clawdlets 0.3.3 → 0.4.0

package/vendor/@clawdlets/core/dist/lib/project-init.js

@@ -0,0 +1,254 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { tmpdir } from "node:os";
+import { downloadTemplate } from "giget";
+import { ensureDir, writeFileAtomic } from "./fs-safe.js";
+import { capture, run } from "./run.js";
+import { assertSafeHostName } from "@clawdlets/shared/lib/identifiers";
+function resolveLocalTemplateDir(templateSpec) {
+    const trimmed = String(templateSpec || "").trim();
+    if (!trimmed.startsWith("file:"))
+        return null;
+    const dir = trimmed.slice("file:".length).trim();
+    if (!dir)
+        throw new Error("templateSpec file: missing path");
+    return path.resolve(process.cwd(), dir);
+}
+function applySubs(s, subs) {
+    let out = s;
+    for (const [k, v] of Object.entries(subs))
+        out = out.split(k).join(v);
+    return out;
+}
+function isProbablyText(file) {
+    const base = path.basename(file);
+    if (base === "Justfile" || base === "_gitignore")
+        return true;
+    const ext = path.extname(file).toLowerCase();
+    return [
+        ".md",
+        ".nix",
+        ".tf",
+        ".hcl",
+        ".json",
+        ".yaml",
+        ".yml",
+        ".txt",
+        ".lock",
+        ".gitignore",
+    ].includes(ext);
+}
+async function copyTree(params) {
+    const entries = await fs.promises.readdir(params.srcDir, { withFileTypes: true });
+    for (const ent of entries) {
+        const srcName = ent.name;
+        const srcPath = path.join(params.srcDir, srcName);
+        const renamed = srcName === "_gitignore" ? ".gitignore" : applySubs(srcName, params.subs);
+        const destPath = path.join(params.destDir, renamed);
+        if (ent.isDirectory()) {
+            await ensureDir(destPath);
+            await copyTree({ srcDir: srcPath, destDir: destPath, subs: params.subs });
+            continue;
+        }
+        if (!ent.isFile())
+            continue;
+        const buf = await fs.promises.readFile(srcPath);
+        if (!isProbablyText(srcName)) {
+            await ensureDir(path.dirname(destPath));
+            await fs.promises.writeFile(destPath, buf);
+            continue;
+        }
+        const rendered = applySubs(buf.toString("utf8"), params.subs);
+        await writeFileAtomic(destPath, rendered);
+    }
+}
+async function dirHasAnyFiles(dir) {
+    try {
+        const entries = await fs.promises.readdir(dir);
+        return entries.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureHookExecutables(repoRoot) {
+    const hooksDir = path.join(repoRoot, ".githooks");
+    try {
+        const entries = await fs.promises.readdir(hooksDir, { withFileTypes: true });
+        let hasHooks = false;
+        for (const ent of entries) {
+            if (!ent.isFile())
+                continue;
+            const p = path.join(hooksDir, ent.name);
+            await fs.promises.chmod(p, 0o755);
+            hasHooks = true;
+        }
+        return hasHooks;
+    }
+    catch {
+        return false;
+    }
+}
+async function findTemplateRoot(dir) {
+    const direct = path.join(dir, "fleet", "clawdlets.json");
+    if (fs.existsSync(direct))
+        return dir;
+    const entries = await fs.promises.readdir(dir, { withFileTypes: true });
+    const candidates = [];
+    for (const ent of entries) {
+        if (!ent.isDirectory())
+            continue;
+        const candidate = path.join(dir, ent.name);
+        if (fs.existsSync(path.join(candidate, "fleet", "clawdlets.json"))) {
+            candidates.push(candidate);
+        }
+    }
+    if (candidates.length === 1)
+        return candidates[0];
+    throw new Error(`template root missing fleet/clawdlets.json (searched: ${dir})`);
+}
+async function withDownloadedTemplate(templateSpec, fn) {
+    const localDir = resolveLocalTemplateDir(templateSpec);
+    if (localDir) {
+        const stat = await fs.promises.stat(localDir).catch(() => null);
+        if (!stat || !stat.isDirectory()) {
+            throw new Error(`local template dir not found: ${localDir}`);
+        }
+        const templateDir = await findTemplateRoot(localDir);
+        return await fn({ templateDir, downloaded: { dir: localDir } });
+    }
+    const tempDir = await fs.promises.mkdtemp(path.join(tmpdir(), "clawdlets-template-"));
+    let templateDir = tempDir;
+    try {
+        const downloaded = await downloadTemplate(templateSpec, {
+            dir: tempDir,
+            force: true,
+            auth: String(process.env["GITHUB_TOKEN"] || process.env["CLAWDLETS_TEMPLATE_TOKEN"] || "").trim() || undefined,
+        });
+        templateDir = await findTemplateRoot(downloaded.dir || tempDir);
+        const result = await fn({ templateDir, downloaded: { dir: downloaded.dir || tempDir } });
+        await fs.promises.rm(tempDir, { recursive: true, force: true });
+        return result;
+    }
+    catch (e) {
+        await fs.promises.rm(tempDir, { recursive: true, force: true });
