,SAAS;gBACT,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;gBAC3E,aAAa;gBACb,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;gBACtC,KAAK;gBACL,QAAQ;gBACR,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC;gBAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;aACrC;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;SACnF,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,+CAA+C;KAC7D;IACD,WAAW,EAAE;QACX,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,YAAY;KACtB;CACF,CAAC,CAAC"}

package/dist/commands/lockdown.d.ts

@@ -1,25 +0,0 @@
-export declare const lockdown: import("citty").CommandDef<{
-    runtimeDir: {
-        type: "string";
-        description: string;
-    };
-    envFile: {
-        type: "string";
-        description: string;
-    };
-    host: {
-        type: "string";
-        description: string;
-    };
-    skipTofu: {
-        type: "boolean";
-        description: string;
-        default: false;
-    };
-    dryRun: {
-        type: "boolean";
-        description: string;
-        default: false;
-    };
-}>;
-//# sourceMappingURL=lockdown.d.ts.map

package/dist/commands/lockdown.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lockdown.d.ts","sourceRoot":"","sources":["../../src/commands/lockdown.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;EA6EnB,CAAC"}

package/dist/commands/lockdown.js

@@ -1,93 +0,0 @@
-import fs from "node:fs";
-import process from "node:process";
-import path from "node:path";
-import { defineCommand } from "citty";
-import { applyOpenTofuVars } from "@clawdlets/core/lib/opentofu";
-import { expandPath } from "@clawdlets/core/lib/path-expand";
-import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
-import { findRepoRoot } from "@clawdlets/core/lib/repo";
-import { getSshExposureMode, getTailnetMode, loadClawdletsConfig } from "@clawdlets/core/lib/clawdlets-config";
-import { getHostOpenTofuDir } from "@clawdlets/core/repo-layout";
-import { requireDeployGate } from "../lib/deploy-gate.js";
-import { resolveHostNameOrExit } from "../lib/host-resolve.js";
-export const lockdown = defineCommand({
-    meta: {
-        name: "lockdown",
-        description: "Remove public SSH from Hetzner firewall (OpenTofu only).",
-    },
-    args: {
-        runtimeDir: { type: "string", description: "Runtime directory (default: .clawdlets)." },
-        envFile: { type: "string", description: "Env file for deploy creds (default: <runtimeDir>/env)." },
-        host: { type: "string", description: "Host name (defaults to clawdlets.json defaultHost / sole host)." },
-        skipTofu: { type: "boolean", description: "Skip provisioning apply.", default: false },
-        dryRun: { type: "boolean", description: "Print commands without executing.", default: false },
-    },
-    async run({ args }) {
-        const cwd = process.cwd();
-        const repoRoot = findRepoRoot(cwd);
-        const hostName = resolveHostNameOrExit({ cwd, runtimeDir: args.runtimeDir, hostArg: args.host });
-        if (!hostName)
-            return;
-        const { layout, config: clawdletsConfig } = loadClawdletsConfig({ repoRoot, runtimeDir: args.runtimeDir });
-        const hostCfg = clawdletsConfig.hosts[hostName];
-        if (!hostCfg)
-            throw new Error(`missing host in fleet/clawdlets.json: ${hostName}`);
-        const opentofuDir = getHostOpenTofuDir(layout, hostName);
-        const sshExposureMode = getSshExposureMode(hostCfg);
-        if (sshExposureMode !== "tailnet") {
-            throw new Error(`sshExposure.mode=${sshExposureMode}; set sshExposure.mode=tailnet before lockdown (clawdlets host set --host ${hostName} --ssh-exposure tailnet)`);
-        }
-        await requireDeployGate({
-            runtimeDir: args.runtimeDir,
-            envFile: args.envFile,
-            host: hostName,
-            scope: "server-deploy",
-            strict: true,
-            skipGithubTokenCheck: true,
-        });
-        const deployCreds = loadDeployCreds({ cwd, runtimeDir: args.runtimeDir, envFile: args.envFile });
-        if (deployCreds.envFile?.status === "invalid")
-            throw new Error(`deploy env file rejected: ${deployCreds.envFile.path} (${deployCreds.envFile.error || "invalid"})`);
-        if (deployCreds.envFile?.status === "missing")
-            throw new Error(`missing deploy env file: ${deployCreds.envFile.path}`);
-        const hcloudToken = String(deployCreds.values.HCLOUD_TOKEN || "").trim();
-        const githubToken = String(deployCreds.values.GITHUB_TOKEN || "").trim();
-        if (!args.skipTofu) {
-            if (!hcloudToken)
-                throw new Error("missing HCLOUD_TOKEN (set in .clawdlets/env or env var; run: clawdlets env init)");
-            const adminCidr = String(hostCfg.provisioning.adminCidr || "").trim();
-            if (!adminCidr)
-                throw new Error(`missing provisioning.adminCidr for ${hostName} (set via: clawdlets host set --admin-cidr ...)`);
-            const sshPubkeyFileRaw = String(hostCfg.provisioning.sshPubkeyFile || "").trim();
-            if (!sshPubkeyFileRaw)
-                throw new Error(`missing provisioning.sshPubkeyFile for ${hostName} (set via: clawdlets host set --ssh-pubkey-file ...)`);
-            const sshPubkeyFileExpanded = expandPath(sshPubkeyFileRaw);
-            const sshPubkeyFile = path.isAbsolute(sshPubkeyFileExpanded)
-                ? sshPubkeyFileExpanded
-                : path.resolve(repoRoot, sshPubkeyFileExpanded);
-            if (!fs.existsSync(sshPubkeyFile))
-                throw new Error(`ssh pubkey file not found: ${sshPubkeyFile}`);
-            const image = String(hostCfg.hetzner.image || "").trim();
-            const location = String(hostCfg.hetzner.location || "").trim();
-            await applyOpenTofuVars({
-                opentofuDir,
-                vars: {
-                    hostName,
-                    hcloudToken,
-                    adminCidr,
-                    adminCidrIsWorldOpen: Boolean(hostCfg.provisioning.adminCidrAllowWorldOpen),
-                    sshPubkeyFile,
-                    serverType: hostCfg.hetzner.serverType,
-                    image,
-                    location,
-                    sshExposureMode,
-                    tailnetMode: getTailnetMode(hostCfg),
-                },
-                nixBin: String(deployCreds.values.NIX_BIN || "nix").trim() || "nix",
-                dryRun: args.dryRun,
-                redact: [hcloudToken, githubToken].filter(Boolean),
-            });
-        }
-    },
-});
-//# sourceMappingURL=lockdown.js.map

