clawdlets 0.3.4 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawdlets",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "private": false,
   "type": "module",
   "description": "CLI for clawdlets (NixOS fleet + bot operations)",
@@ -9,6 +9,7 @@
   },
   "files": [
     "dist",
+    "vendor",
     "README.md",
     "LICENSE"
   ],
@@ -28,13 +29,16 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.11.0",
-    "@clawdlets/core": "0.3.4",
+    "@clawdlets/core": "file:vendor/@clawdlets/core",
+    "@clawdlets/shared": "file:vendor/@clawdlets/shared",
     "citty": "^0.1.6",
     "giget": "^2.0.0",
     "yaml": "^2.8.0",
     "zod-to-json-schema": "^3.24.6",
+    "zod": "^4.3.5",
+    "ajv": "^8.17.1",
     "dotenv": "^17.2.3",
-    "zod": "^4.3.5"
+    "@clawdlets/cattle-core": "file:vendor/@clawdlets/cattle-core"
   },
   "devDependencies": {
     "@types/node": "^25.0.9",
@@ -54,8 +58,5 @@
     "url": "git+https://github.com/regenrek/clawdlets.git"
   },
   "license": "MIT",
-  "packageManager": "pnpm@10.25.0",
-  "bundledDependencies": [
-    "@clawdlets/core"
-  ]
+  "packageManager": "pnpm@10.25.0"
 }

package/vendor/@clawdlets/cattle-core/dist/index.d.ts

@@ -0,0 +1,10 @@
+export * from "./lib/cattle-cloudinit.js";
+export * from "./lib/cattle-planner.js";
+export * from "./lib/cattle-task.js";
+export * from "./lib/fs-private.js";
+export * from "./lib/hcloud-cattle.js";
+export * from "./lib/hcloud-labels.js";
+export * from "./lib/hcloud.js";
+export * from "./lib/persona-loader.js";
+export * from "./lib/ttl.js";
+//# sourceMappingURL=index.d.ts.map

package/vendor/@clawdlets/cattle-core/dist/index.js

@@ -0,0 +1,10 @@
+export * from "./lib/cattle-cloudinit.js";
+export * from "./lib/cattle-planner.js";
+export * from "./lib/cattle-task.js";
+export * from "./lib/fs-private.js";
+export * from "./lib/hcloud-cattle.js";
+export * from "./lib/hcloud-labels.js";
+export * from "./lib/hcloud.js";
+export * from "./lib/persona-loader.js";
+export * from "./lib/ttl.js";
+//# sourceMappingURL=index.js.map

package/{node_modules/@clawdlets/core → vendor/@clawdlets/cattle-core}/dist/lib/cattle-cloudinit.d.ts

@@ -4,11 +4,15 @@ export type CattleCloudInitParams = {
     hostname?: string;
     adminAuthorizedKeys: string[];
     tailscaleAuthKey: string;
+    tailscaleAuthKeyExpiresAt: string;
+    tailscaleAuthKeyOneTime: boolean;
     task: CattleTask;
     publicEnv?: Record<string, string>;
     secretsBootstrap?: {
         baseUrl: string;
         token: string;
+        tokenExpiresAt: string;
+        tokenOneTime: boolean;
     };
     extraWriteFiles?: Array<{
         path: string;
@@ -17,5 +21,7 @@ export type CattleCloudInitParams = {
         content: string;
     }>;
 };
+export declare const MAX_BOOTSTRAP_TOKEN_TTL_SECONDS: number;
+export declare const MAX_TAILSCALE_AUTH_KEY_TTL_SECONDS: number;
 export declare function buildCattleCloudInitUserData(params: CattleCloudInitParams): string;
 //# sourceMappingURL=cattle-cloudinit.d.ts.map

package/{node_modules/@clawdlets/core → vendor/@clawdlets/cattle-core}/dist/lib/cattle-cloudinit.js

