@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Resolved configuration used by every command. Precedence at load
+ * time is: CLI flag (`--url`, `--token`) > env var
+ * (`KINDGI_API_URL`, `KINDGI_API_TOKEN`) > file
+ * (`.kindgirc.json` in cwd, then `~/.kindgi/config.json`).
+ */
+export interface ResolvedConfig {
+    readonly apiUrl: string | undefined;
+    readonly token: string | undefined;
+    readonly source: {
+        readonly apiUrl: ConfigSource;
+        readonly token: ConfigSource;
+    };
+}
+export type ConfigSource = 'flag' | 'env' | 'file' | 'unset';
+export interface ConfigInputs {
+    readonly flagUrl?: string | undefined;
+    readonly flagToken?: string | undefined;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    /** Directory used as cwd when looking for `.kindgirc.json`. */
+    readonly cwd?: string;
+    /** Directory used as `$HOME` when looking for `~/.kindgi/config.json`. */
+    readonly home?: string;
+    /**
+     * Optional file loader override for tests. Returns `null` when the
+     * file does not exist; throws for any other IO error.
+     */
+    readonly readFile?: (path: string) => Promise<string | null>;
+}
+interface FileConfig {
+    readonly apiUrl?: string;
+    readonly token?: string;
+}
+export declare function loadConfig(inputs?: ConfigInputs): Promise<ResolvedConfig>;
+/**
+ * Persist a config file at `~/.kindgi/config.json`. Called by
+ * `kindgi auth login`. Merges with any existing file so a partial
+ * write does not clobber other keys.
+ */
+export declare function saveHomeConfig(patch: FileConfig, home?: string | undefined): Promise<string>;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;QAC9B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD,wBAAsB,UAAU,CAAC,MAAM,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBnF;AA2CD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,EACjB,IAAI,GAAE,MAAM,GAAG,SAAqB,GACnC,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/config.js

