@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/key/runners.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Injectable seams for `kindgi key`. Every filesystem side-effect
+ * and every crypto op flows through this shape so tests substitute
+ * fixtures — no real key files touch disk under `~/.kindgi/keys/` during
+ * unit tests.
+ *
+ * Production wiring lives at `packages/cli/src/key/defaults.ts`; tests
+ * pass `RunCliInputs.keyRunners` with in-memory stubs.
+ */
+/**
+ * Byte-oriented view of an Ed25519 key pair — the raw 32-byte
+ * representation `@kindgi/crypto` operates on. Both public and
+ * private are handed to the runner so the caller can serialize each
+ * independently (public → PEM + raw hex + base64; private → PEM only).
+ */
+export interface GeneratedKeyPair {
+    readonly publicKey: Uint8Array;
+    readonly privateKey: Uint8Array;
+    readonly privateKeyPem: string;
+    readonly publicKeyPem: string;
+}
+export interface WriteFileOptions {
+    readonly path: string;
+    readonly contents: string | Uint8Array;
+    readonly mode: number;
+}
+export interface KeyDirEntry {
+    readonly name: string;
+    readonly isFile: boolean;
+}
+/**
+ * Runners shape. All ops asynchronous — matches the `BuildRunners` /
+ * `DeployRunners` / `DevRunners` conventions.
+ */
+export interface KeyRunners {
+    /** Generate a fresh Ed25519 key pair (raw bytes + PEM serialization). */
+    readonly generateKeyPair: () => Promise<GeneratedKeyPair>;
+    /** `mkdir -p` with a specific mode (0o700 for the keys dir). */
+    readonly mkdir: (path: string, mode: number) => Promise<void>;
+    /** Write `contents` to `path` with the given mode. Never overwrites — the caller pre-checks. */
+    readonly writeFile: (opts: WriteFileOptions) => Promise<void>;
+    /**
+     * Read `path` as UTF-8. Returns `null` if the file does not exist;
+     * throws for any other IO error. Used by `export` (reads the pub PEM)
+     * + `list` (existence probe).
+     */
+    readonly readFile: (path: string) => Promise<string | null>;
+    /**
+     * Directory listing. Returns an empty array when the directory does
+     * not exist. Anything else throws.
+     */
+    readonly readdir: (path: string) => Promise<readonly KeyDirEntry[]>;
+    /**
+     * `stat`-style existence probe. Returns `true` if a file exists at
+     * `path`, `false` otherwise. Used to enforce the refuse-to-overwrite
+     * contract on `key create`.
+     */
+    readonly exists: (path: string) => Promise<boolean>;
+}
+//# sourceMappingURL=runners.d.ts.map

package/dist/key/runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/key/runners.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD"}

package/dist/key/runners.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=runners.js.map

package/dist/key/runners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runners.js","sourceRoot":"","sources":["../../src/key/runners.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/main.d.ts

@@ -0,0 +1,113 @@
+import type { KindgiClient } from '@kindgi/client';
+import type { BuildRunners } from './build/runners.js';
+import type { RegistryAuthSeam } from './commands/auth.js';
+import type { EnvInitInputSeam } from './commands/env.js';
+import { ROOT_COMMANDS } from './commands/index.js';
+import type { SecretsValueInputSeam } from './commands/secrets.js';
+import type { DeployRunners } from './deploy/runners.js';
+import type { DevRunners } from './dev/runners.js';
+import type { EnvRunners } from './env/runners.js';
+import type { KeyRunners } from './key/runners.js';
+import type { TestRunners } from './test/runners.js';
+export interface RunCliInputs {
+    readonly argv: readonly string[];
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly cwd?: string;
+    readonly home?: string;
+    readonly fetchImpl?: typeof fetch;
+    readonly clientFactory?: (apiUrl: string, token: string) => KindgiClient;
+    readonly configReadFile?: (path: string) => Promise<string | null>;
+    /**
+     * Injectable seams used exclusively by `kindgi dev` — the runtime,
+     * indexer, and pack-folder watcher. Tests hand in fixture
+     * implementations so the command flow exercises without Docker or
+     * Postgres. When absent, `kindgi dev` uses production wiring from
+     * `packages/cli/src/dev/defaults.ts` (loaded lazily, so other commands
+     * don't load the dev loop's dependencies).