+        throw e;
+    }
+}
+async function listPlannedFiles(params) {
+    const planned = [];
+    const walk = async (srcDir, rel) => {
+        const entries = await fs.promises.readdir(srcDir, { withFileTypes: true });
+        for (const ent of entries) {
+            const srcName = ent.name;
+            const mapped = srcName === "_gitignore" ? ".gitignore" : applySubs(srcName, params.subs);
+            const nextRel = path.join(rel, mapped);
+            if (ent.isDirectory()) {
+                await walk(path.join(srcDir, srcName), nextRel);
+            }
+            else if (ent.isFile()) {
+                planned.push(nextRel);
+            }
+        }
+    };
+    await walk(params.templateDir, ".");
+    planned.sort();
+    return planned;
+}
+async function disableGarnixPrivate(destDir, host) {
+    const configPath = path.join(destDir, "fleet", "clawdlets.json");
+    if (!fs.existsSync(configPath))
+        return;
+    const raw = await fs.promises.readFile(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    const hostCfg = parsed?.hosts?.[host];
+    if (!hostCfg || typeof hostCfg !== "object")
+        return;
+    hostCfg.cache = hostCfg.cache && typeof hostCfg.cache === "object" ? hostCfg.cache : {};
+    hostCfg.cache.garnix = hostCfg.cache.garnix && typeof hostCfg.cache.garnix === "object" ? hostCfg.cache.garnix : {};
+    hostCfg.cache.garnix.private =
+        hostCfg.cache.garnix.private && typeof hostCfg.cache.garnix.private === "object" ? hostCfg.cache.garnix.private : {};
+    hostCfg.cache.garnix.private.enable = false;
+    await writeFileAtomic(configPath, `${JSON.stringify(parsed, null, 2)}\n`);
+}
+export async function planProjectInit(params) {
+    const destDir = path.resolve(process.cwd(), params.destDir);
+    const host = String(params.host || "clawdbot-fleet-host").trim() || "clawdbot-fleet-host";
+    assertSafeHostName(host);
+    const projectName = path.basename(destDir);
+    const subs = {
+        "__PROJECT_NAME__": projectName,
+        "clawdbot-fleet-host": host,
+        "clawdbot_fleet_host": host.replace(/-/g, "_"),
+    };
+    return await withDownloadedTemplate(params.templateSpec, async ({ templateDir }) => {
+        const plannedFiles = await listPlannedFiles({ templateDir, subs });
+        return {
+            destDir,
+            host,
+            templateSpec: params.templateSpec,
+            plannedFiles,
+        };
+    });
+}
+export async function initProject(params) {
+    const destDir = path.resolve(process.cwd(), params.destDir);
+    const host = String(params.host || "clawdbot-fleet-host").trim() || "clawdbot-fleet-host";
+    assertSafeHostName(host);
+    const exists = fs.existsSync(destDir);
+    if (exists && (await dirHasAnyFiles(destDir))) {
+        throw new Error(`target dir not empty: ${destDir}`);
+    }
+    const projectName = path.basename(destDir);
+    const subs = {
+        "__PROJECT_NAME__": projectName,
+        "clawdbot-fleet-host": host,
+        "clawdbot_fleet_host": host.replace(/-/g, "_"),
+    };
+    const plannedFiles = await withDownloadedTemplate(params.templateSpec, async ({ templateDir }) => {
+        const planned = await listPlannedFiles({ templateDir, subs });
+        await ensureDir(destDir);
+        await copyTree({ srcDir: templateDir, destDir, subs });
+        await disableGarnixPrivate(destDir, host);
+        return planned;
+    });
+    const hasHooks = await ensureHookExecutables(destDir);
+    const wantGitInit = params.gitInit ?? true;
+    let gitInitialized = false;
+    if (wantGitInit) {
+        try {
+            await capture("git", ["--version"], { cwd: destDir });
+            await run("git", ["init"], { cwd: destDir });
+            if (hasHooks)
+                await run("git", ["config", "core.hooksPath", ".githooks"], { cwd: destDir });
+            gitInitialized = true;
+        }
+        catch {
+            gitInitialized = false;
+        }
+    }
+    const nextSteps = [
+        "next:",
+        `- cd ${destDir}`,
+        "- create a git repo + set origin (recommended; enables blank base flake)",
+        "- clawdlets env init  # set HCLOUD_TOKEN in .clawdlets/env (required for provisioning)",
+        `- clawdlets host set --host ${host} --admin-cidr <your-ip>/32 --disk-device /dev/sda --add-ssh-key-file $HOME/.ssh/id_ed25519.pub`,
+        `- clawdlets host set --host ${host} --ssh-exposure bootstrap`,
+        `- clawdlets secrets init --host ${host}`,
+        `- clawdlets doctor --host ${host}`,
+        `- clawdlets bootstrap --host ${host}`,
+        `- clawdlets host set --host ${host} --target-host <ssh-alias|user@host>`,
+        `- clawdlets host set --host ${host} --ssh-exposure tailnet`,
+        `- clawdlets lockdown --host ${host}`,
+    ];
+    return {
+        destDir,
+        host,
+        plannedFiles,
+        gitInitialized,
+        hasHooks,
+        nextSteps,
+    };
+}
+//# sourceMappingURL=project-init.js.map

