@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/dev/runtime-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-env.ts"],"names":[],"mappings":"AAgBA,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,wCAAwC,CAAC;AAChF,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAE/E,wCAAwC;AACxC,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,yEAAyE;IACzE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAKD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoC9E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACjE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAalC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/dev/runtime-env.js

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The runtime's environment under `kindgi dev`: everything the Kindgi
+ * runtime container is told, written to `<pack>/.kindgi/dev/runtime.env`
+ * (mode 0600) and handed to `docker run --env-file`. The runtime reads
+ * nothing else from the developer's machine. Names are
+ * `@kindgi/env-schema`'s.
+ */
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { LOCAL_ENV_NAME, readPackEnv } from '@kindgi/secrets-dotenv';
+/** Where the pack directory is mounted in the runtime container. */
+export const RUNTIME_PACK_DIR = '/pack';
+/** Where read-only credential files are mounted in the runtime container. */
+export const RUNTIME_GOOGLE_CREDENTIALS = '/run/kindgi/google-credentials.json';
+export const RUNTIME_PUBLIC_TOKEN_KEY = '/run/kindgi/public-token-signing.pem';
+/** `<pack>/.kindgi/dev/runtime.env`. */
+export function runtimeEnvPath(packDir) {
+    return join(packDir, '.kindgi', 'dev', 'runtime.env');
+}
+/** Names whose shell value is a path on the host: never handed to the container. */
+const HOST_PATH_NAMES = new Set(['GOOGLE_APPLICATION_CREDENTIALS']);
+/** The runtime container's environment, by name. */
+export function buildRuntimeEnv(input) {
+    const env = {
+        KINDGI_DEV: 'true',
+        KINDGI_ENV: LOCAL_ENV_NAME,
+        KINDGI_API_PORT: String(input.apiPort),
+        ...(input.apiHost !== undefined && { KINDGI_API_HOST: input.apiHost }),
+        ...(input.hostAlias !== undefined && { KINDGI_DEV_HOST_ALIAS: input.hostAlias }),
+        KINDGI_DATABASE_URL: input.databaseUrl,
+        KINDGI_TENANT_ID: input.tenantId,
+        KINDGI_API_TOKEN: input.token,
+        KINDGI_SEED_USER_ID: input.seedUserId,
+        KINDGI_PACK_DIR: input.packDir,
+        KINDGI_DEV_CONSOLE_LOGIN: 'true',
+        KINDGI_SECRETS_BACKEND: 'dotenv',
+        KINDGI_SECRETS_DOTENV_DIR: input.packDir,
+        ...(input.localEnvFiles !== undefined && {
+            KINDGI_SECRETS_DOTENV_FILES: input.localEnvFiles.join(','),
+        }),
+        KINDGI_PACK_SERVICE_URL: input.packService.url,
+        KINDGI_PACK_SERVICE_TOKEN: input.packService.token,
+        ...(input.corsOrigins.length > 0 && { KINDGI_CORS_ORIGINS: input.corsOrigins.join(',') }),
+        ...(input.publicTokenKeyPath !== undefined && {
+            KINDGI_PUBLIC_TOKEN_SIGNING_KEY_PATH: input.publicTokenKeyPath,
+        }),
+        ...(input.googleCredentialsPath !== undefined && {
+            GOOGLE_APPLICATION_CREDENTIALS: input.googleCredentialsPath,
+        }),
+    };
+    for (const [name, value] of Object.entries(input.shellReferences)) {
+        // The runtime's own settings come from kindgi dev, never from a
+        // reference; a host path to credentials means nothing in the
+        // container (they're mounted, at a path of its own).
+        if (name.startsWith('KINDGI_') || name in env || HOST_PATH_NAMES.has(name))
+            continue;
+        env[name] = value;
+    }
+    return env;
+}
+/**
+ * The shell values the runtime needs for the pack's `${VAR}` references:
+ * names the env files refer to without defining, that the shell has.
+ */
+export async function shellReferencesOf(input) {
+    const files = await readPackEnv({
+        packDir: input.packDir,
+        envName: LOCAL_ENV_NAME,
+        ...(input.localEnvFiles !== undefined && { localEnvFiles: input.localEnvFiles }),
+    });
+    const out = {};
+    for (const d of files.diagnostics) {
+        if (d.kind !== 'unresolved')
+            continue;
+        const value = input.shellEnv[d.ref];
+        if (value !== undefined)
+            out[d.ref] = value;
+    }
+    return out;
+}
+/**
+ * Write the env file `docker run --env-file` reads: `NAME=value` lines,
+ * taken literally (no quotes, no expansion), mode 0600, since it holds
+ * the API token. A value with a line break can't be written.
+ */
+export async function writeRuntimeEnv(path, env) {
+    const lines = Object.entries(env).map(([name, value]) => {
+        if (/[\r\n]/.test(value)) {
+            throw new Error(`${name} has a line break, which an env file can't hold.`);
+        }
+        return `${name}=${value}`;
+    });
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `# Written by kindgi dev for the Kindgi runtime container. Holds the dev token: keep it private.\n${lines.join('\n')}\n`, { mode: 0o600 });
+    // An existing file keeps its mode through writeFile: set it.
+    await chmod(path, 0o600);
+}
+//# sourceMappingURL=runtime-env.js.map

