@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/deploy/post.js

@@ -0,0 +1,210 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * `POST /v1/deployments` wire adapter. Two exports:
+ *
+ *   - `buildPostBody(envelope)` — strips `tenantId` + `$schema` +
+ *     `buildLogsUrl` from the envelope; the server derives `tenantId`
+ *     from the bearer token and returns 400 signature-invalid if the
+ *     signed envelope's tenantId doesn't match. `buildLogsUrl` is CLI-
+ *     local metadata, not part of the wire contract.
+ *
+ *   - `deriveIdempotencyKey(body)` — `sha256:<hex>` over the
+ *     canonicalised POST body; matches every other hash shape in the
+ *     codebase. Callers can override via
+ *     `--idempotency-key <str>` for CI re-runs that manage keys
+ *     externally.
+ *
+ *   - `postDeploymentReal(opts)` — the production runner: does the
+ *     actual HTTP POST via the caller-supplied `fetchImpl`, parses the
+ *     server's response, discriminates 201 / 200 / 4xx / 5xx.
+ */
+import { createHash } from 'node:crypto';
+import { stableStringify } from '../build/envelope.js';
+/**
+ * Build the exact wire body per
+ * `packages/api/src/openapi/schemas.ts:3141` — the
+ * `DeploymentRegistrationBodySchema`. `tenantId` is deliberately
+ * absent (server-derived from the token); the envelope's signature
+ * covers it via re-canonicalisation on the server.
+ *
+ * `$schema` (envelope-side namespace pin) and `buildLogsUrl` (build-
+ * server URL, only useful for humans debugging failed builds) are
+ * client-side metadata — not part of the deployment wire contract.
+ */
+export function buildPostBody(envelope) {
+    if (envelope.signerKeyId === undefined ||
+        envelope.signerPublicKey === undefined ||
+        envelope.signature === undefined) {
+        // Should not happen — the caller pre-validates via `isEnvelopeSigned`.
+        // We throw here (as opposed to returning Result) because it's a
+        // programmer error, not user error.
+        throw new Error('buildPostBody() called on an unsigned envelope. Check with `isEnvelopeSigned` first.');
+    }
+    return {
+        imageRef: envelope.imageRef,
+        artifactVersion: envelope.artifactVersion,
+        index: envelope.index,
+        indexHash: envelope.indexHash,
+        signerKeyId: envelope.signerKeyId,
+        signerPublicKey: envelope.signerPublicKey,
+        signature: envelope.signature,
+        publishedAt: envelope.publishedAt,
+    };
+}
+/**
+ * `sha256:<hex>` over the canonical (sorted-key, no-whitespace) JSON
+ * representation of the wire body. Matches the sha256 shape every other hash in the framework uses.
+ *
+ * The idempotency middleware on `packages/api` caches the full HTTP
+ * response by `(tenantId, Idempotency-Key)`. Same body → same key →
+ * same cached response (201 or 200-replay). Different body + same
+ * key → server returns `idempotency-key-conflict`.
+ */
+export function deriveIdempotencyKey(body) {
+    const canonical = stableStringify(body);
+    const hex = createHash('sha256').update(canonical).digest('hex');
+    return `sha256:${hex}`;
+}
+/**
+ * Production `postDeployment` runner. Executes the HTTP POST, parses
+ * the response, discriminates the outcome. Tests substitute this whole
+ * function via `DeployRunners.postDeployment` to keep the wire
+ * synthetic.
+ */
+export async function postDeploymentReal(opts) {
+    const url = `${opts.endpoint.replace(/\/+$/, '')}/v1/deployments`;
+    let res;
+    try {
+        res = await opts.fetchImpl(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${opts.token}`,
+                'Content-Type': 'application/json',
+                'Idempotency-Key': opts.idempotencyKey,
+            },
+            body: JSON.stringify(opts.body),
+            ...(opts.signal !== undefined && { signal: opts.signal }),
+        });
+    }
+    catch (err) {
+        return {
+            kind: 'transport-error',
+            message: `POST ${url} failed: ${err.message}`,
+        };
+    }
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch {
+        // Non-JSON body — treat as transport-level failure.
