@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/dev/runners.d.ts

@@ -0,0 +1,312 @@
+/**
+ * Injectable seams for `kindgi dev`. The command consumes only these
+ * interfaces so tests can hand in a mock runtime / indexer / watcher
+ * without touching Docker, Postgres, the filesystem, or `fs.watch`'s
+ * cross-platform caveats. Production callers wire the real ones from
+ * `packages/cli/src/dev/defaults.ts`: the Kindgi runtime as a container,
+ * `runIndexer` (`@kindgi/handler-runtime`), and an `fs.watch` bridge.
+ */
+import type { PackServiceSupervisor, PackServiceSupervisorEvent } from '@kindgi/handler-runtime/pack-service';
+import type { PackCode } from './pack-code.js';
+/** The running Kindgi runtime `kindgi dev` talks to. */
+export interface RunningApiServer {
+    readonly baseUrl: string;
+    readonly port: number;
+    readonly tenantId: string;
+    /** The user the dev token resolves to. */
+    readonly userId: string;
+    /**
+     * Default project id for the boot tenant. Required for POST-body
+     * primitive-registration routes. `kindgi dev`
+     * threads this into `registerFromIndex` so scaffolded packs land
+     * under the tenant's Default project.
+     */
+    readonly defaultProjectId: string;
+    readonly token: string;
+    readonly banner: string;
+    /**
+     * True when the api-server has the console SPA mounted at
+     * `${baseUrl}/console/`. Depends on the bundled console-assets
+     * directory being present next to the CLI dist — the shipped CLI
+     * ships them; a broken install may not. Absent = console URL
+     * should not be advertised.
+     */
+    readonly consoleMounted?: boolean;
+    shutdown(): Promise<void>;
+}
+export interface StartApiServerOptions {
+    /** The host port the API is reached on (`127.0.0.1` only). */
+    readonly port: number;
+    /** Postgres, as this machine reaches it. */
+    readonly databaseUrl: string;
+    readonly tenantId: string;
+    readonly token: string;
+    /** The user the dev token resolves to — the previous boot's, so reviewer registrations carry over. */
+    readonly userId: string;
+    /** The pack directory: the runtime reads its index and its `.env` files there. */
+    readonly packDir: string;
+    /** `dev.envFiles` from `kindgi.config.ts`; default `.env`, `.env.local`. */
+    readonly localEnvFiles?: readonly string[];
+    /**
+     * The CLI's environment: values for `${VAR}` references the env files
+     * don't define, and `HOME` (Google credentials).
+     */
+    readonly hostEnv: Readonly<Record<string, string | undefined>>;
+    /** The local pack service's front, which the runtime calls the pack's code through. */
+    readonly packService: {
+        readonly url: string;
+        readonly token: string;
+    };
+    /** `KINDGI_PUBLIC_TOKEN_SIGNING_KEY_PATH`: the developer's key file, if set. Otherwise the runtime makes one. */
+    readonly publicRunTokenKeyPath?: string;
+    /** `KINDGI_CORS_ORIGINS`: the browser app's origins, allowed on the run progress routes. */
+    readonly corsOrigins?: readonly string[];
+    /** The runtime image (`--runtime-image`). */
+    readonly runtimeImage: string;
+    /**
+     * `--runtime-url`: a runtime the developer runs themselves (from
+     * source). No container: `kindgi dev` writes `runtime.env` for it and
+     * waits until it serves with this session's dev token.
+     */
+    readonly runtimeUrl?: string;
+    /** Lines the runtime writes. */
+    readonly onLog?: (line: string) => void;
+    /** Progress while preparing (an image pull). */
+    readonly onProgress?: (line: string) => void;
+}
+/**
+ * One bundle of the pack's code: each primitive's source path (as the
+ * index records it) mapped to its bundle, both relative to the pack
+ * root — or the build errors, located `file:line:column`.
+ *
+ * `externals` (a Node pack's): the packages the code loads from the
+ * app's `node_modules`, the same ones a pack image's bundles load — its
+ * primitives' and its config's. Absent for a Python pack.
