@kindgi/cli 0.0.0-bootstrap.0 → 0.1.0

package/dist/commands/key.js

@@ -0,0 +1,322 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * `kindgi key` — local Ed25519 signing-key lifecycle.
+ *
+ * FULLY LOCAL. Reads + writes files under `<home>/.kindgi/keys/`.
+ * `SigningKeyBinding` is a runtime primitive with no HTTP admin
+ * surface yet, so there is no `push` / `pull` / `rotate` / `delete`.
+ *
+ * Subcommands:
+ *   - `create <keyId> [--env <name>] [--home <dir>]`
+ *   - `export <keyId> [--format=pem|base64|raw-hex] [--home <dir>]`
+ *   - `list [--home <dir>]`
+ *
+ * Every filesystem side-effect flows through `KeyRunners` so tests
+ * substitute stubs — no real key files touch disk during unit tests.
+ * Production wiring lives at `packages/cli/src/key/defaults.ts`.
+ */
+import { parsePublicKeyPem, serializePublicKeyBase64 } from '@kindgi/crypto';
+import { shortFingerprint } from '../key/fingerprint.js';
+import { KEYS_DIR_MODE, KEY_ID_REGEX, PRIVATE_KEY_FILE_MODE, PUBLIC_KEY_FILE_MODE, pickHome, resolveKeyPaths, } from '../key/paths.js';
+import { renderJson } from '../output.js';
+// ---------------------------------------------------------------------
+// Common: runner + home resolution
+// ---------------------------------------------------------------------
+function pickRunners(ctx) {
+    if (ctx.keyRunners !== undefined)
+        return { kind: 'ok', runners: ctx.keyRunners };
+    return {
+        kind: 'error',
+        stderr: 'Internal error: kindgi key requires key runners to be wired. ' +
+            'Rebuild the CLI (`pnpm --filter @kindgi/cli build`).\n',
+        exitCode: 1,
+    };
+}
+function pickHomeFromCtx(ctx) {
+    const flag = ctx.options.home;
+    return pickHome({
+        ...(typeof flag === 'string' && flag !== '' ? { flag } : {}),
+        ...(ctx.home !== undefined ? { ctxHome: ctx.home } : {}),
+        ...(typeof ctx.env.HOME === 'string' && ctx.env.HOME !== '' ? { envHome: ctx.env.HOME } : {}),
+    });
+}
+function validateKeyId(id) {
+    if (id === undefined || id === '') {
+        return { ok: false, error: 'Missing required argument: <keyId>.' };
+    }
+    if (!KEY_ID_REGEX.test(id)) {
+        return {
+            ok: false,
+            error: `Invalid keyId: "${id}". Must match ${KEY_ID_REGEX.source} — lowercase alphanumerics + [-._], starting with an alphanumeric.`,
+        };
+    }
+    return { ok: true, id };
+}
+// ---------------------------------------------------------------------
+// `kindgi key create <keyId> [--env <name>] [--home <dir>]`
+// ---------------------------------------------------------------------
+const createCmd = {
+    kind: 'leaf',
+    name: 'create',
+    description: 'Generate a new Ed25519 keypair under ~/.kindgi/keys/.',
+    usage: 'kindgi key create <keyId> [--env <name>] [--home <dir>]',
+    optionSpec: {
+        env: {
+            type: 'string',
+            description: 'Also print the `signingKey` and `signerKeyId` lines to add to this env block in `kindgi.config.ts`.',
+        },
+        home: {
+            type: 'string',
+            description: 'The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.',
+        },
+    },
+    run: async (ctx) => {
+        const idCheck = validateKeyId(ctx.positionals[0]);
+        if (!idCheck.ok) {
+            return { kind: 'error', stderr: `${idCheck.error}\n`, exitCode: 1 };
+        }
+        const keyId = idCheck.id;
+        const runnersOutcome = pickRunners(ctx);
+        if (runnersOutcome.kind === 'error')
+            return runnersOutcome;
+        const runners = runnersOutcome.runners;
+        const home = pickHomeFromCtx(ctx);
+        const paths = resolveKeyPaths(home);
+        const privPath = paths.privateKeyPath(keyId);
+        const pubPath = paths.publicKeyPath(keyId);
+        // Refuse to overwrite — regenerating a key silently would clobber
+        // production signing material.