+        return {
+            kind: 'transport-error',
+            message: `POST ${url} returned HTTP ${res.status} with non-JSON body`,
+        };
+    }
+    if (res.status === 201) {
+        return {
+            kind: 'created',
+            status: 201,
+            record: body,
+        };
+    }
+    if (res.status === 200) {
+        return {
+            kind: 'replayed',
+            status: 200,
+            record: body,
+        };
+    }
+    // 4xx / 5xx — the api-server wraps errors in `{ error: { code,
+    // message, ...details } }` via `toWireError` in
+    // `packages/api/src/errors.ts`.
+    const wire = body;
+    const code = wire?.error?.code ?? `http-${res.status}`;
+    const message = wire?.error?.message ?? `HTTP ${res.status}`;
+    const details = extractDetails(wire?.error);
+    return {
+        kind: 'wire-error',
+        status: res.status,
+        error: { code, message, ...(details !== undefined && { details }) },
+    };
+}
+function extractDetails(err) {
+    if (err === undefined)
+        return undefined;
+    const issues = err.issues;
+    if (Array.isArray(issues)) {
+        return issues;
+    }
+    return undefined;
+}
+/**
+ * Derive the Idempotency-Key for a sync-secrets POST. Same shape as
+ * `deriveIdempotencyKey` for deployments (sha256 of canonical body) —
+ * so a re-run of the same deploy with the same `.env.<envName>` sends
+ * the same key and the server middleware caches the response.
+ */
+export function deriveSyncSecretsIdempotencyKey(deploymentId, body) {
+    const canonical = stableStringify({ deploymentId, ...body });
+    const hex = createHash('sha256').update(canonical).digest('hex');
+    return `sha256:${hex}`;
+}
+/**
+ * Production `syncSecrets` runner. Executes
+ * `POST /v1/deployments/:deploymentId/secrets` — the wire body carries
+ * plaintext `value` entries at the developer boundary; the server
+ * responds with references only. Errors surface as `wire-error` (with
+ * the server's error code preserved for the CLI banner) or
+ * `transport-error`.
+ */
+export async function syncSecretsReal(opts) {
+    const url = `${opts.endpoint.replace(/\/+$/, '')}/v1/deployments/${encodeURIComponent(opts.deploymentId)}/secrets`;
+    let res;
+    try {
+        res = await opts.fetchImpl(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${opts.token}`,
+                'Content-Type': 'application/json',
+                'Idempotency-Key': opts.idempotencyKey,
+            },
+            body: JSON.stringify(opts.body),
+            ...(opts.signal !== undefined && { signal: opts.signal }),
+        });
+    }
+    catch (err) {
+        return {
+            kind: 'transport-error',
+            message: `POST ${url} failed: ${err.message}`,
+        };
+    }
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch {
+        return {
+            kind: 'transport-error',
+            message: `POST ${url} returned HTTP ${res.status} with non-JSON body`,
+        };
+    }
+    if (res.status === 200) {
+        return {
+            kind: 'ok',
+            status: 200,
+            response: body,
+        };
+    }
+    const wire = body;
+    return {
+        kind: 'wire-error',
+        status: res.status,
+        error: {
+            code: wire?.error?.code ?? `http-${res.status}`,
+            message: wire?.error?.message ?? `HTTP ${res.status}`,
+        },
+    };
+}
+//# sourceMappingURL=post.js.map

package/dist/deploy/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../src/deploy/post.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAavD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,QAAQ,CAAC,eAAe,KAAK,SAAS;QACtC,QAAQ,CAAC,SAAS,KAAK,SAAS,EAChC,CAAC;QACD,uEAAuE;QACvE,gEAAgE;QAChE,oCAAoC;QACpC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA2B;IAE3B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC;IAClE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,IAAI,CAAC,cAAc;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,QAAQ,GAAG,YAAa,GAAa,CAAC,OAAO,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;QACpD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,QAAQ,GAAG,kBAAkB,GAAG,CAAC,MAAM,qBAAqB;SACtE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,IAAwB;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,IAAwB;SACjC,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,gDAAgD;IAChD,gCAAgC;IAChC,MAAM,IAAI,GAAG,IAA8D,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,GAAyC;IAEzC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAA4C,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAoB,EACpB,IAAqB;IAErB,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAwB;IAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;IACnH,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,IAAI,CAAC,cAAc;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,QAAQ,GAAG,YAAa,GAAa,CAAC,OAAO,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,QAAQ,GAAG,kBAAkB,GAAG,CAAC,MAAM,qBAAqB;SACtE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,IAA0B;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAA8D,CAAC;IAC5E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;YAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;SACtD;KACF,CAAC;AACJ,CAAC"}

package/dist/deploy/response.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Deploy response formatters — turn a `PostDeploymentResult` into the
+ * banner lines + JSON summary the command emits. Split out from
+ * `commands/deploy.ts` so tests can pin the exact text without
+ * exercising the full runCli path.
+ */
+import type { DeploymentRecord, PostDeploymentResult } from './runners.js';
+export interface RenderedResponse {
+    /** Lines to append to the stderr banner. */
+    readonly banner: readonly string[];
+    /** The value to render as JSON on stdout. `null` for error outcomes. */
+    readonly summary: Record<string, unknown> | null;
+    /** Exit code the command should return. */
+    readonly exitCode: number;
+}
+/**
+ * Render a POST outcome. Includes the "what the developer sees"
+ * summary for 201/200 outcomes + code-specific hints for 4xx.
+ */
+export declare function renderResponse(result: PostDeploymentResult, ctx: {
+    readonly envName: string;
+    readonly endpoint: string;
+    readonly imageRef: string;
+    readonly artifactVersion: string;
+    readonly indexHash: string;
+    readonly indexCounts: Readonly<{
+        tools: number;
+        guardrails: number;
+        agents: number;
+        flows: number;
+    }>;
+    readonly signerKeyId: string;
+    readonly envelopePath: string;
+    readonly idempotencyKey: string;
+}): RenderedResponse;
+/**
+ * Pretty-print the primitive counts on one line
+ * ("primitives: 5 tools, 1 guardrail, 2 agents"). Handles pluralisation
+ * (`guardrail` vs `guardrails` etc.).
+ */
+export declare function primitivesLine(p: DeploymentRecord['primitives']): string;
+//# sourceMappingURL=response.d.ts.map

package/dist/deploy/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../src/deploy/response.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AA8B3E,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACjD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACA,gBAAgB,CAiFlB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,GAAG,MAAM,CAOxE"}

package/dist/deploy/response.js

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Human-friendly hint text keyed by server wire-error code. Each hint
+ * points the developer at the most likely remedy. Unknown codes fall
+ * through to a generic "check server logs" line.
+ */
+const WIRE_ERROR_HINTS = {
+    'signature-invalid': 'Check that --tenant matches the tenant your token authenticates as. ' +
+        "The server re-canonicalises the envelope using the token's tenantId; " +
+        'a mismatch fails signature verification.',
+    'signer-not-trusted': "The signing key's public key is not on this tenant's trust list. " +
+        'Print it with `kindgi key export <keyId>` and have your Kindgi operator ' +
+        'add it to the trust list (SigningKeyBinding).',
+    'image-unverifiable': 'The server could not pull the image or the extracted /app/index.json ' +
+        'sha256 did not match the signed indexHash. Verify the build server ' +
+        'pushed to the same registry the deployment tenant can pull from, and ' +
+        'that the imageRef in the envelope is digest-pinned.',
+    'deployment-validation-failed': 'One or more primitives in the pack failed server-side validation. ' +
+        'The `details[]` array below names each failing primitive + path + ' +
+        'message. Fix locally + re-run `kindgi build`.',
+    'bad-input': 'The wire body was malformed. Regenerate the envelope with ' +
+        '`kindgi build` — a partial write on disk can cause this.',
+};
+/**
+ * Render a POST outcome. Includes the "what the developer sees"
+ * summary for 201/200 outcomes + code-specific hints for 4xx.
