@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/init/python-augment.js

@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * `kindgi init` in an existing Python app — the Python counterpart of the
+ * augment scaffolder. Called from `runInit` when `detectInitMode` returns
+ * augment mode for a `pyproject.toml`.
+ *
+ * What it writes:
+ *   - `pyproject.toml`, edited in place (`pyproject-patcher.ts`, each edit
+ *     verified by re-parsing):
+ *       - the `[tool.kindgi]` tables, appended — the pack id from
+ *         `[project].name` (PEP 503-normalized), discovery under `kindgi/`,
+ *         and for a Poetry app `dev.python = ["poetry", "run", "python"]`;
+ *       - `kindgi` in `[project].dependencies`, and — for a uv app, while
+ *         the SDK is unpublished — a `[tool.uv.sources]` entry for the
+ *         Kindgi checkout's `sdks/python` (a uv app also gets Kindgi's
+ *         `[tool.uv] required-version` unless it sets its own). An app whose dependencies can't be
+ *         edited that way (Poetry 1, dynamic dependencies) gets the command
+ *         to run instead.
+ *   - `kindgi/{tools,guardrails,agents,flows}/.gitkeep`
+ *   - `.claude/skills/` — the skills written for Python packs
+ *   - `.gitignore` — Kindgi's local-state patterns
+ *
+ * The app's own code, env files, lockfile and virtualenv are left alone:
+ * the next steps say to `uv sync` (or the app's equivalent).
+ */
+import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { IMAGE_UV_VERSION, PACK_UV_REQUIRED_VERSION } from '../build/python-image.js';
+import { satisfiesSpecifiers } from '../build/version-specifier.js';
+import { PACK_ID_REGEX } from '../commands/init.js';
+import { syncSkills } from '../commands/skills.js';
+import { renderJson } from '../output.js';
+import { binDisplay } from '../package-manager.js';
+import { kindgiRequirementFor, resolveKindgiPythonSource, } from './dependency-specs.js';
+import { patchGitignore } from './gitignore-patcher.js';
+import { addProjectDependency, addTableKey, addUvSource, appendTables, normalizeName, readPyproject, } from './pyproject-patcher.js';
+const SUBDIRS = ['agents', 'tools', 'guardrails', 'flows'];
+const DEFAULT_VERSION = '0.1.0';
+export async function runInitPythonAugment(inputs) {
+    const fail = (message) => ({
+        kind: 'error',
+        stderr: `${message}\n`,
+        exitCode: 1,
+    });
+    const exists = inputs.fileExists ?? fileExists;
+    const pyprojectPath = join(inputs.targetDir, 'pyproject.toml');
+    const original = await readFile(pyprojectPath, 'utf8');
+    const read = readPyproject(original);
+    if (read.kind === 'err')
+        return fail(`${pyprojectPath}: ${read.message}`);
+    const info = read.info;
+    if (info.isPack) {
+        return fail(`${pyprojectPath} already has a [tool.kindgi] table — this app is a Kindgi pack. Run \`${binDisplay('path', 'kindgi', ['dev'])}\` here.`);
+    }
+    const packId = resolvePackId(info, inputs.packIdOverride);
+    if (packId.kind === 'err')
+        return fail(packId.message);
+    const version = info.version ?? DEFAULT_VERSION;
+    const installer = await detectInstaller(inputs.targetDir, info, exists);
+    const source = inputs.pythonSource ?? (await resolveKindgiPythonSource());
+    if (source.kind === 'error')
+        return fail(source.message);
+    // Every pyproject edit is made and verified before anything is written.
+    const edited = editPyproject(original, { info, packId: packId.id, version, installer, source });
+    if (edited.kind === 'err')
+        return fail(`${pyprojectPath}: ${edited.message}`);
+    const created = [];
+    const skipped = [];
+    await writeFile(pyprojectPath, edited.text, 'utf8');
+    created.push(`${pyprojectPath} (${edited.changes.join('; ')})`);
+    for (const sub of SUBDIRS) {
+        const keep = join(inputs.targetDir, 'kindgi', sub, '.gitkeep');
+        if (await exists(keep)) {
+            skipped.push(keep);
+        }
+        else {
+            await mkdir(dirname(keep), { recursive: true });
+            await writeFile(keep, '', 'utf8');
+            created.push(keep);
+        }
+    }
+    if (inputs.skillsRoot !== undefined) {
+        const report = await syncSkills({
+            skillsRoot: inputs.skillsRoot,
+            targetDir: inputs.targetDir,
+            language: 'python',
+            force: inputs.force,
+            dryRun: false,
+        });
+        for (const o of report.outcomes) {
+            const target = join(inputs.targetDir, '.claude', 'skills', o.name, 'SKILL.md');