@@ -1,7 +1,34 @@
 import YAML from "yaml";
-import { EnvVarNameSchema } from "./identifiers.js";
+import { EnvVarNameSchema } from "@clawdlets/shared/lib/identifiers";
 export const HCLOUD_USER_DATA_MAX_BYTES = 32 * 1024;
 const SUPPORTED_PUBLIC_ENV_KEYS = new Set(["CLAWDLETS_CATTLE_AUTO_SHUTDOWN"]);
+export const MAX_BOOTSTRAP_TOKEN_TTL_SECONDS = 15 * 60;
+export const MAX_TAILSCALE_AUTH_KEY_TTL_SECONDS = 60 * 60;
+function parseIsoInstant(value, label) {
+    const ts = Date.parse(value);
+    if (!Number.isFinite(ts)) {
+        throw new Error(`${label} must be an ISO-8601 timestamp (got: ${value})`);
+    }
+    return ts;
+}
+function assertShortLivedToken(params) {
+    if (!params.oneTime) {
+        throw new Error(`${params.label} must be one-time`);
+    }
+    const expiresAt = String(params.expiresAt || "").trim();
+    if (!expiresAt)
+        throw new Error(`${params.label} expiresAt is missing`);
+    const expiresAtMs = parseIsoInstant(expiresAt, `${params.label} expiresAt`);
+    const nowMs = Date.now();
+    if (expiresAtMs <= nowMs) {
+        throw new Error(`${params.label} is expired`);
+    }
+    const ttlSeconds = Math.floor((expiresAtMs - nowMs) / 1000);
+    if (ttlSeconds <= 0 || ttlSeconds > params.maxTtlSeconds) {
+        throw new Error(`${params.label} TTL must be > 0 and <= ${params.maxTtlSeconds}s (got ${ttlSeconds}s)`);
+    }
+    return expiresAt;
+}
 function normalizePublicEnv(env) {
     const out = {};
     for (const [k, v] of Object.entries(env || {})) {
@@ -33,6 +60,12 @@ export function buildCattleCloudInitUserData(params) {
     const tailscaleAuthKey = String(params.tailscaleAuthKey || "").trim();
     if (!tailscaleAuthKey)
         throw new Error("tailscaleAuthKey is missing");
+    const tailscaleAuthKeyExpiresAt = assertShortLivedToken({
+        label: "tailscaleAuthKey",
+        expiresAt: String(params.tailscaleAuthKeyExpiresAt || "").trim(),
+        oneTime: Boolean(params.tailscaleAuthKeyOneTime),
+        maxTtlSeconds: MAX_TAILSCALE_AUTH_KEY_TTL_SECONDS,
+    });
     const publicEnv = normalizePublicEnv(params.publicEnv);
     const publicEnvKeys = Object.keys(publicEnv).sort();
     const publicEnvText = publicEnvKeys.length === 0
@@ -42,6 +75,13 @@ export function buildCattleCloudInitUserData(params) {
         ? {
             baseUrl: String(params.secretsBootstrap.baseUrl || "").trim(),
             token: String(params.secretsBootstrap.token || "").trim(),
+            expiresAt: assertShortLivedToken({
+                label: "secretsBootstrap.token",
+                expiresAt: String(params.secretsBootstrap.tokenExpiresAt || "").trim(),
+                oneTime: Boolean(params.secretsBootstrap.tokenOneTime),
+                maxTtlSeconds: MAX_BOOTSTRAP_TOKEN_TTL_SECONDS,
+            }),
+            oneTime: Boolean(params.secretsBootstrap.tokenOneTime),
         }
         : null;
     if (bootstrap) {
@@ -65,6 +105,12 @@ export function buildCattleCloudInitUserData(params) {
             owner: "root:root",
             content: `${tailscaleAuthKey}\n`,
         },
+        {
+            path: "/run/secrets/tailscale_auth_key.expiresAt",
+            permissions: "0400",
+            owner: "root:root",
+            content: `${tailscaleAuthKeyExpiresAt}\n`,
+        },
         ...(bootstrap
             ? [
                 {

package/{node_modules/@clawdlets/core → vendor/@clawdlets/cattle-core}/dist/lib/cattle-planner.js

