@kindgi/cli 0.0.0-bootstrap.0 → 0.1.0

package/dist/mcp/launcher.js

@@ -0,0 +1,393 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * `kindgi mcp-launch` — the subprocess wrapper that spawns an MCP
+ * server with secrets injected from the pack's env files — the same
+ * files, read the same way, as Kindgi's dev-mode `SecretBinding`
+ * (`@kindgi/secrets-dotenv`): for `local`, the project's `.env` then
+ * `.env.local` (or `dev.envFiles`); otherwise `.env.<envName>`.
+ *
+ * Design goals:
+ *   - **Generic** — no per-server logic. Works for any Node package
+ *     invocable via `npx`, or any Docker image, that reads its
+ *     credentials from environment variables.
+ *   - **Portable across MCP clients** — a `.mcp.json` entry running the
+ *     project's `kindgi mcp-launch …` (via its package manager, e.g.
+ *     `pnpm exec kindgi`) works identically for Claude Code, Cursor,
+ *     VS Code, Claude Desktop, Windsurf, or anything else that speaks
+ *     the MCP config shape.
+ *   - **Secrets stay outside the model's context** — the DB URL /
+ *     token flows: SecretBinding → this process's memory → child
+ *     process's env. Never in argv (visible via `ps aux`); never in
+ *     `.mcp.json` (visible via any Read tool the model calls).
+ *
+ * Argv shape:
+ *
+ *     kindgi mcp-launch \
+ *       --runtime=<npx|docker> \
+ *       --package=<npm-package-or-docker-image> \
+ *       --env-map=VAR=secret:NAME@envName:scopeKind[:scopeId] \  (repeatable)
+ *       [--pack-dir=<abs-path>] \
+ *       [--host-remap=docker-desktop] \
+ *       -- <passthrough args forwarded to the child process>
+ *
+ * `--host-remap=docker-desktop` rewrites `localhost` / `127.0.0.1` in
+ * resolved secret VALUES to `host.docker.internal` — the Mac/Windows
+ * Docker escape hatch. Only applied when the runtime is `docker`.
+ *
+ * Exit codes:
+ *   - 0 (or child's exit code) — child ran to completion
+ *   - 2 — argv parse error
+ *   - 3 — secret resolution error (missing env file, missing secret)
+ *   - 4 — spawn error (child couldn't start)
+ */
+import { spawn as nodeSpawn } from 'node:child_process';
+import { readFile as nodeReadFile } from 'node:fs/promises';
+import { parseArgs as nodeParseArgs } from 'node:util';
+import { displayEnvPath, packValues, readPackEnv } from '@kindgi/secrets-dotenv';
+import { loadLocalEnvSettings } from '../env/project-env.js';
+// ---------------------------------------------------------------------
+// Argv parsing
+// ---------------------------------------------------------------------
+const RUNTIMES = new Set(['npx', 'docker']);
+const HOST_REMAPS = new Set(['docker-desktop']);
+/**
+ * Parse a single `--env-map` value: `VAR=secret:NAME@envName:scopeKind[:scopeId]`.
+ * Returns null on malformed input; caller decides error phrasing.
+ */
+export function parseEnvMapFlag(raw) {
+    const eq = raw.indexOf('=');
+    if (eq <= 0)
+        return null;
+    const child = raw.slice(0, eq).trim();
+    if (child === '')
+        return null;
+    const refRaw = raw.slice(eq + 1);
+    const ref = parseSecretRef(refRaw);
+    if (ref === null)
+        return null;
+    return { child, ref };
+}
+/**
+ * Parse a secret reference: `secret:NAME@envName:scopeKind[:scopeId]`.