+            if (o.status === 'added' || o.status === 'updated')
+                created.push(target);
+            else if (o.status !== 'local-only')
+                skipped.push(target);
+        }
+    }
+    const gitignorePath = join(inputs.targetDir, '.gitignore');
+    const gitignore = await patchGitignore(gitignorePath);
+    if (gitignore.kind === 'error') {
+        return fail(`Failed to patch ${gitignorePath}: ${gitignore.message ?? 'unknown error'}`);
+    }
+    if (gitignore.kind === 'patched') {
+        created.push(`${gitignorePath} (patched: +${gitignore.appended.join(', +')})`);
+    }
+    const nextSteps = [
+        ...pythonAugmentNextSteps(installer, edited.dependencyAdded, source),
+        ...uvVersionNote(info.uvRequiredVersion),
+    ];
+    const summary = {
+        kind: 'augment',
+        language: 'python',
+        targetDir: inputs.targetDir,
+        packId: packId.id,
+        packVersion: version,
+        installer,
+        kindgi: source,
+        created,
+        skipped,
+        nextSteps,
+    };
+    return {
+        kind: 'ok',
+        rendered: {
+            stdout: renderJson(summary, 'json').stdout,
+            stderr: [
+                '',
+                `  Kindgi added to ${inputs.targetDir} (a Python pack in the app).`,
+                `  Pack id: ${packId.id}    Version: ${version}`,
+                `  Wrote ${created.length} file${created.length === 1 ? '' : 's'}; skipped ${skipped.length}.`,
+                '',
+                '  Next steps:',
+                ...nextSteps.map((step) => `    ${step}`),
+                '',
+                '',
+            ].join('\n'),
+        },
+    };
+}
+function resolvePackId(info, override) {
+    if (override !== undefined && override !== '') {
+        return PACK_ID_REGEX.test(override)
+            ? { kind: 'ok', id: override }
+            : {
+                kind: 'err',
+                message: `Invalid --pack-id: ${override}. Must match ${PACK_ID_REGEX.source}.`,
+            };
+    }
+    if (info.name === undefined) {
+        return {
+            kind: 'err',
+            message: 'pyproject.toml has no [project].name (or [tool.poetry].name) to name the pack. Pass `--pack-id=<id>`.',
+        };
+    }
+    const candidate = normalizeName(info.name);
+    return PACK_ID_REGEX.test(candidate)
+        ? { kind: 'ok', id: candidate }
+        : {
+            kind: 'err',
+            message: `Cannot derive a pack id from the project name "${info.name}" (candidate "${candidate}"); pack ids match ${PACK_ID_REGEX.source}. Pass \`--pack-id=<id>\`.`,
+        };
+}
+/**
+ * The app's installer: uv when it says so (a `uv.lock`, `[tool.uv]`, the
+ * `uv_build` backend), Poetry likewise, pip for a `requirements.txt` app —
+ * otherwise uv, Kindgi's own toolchain.
+ */
+async function detectInstaller(dir, info, exists) {
+    if (info.usesUv || (await exists(join(dir, 'uv.lock'))))
+        return 'uv';
+    if (info.usesPoetry || (await exists(join(dir, 'poetry.lock'))))
+        return 'poetry';
+    if (await exists(join(dir, 'requirements.txt')))
+        return 'pip';
+    return 'uv';
+}
+function editPyproject(original, inputs) {
+    let text = original;
+    const changes = [];
+    let dependencyAdded = inputs.info.hasKindgiDependency;
+    if (inputs.info.dependencyStyle === 'pep621' && !inputs.info.hasKindgiDependency) {
+        const requirement = kindgiRequirementFor(inputs.source);
+        const dep = addProjectDependency(text, requirement);
+        if (dep.kind === 'ok') {
+            text = dep.text;
+            dependencyAdded = true;
+            changes.push(`+${requirement} in [project].dependencies`);
+        }
+    }
+    // uv settings only for an app uv installs — Poetry and pip ignore
+    // `[tool.uv]`; their next steps install the SDK by path instead.
+    const usesUv = inputs.installer === 'uv';
+    // The uv versions the pack works with: the app's own when it sets them
+    // (`kindgi build` checks they include the image's uv), else Kindgi's.
+    if (usesUv && inputs.info.uvRequiredVersion === undefined) {
+        const uvVersion = addTableKey(text, 'tool.uv', 'required-version', JSON.stringify(PACK_UV_REQUIRED_VERSION));
+        if (uvVersion.kind === 'err') {
+            return {
+                kind: 'err',
+                message: `could not add [tool.uv] required-version: ${uvVersion.message}`,
+            };
+        }
+        text = uvVersion.text;