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+async function defaultReadFile(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+export async function loadConfig(inputs = {}) {
+    const env = inputs.env ?? process.env;
+    const cwd = inputs.cwd ?? process.cwd();
+    const home = inputs.home ?? homedir();
+    const read = inputs.readFile ?? defaultReadFile;
+    const fileConfig = await loadFileConfig(cwd, home, read);
+    const envUrl = env.KINDGI_API_URL;
+    const envToken = env.KINDGI_API_TOKEN;
+    const apiUrl = pickWithSource(inputs.flagUrl, envUrl, fileConfig.apiUrl);
+    const token = pickWithSource(inputs.flagToken, envToken, fileConfig.token);
+    return {
+        apiUrl: apiUrl.value,
+        token: token.value,
+        source: { apiUrl: apiUrl.source, token: token.source },
+    };
+}
+function pickWithSource(flag, env, file) {
+    if (typeof flag === 'string' && flag !== '')
+        return { value: flag, source: 'flag' };
+    if (typeof env === 'string' && env !== '')
+        return { value: env, source: 'env' };
+    if (typeof file === 'string' && file !== '')
+        return { value: file, source: 'file' };
+    return { value: undefined, source: 'unset' };
+}
+async function loadFileConfig(cwd, home, read) {
+    const cwdPath = join(cwd, '.kindgirc.json');
+    const homePath = join(home, '.kindgi', 'config.json');
+    const merged = {};
+    for (const path of [homePath, cwdPath]) {
+        const raw = await read(path);
+        if (raw === null)
+            continue;
+        const parsed = parseJson(raw, path);
+        if (typeof parsed.apiUrl === 'string')
+            merged.apiUrl = parsed.apiUrl;
+        if (typeof parsed.token === 'string')
+            merged.token = parsed.token;
+    }
+    return merged;
+}
+function parseJson(raw, path) {
+    try {
+        const obj = JSON.parse(raw);
+        if (obj === null || typeof obj !== 'object')
+            return {};
+        return obj;
+    }
+    catch (err) {
+        throw new Error(`Malformed JSON in ${path}: ${err.message}. Delete or repair the file.`);
+    }
+}
+/**
+ * Persist a config file at `~/.kindgi/config.json`. Called by
+ * `kindgi auth login`. Merges with any existing file so a partial
+ * write does not clobber other keys.
+ */
+export async function saveHomeConfig(patch, home = homedir()) {
+    const resolvedHome = home ?? homedir();
+    const path = join(resolvedHome, '.kindgi', 'config.json');
+    const existing = await defaultReadFile(path);
+    const base = existing === null ? {} : JSON.parse(existing);
+    const next = { ...base, ...patch };
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
+    return path;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuC1C,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAuB,EAAE;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC;IAEtC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAE3E,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAwB,EACxB,GAAuB,EACvB,IAAwB;IAExB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,IAAY,EACZ,IAA8C;IAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACrE,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACvC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACvD,OAAO,GAAiB,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,KAAM,GAAa,CAAC,OAAO,8BAA8B,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,OAA2B,OAAO,EAAE;IAEpC,MAAM,YAAY,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAgB,CAAC;IAC3E,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,162 @@
+import { type KindgiClient } from '@kindgi/client';
+import type { BuildRunners } from './build/runners.js';
+import type { RegistryAuthSeam } from './commands/auth.js';
+import type { EnvInitInputSeam } from './commands/env.js';
+import type { SecretsValueInputSeam } from './commands/secrets.js';
+import type { ResolvedConfig } from './config.js';
+import type { DeployRunners } from './deploy/runners.js';
+import type { DevRunners } from './dev/runners.js';
+import type { EnvRunners } from './env/runners.js';
+import type { KeyRunners } from './key/runners.js';
+import type { GlobalFlags } from './parse.js';
+import type { TestRunners } from './test/runners.js';
+/**
+ * Loader hook the `kindgi build` command consumes when reading
+ * `kindgi.config.ts`. Production leaves this undefined; the command
+ * falls back to a plain dynamic `import()` (Node 22
+ * `--experimental-strip-types` handles the `.ts` variant natively).
+ * Tests inject an in-memory function to bypass the filesystem.
+ */
+export type BuildConfigLoader = (packDir: string) => Promise<unknown>;
+/**
+ * Runtime context passed to every command handler. Holds the resolved
+ * config, the SDK client (lazily created), and the effective output
+ * format.
+ */
+export interface CommandContext {
+    readonly globals: GlobalFlags;
+    readonly positionals: readonly string[];
+    readonly options: Readonly<Record<string, string | boolean | undefined>>;
+    readonly config: ResolvedConfig;
+    /** Create an SDK client using the resolved config. Throws if apiUrl / token are missing. */
+    readonly client: () => KindgiClient;
+    /** Create an SDK client bound to arbitrary apiUrl + token (used by `kindgi dev`). */
+    readonly clientFor: (apiUrl: string, token: string) => KindgiClient;
+    /** Base URL, if resolved — used by non-SDK direct fetch (health, whoami). */
+    readonly apiUrl: () => string;
+    /** Bearer token, if resolved — used by non-SDK direct fetch. */
+    readonly token: () => string;
+    /** fetch impl (injectable for tests). */
+    readonly fetch: typeof fetch;
+    /** Home directory used by `auth login` when persisting `~/.kindgi/config.json`. */
+    readonly home: string | undefined;
+    /** Working directory (injectable for tests; defaults to process.cwd()). */
+    readonly cwd: string;
+    /**
+     * Environment variables the CLI was booted with. Populated verbatim
+     * from `runCli({ env })`; production callers pass `process.env`.