+     */
+    readonly devRunners?: DevRunners;
+    /**
+     * Optional signal that terminates long-running commands (the
+     * `kindgi dev` watch loop). Production callers wire this to
+     * SIGINT/SIGTERM in the `cli.js` bin; tests pass an
+     * `AbortController.signal`.
+     */
+    readonly stopSignal?: AbortSignal;
+    /**
+     * Injectable seams used exclusively by `kindgi build` — the local
+     * indexer, esbuild bundler, Containerfile writer, tar producer, POST
+     * /v1/build client, SSE log reader, docker-pull-and-extract, and
+     * Ed25519 signer. Tests substitute fixture implementations so the
+     * pipeline exercises without spawning esbuild / real docker / a live
+     * build server. When absent, `kindgi build` lazy-loads production
+     * wiring from `packages/cli/src/build/defaults.ts`.
+     */
+    readonly buildRunners?: BuildRunners;
+    /**
+     * Optional loader for `kindgi.config.ts`. Tests hand in an
+     * in-memory function; production uses a plain dynamic `import()`.
+     */
+    readonly buildConfigLoader?: (packDir: string) => Promise<{
+        readonly [k: string]: unknown;
+    }>;
+    /**
+     * Injectable seams used exclusively by `kindgi deploy` — the
+     * envelope loader + POST /v1/deployments client + optional inline-
+     * build runner. Tests substitute fixture implementations so the
+     * pipeline exercises without reading a real envelope from disk or
+     * hitting a live api-server. Production lazy-loads
+     * `packages/cli/src/deploy/defaults.ts` on dispatch.
+     */
+    readonly deployRunners?: DeployRunners;
+    /**
+     * Injectable seams used exclusively by `kindgi test` — the
+     * vitest config probe + runner spawn. Tests substitute stubs so
+     * the command exercises without spawning real vitest. Production
+     * lazy-loads `packages/cli/src/test/defaults.ts` on dispatch.
+     */
+    readonly testRunners?: TestRunners;
+    /**
+     * Injectable filesystem seams used exclusively by `kindgi env` —
+     * `.env.<envName>` reads/writes. Tests substitute in-memory stubs
+     * so no real env files touch disk. Production lazy-loads
+     * `packages/cli/src/env/defaults.ts` on dispatch.
+     */
+    readonly envRunners?: EnvRunners;
+    /**
+     * Injectable seams used exclusively by `kindgi key` — the crypto
+     * generator + `~/.kindgi/keys/` fs surface. Tests substitute stubs so
+     * no real key files touch disk. Production lazy-loads
+     * `packages/cli/src/key/defaults.ts` on dispatch.
+     */
+    readonly keyRunners?: KeyRunners;
+    /**
+     * Injectable value-input seams for `kindgi secrets set` /
+     * `rotate`. Tests substitute stubs so the TTY / stdin / file paths
+     * exercise without a real terminal.
+     */
+    readonly secretsInputSeam?: SecretsValueInputSeam;
+    /**
+     * Injectable prompt / TTY-check seam for `kindgi env init`. Tests
+     * substitute a fixture `promptChoice`.
+     */
+    readonly envInitInputSeam?: EnvInitInputSeam;
+    /**
+     * Injectable seams for `kindgi auth registry`: the `docker` runner, the
+     * stdin reader, the hidden prompt and the image checked. Tests
+     * substitute fixtures so no real `docker login` runs.
+     */
+    readonly registryAuthSeam?: RegistryAuthSeam;
+}
+export interface CliOutcome {
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly exitCode: number;
+}
+/**
+ * Entry point invoked by both the compiled `kindgi` bin and the
+ * test harness. Isolated from `process.exit` / `process.argv` so tests
+ * can drive it directly.
+ */
+export declare function runCli(inputs: RunCliInputs): Promise<CliOutcome>;
+export { ROOT_COMMANDS };
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAe,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAInE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,YAAY,CAAC;IACzE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7F;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CA0HtE;AA4ED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/main.js

@@ -0,0 +1,199 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { ROOT_COMMANDS, findCommand } from './commands/index.js';
+import { loadConfig } from './config.js';
+import { buildContext } from './context.js';
+import { formatThrown } from './errors.js';
+import { commandHelpText, rootHelpText } from './help.js';
+import { GLOBAL_OPTION_SPEC, parseCommand } from './parse.js';
+import { CLI_VERSION } from './version-info.js';
+/**
+ * Entry point invoked by both the compiled `kindgi` bin and the
+ * test harness. Isolated from `process.exit` / `process.argv` so tests
+ * can drive it directly.