+        changes.push(`+[tool.uv] required-version = "${PACK_UV_REQUIRED_VERSION}"`);
+    }
+    if (usesUv && dependencyAdded && inputs.source.kind === 'local-checkout') {
+        const uv = addUvSource(text, 'kindgi', `{ path = ${JSON.stringify(inputs.source.path)}, editable = true }`);
+        if (uv.kind === 'err')
+            return { kind: 'err', message: `could not add [tool.uv.sources] kindgi: ${uv.message}` };
+        text = uv.text;
+        changes.push("+[tool.uv.sources] kindgi (the Kindgi checkout's Python SDK)");
+    }
+    const poetryDev = inputs.installer === 'poetry';
+    const tables = appendTables(text, kindgiTables(inputs.packId, inputs.version, poetryDev), {
+        tool: {
+            kindgi: {
+                pack: { id: inputs.packId, version: inputs.version },
+                discovery: Object.fromEntries(SUBDIRS.map((s) => [s, `kindgi/${s}/**/*.py`])),
+                ...(poetryDev && { dev: { python: ['poetry', 'run', 'python'] } }),
+            },
+        },
+    });
+    if (tables.kind === 'err')
+        return { kind: 'err', message: `could not add [tool.kindgi]: ${tables.message}` };
+    changes.push('+[tool.kindgi]');
+    return { kind: 'ok', text: tables.text, changes, dependencyAdded };
+}
+/** The appended `[tool.kindgi]` tables. */
+export function kindgiTables(packId, version, poetry) {
+    const dev = poetry
+        ? [
+            '[tool.kindgi.dev]',
+            'python = ["poetry", "run", "python"]   # the interpreter that runs the pack',
+        ]
+        : [
+            '# [tool.kindgi.dev]',
+            '# python = ["uv", "run", "python"]   # default: .venv/bin/python, else python3',
+        ];
+    return [
+        '# The Kindgi pack, added by `kindgi init`: its tools, guardrails, agents and',
+        "# flows live under kindgi/ (the app's own packages import by name there).",
+        '[tool.kindgi.pack]',
+        `id = ${JSON.stringify(packId)}`,
+        `version = ${JSON.stringify(version)}`,
+        '',
+        '[tool.kindgi.discovery]',
+        ...SUBDIRS.map((s) => `${s} = "kindgi/${s}/**/*.py"`),
+        '',
+        ...dev,
+        '',
+    ].join('\n');
+}
+/** What to run next, for the app's installer. */
+export function pythonAugmentNextSteps(installer, dependencyAdded, source) {
+    const sdk = source.kind === 'local-checkout' ? source.path : undefined;
+    // Quoted: the range has `<` and `>`, which a shell would read as redirects.
+    const requirement = `"${kindgiRequirementFor(source)}"`;
+    const install = dependencyAdded
+        ? installer === 'uv'
+            ? 'Install: uv sync'
+            : installer === 'poetry'
+                ? `Install: ${sdk === undefined ? 'poetry install' : `poetry add --editable ${sdk}`}`
+                : `Install: ${sdk === undefined ? 'pip install -e .' : `pip install -e ${sdk} && pip install -e .`}`
+        : `Add the SDK to the app's dependencies: ${installer === 'uv'
+            ? sdk === undefined
+                ? `uv add ${requirement}`
+                : `uv add --editable ${sdk}`
+            : installer === 'poetry'
+                ? sdk === undefined
+                    ? `poetry add ${requirement}`
+                    : `poetry add --editable ${sdk}`
+                : sdk === undefined
+                    ? `pip install ${requirement} (and list it with the app’s requirements)`
+                    : `pip install -e ${sdk}`}`;
+    return [
+        install,
+        `Boot the dev server: ${binDisplay('path', 'kindgi', ['dev'])}`,
+        'Write tools, guardrails and agents under kindgi/ — see .claude/skills/kindgi-python-getting-started/SKILL.md',
+        'Secrets: kindgi dev reads your .env and .env.local; tools read them from os.environ',
+        `Model provider: agents answer with the dev-echo fallback until you register one — e.g. ${binDisplay('path', 'kindgi', ['providers', 'register', '--preset=anthropic'])} (ANTHROPIC_API_KEY in .env)`,
+    ];
+}
+/** A next step when the app's own uv range leaves out the uv that builds Kindgi images. */
+function uvVersionNote(required) {
+    if (required === undefined || satisfiesSpecifiers(IMAGE_UV_VERSION, required) !== false)
+        return [];
+    return [
+        `uv: the app's required-version ("${required}") excludes uv ${IMAGE_UV_VERSION}, which builds Kindgi's images — \`kindgi build\` refuses until it includes it (e.g. "${PACK_UV_REQUIRED_VERSION}")`,
+    ];
+}
+async function fileExists(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=python-augment.js.map

