@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/build/defaults.d.ts

@@ -0,0 +1,66 @@
+import type { BuildRunners, DockerBuildOptions, DockerBuildResult, EsbuildBundleOptions, EsbuildBundleResult, LocalIndexResult, PostBuildOptions, PostBuildResult, PullImageIndexOptions, PullImageIndexResult, PythonBuildRunners, RunLocalIndexerOptions, SignOptions, SignResult, StreamBuildLogsOptions, TarPackOptions, TarPackResult, TerminalPayload, WriteContainerfileOptions, WriteContextOptions } from './runners.js';
+/**
+ * Index the build the way the image's indexer stage does: the bundled
+ * `kindgi-index.mjs`, in its own process, over the same bundles and
+ * config, writing `expected-index.json`. Run from the bundles' folder,
+ * it loads what the image loads (zod, for one, from the pack's own
+ * dependencies), so the two indexes compare like with like.
+ */
+export declare function runLocalIndexerReal(opts: RunLocalIndexerOptions): Promise<LocalIndexResult>;
+/**
+ * Bundle a build, into `outputDir` (the image's `dist/`), every bundle
+ * `.mjs` with a linked sourcemap:
+ *   - the pack's primitives and its `kindgi.config.*`: the pack's own
+ *     code bundled, its installed dependencies left to the image's
+ *     `node_modules` (imported by name);
+ *   - the framework's process entries, `kindgi-index.mjs` and
+ *     `kindgi-pack-service.mjs`: self-contained, from the CLI's own
+ *     `@kindgi/handler-runtime` (the pack's install has none once
+ *     pruned);
+ *   - `bundle-map.json`: each primitive's source path → its bundle.
+ */
+export declare function esbuildBundleReal(opts: EsbuildBundleOptions): Promise<EsbuildBundleResult>;
+export declare function writeContainerfileReal(opts: WriteContainerfileOptions): Promise<void>;
+/**
+ * Write the image's build context into `contextDir` (emptied first):
+ *   host/          the files the install reads, at their paths under the install root
+ *   ext/           the files the build extensions read, at their paths under the install root
+ *   dist/          the bundles
+ *   include/       `bundle.include` files, at their pack-relative paths
+ *   Containerfile
+ * Nothing else of the app: never its source, never its `.env` or
+ * registry credentials.
+ */
+export declare function writeContextReal(opts: WriteContextOptions): Promise<void>;
+/** Tar a written context (`writeContext`) for the build service. */
+export declare function tarPackReal(opts: TarPackOptions): Promise<TarPackResult>;
+/** A Python pack's build context: the listed pack files plus the Containerfile. */
+export declare function tarContextReal(opts: {
+    readonly packDir: string;
+    readonly files: readonly string[];
+    readonly containerfilePath: string;
+    readonly outputPath: string;
+}): Promise<TarPackResult>;
+/** The Python pack's steps of `kindgi build`. */
+export declare const PYTHON_BUILD_RUNNERS: PythonBuildRunners;
+export declare function postBuildReal(opts: PostBuildOptions): Promise<PostBuildResult>;
+export declare function streamBuildLogsReal(opts: StreamBuildLogsOptions): Promise<TerminalPayload>;
+/**
+ * Mirror of `packages/build-server/src/docker-wrapper.ts:
+ * extractFileFromImage`. Uses `docker create/cp/rm` — the same
+ * dependency footprint the build server declares, so a machine that
+ * can run the build server also has this path available.
+ */
+export declare function pullImageIndexReal(opts: PullImageIndexOptions): Promise<PullImageIndexResult>;
+/**
+ * Build the image from a written context into the local Docker image
+ * store: `docker buildx build --load`, registry config passed as
+ * BuildKit secrets (never in a layer). Every output line goes to
+ * `onLog`.