+        if (await runners.exists(privPath)) {
+            return {
+                kind: 'error',
+                stderr: `kindgi key create refuses to overwrite: ${privPath} already exists. Delete the existing pair (or pick a different --home) and re-run.\n`,
+                exitCode: 1,
+            };
+        }
+        if (await runners.exists(pubPath)) {
+            return {
+                kind: 'error',
+                stderr: `kindgi key create refuses to overwrite: ${pubPath} already exists. Delete the existing pair (or pick a different --home) and re-run.\n`,
+                exitCode: 1,
+            };
+        }
+        const pair = await runners.generateKeyPair();
+        await runners.mkdir(paths.keysDir, KEYS_DIR_MODE);
+        await runners.writeFile({
+            path: privPath,
+            contents: pair.privateKeyPem,
+            mode: PRIVATE_KEY_FILE_MODE,
+        });
+        await runners.writeFile({
+            path: pubPath,
+            contents: pair.publicKeyPem,
+            mode: PUBLIC_KEY_FILE_MODE,
+        });
+        const fingerprint = shortFingerprint(pair.publicKey);
+        const envFlag = ctx.options.env;
+        const envName = typeof envFlag === 'string' && envFlag !== '' ? envFlag : undefined;
+        const banner = [
+            '',
+            `  ✓ Ed25519 keypair created: ${keyId}`,
+            `    private key:  ${privPath}  (mode 0600)`,
+            `    public key:   ${pubPath}  (mode 0644)`,
+            `    fingerprint:  ${fingerprint}`,
+            '',
+        ];
+        if (envName !== undefined) {
+            banner.push(`  Next step: add to environments.${envName} in kindgi.config.ts:`, '', `    ${envName}: {`, '      // …existing fields…', `      signingKey: '~/.kindgi/keys/${keyId}.pem',`, `      signerKeyId: '${keyId}',`, '    },', '', `  Then \`kindgi build --env=${envName}\` will pick up the key.`, '');
+        }
+        const summary = {
+            keyId,
+            privateKeyPath: privPath,
+            publicKeyPath: pubPath,
+            fingerprint,
+            home,
+            ...(envName !== undefined && { env: envName }),
+        };
+        const rendered = renderJson(summary, ctx.globals.format);
+        return {
+            kind: 'ok',
+            rendered: { stdout: rendered.stdout, stderr: `${banner.join('\n')}\n` },
+        };
+    },
+};
+// ---------------------------------------------------------------------
+// `kindgi key export <keyId> [--format=pem|base64|raw-hex]`
+// ---------------------------------------------------------------------
+const AVAILABLE_FORMATS = ['pem', 'base64', 'raw-hex'];
+const exportCmd = {
+    kind: 'leaf',
+    name: 'export',
+    description: 'Print the PUBLIC key material for a local key. Never exports the private key.',
+    usage: 'kindgi key export <keyId> [--format=pem|base64|raw-hex] [--home <dir>]',
+    optionSpec: {
+        format: {
+            type: 'string',
+            description: "The public key's encoding: `pem` (default), `base64` or `raw-hex`.",
+        },
+        home: {
+            type: 'string',
+            description: 'The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.',
+        },
+    },
+    run: async (ctx) => {
+        const idCheck = validateKeyId(ctx.positionals[0]);
+        if (!idCheck.ok) {
+            return { kind: 'error', stderr: `${idCheck.error}\n`, exitCode: 1 };