package/dist/init/python-augment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-augment.js","sourceRoot":"","sources":["../../src/init/python-augment.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,GACd,MAAM,wBAAwB,CAAC;AAEhC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAU,CAAC;AACpE,MAAM,eAAe,GAAG,OAAO,CAAC;AAgBhC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkC;IAElC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,GAAG,OAAO,IAAI;QACtB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,aAAa,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,IAAI,CACT,GAAG,aAAa,yEAAyE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CACzI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEzD,wEAAwE;IACxE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAE9E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;iBACpE,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,mBAAmB,aAAa,KAAK,SAAS,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,eAAe,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG;QAChB,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;QACpE,GAAG,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC;KACzC,CAAC;IACF,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,EAAE;QACjB,WAAW,EAAE,OAAO;QACpB,SAAS;QACT,MAAM,EAAE,MAAM;QACd,OAAO;QACP,OAAO;QACP,SAAS;KACV,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE;YACR,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM;YAC1C,MAAM,EAAE;gBACN,EAAE;gBACF,qBAAqB,MAAM,CAAC,SAAS,8BAA8B;gBACnE,cAAc,MAAM,CAAC,EAAE,gBAAgB,OAAO,EAAE;gBAChD,WAAW,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,OAAO,CAAC,MAAM,GAAG;gBAC9F,EAAE;gBACF,eAAe;gBACf,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;gBACzC,EAAE;gBACF,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC;SACb;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAmB,EACnB,QAA4B;IAI5B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE;YAC9B,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,sBAAsB,QAAQ,gBAAgB,aAAa,CAAC,MAAM,GAAG;aAC/E,CAAC;IACR,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EACL,uGAAuG;SAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE;QAC/B,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,kDAAkD,IAAI,CAAC,IAAI,iBAAiB,SAAS,sBAAsB,aAAa,CAAC,MAAM,4BAA4B;SACrK,CAAC;AACR,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAW,EACX,IAAmB,EACnB,MAA0C;IAE1C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjF,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAkB;IACzD,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjF,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAChB,eAAe,GAAG,IAAI,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,4BAA4B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,WAAW,CAC3B,IAAI,EACJ,SAAS,EACT,kBAAkB,EAClB,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,CACzC,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,6CAA6C,SAAS,CAAC,OAAO,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,kCAAkC,wBAAwB,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,IAAI,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,WAAW,CACpB,IAAI,EACJ,QAAQ,EACR,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CACpE,CAAC;QACF,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK;YACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3F,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;QACxF,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;gBACpD,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC7E,GAAG,CAAC,SAAS,IAAI,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;aACnE;SACF;KACF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AACrE,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,MAAe;IAC3E,MAAM,GAAG,GAAG,MAAM;QAChB,CAAC,CAAC;YACE,mBAAmB;YACnB,6EAA6E;SAC9E;QACH,CAAC,CAAC;YACE,qBAAqB;YACrB,gFAAgF;SACjF,CAAC;IACN,OAAO;QACL,8EAA8E;QAC9E,2EAA2E;QAC3E,oBAAoB;QACpB,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QAChC,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACtC,EAAE;QACF,yBAAyB;QACzB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC;QACrD,EAAE;QACF,GAAG,GAAG;QACN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,sBAAsB,CACpC,SAA0B,EAC1B,eAAwB,EACxB,MAAsD;IAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,4EAA4E;IAC5E,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC;IACxD,MAAM,OAAO,GAAG,eAAe;QAC7B,CAAC,CAAC,SAAS,KAAK,IAAI;YAClB,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,SAAS,KAAK,QAAQ;gBACtB,CAAC,CAAC,YAAY,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,yBAAyB,GAAG,EAAE,EAAE;gBACrF,CAAC,CAAC,YAAY,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,GAAG,sBAAsB,EAAE;QACxG,CAAC,CAAC,0CACE,SAAS,KAAK,IAAI;YAChB,CAAC,CAAC,GAAG,KAAK,SAAS;gBACjB,CAAC,CAAC,UAAU,WAAW,EAAE;gBACzB,CAAC,CAAC,qBAAqB,GAAG,EAAE;YAC9B,CAAC,CAAC,SAAS,KAAK,QAAQ;gBACtB,CAAC,CAAC,GAAG,KAAK,SAAS;oBACjB,CAAC,CAAC,cAAc,WAAW,EAAE;oBAC7B,CAAC,CAAC,yBAAyB,GAAG,EAAE;gBAClC,CAAC,CAAC,GAAG,KAAK,SAAS;oBACjB,CAAC,CAAC,eAAe,WAAW,4CAA4C;oBACxE,CAAC,CAAC,kBAAkB,GAAG,EAC/B,EAAE,CAAC;IACP,OAAO;QACL,OAAO;QACP,wBAAwB,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE;QAC/D,8GAA8G;QAC9G,qFAAqF;QACrF,0FAA0F,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,8BAA8B;KACtM,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,QAA4B;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,KAAK;QACrF,OAAO,EAAE,CAAC;IACZ,OAAO;QACL,oCAAoC,QAAQ,kBAAkB,gBAAgB,yFAAyF,wBAAwB,IAAI;KACpM,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/init/template-files.d.ts

