@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/build/apt.d.ts

@@ -0,0 +1,16 @@
+export type AptPackages = {
+    readonly kind: 'ok';
+    readonly packages: readonly string[];
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/** The declared packages, checked — `where` names the setting in messages. */
+export declare function checkAptPackages(value: unknown, where: string): AptPackages;
+/**
+ * The Containerfile `RUN` step installing `packages` (checked by
+ * `checkAptPackages`): one layer, no recommended extras, the package
+ * lists removed after. Empty → no step.
+ */
+export declare function renderAptGetStep(packages: readonly string[]): string;
+//# sourceMappingURL=apt.d.ts.map

package/dist/build/apt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apt.d.ts","sourceRoot":"","sources":["../../src/build/apt.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAa3E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAOpE"}

package/dist/build/apt.js

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Debian packages in a pack image — the one place that renders the
+ * `apt-get` step, so every pack image installs them the same way.
+ *
+ * A pack declares them when its code needs programs or libraries outside
+ * its language's packages (OCR, PDF tools, `libmagic`, …):
+ *   - a Python pack: `[tool.kindgi.image] system-packages = [...]` in
+ *     `pyproject.toml` — the Python spelling of the `aptGet` image
+ *     extension (plan decision K8) a TypeScript pack configures under
+ *     `image:` in `kindgi.config`;
+ *   - the Node pack image renders the same step for `aptGet` (R3).
+ *
+ * Names are checked against Debian's package-name rules, with an optional
+ * `=version` pin, so nothing else can reach the `RUN` line.
+ */
+/** `name` or `name=version`, as Debian policy allows them. */
+const APT_PACKAGE = /^[a-z0-9][a-z0-9+.-]+(=[A-Za-z0-9.+~:-]+)?$/;
+/** The declared packages, checked — `where` names the setting in messages. */
+export function checkAptPackages(value, where) {
+    if (value === undefined)
+        return { kind: 'ok', packages: [] };
+    if (!Array.isArray(value) || !value.every((p) => typeof p === 'string')) {
+        return { kind: 'err', message: `${where} must be a list of Debian package names` };
+    }
+    const bad = value.filter((p) => !APT_PACKAGE.test(p));
+    if (bad.length > 0) {
+        return {
+            kind: 'err',
+            message: `${where}: not a Debian package name: ${bad.map((p) => JSON.stringify(p)).join(', ')}`,
+        };
+    }
+    return { kind: 'ok', packages: [...new Set(value)].sort() };
+}
+/**
+ * The Containerfile `RUN` step installing `packages` (checked by
+ * `checkAptPackages`): one layer, no recommended extras, the package
+ * lists removed after. Empty → no step.
+ */
+export function renderAptGetStep(packages) {
+    if (packages.length === 0)
+        return '';
+    return [
+        'RUN apt-get update \\',
+        ` && apt-get install -y --no-install-recommends ${packages.join(' ')} \\`,
+        ' && rm -rf /var/lib/apt/lists/*',
+    ].join('\n');
+}
+//# sourceMappingURL=apt.js.map

package/dist/build/apt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apt.js","sourceRoot":"","sources":["../../src/build/apt.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,8DAA8D;AAC9D,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAMlE,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,KAAa;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,yCAAyC,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,GAAG,KAAK,gCAAgC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA2B;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO;QACL,uBAAuB;QACvB,kDAAkD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;QACzE,iCAAiC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/build/bundle.d.ts