+ */
+export function renderResponse(result, ctx) {
+    if (result.kind === 'created' || result.kind === 'replayed') {
+        const banner = [];
+        banner.push('  Registering deployment');
+        const statusLabel = result.kind === 'created' ? '201 Created' : '200 OK (idempotent replay)';
+        banner.push(`    ✓ POST /v1/deployments  →  ${statusLabel}`);
+        banner.push(`      deploymentId:    ${result.record.deploymentId}`);
+        banner.push(`      artifactVersion: ${result.record.artifactVersion}`);
+        banner.push(`      primitives:      ${primitivesLine(result.record.primitives)}`);
+        banner.push(`      activatedAt:     ${result.record.activatedAt}`);
+        banner.push('');
+        if (result.kind === 'replayed') {
+            banner.push('  Note: same imageDigest previously landed. Server returned the existing record.');
+            banner.push(`  Runs already in flight continue on their pinned image (${result.record.imageDigest.slice(0, 20)}…).`);
+        }
+        else {
+            banner.push('  Deploy complete.');
+            banner.push(`  Runs started from now use image ${result.record.imageDigest.slice(0, 20)}… ` +
+                `(artifactVersion ${result.record.artifactVersion}).`);
+            banner.push('  Runs already in flight continue on their pinned image.');
+        }
+        banner.push('');
+        const summary = {
+            envName: ctx.envName,
+            endpoint: ctx.endpoint,
+            envelopePath: ctx.envelopePath,
+            idempotencyKey: ctx.idempotencyKey,
+            status: result.status,
+            outcome: result.kind === 'created' ? 'created' : 'replayed',
+            deployment: result.record,
+        };
+        return { banner, summary, exitCode: 0 };
+    }
+    if (result.kind === 'wire-error') {
+        const banner = [];
+        banner.push('  Registering deployment');
+        banner.push(`    ✗ POST /v1/deployments  →  HTTP ${result.status}`);
+        banner.push(`      code:    ${result.error.code}`);
+        banner.push(`      message: ${result.error.message}`);
+        const hint = WIRE_ERROR_HINTS[result.error.code];
+        if (hint !== undefined) {
+            banner.push('');
+            banner.push('  Hint:');
+            for (const line of wrapForBanner(hint, 74, '    ')) {
+                banner.push(line);
+            }
+        }
+        if (result.error.details !== undefined && result.error.details.length > 0) {
+            banner.push('');
+            banner.push('  Details:');
+            for (const detail of result.error.details) {
+                banner.push(`    · ${JSON.stringify(detail)}`);
+            }
+        }
+        if (result.status >= 500) {
+            banner.push('');
+            banner.push('  This is a server error — check the api-server logs. Idempotent-safe to retry.');
+        }
+        banner.push('');
+        return { banner, summary: null, exitCode: 1 };
+    }
+    // transport-error
+    const banner = [];
+    banner.push('  Registering deployment');
+    banner.push('    ✗ POST /v1/deployments  →  transport failure');
+    banner.push(`      ${result.message}`);
+    banner.push('');
+    banner.push('  Check network connectivity + endpoint URL. Idempotent-safe to retry with the same key.');
+    banner.push('');
+    return { banner, summary: null, exitCode: 1 };
+}
+/**
+ * Pretty-print the primitive counts on one line
+ * ("primitives: 5 tools, 1 guardrail, 2 agents"). Handles pluralisation
+ * (`guardrail` vs `guardrails` etc.).