@@ -0,0 +1,18 @@
+/** What a template's placeholders become. */
+export interface Substitutions {
+    readonly PACK_NAME: string;
+    readonly PACK_ID: string;
+    readonly PACK_VERSION: string;
+    /** The python template's `kindgi` dependency, quoted (`"kindgi>=0.1,<0.2"` from a published CLI). */
+    readonly KINDGI_REQUIREMENT?: string;
+    /** The python template's `[tool.uv.sources]` block for `kindgi` (from a checkout; empty when published). */
+    readonly KINDGI_PYTHON_SOURCE?: string;
+    /** The python template's `[tool.uv] required-version`. */
+    readonly UV_REQUIRED_VERSION?: string;
+}
+/** Every file under `root`, as paths relative to it. */
+export declare function collectTemplateFiles(root: string): Promise<string[]>;
+/** A template file's path (relative to its template) as written into the pack. */
+export declare function templateTarget(rel: string): string;
+export declare function substitute(raw: string, subs: Substitutions): string;
+//# sourceMappingURL=template-files.d.ts.map

package/dist/init/template-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-files.d.ts","sourceRoot":"","sources":["../../src/init/template-files.ts"],"names":[],"mappings":"AAaA,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qGAAqG;IACrG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,wDAAwD;AACxD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgB1E;AASD,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAQnE"}