+     * Consumed by commands (e.g. `kindgi dev`'s `KINDGI_DATABASE_URL`
+     * fallback) so tests can drive the resolution deterministically.
+     */
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /**
+     * Injectable dev-mode runners (api-server factory + indexer + watcher).
+     * Present iff the CLI was booted via `runCli({ devRunners })` — used
+     * exclusively by `kindgi dev` so tests can hand in mock server /
+     * indexer / watcher without touching Postgres or the filesystem.
+     * Production callers leave this undefined; `kindgi dev` then wires
+     * the real runtime container / `runIndexer` / `fs.watch` from
+     * `dev/defaults.ts`.
+     */
+    readonly devRunners: DevRunners | undefined;
+    /**
+     * Optional signal that terminates long-lived commands (currently just
+     * `kindgi dev` — the watch loop). Tests pass an
+     * `AbortController.signal` so a graceful shutdown path can be
+     * exercised without process signals. Production callers wire this to
+     * SIGINT/SIGTERM in `main.ts`.
+     */
+    readonly stopSignal: AbortSignal | undefined;
+    /**
+     * Injectable build-pipeline seams used exclusively by `kindgi
+     * build`. Absent for every other command. Tests hand
+     * in fixture implementations so the pipeline exercises without
+     * spawning real esbuild, real tar, real fetch, or docker; production
+     * lazy-loads `build/defaults.ts` on dispatch.
+     */
+    readonly buildRunners: BuildRunners | undefined;
+    /**
+     * Optional loader hook for `kindgi.config.ts`. Tests inject an
+     * in-memory function; production leaves this undefined and the
+     * command falls back to a plain dynamic `import()`.
+     */
+    readonly buildConfigLoader: ((packDir: string) => Promise<{
+        readonly [k: string]: unknown;
+    }>) | undefined;
+    /**
+     * Injectable deploy-pipeline seams used exclusively by `kindgi
+     * deploy`. Absent for every other command. Tests hand
+     * in fixture implementations so the pipeline exercises without
+     * reading a real envelope file or hitting a live api-server;
+     * production lazy-loads `deploy/defaults.ts` on dispatch.
+     */
+    readonly deployRunners: DeployRunners | undefined;
+    /**
+     * Injectable seams for `kindgi test`. Absent for
+     * every other command. Tests hand in fixture implementations so the
+     * command flow exercises without spawning real vitest; production
+     * lazy-loads `test/defaults.ts` on dispatch.
+     */
+    readonly testRunners: TestRunners | undefined;
+    /**
+     * Injectable filesystem seams for `kindgi env`.
+     * Absent for every other command. Tests substitute in-memory stubs
+     * so `.env.<envName>` reads/writes never touch disk; production
+     * lazy-loads `env/defaults.ts` on dispatch.
+     */
+    readonly envRunners: EnvRunners | undefined;
+    /**
+     * Injectable seams for `kindgi key`. Absent for
+     * every other command. Tests substitute stubs so the crypto +
+     * filesystem paths under `~/.kindgi/keys/` never touch disk; production
+     * lazy-loads `key/defaults.ts` on dispatch.
+     */
+    readonly keyRunners: KeyRunners | undefined;
+    /**
+     * Injectable value-input seams for `kindgi secrets set` /
+     * `rotate`. Tests pass fixtures so the TTY prompt / stdin reader /
+     * file reader / fs.stat mode check exercise without a real terminal
+     * or disk. Production leaves this undefined; the command falls back
+     * to real `readline` / `process.stdin` / `node:fs`.
+     */
+    readonly secretsInputSeam: SecretsValueInputSeam | undefined;
+    /**
+     * Injectable prompt / TTY-check seam for `kindgi env init`. Tests
+     * inject a fixture `promptChoice`; production leaves undefined and
+     * `env init` spins up a real `readline.Interface`.
+     */
+    readonly envInitInputSeam: EnvInitInputSeam | undefined;
+    /**
+     * Injectable seams for `kindgi auth registry`: the `docker` runner, the
+     * stdin reader, the hidden prompt and the image checked. Tests pass
+     * fixtures so the login and the check run without Docker or a
+     * terminal; production leaves this undefined (the real ones).
+     */
+    readonly registryAuthSeam: RegistryAuthSeam | undefined;
+}
+export interface BuildContextInputs {
+    readonly globals: GlobalFlags;
+    readonly positionals: readonly string[];
+    readonly options: Readonly<Record<string, string | boolean | undefined>>;
+    readonly config: ResolvedConfig;
+    readonly fetchImpl?: typeof fetch;
+    readonly clientFactory?: (apiUrl: string, token: string) => KindgiClient;
+    readonly home?: string;
+    readonly cwd?: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly devRunners?: DevRunners;
+    readonly stopSignal?: AbortSignal;
+    readonly buildRunners?: BuildRunners;
+    readonly buildConfigLoader?: (packDir: string) => Promise<{
+        readonly [k: string]: unknown;
+    }>;
+    readonly deployRunners?: DeployRunners;
+    readonly testRunners?: TestRunners;
+    readonly envRunners?: EnvRunners;
+    readonly keyRunners?: KeyRunners;
+    readonly secretsInputSeam?: SecretsValueInputSeam;
+    readonly envInitInputSeam?: EnvInitInputSeam;
+    readonly registryAuthSeam?: RegistryAuthSeam;
+}
+export declare function buildContext(inputs: BuildContextInputs): CommandContext;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,YAAY,EAAgB,MAAM,gBAAgB,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;IACzE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC;IACpC,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,YAAY,CAAC;IACpE,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,WAAW,GAAG,SAAS,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EACtB,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;IACzE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,YAAY,CAAC;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IAClD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CA8CvE"}