+ */
+export declare function dockerBuildReal(opts: DockerBuildOptions): Promise<DockerBuildResult>;
+export declare function signEnvelopeReal(opts: SignOptions): Promise<SignResult>;
+export declare const REAL_BUILD_RUNNERS: BuildRunners;
+export declare function defaultBuildWorkDir(): string;
+export declare function sha256HexOf(bytes: Uint8Array): string;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/build/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/build/defaults.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAMtB;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA4D3B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAgE9B;AAsBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F;AAMD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B/E;AAED,oEAAoE;AACpE,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAE9E;AAkBD,mFAAmF;AACnF,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzB;AAED,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAE,kBA2BlC,CAAC;AAMF,wBAAsB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA8CpF;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA6C1B;AAMD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAkC/B;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqD1F;AA6ED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuB7E;AAMD,eAAO,MAAM,kBAAkB,EAAE,YAYhC,CAAC;AAIF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD"}

package/dist/build/defaults.js

@@ -0,0 +1,597 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Production wiring for `kindgi build`. Each `BuildRunners` slot is
+ * implemented against real infrastructure (esbuild, tar, fetch,
+ * @kindgi/handler-runtime.runIndexer, @kindgi/crypto.signEd25519,
+ * a docker CLI shell-out). Tests never touch this file — they inject
+ * fixtures via `runCli({ buildRunners })`.
+ */
+import { spawn } from 'node:child_process';
+import { createHash, createPrivateKey, createPublicKey } from 'node:crypto';
+import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parsePrivateKeyPem, serializePublicKeyPem, signEd25519 } from '@kindgi/crypto';
+import { readSse } from '@kindgi/sdk/client';
+import { runPythonIndexer } from '../dev/defaults.js';
+import { REQUIRE_BANNER, collectPackEntries, nodeModulesExternalPlugin } from './bundle.js';
+import { renderContainerfile } from './containerfile.js';
+import { installCommands, withoutInstallScripts } from './host-install.js';
+import { renderPythonContainerfile } from './python-image.js';
+// ---------------------------------------------------------------------
+// Local indexer — the integrity-gate baseline
+// ---------------------------------------------------------------------
+/**
+ * Index the build the way the image's indexer stage does: the bundled
+ * `kindgi-index.mjs`, in its own process, over the same bundles and
+ * config, writing `expected-index.json`. Run from the bundles' folder,
+ * it loads what the image loads (zod, for one, from the pack's own
+ * dependencies), so the two indexes compare like with like.
+ */
+export async function runLocalIndexerReal(opts) {
+    const dist = opts.bundleDir;
+    const args = [
+        '--enable-source-maps',
+        join(dist, 'kindgi-index.mjs'),
+        '--pack-dir',
+        opts.packDir,
+        '--config',
+        join(dist, 'kindgi.config.mjs'),
+        '--bundle-map',
+        join(dist, 'bundle-map.json'),
+        '--module-root',
+        dist,
+        '--artifact-version',
+        opts.artifactVersion,
+        '--published-at',
+        opts.publishedAt,
+        '--output',
+        opts.outputPath,
+    ];
+    const run = await spawnOutcome(process.execPath, args, opts.packDir);
+    if (run.code !== 0) {
+        // `kindgi-index: <code>: <message>`
+        const line = run.stderr.trim().split('\n').pop() ?? '';
+        const match = /^kindgi-index: ([a-z-]+): (.*)$/s.exec(line);
+        return {
+            kind: 'err',
+            code: match?.[1] ?? 'index-failed',
+            message: match?.[2] ?? (run.stderr.trim() || `kindgi-index exited ${run.code}`),
+        };
+    }
+    let report;
+    let index;
+    try {
+        report = JSON.parse(run.stdout);
+        index = JSON.parse(await readFile(opts.outputPath, 'utf8'));
+    }
+    catch (cause) {
+        return {
+            kind: 'err',
+            code: 'index-read-failed',
+            message: `The indexer finished, but its report or ${opts.outputPath} can't be read: ${cause.message}`,
+        };
+    }
+    return {
+        kind: 'ok',
+        packId: report.packId,
+        packVersion: report.packVersion,
+        counts: report.counts,
+        fileErrors: report.fileErrors.map((e) => ({
+            code: e.code,
+            message: e.message,
+            ...(e.filePath !== undefined && { filePath: e.filePath }),
+        })),
+        index,
+    };
+}
+// ---------------------------------------------------------------------
+// esbuild bundle
+// ---------------------------------------------------------------------
+/**
+ * Bundle a build, into `outputDir` (the image's `dist/`), every bundle
+ * `.mjs` with a linked sourcemap:
+ *   - the pack's primitives and its `kindgi.config.*`: the pack's own
+ *     code bundled, its installed dependencies left to the image's
+ *     `node_modules` (imported by name);
+ *   - the framework's process entries, `kindgi-index.mjs` and
+ *     `kindgi-pack-service.mjs`: self-contained, from the CLI's own
+ *     `@kindgi/handler-runtime` (the pack's install has none once
+ *     pruned);
+ *   - `bundle-map.json`: each primitive's source path → its bundle.