@@ -0,0 +1,48 @@
+import type { Plugin } from 'esbuild';
+export interface PackEntry {
+    /** Absolute path of the primitive's source file. */
+    readonly abs: string;
+    /** The source path relative to the pack root — what the index records as `modulePath`. */
+    readonly sourceRel: string;
+    /** The bundle's path under the output directory, without extension. */
+    readonly outRel: string;
+}
+/**
+ * Bundle entrypoints: every file the pack's discovery patterns match
+ * (test files excluded), walked from each pattern's static prefix —
+ * the same set the indexer discovers, at any depth.
+ */
+export declare function collectPackEntries(packDir: string, patterns: readonly string[]): Promise<readonly PackEntry[]>;
+/**
+ * Local files esbuild read (metafile keys are relative to
+ * absWorkingDir): real files outside `node_modules`; plugin namespaces
+ * (`ns:…`) are not paths.
+ */
+export declare function localSourceInputs(root: string, inputs: Readonly<Record<string, unknown>>): Promise<string[]>;
+/** An ESM bundle that inlines CommonJS code needs `require`. */
+export declare const REQUIRE_BANNER = "import { createRequire as __kindgiCreateRequire } from 'node:module'; const require = __kindgiCreateRequire(import.meta.url);";
+/**
+ * Externals: whatever resolves into a `node_modules` directory stays
+ * external — loaded from the pack's own installed dependencies at
+ * runtime, native modules and generated clients (Prisma) included.
+ * Everything else, the pack's own code, what tsconfig `paths` point at,
+ * and a package linked from outside `node_modules` (its real path isn't
+ * in one), is bundled.
+ *
+ * How an external is imported:
+ *   - `resolved` (dev): by the absolute path esbuild resolved, so it
+ *     loads the same file no matter where the bundle sits;
+ *   - `bare` (a pack image): by its specifier, which Node resolves from
+ *     the bundle's folder upward into the image's own `node_modules` —
+ *     the host's absolute paths don't exist there.
+ *
+ * Which packages are external doesn't depend on `importBy`: a dev bundle
+ * and an image's leave out the same ones. `onExternal` (optional) is told
+ * each external import: the package's name (`@scope/name` of
+ * `@scope/name/sub`), and the absolute path of the file importing it.
+ */
+export declare function nodeModulesExternalPlugin(options?: {
+    readonly importBy?: 'resolved' | 'bare';
+    readonly onExternal?: (name: string, importer: string) => void;
+}): Plugin;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/build/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/build/bundle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAUD,gEAAgE;AAChE,eAAO,MAAM,cAAc,kIACsG,CAAC;AAIlI;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE;IACP,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3D,GACL,MAAM,CAuBR"}