package/vendor/@clawdlets/core/dist/lib/run-constants.d.ts

@@ -0,0 +1,4 @@
+export declare const RUN_KINDS: readonly ["project_init", "project_import", "config_write", "workspace_write", "doctor", "secrets_init", "secrets_verify", "secrets_sync", "bootstrap", "deploy", "server_status", "server_logs", "server_audit", "server_restart", "custom"];
+export declare const RUN_STATUSES: readonly ["queued", "running", "succeeded", "failed", "canceled"];
+export declare const RUN_EVENT_LEVELS: readonly ["debug", "info", "warn", "error"];
+//# sourceMappingURL=run-constants.d.ts.map

package/vendor/@clawdlets/core/dist/lib/run-constants.js

@@ -0,0 +1,20 @@
+export const RUN_KINDS = [
+    "project_init",
+    "project_import",
+    "config_write",
+    "workspace_write",
+    "doctor",
+    "secrets_init",
+    "secrets_verify",
+    "secrets_sync",
+    "bootstrap",
+    "deploy",
+    "server_status",
+    "server_logs",
+    "server_audit",
+    "server_restart",
+    "custom",
+];
+export const RUN_STATUSES = ["queued", "running", "succeeded", "failed", "canceled"];
+export const RUN_EVENT_LEVELS = ["debug", "info", "warn", "error"];
+//# sourceMappingURL=run-constants.js.map

package/vendor/@clawdlets/core/dist/lib/run-types.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+export declare const RunKindSchema: z.ZodEnum<{
+    custom: "custom";
+    bootstrap: "bootstrap";
+    deploy: "deploy";
+    project_init: "project_init";
+    project_import: "project_import";
+    config_write: "config_write";
+    workspace_write: "workspace_write";
+    doctor: "doctor";
+    secrets_init: "secrets_init";
+    secrets_verify: "secrets_verify";
+    secrets_sync: "secrets_sync";
+    server_status: "server_status";
+    server_logs: "server_logs";
+    server_audit: "server_audit";
+    server_restart: "server_restart";
+}>;
+export type RunKind = z.infer<typeof RunKindSchema>;
+export declare const RunStatusSchema: z.ZodEnum<{
+    queued: "queued";
+    running: "running";
+    succeeded: "succeeded";
+    failed: "failed";
+    canceled: "canceled";
+}>;
+export type RunStatus = z.infer<typeof RunStatusSchema>;
+export declare const RunEventLevelSchema: z.ZodEnum<{
+    error: "error";
+    warn: "warn";
+    info: "info";
+    debug: "debug";
+}>;
+export type RunEventLevel = z.infer<typeof RunEventLevelSchema>;
+export declare const RunEventSchema: z.ZodObject<{
+    ts: z.ZodNumber;
+    level: z.ZodEnum<{
+        error: "error";
+        warn: "warn";
+        info: "info";
+        debug: "debug";
+    }>;
+    message: z.ZodString;
+    data: z.ZodOptional<z.ZodUnknown>;
+    redacted: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RunEvent = z.infer<typeof RunEventSchema>;
+//# sourceMappingURL=run-types.d.ts.map