+ *
+ *   - `secret:GRIEVANCE_DB_URL@local:tenant`
+ *   - `secret:X@local:project:pack-a`
+ *   - `secret:X@local:org:acme`
+ */
+export function parseSecretRef(raw) {
+    if (!raw.startsWith('secret:'))
+        return null;
+    const body = raw.slice('secret:'.length);
+    const atSign = body.indexOf('@');
+    if (atSign <= 0)
+        return null;
+    const name = body.slice(0, atSign);
+    const tail = body.slice(atSign + 1);
+    const parts = tail.split(':');
+    if (parts.length < 2)
+        return null;
+    const envName = parts[0];
+    const scopeKind = parts[1];
+    if (envName === undefined || envName === '')
+        return null;
+    if (scopeKind !== 'tenant' && scopeKind !== 'org' && scopeKind !== 'project')
+        return null;
+    if (scopeKind === 'tenant') {
+        if (parts.length !== 2)
+            return null;
+        return { name, envName, scopeKind };
+    }
+    // org / project must carry a scopeId
+    if (parts.length !== 3)
+        return null;
+    const scopeId = parts[2];
+    if (scopeId === undefined || scopeId === '')
+        return null;
+    return { name, envName, scopeKind, scopeId };
+}
+/**
+ * Parse the full launcher argv. Everything after a bare `--` token is
+ * treated as passthrough to the child.
+ */
+export function parseLauncherArgs(argv) {
+    const dashDash = argv.indexOf('--');
+    const launcherArgv = dashDash >= 0 ? argv.slice(0, dashDash) : argv;
+    const passthroughArgs = dashDash >= 0 ? argv.slice(dashDash + 1) : [];
+    let parsed;
+    try {
+        parsed = nodeParseArgs({
+            args: [...launcherArgv],
+            options: {
+                runtime: { type: 'string' },
+                package: { type: 'string' },
+                'env-map': { type: 'string', multiple: true },
+                'pack-dir': { type: 'string' },
+                'host-remap': { type: 'string' },
+            },
+            strict: true,
+            allowPositionals: false,
+        });
+    }
+    catch (err) {
+        return { kind: 'err', message: `Bad launcher argv: ${err.message}` };
+    }
+    const runtimeRaw = parsed.values.runtime;
+    if (typeof runtimeRaw !== 'string') {
+        return { kind: 'err', message: 'Missing required --runtime=<npx|docker>' };
+    }
+    if (!RUNTIMES.has(runtimeRaw)) {
+        return {
+            kind: 'err',
+            message: `Invalid --runtime "${runtimeRaw}". Accepted: npx, docker.`,
+        };
+    }
+    const runtime = runtimeRaw;
+    const packageName = parsed.values.package;
+    if (typeof packageName !== 'string' || packageName === '') {
+        return { kind: 'err', message: 'Missing required --package=<npm-package-or-docker-image>' };
+    }
+    const envMapRaws = parsed.values['env-map'] ?? [];
+    const envMap = [];
+    for (const raw of envMapRaws) {
+        const entry = parseEnvMapFlag(raw);
+        if (entry === null) {
+            return {
+                kind: 'err',
+                message: `Bad --env-map "${raw}". Expected VAR=secret:NAME@envName:scopeKind[:scopeId].`,
+            };
+        }
+        envMap.push(entry);
+    }
+    const packDir = parsed.values['pack-dir'] ?? process.cwd();
+    const hostRemapRaw = parsed.values['host-remap'];
+    let hostRemap;
+    if (hostRemapRaw !== undefined) {
+        if (!HOST_REMAPS.has(hostRemapRaw)) {
+            return {
+                kind: 'err',
+                message: `Invalid --host-remap "${hostRemapRaw}". Accepted: docker-desktop.`,
+            };
+        }
+        hostRemap = hostRemapRaw;
+    }
+    return {
+        kind: 'ok',
+        args: {
+            runtime,
+            package: packageName,
+            envMap,
+            packDir,
+            ...(hostRemap !== undefined && { hostRemap }),
+            passthroughArgs,
+        },
+    };
+}
+// ---------------------------------------------------------------------
+// Secret resolution
+// ---------------------------------------------------------------------
+/**
+ * Resolve every env-map entry against the pack's env files for its
+ * environment (`@kindgi/secrets-dotenv`'s `readPackEnv`). Each
+ * environment's files are read once. The dev store is scope-blind, so
+ * `scopeKind` / `scopeId` are recorded but not used for lookup;
+ * `KINDGI_*` names are runtime config and never resolve here.
