@kindgi/cli 0.0.0-bootstrap.0 → 0.1.0

package/dist/dev/runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/dev/runners.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,iHAAiH;IACjH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,0FAA0F;IAC1F,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,mFAAmF;QACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC/D,KAAK,WAAW,CAAC;IAClB,gDAAgD;IAChD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,cAAc,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EACtC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CACR;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,IAAI,EACpB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,KACE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACpC"}

package/dist/dev/runners.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=runners.js.map

package/dist/dev/runners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.js","sourceRoot":"","sources":["../../src/dev/runners.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/dev/runtime-container.d.ts

@@ -0,0 +1,62 @@
+export type RuntimeNetwork = 'alias' | 'host-network';
+/** The port the image's server listens on (its `KINDGI_API_PORT`). */
+export declare const IMAGE_API_PORT = 4000;
+export interface DockerOutcome {
+    /** The exit code; `null` when `docker` couldn't be spawned. */
+    readonly code: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** Run one `docker` command to completion. */
+export declare function docker(args: readonly string[]): Promise<DockerOutcome>;
+/**
+ * How this machine's Docker reaches the host: Docker Desktop (any OS)
+ * can't see the host's loopback; a Linux engine can share the host
+ * network.
+ */
+export declare function detectRuntimeNetwork(): Promise<RuntimeNetwork>;
+/** The container for this pack directory: one per pack, so two packs can run side by side. */
+export declare function runtimeContainerName(packDir: string): string;
+/**
+ * Make sure the image is here, pulling it if not. A private image needs
+ * `docker login` first; the error says so.
+ */
+export declare function ensureRuntimeImage(image: string, onProgress: (line: string) => void): Promise<{
+    readonly kind: 'ok';
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+}>;
+export interface RuntimeContainerOptions {
+    readonly image: string;
+    /** The pack directory on the host, mounted at `/pack`. */
+    readonly packDir: string;
+    /** The `runtime.env` file (`docker run --env-file`). */
+    readonly envFile: string;
+    readonly network: RuntimeNetwork;
+    /** The host port the API is reached on (always on `127.0.0.1`). */
+    readonly hostPort: number;
+    /** Credential files mounted read-only, by host path. */
+    readonly googleCredentials?: string;
+    readonly publicTokenKey?: string;
+    /** Every line the runtime writes. */
+    readonly onLog: (line: string) => void;
+}
+export interface RunningRuntimeContainer {
+    readonly name: string;
+    readonly baseUrl: string;
+    /** What the runtime printed until it served: its banner. */
+    readonly banner: string;
+    stop(): Promise<void>;
+}
+/** The `docker run` arguments for the runtime container. */
+export declare function runtimeRunArgs(name: string, options: RuntimeContainerOptions): string[];
+/**
+ * Start the runtime container and wait until it serves. An earlier
+ * container for the same pack (a crashed session) is replaced.
+ */
+export declare function startRuntimeContainer(options: RuntimeContainerOptions, wait?: {
+    readonly timeoutMs?: number;
+    readonly fetch?: typeof fetch;
+}): Promise<RunningRuntimeContainer>;
+//# sourceMappingURL=runtime-container.d.ts.map

package/dist/dev/runtime-container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-container.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-container.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,cAAc,CAAC;AAEtD,sEAAsE;AACtE,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8CAA8C;AAC9C,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CActE;AAMD;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,cAAc,CAAC,CAIpE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAczF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAuBvF;AAKD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GACxE,OAAO,CAAC,uBAAuB,CAAC,CAgElC"}