+ */
+export function primitivesLine(p) {
+    const parts = [];
+    parts.push(`${p.tools} ${p.tools === 1 ? 'tool' : 'tools'}`);
+    parts.push(`${p.guardrails} ${p.guardrails === 1 ? 'guardrail' : 'guardrails'}`);
+    parts.push(`${p.agents} ${p.agents === 1 ? 'agent' : 'agents'}`);
+    parts.push(`${p.flows} ${p.flows === 1 ? 'flow' : 'flows'}`);
+    return parts.join(', ');
+}
+function wrapForBanner(text, width, indent) {
+    const words = text.split(/\s+/);
+    const lines = [];
+    let current = indent;
+    for (const word of words) {
+        if (current.length + word.length + 1 > width && current !== indent) {
+            lines.push(current);
+            current = indent;
+        }
+        current += (current === indent ? '' : ' ') + word;
+    }
+    if (current !== indent)
+        lines.push(current);
+    return lines;
+}
+//# sourceMappingURL=response.js.map

package/dist/deploy/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../src/deploy/response.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC;;;;GAIG;AACH,MAAM,gBAAgB,GAAqC;IACzD,mBAAmB,EACjB,sEAAsE;QACtE,uEAAuE;QACvE,0CAA0C;IAC5C,oBAAoB,EAClB,mEAAmE;QACnE,0EAA0E;QAC1E,+CAA+C;IACjD,oBAAoB,EAClB,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,qDAAqD;IACvD,8BAA8B,EAC5B,oEAAoE;QACpE,oEAAoE;QACpE,+CAA+C;IACjD,WAAW,EACT,4DAA4D;QAC5D,0DAA0D;CAC7D,CAAC;AAWF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA4B,EAC5B,GAeC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,kCAAkC,WAAW,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,0BAA0B,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CACT,kFAAkF,CACnF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,4DAA4D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACxG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,qCAAqC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;gBAC7E,oBAAoB,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,CACxD,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,OAAO,GAA4B;YACvC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC3D,UAAU,EAAE,MAAM,CAAC,MAAM;SAC1B,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,iFAAiF,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,kBAAkB;IAClB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,IAAI,CACT,0FAA0F,CAC3F,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,CAAiC;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/deploy/runners.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Injectable seams for `kindgi deploy` — the client-side POST
+ * orchestrator that lands a signed pack image on a Kindgi runtime
+ * (the one deployment wire call). Every side effect flows through this interface so tests
+ * substitute fixtures without ever booting `kindgi build` or hitting
+ * a real api-server.
+ *
+ * Three slots — the shape of the pipeline `commands/deploy.ts`
+ * composes:
+ *
+ *   1. `runBuild` — inline `kindgi build` when the envelope isn't
+ *      already on disk. Composed from a fresh `BuildRunners` set (the
+ *      command wires its own `ctx.buildRunners` through).
+ *   2. `loadEnvelope` — read + JSON-parse `deploy-envelope.json` from a
+ *      resolved absolute path.
+ *   3. `postDeployment` — POST the built body to `/v1/deployments`,
+ *      returning the parsed response record (or the wire error).
+ *
+ * The build inline step reuses the exact same `BuildRunners` seam
+ * `kindgi build` uses — no fresh interface, no duplicated
+ * plumbing. `kindgi deploy` = `kindgi build` + one more POST.
+ */
+import type { DeployEnvelope } from '../build/envelope.js';
+export interface LoadEnvelopeOptions {
+    readonly path: string;
+}
+export type LoadEnvelopeResult = {
+    readonly kind: 'ok';
+    readonly envelope: DeployEnvelope;
+} | {
+    readonly kind: 'err';
+    readonly code: 'envelope-not-found' | 'envelope-invalid-json' | 'envelope-schema-mismatch';
+    readonly message: string;
+    readonly path: string;
+};
+/**
+ * Exact wire body per `packages/api/src/openapi/schemas.ts`'s
+ * `DeploymentRegistrationBodySchema`. `tenantId` is deliberately absent
+ * — the server derives it from the bearer token. The client's signed
+ * envelope MUST have signed against the same tenantId the token
+ * authenticates as, or the server rejects with `signature-invalid`.