+        }
+        const keyId = idCheck.id;
+        const formatFlag = ctx.options.format;
+        const formatInput = typeof formatFlag === 'string' && formatFlag !== '' ? formatFlag : 'pem';
+        if (!AVAILABLE_FORMATS.includes(formatInput)) {
+            return {
+                kind: 'error',
+                stderr: `Unknown --format: ${formatInput}. Available: ${AVAILABLE_FORMATS.join(', ')}.\n`,
+                exitCode: 1,
+            };
+        }
+        const format = formatInput;
+        const runnersOutcome = pickRunners(ctx);
+        if (runnersOutcome.kind === 'error')
+            return runnersOutcome;
+        const runners = runnersOutcome.runners;
+        const home = pickHomeFromCtx(ctx);
+        const paths = resolveKeyPaths(home);
+        const pubPath = paths.publicKeyPath(keyId);
+        const pubPem = await runners.readFile(pubPath);
+        if (pubPem === null) {
+            return {
+                kind: 'error',
+                stderr: `kindgi key export: no public key at ${pubPath}. ` +
+                    `Run \`kindgi key create ${keyId}\` first, or pass --home <dir>.\n`,
+                exitCode: 1,
+            };
+        }
+        if (format === 'pem') {
+            return {
+                kind: 'ok',
+                rendered: { stdout: ensureTrailingNewline(pubPem), stderr: '' },
+            };
+        }
+        const parsed = parsePublicKeyPem(pubPem);
+        if (parsed.kind === 'err') {
+            return {
+                kind: 'error',
+                stderr: `kindgi key export: ${pubPath} is not a valid Ed25519 public key PEM: ` +
+                    `${parsed.error.message}\n`,
+                exitCode: 1,
+            };
+        }
+        if (format === 'base64') {
+            return {
+                kind: 'ok',
+                rendered: {
+                    stdout: `${serializePublicKeyBase64(parsed.value)}\n`,
+                    stderr: '',
+                },
+            };
+        }
+        // raw-hex
+        return {
+            kind: 'ok',
+            rendered: { stdout: `${bytesToHex(parsed.value)}\n`, stderr: '' },
+        };
+    },
+};
+// ---------------------------------------------------------------------
+// `kindgi key list [--home <dir>]`
+// ---------------------------------------------------------------------
+const listCmd = {
+    kind: 'leaf',
+    name: 'list',
+    description: 'List local Ed25519 keys under ~/.kindgi/keys/.',
+    usage: 'kindgi key list [--home <dir>]',
+    optionSpec: {
+        home: {
+            type: 'string',
+            description: 'The home directory whose `.kindgi/keys/` holds the keys. Default: `$HOME`.',
+        },
+    },
+    run: async (ctx) => {
+        const runnersOutcome = pickRunners(ctx);
+        if (runnersOutcome.kind === 'error')
+            return runnersOutcome;
+        const runners = runnersOutcome.runners;
+        const home = pickHomeFromCtx(ctx);
+        const paths = resolveKeyPaths(home);
+        const entries = await runners.readdir(paths.keysDir);
+        const fileNames = new Set(entries.filter((e) => e.isFile).map((e) => e.name));
+        // Match `<keyId>.pem` iff `<keyId>.pub.pem` also present. Orphaned
+        // halves (private only or public only) are silently skipped — the
+        // pair contract is the whole point of the list.
