@kindgi/cli 0.0.0-bootstrap.0 → 0.1.1

package/dist/mcp/preset-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset-loader.js","sourceRoot":"","sources":["../../src/mcp/preset-loader.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,mEAAmE;AACnE,2CAA2C;AAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAOD,MAAM,UAAU,GAAa;IAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;IAC1C,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;CACrD,CAAC;AAMF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,kBAAkB,EAAE,EAClC,KAAe,UAAU;IAEzB,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAqB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,kEAAkE;QAClE,8BAA8B;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,kBAAkB,MAAM,CAAC,IAAI,mCAAmC,YAAY,GAAG,CACvF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyC,EAAE,IAAY;IAC/E,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CACjC,OAAyC;IAEzC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,GAAG,CAAgB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAUD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,oCAAoC,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,mCAAmC,EAAE,CAAC;QACzF,CAAC;QACD,kEAAkE;QAClE,6DAA6D;QAC7D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,iBAAiB,CAAC,aAAa,IAAI,8CAA8C;aAC3F,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,WAAW,GAAG,cAAmC,CAAC;IACxD,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC;IACnC,IAAI,SAA8B,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,uBAAuB,MAAM,CAAC,YAAY,CAAC,qDAAqD;aAC1G,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,gBAAgB,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,cAAc,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,cAAc,CAAC;IAEzD,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtF,MAAM,MAAM,GAAW;QACrB,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;QACjD,OAAO;QACP,OAAO,EAAE,GAAG;QACZ,MAAM;QACN,WAAW;QACX,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,KAAK,EAAE,cAAc,CAAC,KAAK;KAC5B,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAMD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;IACjC,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EACL,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACtF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,eAAe,EAAE,IAAI;YACrB,UAAU;YACV,OAAO;YACP,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp/preset-types.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Types for `kindgi mcp` presets — the curated per-server config bundles
+ * that back `kindgi mcp add <kind>`.
+ *
+ * A preset is a JSON file under `packages/cli/src/mcp/presets/*.json`.
+ * At `kindgi mcp add` time, the CLI resolves the preset by `kind`,
+ * substitutes `--secret=<name>` into the `$SECRET` placeholder of the
+ * envMap template, and writes the fully-resolved launcher argv into
+ * `.mcp.json` at the pack root.
+ *
+ * See `packages/cli/src/mcp/presets/README.md` for the authoring guide.
+ */
+import type { HostRemap, Runtime } from './launcher.js';
+export interface Preset {
+    /** Short label, matches the JSON filename stem. Used by `kindgi mcp add <kind>`. */
+    readonly kind: string;
+    /** One-line human summary shown by `kindgi mcp presets`. */
+    readonly description?: string;
+    /** Which spawn strategy the launcher uses. */
+    readonly runtime: Runtime;
+    /** npm package (for `npx`) or Docker image (for `docker`). */
+    readonly package: string;
+    /**
+     * How to route the caller's `--secret=<name>` into the child's env.
+     * Every entry has `from: "$SECRET"` today — the placeholder that
+     * substitutes with the user-provided secret name at `mcp add` time.
+     * Future template forms (e.g. per-secret refs, literal values) can
+     * extend this shape without breaking existing presets.
+     */
+    readonly envMap: readonly PresetEnvMapEntry[];
+    /** Passthrough args appended after `--` when spawning the child. */
+    readonly defaultArgs: readonly string[];
+    /** Docker-Desktop-on-Mac localhost fixup — see launcher's applyHostRemap. */
+    readonly hostRemap?: HostRemap;
+    /** Per-server audit metadata (who reviewed the server, and when). */
+    readonly audit: PresetAudit;
+}
+export interface PresetEnvMapEntry {
+    /** The env-var name in the CHILD process. */
+    readonly child: string;
+    /**
+     * Template that resolves the value. Only `"$SECRET"` today — expands
+     * to the caller's `--secret=<name>`.
+     */
+    readonly from: string;
+}
+export interface PresetAudit {
+    /**
+     * Has this preset's server version been verified NOT to echo the
+     * resolved secret in its error tool results / debug logs?
+     *   - `verified-safe` — a real inspection succeeded at `version`
+     *   - `pending` — no inspection yet; assume unsafe
+     *   - `known-issue` — inspection found a leak; details in `notes`
+     */
+    readonly urlLeakInErrors: 'verified-safe' | 'pending' | 'known-issue';
+    /** ISO date of the last audit. Null when `urlLeakInErrors === 'pending'`. */
+    readonly reviewedAt: string | null;
+    /** npm / Docker tag of the version audited. Null when `pending`. */
+    readonly version: string | null;
+    /** Free-form notes — quirks, links to related issues, etc. */
+    readonly notes?: string;
+}
+/** Slimmer shape for `kindgi mcp presets` list output. */
+export interface PresetSummary {
+    readonly kind: string;
+    readonly runtime: Runtime;
+    readonly package: string;
+    readonly description?: string;
+    readonly audit: PresetAudit;
+}
+//# sourceMappingURL=preset-types.d.ts.map

package/dist/mcp/preset-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset-types.d.ts","sourceRoot":"","sources":["../../src/mcp/preset-types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,SAAS,GAAG,aAAa,CAAC;IACtE,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B"}

package/dist/mcp/preset-types.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=preset-types.js.map

package/dist/mcp/preset-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset-types.js","sourceRoot":"","sources":["../../src/mcp/preset-types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/mcp/presets/README.md