package/dist/dev/runtime-container.js

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The Kindgi runtime as a container under `kindgi dev`: one
+ * container per pack directory, started with `docker run`, configured
+ * only by `runtime.env`, with the pack directory mounted at `/pack`.
+ *
+ * Nothing it serves is reachable from the network:
+ *   - Docker Desktop (`alias`): the API is published on the host's
+ *     `127.0.0.1` only, and loopback calls from the container (the pack
+ *     service, the app's webhooks) go to `host.docker.internal`.
+ *   - Linux (`host-network`): the container shares the host's network,
+ *     binds `127.0.0.1`, and runs as the developer's user, so files it
+ *     writes into the pack stay theirs.
+ */
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { RUNTIME_GOOGLE_CREDENTIALS, RUNTIME_PACK_DIR, RUNTIME_PUBLIC_TOKEN_KEY, } from './runtime-env.js';
+/** The port the image's server listens on (its `KINDGI_API_PORT`). */
+export const IMAGE_API_PORT = 4000;
+/** Run one `docker` command to completion. */
+export function docker(args) {
+    return new Promise((resolve) => {
+        const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.once('error', (err) => resolve({ code: null, stdout, stderr: err.message }));
+        child.once('close', (code) => resolve({ code, stdout, stderr }));
+    });
+}
+function lastLines(text, n = 5) {
+    return text.trim().split('\n').slice(-n).join('\n');
+}
+/**
+ * How this machine's Docker reaches the host: Docker Desktop (any OS)
+ * can't see the host's loopback; a Linux engine can share the host
+ * network.
+ */
+export async function detectRuntimeNetwork() {
+    if (process.platform !== 'linux')
+        return 'alias';
+    const info = await docker(['info', '--format', '{{.OperatingSystem}}']);
+    return info.code === 0 && /Docker Desktop/i.test(info.stdout) ? 'alias' : 'host-network';
+}
+/** The container for this pack directory: one per pack, so two packs can run side by side. */
+export function runtimeContainerName(packDir) {
+    return `kindgi-dev-runtime-${createHash('sha256').update(packDir).digest('hex').slice(0, 12)}`;
+}
+/**
+ * Make sure the image is here, pulling it if not. A private image needs
+ * `docker login` first; the error says so.
+ */
+export async function ensureRuntimeImage(image, onProgress) {
+    const present = await docker(['image', 'inspect', '--format', '{{.Id}}', image]);
+    if (present.code === 0)
+        return { kind: 'ok' };
+    if (present.code === null) {
+        return { kind: 'error', message: `Docker isn't available: ${present.stderr}` };
+    }
+    onProgress(`Pulling the Kindgi runtime image ${image} (first run only)...`);
+    const pulled = await docker(['pull', image]);
+    if (pulled.code === 0)
+        return { kind: 'ok' };
+    const detail = lastLines(pulled.stderr);
+    const auth = /unauthorized|denied|authentication required/i.test(pulled.stderr)
+        ? `\n  The runtime image is in private preview: request access at contact@kindgi.com, log in with the pull credentials you receive (docker login ${image.split('/')[0]}), then run kindgi dev again.`
+        : '';
+    return { kind: 'error', message: `Couldn't pull ${image}: ${detail}${auth}` };
+}
+/** The `docker run` arguments for the runtime container. */
+export function runtimeRunArgs(name, options) {
+    const args = ['run', '--detach', '--rm', '--name', name, '--env-file', options.envFile];
+    args.push('--volume', `${options.packDir}:${RUNTIME_PACK_DIR}`);
+    if (options.googleCredentials !== undefined) {
+        args.push('--volume', `${options.googleCredentials}:${RUNTIME_GOOGLE_CREDENTIALS}:ro`);
+    }
+    if (options.publicTokenKey !== undefined) {