package/dist/init/template-files.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Template files, as `kindgi init` writes them. Files ending in `.tmpl`
+ * are rendered (suffix stripped, placeholders replaced); others are
+ * copied as they are. A few dotfiles are stored without their dot (see
+ * {@link templateTarget}).
+ */
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+/** Every file under `root`, as paths relative to it. */
+export async function collectTemplateFiles(root) {
+    const out = [];
+    async function walk(dir, prefix) {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const rel = prefix === '' ? entry.name : `${prefix}/${entry.name}`;
+            const abs = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await walk(abs, rel);
+            }
+            else if (entry.isFile()) {
+                out.push(rel);
+            }
+        }
+    }
+    await walk(root, '');
+    return out;
+}
+/**
+ * Dotfiles a template stores under another name. npm renames a package's
+ * `.gitignore` to `.npmignore` when it installs it, so a template's own
+ * `.gitignore` would never reach a pack scaffolded by `npx @kindgi/cli`.
+ */
+const STORED_AS = { gitignore: '.gitignore' };
+/** A template file's path (relative to its template) as written into the pack. */
+export function templateTarget(rel) {
+    const path = rel.endsWith('.tmpl') ? rel.slice(0, -'.tmpl'.length) : rel;
+    const slash = path.lastIndexOf('/');
+    const name = path.slice(slash + 1);
+    const stored = STORED_AS[name];
+    return stored === undefined ? path : `${path.slice(0, slash + 1)}${stored}`;
+}
+export function substitute(raw, subs) {
+    return raw
+        .replaceAll('{{PACK_NAME}}', subs.PACK_NAME)
+        .replaceAll('{{PACK_ID}}', subs.PACK_ID)
+        .replaceAll('{{PACK_VERSION}}', subs.PACK_VERSION)
+        .replaceAll('{{KINDGI_REQUIREMENT}}', subs.KINDGI_REQUIREMENT ?? '"kindgi"')
+        .replaceAll('{{KINDGI_PYTHON_SOURCE}}', subs.KINDGI_PYTHON_SOURCE ?? '')
+        .replaceAll('{{UV_REQUIRED_VERSION}}', subs.UV_REQUIRED_VERSION ?? '');
+}
+//# sourceMappingURL=template-files.js.map

package/dist/init/template-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-files.js","sourceRoot":"","sources":["../../src/init/template-files.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,MAAc;QAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,SAAS,GAAqC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAEhF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAmB;IACzD,OAAO,GAAG;SACP,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC;SAC3C,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC;SACvC,UAAU,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC;SACjD,UAAU,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,IAAI,UAAU,CAAC;SAC3E,UAAU,CAAC,0BAA0B,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC;SACvE,UAAU,CAAC,yBAAyB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/key/defaults.d.ts