+ */
+export async function esbuildBundleReal(opts) {
+    const esbuild = await import('esbuild');
+    await rm(opts.outputDir, { recursive: true, force: true });
+    await mkdir(opts.outputDir, { recursive: true });
+    const common = {
+        absWorkingDir: opts.packDir,
+        outdir: opts.outputDir,
+        outExtension: { '.js': '.mjs' },
+        bundle: true,
+        format: 'esm',
+        platform: 'node',
+        target: `node${opts.nodeMajor}`,
+        sourcemap: 'linked',
+        banner: { js: REQUIRE_BANNER },
+        metafile: true,
+        logLevel: 'silent',
+        // Readable stack traces in the image; no minification.
+        minify: false,
+    };
+    const packEntries = await collectPackEntries(opts.packDir, opts.discoveryPatterns);
+    const externalPackages = new Set();
+    const externals = nodeModulesExternalPlugin({
+        importBy: 'bare',
+        onExternal: (name) => externalPackages.add(name),
+    });
+    const pack = await esbuild.build({
+        ...common,
+        entryPoints: [
+            ...packEntries.map((e) => ({ in: e.abs, out: e.outRel })),
+            { in: opts.configPath, out: 'kindgi.config' },
+        ],
+        plugins: [externals],
+    });
+    // Resolved from the CLI's own package, whose dependency it is.
+    const cliRoot = await cliPackageRoot();
+    const framework = await esbuild.build({
+        ...common,
+        absWorkingDir: cliRoot,
+        entryPoints: [
+            { in: '@kindgi/handler-runtime/kindgi-index-main', out: 'kindgi-index' },
+            { in: '@kindgi/handler-runtime/pack-service-main', out: 'kindgi-pack-service' },
+        ],
+    });
+    const bundleMap = {};
+    for (const entry of packEntries)
+        bundleMap[entry.sourceRel] = `${entry.outRel}.mjs`;
+    await writeFile(join(opts.outputDir, 'bundle-map.json'), `${JSON.stringify(bundleMap, null, 2)}\n`, 'utf8');
+    // Metafile output keys are relative to each build's `absWorkingDir`.
+    const outputs = [
+        ...Object.entries(pack.metafile?.outputs ?? {}).map(([p, o]) => [resolve(opts.packDir, p), o]),
+        ...Object.entries(framework.metafile?.outputs ?? {}).map(([p, o]) => [resolve(cliRoot, p), o]),
+    ];
+    return {
+        emitted: outputs.map(([p]) => p).sort(),
+        totalBytes: outputs.reduce((sum, [, o]) => sum + o.bytes, 0),
+        externals: [...externalPackages].sort(),
+        bundleMap,
+    };
+}
+/** The `@kindgi/cli` package folder (this file's nearest `package.json`). */
+async function cliPackageRoot() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (;;) {
+        try {
+            const pkg = JSON.parse(await readFile(join(dir, 'package.json'), 'utf8'));
+            if (pkg.name === '@kindgi/cli')
+                return dir;
+        }
+        catch {
+            // not here
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            throw new Error('kindgi build: cannot find the @kindgi/cli package folder');
+        dir = parent;
+    }
+}
+// ---------------------------------------------------------------------
+// Containerfile
+// ---------------------------------------------------------------------
+export async function writeContainerfileReal(opts) {
+    const text = renderContainerfile({
+        baseImageRef: opts.baseImageRef,
+        artifactVersion: opts.artifactVersion,
+        publishedAt: opts.publishedAt,
+        buildTarget: opts.buildTarget,
+        install: opts.install,
+        commands: installCommands(opts.install),
+        image: opts.image,
+        hasIncludes: opts.hasIncludes,
+    });
+    await mkdir(join(opts.outputPath, '..'), { recursive: true });
+    await writeFile(opts.outputPath, text, 'utf8');
+}
+// ---------------------------------------------------------------------
+// Build context + tarball
+// ---------------------------------------------------------------------
+/**
+ * Write the image's build context into `contextDir` (emptied first):
+ *   host/          the files the install reads, at their paths under the install root
+ *   ext/           the files the build extensions read, at their paths under the install root
+ *   dist/          the bundles
+ *   include/       `bundle.include` files, at their pack-relative paths
+ *   Containerfile
+ * Nothing else of the app: never its source, never its `.env` or
+ * registry credentials.