+        args.push('--volume', `${options.publicTokenKey}:${RUNTIME_PUBLIC_TOKEN_KEY}:ro`);
+    }
+    if (options.network === 'host-network') {
+        args.push('--network', 'host');
+        // Files the runtime writes into the pack (secrets) stay the developer's.
+        if (typeof process.getuid === 'function' && typeof process.getgid === 'function') {
+            args.push('--user', `${process.getuid()}:${process.getgid()}`);
+        }
+    }
+    else {
+        args.push('--publish', `127.0.0.1:${options.hostPort}:${IMAGE_API_PORT}`);
+        // Docker Desktop provides the name; other engines get it this way.
+        args.push('--add-host', 'host.docker.internal:host-gateway');
+    }
+    // The image's own argument (its console), then the dev-echo provider.
+    args.push(options.image, '--console-static-dir', '/app/console', '--dev-echo-provider');
+    return args;
+}
+/** The line every runtime that runs a `kindgi dev` pack prints. */
+const PACK_DIR_BANNER = `  Pack: ${RUNTIME_PACK_DIR} `;
+/**
+ * Start the runtime container and wait until it serves. An earlier
+ * container for the same pack (a crashed session) is replaced.
+ */
+export async function startRuntimeContainer(options, wait = {}) {
+    const name = runtimeContainerName(options.packDir);
+    await docker(['rm', '--force', name]);
+    const started = await docker(runtimeRunArgs(name, options));
+    if (started.code !== 0) {
+        throw new Error(`docker run failed: ${lastLines(started.stderr)}`);
+    }
+    const lines = [];
+    let logs = spawn('docker', ['logs', '--follow', name], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const onChunk = (chunk) => {
+        for (const line of chunk.toString().split('\n')) {
+            if (line === '')
+                continue;
+            lines.push(line);
+            options.onLog(line);
+        }
+    };
+    logs.stdout?.on('data', onChunk);
+    logs.stderr?.on('data', onChunk);
+    const stop = async () => {
+        logs?.kill();
+        logs = undefined;
+        await docker(['stop', '--time', '10', name]);
+    };
+    const baseUrl = `http://127.0.0.1:${options.hostPort}`;
+    const doFetch = wait.fetch ?? fetch;
+    const deadline = Date.now() + (wait.timeoutMs ?? 120_000);
+    for (;;) {
+        const healthy = await doFetch(`${baseUrl}/health`, { signal: AbortSignal.timeout(2_000) })
+            .then((r) => r.ok)
+            .catch(() => false);
+        // Serving, and its banner printed (the pack line comes after the URL).
+        if (healthy && lines.some((l) => l.startsWith(PACK_DIR_BANNER)))
+            break;
+        const running = await docker(['inspect', '--format', '{{.State.Running}}', name]);
+        if (running.code !== 0 || running.stdout.trim() !== 'true') {
+            await stop();
+            throw new Error(`the Kindgi runtime container stopped while starting:\n${lines.slice(-15).join('\n')}`);
+        }
+        // The banner ends with the `Env:` line, after the pack line. Without
+        // the pack line, the image predates the runtime's development settings.
+        if (lines.some((l) => l.startsWith('  Env: ')) &&
+            !lines.some((l) => l.startsWith(PACK_DIR_BANNER))) {
+            await stop();
+            throw new Error(`${options.image} can't run a kindgi dev pack: it predates the runtime's development settings. Use a newer image (--runtime-image).`);
+        }
+        if (Date.now() > deadline) {
+            await stop();
+            throw new Error(`the Kindgi runtime didn't start serving in time:\n${lines.slice(-15).join('\n')}`);
+        }
+        await new Promise((r) => setTimeout(r, 250));
+    }
+    return { name, baseUrl, banner: lines.join('\n'), stop };
+}
+//# sourceMappingURL=runtime-container.js.map