package/vendor/@clawdlets/core/dist/lib/run-types.js

@@ -0,0 +1,13 @@
+import { z } from "zod";
+import { RUN_EVENT_LEVELS, RUN_KINDS, RUN_STATUSES } from "./run-constants.js";
+export const RunKindSchema = z.enum(RUN_KINDS);
+export const RunStatusSchema = z.enum(RUN_STATUSES);
+export const RunEventLevelSchema = z.enum(RUN_EVENT_LEVELS);
+export const RunEventSchema = z.object({
+    ts: z.number().int().nonnegative(),
+    level: RunEventLevelSchema,
+    message: z.string().min(1),
+    data: z.unknown().optional(),
+    redacted: z.boolean().optional(),
+});
+//# sourceMappingURL=run-types.js.map

package/vendor/@clawdlets/core/dist/lib/safe-record.d.ts

@@ -0,0 +1,7 @@
+export declare function isUnsafeRecordKey(key: string): boolean;
+export declare function assertSafeRecordKey(params: {
+    key: string;
+    context: string;
+}): void;
+export declare function createNullProtoRecord<TValue>(): Record<string, TValue>;
+//# sourceMappingURL=safe-record.d.ts.map

package/vendor/@clawdlets/core/dist/lib/safe-record.js

@@ -0,0 +1,13 @@
+const UNSAFE_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+export function isUnsafeRecordKey(key) {
+    return UNSAFE_KEYS.has(key);
+}
+export function assertSafeRecordKey(params) {
+    if (!isUnsafeRecordKey(params.key))
+        return;
+    throw new Error(`unsafe key "${params.key}" (${params.context})`);
+}
+export function createNullProtoRecord() {
+    return Object.create(null);
+}
+//# sourceMappingURL=safe-record.js.map

package/vendor/@clawdlets/core/dist/lib/secret-wiring.d.ts

@@ -0,0 +1,39 @@
+import { z } from "zod";
+export declare const SecretEnvSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+export declare const SecretFileIdSchema: z.ZodString;
+export declare const SECRET_FILE_FORMATS: readonly ["raw", "dotenv", "json", "yaml"];
+export declare const SecretFileFormatSchema: z.ZodEnum<{
+    raw: "raw";
+    dotenv: "dotenv";
+    json: "json";
+    yaml: "yaml";
+}>;
+export type SecretFileFormat = z.infer<typeof SecretFileFormatSchema>;
+export declare const SecretFileSpecSchema: z.ZodObject<{
+    secretName: z.ZodString;
+    targetPath: z.ZodString;
+    mode: z.ZodDefault<z.ZodString>;
+    owner: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    format: z.ZodOptional<z.ZodEnum<{
+        raw: "raw";
+        dotenv: "dotenv";
+        json: "json";
+        yaml: "yaml";
+    }>>;
+}, z.core.$strict>;
+export type SecretFileSpec = z.infer<typeof SecretFileSpecSchema>;
+export declare const SecretFilesSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    secretName: z.ZodString;
+    targetPath: z.ZodString;
+    mode: z.ZodDefault<z.ZodString>;
+    owner: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    format: z.ZodOptional<z.ZodEnum<{
+        raw: "raw";
+        dotenv: "dotenv";
+        json: "json";
+        yaml: "yaml";
+    }>>;
+}, z.core.$strict>>>;
+//# sourceMappingURL=secret-wiring.d.ts.map

package/vendor/@clawdlets/core/dist/lib/secret-wiring.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { EnvVarNameSchema, SecretNameSchema } from "@clawdlets/shared/lib/identifiers";
+export const SecretEnvSchema = z.record(EnvVarNameSchema, SecretNameSchema).default(() => ({}));
+export const SecretFileIdSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .regex(/^[a-z0-9._-]+$/, { message: "invalid secret file id (use [a-z0-9._-]+)" });
+const AbsolutePathSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .refine((v) => v.startsWith("/"), { message: "targetPath must be an absolute path" })
+    .refine((v) => !v.includes("/../") && !v.endsWith("/..") && !v.includes("\u0000"), {
+    message: "targetPath must not contain /../, end with /.., or include NUL",
+});
+const AllowedTargetPathSchema = AbsolutePathSchema.refine((v) => v.startsWith("/var/lib/clawdlets/"), {
+    message: "targetPath must be under /var/lib/clawdlets/",
+});
+const FileModeSchema = z
+    .string()
+    .trim()
+    .default("0400")
+    .refine((v) => /^0[0-7]{3}$/.test(v), { message: "invalid file mode (expected 0400-style octal string)" });
+const FileOwnerSchema = z.string().trim().min(1);
+export const SECRET_FILE_FORMATS = ["raw", "dotenv", "json", "yaml"];
+export const SecretFileFormatSchema = z.enum(SECRET_FILE_FORMATS);
+export const SecretFileSpecSchema = z
+    .object({
+    secretName: SecretNameSchema,
+    targetPath: AllowedTargetPathSchema,
+    mode: FileModeSchema,
+    owner: FileOwnerSchema.optional(),
+    group: FileOwnerSchema.optional(),
+    format: SecretFileFormatSchema.optional(),
+})
+    .strict();
+export const SecretFilesSchema = z.record(SecretFileIdSchema, SecretFileSpecSchema).default(() => ({}));
+//# sourceMappingURL=secret-wiring.js.map