package/dist/build/bundle.js

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * What `kindgi build` and `kindgi dev` share about bundling a pack: the
+ * entry points (every file the discovery patterns match), the local
+ * source files a build read, and the externals rule: which packages both
+ * load from the app's `node_modules`.
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { createGlobMatcher, discoveryRoots } from '@kindgi/handler-runtime';
+/**
+ * Bundle entrypoints: every file the pack's discovery patterns match
+ * (test files excluded), walked from each pattern's static prefix —
+ * the same set the indexer discovers, at any depth.
+ */
+export async function collectPackEntries(packDir, patterns) {
+    const matches = createGlobMatcher(patterns);
+    const out = [];
+    const walk = async (rel) => {
+        let entries;
+        try {
+            entries = await readdir(rel === '' ? packDir : join(packDir, rel), { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.name === 'node_modules' || entry.name.startsWith('.'))
+                continue;
+            const child = rel === '' ? entry.name : `${rel}/${entry.name}`;
+            if (entry.isDirectory())
+                await walk(child);
+            else if (entry.isFile() && matches(child)) {
+                out.push({
+                    abs: join(packDir, child),
+                    sourceRel: child,
+                    outRel: child.replace(/\.(ts|mts|mjs|js)$/, ''),
+                });
+            }
+        }
+    };
+    for (const root of discoveryRoots(patterns))
+        await walk(root);
+    return out.sort((a, b) => a.outRel.localeCompare(b.outRel));
+}
+/**
+ * Local files esbuild read (metafile keys are relative to
+ * absWorkingDir): real files outside `node_modules`; plugin namespaces
+ * (`ns:…`) are not paths.
+ */
+export async function localSourceInputs(root, inputs) {
+    const out = [];
+    for (const key of Object.keys(inputs)) {
+        if (key.includes('node_modules/') || /^[a-z-]+:/.test(key))
+            continue;
+        const abs = resolve(root, key);
+        if (await isRegularFile(abs))
+            out.push(abs);
+    }
+    return out.sort();
+}
+async function isRegularFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** An ESM bundle that inlines CommonJS code needs `require`. */
+export const REQUIRE_BANNER = "import { createRequire as __kindgiCreateRequire } from 'node:module'; const require = __kindgiCreateRequire(import.meta.url);";
+const SKIP = Symbol('kindgi-externals-resolving');
+/**
+ * Externals: whatever resolves into a `node_modules` directory stays
+ * external — loaded from the pack's own installed dependencies at
+ * runtime, native modules and generated clients (Prisma) included.
+ * Everything else, the pack's own code, what tsconfig `paths` point at,
+ * and a package linked from outside `node_modules` (its real path isn't
+ * in one), is bundled.
+ *
+ * How an external is imported:
+ *   - `resolved` (dev): by the absolute path esbuild resolved, so it
+ *     loads the same file no matter where the bundle sits;
+ *   - `bare` (a pack image): by its specifier, which Node resolves from
+ *     the bundle's folder upward into the image's own `node_modules` —
+ *     the host's absolute paths don't exist there.
+ *
+ * Which packages are external doesn't depend on `importBy`: a dev bundle
+ * and an image's leave out the same ones. `onExternal` (optional) is told
+ * each external import: the package's name (`@scope/name` of
+ * `@scope/name/sub`), and the absolute path of the file importing it.
+ */
+export function nodeModulesExternalPlugin(options = {}) {
+    const importBy = options.importBy ?? 'resolved';
+    const onExternal = options.onExternal;
+    return {
+        name: 'kindgi-node-modules-external',
+        setup(build) {
+            build.onResolve({ filter: /^[^./]/ }, async (args) => {
+                if (args.pluginData === SKIP)
+                    return undefined;
+                const resolved = await build.resolve(args.path, {
+                    kind: args.kind,
+                    importer: args.importer,
+                    resolveDir: args.resolveDir,
+                    pluginData: SKIP,
+                });
+                if (resolved.errors.length > 0 || resolved.external)
+                    return undefined;
+                if (/[\\/]node_modules[\\/]/.test(resolved.path)) {
+                    onExternal?.(packageName(args.path), args.importer);
+                    return { path: importBy === 'bare' ? args.path : resolved.path, external: true };
+                }
+                return undefined;
+            });
+        },
+    };
+}
+/** `@scope/name/sub` → `@scope/name`; `name/sub` → `name`. */
+function packageName(specifier) {
+    const parts = specifier.split('/');
+    return specifier.startsWith('@') ? parts.slice(0, 2).join('/') : (parts[0] ?? specifier);
+}
+//# sourceMappingURL=bundle.js.map

package/dist/build/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/build/bundle.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAY5E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,QAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;iBACtC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;oBACzB,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,MAAyC;IAEzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GACzB,+HAA+H,CAAC;AAElI,MAAM,IAAI,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAGI,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC;gBAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBACtE,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,UAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACnF,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AAC3F,CAAC"}