+ */
+export async function runCli(inputs) {
+    const argv = inputs.argv;
+    // Handle top-level version / help before command parsing so
+    // `kindgi --version` works without arguments.
+    if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
+        return { stdout: rootHelpText(), stderr: '', exitCode: 0 };
+    }
+    if (argv[0] === '--version') {
+        return { stdout: `${CLI_VERSION}\n`, stderr: '', exitCode: 0 };
+    }
+    const found = findCommand(argv);
+    if (found === null) {
+        return {
+            stdout: '',
+            stderr: `Unknown command: ${argv.join(' ')}\n\n${rootHelpText()}`,
+            exitCode: 2,
+        };
+    }
+    const { command, consumed } = found;
+    const remainingTokens = argv.slice(consumed);
+    if (command.kind === 'group') {
+        return { stdout: commandHelpText(command, argv.slice(0, consumed)), stderr: '', exitCode: 0 };
+    }
+    let parsed;
+    try {
+        parsed = parseCommand(remainingTokens, {
+            ...(command.optionSpec ?? {}),
+            ...GLOBAL_OPTION_SPEC,
+        });
+    }
+    catch (err) {
+        return {
+            stdout: '',
+            stderr: `Argument error: ${err.message}\n\n${commandHelpText(command)}`,
+            exitCode: 2,
+        };
+    }
+    if (parsed.globals.help) {
+        return { stdout: commandHelpText(command), stderr: '', exitCode: 0 };
+    }
+    if (parsed.globals.version) {
+        return { stdout: `${CLI_VERSION}\n`, stderr: '', exitCode: 0 };
+    }
+    const config = await loadConfig({
+        ...(parsed.globals.url !== undefined ? { flagUrl: parsed.globals.url } : {}),
+        ...(parsed.globals.token !== undefined ? { flagToken: parsed.globals.token } : {}),
+        ...(inputs.env !== undefined ? { env: inputs.env } : {}),
+        ...(inputs.cwd !== undefined ? { cwd: inputs.cwd } : {}),
+        ...(inputs.home !== undefined ? { home: inputs.home } : {}),
+        ...(inputs.configReadFile !== undefined ? { readFile: inputs.configReadFile } : {}),
+    });
+    // Lazily wire dev runners so commands other than `kindgi dev` don't
+    // load the dev loop. Tests supplying `inputs.devRunners` always win.
+    //
+    // Keyed on the TOP-LEVEL command (`argv[0]`), not the resolved leaf:
+    // `kindgi env list` resolves to the leaf `list`, so matching on the
+    // leaf name never loaded the env / key runners outside tests.
+    const topLevel = argv[0];
+    const devRunners = inputs.devRunners ?? (topLevel === 'dev' ? await loadRealDevRunners() : undefined);
+    // Same shape for `kindgi build`: lazy-load the esbuild / tar /
+    // docker seams so unrelated commands don't pay the transitive load.
+    // `kindgi deploy` needs the build runners too when the envelope
+    // is missing and the command auto-runs `kindgi build` inline.