package/vendor/@clawdlets/core/dist/lib/secrets-allowlist.d.ts

@@ -0,0 +1,10 @@
+import type { ClawdletsConfig } from "./clawdlets-config.js";
+export declare function buildManagedHostSecretNameAllowlist(params: {
+    config: ClawdletsConfig;
+    host: string;
+}): Set<string>;
+export declare function assertSecretsAreManaged(params: {
+    allowlist: Set<string>;
+    secrets: Record<string, string>;
+}): void;
+//# sourceMappingURL=secrets-allowlist.d.ts.map

package/vendor/@clawdlets/core/dist/lib/secrets-allowlist.js

@@ -0,0 +1,21 @@
+import { buildFleetSecretsPlan } from "./fleet-secrets-plan.js";
+export function buildManagedHostSecretNameAllowlist(params) {
+    const host = params.host.trim();
+    const secretsPlan = buildFleetSecretsPlan({ config: params.config, hostName: host });
+    const names = new Set();
+    for (const spec of secretsPlan.required || [])
+        names.add(spec.name);
+    for (const spec of secretsPlan.optional || [])
+        names.add(spec.name);
+    for (const name of secretsPlan.hostSecretNamesRequired || [])
+        names.add(name);
+    return names;
+}
+export function assertSecretsAreManaged(params) {
+    const unmanaged = Object.keys(params.secrets).filter((name) => !params.allowlist.has(name));
+    if (unmanaged.length === 0)
+        return;
+    const sample = unmanaged.slice(0, 3).join(", ");
+    throw new Error(`unmanaged secret name(s): ${sample} (add to fleet.secretEnv/secretFiles)`);
+}
+//# sourceMappingURL=secrets-allowlist.js.map

package/vendor/@clawdlets/core/dist/lib/secrets-autowire.d.ts

@@ -0,0 +1,26 @@
+import type { ClawdletsConfig } from "./clawdlets-config.js";
+import type { MissingSecretConfig, SecretSource } from "./secrets-plan.js";
+export type SecretsAutowireScope = "fleet" | "bot";
+export type SecretsAutowireEntry = {
+    bot: string;
+    envVar: string;
+    secretName: string;
+    scope: SecretsAutowireScope;
+    sources: SecretSource[];
+};
+export type SecretsAutowirePlan = {
+    updates: SecretsAutowireEntry[];
+    skipped: MissingSecretConfig[];
+};
+export declare function planSecretsAutowire(params: {
+    config: ClawdletsConfig;
+    hostName: string;
+    scope?: SecretsAutowireScope;
+    bot?: string;
+    onlyEnvVars?: string[];
+}): SecretsAutowirePlan;
+export declare function applySecretsAutowire(params: {
+    config: ClawdletsConfig;
+    plan: SecretsAutowirePlan;
+}): ClawdletsConfig;
+//# sourceMappingURL=secrets-autowire.d.ts.map