package/dist/dev/runtime-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../../src/dev/runtime-env.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErE,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;AAE/E,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC;AAqCD,oFAAoF;AACpF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;AAEzF,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,GAAG,GAA2B;QAClC,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,cAAc;QAC1B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAChF,mBAAmB,EAAE,KAAK,CAAC,WAAW;QACtC,gBAAgB,EAAE,KAAK,CAAC,QAAQ;QAChC,gBAAgB,EAAE,KAAK,CAAC,KAAK;QAC7B,mBAAmB,EAAE,KAAK,CAAC,UAAU;QACrC,eAAe,EAAE,KAAK,CAAC,OAAO;QAC9B,wBAAwB,EAAE,MAAM;QAChC,sBAAsB,EAAE,QAAQ;QAChC,yBAAyB,EAAE,KAAK,CAAC,OAAO;QACxC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI;YACvC,2BAA2B,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;SAC3D,CAAC;QACF,uBAAuB,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;QAC9C,yBAAyB,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK;QAClD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI;YAC5C,oCAAoC,EAAE,KAAK,CAAC,kBAAkB;SAC/D,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI;YAC/C,8BAA8B,EAAE,KAAK,CAAC,qBAAqB;SAC5D,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAClE,gEAAgE;QAChE,6DAA6D;QAC7D,qDAAqD;QACrD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACrF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAIvC;IACC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,cAAc;QACvB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;KACjF,CAAC,CAAC;IACH,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,GAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CACb,IAAI,EACJ,oGAAoG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EACxH,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,6DAA6D;IAC7D,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/dev/runtime-image.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The Kindgi runtime image `kindgi dev` runs. One place names
+ * it, so a release pins the image it was tested with and a pull token
+ * can drop in later. `--runtime-image` overrides it.
+ *
+ * Pinned by digest, not tag: Docker doesn't re-pull a tag it already has, so
+ * a tag would leave anyone with an older pull on an older runtime.
+ *
+ * The image is in private preview on Quay (pull credentials on request at
+ * contact@kindgi.com, then `kindgi auth registry --username <name>`).
+ */
+export declare const DEFAULT_RUNTIME_IMAGE = "quay.io/kindgi/runtime:0.1.1@sha256:eaa3a981f88f37efa3a33955d24c40df31474997e0318b006e983f411fdd8654";
+/**
+ * The registry an image reference is pulled from, read the way Docker
+ * reads it: the first path component when it names a host (it has a `.`
+ * or a `:`, or is `localhost`), otherwise Docker Hub.
+ */
+export declare function registryOf(image: string): string;
+/** The registry `DEFAULT_RUNTIME_IMAGE` is pulled from: `kindgi auth registry` logs in to it. */
+export declare const RUNTIME_IMAGE_REGISTRY: string;
+/**
+ * The same image on another registry: its repository path, tag and digest
+ * under `registry`, the way a mirror carries it.
+ */
+export declare function imageOnRegistry(image: string, registry: string): string;
+//# sourceMappingURL=runtime-image.d.ts.map

package/dist/dev/runtime-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,yGACsE,CAAC;AAKzG;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,QAAoC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvE"}