package/dist/build/containerfile.d.ts

@@ -0,0 +1,27 @@
+import type { HostInstall, InstallCommands } from './host-install.js';
+import type { ResolvedImage } from './image-config.js';
+export interface RenderContainerfileInputs {
+    readonly baseImageRef: string;
+    readonly artifactVersion: string;
+    readonly publishedAt: string;
+    readonly buildTarget: string;
+    readonly install: Pick<HostInstall, 'manager' | 'managerSpec' | 'packRel' | 'secrets' | 'yarnBerry'>;
+    readonly commands: InstallCommands;
+    /** What `image` in `kindgi.config` adds (`image-config.ts`). */
+    readonly image: ResolvedImage;
+    /** Whether the context has `include/` (files `bundle.include` lists). */
+    readonly hasIncludes: boolean;
+}
+/**
+ * pnpm's store in the install stage: the cache mount's own folder, set
+ * explicitly (`pnpm_config_store_dir` for pnpm 11, `npm_config_store_dir`
+ * before it), under ~/.cache, which the stage gives `node`.
+ */
+export declare const PNPM_STORE_DIR = "/home/node/.cache/pnpm-store";
+/** Where the pack sits in the image. */
+export declare function imagePackDir(packRel: string): string;
+/** The pack service's command in the image (after tini). */
+export declare const PACK_SERVICE_COMMAND: readonly string[];
+/** Render the Containerfile. Pure; the caller writes it. */
+export declare function renderContainerfile(inputs: RenderContainerfileInputs): string;
+//# sourceMappingURL=containerfile.d.ts.map

package/dist/build/containerfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerfile.d.ts","sourceRoot":"","sources":["../../src/build/containerfile.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC;IACrG,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,iCAAiC,CAAC;AAE7D,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAUjD,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAiH7E"}