+ */
+export async function resolveSecrets(entries, packDir, readFile, options = {}) {
+    const byEnv = new Map();
+    const readOrNull = async (path) => {
+        try {
+            return await readFile(path);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    };
+    const load = async (envName) => {
+        const cached = byEnv.get(envName);
+        if (cached !== undefined)
+            return cached;
+        const env = await readPackEnv({
+            packDir,
+            envName,
+            readFile: readOrNull,
+            ...(options.localEnvFiles !== undefined && { localEnvFiles: options.localEnvFiles }),
+        });
+        byEnv.set(envName, env);
+        return env;
+    };
+    const label = (paths) => paths.map((p) => displayEnvPath(packDir, p)).join(', ');
+    const resolved = {};
+    for (const entry of entries) {
+        const { name, envName, scopeKind, scopeId } = entry.ref;
+        let env;
+        try {
+            env = await load(envName);
+        }
+        catch (err) {
+            return {
+                kind: 'err',
+                message: `Failed to read env files for "${envName}": ${err.message}`,
+            };
+        }
+        const setHint = `Run \`kindgi secrets set ${name} --env=${envName} --scope=${scopeKind}${scopeId !== undefined ? `:${scopeId}` : ''}\` first.`;
+        if (env.present.length === 0) {
+            return {
+                kind: 'err',
+                message: `No env files for env "${envName}" at ${packDir} (looked for ${label(env.files.read)}). ${setHint}`,
+            };
+        }
+        const secrets = packValues(env.values);
+        if (!Object.hasOwn(secrets, name)) {
+            return {
+                kind: 'err',
+                message: `Secret "${name}" not found in ${label(env.present)}. Available: ${Object.keys(secrets).sort().join(', ') || '(none)'}. ${setHint}`,
+            };
+        }
+        resolved[entry.child] = secrets[name];
+    }
+    return { kind: 'ok', env: resolved };
+}
+// ---------------------------------------------------------------------
+// Host remap — Docker-Desktop escape hatch for localhost DBs
+// ---------------------------------------------------------------------
+/**
+ * Rewrite `localhost` / `127.0.0.1` in a value to `host.docker.internal`
+ * when `mode === 'docker-desktop'`. Applied to every resolved secret
+ * value before injecting into the child's env, but only when the child
+ * is a Docker container (the launcher decides at call time).
+ *
+ * Not URL-parsing-based; we don't want to shred a value we don't
+ * understand. Simple string replacement on the two known host tokens.
+ * Real edge cases (nested URLs, IPv6 `::1`) can be added if a real
+ * consumer surfaces them.
+ */
+export function applyHostRemap(value, mode) {
+    if (mode !== 'docker-desktop')
+        return value;
+    return value
+        .replace(/@localhost([:/])/g, '@host.docker.internal$1')
+        .replace(/@127\.0\.0\.1([:/])/g, '@host.docker.internal$1');
+}
+// ---------------------------------------------------------------------
+// Build the child command
+// ---------------------------------------------------------------------
+/**
+ * Compose the (cmd, args, extraEnv) triple to spawn. Deterministic —
+ * no side effects — so it's trivially testable. Docker-runtime host
+ * remap is applied here because it's per-value transformation.