+ */
+export async function writeContextReal(opts) {
+    await rm(opts.contextDir, { recursive: true, force: true });
+    await mkdir(opts.contextDir, { recursive: true });
+    const projectManifests = new Set(opts.install.projectManifests);
+    for (const rel of opts.install.files) {
+        const dest = join(opts.contextDir, 'host', rel);
+        await mkdir(dirname(dest), { recursive: true });
+        if (projectManifests.has(rel)) {
+            // The app's own install scripts never run in the image.
+            const text = await readFile(join(opts.install.root, rel), 'utf8');
+            await writeFile(dest, withoutInstallScripts(text), 'utf8');
+        }
+        else {
+            await cp(join(opts.install.root, rel), dest);
+        }
+    }
+    for (const rel of opts.extensionFiles) {
+        const dest = join(opts.contextDir, 'ext', opts.install.packRel, rel);
+        await mkdir(dirname(dest), { recursive: true });
+        await cp(join(opts.packDir, rel), dest);
+    }
+    await cp(opts.bundleDir, join(opts.contextDir, 'dist'), { recursive: true });
+    for (const rel of opts.includes) {
+        const dest = join(opts.contextDir, 'include', rel);
+        await mkdir(dirname(dest), { recursive: true });
+        await cp(join(opts.packDir, rel), dest);
+    }
+    await cp(opts.containerfilePath, join(opts.contextDir, 'Containerfile'));
+}
+/** Tar a written context (`writeContext`) for the build service. */
+export async function tarPackReal(opts) {
+    return deterministicTar(opts.contextDir, opts.outputPath);
+}
+/**
+ * Gzip `contextDir` into `outputPath` with every mtime at the epoch, so the
+ * tarball's hash depends only on its content; the scratch context is
+ * removed afterwards.
+ */
+async function deterministicTar(contextDir, outputPath) {
+    const tar = await import('tar');
+    await tar.create({ gzip: true, cwd: contextDir, portable: true, file: outputPath, mtime: new Date(0) }, ['.']);
+    const bytes = await readFile(outputPath);
+    await rm(contextDir, { recursive: true, force: true });
+    return { path: outputPath, bytes: new Uint8Array(bytes), size: bytes.length };
+}
+/** A Python pack's build context: the listed pack files plus the Containerfile. */
+export async function tarContextReal(opts) {
+    const { cp } = await import('node:fs/promises');
+    const contextDir = join(join(opts.outputPath, '..'), '.tar-context');
+    await rm(contextDir, { recursive: true, force: true });
+    await mkdir(contextDir, { recursive: true });
+    for (const rel of opts.files) {
+        const dest = join(contextDir, rel);
+        await mkdir(dirname(dest), { recursive: true });
+        await cp(join(opts.packDir, rel), dest);
+    }
+    await cp(opts.containerfilePath, join(contextDir, 'Containerfile'));
+    return deterministicTar(contextDir, opts.outputPath);
+}
+/** The Python pack's steps of `kindgi build`. */
+export const PYTHON_BUILD_RUNNERS = {
+    runLocalIndexer: (opts) => runPythonIndexer({
+        packDir: opts.packDir,
+        outputPath: opts.outputPath,
+        python: opts.python,
+        env: opts.env,
+        artifactVersion: opts.artifactVersion,
+        publishedAt: opts.publishedAt,
+    }),
+    async writeContainerfile(opts) {
+        await mkdir(join(opts.outputPath, '..'), { recursive: true });
+        await writeFile(opts.outputPath, renderPythonContainerfile({
+            baseImageRef: opts.baseImageRef,
+            uvImageRef: opts.uvImageRef,
+            artifactVersion: opts.artifactVersion,
+            publishedAt: opts.publishedAt,
+            buildTarget: opts.buildTarget,
+            installer: opts.installer,
+            systemPackages: opts.systemPackages,
+        }), 'utf8');
+    },
+    tarContext: tarContextReal,
+};
+// ---------------------------------------------------------------------
+// POST /v1/build
+// ---------------------------------------------------------------------