package/dist/build/containerfile.js

@@ -0,0 +1,197 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The `Containerfile` of a TypeScript pack image, which runs the pack
+ * service over the pack's bundles. Stages:
+ *
+ *   system   the Node base image, tini, CA certificates, the system
+ *            packages `image` asks for (corepack on)
+ *   deps     the app's dependencies, with its own package manager from
+ *            its own lockfile, frozen and scripts off; then the build
+ *            scripts it allows; then the extensions' steps (`prisma
+ *            generate`); then pruned to production
+ *   code     the bundles (`dist/`): the pack's, the framework's, the
+ *            config, the bundle map
+ *   indexer  `index.json`, indexed from the bundles
+ *   final    deps + code + index.json, as the `node` user
+ *
+ * Image layout: the install root at `/app`, the pack at
+ * `/app/<packRel>` (the working directory) with its bundles in `dist/`,
+ * and the index at `/app/index.json`.
+ *
+ * Build context (`kindgi build` writes it):
+ *   host/          what the install reads (manifests, lockfile, workspace file, patches)
+ *   ext/           what the extensions' steps read (a Prisma schema), at the install root's paths
+ *   dist/          the bundles
+ *   include/       `bundle.include` files, at their pack-relative paths
+ *   Containerfile
+ * Registry config that can hold credentials (`.npmrc`, `.yarnrc*`) is
+ * never in the context: the install reads it as a BuildKit secret.
+ *
+ * ## Reproducibility
+ *
+ * The build service passes `SOURCE_DATE_EPOCH=0` + `KINDGI_BUILD_TARGET`
+ * as build args. `KINDGI_PUBLISHED_AT` and `KINDGI_ARTIFACT_VERSION` are
+ * `ARG` defaults here, so the CLI's local index and the image's agree
+ * without extending the build-server contract.
+ *
+ * Attribution: the multi-stage layout follows Trigger.dev's (Apache-2.0)
+ * `packages/cli-v3/src/deploy/buildImage.ts`.
+ */
+import { binCommand } from '../package-manager.js';
+import { renderAptGetStep } from './apt.js';
+/**
+ * pnpm's store in the install stage: the cache mount's own folder, set
+ * explicitly (`pnpm_config_store_dir` for pnpm 11, `npm_config_store_dir`
+ * before it), under ~/.cache, which the stage gives `node`.
+ */
+export const PNPM_STORE_DIR = '/home/node/.cache/pnpm-store';
+/** Where the pack sits in the image. */
+export function imagePackDir(packRel) {
+    return packRel === '' ? '/app' : `/app/${packRel}`;
+}
+/** The pack service's command in the image (after tini). */
+export const PACK_SERVICE_COMMAND = [
+    'node',
+    '--enable-source-maps',
+    './dist/kindgi-pack-service.mjs',
+    '--index',
+    '/app/index.json',
+    '--module-root',
+    './dist',
+    '--bundle-map',
+    './dist/bundle-map.json',
+];
+/** Render the Containerfile. Pure; the caller writes it. */
+export function renderContainerfile(inputs) {
+    const { baseImageRef, artifactVersion, publishedAt, buildTarget, install, commands } = inputs;
+    const packDir = imagePackDir(install.packRel);
+    const corepack = install.manager !== 'npm';
+    const mounts = installMounts(install);
+    const run = (command) => mounts.length === 0 ? `RUN ${command}` : `RUN ${mounts.join(' \\\n    ')} \\\n    ${command}`;
+    const entrypoint = JSON.stringify(['/usr/bin/tini', '--', ...PACK_SERVICE_COMMAND]);
+    const healthcheck = JSON.stringify([
+        'node',
+        '-e',
+        "fetch('http://127.0.0.1:'+(process.env.PORT||8080)+'/healthz').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))",
+    ]);
+    const system = renderAptGetStep(['ca-certificates', 'tini', ...inputs.image.systemPackages].sort());
+    const env = Object.entries(inputs.image.buildEnv)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([name, value]) => `ENV ${name}=${dockerfileString(value)}`);
+    const steps = inputs.image.steps.map((step) => {
+        const { command, args } = binCommand(install.manager, step.bin, step.args ?? []);
+        return `# ${step.extension}\n${run(`cd ${packDir} && ${[command, ...args].map(shellWord).join(' ')}`)}`;
+    });
+    return `# syntax=docker/dockerfile:1.7
+# A Kindgi pack image: the pack service over the pack's bundles.
+# Reproducible: SOURCE_DATE_EPOCH=0 and KINDGI_BUILD_TARGET come in as
+# --build-arg from the build service; KINDGI_PUBLISHED_AT and
+# KINDGI_ARTIFACT_VERSION are pinned here, so the CLI and the image