+ */
+export type PackBuild = {
+    readonly kind: 'ok';
+    readonly bundleMap: Readonly<Record<string, string>>;
+    readonly externals?: readonly ExternalPackage[];
+} | {
+    readonly kind: 'err';
+    readonly errors: readonly string[];
+};
+/** A package the pack's code loads from `node_modules`, and the files that import it. */
+export interface ExternalPackage {
+    /** `@scope/name` or `name`. */
+    readonly name: string;
+    /** Relative to the pack root, sorted. */
+    readonly importers: readonly string[];
+}
+/**
+ * Makes the pack's code ready for the pack service: esbuild bundles for a
+ * Node pack, the sources themselves for a Python one.
+ */
+export interface PackBuilder {
+    /** Build once; picks up added or removed primitive files. */
+    build(): Promise<PackBuild>;
+    /** Rebuild whenever a file any bundle read changes, reporting every build. */
+    watch(onBuild: (build: PackBuild) => void): Promise<void>;
+    /** Pick up added or removed primitive files; resolves `true` when the entries changed. */
+    syncEntries(): Promise<boolean>;
+    dispose(): Promise<void>;
+}
+export interface IndexerRunOptions {
+    /** Import each primitive's bundle instead of its source (source path → bundle path). */
+    readonly bundleMap?: Readonly<Record<string, string>>;
+    /** Run the indexer in a child process with this environment. */
+    readonly env?: () => Promise<Readonly<Record<string, string>>>;
+    /** Which indexer: the TypeScript one (default) or the pack's Python. */
+    readonly code?: PackCode;
+}
+/** The local pack service `kindgi dev` runs the pack's code in. */
+export interface DevPackServiceOptions {
+    readonly packDir: string;
+    /** Which pack service runs the code: the Node one, or the pack's Python. */
+    readonly code: PackCode;
+    /** The pack service's whole environment, read at every start. */
+    readonly env: () => Promise<Readonly<Record<string, string>>>;
+    /** Lines the pack's code writes. */
+    readonly onLog: (line: string, stream: 'stdout' | 'stderr') => void;
+    readonly onEvent: (event: PackServiceSupervisorEvent) => void;
+    /**
+     * The front's port and token: the previous session's, so a runtime
+     * started with them (`--runtime-url`) keeps reaching it. Default: any
+     * free port, a new token.
+     */
+    readonly port?: number;
+    readonly token?: string;
+}
+/**
+ * The local pack service: the public supervisor, children behind a
+ * stable front. The runtime calls the front by URL and token.
+ */
+export type DevPackService = PackServiceSupervisor;
+/**
+ * Shape of `IndexerReport.counts` — kept structural so tests can hand
+ * back plain objects without importing `@kindgi/handler-runtime`.
+ */
+export interface IndexedCounts {
+    readonly tools: number;
+    readonly guardrails: number;
+    readonly agents: number;
+    readonly flows: number;
+}
+/**
+ * The subset of `IndexerReport` `kindgi dev` needs at the callsite.
+ * The full runtime report (published-at, artifact version, etc.) is
+ * present in the manifest but the CLI only surfaces counts + the read
+ * `index.json` bytes.
+ */
+export interface IndexOutcome {
+    readonly kind: 'ok';
+    readonly packId: string;
+    readonly packVersion: string;
+    readonly counts: IndexedCounts;
+    /**
+     * Per-file errors accumulated during indexing. One bad file no
+     * longer aborts the whole pass — registration proceeds on healthy
+     * primitives and the errors surface here for `kindgi dev` to
+     * print. Empty on a fully-clean pass.
+     */
+    readonly fileErrors: readonly {
+        readonly code: string;
+        readonly message: string;
+        readonly filePath?: string;
+    }[];
+    /**
+     * The parsed `index.json` payload — passed straight to the
+     * registration bridge. Kept as `unknown` because the CLI does not
+     * re-validate the shape (`runIndexer` is the authority).
+     */
+    readonly index: unknown;
+}
+export interface IndexFailure {
+    readonly kind: 'err';
+    readonly code: string;
+    readonly message: string;
+    readonly filePath?: string;
+}
+export type IndexResult = IndexOutcome | IndexFailure;
+/**
+ * Watcher handle. `close()` is idempotent — the command may call it
+ * from the graceful-shutdown path after the abort-signal has fired.
+ */
+export interface WatchHandle {
+    close(): Promise<void>;
+}
+/**
+ * Handle returned by `startServices` when auto-start succeeded.
+ * `databaseUrl` is the connection string the runtime should use;
+ * `services` names what runs, for the banner.