+ */
+export function buildChildCommand(parsed, resolvedEnv) {
+    const remapped = {};
+    for (const [key, value] of Object.entries(resolvedEnv)) {
+        remapped[key] = parsed.runtime === 'docker' ? applyHostRemap(value, parsed.hostRemap) : value;
+    }
+    if (parsed.runtime === 'npx') {
+        return {
+            cmd: 'npx',
+            args: ['-y', parsed.package, ...parsed.passthroughArgs],
+            extraEnv: remapped,
+        };
+    }
+    // docker
+    const passthroughEnvFlags = [];
+    for (const key of Object.keys(remapped).sort()) {
+        passthroughEnvFlags.push('-e', key);
+    }
+    return {
+        cmd: 'docker',
+        args: ['run', '-i', '--rm', ...passthroughEnvFlags, parsed.package, ...parsed.passthroughArgs],
+        extraEnv: remapped,
+    };
+}
+const DEFAULT_DEPS = {
+    readFile: (path) => nodeReadFile(path, 'utf8'),
+    localEnvSettings: (packDir) => loadLocalEnvSettings({ buildConfigLoader: undefined }, packDir),
+    spawn: nodeSpawn,
+    stderr: (msg) => process.stderr.write(msg),
+    onSignal: (handler) => {
+        const wrapped = (sig) => handler(sig);
+        process.on('SIGINT', wrapped);
+        process.on('SIGTERM', wrapped);
+        return () => {
+            process.off('SIGINT', wrapped);
+            process.off('SIGTERM', wrapped);
+        };
+    },
+};
+/**
+ * Run the launcher end-to-end. Returns the effective exit code so a
+ * caller (the CLI) can `process.exit(code)`.
+ */
+export async function runLauncher(argv, overrides = {}) {
+    const deps = { ...DEFAULT_DEPS, ...overrides };
+    const parsed = parseLauncherArgs(argv);
+    if (parsed.kind === 'err') {
+        deps.stderr(`kindgi mcp-launch: ${parsed.message}\n`);
+        return 2;
+    }
+    const settings = await deps.localEnvSettings(parsed.args.packDir);
+    if (settings.kind === 'error') {
+        deps.stderr(`kindgi mcp-launch: ${settings.message}\n`);
+        return 3;
+    }
+    const resolved = await resolveSecrets(parsed.args.envMap, parsed.args.packDir, deps.readFile, {
+        ...(settings.localEnvFiles !== undefined && { localEnvFiles: settings.localEnvFiles }),
+    });
+    if (resolved.kind === 'err') {
+        deps.stderr(`kindgi mcp-launch: ${resolved.message}\n`);
+        return 3;
+    }
+    const child = buildChildCommand(parsed.args, resolved.env);
+    let subprocess;
+    try {
+        subprocess = deps.spawn(child.cmd, [...child.args], {
+            env: { ...process.env, ...child.extraEnv },
+            stdio: 'inherit',
+        });
+    }
+    catch (err) {
+        deps.stderr(`kindgi mcp-launch: spawn failed: ${err.message}\n`);
+        return 4;
+    }
+    const unsubscribe = deps.onSignal((sig) => {
+        if (!subprocess.killed)
+            subprocess.kill(sig);
+    });
+    return await new Promise((resolve) => {
+        subprocess.once('exit', (code, signal) => {
+            unsubscribe();
+            if (code !== null)
+                return resolve(code);
+            // Killed by signal — mirror shell convention (128 + signal number)
+            const signalNum = signal !== null ? signalNumber(signal) : 0;
+            return resolve(128 + signalNum);
+        });
+        subprocess.once('error', (err) => {
+            unsubscribe();
+            deps.stderr(`kindgi mcp-launch: child error: ${err.message}\n`);
+            return resolve(4);
+        });
+    });
+}
+function signalNumber(signal) {
+    // Minimal table — matches shell convention. Only entries we're
+    // likely to see; unknowns fall back to 0 (128 = "killed by unknown").