package/dist/dev/runtime-container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-container.js","sourceRoot":"","sources":["../../src/dev/runtime-container.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AASnC,8CAA8C;AAC9C,MAAM,UAAU,MAAM,CAAC,IAAuB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,CAAC,GAAG,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;AAC3F,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,sBAAsB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,UAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,UAAU,CAAC,oCAAoC,KAAK,sBAAsB,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,8CAA8C,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7E,CAAC,CAAC,iJAAiJ,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,+BAA+B;QACrM,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,KAAK,KAAK,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;AAChF,CAAC;AA0BD,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAgC;IAC3E,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,KAAK,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,KAAK,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/B,yEAAyE;QACzE,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAC,CAAC;QAC1E,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,eAAe,GAAG,WAAW,gBAAgB,GAAG,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgC,EAChC,OAAuE,EAAE;IAEzE,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAA6B,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE;QAC/E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,EAAE,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,SAAS,CAAC;QACjB,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,oBAAoB,OAAO,CAAC,QAAQ,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAC1D,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;aACvF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,uEAAuE;QACvE,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAAE,MAAM;QACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,KAAK,oHAAoH,CACrI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC"}

package/dist/dev/runtime-env.d.ts

@@ -0,0 +1,62 @@
+/** Where the pack directory is mounted in the runtime container. */
+export declare const RUNTIME_PACK_DIR = "/pack";
+/** Where read-only credential files are mounted in the runtime container. */
+export declare const RUNTIME_GOOGLE_CREDENTIALS = "/run/kindgi/google-credentials.json";
+export declare const RUNTIME_PUBLIC_TOKEN_KEY = "/run/kindgi/public-token-signing.pem";
+/** `<pack>/.kindgi/dev/runtime.env`. */
+export declare function runtimeEnvPath(packDir: string): string;
+export interface RuntimeEnvInput {
+    /** The port the API listens on, as the runtime sees it. */
+    readonly apiPort: number;
+    /** `KINDGI_API_HOST`: bind loopback (Linux host networking, or a server on the host). */
+    readonly apiHost?: string;
+    /**
+     * `KINDGI_DEV_HOST_ALIAS`: where loopback calls go when the runtime
+     * can't see the host's loopback (Docker Desktop: `host.docker.internal`).
+     */
+    readonly hostAlias?: string;
+    /** The pack directory, as the runtime sees it (`/pack` in the container). */
+    readonly packDir: string;
+    /** Postgres, as the runtime reaches it. */
+    readonly databaseUrl: string;
+    readonly tenantId: string;
+    readonly token: string;
+    readonly seedUserId: string;
+    /** The pack service's front (`http://127.0.0.1:<port>`; through the alias from a container). */
+    readonly packService: {
+        readonly url: string;
+        readonly token: string;
+    };
+    /** `dev.envFiles`; default `.env`, `.env.local`. */
+    readonly localEnvFiles?: readonly string[];
+    /** Browser origins allowed on the run progress routes. */
+    readonly corsOrigins: readonly string[];
+    /** The developer's public run token key file, as the runtime sees it. */
+    readonly publicTokenKeyPath?: string;
+    /** The developer's Google Application Default Credentials, as the runtime sees them. */
+    readonly googleCredentialsPath?: string;
+    /**
+     * Values from the shell for `${VAR}` references the pack's env files
+     * make and don't define. On the machine the server reads them from the
+     * shell; in the container this is its shell.
+     */
+    readonly shellReferences: Readonly<Record<string, string>>;
+}
+/** The runtime container's environment, by name. */
+export declare function buildRuntimeEnv(input: RuntimeEnvInput): Record<string, string>;
+/**
+ * The shell values the runtime needs for the pack's `${VAR}` references:
+ * names the env files refer to without defining, that the shell has.
+ */
+export declare function shellReferencesOf(input: {
+    readonly packDir: string;
+    readonly localEnvFiles?: readonly string[];
+    readonly shellEnv: Readonly<Record<string, string | undefined>>;
+}): Promise<Record<string, string>>;
+/**
+ * Write the env file `docker run --env-file` reads: `NAME=value` lines,
+ * taken literally (no quotes, no expansion), mode 0600, since it holds
+ * the API token. A value with a line break can't be written.
+ */
+export declare function writeRuntimeEnv(path: string, env: Readonly<Record<string, string>>): Promise<void>;
+//# sourceMappingURL=runtime-env.d.ts.map

package/dist/dev/runtime-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-env.ts"],"names":[],"mappings":"AAgBA,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,wCAAwC,CAAC;AAChF,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAE/E,wCAAwC;AACxC,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,yEAAyE;IACzE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAKD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoC9E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACjE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAalC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/dev/runtime-env.js