+ *
+ * The services aren't stopped when `kindgi dev` exits: every `kindgi dev`
+ * on the machine shares the one `kindgi-dev` compose project, so another
+ * session's runtime may be using them. The next boot picks them up.
+ * `kindgi dev --reset` leaves them alone; `docker compose -p kindgi-dev
+ * down -v` removes them and their data.
+ */
+export interface StartedServicesHandle {
+    readonly databaseUrl: string;
+    readonly services: readonly string[];
+    /**
+     * How they were started: with `docker compose`, or with plain `docker`
+     * when compose isn't available (a Docker engine without the plugin).
+     * The same containers, volume and network either way.
+     */
+    readonly startedWith: 'docker compose' | 'docker';
+    /** What the developer should know about this start: a flag that needs compose. */
+    readonly notes?: readonly string[];
+}
+/**
+ * Outcome of `startServices`. `kind: 'ok'` = started (with docker
+ * compose, or plain docker without it) AND all containers healthy.
+ * `kind: 'unavailable'` = docker itself isn't available (not installed,
+ * or the engine doesn't answer); caller falls back to the
+ * missing-KINDGI_DATABASE_URL error. `kind: 'error'` = docker was
+ * available but the boot failed (image pull, port collision, health
+ * timeout) — caller surfaces the reason.
+ */
+export type StartServicesResult = {
+    readonly kind: 'ok';
+    readonly handle: StartedServicesHandle;
+} | {
+    readonly kind: 'unavailable';
+    readonly reason: string;
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+/**
+ * Injected fixture-friendly runners. Every field has a real
+ * implementation in `dev/defaults.ts`; tests replace individual fields
+ * to bypass Postgres, real file watchers, or the real indexer.
+ */
+export interface DevRunners {
+    /** Boot the api-server. Resolves once the HTTP listener is bound. */
+    readonly startApiServer: (opts: StartApiServerOptions) => Promise<RunningApiServer>;
+    /**
+     * Run the indexer against a pack root + return the parsed
+     * `index.json`, written to `outputPath` (default: the dev index).
+     * Failures are captured — this function never throws.
+     */
+    readonly runIndexer: (packDir: string, outputPath?: string, options?: IndexerRunOptions) => Promise<IndexResult>;
+    /** The builder for the pack's code (esbuild for Node, the sources for Python). */
+    readonly createPackBuilder: (opts: {
+        readonly packDir: string;
+        readonly patterns: readonly string[];
+        /** A Node pack's `kindgi.config.*`: its imports count among the externals, as in a pack image. */
+        readonly configPath?: string;
+        readonly code: PackCode;
+        /** The pack's environment (a Python build runs the pack's interpreter with it). */
+        readonly env: () => Promise<Readonly<Record<string, string>>>;
+    }) => PackBuilder;
+    /** The local pack service (not yet started). */
+    readonly createPackService: (opts: DevPackServiceOptions) => DevPackService;
+    /**
+     * Check a Python pack's interpreter can run pack code (`import kindgi`),
+     * with the pack's environment: a one-line description, or why not.
+     */
+    readonly checkPackPython: (python: readonly [string, ...string[]], env: Readonly<Record<string, string>>, packDir?: string) => Promise<{
+        readonly kind: 'ok';
+        readonly value: string;
+    } | {
+        readonly kind: 'err';
+        readonly message: string;
+    }>;
+    /** Make a staged index the one the api-server reads. */
+    readonly publishIndex: (stagedPath: string, indexPath: string) => Promise<void>;
+    /**
+     * Start watching the pack's discovery patterns (default: the
+     * indexer's `DEFAULT_DISCOVERY`). The callback fires (debounced) when
+     * a file a pattern matches changes, or one of `files` (absolute
+     * paths — the env files). Returns a handle with an idempotent
+     * `close()`.
+     */
+    readonly watchPack: (packDir: string, onChange: () => void, opts?: {
+        readonly debounceMs?: number;
+        readonly patterns?: readonly string[];
+        readonly files?: readonly string[];
+    }) => Promise<WatchHandle>;
+    /**
+     * Auto-start the bundled `docker-compose.dev.yml` (Postgres) with
+     * `docker compose`, in the `kindgi-dev` project, or with plain `docker`
+     * when compose isn't available. Called only when the user did NOT
+     * provide `--database-url` / `KINDGI_DATABASE_URL`. Returns an outcome
+     * enum: `ok` (fall through with the container's URL), `unavailable`
+     * (docker isn't available — caller falls back to the manual error),
+     * or `error` (docker was available but boot failed).