package/dist/context.js

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { createClient } from '@kindgi/client';
+export function buildContext(inputs) {
+    const apiUrl = () => {
+        if (inputs.config.apiUrl === undefined) {
+            throw new Error('API URL not configured. Set KINDGI_API_URL, pass --url=..., or run `kindgi auth login`.');
+        }
+        return inputs.config.apiUrl;
+    };
+    const token = () => {
+        if (inputs.config.token === undefined) {
+            throw new Error('API token not configured. Set KINDGI_API_TOKEN, pass --token=..., or run `kindgi auth login`.');
+        }
+        return inputs.config.token;
+    };
+    const factory = inputs.clientFactory ??
+        ((url, tok) => createClient({ apiUrl: url, auth: { kind: 'apiToken', token: tok } }));
+    return {
+        globals: inputs.globals,
+        positionals: inputs.positionals,
+        options: inputs.options,
+        config: inputs.config,
+        client: () => factory(apiUrl(), token()),
+        clientFor: (url, tok) => factory(url, tok),
+        apiUrl,
+        token,
+        fetch: inputs.fetchImpl ?? fetch,
+        home: inputs.home,
+        cwd: inputs.cwd ?? process.cwd(),
+        env: inputs.env ?? {},
+        devRunners: inputs.devRunners,
+        stopSignal: inputs.stopSignal,
+        buildRunners: inputs.buildRunners,
+        buildConfigLoader: inputs.buildConfigLoader,
+        deployRunners: inputs.deployRunners,
+        testRunners: inputs.testRunners,
+        envRunners: inputs.envRunners,
+        keyRunners: inputs.keyRunners,
+        secretsInputSeam: inputs.secretsInputSeam,
+        envInitInputSeam: inputs.envInitInputSeam,
+        registryAuthSeam: inputs.registryAuthSeam,
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAqB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmKjE,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAW,EAAE;QACzB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC,CAAC;IACF,MAAM,OAAO,GACX,MAAM,CAAC,aAAa;QACpB,CAAC,CAAC,GAAW,EAAE,GAAW,EAAE,EAAE,CAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;QACxC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM;QACN,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QAChC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;AACJ,CAAC"}

package/dist/deploy/defaults.d.ts

@@ -0,0 +1,14 @@
+import type { DeployRunners } from './runners.js';
+/**
+ * Production `DeployRunners`. `runBuild` is intentionally OMITTED here
+ * — the deploy command re-uses its own already-parsed
+ * `ctx.buildRunners` + calls into `runBuild` from `commands/build.ts`
+ * directly (importing the runner would create a cycle). Instead the
+ * command reaches for `ctx.buildRunners`; production wires
+ * `buildRunners` via `main.ts`'s existing lazy loader.
+ *
+ * This keeps the deploy path production-wired end-to-end without
+ * duplicating the build-runners production loader here.
+ */
+export declare const REAL_DEPLOY_RUNNERS: DeployRunners;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/deploy/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/deploy/defaults.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EAAE,aASjC,CAAC"}