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The runtime's environment under `kindgi dev`: everything the Kindgi
+ * runtime container is told, written to `<pack>/.kindgi/dev/runtime.env`
+ * (mode 0600) and handed to `docker run --env-file`. The runtime reads
+ * nothing else from the developer's machine. Names are
+ * `@kindgi/env-schema`'s.
+ */
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { LOCAL_ENV_NAME, readPackEnv } from '@kindgi/secrets-dotenv';
+/** Where the pack directory is mounted in the runtime container. */
+export const RUNTIME_PACK_DIR = '/pack';
+/** Where read-only credential files are mounted in the runtime container. */
+export const RUNTIME_GOOGLE_CREDENTIALS = '/run/kindgi/google-credentials.json';
+export const RUNTIME_PUBLIC_TOKEN_KEY = '/run/kindgi/public-token-signing.pem';
+/** `<pack>/.kindgi/dev/runtime.env`. */
+export function runtimeEnvPath(packDir) {
+    return join(packDir, '.kindgi', 'dev', 'runtime.env');
+}
+/** Names whose shell value is a path on the host: never handed to the container. */
+const HOST_PATH_NAMES = new Set(['GOOGLE_APPLICATION_CREDENTIALS']);
+/** The runtime container's environment, by name. */
+export function buildRuntimeEnv(input) {
+    const env = {
+        KINDGI_DEV: 'true',
+        KINDGI_ENV: LOCAL_ENV_NAME,
+        KINDGI_API_PORT: String(input.apiPort),
+        ...(input.apiHost !== undefined && { KINDGI_API_HOST: input.apiHost }),
+        ...(input.hostAlias !== undefined && { KINDGI_DEV_HOST_ALIAS: input.hostAlias }),
+        KINDGI_DATABASE_URL: input.databaseUrl,
+        KINDGI_TENANT_ID: input.tenantId,
+        KINDGI_API_TOKEN: input.token,
+        KINDGI_SEED_USER_ID: input.seedUserId,
+        KINDGI_PACK_DIR: input.packDir,
+        KINDGI_DEV_CONSOLE_LOGIN: 'true',
+        KINDGI_SECRETS_BACKEND: 'dotenv',
+        KINDGI_SECRETS_DOTENV_DIR: input.packDir,
+        ...(input.localEnvFiles !== undefined && {
+            KINDGI_SECRETS_DOTENV_FILES: input.localEnvFiles.join(','),
+        }),
+        KINDGI_PACK_SERVICE_URL: input.packService.url,
+        KINDGI_PACK_SERVICE_TOKEN: input.packService.token,
+        ...(input.corsOrigins.length > 0 && { KINDGI_CORS_ORIGINS: input.corsOrigins.join(',') }),
+        ...(input.publicTokenKeyPath !== undefined && {
+            KINDGI_PUBLIC_TOKEN_SIGNING_KEY_PATH: input.publicTokenKeyPath,
+        }),
+        ...(input.googleCredentialsPath !== undefined && {
+            GOOGLE_APPLICATION_CREDENTIALS: input.googleCredentialsPath,
+        }),
+    };
+    for (const [name, value] of Object.entries(input.shellReferences)) {
+        // The runtime's own settings come from kindgi dev, never from a
+        // reference; a host path to credentials means nothing in the
+        // container (they're mounted, at a path of its own).
+        if (name.startsWith('KINDGI_') || name in env || HOST_PATH_NAMES.has(name))
+            continue;
+        env[name] = value;
+    }
+    return env;
+}
+/**
+ * The shell values the runtime needs for the pack's `${VAR}` references:
+ * names the env files refer to without defining, that the shell has.
+ */
+export async function shellReferencesOf(input) {
+    const files = await readPackEnv({
+        packDir: input.packDir,
+        envName: LOCAL_ENV_NAME,
+        ...(input.localEnvFiles !== undefined && { localEnvFiles: input.localEnvFiles }),
+    });
+    const out = {};
+    for (const d of files.diagnostics) {
+        if (d.kind !== 'unresolved')
+            continue;
+        const value = input.shellEnv[d.ref];
+        if (value !== undefined)
+            out[d.ref] = value;
+    }
+    return out;
+}
+/**
+ * Write the env file `docker run --env-file` reads: `NAME=value` lines,
+ * taken literally (no quotes, no expansion), mode 0600, since it holds
+ * the API token. A value with a line break can't be written.
+ */
+export async function writeRuntimeEnv(path, env) {
+    const lines = Object.entries(env).map(([name, value]) => {
+        if (/[\r\n]/.test(value)) {
+            throw new Error(`${name} has a line break, which an env file can't hold.`);
+        }
+        return `${name}=${value}`;
+    });
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `# Written by kindgi dev for the Kindgi runtime container. Holds the dev token: keep it private.\n${lines.join('\n')}\n`, { mode: 0o600 });
+    // An existing file keeps its mode through writeFile: set it.
+    await chmod(path, 0o600);
+}
+//# sourceMappingURL=runtime-env.js.map