+     *
+     * Optional so tests can leave it unset (falls through to the
+     * current "manual KINDGI_DATABASE_URL required" error).
+     *
+     * `recreate`: let compose recreate the shared Postgres when its
+     * definition changed (`--recreate-services`). Default: an existing
+     * container is reused as it is — another `kindgi dev` may be using it.
+     * Without compose it is always reused; the handle's `notes` say so.
+     */
+    readonly startServices?: (options: {
+        readonly recreate: boolean;
+    }) => Promise<StartServicesResult>;
+}
+//# sourceMappingURL=runners.d.ts.map

package/dist/dev/runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/dev/runners.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,iHAAiH;IACjH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,0FAA0F;IAC1F,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,QAAQ,CAAC;IAClD,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,kGAAkG;QAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,mFAAmF;QACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC/D,KAAK,WAAW,CAAC;IAClB,gDAAgD;IAChD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,cAAc,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EACtC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CACR;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,IAAI,EACpB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,KACE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACpC"}

package/dist/dev/runners.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=runners.js.map

package/dist/dev/runners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.js","sourceRoot":"","sources":["../../src/dev/runners.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/dev/runtime-container.d.ts

@@ -0,0 +1,71 @@
+export type RuntimeNetwork = 'alias' | 'host-network';
+/** The port the image's server listens on (its `KINDGI_API_PORT`). */
+export declare const IMAGE_API_PORT = 4000;
+export interface DockerOutcome {
+    /** The exit code; `null` when `docker` couldn't be spawned. */
+    readonly code: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export interface DockerRunOptions {
+    /**
+     * Written to the command's stdin, which is then closed. A secret (a
+     * registry token) goes here, never in the arguments or the environment.
+     */
+    readonly stdin?: string;
+}
+/** Runs one `docker` command to completion: `docker` below, or a fake in tests. */
+export type DockerRunner = (args: readonly string[], options?: DockerRunOptions) => Promise<DockerOutcome>;
+/** Run one `docker` command to completion. */
+export declare function docker(args: readonly string[], options?: DockerRunOptions): Promise<DockerOutcome>;
+/**
+ * How this machine's Docker reaches the host: Docker Desktop (any OS)
+ * can't see the host's loopback; a Linux engine can share the host
+ * network.
+ */
+export declare function detectRuntimeNetwork(): Promise<RuntimeNetwork>;
+/** The container for this pack directory: one per pack, so two packs can run side by side. */
+export declare function runtimeContainerName(packDir: string): string;
+/**
+ * Make sure the image is here, pulling it if not. A private image needs
+ * a registry login first (`kindgi auth registry`); the error says so.
+ */
+export declare function ensureRuntimeImage(image: string, onProgress: (line: string) => void): Promise<{
+    readonly kind: 'ok';
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+}>;
+export interface RuntimeContainerOptions {
+    readonly image: string;
+    /** The pack directory on the host, mounted at `/pack`. */
+    readonly packDir: string;
+    /** The `runtime.env` file (`docker run --env-file`). */
+    readonly envFile: string;
+    readonly network: RuntimeNetwork;
+    /** The host port the API is reached on (always on `127.0.0.1`). */
+    readonly hostPort: number;
+    /** Credential files mounted read-only, by host path. */
+    readonly googleCredentials?: string;
+    readonly publicTokenKey?: string;
+    /** Every line the runtime writes. */
+    readonly onLog: (line: string) => void;
+}
+export interface RunningRuntimeContainer {
+    readonly name: string;
+    readonly baseUrl: string;
+    /** What the runtime printed until it served: its banner. */
+    readonly banner: string;
+    stop(): Promise<void>;
+}
+/** The `docker run` arguments for the runtime container. */
+export declare function runtimeRunArgs(name: string, options: RuntimeContainerOptions): string[];
+/**
+ * Start the runtime container and wait until it serves. An earlier
+ * container for the same pack (a crashed session) is replaced.