package/dist/commands/lockdown.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lockdown.js","sourceRoot":"","sources":["../../src/commands/lockdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IACpC,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,0DAA0D;KACxE;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACvF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;QAClG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iEAAiE,EAAE;QACxG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE;QACtF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE;KAC9F;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,eAAe,6EAA6E,QAAQ,0BAA0B,CAAC,CAAC;QACtK,CAAC;QAED,MAAM,iBAAiB,CAAC;YACtB,UAAU,EAAG,IAAY,CAAC,UAAU;YACpC,OAAO,EAAG,IAAY,CAAC,OAAO;YAC9B,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,IAAI;YACZ,oBAAoB,EAAE,IAAI;SAC3B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,UAAU,EAAG,IAAY,CAAC,UAAU,EAAE,OAAO,EAAG,IAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;QACpK,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAEtH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,iDAAiD,CAAC,CAAC;YAEnI,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjF,IAAI,CAAC,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,sDAAsD,CAAC,CAAC;YACjJ,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBAC1D,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;YAChG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,iBAAiB,CAAC;gBACtB,WAAW;gBACX,IAAI,EAAE;oBACJ,QAAQ;oBACR,WAAW;oBACX,SAAS;oBACT,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;oBAC3E,aAAa;oBACb,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;oBACtC,KAAK;oBACL,QAAQ;oBACR,eAAe;oBACf,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;iBACrC;gBACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;gBACnE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/commands/project.d.ts

@@ -1,2 +0,0 @@
-export declare const project: import("citty").CommandDef<import("citty").ArgsDef>;
-//# sourceMappingURL=project.d.ts.map

package/dist/commands/project.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../src/commands/project.ts"],"names":[],"mappings":"AAgRA,eAAO,MAAM,OAAO,qDAGlB,CAAC"}