package/dist/dev/runtime-image.js

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The Kindgi runtime image `kindgi dev` runs. One place names
+ * it, so a release pins the image it was tested with and a pull token
+ * can drop in later. `--runtime-image` overrides it.
+ *
+ * Pinned by digest, not tag: Docker doesn't re-pull a tag it already has, so
+ * a tag would leave anyone with an older pull on an older runtime.
+ *
+ * The image is in private preview on Quay (pull credentials on request at
+ * contact@kindgi.com, then `kindgi auth registry --username <name>`).
+ */
+export const DEFAULT_RUNTIME_IMAGE = 'quay.io/kindgi/runtime:0.1.1@sha256:eaa3a981f88f37efa3a33955d24c40df31474997e0318b006e983f411fdd8654';
+/** Docker Hub, the registry of a reference that names none (`busybox`, `library/busybox`). */
+const DOCKER_HUB = 'docker.io';
+/**
+ * The registry an image reference is pulled from, read the way Docker
+ * reads it: the first path component when it names a host (it has a `.`
+ * or a `:`, or is `localhost`), otherwise Docker Hub.
+ */
+export function registryOf(image) {
+    const slash = image.indexOf('/');
+    if (slash === -1)
+        return DOCKER_HUB;
+    const first = image.slice(0, slash);
+    return first.includes('.') || first.includes(':') || first === 'localhost' ? first : DOCKER_HUB;
+}
+/** The registry `DEFAULT_RUNTIME_IMAGE` is pulled from: `kindgi auth registry` logs in to it. */
+export const RUNTIME_IMAGE_REGISTRY = registryOf(DEFAULT_RUNTIME_IMAGE);
+/**
+ * The same image on another registry: its repository path, tag and digest
+ * under `registry`, the way a mirror carries it.
+ */
+export function imageOnRegistry(image, registry) {
+    const own = registryOf(image);
+    if (own === registry)
+        return image;
+    const named = image.startsWith(`${own}/`);
+    const path = named ? image.slice(own.length + 1) : image;
+    // Docker Hub's official images live under `library/`.
+    return `${registry}/${!named && !path.includes('/') ? `library/${path}` : path}`;
+}
+//# sourceMappingURL=runtime-image.js.map

package/dist/dev/runtime-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image.js","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,sGAAsG,CAAC;AAEzG,8FAA8F;AAC9F,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAClG,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,sDAAsD;IACtD,OAAO,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC"}

package/dist/dev/runtime-registry.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Docker's access to the registry the Kindgi runtime image comes from, for
+ * `kindgi auth registry`: `docker login` (the credential goes to Docker's
+ * own credential store; Kindgi keeps no copy), then a check that the
+ * pinned image can be pulled.
+ *
+ * Every step runs `docker` through the runner `kindgi dev` uses
+ * (`runtime-container.ts`), handed in, so tests pass a fake.
+ */
+import type { DockerRunner } from './runtime-container.js';
+/** Whether `docker` output says the registry refused the credentials (or their absence). */
+export declare function isRegistryAuthFailure(output: string): boolean;
+/** The command that logs Docker in to `image`'s registry, as a message shows it. */
+export declare function registryLoginCommand(image: string): string;
+export type DockerCheck = {
+    readonly kind: 'ok';
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+/** Docker is installed and its engine answers: the login and the pull both need it. */
+export declare function checkDocker(run: DockerRunner): Promise<DockerCheck>;
+export type RegistryLogin = {
+    readonly kind: 'ok';
+    /** What `docker login` warned about (an unencrypted credential store), line by line. */
+    readonly notes: readonly string[];
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+/**
+ * `docker login <registry> --username <username> --password-stdin`, with
+ * the token written to its stdin: never in its arguments, its
+ * environment, or a message.
+ */
+export declare function dockerLogin(run: DockerRunner, registry: string, username: string, token: string): Promise<RegistryLogin>;
+/** How the check reached the registry: buildx, or the fallback when buildx isn't installed. */
+export type AccessMethod = 'docker buildx imagetools inspect' | 'docker manifest inspect';
+export type ImageAccess = {
+    readonly kind: 'ok';
+    readonly method: AccessMethod;
+}
+/** The registry refused: no credentials, or credentials without access. */
+ | {
+    readonly kind: 'no-access';
+    readonly detail: string;
+    readonly method: AccessMethod;
+}
+/** The image isn't there, or the registry can't be reached. */
+ | {
+    readonly kind: 'not-found';
+    readonly detail: string;
+    readonly method: AccessMethod;
+}
+/** Neither `docker buildx` nor `docker manifest` is available. */
+ | {
+    readonly kind: 'no-tool';
+    readonly detail: string;
+};
+/**
+ * Whether Docker's credentials on this machine can pull `image`, without
+ * pulling it: `docker buildx imagetools inspect` fetches the manifest by
+ * its digest, as `docker pull` does.
+ *
+ * Without buildx (a bare Linux engine often lacks it), `docker manifest
+ * inspect` on the digest-only reference instead. Never on the full
+ * `name:tag@digest`: it resolves that by its tag, so a moved tag fails it
+ * while the pinned digest still pulls.
+ */
+export declare function checkImageAccess(run: DockerRunner, image: string): Promise<ImageAccess>;
+/** `repo:tag@sha256:…` → `repo@sha256:…`; a reference without a digest is unchanged. */
+export declare function digestOnly(image: string): string;
+//# sourceMappingURL=runtime-registry.d.ts.map