+ */
+export declare function startRuntimeContainer(options: RuntimeContainerOptions, wait?: {
+    readonly timeoutMs?: number;
+    readonly fetch?: typeof fetch;
+}): Promise<RunningRuntimeContainer>;
+//# sourceMappingURL=runtime-container.d.ts.map

package/dist/dev/runtime-container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-container.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-container.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,cAAc,CAAC;AAEtD,sEAAsE;AACtE,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,8CAA8C;AAC9C,wBAAgB,MAAM,CACpB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAMD;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,cAAc,CAAC,CAIpE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAczF;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAuBvF;AAKD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GACxE,OAAO,CAAC,uBAAuB,CAAC,CAgElC"}

package/dist/dev/runtime-container.js

@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The Kindgi runtime as a container under `kindgi dev`: one
+ * container per pack directory, started with `docker run`, configured
+ * only by `runtime.env`, with the pack directory mounted at `/pack`.
+ *
+ * Nothing it serves is reachable from the network:
+ *   - Docker Desktop (`alias`): the API is published on the host's
+ *     `127.0.0.1` only, and loopback calls from the container (the pack
+ *     service, the app's webhooks) go to `host.docker.internal`.
+ *   - Linux (`host-network`): the container shares the host's network,
+ *     binds `127.0.0.1`, and runs as the developer's user, so files it
+ *     writes into the pack stay theirs.
+ */
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { RUNTIME_GOOGLE_CREDENTIALS, RUNTIME_PACK_DIR, RUNTIME_PUBLIC_TOKEN_KEY, } from './runtime-env.js';
+import { isRegistryAuthFailure, registryLoginCommand } from './runtime-registry.js';
+/** The port the image's server listens on (its `KINDGI_API_PORT`). */
+export const IMAGE_API_PORT = 4000;
+/** Run one `docker` command to completion. */
+export function docker(args, options = {}) {
+    return new Promise((resolve) => {
+        const child = spawn('docker', args, {
+            stdio: [options.stdin === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.once('error', (err) => resolve({ code: null, stdout, stderr: err.message }));
+        child.once('close', (code) => resolve({ code, stdout, stderr }));
+        if (options.stdin !== undefined) {
+            // `docker` may exit without reading it (a bad flag, or no `docker`
+            // at all): the write's EPIPE is reported by the exit, not thrown.
+            child.stdin?.on('error', () => undefined);
+            child.stdin?.end(options.stdin);
+        }
+    });
+}
+function lastLines(text, n = 5) {
+    return text.trim().split('\n').slice(-n).join('\n');
+}
+/**
+ * How this machine's Docker reaches the host: Docker Desktop (any OS)
+ * can't see the host's loopback; a Linux engine can share the host
+ * network.
+ */
+export async function detectRuntimeNetwork() {
+    if (process.platform !== 'linux')
+        return 'alias';
+    const info = await docker(['info', '--format', '{{.OperatingSystem}}']);
+    return info.code === 0 && /Docker Desktop/i.test(info.stdout) ? 'alias' : 'host-network';
+}
+/** The container for this pack directory: one per pack, so two packs can run side by side. */
+export function runtimeContainerName(packDir) {
+    return `kindgi-dev-runtime-${createHash('sha256').update(packDir).digest('hex').slice(0, 12)}`;
+}
+/**
+ * Make sure the image is here, pulling it if not. A private image needs
+ * a registry login first (`kindgi auth registry`); the error says so.
+ */
+export async function ensureRuntimeImage(image, onProgress) {
+    const present = await docker(['image', 'inspect', '--format', '{{.Id}}', image]);
+    if (present.code === 0)
+        return { kind: 'ok' };
+    if (present.code === null) {
+        return { kind: 'error', message: `Docker isn't available: ${present.stderr}` };
+    }
+    onProgress(`Pulling the Kindgi runtime image ${image} (first run only)...`);
+    const pulled = await docker(['pull', image]);
+    if (pulled.code === 0)
+        return { kind: 'ok' };
+    const detail = lastLines(pulled.stderr);
+    const auth = isRegistryAuthFailure(pulled.stderr)
+        ? `\n  The runtime image is in private preview: request access at contact@kindgi.com, log in with the pull credentials you receive (${registryLoginCommand(image)}), then run kindgi dev again.`
+        : '';
+    return { kind: 'error', message: `Couldn't pull ${image}: ${detail}${auth}` };
+}
+/** The `docker run` arguments for the runtime container. */
+export function runtimeRunArgs(name, options) {
+    const args = ['run', '--detach', '--rm', '--name', name, '--env-file', options.envFile];
+    args.push('--volume', `${options.packDir}:${RUNTIME_PACK_DIR}`);
+    if (options.googleCredentials !== undefined) {
+        args.push('--volume', `${options.googleCredentials}:${RUNTIME_GOOGLE_CREDENTIALS}:ro`);
+    }
+    if (options.publicTokenKey !== undefined) {
+        args.push('--volume', `${options.publicTokenKey}:${RUNTIME_PUBLIC_TOKEN_KEY}:ro`);
+    }
+    if (options.network === 'host-network') {
+        args.push('--network', 'host');
+        // Files the runtime writes into the pack (secrets) stay the developer's.