package/dist/deploy/defaults.js

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Production wiring for the deploy runners. Lazy-loaded from
+ * `main.ts` ONLY when the dispatched command is `deploy` — the
+ * `runBuild` runner pulls in the full build defaults tree (esbuild
+ * / tar / docker / crypto). Commands that never invoke deploy don't
+ * pay that transitive load.
+ *
+ * The `runBuild` inline-build path is best-effort: if it fails, the
+ * error is surfaced via `RunBuildResult.kind = 'err'` — the deploy
+ * command translates that into an actionable stderr message.
+ */
+import { loadEnvelopeReal } from './envelope-loader.js';
+import { postDeploymentReal, syncSecretsReal } from './post.js';
+/**
+ * Production `DeployRunners`. `runBuild` is intentionally OMITTED here
+ * — the deploy command re-uses its own already-parsed
+ * `ctx.buildRunners` + calls into `runBuild` from `commands/build.ts`
+ * directly (importing the runner would create a cycle). Instead the
+ * command reaches for `ctx.buildRunners`; production wires
+ * `buildRunners` via `main.ts`'s existing lazy loader.
+ *
+ * This keeps the deploy path production-wired end-to-end without
+ * duplicating the build-runners production loader here.
+ */
+export const REAL_DEPLOY_RUNNERS = {
+    loadEnvelope: loadEnvelopeReal,
+    postDeployment: postDeploymentReal,
+    // Production sync runner. Only invoked when
+    // `--sync-secrets` is passed AND `.env.<envName>` carries entries.
+    syncSecrets: syncSecretsReal,
+    // runBuild deliberately omitted — the command composes it from
+    // `ctx.buildRunners` + the exported `runBuild` from
+    // `commands/build.ts`.
+};
+//# sourceMappingURL=defaults.js.map

package/dist/deploy/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/deploy/defaults.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGhE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAkB;IAChD,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,kBAAkB;IAClC,4CAA4C;IAC5C,mEAAmE;IACnE,WAAW,EAAE,eAAe;IAC5B,+DAA+D;IAC/D,oDAAoD;IACpD,uBAAuB;CACxB,CAAC"}

package/dist/deploy/envelope-loader.d.ts

@@ -0,0 +1,24 @@
+import { type DeployEnvelope } from '../build/envelope.js';
+import type { LoadEnvelopeResult } from './runners.js';
+/**
+ * Structural check + schema pin. On success returns the parsed
+ * envelope; on failure returns a typed error the command surfaces to
+ * the developer as an actionable message.
+ */
+export declare function validateEnvelopeStructure(raw: unknown, path: string): LoadEnvelopeResult;
+/**
+ * Read the envelope from disk + validate. Returns typed errors for
+ * missing-file / bad-JSON / schema-mismatch cases — the command
+ * translates each to an actionable stderr message.
+ */
+export declare function loadEnvelopeReal(opts: {
+    readonly path: string;
+}): Promise<LoadEnvelopeResult>;
+/**
+ * Check whether an envelope is signed. `kindgi deploy` refuses to
+ * POST an unsigned envelope unless `--dry-run` is set — the server
+ * would reject anyway (400 signature-invalid), so we fail fast with a
+ * clearer message.
+ */
+export declare function isEnvelopeSigned(envelope: DeployEnvelope): boolean;
+//# sourceMappingURL=envelope-loader.d.ts.map

package/dist/deploy/envelope-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-loader.d.ts","sourceRoot":"","sources":["../../src/deploy/envelope-loader.ts"],"names":[],"mappings":"AAkBA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAwExF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgC9B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CASlE"}