+    switch (signal) {
+        case 'SIGHUP':
+            return 1;
+        case 'SIGINT':
+            return 2;
+        case 'SIGQUIT':
+            return 3;
+        case 'SIGKILL':
+            return 9;
+        case 'SIGTERM':
+            return 15;
+        default:
+            return 0;
+    }
+}
+//# sourceMappingURL=launcher.js.map

package/dist/mcp/launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../src/mcp/launcher.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAgB,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE/F,OAAO,EAAyB,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AA6CpF,wEAAwE;AACxE,eAAe;AACf,wEAAwE;AAExE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAc,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IACD,qCAAqC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,eAAe,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC;YACrB,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC;YACvB,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC;YACD,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAuB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAqB,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,sBAAsB,UAAU,2BAA2B;SACrE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAqB,CAAC;IAEtC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,UAAU,GAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAA0B,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,kBAAkB,GAAG,0DAA0D;aACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAwB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEnF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAC;IACvE,IAAI,SAAgC,CAAC;IACrC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAyB,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,yBAAyB,YAAY,8BAA8B;aAC7E,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,YAAyB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,IAAI,EAAE;YACJ,OAAO;YACP,OAAO,EAAE,WAAW;YACpB,MAAM;YACN,OAAO;YACP,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,eAAe;SAChB;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,oBAAoB;AACpB,wEAAwE;AAExE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA+B,EAC/B,OAAe,EACf,QAA2C,EAC3C,UAA0D,EAAE;IAE5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAoB,EAAE;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;YAC5B,OAAO;YACP,OAAO;YACP,QAAQ,EAAE,UAAU;YACpB,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACrF,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAU,EAAE,CACjD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC;QACxD,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,iCAAiC,OAAO,MAAO,GAAa,CAAC,OAAO,EAAE;aAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,4BAA4B,IAAI,UAAU,OAAO,YAAY,SAAS,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAC/I,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,yBAAyB,OAAO,QAAQ,OAAO,gBAAgB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,EAAE;aAC7G,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,WAAW,IAAI,kBAAkB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE;aAC7I,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAW,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,6DAA6D;AAC7D,wEAAwE;AAExE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAA2B;IACvE,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,KAAK;SACT,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACvD,OAAO,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,CAAC;AAChE,CAAC;AAED,wEAAwE;AACxE,0BAA0B;AAC1B,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,WAA6C;IAE7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC;YACvD,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAED,SAAS;IACT,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9F,QAAQ,EAAE,QAAQ;KACnB,CAAC;AACJ,CAAC;AAeD,MAAM,YAAY,GAAoB;IACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC;IAC9F,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC1C,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,YAAsC,EAAE;IAExC,MAAM,IAAI,GAAoB,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,sBAAsB,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE;QAC5F,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,sBAAsB,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE3D,IAAI,UAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;YAClD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;YAC1C,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,oCAAqC,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACvC,WAAW,EAAE,CAAC;YACd,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,mEAAmE;YACnE,MAAM,SAAS,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC/B,WAAW,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,mCAAmC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAAsB;IAC1C,+DAA+D;IAC/D,sEAAsE;IACtE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/mcp/preset-loader.d.ts

@@ -0,0 +1,29 @@
+import type { Preset, PresetSummary } from './preset-types.js';
+export declare function defaultPresetsRoot(): string;
+export interface PresetIO {
+    readonly readdir: (path: string) => Promise<readonly string[]>;
+    readonly readFile: (path: string) => Promise<string>;
+}
+export type LoadPresetsResult = {
+    readonly kind: 'ok';
+    readonly presets: Readonly<Record<string, Preset>>;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/**
+ * Read every `*.json` file in the presets directory, parse + validate
+ * each, and key the resulting map by preset `kind`. Malformed files
+ * accumulate into an error rather than being silently skipped — a
+ * broken preset should fail loudly in dev so we catch schema drift
+ * during authoring, not in production.
+ */
+export declare function loadPresets(dir?: string, io?: PresetIO): Promise<LoadPresetsResult>;
+/**
+ * Convenience — `null` when the preset doesn't exist. Callers surface
+ * the message with the available list.
+ */
+export declare function getPreset(presets: Readonly<Record<string, Preset>>, kind: string): Preset | null;
+/** Summary rows for `kindgi mcp presets`. */
+export declare function listPresetSummaries(presets: Readonly<Record<string, Preset>>): readonly PresetSummary[];
+//# sourceMappingURL=preset-loader.d.ts.map

package/dist/mcp/preset-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset-loader.d.ts","sourceRoot":"","sources":["../../src/mcp/preset-loader.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAM/D,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAOD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,GAAE,MAA6B,EAClC,EAAE,GAAE,QAAqB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAmD5B;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhG;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACxC,SAAS,aAAa,EAAE,CAU1B"}

package/dist/mcp/preset-loader.js

@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Load `kindgi mcp` presets from JSON files on disk. Presets ship
+ * inside the CLI package (`packages/cli/src/mcp/presets/`) and are
+ * copied to `dist/mcp/presets/` by `copy-build-assets.mjs` so the
+ * published tarball is self-contained.