+ */
+export interface PostDeploymentBody {
+    readonly imageRef: string;
+    readonly artifactVersion: string;
+    readonly index: Readonly<Record<string, unknown>>;
+    readonly indexHash: string;
+    readonly signerKeyId: string;
+    readonly signerPublicKey: string;
+    readonly signature: string;
+    readonly publishedAt: string;
+}
+/**
+ * Wire response for `POST /v1/deployments` — the `DeploymentRecord`
+ * shape from `packages/api/src/openapi/schemas.ts:3071`.
+ */
+export interface DeploymentRecord {
+    readonly deploymentId: string;
+    readonly tenantId: string;
+    readonly imageRef: string;
+    readonly imageDigest: string;
+    readonly artifactVersion: string;
+    readonly indexHash: string;
+    readonly signerKeyId: string;
+    readonly signerPublicKey: string;
+    readonly signature: string;
+    readonly publishedAt: string;
+    readonly activatedAt: string;
+    readonly primitives: {
+        readonly tools: number;
+        readonly guardrails: number;
+        readonly agents: number;
+        readonly flows: number;
+    };
+}
+export interface PostDeploymentOptions {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly body: PostDeploymentBody;
+    readonly idempotencyKey: string;
+    readonly fetchImpl: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+export type PostDeploymentResult = {
+    readonly kind: 'created';
+    readonly status: 201;
+    readonly record: DeploymentRecord;
+} | {
+    readonly kind: 'replayed';
+    readonly status: 200;
+    readonly record: DeploymentRecord;
+} | {
+    readonly kind: 'wire-error';
+    readonly status: number;
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+        readonly details?: readonly Record<string, unknown>[];
+    };
+} | {
+    readonly kind: 'transport-error';
+    readonly message: string;
+};
+export interface RunBuildOptions {
+    /**
+     * The parsed CLI options the build command would consume. The deploy
+     * command derives this from its own flag set + the resolved env
+     * block. Kept opaque so `deploy` doesn't need to know every flag
+     * `build` accepts.
+     */
+    readonly buildArgv: readonly string[];
+    /**
+     * The pack directory (`--path`) — resolved absolute path. The build
+     * inline step needs it to load `kindgi.config.ts` and locate the
+     * default `.kindgi/build/` output.
+     */
+    readonly packDir: string;
+}
+export type RunBuildResult = {
+    readonly kind: 'ok';
+    /** Absolute path of the freshly-emitted `deploy-envelope.json`. */
+    readonly envelopePath: string;
+    /** Human-readable banner lines from the underlying build. */
+    readonly banner: string;
+} | {
+    readonly kind: 'err';
+    readonly exitCode: number;
+    readonly stderr: string;
+};
+/**
+ * Wire body for `POST /v1/deployments/:deploymentId/secrets`. Mirror
+ * of the server-side `DeploymentSecretsSyncRequestSchema` in
+ * `packages/api/src/openapi/schemas.ts`. Each entry sets exactly one
+ * of `ref` (validate-only) or `value` (write new version).
+ *
+ * The CLI only emits `{ name, value }` entries — the `.env.<envName>`
+ * file carries plaintext values, and the server-side scope is derived
+ * from the deployment row itself (never the wire).