package/dist/dev/runtime-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../../src/dev/runtime-env.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErE,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;AAE/E,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC;AAqCD,oFAAoF;AACpF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;AAEzF,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,GAAG,GAA2B;QAClC,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,cAAc;QAC1B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAChF,mBAAmB,EAAE,KAAK,CAAC,WAAW;QACtC,gBAAgB,EAAE,KAAK,CAAC,QAAQ;QAChC,gBAAgB,EAAE,KAAK,CAAC,KAAK;QAC7B,mBAAmB,EAAE,KAAK,CAAC,UAAU;QACrC,eAAe,EAAE,KAAK,CAAC,OAAO;QAC9B,wBAAwB,EAAE,MAAM;QAChC,sBAAsB,EAAE,QAAQ;QAChC,yBAAyB,EAAE,KAAK,CAAC,OAAO;QACxC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI;YACvC,2BAA2B,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;SAC3D,CAAC;QACF,uBAAuB,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;QAC9C,yBAAyB,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK;QAClD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI;YAC5C,oCAAoC,EAAE,KAAK,CAAC,kBAAkB;SAC/D,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI;YAC/C,8BAA8B,EAAE,KAAK,CAAC,qBAAqB;SAC5D,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,qDAAqD;QACrD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACrF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAIvC;IACC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,cAAc;QACvB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;KACjF,CAAC,CAAC;IACH,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,GAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CACb,IAAI,EACJ,oGAAoG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EACxH,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,6DAA6D;IAC7D,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/dev/runtime-image.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The Kindgi runtime image `kindgi dev` runs. One place names
+ * it, so a release pins the image it was tested with and a pull token
+ * can drop in later. `--runtime-image` overrides it.
+ *
+ * Pinned by digest, not tag: Docker doesn't re-pull a tag it already has, so
+ * a tag would leave anyone with an older pull on an older runtime.
+ *
+ * The image is in private preview on Quay (pull credentials on request at
+ * contact@kindgi.com, then `docker login quay.io`).
+ */
+export declare const DEFAULT_RUNTIME_IMAGE = "quay.io/kindgi/runtime:0.1.0@sha256:91cb164f17c0754d56d6f09783dad00748eff3e9906bdd3f49f45747cf49c5b2";
+//# sourceMappingURL=runtime-image.d.ts.map

package/dist/dev/runtime-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,yGACsE,CAAC"}

package/dist/dev/runtime-image.js

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The Kindgi runtime image `kindgi dev` runs. One place names
+ * it, so a release pins the image it was tested with and a pull token
+ * can drop in later. `--runtime-image` overrides it.
+ *
+ * Pinned by digest, not tag: Docker doesn't re-pull a tag it already has, so
+ * a tag would leave anyone with an older pull on an older runtime.
+ *
+ * The image is in private preview on Quay (pull credentials on request at
+ * contact@kindgi.com, then `docker login quay.io`).
+ */
+export const DEFAULT_RUNTIME_IMAGE = 'quay.io/kindgi/runtime:0.1.0@sha256:91cb164f17c0754d56d6f09783dad00748eff3e9906bdd3f49f45747cf49c5b2';
+//# sourceMappingURL=runtime-image.js.map

package/dist/dev/runtime-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image.js","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,sGAAsG,CAAC"}

package/dist/env/defaults.d.ts

@@ -0,0 +1,3 @@
+import type { EnvRunners } from './runners.js';
+export declare const REAL_ENV_RUNNERS: EnvRunners;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/env/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/env/defaults.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,eAAO,MAAM,gBAAgB,EAAE,UAY9B,CAAC"}