package/dist/dev/runtime-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-registry.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-registry.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAO1E,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI1D;AAWD,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,uFAAuF;AACvF,wBAAsB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAezE;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAexB;AAED,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG,kCAAkC,GAAG,yBAAyB,CAAC;AAE1F,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE;AACxD,2EAA2E;GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE;AACxF,+DAA+D;GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE;AACxF,kEAAkE;GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAK1D;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAa7F;AASD,wFAAwF;AACxF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD"}

package/dist/dev/runtime-registry.js

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { RUNTIME_IMAGE_REGISTRY, registryOf } from './runtime-image.js';
+/** How a registry, or Docker relaying it, refuses credentials or access. */
+const AUTH_FAILURE = /unauthorized|denied|forbidden|authentication required|insufficient_scope|no basic auth credentials/i;
+/** Whether `docker` output says the registry refused the credentials (or their absence). */
+export function isRegistryAuthFailure(output) {
+    return AUTH_FAILURE.test(output);
+}
+/** The command that logs Docker in to `image`'s registry, as a message shows it. */
+export function registryLoginCommand(image) {
+    const registry = registryOf(image);
+    const other = registry === RUNTIME_IMAGE_REGISTRY ? '' : ` --registry ${registry}`;
+    return `kindgi auth registry --username <the robot name you were given>${other}`;
+}
+/** The end of what `docker` wrote to stderr, with `secret` (the token) blanked out. */
+function detail(outcome, secret) {
+    const text = secret === undefined || secret === ''
+        ? outcome.stderr
+        : outcome.stderr.split(secret).join('***');
+    return text.trim().split('\n').slice(-5).join('\n');
+}
+/** Docker is installed and its engine answers: the login and the pull both need it. */
+export async function checkDocker(run) {
+    const version = await run(['version', '--format', '{{.Server.Version}}']);
+    if (version.code === null) {
+        return {
+            kind: 'error',
+            message: `Docker isn't installed, or \`docker\` isn't on your PATH (${detail(version)}).\n  kindgi dev runs the Kindgi runtime in Docker: install Docker Desktop (or a Docker engine on Linux), then run this again.`,
+        };
+    }
+    if (version.code !== 0) {
+        return {
+            kind: 'error',
+            message: `Docker isn't running: ${detail(version)}\n  Start Docker Desktop (or the Docker engine), then run this again.`,
+        };
+    }
+    return { kind: 'ok' };
+}
+/**
+ * `docker login <registry> --username <username> --password-stdin`, with
+ * the token written to its stdin: never in its arguments, its
+ * environment, or a message.
+ */
+export async function dockerLogin(run, registry, username, token) {
+    const login = await run(['login', registry, '--username', username, '--password-stdin'], {
+        stdin: token,
+    });
+    if (login.code === 0) {
+        const notes = detail(login, token);
+        return { kind: 'ok', notes: notes === '' ? [] : notes.split('\n') };
+    }
+    const refused = isRegistryAuthFailure(login.stderr)
+        ? `\n  Check the username and the token.${registry === RUNTIME_IMAGE_REGISTRY ? ' For new pull credentials, write to contact@kindgi.com.' : ''}`
+        : '';
+    return {
+        kind: 'error',
+        message: `docker login ${registry} failed: ${detail(login, token)}${refused}`,
+    };
+}
+/** `docker` saying a command (a plugin such as buildx) isn't installed. */
+const UNKNOWN_COMMAND = /is not a docker command|unknown command/i;
+/**