@@ -5,13 +5,19 @@ export function safeCattleLabelValue(raw, fallback) {
         return v;
     return toHcloudLabelValueSlug(v, { fallback });
 }
+function trimTrailingDashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === "-")
+        end--;
+    return value.slice(0, end);
+}
 export function buildCattleServerName(persona, unixSeconds) {
     const ts = Math.max(0, Math.floor(unixSeconds));
     const slug = toHcloudLabelValueSlug(persona, { fallback: "persona" });
     const prefix = "cattle-";
     const suffix = `-${ts}`;
     const maxSlug = 63 - prefix.length - suffix.length;
-    const slugTrimmed = (maxSlug > 0 ? slug.slice(0, maxSlug) : slug).replace(/-+$/, "") || "id";
+    const slugTrimmed = trimTrailingDashes(maxSlug > 0 ? slug.slice(0, maxSlug) : slug) || "id";
     return `${prefix}${slugTrimmed}${suffix}`;
 }
 //# sourceMappingURL=cattle-planner.js.map

package/{node_modules/@clawdlets/core → vendor/@clawdlets/cattle-core}/dist/lib/hcloud-labels.js

@@ -3,6 +3,32 @@ export const HCLOUD_LABEL_VALUE_MAX_LEN = 63;
 function isAsciiAlphaNum(ch) {
     return (ch >= "a" && ch <= "z") || (ch >= "A" && ch <= "Z") || (ch >= "0" && ch <= "9");
 }
+function collapseDashes(value) {
+    let out = "";
+    let prevDash = false;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (ch === "-") {
+            if (!prevDash) {
+                out += "-";
+                prevDash = true;
+            }
+            continue;
+        }
+        out += ch;
+        prevDash = false;
+    }
+    return out;
+}
+function trimDashes(value) {
+    let start = 0;
+    while (start < value.length && value[start] === "-")
+        start++;
+    let end = value.length;
+    while (end > start && value[end - 1] === "-")
+        end--;
+    return value.slice(start, end);
+}
 export function isValidHcloudLabelValue(value) {
     const v = String(value ?? "");
     if (v.length === 0)
@@ -53,12 +79,12 @@ export function toHcloudLabelValueSlug(input, opts) {
         else if (ch === "-" || ch === "_" || ch === "." || ch === " ")
             out.push("-");
     }
-    let s = out.join("").replace(/-+/g, "-").replace(/^-+/, "").replace(/-+$/, "");
+    let s = trimDashes(collapseDashes(out.join("")));
     if (!s)
         s = fallback;
     if (s.length > HCLOUD_LABEL_VALUE_MAX_LEN)
         s = s.slice(0, HCLOUD_LABEL_VALUE_MAX_LEN);
-    s = s.replace(/^-+/, "").replace(/-+$/, "");
+    s = trimDashes(s);
     if (!s)
         s = fallback;
     if (!isValidHcloudLabelValue(s))

package/{node_modules/@clawdlets/core → vendor/@clawdlets/cattle-core}/dist/lib/persona-loader.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { z } from "zod";
-import { assertSafePersonaName } from "./identifiers.js";
+import { assertSafePersonaName } from "@clawdlets/shared/lib/identifiers";
 export const PERSONA_CONFIG_SCHEMA_VERSION = 1;
 export const PersonaConfigSchema = z
     .object({

package/vendor/@clawdlets/cattle-core/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@clawdlets/cattle-core",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./dist/index.js",
+    "./lib/*": "./dist/lib/*.js"
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@clawdlets/shared": "file:../shared",
+    "yaml": "^2.8.0",
+    "zod": "^4.3.5"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.9",
+    "typescript": "^5.6.3",
+    "vitest": "^4.0.17"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "packageManager": "pnpm@10.25.0"
+}