+export async function postBuildReal(opts) {
+    const form = new FormData();
+    const blob = new Blob([opts.tarballBytes], { type: 'application/gzip' });
+    form.append('pack.tgz', blob, 'pack.tgz');
+    form.append('buildTarget', opts.buildTarget);
+    if (opts.registryPushCredsRef !== undefined) {
+        form.append('registryPushCredsRef', opts.registryPushCredsRef);
+    }
+    const url = `${opts.endpoint.replace(/\/+$/, '')}/v1/build`;
+    const res = await opts.fetchImpl(url, {
+        method: 'POST',
+        headers: { 'X-Content-SHA256': opts.tarballSha256 },
+        body: form,
+    });
+    if (res.status !== 200 && res.status !== 202) {
+        const errBody = await res.text().catch(() => '');
+        throw new Error(`POST /v1/build failed with HTTP ${res.status}: ${errBody}`);
+    }
+    const payload = (await res.json());
+    const terminal = payload.status === 'completed' || payload.status === 'failed'
+        ? {
+            status: payload.status,
+            ...(payload.imageRef !== undefined && { imageRef: payload.imageRef }),
+            ...(payload.imageDigest !== undefined && { imageDigest: payload.imageDigest }),
+            ...(payload.indexJson !== undefined && { indexJson: payload.indexJson }),
+            ...(payload.indexHash !== undefined && { indexHash: payload.indexHash }),
+            ...(payload.buildLogsUrl !== undefined && { buildLogsUrl: payload.buildLogsUrl }),
+            ...(payload.error !== undefined && { error: payload.error }),
+        }
+        : undefined;
+    return {
+        buildJobId: payload.buildJobId,
+        status: payload.status,
+        buildLogsUrl: payload.buildLogsUrl,
+        ...(terminal !== undefined && { terminal }),
+    };
+}
+// ---------------------------------------------------------------------
+// SSE stream of build logs
+// ---------------------------------------------------------------------
+export async function streamBuildLogsReal(opts) {
+    const url = `${opts.endpoint.replace(/\/+$/, '')}/v1/build/${opts.buildJobId}/stream`;
+    let terminal;
+    const iter = readSse({
+        url,
+        fetchImpl: opts.fetchImpl,
+        ...(opts.signal !== undefined && { signal: opts.signal }),
+        // The build server's stream is single-shot; disable auto-retry.
+        shouldRetry: () => false,
+    });
+    for await (const event of iter) {
+        if (event.event === 'log') {
+            const data = event.data;
+            if (typeof data.line === 'string')
+                opts.onLog(data.line);
+            continue;
+        }
+        if (event.event === 'terminal') {
+            const data = event.data;
+            terminal = {
+                status: data.status,
+                ...(data.imageRef !== undefined && { imageRef: data.imageRef }),
+                ...(data.imageDigest !== undefined && { imageDigest: data.imageDigest }),
+                ...(data.indexJson !== undefined && { indexJson: data.indexJson }),
+                ...(data.indexHash !== undefined && { indexHash: data.indexHash }),
+                ...(data.buildLogsUrl !== undefined && { buildLogsUrl: data.buildLogsUrl }),
+                ...(data.error !== undefined && { error: data.error }),
+            };
+        }
+    }
+    if (terminal === undefined) {
+        throw new Error(`SSE stream closed without a terminal event for buildJobId ${opts.buildJobId}`);
+    }
+    return terminal;
+}
+// ---------------------------------------------------------------------
+// docker pull + extract /app/index.json (for the byte-diff path)
+// ---------------------------------------------------------------------
+/**
+ * Mirror of `packages/build-server/src/docker-wrapper.ts:
+ * extractFileFromImage`. Uses `docker create/cp/rm` — the same
+ * dependency footprint the build server declares, so a machine that
+ * can run the build server also has this path available.