+        if (typeof process.getuid === 'function' && typeof process.getgid === 'function') {
+            args.push('--user', `${process.getuid()}:${process.getgid()}`);
+        }
+    }
+    else {
+        args.push('--publish', `127.0.0.1:${options.hostPort}:${IMAGE_API_PORT}`);
+        // Docker Desktop provides the name; other engines get it this way.
+        args.push('--add-host', 'host.docker.internal:host-gateway');
+    }
+    // The image's own argument (its console), then the dev-echo provider.
+    args.push(options.image, '--console-static-dir', '/app/console', '--dev-echo-provider');
+    return args;
+}
+/** The line every runtime that runs a `kindgi dev` pack prints. */
+const PACK_DIR_BANNER = `  Pack: ${RUNTIME_PACK_DIR} `;
+/**
+ * Start the runtime container and wait until it serves. An earlier
+ * container for the same pack (a crashed session) is replaced.
+ */
+export async function startRuntimeContainer(options, wait = {}) {
+    const name = runtimeContainerName(options.packDir);
+    await docker(['rm', '--force', name]);
+    const started = await docker(runtimeRunArgs(name, options));
+    if (started.code !== 0) {
+        throw new Error(`docker run failed: ${lastLines(started.stderr)}`);
+    }
+    const lines = [];
+    let logs = spawn('docker', ['logs', '--follow', name], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const onChunk = (chunk) => {
+        for (const line of chunk.toString().split('\n')) {
+            if (line === '')
+                continue;
+            lines.push(line);
+            options.onLog(line);
+        }
+    };
+    logs.stdout?.on('data', onChunk);
+    logs.stderr?.on('data', onChunk);
+    const stop = async () => {
+        logs?.kill();
+        logs = undefined;
+        await docker(['stop', '--time', '10', name]);
+    };
+    const baseUrl = `http://127.0.0.1:${options.hostPort}`;
+    const doFetch = wait.fetch ?? fetch;
+    const deadline = Date.now() + (wait.timeoutMs ?? 120_000);
+    for (;;) {
+        const healthy = await doFetch(`${baseUrl}/health`, { signal: AbortSignal.timeout(2_000) })
+            .then((r) => r.ok)
+            .catch(() => false);
+        // Serving, and its banner printed (the pack line comes after the URL).
+        if (healthy && lines.some((l) => l.startsWith(PACK_DIR_BANNER)))
+            break;
+        const running = await docker(['inspect', '--format', '{{.State.Running}}', name]);
+        if (running.code !== 0 || running.stdout.trim() !== 'true') {
+            await stop();
+            throw new Error(`the Kindgi runtime container stopped while starting:\n${lines.slice(-15).join('\n')}`);
+        }
+        // The banner ends with the `Env:` line, after the pack line. Without
+        // the pack line, the image predates the runtime's development settings.