+ * Whether Docker's credentials on this machine can pull `image`, without
+ * pulling it: `docker buildx imagetools inspect` fetches the manifest by
+ * its digest, as `docker pull` does.
+ *
+ * Without buildx (a bare Linux engine often lacks it), `docker manifest
+ * inspect` on the digest-only reference instead. Never on the full
+ * `name:tag@digest`: it resolves that by its tag, so a moved tag fails it
+ * while the pinned digest still pulls.
+ */
+export async function checkImageAccess(run, image) {
+    const inspected = await run(['buildx', 'imagetools', 'inspect', image]);
+    if (!UNKNOWN_COMMAND.test(inspected.stderr) || inspected.code === 0) {
+        return accessFrom(inspected, 'docker buildx imagetools inspect');
+    }
+    // `--insecure` only where Docker itself allows plain HTTP by default
+    // (loopback): `docker manifest` doesn't follow the engine's settings.
+    const insecure = isLoopbackRegistry(registryOf(image)) ? ['--insecure'] : [];
+    const manifest = await run(['manifest', 'inspect', ...insecure, digestOnly(image)]);
+    if (manifest.code !== 0 && UNKNOWN_COMMAND.test(manifest.stderr)) {
+        return { kind: 'no-tool', detail: `${detail(inspected)}\n${detail(manifest)}` };
+    }
+    return accessFrom(manifest, 'docker manifest inspect');
+}
+function accessFrom(outcome, method) {
+    if (outcome.code === 0)
+        return { kind: 'ok', method };
+    const shown = detail(outcome);
+    if (isRegistryAuthFailure(outcome.stderr))
+        return { kind: 'no-access', detail: shown, method };
+    return { kind: 'not-found', detail: shown, method };
+}
+/** `repo:tag@sha256:…` → `repo@sha256:…`; a reference without a digest is unchanged. */
+export function digestOnly(image) {
+    const at = image.indexOf('@');
+    if (at === -1)
+        return image;
+    const name = image.slice(0, at);
+    const colon = name.lastIndexOf(':');
+    const repo = colon > name.lastIndexOf('/') ? name.slice(0, colon) : name;
+    return `${repo}${image.slice(at)}`;
+}
+function isLoopbackRegistry(registry) {
+    const host = registry.startsWith('[')
+        ? registry.slice(0, registry.indexOf(']') + 1)
+        : registry.split(':')[0];
+    return host === 'localhost' || host === '[::1]' || /^127\./.test(host ?? '');
+}
+//# sourceMappingURL=runtime-registry.js.map

package/dist/dev/runtime-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-registry.js","sourceRoot":"","sources":["../../src/dev/runtime-registry.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAajC,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExE,4EAA4E;AAC5E,MAAM,YAAY,GAChB,qGAAqG,CAAC;AAExG,4FAA4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,KAAK,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC;IACnF,OAAO,kEAAkE,KAAK,EAAE,CAAC;AACnF,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAC,OAAsB,EAAE,MAAe;IACrD,MAAM,IAAI,GACR,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QACnC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAMD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAiB;IACjD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,6DAA6D,MAAM,CAAC,OAAO,CAAC,gIAAgI;SACtN,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,yBAAyB,MAAM,CAAC,OAAO,CAAC,uEAAuE;SACzH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,QAAgB,EAChB,QAAgB,EAChB,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE;QACvF,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,wCAAwC,QAAQ,KAAK,sBAAsB,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,EAAE,EAAE;QAChJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,gBAAgB,QAAQ,YAAY,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,OAAO,EAAE;KAC9E,CAAC;AACJ,CAAC;AAcD,2EAA2E;AAC3E,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAiB,EAAE,KAAa;IACrE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,UAAU,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IACnE,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB,EAAE,MAAoB;IAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/env/defaults.d.ts