+    const needsBuildRunners = topLevel === 'build' || topLevel === 'deploy';
+    const buildRunners = inputs.buildRunners ?? (needsBuildRunners ? await loadRealBuildRunners() : undefined);
+    const deployRunners = inputs.deployRunners ?? (topLevel === 'deploy' ? await loadRealDeployRunners() : undefined);
+    const testRunners = inputs.testRunners ?? (topLevel === 'test' ? await loadRealTestRunners() : undefined);
+    const envRunners = inputs.envRunners ?? (topLevel === 'env' ? await loadRealEnvRunners() : undefined);
+    const keyRunners = inputs.keyRunners ?? (topLevel === 'key' ? await loadRealKeyRunners() : undefined);
+    const ctx = buildContext({
+        globals: parsed.globals,
+        positionals: parsed.positionals,
+        options: parsed.options,
+        config,
+        ...(inputs.fetchImpl !== undefined ? { fetchImpl: inputs.fetchImpl } : {}),
+        ...(inputs.clientFactory !== undefined ? { clientFactory: inputs.clientFactory } : {}),
+        ...(inputs.home !== undefined ? { home: inputs.home } : {}),
+        ...(inputs.cwd !== undefined ? { cwd: inputs.cwd } : {}),
+        ...(inputs.env !== undefined ? { env: inputs.env } : {}),
+        ...(devRunners !== undefined ? { devRunners } : {}),
+        ...(inputs.stopSignal !== undefined ? { stopSignal: inputs.stopSignal } : {}),
+        ...(buildRunners !== undefined ? { buildRunners } : {}),
+        ...(inputs.buildConfigLoader !== undefined
+            ? { buildConfigLoader: inputs.buildConfigLoader }
+            : {}),
+        ...(deployRunners !== undefined ? { deployRunners } : {}),
+        ...(testRunners !== undefined ? { testRunners } : {}),
+        ...(envRunners !== undefined ? { envRunners } : {}),
+        ...(keyRunners !== undefined ? { keyRunners } : {}),
+        ...(inputs.secretsInputSeam !== undefined ? { secretsInputSeam: inputs.secretsInputSeam } : {}),
+        ...(inputs.envInitInputSeam !== undefined ? { envInitInputSeam: inputs.envInitInputSeam } : {}),
+        ...(inputs.registryAuthSeam !== undefined ? { registryAuthSeam: inputs.registryAuthSeam } : {}),
+    });
+    const label = commandLabel(command, argv, consumed);
+    try {
+        const result = await command.run(ctx);
+        if (result.kind === 'ok') {
+            return {
+                stdout: result.rendered.stdout,
+                stderr: result.rendered.stderr,
+                exitCode: result.exitCode ?? 0,
+            };
+        }
+        return { stdout: '', stderr: result.stderr, exitCode: result.exitCode };
+    }
+    catch (err) {
+        const formatted = formatThrown(err, { commandLabel: label, verbose: parsed.globals.verbose });
+        return { stdout: '', stderr: formatted.stderr, exitCode: formatted.exitCode };
+    }
+}
+function commandLabel(_command, argv, consumed) {
+    return `kindgi ${argv.slice(0, consumed).join(' ')}`;
+}
+async function loadRealDevRunners() {
+    try {
+        const mod = await import('./dev/defaults.js');
+        return mod.REAL_DEV_RUNNERS;
+    }
+    catch {
+        // Loading defaults can fail cleanly when a dev-loop dependency
+        // isn't installed (e.g. a minimally-built environment). We surface a
+        // clear error inside the command handler rather than crash CLI
+        // dispatch here.
+        return undefined;
+    }
+}
+async function loadRealBuildRunners() {
+    try {
+        const mod = await import('./build/defaults.js');
+        return mod.REAL_BUILD_RUNNERS;
+    }
+    catch {
+        // Same pattern as dev — if esbuild / tar / @kindgi/crypto /
+        // @kindgi/handler-runtime fail to load, the command handler
+        // surfaces a clear error rather than crashing dispatch.
+        return undefined;
+    }
+}
+async function loadRealDeployRunners() {
+    try {
+        const mod = await import('./deploy/defaults.js');
+        return mod.REAL_DEPLOY_RUNNERS;
+    }
+    catch {
+        // If the envelope loader / post module fails to load, surface a
+        // clean error from the command handler rather than crashing
+        // dispatch — mirrors dev + build.
+        return undefined;
+    }
+}
+async function loadRealTestRunners() {
+    try {
+        const mod = await import('./test/defaults.js');
+        return mod.REAL_TEST_RUNNERS;
+    }
+    catch {
+        // Should never fail (only node:child_process + node:fs), but keep
+        // the same shape as every other lazy-load path so a broken import
+        // surfaces via the command handler.
+        return undefined;
+    }
+}
+async function loadRealEnvRunners() {
+    try {
+        const mod = await import('./env/defaults.js');
+        return mod.REAL_ENV_RUNNERS;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function loadRealKeyRunners() {
+    try {
+        const mod = await import('./key/defaults.js');
+        return mod.REAL_KEY_RUNNERS;
+    }
+    catch {
+        // `@kindgi/crypto` transitively pulls in `node:crypto`, always
+        // available under Node 22. If this ever fails, the fault is a
+        // build-time mispackage.