@@ -0,0 +1,3 @@
+import type { KeyRunners } from './runners.js';
+export declare const REAL_KEY_RUNNERS: KeyRunners;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/key/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/key/defaults.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,eAAO,MAAM,gBAAgB,EAAE,UA0C9B,CAAC"}

package/dist/key/defaults.js

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Production wiring for `kindgi key`. Composes `@kindgi/crypto`
+ * primitives + `node:fs/promises` into the `KeyRunners` shape. Loaded
+ * lazily by `main.ts` on `key` dispatch so unrelated commands don't
+ * pay the crypto load.
+ */
+import { mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { generateEd25519KeyPair, serializePrivateKeyPem, serializePublicKeyPem, } from '@kindgi/crypto';
+export const REAL_KEY_RUNNERS = {
+    generateKeyPair: async () => {
+        const pair = generateEd25519KeyPair();
+        return {
+            publicKey: pair.publicKey,
+            privateKey: pair.privateKey,
+            privateKeyPem: serializePrivateKeyPem(pair.privateKey),
+            publicKeyPem: serializePublicKeyPem(pair.publicKey),
+        };
+    },
+    mkdir: async (path, mode) => {
+        await mkdir(path, { recursive: true, mode });
+    },
+    writeFile: async ({ path, contents, mode }) => {
+        await writeFile(path, contents, { mode });
+    },
+    readFile: async (path) => {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    },
+    readdir: async (path) => {
+        try {
+            const entries = await readdir(path, { withFileTypes: true });
+            return entries.map((e) => ({ name: e.name, isFile: e.isFile() }));
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return [];
+            throw err;
+        }
+    },
+    exists: async (path) => {
+        try {
+            await stat(path);
+            return true;
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return false;
+            throw err;
+        }
+    },
+};
+//# sourceMappingURL=defaults.js.map

package/dist/key/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/key/defaults.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,eAAe,EAAE,KAAK,IAAI,EAAE;QAC1B,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAC;QACtC,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QAC5C,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAmC,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACnE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/key/fingerprint.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Compute a short fingerprint (`sha256:<first 12 bytes as hex>`) over
+ * the given public-key material. Accepts raw bytes or a PEM string.
+ */
+export declare function shortFingerprint(input: Uint8Array | string): string;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/key/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/key/fingerprint.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAKnE"}

package/dist/key/fingerprint.js

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Public-key fingerprint helper. `sha256:<first-12-bytes-hex>` — short
+ * enough to eyeball in a list, long enough to disambiguate keys within
+ * a single tenant's tree. Consumers wanting the full digest hash the
+ * public PEM themselves.
+ *
+ * Framework-grade note: this is intentionally NOT the same shape as
+ * `@kindgi/crypto`'s wire fingerprint (if one lands) — this is a
+ * CLI-local display convenience. When `SigningKeyBinding` admin ops
+ * ship, the CLI should switch to the server's canonical fingerprint.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Compute a short fingerprint (`sha256:<first 12 bytes as hex>`) over
+ * the given public-key material. Accepts raw bytes or a PEM string.
+ */
+export function shortFingerprint(input) {
+    const hash = createHash('sha256');
+    hash.update(typeof input === 'string' ? input : Buffer.from(input));
+    const hex = hash.digest('hex').slice(0, 24);
+    return `sha256:${hex}`;
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/key/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/key/fingerprint.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC"}