@@ -0,0 +1,3 @@
+import type { EnvRunners } from './runners.js';
+export declare const REAL_ENV_RUNNERS: EnvRunners;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/env/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/env/defaults.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,eAAO,MAAM,gBAAgB,EAAE,UAY9B,CAAC"}

package/dist/env/defaults.js

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Production wiring for `kindgi env`. Loaded lazily by `main.ts`.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+export const REAL_ENV_RUNNERS = {
+    readFile: async (path) => {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    },
+    writeFile: async (path, contents) => {
+        await writeFile(path, contents, 'utf8');
+    },
+};
+//# sourceMappingURL=defaults.js.map

package/dist/env/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/env/defaults.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAClC,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC"}

package/dist/env/pack-env-plan.d.ts

@@ -0,0 +1,70 @@
+/** Where a declared name's value comes from in one environment. */
+export type PackEnvSource = {
+    readonly kind: 'value';
+    readonly value: string;
+} | {
+    readonly kind: 'secret';
+    /** The Secret Manager secret id. */
+    readonly secret: string;
+    /** A version number, or `latest`. */
+    readonly version: string;
+    /** The number of the project that holds it, when it isn't the service's own. */
+    readonly project?: string;
+};
+export interface PackEnvPlanEntry {
+    readonly name: string;
+    readonly required: boolean;
+    /** Absent: the environment gives it no value. */
+    readonly source?: PackEnvSource;
+}
+export interface PackEnvPlan {
+    readonly envName: string;
+    /** Declared names, required ones first, each group sorted. */
+    readonly entries: readonly PackEnvPlanEntry[];
+    /** Required names the environment gives no value. */
+    readonly missing: readonly string[];
+    /** What makes the plan unusable: a secret as a plain value, a malformed entry. */
+    readonly problems: readonly string[];
+    /** Worth knowing, not blocking: `latest` versions, values for undeclared names. */
+    readonly warnings: readonly string[];
+}
+/** Whether a name looks like it holds a secret (`*_KEY`, `*_TOKEN`, `*_PASSWORD`, …). */
+export declare function isSecretShapedName(name: string): boolean;
+/** Whether a value carries a credential: a URL with a password (`postgres://user:pass@host/db`). */
+export declare function carriesCredential(value: string): boolean;
+/**
+ * Why `value` can't be given in the clear under `name`, or `undefined`
+ * when it can. The one check behind `kindgi env plan`, the deploy
+ * preflight and `kindgi deploy --sync-secrets`'s warning.
+ */
+export declare function plainSecretReason(name: string, value: string): string | undefined;
+/** `environments.<envName>.env` from a loaded config: each name's source, and what's malformed. */
+export declare function readEnvironmentEnv(config: Readonly<Record<string, unknown>> | undefined, envName: string): {
+    readonly sources: ReadonlyMap<string, PackEnvSource>;
+    readonly problems: readonly string[];
+};
+/**
+ * The plan for `envName`: the pack's declaration (from `config.env`)
+ * against that environment's sources. `err` when the declaration itself
+ * is malformed, the same check the indexer runs.
+ */
+export declare function planPackEnv(config: Readonly<Record<string, unknown>> | undefined, envName: string): {
+    readonly kind: 'ok';
+    readonly plan: PackEnvPlan;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/** A secret source as Cloud Run takes it: `SECRET:VERSION`, or the full name for another project. */
+export declare function secretReference(source: Extract<PackEnvSource, {
+    kind: 'secret';
+}>): string;
+/**
+ * The Terraform input for the pack service's revision: `env` (plain
+ * values) and `secret_env` (references), as JSON.
+ */
+export declare function renderTerraform(plan: PackEnvPlan): string;
+/** `gcloud run deploy` flags: `--set-env-vars` and `--set-secrets`, one per line. */
+export declare function renderGcloud(plan: PackEnvPlan): string;
+export declare function describePackEnvPlan(plan: PackEnvPlan): string[];
+//# sourceMappingURL=pack-env-plan.d.ts.map

package/dist/env/pack-env-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-env-plan.d.ts","sourceRoot":"","sources":["../../src/env/pack-env-plan.ts"],"names":[],"mappings":"AAsBA,mEAAmE;AACnE,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AASD,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOxD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjF;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACrD,OAAO,EAAE,MAAM,GACd;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA2BhG;AA0BD;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACrD,OAAO,EAAE,MAAM,GAEb;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAsCrD;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAAG,MAAM,CAM1F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAezD;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAYtD;AA0BD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAe/D"}