@@ -0,0 +1,68 @@
+# `kindgi mcp` presets — authoring guide
+
+Each `*.json` file in this directory is one MCP-server preset consumed
+by `kindgi mcp add <kind>`. The filename stem is the `kind` — how users
+reach the preset from the CLI.
+
+## Schema
+
+See `packages/cli/src/mcp/preset-types.ts` for the authoritative TypeScript
+shape. In brief:
+
+```json
+{
+  "kind": "postgres",                        // must match filename stem
+  "description": "one-line summary",         // shown by `kindgi mcp presets`
+  "runtime": "npx" | "docker",               // how the launcher spawns it
+  "package": "<npm-name-or-docker-image>",
+  "envMap": [
+    { "child": "DATABASE_URI", "from": "$SECRET" }   // "$SECRET" = user's --secret=<name>
+  ],
+  "defaultArgs": ["--access-mode=restricted"],       // passthrough args after `--`
+  "hostRemap": "docker-desktop",                     // (optional) localhost fixup for Docker on Mac
+  "audit": {
+    "urlLeakInErrors": "pending",                    // "verified-safe" | "pending" | "known-issue"
+    "reviewedAt": null,                              // ISO date once audited
+    "version": null,                                 // npm/docker tag audited
+    "notes": "..."                                   // freeform
+  }
+}
+```
+
+## Adding a preset
+
+1. Create `<kind>.json` (filename == the `kind` field).
+2. Fill in the fields above. Start with `audit.urlLeakInErrors: "pending"` —
+   never claim `"verified-safe"` without a real inspection.
+3. If the underlying MCP server is Docker + you're targeting local dev on
+   Mac / Windows, set `"hostRemap": "docker-desktop"` so the launcher
+   rewrites `@localhost` / `@127.0.0.1` in resolved secret values to
+   `@host.docker.internal`.
+4. Run `pnpm --filter @kindgi/cli test preset` to confirm the loader
+   accepts your JSON.
+
+## Audit obligations
+
+Every preset carries an `audit` block. Before flipping
+`urlLeakInErrors` to `"verified-safe"`:
+
+- **Read the server's source** for every place it constructs an error
+  message, log line, or debug-mode dump. Confirm the secret env var
+  never appears.
+- **Poke the server** with malformed queries (`docker run` it locally,
+  send garbage over stdio) and grep stdout/stderr for the URL/token
+  substring.
+- Record the version (`npm ls <pkg>` or `docker image inspect`) in
+  `audit.version` and today's ISO date in `audit.reviewedAt`.
+
+A `kindgi mcp verify` command that automates this check is planned.
+
+## Only `$SECRET` is a supported template today
+
+`envMap[].from` accepts only the literal string `"$SECRET"`, which
+substitutes with the `--secret=<name>` the user passes to
+`kindgi mcp add`. This narrows the surface area intentionally — most
+MCP servers want exactly one secret in one env var. When we see a
+consumer needing multiple named secrets or per-env-var overrides,
+we'll widen the template DSL (candidate shapes:
+`${SECRET:OTHER_NAME}`, `${LITERAL:some-value}`).

package/dist/mcp/presets/postgres.json

@@ -0,0 +1,15 @@
+{
+  "kind": "postgres",
+  "description": "PostgreSQL via crystaldba/postgres-mcp (Docker) — active fork with index tuning, EXPLAIN plans, health checks, and safe SQL execution. Defaults to read-only mode.",
+  "runtime": "docker",
+  "package": "crystaldba/postgres-mcp",
+  "envMap": [{ "child": "DATABASE_URI", "from": "$SECRET" }],
+  "defaultArgs": ["--access-mode=restricted"],
+  "hostRemap": "docker-desktop",
+  "audit": {
+    "urlLeakInErrors": "pending",
+    "reviewedAt": null,
+    "version": null,
+    "notes": "First audit pending — verify error paths don't echo DATABASE_URI."
+  }
+}