+# agree on index.json.
+#
+# Written by \`kindgi build\` (@kindgi/cli). Don't edit it by hand:
+# change kindgi.config.ts and run \`kindgi build\` again.
+
+# --- stage: system ---
+FROM ${baseImageRef} AS system
+${system}${corepack
+        ? `
+RUN corepack enable
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0`
+        : ''}
+
+# --- stage: deps (${describeManager(install)}, from the lockfile) ---
+FROM system AS deps
+WORKDIR /app
+# The install runs as node, in folders it owns: /app, and its caches
+# (a cache mount would otherwise create ~/.cache as root).
+RUN chown node:node /app && mkdir -p /home/node/.cache && chown node:node /home/node/.cache${install.manager === 'pnpm'
+        ? `
+# pnpm's store, where the cache mount is: by default pnpm picks it from
+# ~/.local/share, which a mount's parents (created as root) make it skip.
+ENV pnpm_config_store_dir=${PNPM_STORE_DIR}
+ENV npm_config_store_dir=${PNPM_STORE_DIR}`
+        : ''}
+USER node
+COPY --chown=node:node host/ ./${env.length > 0 ? `\n# Build env: the build steps and the indexer stage only, never the final image.\n${env.join('\n')}` : ''}
+${run(commands.install)}${inputs.image.contextFiles.length > 0 ? '\nCOPY --chown=node:node ext/ ./' : ''}${steps.length > 0 ? `\n${steps.join('\n')}` : ''}
+${run(commands.prune)}
+
+# --- stage: code ---
+FROM scratch AS code
+COPY dist/ /dist/
+
+# --- stage: indexer ---
+FROM deps AS indexer
+ARG SOURCE_DATE_EPOCH=0
+ARG KINDGI_BUILD_TARGET=${buildTarget}
+ARG KINDGI_ARTIFACT_VERSION=${artifactVersion}
+ARG KINDGI_PUBLISHED_AT=${publishedAt}
+ENV SOURCE_DATE_EPOCH=\${SOURCE_DATE_EPOCH}
+ENV KINDGI_BUILD_TARGET=\${KINDGI_BUILD_TARGET}
+ENV KINDGI_ARTIFACT_VERSION=\${KINDGI_ARTIFACT_VERSION}
+ENV KINDGI_PUBLISHED_AT=\${KINDGI_PUBLISHED_AT}
+COPY --from=code --chown=node:node /dist ${packDir}/dist
+WORKDIR ${packDir}
+RUN node --enable-source-maps ./dist/kindgi-index.mjs \\
+      --pack-dir . \\
+      --config ./dist/kindgi.config.mjs \\
+      --bundle-map ./dist/bundle-map.json \\
+      --module-root ./dist \\
+      --artifact-version "\${KINDGI_ARTIFACT_VERSION}" \\
+      --published-at "\${KINDGI_PUBLISHED_AT}" \\
+      --strict \\
+      --output /app/index.json
+
+# --- stage: final ---
+FROM system AS final
+ARG KINDGI_ARTIFACT_VERSION=${artifactVersion}
+ARG KINDGI_PUBLISHED_AT=${publishedAt}
+ENV KINDGI_ARTIFACT_VERSION=\${KINDGI_ARTIFACT_VERSION}
+ENV KINDGI_PUBLISHED_AT=\${KINDGI_PUBLISHED_AT}
+ENV NODE_ENV=production
+ENV PORT=8080
+USER node
+WORKDIR ${packDir}
+COPY --from=deps --chown=node:node /app /app
+COPY --from=code --chown=node:node /dist ./dist${inputs.hasIncludes
+        ? `
+COPY --chown=node:node include/ ./`
+        : ''}
+COPY --from=indexer --chown=node:node /app/index.json /app/index.json
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s CMD ${healthcheck}
+# The pack service: serves /app/index.json's tools and checks on $PORT
+# to a server holding KINDGI_PACK_SERVICE_TOKEN.
+ENTRYPOINT ${entrypoint}
+CMD []
+`;
+}
+/** The secret mounts for registry config, and the package manager's download cache. */
+function installMounts(install) {
+    const owner = 'uid=1000,gid=1000';
+    const mounts = install.secrets.map((s) => `--mount=type=secret,id=${s.id},target=/app/${s.file},${owner},required=false`);
+    if (install.manager === 'pnpm') {
+        mounts.push(`--mount=type=cache,id=kindgi-pnpm-store,target=${PNPM_STORE_DIR},${owner}`, 
+        // Package metadata, so a rebuild needn't fetch it all again.
+        `--mount=type=cache,id=kindgi-pnpm-cache,target=/home/node/.cache/pnpm,${owner}`);
+    }
+    else if (install.manager === 'npm') {
+        mounts.push(`--mount=type=cache,id=kindgi-npm-cache,target=/home/node/.npm,${owner}`);
+    }
+    return mounts;
+}
+function describeManager(install) {
+    const name = install.manager === 'yarn' ? (install.yarnBerry ? 'yarn berry' : 'yarn classic') : install.manager;
+    return install.managerSpec !== undefined ? `${name}: ${install.managerSpec}` : name;
+}
+/** A Dockerfile `ENV` value: double-quoted, with `$` not expanded. */
+function dockerfileString(value) {
+    return `"${value.replace(/[\\"$]/g, (c) => `\\${c}`)}"`;
+}
+/** A word for `sh`: as is when it's plain, else single-quoted. */
+function shellWord(word) {
+    return /^[A-Za-z0-9@%+=:,./_-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+//# sourceMappingURL=containerfile.js.map