package/dist/deploy/envelope-loader.js

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Deploy envelope loader — reads `deploy-envelope.json` (emitted by
+ * `kindgi build`) from disk and structurally
+ * validates it. The signature itself was computed at build time; we do
+ * NOT re-sign here. This loader's job is to catch corruption + partial
+ * writes + the "someone hand-edited the file" class of bugs before we
+ * put anything on the wire.
+ *
+ * The result feeds directly into `packages/cli/src/deploy/post.ts`
+ * (which strips `tenantId` for the wire body) + into the summary/
+ * banner code paths.
+ */
+import { readFile } from 'node:fs/promises';
+import { DEPLOY_ENVELOPE_SCHEMA } from '../build/envelope.js';
+/**
+ * Structural check + schema pin. On success returns the parsed
+ * envelope; on failure returns a typed error the command surfaces to
+ * the developer as an actionable message.
+ */
+export function validateEnvelopeStructure(raw, path) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        return {
+            kind: 'err',
+            code: 'envelope-schema-mismatch',
+            message: 'deploy-envelope.json must be a JSON object.',
+            path,
+        };
+    }
+    const obj = raw;
+    if (obj.$schema !== DEPLOY_ENVELOPE_SCHEMA) {
+        return {
+            kind: 'err',
+            code: 'envelope-schema-mismatch',
+            message: `deploy-envelope.json $schema mismatch: expected "${DEPLOY_ENVELOPE_SCHEMA}", got ` +
+                `"${String(obj.$schema)}". Re-run \`kindgi build\` to regenerate.`,
+            path,
+        };
+    }
+    const requiredStrings = [
+        'imageRef',
+        'imageDigest',
+        'artifactVersion',
+        'indexHash',
+        'tenantId',
+        'publishedAt',
+    ];
+    for (const field of requiredStrings) {
+        const value = obj[field];
+        if (typeof value !== 'string' || value.length === 0) {
+            return {
+                kind: 'err',
+                code: 'envelope-schema-mismatch',
+                message: `deploy-envelope.json is missing required field "${String(field)}" (or the value is empty). Re-run \`kindgi build\` to regenerate.`,
+                path,
+            };
+        }
+    }
+    const index = obj.index;
+    if (index === null || typeof index !== 'object' || Array.isArray(index)) {
+        return {
+            kind: 'err',
+            code: 'envelope-schema-mismatch',
+            message: 'deploy-envelope.json `index` must be an object (verbatim /app/index.json).',
+            path,
+        };
+    }
+    // Optional signature triplet: either all three are present, or all
+    // three are absent. Half-signed envelopes are corruption.
+    const hasSig = typeof obj.signature === 'string' && obj.signature.length > 0;
+    const hasKeyId = typeof obj.signerKeyId === 'string' && obj.signerKeyId.length > 0;
+    const hasPubKey = typeof obj.signerPublicKey === 'string' && obj.signerPublicKey.length > 0;
+    const sigCount = Number(hasSig) + Number(hasKeyId) + Number(hasPubKey);
+    if (sigCount !== 0 && sigCount !== 3) {
+        return {
+            kind: 'err',
+            code: 'envelope-schema-mismatch',
+            message: 'deploy-envelope.json has a partial signature triplet — expected all ' +
+                'three of `signature` / `signerKeyId` / `signerPublicKey`, or none of ' +
+                'them. Re-run `kindgi build` (drop `--skip-sign` if you intended to sign).',
+            path,
+        };
+    }
+    return { kind: 'ok', envelope: obj };
+}
+/**
+ * Read the envelope from disk + validate. Returns typed errors for
+ * missing-file / bad-JSON / schema-mismatch cases — the command
+ * translates each to an actionable stderr message.
+ */
+export async function loadEnvelopeReal(opts) {
+    let raw;
+    try {
+        raw = await readFile(opts.path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            return {
+                kind: 'err',
+                code: 'envelope-not-found',
+                message: `deploy-envelope.json not found at ${opts.path}.`,
+                path: opts.path,
+            };
+        }
+        return {
+            kind: 'err',
+            code: 'envelope-not-found',
+            message: `Failed to read ${opts.path}: ${err.message}`,
+            path: opts.path,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        return {
+            kind: 'err',
+            code: 'envelope-invalid-json',
+            message: `deploy-envelope.json is not valid JSON: ${err.message}`,
+            path: opts.path,
+        };
+    }
+    return validateEnvelopeStructure(parsed, opts.path);
+}
+/**
+ * Check whether an envelope is signed. `kindgi deploy` refuses to
+ * POST an unsigned envelope unless `--dry-run` is set — the server
+ * would reject anyway (400 signature-invalid), so we fail fast with a
+ * clearer message.
+ */
+export function isEnvelopeSigned(envelope) {
+    return (typeof envelope.signature === 'string' &&
+        envelope.signature.length > 0 &&
+        typeof envelope.signerKeyId === 'string' &&
+        envelope.signerKeyId.length > 0 &&
+        typeof envelope.signerPublicKey === 'string' &&
+        envelope.signerPublicKey.length > 0);
+}
+//# sourceMappingURL=envelope-loader.js.map