package/dist/output.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Output shapes used by every command handler. The dispatcher picks a
+ * formatter based on the caller's `--json` / `--table` / `--raw` /
+ * `--quiet` flags.
+ */
+export type OutputFormat = 'json' | 'table' | 'raw' | 'quiet';
+export interface Column<T> {
+    readonly header: string;
+    readonly get: (row: T) => string;
+}
+export interface Rendered {
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export declare function renderJson(value: unknown, format: OutputFormat): Rendered;
+export declare function renderTable<T>(rows: readonly T[], columns: readonly Column<T>[]): Rendered;
+/**
+ * Render a value, choosing between JSON and table representations based on
+ * the requested format. If `--table` is requested but no columns are given
+ * (e.g. a get-by-id result), fall back to pretty JSON.
+ */
+export declare function renderResult<T>(value: T, format: OutputFormat, options?: {
+    readonly rows?: readonly unknown[];
+    readonly columns?: readonly Column<unknown>[];
+}): Rendered;
+//# sourceMappingURL=output.d.ts.map

package/dist/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,QAAQ,CAIzE;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAuB1F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;IACP,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,GACL,QAAQ,CAKV"}

package/dist/output.js

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export function renderJson(value, format) {
+    if (format === 'quiet')
+        return { stdout: '', stderr: '' };
+    if (format === 'raw')
+        return { stdout: `${JSON.stringify(value)}\n`, stderr: '' };
+    return { stdout: `${JSON.stringify(value, null, 2)}\n`, stderr: '' };
+}
+export function renderTable(rows, columns) {
+    if (rows.length === 0)
+        return { stdout: '(no rows)\n', stderr: '' };
+    const headers = columns.map((c) => c.header);
+    const cells = rows.map((row) => columns.map((c) => c.get(row)));
+    const widths = headers.map((h, i) => {
+        let w = h.length;
+        for (const row of cells) {
+            const v = row[i] ?? '';
+            if (v.length > w)
+                w = v.length;
+        }
+        return w;
+    });
+    const line = (values) => values
+        .map((v, i) => v.padEnd(widths[i] ?? 0, ' '))
+        .join('  ')
+        .trimEnd();
+    const sep = widths
+        .map((w) => '─'.repeat(w))
+        .join('  ')
+        .trimEnd();
+    const body = cells.map(line).join('\n');
+    return { stdout: `${line(headers)}\n${sep}\n${body}\n`, stderr: '' };
+}
+/**
+ * Render a value, choosing between JSON and table representations based on
+ * the requested format. If `--table` is requested but no columns are given
+ * (e.g. a get-by-id result), fall back to pretty JSON.
+ */
+export function renderResult(value, format, options = {}) {
+    if (format === 'table' && options.rows && options.columns) {
+        return renderTable(options.rows, options.columns);
+    }
+    return renderJson(value, format);
+}
+//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,MAAoB;IAC7D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAClF,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,WAAW,CAAI,IAAkB,EAAE,OAA6B;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAU,EAAE,CACjD,MAAM;SACH,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CAAC;IACf,MAAM,GAAG,GAAG,MAAM;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACzB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CAAC;IACb,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAQ,EACR,MAAoB,EACpB,UAGI,EAAE;IAEN,IAAI,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/pack-config.d.ts

@@ -0,0 +1,37 @@
+import type { CommandContext } from './context.js';
+export type PackConfigRecord = {
+    readonly [k: string]: unknown;
+};
+export type PackConfigOutcome = {
+    readonly kind: 'ok';
+    readonly config: PackConfigRecord;
+} | {
+    readonly kind: 'missing';
+    readonly message: string;
+} | {
+    readonly kind: 'invalid';
+    readonly message: string;
+};
+export declare function loadPackConfig(ctx: Pick<CommandContext, 'buildConfigLoader'>, packDir: string): Promise<PackConfigOutcome>;
+export type DevEnvFilesOutcome = {
+    readonly kind: 'ok';
+    readonly files: readonly string[] | undefined;
+} | {
+    readonly kind: 'invalid';
+    readonly message: string;
+};
+/**
+ * `dev.envFiles` — the env files `kindgi dev` reads for the `local`
+ * environment, lowest precedence first, relative to the pack root.
+ * `undefined` when unset (the default, `.env` then `.env.local`,
+ * applies).
+ *
+ * ```ts
+ * export default {
+ *   pack: { id: 'acme.app', version: '1.0.0' },
+ *   dev: { envFiles: ['.env', '.env.development', '.env.local'] },
+ * };
+ * ```
+ */
+export declare function devEnvFiles(config: PackConfigRecord): DevEnvFilesOutcome;
+//# sourceMappingURL=pack-config.d.ts.map

package/dist/pack-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-config.d.ts","sourceRoot":"","sources":["../src/pack-config.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAC9C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,kBAAkB,CAoBxE"}