+ */
+export async function pullImageIndexReal(opts) {
+    await mkdir(opts.workDir, { recursive: true });
+    const onLog = opts.onLog ?? (() => { });
+    const platform = opts.platform !== undefined ? ['--platform', opts.platform] : [];
+    if (opts.pull !== false) {
+        onLog(`docker pull ${opts.imageRef}`);
+        await spawnCapture('docker', ['pull', ...platform, opts.imageRef], opts.signal);
+    }
+    const containerId = (await spawnCapture('docker', ['create', ...platform, opts.imageRef], opts.signal)).trim();
+    const localCopy = join(opts.workDir, 'server-index.json');
+    try {
+        onLog(`docker cp ${containerId}:/app/index.json ${localCopy}`);
+        await spawnCapture('docker', ['cp', `${containerId}:/app/index.json`, localCopy], opts.signal);
+        const bytes = await readFile(localCopy);
+        return { bytes };
+    }
+    finally {
+        try {
+            await spawnCapture('docker', ['rm', containerId], undefined);
+        }
+        catch {
+            // ignore — leaked containers are an operator concern, not a build
+            // failure.
+        }
+        try {
+            await rm(localCopy);
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+// ---------------------------------------------------------------------
+// docker buildx build --load (`kindgi build --local`)
+// ---------------------------------------------------------------------
+/**
+ * Build the image from a written context into the local Docker image
+ * store: `docker buildx build --load`, registry config passed as
+ * BuildKit secrets (never in a layer). Every output line goes to
+ * `onLog`.
+ */
+export async function dockerBuildReal(opts) {
+    const metadataFile = join(opts.contextDir, '..', 'buildx-metadata.json');
+    const args = [
+        'buildx',
+        'build',
+        opts.push === true ? '--push' : '--load',
+        ...(opts.platform !== undefined ? ['--platform', opts.platform] : []),
+        // A plain image manifest: its digest is the image's, nothing else's.
+        '--provenance=false',
+        '--metadata-file',
+        metadataFile,
+        '--progress',
+        'plain',
+        '--file',
+        join(opts.contextDir, 'Containerfile'),
+        '--tag',
+        opts.tag,
+        '--build-arg',
+        'SOURCE_DATE_EPOCH=0',
+        '--build-arg',
+        `KINDGI_BUILD_TARGET=${opts.buildTarget}`,
+        ...opts.secrets.flatMap((s) => ['--secret', `id=${s.id},src=${s.src}`]),
+        opts.contextDir,
+    ];
+    const tail = [];
+    const run = await spawnOutcome('docker', args, opts.contextDir, (line) => {
+        tail.push(line);
+        if (tail.length > 30)
+            tail.shift();
+        opts.onLog?.(line);
+    });
+    if (run.code !== 0) {
+        return { kind: 'err', message: `docker buildx build exited ${run.code}:\n${tail.join('\n')}` };
+    }
+    if (opts.push === true) {
+        // The registry's digest of what was pushed.