+        if (lines.some((l) => l.startsWith('  Env: ')) &&
+            !lines.some((l) => l.startsWith(PACK_DIR_BANNER))) {
+            await stop();
+            throw new Error(`${options.image} can't run a kindgi dev pack: it predates the runtime's development settings. Use a newer image (--runtime-image).`);
+        }
+        if (Date.now() > deadline) {
+            await stop();
+            throw new Error(`the Kindgi runtime didn't start serving in time:\n${lines.slice(-15).join('\n')}`);
+        }
+        await new Promise((r) => setTimeout(r, 250));
+    }
+    return { name, baseUrl, banner: lines.join('\n'), stop };
+}
+//# sourceMappingURL=runtime-container.js.map

package/dist/dev/runtime-container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-container.js","sourceRoot":"","sources":["../../src/dev/runtime-container.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAIpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAuBnC,8CAA8C;AAC9C,MAAM,UAAU,MAAM,CACpB,IAAuB,EACvB,UAA4B,EAAE;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACzE,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,mEAAmE;YACnE,kEAAkE;YAClE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,CAAC,GAAG,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;AAC3F,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,sBAAsB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,UAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,UAAU,CAAC,oCAAoC,KAAK,sBAAsB,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,oIAAoI,oBAAoB,CAAC,KAAK,CAAC,+BAA+B;QAChM,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,KAAK,KAAK,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;AAChF,CAAC;AA0BD,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAgC;IAC3E,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,KAAK,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,KAAK,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/B,yEAAyE;QACzE,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAC,CAAC;QAC1E,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,eAAe,GAAG,WAAW,gBAAgB,GAAG,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgC,EAChC,OAAuE,EAAE;IAEzE,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAA6B,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE;QAC/E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,EAAE,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,SAAS,CAAC;QACjB,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,oBAAoB,OAAO,CAAC,QAAQ,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAC1D,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;aACvF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,uEAAuE;QACvE,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAAE,MAAM;QACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,KAAK,oHAAoH,CACrI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC"}

package/dist/dev/runtime-env.d.ts

@@ -0,0 +1,62 @@
+/** Where the pack directory is mounted in the runtime container. */
+export declare const RUNTIME_PACK_DIR = "/pack";
+/** Where read-only credential files are mounted in the runtime container. */
+export declare const RUNTIME_GOOGLE_CREDENTIALS = "/run/kindgi/google-credentials.json";
+export declare const RUNTIME_PUBLIC_TOKEN_KEY = "/run/kindgi/public-token-signing.pem";
+/** `<pack>/.kindgi/dev/runtime.env`. */
+export declare function runtimeEnvPath(packDir: string): string;
+export interface RuntimeEnvInput {
+    /** The port the API listens on, as the runtime sees it. */
+    readonly apiPort: number;
+    /** `KINDGI_API_HOST`: bind loopback (Linux host networking, or a server on the host). */
+    readonly apiHost?: string;
+    /**
+     * `KINDGI_DEV_HOST_ALIAS`: where loopback calls go when the runtime
+     * can't see the host's loopback (Docker Desktop: `host.docker.internal`).
+     */
+    readonly hostAlias?: string;
+    /** The pack directory, as the runtime sees it (`/pack` in the container). */
+    readonly packDir: string;
+    /** Postgres, as the runtime reaches it. */
+    readonly databaseUrl: string;
+    readonly tenantId: string;
+    readonly token: string;
+    readonly seedUserId: string;
+    /** The pack service's front (`http://127.0.0.1:<port>`; through the alias from a container). */
+    readonly packService: {
+        readonly url: string;
+        readonly token: string;
+    };
+    /** `dev.envFiles`; default `.env`, `.env.local`. */
+    readonly localEnvFiles?: readonly string[];
+    /** Browser origins allowed on the run progress routes. */
+    readonly corsOrigins: readonly string[];
+    /** The developer's public run token key file, as the runtime sees it. */
+    readonly publicTokenKeyPath?: string;
+    /** The developer's Google Application Default Credentials, as the runtime sees them. */
+    readonly googleCredentialsPath?: string;
+    /**
+     * Values from the shell for `${VAR}` references the pack's env files
+     * make and don't define. On the machine the server reads them from the
+     * shell; in the container this is its shell.
+     */
+    readonly shellReferences: Readonly<Record<string, string>>;
+}
+/** The runtime container's environment, by name. */
+export declare function buildRuntimeEnv(input: RuntimeEnvInput): Record<string, string>;
+/**
+ * The shell values the runtime needs for the pack's `${VAR}` references:
+ * names the env files refer to without defining, that the shell has.
+ */
+export declare function shellReferencesOf(input: {
+    readonly packDir: string;
+    readonly localEnvFiles?: readonly string[];
+    readonly shellEnv: Readonly<Record<string, string | undefined>>;
+}): Promise<Record<string, string>>;
+/**
+ * Write the env file `docker run --env-file` reads: `NAME=value` lines,
+ * taken literally (no quotes, no expansion), mode 0600, since it holds
+ * the API token. A value with a line break can't be written.
+ */
+export declare function writeRuntimeEnv(path: string, env: Readonly<Record<string, string>>): Promise<void>;
+//# sourceMappingURL=runtime-env.d.ts.map