package/dist/key/paths.d.ts

@@ -0,0 +1,30 @@
+/** Directory the CLI writes / reads keys under. `~/.kindgi/keys/`. */
+export declare const KEYS_SUBDIR: readonly [".kindgi", "keys"];
+/** File permissions the CLI enforces on the layout. */
+export declare const PRIVATE_KEY_FILE_MODE = 384;
+export declare const PUBLIC_KEY_FILE_MODE = 420;
+export declare const KEYS_DIR_MODE = 448;
+/** Regex a `keyId` must match. Same shape as pack IDs — lowercase kebab, optionally dot-namespaced. */
+export declare const KEY_ID_REGEX: RegExp;
+export interface KeyPaths {
+    readonly home: string;
+    readonly keysDir: string;
+    readonly privateKeyPath: (keyId: string) => string;
+    readonly publicKeyPath: (keyId: string) => string;
+}
+/**
+ * Resolve every filesystem path from a home dir. Callers supply
+ * `--home` / `ctx.env.HOME` / `ctx.home`; this file's job is to keep
+ * the layout consistent regardless.
+ */
+export declare function resolveKeyPaths(homeInput: string): KeyPaths;
+/**
+ * Resolve the effective home dir given the standard precedence:
+ * `--home` > `ctx.env.HOME` > `ctx.home` > `os.homedir()`.
+ */
+export declare function pickHome(inputs: {
+    readonly flag?: string;
+    readonly ctxHome?: string;
+    readonly envHome?: string;
+}): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/key/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/key/paths.ts"],"names":[],"mappings":"AAiBA,sEAAsE;AACtE,eAAO,MAAM,WAAW,8BAA+B,CAAC;AAExD,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,MAAQ,CAAC;AAC3C,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAC1C,eAAO,MAAM,aAAa,MAAQ,CAAC;AAEnC,uGAAuG;AACvG,eAAO,MAAM,YAAY,QAA2B,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAS3D;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAKT"}

package/dist/key/paths.js

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Filesystem layout for local signing keys under
+ * `<home>/.kindgi/keys/<keyId>.{pem,pub.pem}`. Kept in its own file so the
+ * command handler + tests share one source of truth for the layout.
+ *
+ * Home dir resolution order (matches other CLI commands):
+ *   1. `--home <dir>` flag
+ *   2. `HOME` env var (via `ctx.env.HOME` or `process.env.HOME`)
+ *   3. `os.homedir()`
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Directory the CLI writes / reads keys under. `~/.kindgi/keys/`. */
+export const KEYS_SUBDIR = ['.kindgi', 'keys'];
+/** File permissions the CLI enforces on the layout. */
+export const PRIVATE_KEY_FILE_MODE = 0o600;
+export const PUBLIC_KEY_FILE_MODE = 0o644;
+export const KEYS_DIR_MODE = 0o700;
+/** Regex a `keyId` must match. Same shape as pack IDs — lowercase kebab, optionally dot-namespaced. */
+export const KEY_ID_REGEX = /^[a-z0-9][a-z0-9._-]*$/;
+/**
+ * Resolve every filesystem path from a home dir. Callers supply
+ * `--home` / `ctx.env.HOME` / `ctx.home`; this file's job is to keep
+ * the layout consistent regardless.
+ */
+export function resolveKeyPaths(homeInput) {
+    const home = homeInput;
+    const keysDir = join(home, ...KEYS_SUBDIR);
+    return {
+        home,
+        keysDir,
+        privateKeyPath: (keyId) => join(keysDir, `${keyId}.pem`),
+        publicKeyPath: (keyId) => join(keysDir, `${keyId}.pub.pem`),
+    };
+}
+/**
+ * Resolve the effective home dir given the standard precedence:
+ * `--home` > `ctx.env.HOME` > `ctx.home` > `os.homedir()`.
+ */
+export function pickHome(inputs) {
+    if (typeof inputs.flag === 'string' && inputs.flag !== '')
+        return inputs.flag;
+    if (typeof inputs.envHome === 'string' && inputs.envHome !== '')
+        return inputs.envHome;
+    if (typeof inputs.ctxHome === 'string' && inputs.ctxHome !== '')
+        return inputs.ctxHome;
+    return homedir();
+}
+//# sourceMappingURL=paths.js.map

package/dist/key/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/key/paths.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,MAAM,CAAU,CAAC;AAExD,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AASrD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI;QACJ,OAAO;QACP,cAAc,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,MAAM,CAAC;QAChE,aAAa,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAIxB;IACC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAC9E,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IACvF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IACvF,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC"}