package/dist/deploy/envelope-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-loader.js","sourceRoot":"","sources":["../../src/deploy/envelope-loader.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAuB,MAAM,sBAAsB,CAAC;AAGnF;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,IAAY;IAClE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,6CAA6C;YACtD,IAAI;SACL,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,GAAG,CAAC,OAAO,KAAK,sBAAsB,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,0BAA0B;YAChC,OAAO,EACL,oDAAoD,sBAAsB,SAAS;gBACnF,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,2CAA2C;YACpE,IAAI;SACL,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAsC;QACzD,UAAU;QACV,aAAa;QACb,iBAAiB;QACjB,WAAW;QACX,UAAU;QACV,aAAa;KACd,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAe,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,mDAAmD,MAAM,CAAC,KAAK,CAAC,mEAAmE;gBAC5I,IAAI;aACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,4EAA4E;YACrF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAK,GAAG,CAAC,SAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAK,GAAG,CAAC,WAAsB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/F,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAK,GAAG,CAAC,eAA0B,CAAC,MAAM,GAAG,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,0BAA0B;YAChC,OAAO,EACL,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;YAC7E,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAgC,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAEtC;IACC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,qCAAqC,IAAI,CAAC,IAAI,GAAG;gBAC1D,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,2CAA4C,GAAa,CAAC,OAAO,EAAE;YAC5E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,OAAO,CACL,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;QACtC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC7B,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAC/B,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;QAC5C,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CACpC,CAAC;AACJ,CAAC"}

package/dist/deploy/post.d.ts

@@ -0,0 +1,48 @@
+import type { DeployEnvelope } from '../build/envelope.js';
+import type { PostDeploymentBody, PostDeploymentOptions, PostDeploymentResult, SyncSecretsBody, SyncSecretsOptions, SyncSecretsResult } from './runners.js';
+/**
+ * Build the exact wire body per
+ * `packages/api/src/openapi/schemas.ts:3141` — the
+ * `DeploymentRegistrationBodySchema`. `tenantId` is deliberately
+ * absent (server-derived from the token); the envelope's signature
+ * covers it via re-canonicalisation on the server.
+ *
+ * `$schema` (envelope-side namespace pin) and `buildLogsUrl` (build-
+ * server URL, only useful for humans debugging failed builds) are
+ * client-side metadata — not part of the deployment wire contract.
+ */
+export declare function buildPostBody(envelope: DeployEnvelope): PostDeploymentBody;
+/**
+ * `sha256:<hex>` over the canonical (sorted-key, no-whitespace) JSON
+ * representation of the wire body. Matches the sha256 shape every other hash in the framework uses.
+ *
+ * The idempotency middleware on `packages/api` caches the full HTTP
+ * response by `(tenantId, Idempotency-Key)`. Same body → same key →
+ * same cached response (201 or 200-replay). Different body + same
+ * key → server returns `idempotency-key-conflict`.
+ */
+export declare function deriveIdempotencyKey(body: PostDeploymentBody): string;
+/**
+ * Production `postDeployment` runner. Executes the HTTP POST, parses
+ * the response, discriminates the outcome. Tests substitute this whole
+ * function via `DeployRunners.postDeployment` to keep the wire
+ * synthetic.
+ */
+export declare function postDeploymentReal(opts: PostDeploymentOptions): Promise<PostDeploymentResult>;
+/**
+ * Derive the Idempotency-Key for a sync-secrets POST. Same shape as
+ * `deriveIdempotencyKey` for deployments (sha256 of canonical body) —
+ * so a re-run of the same deploy with the same `.env.<envName>` sends
+ * the same key and the server middleware caches the response.
+ */
+export declare function deriveSyncSecretsIdempotencyKey(deploymentId: string, body: SyncSecretsBody): string;
+/**
+ * Production `syncSecrets` runner. Executes
+ * `POST /v1/deployments/:deploymentId/secrets` — the wire body carries
+ * plaintext `value` entries at the developer boundary; the server
+ * responds with references only. Errors surface as `wire-error` (with
+ * the server's error code preserved for the CLI banner) or
+ * `transport-error`.
+ */
+export declare function syncSecretsReal(opts: SyncSecretsOptions): Promise<SyncSecretsResult>;
+//# sourceMappingURL=post.d.ts.map

package/dist/deploy/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../src/deploy/post.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAEV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,kBAAkB,CAuB1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAIrE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CA2D/B;AAaD;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,eAAe,GACpB,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgD1F"}