+        return undefined;
+    }
+}
+export { ROOT_COMMANDS };
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAOjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgGhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAoB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,4DAA4D;IAC5D,8CAA8C;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,oBAAoB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,YAAY,EAAE,EAAE;YACjE,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChG,CAAC;IAED,IAAI,MAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,eAAe,EAAE;YACrC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;YAC7B,GAAG,kBAAkB;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,mBAAoB,GAAa,CAAC,OAAO,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE;YAClF,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;IAEH,oEAAoE;IACpE,qEAAqE;IACrE,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrF,+DAA+D;IAC/D,oEAAoE;IACpE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,iBAAiB,GAAG,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IACxE,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,WAAW,GACf,MAAM,CAAC,WAAW,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErF,MAAM,GAAG,GAAG,YAAY,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAiB,EAAE,IAAuB,EAAE,QAAgB;IAChF,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,gBAAgB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,qEAAqE;QACrE,+DAA+D;QAC/D,iBAAiB;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,kBAAkB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,4DAA4D;QAC5D,wDAAwD;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,mBAAmB,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,4DAA4D;QAC5D,kCAAkC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,iBAAiB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,kEAAkE;QAClE,oCAAoC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,gBAAgB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,gBAAgB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,8DAA8D;QAC9D,yBAAyB;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/mcp/launcher.d.ts

@@ -0,0 +1,143 @@
+/**
+ * `kindgi mcp-launch` — the subprocess wrapper that spawns an MCP
+ * server with secrets injected from the pack's env files — the same
+ * files, read the same way, as Kindgi's dev-mode `SecretBinding`
+ * (`@kindgi/secrets-dotenv`): for `local`, the project's `.env` then
+ * `.env.local` (or `dev.envFiles`); otherwise `.env.<envName>`.
+ *
+ * Design goals:
+ *   - **Generic** — no per-server logic. Works for any Node package
+ *     invocable via `npx`, or any Docker image, that reads its
+ *     credentials from environment variables.
+ *   - **Portable across MCP clients** — a `.mcp.json` entry running the
+ *     project's `kindgi mcp-launch …` (via its package manager, e.g.
+ *     `pnpm exec kindgi`) works identically for Claude Code, Cursor,
+ *     VS Code, Claude Desktop, Windsurf, or anything else that speaks
+ *     the MCP config shape.
+ *   - **Secrets stay outside the model's context** — the DB URL /
+ *     token flows: SecretBinding → this process's memory → child
+ *     process's env. Never in argv (visible via `ps aux`); never in
+ *     `.mcp.json` (visible via any Read tool the model calls).
+ *
+ * Argv shape:
+ *
+ *     kindgi mcp-launch \
+ *       --runtime=<npx|docker> \
+ *       --package=<npm-package-or-docker-image> \
+ *       --env-map=VAR=secret:NAME@envName:scopeKind[:scopeId] \  (repeatable)
+ *       [--pack-dir=<abs-path>] \
+ *       [--host-remap=docker-desktop] \
+ *       -- <passthrough args forwarded to the child process>
+ *
+ * `--host-remap=docker-desktop` rewrites `localhost` / `127.0.0.1` in
+ * resolved secret VALUES to `host.docker.internal` — the Mac/Windows
+ * Docker escape hatch. Only applied when the runtime is `docker`.
+ *
+ * Exit codes:
+ *   - 0 (or child's exit code) — child ran to completion
+ *   - 2 — argv parse error
+ *   - 3 — secret resolution error (missing env file, missing secret)
+ *   - 4 — spawn error (child couldn't start)
+ */
+import { spawn as nodeSpawn } from 'node:child_process';
+import { type LocalEnvSettings } from '../env/project-env.js';
+export type Runtime = 'npx' | 'docker';
+export type HostRemap = 'docker-desktop';
+export type ScopeKind = 'tenant' | 'org' | 'project';
+export interface SecretRef {
+    readonly name: string;
+    readonly envName: string;
+    readonly scopeKind: ScopeKind;
+    readonly scopeId?: string;
+}
+export interface EnvMapEntry {
+    readonly child: string;
+    readonly ref: SecretRef;
+}
+export interface ParsedLauncherArgs {
+    readonly runtime: Runtime;
+    readonly package: string;
+    readonly envMap: readonly EnvMapEntry[];
+    readonly packDir: string;
+    readonly hostRemap?: HostRemap;
+    readonly passthroughArgs: readonly string[];
+}
+export type ParseResult = {
+    readonly kind: 'ok';
+    readonly args: ParsedLauncherArgs;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+export type ResolveResult = {
+    readonly kind: 'ok';
+    readonly env: Readonly<Record<string, string>>;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+export interface ChildCommand {
+    readonly cmd: string;
+    readonly args: readonly string[];
+    readonly extraEnv: Readonly<Record<string, string>>;
+}
+/**
+ * Parse a single `--env-map` value: `VAR=secret:NAME@envName:scopeKind[:scopeId]`.