+        const keyIds = [];
+        for (const name of fileNames) {
+            if (!name.endsWith('.pem') || name.endsWith('.pub.pem'))
+                continue;
+            const stem = name.slice(0, -'.pem'.length);
+            const pubName = `${stem}.pub.pem`;
+            if (!fileNames.has(pubName))
+                continue;
+            keyIds.push(stem);
+        }
+        keyIds.sort();
+        const rows = await Promise.all(keyIds.map(async (keyId) => {
+            const pubPath = paths.publicKeyPath(keyId);
+            const pem = await runners.readFile(pubPath);
+            const fingerprint = pem !== null ? shortFingerprint(pem) : 'sha256:(unreadable)';
+            return {
+                keyId,
+                privateKeyPath: paths.privateKeyPath(keyId),
+                publicKeyPath: pubPath,
+                fingerprint,
+            };
+        }));
+        const summary = { keysDir: paths.keysDir, count: rows.length, keys: rows };
+        if (rows.length === 0) {
+            const rendered = renderJson(summary, ctx.globals.format);
+            return {
+                kind: 'ok',
+                rendered: {
+                    stdout: rendered.stdout,
+                    stderr: `\n  (no keys under ${paths.keysDir})\n\n`,
+                },
+            };
+        }
+        const banner = ['', `  ${rows.length} key(s) under ${paths.keysDir}:`, ''];
+        for (const row of rows) {
+            banner.push(`    ${row.keyId}    ${row.fingerprint}`);
+            banner.push(`      private:  ${row.privateKeyPath}`);
+            banner.push(`      public:   ${row.publicKeyPath}`);
+        }
+        banner.push('');
+        const rendered = renderJson(summary, ctx.globals.format);
+        return {
+            kind: 'ok',
+            rendered: { stdout: rendered.stdout, stderr: `${banner.join('\n')}\n` },
+        };
+    },
+};
+// ---------------------------------------------------------------------
+// Group registration
+// ---------------------------------------------------------------------
+export const keyCommand = {
+    kind: 'group',
+    name: 'key',
+    description: "Manage the tenant's local Ed25519 signing keys under ~/.kindgi/keys/.",
+    subcommands: [createCmd, exportCmd, listCmd],
+};
+// ---------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------
+function bytesToHex(bytes) {
+    let s = '';
+    for (const b of bytes) {
+        s += b.toString(16).padStart(2, '0');
+    }
+    return s;
+}
+function ensureTrailingNewline(s) {
+    return s.endsWith('\n') ? s : `${s}\n`;
+}
+//# sourceMappingURL=key.js.map

package/dist/commands/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../src/commands/key.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,QAAQ,EACR,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,wEAAwE;AACxE,mCAAmC;AACnC,wEAAwE;AAExE,SAAS,WAAW,CAClB,GAAmB;IAInB,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACjF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EACJ,+DAA+D;YAC/D,wDAAwD;QAC1D,QAAQ,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,OAAO,QAAQ,CAAC;QACd,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,EAAsB;IAEtB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,YAAY,CAAC,MAAM,oEAAoE;SACrI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED,wEAAwE;AACxE,4DAA4D;AAC5D,wEAAwE;AAExE,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,uDAAuD;IACpE,KAAK,EAAE,yDAAyD;IAChE,UAAU,EAAE;QACV,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EACT,qGAAqG;SACxG;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4EAA4E;SAC1F;KACF;IACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;QAEzB,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,cAAc,CAAC;QAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAE3C,kEAAkE;QAClE,+BAA+B;QAC/B,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,2CAA2C,QAAQ,sFAAsF;gBACjJ,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,2CAA2C,OAAO,sFAAsF;gBAChJ,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,SAAS,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,SAAS,CAAC;YACtB,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpF,MAAM,MAAM,GAAa;YACvB,EAAE;YACF,gCAAgC,KAAK,EAAE;YACvC,qBAAqB,QAAQ,eAAe;YAC5C,qBAAqB,OAAO,eAAe;YAC3C,qBAAqB,WAAW,EAAE;YAClC,EAAE;SACH,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT,oCAAoC,OAAO,uBAAuB,EAClE,EAAE,EACF,OAAO,OAAO,KAAK,EACnB,4BAA4B,EAC5B,qCAAqC,KAAK,QAAQ,EAClD,uBAAuB,KAAK,IAAI,EAChC,QAAQ,EACR,EAAE,EACF,+BAA+B,OAAO,0BAA0B,EAChE,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG;YACd,KAAK;YACL,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO;YACtB,WAAW;YACX,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SAC/C,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;SACxE,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,4DAA4D;AAC5D,wEAAwE;AAExE,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAGhE,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,+EAA+E;IAC5F,KAAK,EAAE,wEAAwE;IAC/E,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,oEAAoE;SAClF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4EAA4E;SAC1F