package/dist/env/defaults.js

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Production wiring for `kindgi env`. Loaded lazily by `main.ts`.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+export const REAL_ENV_RUNNERS = {
+    readFile: async (path) => {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    },
+    writeFile: async (path, contents) => {
+        await writeFile(path, contents, 'utf8');
+    },
+};
+//# sourceMappingURL=defaults.js.map

package/dist/env/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/env/defaults.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAClC,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC"}

package/dist/env/pack-env-plan.d.ts

@@ -0,0 +1,70 @@
+/** Where a declared name's value comes from in one environment. */
+export type PackEnvSource = {
+    readonly kind: 'value';
+    readonly value: string;
+} | {
+    readonly kind: 'secret';
+    /** The Secret Manager secret id. */
+    readonly secret: string;
+    /** A version number, or `latest`. */
+    readonly version: string;
+    /** The number of the project that holds it, when it isn't the service's own. */
+    readonly project?: string;
+};
+export interface PackEnvPlanEntry {
+    readonly name: string;
+    readonly required: boolean;
+    /** Absent: the environment gives it no value. */
+    readonly source?: PackEnvSource;
+}
+export interface PackEnvPlan {
+    readonly envName: string;
+    /** Declared names, required ones first, each group sorted. */
+    readonly entries: readonly PackEnvPlanEntry[];
+    /** Required names the environment gives no value. */
+    readonly missing: readonly string[];
+    /** What makes the plan unusable: a secret as a plain value, a malformed entry. */
+    readonly problems: readonly string[];
+    /** Worth knowing, not blocking: `latest` versions, values for undeclared names. */
+    readonly warnings: readonly string[];
+}
+/** Whether a name looks like it holds a secret (`*_KEY`, `*_TOKEN`, `*_PASSWORD`, …). */
+export declare function isSecretShapedName(name: string): boolean;
+/** Whether a value carries a credential: a URL with a password (`postgres://user:pass@host/db`). */
+export declare function carriesCredential(value: string): boolean;
+/**
+ * Why `value` can't be given in the clear under `name`, or `undefined`
+ * when it can. The one check behind `kindgi env plan`, the deploy
+ * preflight and `kindgi deploy --sync-secrets`'s warning.
+ */
+export declare function plainSecretReason(name: string, value: string): string | undefined;
+/** `environments.<envName>.env` from a loaded config: each name's source, and what's malformed. */
+export declare function readEnvironmentEnv(config: Readonly<Record<string, unknown>> | undefined, envName: string): {
+    readonly sources: ReadonlyMap<string, PackEnvSource>;
+    readonly problems: readonly string[];
+};
+/**
+ * The plan for `envName`: the pack's declaration (from `config.env`)
+ * against that environment's sources. `err` when the declaration itself
+ * is malformed, the same check the indexer runs.
+ */
+export declare function planPackEnv(config: Readonly<Record<string, unknown>> | undefined, envName: string): {
+    readonly kind: 'ok';
+    readonly plan: PackEnvPlan;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/** A secret source as Cloud Run takes it: `SECRET:VERSION`, or the full name for another project. */
+export declare function secretReference(source: Extract<PackEnvSource, {
+    kind: 'secret';
+}>): string;
+/**
+ * The Terraform input for the pack service's revision: `env` (plain
+ * values) and `secret_env` (references), as JSON.
+ */
+export declare function renderTerraform(plan: PackEnvPlan): string;
+/** `gcloud run deploy` flags: `--set-env-vars` and `--set-secrets`, one per line. */
+export declare function renderGcloud(plan: PackEnvPlan): string;
+export declare function describePackEnvPlan(plan: PackEnvPlan): string[];
+//# sourceMappingURL=pack-env-plan.d.ts.map

package/dist/env/pack-env-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-env-plan.d.ts","sourceRoot":"","sources":["../../src/env/pack-env-plan.ts"],"names":[],"mappings":"AAsBA,mEAAmE;AACnE,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AASD,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjF;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACrD,OAAO,EAAE,MAAM,GACd;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA2BhG;AA0BD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACrD,OAAO,EAAE,MAAM,GAEb;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAsCrD;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAAG,MAAM,CAM1F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAezD;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAYtD;AA0BD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAe/D"}