package/dist/build/containerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerfile.js","sourceRoot":"","sources":["../../src/build/containerfile.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAiB5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAE7D,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,MAAM;IACN,sBAAsB;IACtB,gCAAgC;IAChC,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,QAAQ;IACR,cAAc;IACd,wBAAwB;CACzB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC9F,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE,CACtC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,OAAO,EAAE,CAAC;IAChG,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM;QACN,IAAI;QACJ,oHAAoH;KACrH,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,KAAK,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;;;;OAWF,YAAY;EACjB,MAAM,GACL,QAAQ;QACN,CAAC,CAAC;;sCAE+B;QACjC,CAAC,CAAC,EACN;;qBAEoB,eAAe,CAAC,OAAO,CAAC;;;;;6FAM1C,OAAO,CAAC,OAAO,KAAK,MAAM;QACxB,CAAC,CAAC;;;4BAGqB,cAAc;2BACf,cAAc,EAAE;QACtC,CAAC,CAAC,EACN;;iCAEgC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sFAAsF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;EAC3J,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;EACxJ,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;;;;;;;;;0BASK,WAAW;8BACP,eAAe;0BACnB,WAAW;;;;;2CAKM,OAAO;UACxC,OAAO;;;;;;;;;;;;;8BAaa,eAAe;0BACnB,WAAW;;;;;;UAM3B,OAAO;;iDAGd,MAAM,CAAC,WAAW;QAChB,CAAC,CAAC;mCAC4B;QAC9B,CAAC,CAAC,EACN;;;8CAG6C,WAAW;;;aAG5C,UAAU;;CAEtB,CAAC;AACF,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,OAA6C;IAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,IAAI,KAAK,iBAAiB,CACtF,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,kDAAkD,cAAc,IAAI,KAAK,EAAE;QAC3E,6DAA6D;QAC7D,yEAAyE,KAAK,EAAE,CACjF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,iEAAiE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAA6C;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACrG,OAAO,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtF,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/build/context-files.d.ts