package/vendor/@clawdlets/core/dist/lib/secrets-autowire.js

@@ -0,0 +1,97 @@
+import { buildFleetSecretsPlan } from "./fleet-secrets-plan.js";
+import { suggestSecretNameForEnvVar } from "./fleet-secrets-plan-helpers.js";
+import { ClawdletsConfigSchema } from "./clawdlets-config.js";
+function pickDefaultScope(sources) {
+    if (sources.includes("channel"))
+        return "bot";
+    if (sources.includes("model") || sources.includes("provider"))
+        return "fleet";
+    return "bot";
+}
+function normalizeEnvVarFilter(list) {
+    if (!list || list.length === 0)
+        return null;
+    const out = new Set();
+    for (const entry of list) {
+        const cleaned = String(entry || "").trim();
+        if (cleaned)
+            out.add(cleaned);
+    }
+    return out.size > 0 ? out : null;
+}
+export function planSecretsAutowire(params) {
+    const plan = buildFleetSecretsPlan({ config: params.config, hostName: params.hostName });
+    const onlyEnvVars = normalizeEnvVarFilter(params.onlyEnvVars);
+    const targetBot = params.bot ? String(params.bot).trim() : "";
+    const missing = plan.missingSecretConfig || [];
+    const updates = [];
+    const skipped = [];
+    const seenFleetEnvVars = new Set();
+    for (const entry of missing) {
+        if (entry.kind !== "envVar") {
+            skipped.push(entry);
+            continue;
+        }
+        if (targetBot && entry.bot !== targetBot) {
+            skipped.push(entry);
+            continue;
+        }
+        if (onlyEnvVars && !onlyEnvVars.has(entry.envVar)) {
+            skipped.push(entry);
+            continue;
+        }
+        const sources = Array.isArray(entry.sources) ? entry.sources : [];
+        const scope = params.scope ?? pickDefaultScope(sources);
+        if (scope === "fleet") {
+            if (seenFleetEnvVars.has(entry.envVar)) {
+                skipped.push(entry);
+                continue;
+            }
+            seenFleetEnvVars.add(entry.envVar);
+        }
+        const secretName = suggestSecretNameForEnvVar(entry.envVar, scope === "bot" ? entry.bot : undefined);
+        updates.push({
+            bot: entry.bot,
+            envVar: entry.envVar,
+            secretName,
+            scope,
+            sources,
+        });
+    }
+    updates.sort((a, b) => {
+        if (a.envVar !== b.envVar)
+            return a.envVar.localeCompare(b.envVar);
+        if (a.bot !== b.bot)
+            return a.bot.localeCompare(b.bot);
+        if (a.scope !== b.scope)
+            return a.scope.localeCompare(b.scope);
+        return a.secretName.localeCompare(b.secretName);
+    });
+    return { updates, skipped };
+}
+export function applySecretsAutowire(params) {
+    const next = structuredClone(params.config);
+    for (const entry of params.plan.updates) {
+        if (entry.scope === "fleet") {
+            const existing = next.fleet.secretEnv?.[entry.envVar];
+            if (existing && existing !== entry.secretName) {
+                throw new Error(`conflict for ${entry.envVar}: fleet.secretEnv already set to ${existing}`);
+            }
+            next.fleet.secretEnv[entry.envVar] = entry.secretName;
+            continue;
+        }
+        const bot = next.fleet.bots[entry.bot];
+        if (!bot)
+            throw new Error(`unknown bot: ${entry.bot}`);
+        const profile = bot.profile;
+        if (!profile.secretEnv)
+            profile.secretEnv = {};
+        const existing = profile.secretEnv[entry.envVar];
+        if (existing && existing !== entry.secretName) {
+            throw new Error(`conflict for ${entry.envVar} on bot ${entry.bot}: profile.secretEnv already set to ${existing}`);
+        }
+        profile.secretEnv[entry.envVar] = entry.secretName;
+    }
+    return ClawdletsConfigSchema.parse(next);
+}
+//# sourceMappingURL=secrets-autowire.js.map

package/{node_modules → vendor}/@clawdlets/core/dist/lib/secrets-init.d.ts

@@ -1,8 +1,7 @@
 export type SecretsInitJson = {
     adminPasswordHash: string;
     tailscaleAuthKey?: string;
-    secrets?: Record<string, string>;
-    discordTokens: Record<string, string>;
+    secrets: Record<string, string>;
 };
 export declare function resolveSecretsInitFromJsonArg(params: {
     fromJsonRaw: unknown;
@@ -12,13 +11,9 @@ export declare function resolveSecretsInitFromJsonArg(params: {
 export declare function isPlaceholderSecretValue(value: string): boolean;
 export declare function listSecretsInitPlaceholders(params: {
     input: SecretsInitJson;
-    bots: string[];
-    discordBots?: string[];
     requiresTailscaleAuthKey: boolean;
 }): string[];
 export declare function buildSecretsInitTemplate(params: {
-    bots: string[];
-    discordBots?: string[];
     requiresTailscaleAuthKey: boolean;
     secrets?: Record<string, string>;
 }): SecretsInitJson;