+ * Returns null on malformed input; caller decides error phrasing.
+ */
+export declare function parseEnvMapFlag(raw: string): EnvMapEntry | null;
+/**
+ * Parse a secret reference: `secret:NAME@envName:scopeKind[:scopeId]`.
+ *
+ *   - `secret:GRIEVANCE_DB_URL@local:tenant`
+ *   - `secret:X@local:project:pack-a`
+ *   - `secret:X@local:org:acme`
+ */
+export declare function parseSecretRef(raw: string): SecretRef | null;
+/**
+ * Parse the full launcher argv. Everything after a bare `--` token is
+ * treated as passthrough to the child.
+ */
+export declare function parseLauncherArgs(argv: readonly string[]): ParseResult;
+/**
+ * Resolve every env-map entry against the pack's env files for its
+ * environment (`@kindgi/secrets-dotenv`'s `readPackEnv`). Each
+ * environment's files are read once. The dev store is scope-blind, so
+ * `scopeKind` / `scopeId` are recorded but not used for lookup;
+ * `KINDGI_*` names are runtime config and never resolve here.
+ */
+export declare function resolveSecrets(entries: readonly EnvMapEntry[], packDir: string, readFile: (path: string) => Promise<string>, options?: {
+    readonly localEnvFiles?: readonly string[];
+}): Promise<ResolveResult>;
+/**
+ * Rewrite `localhost` / `127.0.0.1` in a value to `host.docker.internal`
+ * when `mode === 'docker-desktop'`. Applied to every resolved secret
+ * value before injecting into the child's env, but only when the child
+ * is a Docker container (the launcher decides at call time).
+ *
+ * Not URL-parsing-based; we don't want to shred a value we don't
+ * understand. Simple string replacement on the two known host tokens.
+ * Real edge cases (nested URLs, IPv6 `::1`) can be added if a real
+ * consumer surfaces them.
+ */
+export declare function applyHostRemap(value: string, mode: HostRemap | undefined): string;
+/**
+ * Compose the (cmd, args, extraEnv) triple to spawn. Deterministic —
+ * no side effects — so it's trivially testable. Docker-runtime host
+ * remap is applied here because it's per-value transformation.
+ */
+export declare function buildChildCommand(parsed: ParsedLauncherArgs, resolvedEnv: Readonly<Record<string, string>>): ChildCommand;
+export interface RunLauncherDeps {
+    readonly readFile: (path: string) => Promise<string>;
+    /** `dev.envFiles` from the pack's `kindgi.config.ts`. */
+    readonly localEnvSettings: (packDir: string) => Promise<LocalEnvSettings>;
+    readonly spawn: typeof nodeSpawn;
+    readonly stderr: (msg: string) => void;
+    readonly onSignal: (handler: (sig: NodeJS.Signals) => void) => () => void;
+}
+/**
+ * Run the launcher end-to-end. Returns the effective exit code so a
+ * caller (the CLI) can `process.exit(code)`.
+ */
+export declare function runLauncher(argv: readonly string[], overrides?: Partial<RunLauncherDeps>): Promise<number>;
+//# sourceMappingURL=launcher.d.ts.map

package/dist/mcp/launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../../src/mcp/launcher.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMxD,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AAMpF,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;AACvC,MAAM,MAAM,SAAS,GAAG,gBAAgB,CAAC;AACzC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AASD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAS/D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAsB5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CA8EtE;AAMD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAC3C,OAAO,GAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAC3D,OAAO,CAAC,aAAa,CAAC,CAuDxB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAKjF;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC5C,YAAY,CAwBd;AAMD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1E,QAAQ,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;CAC3E;AAkBD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GACvC,OAAO,CAAC,MAAM,CAAC,CAqDjB"}