+ *
+ * Test-friendly: `loadPresets(dir, reader)` accepts an explicit
+ * directory + reader pair so tests can point at fixture dirs. The
+ * default resolves to `<this-file's-dir>/presets/`.
+ */
+import { readFile as nodeReadFile, readdir as nodeReaddir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// Colocated with this loader — `src/mcp/presets/*.json` at source,
+// `dist/mcp/presets/*.json` at built time.
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export function defaultPresetsRoot() {
+    return join(__dirname, 'presets');
+}
+const DEFAULT_IO = {
+    readdir: async (path) => nodeReaddir(path),
+    readFile: async (path) => nodeReadFile(path, 'utf8'),
+};
+/**
+ * Read every `*.json` file in the presets directory, parse + validate
+ * each, and key the resulting map by preset `kind`. Malformed files
+ * accumulate into an error rather than being silently skipped — a
+ * broken preset should fail loudly in dev so we catch schema drift
+ * during authoring, not in production.
+ */
+export async function loadPresets(dir = defaultPresetsRoot(), io = DEFAULT_IO) {
+    let entries;
+    try {
+        entries = await io.readdir(dir);
+    }
+    catch (err) {
+        return { kind: 'err', message: `Failed to read presets dir ${dir}: ${err.message}` };
+    }
+    const jsonFiles = entries.filter((n) => n.endsWith('.json')).sort();
+    const presets = {};
+    const errors = [];
+    for (const file of jsonFiles) {
+        const path = join(dir, file);
+        let raw;
+        try {
+            raw = await io.readFile(path);
+        }
+        catch (err) {
+            errors.push(`${file}: read failed — ${err.message}`);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            errors.push(`${file}: invalid JSON — ${err.message}`);
+            continue;
+        }
+        const validated = validatePreset(parsed);
+        if (validated.kind === 'err') {
+            errors.push(`${file}: ${validated.message}`);
+            continue;
+        }
+        const preset = validated.preset;
+        // Sanity-check the filename matches `kind` — catches renames that
+        // leave the JSON out of sync.
+        const expectedStem = file.replace(/\.json$/, '');
+        if (preset.kind !== expectedStem) {
+            errors.push(`${file}: preset kind "${preset.kind}" does not match filename stem "${expectedStem}"`);
+            continue;
+        }
+        if (presets[preset.kind] !== undefined) {
+            errors.push(`${file}: duplicate preset kind "${preset.kind}"`);
+            continue;
+        }
+        presets[preset.kind] = preset;
+    }
+    if (errors.length > 0) {
+        return { kind: 'err', message: `Preset load errors:\n  ${errors.join('\n  ')}` };
+    }
+    return { kind: 'ok', presets };
+}
+/**
+ * Convenience — `null` when the preset doesn't exist. Callers surface
+ * the message with the available list.