@@ -0,0 +1,24 @@
+/** Why a relative path must never enter the image, or `undefined`. */
+export declare function forbiddenReason(relPath: string): string | undefined;
+export interface BundleConfig {
+    /** Extra files for the image, as discovery-style globs relative to the pack root. */
+    readonly include: readonly string[];
+}
+/** `bundle` from `kindgi.config.*` — validated; `include` defaults to none. */
+export declare function readBundleConfig(config: Readonly<Record<string, unknown>>): {
+    readonly kind: 'ok';
+    readonly bundle: BundleConfig;
+} | {
+    readonly kind: 'invalid';
+    readonly message: string;
+};
+export type IncludeFilesResult = {
+    readonly kind: 'ok';
+    readonly files: readonly string[];
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+/** The files `include` (`bundle.include`) matches, relative to `packDir` (`/`-separated, sorted). */
+export declare function collectIncludeFiles(packDir: string, include: readonly string[]): Promise<IncludeFilesResult>;
+//# sourceMappingURL=context-files.d.ts.map

package/dist/build/context-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-files.d.ts","sourceRoot":"","sources":["../../src/build/context-files.ts"],"names":[],"mappings":"AAoCA,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMnE;AAED,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAgBjH;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,qGAAqG;AACrG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}

package/dist/build/context-files.js

@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The pack's own files in the image — an explicit allowlist, never
+ * "the pack directory minus a few folders". A pack embedded in an app
+ * has the app's whole tree (and its `.env`) in its directory; copying
+ * that put the app's source and secrets into the image.
+ *
+ * The image runs the pack's bundles, so its source never ships. Of the
+ * pack's files, the image holds exactly what `bundle.include` in
+ * `kindgi.config.*` lists: files a tool reads at runtime rather than
+ * imports. (The install's files are `host-install.ts`'s; the bundles,
+ * the Containerfile and the index are the build's own.)
+ *
+ * Secret-shaped files are refused even when listed: env files,
+ * `.kindgirc.json`, `.npmrc`, `.yarnrc.yml`, private keys, and anything
+ * under `.git/`, `.kindgi/` or `node_modules/`. A build that would ship
+ * one fails, naming it — never a silently different image.
+ */
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createGlobMatcher, discoveryRoots } from '@kindgi/handler-runtime';
+const SECRET_BASENAMES = [
+    /^\.env(\..*)?$/,
+    /^\.kindgirc\.json$/,
+    /^\.npmrc$/,
+    /^\.yarnrc\.yml$/,
+    /\.(pem|key|p12|pfx)$/,
+    /^id_(rsa|ed25519|ecdsa)(\.pub)?$/,
+];
+const FORBIDDEN_SEGMENTS = new Set(['.git', '.kindgi', 'node_modules']);
+/** Why a relative path must never enter the image, or `undefined`. */
+export function forbiddenReason(relPath) {
+    const segments = relPath.split('/');
+    const segment = segments.find((s) => FORBIDDEN_SEGMENTS.has(s));
+    if (segment !== undefined)
+        return `inside ${segment}/`;
+    const base = segments[segments.length - 1] ?? '';
+    return SECRET_BASENAMES.some((r) => r.test(base)) ? 'secret-shaped file' : undefined;
+}
+/** `bundle` from `kindgi.config.*` — validated; `include` defaults to none. */
+export function readBundleConfig(config) {
+    const bundle = config.bundle;
+    if (bundle === undefined)
+        return { kind: 'ok', bundle: { include: [] } };
+    const include = bundle?.include;
+    if (typeof bundle !== 'object' ||
+        bundle === null ||
+        (include !== undefined &&
+            (!Array.isArray(include) || !include.every((g) => typeof g === 'string' && g !== '')))) {
+        return {
+            kind: 'invalid',
+            message: '`bundle.include` in kindgi.config.ts must be a list of file globs relative to the pack root.',
+        };
+    }
+    return { kind: 'ok', bundle: { include: include ?? [] } };
+}
+/** The files `include` (`bundle.include`) matches, relative to `packDir` (`/`-separated, sorted). */
+export async function collectIncludeFiles(packDir, include) {
+    const files = await globFiles(packDir, include);
+    const refused = files
+        .map((rel) => ({ rel, reason: forbiddenReason(rel) }))
+        .filter((f) => f.reason !== undefined);
+    if (refused.length > 0) {
+        return {
+            kind: 'error',
+            message: `Refusing to put these files in the image: ${refused.map((f) => `${f.rel} (${f.reason})`).join(', ')}. Remove the \`bundle.include\` entry.`,
+        };
+    }
+    return { kind: 'ok', files: files.sort() };
+}
+async function globFiles(packDir, patterns) {
+    if (patterns.length === 0)
+        return [];
+    const matches = createGlobMatcher(patterns);
+    const out = [];
+    for (const root of discoveryRoots(patterns))
+        await walk(packDir, root, matches, out);
+    return out;
+}
+async function walk(packDir, rel, matches, out) {
+    let entries;
+    try {
+        entries = await readdir(rel === '' ? packDir : join(packDir, rel), { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (FORBIDDEN_SEGMENTS.has(entry.name))
+            continue;
+        const child = rel === '' ? entry.name : `${rel}/${entry.name}`;
+        if (entry.isDirectory())
+            await walk(packDir, child, matches, out);
+        else if (entry.isFile() && matches(child))
+            out.push(child);
+    }
+}
+//# sourceMappingURL=context-files.js.map

package/dist/build/context-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-files.js","sourceRoot":"","sources":["../../src/build/context-files.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE5E,MAAM,gBAAgB,GAAsB;IAC1C,gBAAgB;IAChB,oBAAoB;IACpB,WAAW;IACX,iBAAiB;IACjB,sBAAsB;IACtB,kCAAkC;CACnC,CAAC;AACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAExE,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,UAAU,OAAO,GAAG,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAOD,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IACzE,MAAM,OAAO,GAAI,MAAuC,EAAE,OAAO,CAAC;IAClE,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,OAAO,KAAK,SAAS;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EACxF,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,8FAA8F;SACxG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAG,OAAgC,IAAI,EAAE,EAAE,EAAE,CAAC;AACtF,CAAC;AAMD,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,6CAA6C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;SACtJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,QAA2B;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,OAAe,EACf,GAAW,EACX,OAAqC,EACrC,GAAa;IAEb,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;aAC7D,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}