+        let digest;
+        try {
+            digest = JSON.parse(await readFile(metadataFile, 'utf8'))['containerimage.digest'];
+        }
+        catch {
+            digest = undefined;
+        }
+        if (typeof digest !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(digest)) {
+            return { kind: 'err', message: `docker buildx pushed ${opts.tag} but reported no digest` };
+        }
+        return { kind: 'ok', imageId: digest, digest };
+    }
+    const inspected = await spawnOutcome('docker', ['image', 'inspect', '--format', '{{.Id}}', opts.tag], opts.contextDir);
+    if (inspected.code !== 0) {
+        return { kind: 'err', message: `docker image inspect ${opts.tag}: ${inspected.stderr.trim()}` };
+    }
+    return { kind: 'ok', imageId: inspected.stdout.trim() };
+}
+/** Run a command to the end: its exit code and output, each line also to `onLine`. */
+function spawnOutcome(command, args, cwd, onLine) {
+    return new Promise((resolveRun) => {
+        const child = spawn(command, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        const lines = (chunk, pending) => {
+            if (onLine === undefined)
+                return;
+            pending.text += chunk.toString('utf8');
+            const parts = pending.text.split('\n');
+            pending.text = parts.pop() ?? '';
+            for (const line of parts)
+                onLine(line);
+        };
+        const out = { text: '' };
+        const err = { text: '' };
+        child.stdout?.on('data', (c) => {
+            stdout += c.toString('utf8');
+            lines(c, out);
+        });
+        child.stderr?.on('data', (c) => {
+            stderr += c.toString('utf8');
+            lines(c, err);
+        });
+        child.on('error', (cause) => resolveRun({ code: 127, stdout, stderr: `${stderr}${cause.message}` }));
+        child.on('close', (code) => {
+            for (const rest of [out.text, err.text])
+                if (rest !== '')
+                    onLine?.(rest);
+            resolveRun({ code: code ?? 1, stdout, stderr });
+        });
+    });
+}
+function spawnCapture(command, args, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (c) => {
+            stdout += c.toString('utf8');
+        });
+        child.stderr?.on('data', (c) => {
+            stderr += c.toString('utf8');
+        });
+        const onAbort = () => {
+            try {
+                child.kill('SIGTERM');
+            }
+            catch {
+                // ignore
+            }
+        };
+        if (signal !== undefined) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (signal !== undefined)
+                signal.removeEventListener('abort', onAbort);
+            if (code === 0)
+                resolve(stdout);
+            else
+                reject(new Error(`${command} ${args.join(' ')} exited ${code}: ${stderr.trim()}`));
+        });
+    });
+}
+// ---------------------------------------------------------------------
+// Ed25519 sign
+// ---------------------------------------------------------------------
+export async function signEnvelopeReal(opts) {
+    const parsed = parsePrivateKeyPem(opts.privateKeyPem);
+    if (parsed.kind === 'err') {
+        throw new Error(`Signing key rejected: ${parsed.error.code} — ${parsed.error.message}`);
+    }
+    const sig = signEd25519(parsed.value, opts.message);
+    if (sig.kind === 'err') {
+        throw new Error(`Ed25519 signing failed: ${sig.error.message}`);
+    }
+    // Derive the public key from the PEM with Node's crypto: @kindgi/crypto
+    // has no `derivePublicKey` helper.
+    const priv = createPrivateKey({ key: opts.privateKeyPem, format: 'pem' });
+    const pub = createPublicKey(priv);
+    const spki = pub.export({ format: 'der', type: 'spki' });
+    const raw = new Uint8Array(spki).subarray(-32); // Ed25519 SPKI trailer is the raw pub key.
+    const publicKeyPem = serializePublicKeyPem(raw);
+    return {
+        signatureBase64: Buffer.from(sig.value).toString('base64'),
+        publicKeyPem,
+    };
+}
+// ---------------------------------------------------------------------
+// Wired seam
+// ---------------------------------------------------------------------
+export const REAL_BUILD_RUNNERS = {
+    runLocalIndexer: runLocalIndexerReal,
+    esbuildBundle: esbuildBundleReal,
+    writeContainerfile: writeContainerfileReal,
+    writeContext: writeContextReal,
+    tarPack: tarPackReal,
+    dockerBuild: dockerBuildReal,
+    postBuild: postBuildReal,
+    streamBuildLogs: streamBuildLogsReal,
+    pullImageIndex: pullImageIndexReal,
+    signEnvelope: signEnvelopeReal,
+    python: PYTHON_BUILD_RUNNERS,
+};
+// Re-export utility for callers that want a portable tmp workdir for
+// the image-pull path.
+export function defaultBuildWorkDir() {
+    return join(tmpdir(), 'kindgi-cli-build');
+}
+// Re-export the small primitive tests use to independently compute the
+// tarball hash without the tar step.
+export function sha256HexOf(bytes) {
+    return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+}
+//# sourceMappingURL=defaults.js.map