+ */
+export function getPreset(presets, kind) {
+    return presets[kind] ?? null;
+}
+/** Summary rows for `kindgi mcp presets`. */
+export function listPresetSummaries(presets) {
+    return Object.values(presets)
+        .map((p) => ({
+        kind: p.kind,
+        runtime: p.runtime,
+        package: p.package,
+        ...(p.description !== undefined && { description: p.description }),
+        audit: p.audit,
+    }))
+        .sort((a, b) => a.kind.localeCompare(b.kind));
+}
+function validatePreset(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        return { kind: 'err', message: 'preset must be a JSON object' };
+    }
+    const obj = input;
+    const kind = obj.kind;
+    if (typeof kind !== 'string' || kind === '') {
+        return { kind: 'err', message: 'preset.kind must be a non-empty string' };
+    }
+    const runtime = obj.runtime;
+    if (runtime !== 'npx' && runtime !== 'docker') {
+        return { kind: 'err', message: 'preset.runtime must be "npx" or "docker"' };
+    }
+    const pkg = obj.package;
+    if (typeof pkg !== 'string' || pkg === '') {
+        return { kind: 'err', message: 'preset.package must be a non-empty string' };
+    }
+    const envMapRaw = obj.envMap;
+    if (!Array.isArray(envMapRaw)) {
+        return { kind: 'err', message: 'preset.envMap must be an array' };
+    }
+    const envMap = [];
+    for (const [i, entry] of envMapRaw.entries()) {
+        if (entry === null || typeof entry !== 'object') {
+            return { kind: 'err', message: `preset.envMap[${i}] must be an object` };
+        }
+        const e = entry;
+        const child = e.child;
+        const from = e.from;
+        if (typeof child !== 'string' || child === '') {
+            return { kind: 'err', message: `preset.envMap[${i}].child must be a non-empty string` };
+        }
+        if (typeof from !== 'string' || from === '') {
+            return { kind: 'err', message: `preset.envMap[${i}].from must be a non-empty string` };
+        }
+        // Only `$SECRET` is supported today. Reject unknowns loudly so we
+        // catch typos or future forms that haven't been implemented.
+        if (from !== '$SECRET') {
+            return {
+                kind: 'err',
+                message: `preset.envMap[${i}].from = "${from}" unsupported (only "$SECRET" is recognized)`,
+            };
+        }
+        envMap.push({ child, from });
+    }
+    const defaultArgsRaw = obj.defaultArgs ?? [];
+    if (!Array.isArray(defaultArgsRaw) || !defaultArgsRaw.every((a) => typeof a === 'string')) {
+        return { kind: 'err', message: 'preset.defaultArgs must be an array of strings' };
+    }
+    const defaultArgs = defaultArgsRaw;
+    const hostRemapRaw = obj.hostRemap;
+    let hostRemap;
+    if (hostRemapRaw !== undefined) {
+        if (hostRemapRaw !== 'docker-desktop') {
+            return {
+                kind: 'err',
+                message: `preset.hostRemap = "${String(hostRemapRaw)}" unsupported (only "docker-desktop" is recognized)`,
+            };
+        }
+        hostRemap = 'docker-desktop';
+    }
+    const audit = obj.audit;
+    const auditValidated = validateAudit(audit);
+    if (auditValidated.kind === 'err')
+        return auditValidated;
+    const description = typeof obj.description === 'string' ? obj.description : undefined;
+    const preset = {
+        kind,
+        ...(description !== undefined && { description }),
+        runtime,
+        package: pkg,
+        envMap,
+        defaultArgs,
+        ...(hostRemap !== undefined && { hostRemap }),
+        audit: auditValidated.audit,
+    };
+    return { kind: 'ok', preset };
+}
+function validateAudit(input) {
+    if (input === null || typeof input !== 'object') {
+        return { kind: 'err', message: 'preset.audit must be an object' };
+    }
+    const obj = input;
+    const leak = obj.urlLeakInErrors;
+    if (leak !== 'verified-safe' && leak !== 'pending' && leak !== 'known-issue') {
+        return {
+            kind: 'err',
+            message: 'preset.audit.urlLeakInErrors must be one of "verified-safe" | "pending" | "known-issue"',
+        };
+    }
+    const reviewedAt = obj.reviewedAt;
+    if (reviewedAt !== null && typeof reviewedAt !== 'string') {
+        return { kind: 'err', message: 'preset.audit.reviewedAt must be null or a string' };
+    }
+    const version = obj.version;
+    if (version !== null && typeof version !== 'string') {
+        return { kind: 'err', message: 'preset.audit.version must be null or a string' };
+    }
+    const notes = obj.notes;
+    if (notes !== undefined && typeof notes !== 'string') {
+        return { kind: 'err', message: 'preset.audit.notes must be a string when present' };
+    }
+    return {
+        kind: 'ok',
+        audit: {
+            urlLeakInErrors: leak,
+            reviewedAt,
+            version,
+            ...(notes !== undefined && { notes }),
+        },
+    };
+}
+//# sourceMappingURL=preset-loader.js.map