+ */
+export interface SyncSecretsBody {
+    readonly envName: string;
+    readonly secrets: readonly ({
+        readonly name: string;
+        readonly ref: string;
+    } | {
+        readonly name: string;
+        readonly value: string;
+    })[];
+}
+export interface SyncSecretsReference {
+    readonly name: string;
+    readonly ref: string;
+    readonly version: number;
+}
+export interface SyncSecretsSuccess {
+    readonly resolved: number;
+    readonly added: number;
+    readonly references: readonly SyncSecretsReference[];
+}
+export interface SyncSecretsOptions {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly deploymentId: string;
+    readonly body: SyncSecretsBody;
+    readonly idempotencyKey: string;
+    readonly fetchImpl: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+export type SyncSecretsResult = {
+    readonly kind: 'ok';
+    readonly status: 200;
+    readonly response: SyncSecretsSuccess;
+} | {
+    readonly kind: 'wire-error';
+    readonly status: number;
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+    };
+} | {
+    readonly kind: 'transport-error';
+    readonly message: string;
+};
+/**
+ * Injected seams the `deploy` command consumes. Every side effect must
+ * pass through one of these — no `fetch()` inside `commands/deploy.ts`,
+ * no direct filesystem writes outside `loadEnvelope`, no inline build
+ * outside `runBuild`. Tests substitute per-field to exercise every
+ * branch without ever booting `kindgi build`, hitting a real
+ * api-server, or reading a real envelope file.
+ */
+export interface DeployRunners {
+    /** Read `deploy-envelope.json` from disk + structurally validate. */
+    readonly loadEnvelope: (opts: LoadEnvelopeOptions) => Promise<LoadEnvelopeResult>;
+    /** POST the deployment body to `/v1/deployments`. */
+    readonly postDeployment: (opts: PostDeploymentOptions) => Promise<PostDeploymentResult>;
+    /**
+     * Inline-build fallback used when no `deploy-envelope.json` is present
+     * on disk and `--from-envelope` was not explicitly supplied.
+     * Production wiring shells out (in-process) to the same `runBuild`
+     * exported from `commands/build.ts`, threading the current
+     * `ctx.buildRunners` through so tests keep control of every stage.
+     * Absent in test fixtures that supply their own envelope — the
+     * command surfaces a clear error if inline build is required but no
+     * runner is wired.
+     */
+    readonly runBuild?: (opts: RunBuildOptions) => Promise<RunBuildResult>;
+    /**
+     * Post-deploy secret sync. Called ONLY when the
+     * user passes `--sync-secrets` AND a local `.env.<envName>` file
+     * carries entries. POSTs plaintext values (the wire-carry point is
+     * the developer boundary; the server responds with references
+     * only). Absent runner in tests → the command surfaces a clear
+     * "runner not wired" error even when the flag is passed.
+     */
+    readonly syncSecrets?: (opts: SyncSecretsOptions) => Promise<SyncSecretsResult>;
+}
+//# sourceMappingURL=runners.d.ts.map

package/dist/deploy/runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/deploy/runners.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,0BAA0B,CAAC;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAMN;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KACvD,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAMN,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAMN;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,CACvB;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACpD,EAAE,CAAC;CACL;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAMN;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClF,qDAAqD;IACrD,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACvE;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACjF"}

package/dist/deploy/runners.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=runners.js.map

package/dist/deploy/runners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.js","sourceRoot":"","sources":["../../src/deploy/runners.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/dev/bundler.d.ts

@@ -0,0 +1,10 @@
+import type { PackBuilder } from './runners.js';
+export interface DevPackBuilderOptions {
+    readonly packDir: string;
+    /** The pack's discovery patterns. */
+    readonly patterns: readonly string[];
+    /** The pack's `kindgi.config.*`, whose imports count among the externals. */
+    readonly configPath?: string;
+}
+export declare function createDevPackBuilder(options: DevPackBuilderOptions): PackBuilder;
+//# sourceMappingURL=bundler.d.ts.map

package/dist/dev/bundler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundler.d.ts","sourceRoot":"","sources":["../../src/dev/bundler.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAA8B,WAAW,EAAE,MAAM,cAAc,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAKD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,WAAW,CAuHhF"}