;KACF;IACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC;QAEzB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,WAAW,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7F,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,qBAAqB,WAAW,gBAAgB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACzF,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAA8B,CAAC;QAE9C,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,cAAc,CAAC;QAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EACJ,uCAAuC,OAAO,IAAI;oBAClD,2BAA2B,KAAK,mCAAmC;gBACrE,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;aAChE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EACJ,sBAAsB,OAAO,0CAA0C;oBACvE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI;gBAC7B,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE;oBACR,MAAM,EAAE,GAAG,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;oBACrD,MAAM,EAAE,EAAE;iBACX;aACF,CAAC;QACJ,CAAC;QACD,UAAU;QACV,OAAO;YACL,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SAClE,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,mCAAmC;AACnC,wEAAwE;AAExE,MAAM,OAAO,GAAgB;IAC3B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,gDAAgD;IAC7D,KAAK,EAAE,gCAAgC;IACvC,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,4EAA4E;SAC1F;KACF;IACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;QACzC,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,cAAc,CAAC;QAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9E,mEAAmE;QACnE,kEAAkE;QAClE,gDAAgD;QAChD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAS;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,GAAG,IAAI,UAAU,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,CAAC;QAEd,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACjF,OAAO;gBACL,KAAK;gBACL,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;gBAC3C,aAAa,EAAE,OAAO;gBACtB,WAAW;aACZ,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAE3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,sBAAsB,KAAK,CAAC,OAAO,OAAO;iBACnD;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAa,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,MAAM,iBAAiB,KAAK,CAAC,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;QACrF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;SACxE,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,qBAAqB;AACrB,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAY;IACjC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,uEAAuE;IACpF,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;CAC7C,CAAC;AAEF,wEAAwE;AACxE,UAAU;AACV,wEAAwE;AAExE,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;AACzC,CAAC"}

package/dist/commands/mcp.d.ts

@@ -0,0 +1,43 @@
+import type { Preset } from '../mcp/preset-types.js';
+import { type BinRunner } from '../package-manager.js';
+import type { Command, LeafCommand } from './types.js';
+interface McpServerEntry {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly env?: Readonly<Record<string, string>>;
+}
+/**
+ * Turn `GRIEVANCE_DB_URL` into `grievance_db` — lowercase, replace
+ * non-alphanumeric with `_`, collapse repeats, strip trailing common
+ * secret suffixes. Falls back to `kind` if the result is empty.
+ */
+export declare function defaultServerName(secretName: string, kind: string): string;
+interface ScopeShape {
+    readonly kind: 'tenant' | 'org' | 'project';
+    readonly id?: string;
+    readonly raw: string;
+}
+/**
+ * Build the `.mcp.json` server entry from a preset + user inputs. The
+ * command runs the project-local `kindgi mcp-launch -- <launcher-flags>`
+ * via `runner` (see `binCommand`) — a Python pack's runs the `kindgi` on
+ * `PATH`. The `--` protects the launcher's flags
+ * from the CLI's strict argv parser (see design note at top of file).
+ */
+export declare function buildMcpServerEntry(preset: Preset, secretName: string, envName: string, scope: ScopeShape, runner: BinRunner): McpServerEntry;
+export declare const mcpCommand: Command;
+/**
+ * MCP clients invoke this via `.mcp.json` — the project-local `kindgi`
+ * run through the package manager, args `["mcp-launch", "--",
+ * <launcher-flags>...]`. Everything after the
+ * leading `--` is treated as positional by the CLI's strict parseArgs;
+ * `runLauncher` then re-parses those positionals as its own argv.
+ *
+ * This command owns stdout/stderr for the entire subprocess lifetime —
+ * the launcher spawns its child with `stdio: 'inherit'`, so the MCP
+ * protocol stream flows: [MCP client] ↔ [kindgi mcp-launch] ↔
+ * [MCP server subprocess] transparently.
+ */
+export declare const mcpLaunchCommand: LeafCommand;
+export {};
+//# sourceMappingURL=mcp.d.ts.map

package/dist/commands/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,uBAAuB,CAAC;AAEpF,OAAO,KAAK,EAAE,OAAO,EAAiB,WAAW,EAAE,MAAM,YAAY,CAAC;AAYtE,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAiCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAiB1E;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAeD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,SAAS,GAChB,cAAc,CAmBhB;AA2RD,eAAO,MAAM,UAAU,EAAE,OAKxB,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAc9B,CAAC"}