package/dist/pack-config.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The one way CLI commands load a pack's `kindgi.config.*`.
+ *
+ * Production delegates to `@kindgi/handler-runtime`'s
+ * `loadKindgiConfig` — the same loader the indexer uses, so `build`,
+ * `deploy`, `env`, `dev` and `mcp` agree with `kindgi-index` on lookup
+ * order, validation and cache-busting. Tests inject
+ * `ctx.buildConfigLoader` to hand in an in-memory config.
+ *
+ * `missing` and `invalid` are distinct so callers can treat "no config
+ * here" as non-fatal while still surfacing a broken config's cause.
+ */
+import { loadKindgiConfig } from '@kindgi/handler-runtime';
+export async function loadPackConfig(ctx, packDir) {
+    if (ctx.buildConfigLoader !== undefined) {
+        try {
+            return { kind: 'ok', config: await ctx.buildConfigLoader(packDir) };
+        }
+        catch (err) {
+            return { kind: 'invalid', message: err.message };
+        }
+    }
+    const result = await loadKindgiConfig(packDir);
+    if (result.kind === 'ok')
+        return { kind: 'ok', config: result.value };
+    return result.error.code === 'config-not-found'
+        ? { kind: 'missing', message: result.error.message }
+        : { kind: 'invalid', message: result.error.message };
+}
+/**
+ * `dev.envFiles` — the env files `kindgi dev` reads for the `local`
+ * environment, lowest precedence first, relative to the pack root.
+ * `undefined` when unset (the default, `.env` then `.env.local`,
+ * applies).
+ *
+ * ```ts
+ * export default {
+ *   pack: { id: 'acme.app', version: '1.0.0' },
+ *   dev: { envFiles: ['.env', '.env.development', '.env.local'] },
+ * };
+ * ```
+ */
+export function devEnvFiles(config) {
+    const dev = config.dev;
+    if (dev === undefined)
+        return { kind: 'ok', files: undefined };
+    if (dev === null || typeof dev !== 'object' || Array.isArray(dev)) {
+        return { kind: 'invalid', message: '`dev` in kindgi.config.ts must be an object.' };
+    }
+    const files = dev.envFiles;
+    if (files === undefined)
+        return { kind: 'ok', files: undefined };
+    if (!Array.isArray(files) ||
+        files.length === 0 ||
+        !files.every((f) => typeof f === 'string' && f !== '')) {
+        return {
+            kind: 'invalid',
+            message: '`dev.envFiles` in kindgi.config.ts must be a non-empty list of file paths, lowest precedence first (e.g. [".env", ".env.local"]).',
+        };
+    }
+    return { kind: 'ok', files };
+}
+//# sourceMappingURL=pack-config.js.map

package/dist/pack-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-config.js","sourceRoot":"","sources":["../src/pack-config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAW3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAA8C,EAC9C,OAAe;IAEf,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACtE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB;QAC7C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QACpD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwB;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC/D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAI,GAA+B,CAAC,QAAQ,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACjE,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,EACnE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EACL,mIAAmI;SACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/package-manager.d.ts

@@ -0,0 +1,33 @@
+import type { PackLanguage } from '@kindgi/handler-runtime';
+export type PackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
+/**
+ * How a pack runs its bins: through its package manager, or — a Python
+ * pack, which has no npm project to install the CLI into — from `PATH`.
+ */
+export type BinRunner = PackageManager | 'path';
+export interface DetectIo {
+    readonly readFile: (path: string) => Promise<string | null>;
+    readonly exists: (path: string) => Promise<boolean>;
+}
+/**
+ * Walk up from `dir`; at each level the `packageManager` field of
+ * `package.json` wins, then a lockfile / workspace marker. A pack inside
+ * a monorepo therefore inherits the root's manager. `npm` when nothing
+ * says otherwise.
+ */
+export declare function detectPackageManager(dir: string, io?: DetectIo): Promise<PackageManager>;
+/** The pack's `BinRunner`: `path` for a Python pack, else its package manager. */
+export declare function detectBinRunner(dir: string, language: PackLanguage, io?: DetectIo): Promise<BinRunner>;
+export declare function binCommand(runner: BinRunner, bin: string, args?: readonly string[]): {
+    readonly command: string;
+    readonly args: readonly string[];
+};
+/** `binCommand` as a line to show a person. */
+export declare function binDisplay(runner: BinRunner, bin: string, args?: readonly string[]): string;
+export declare function installCommand(pm: PackageManager): string;
+/**
+ * Protocol for depending on a local directory by symlink. npm has no
+ * `link:`; its `file:` symlinks directories (npm ≥ 7).
+ */
+export declare function localLinkProtocol(pm: PackageManager): 'link:' | 'file:';
+//# sourceMappingURL=package-manager.d.ts.map

package/dist/package-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../src/package-manager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAI5D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7D;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;AAahD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAoBD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,EAAE,GAAE,QAAoB,GACvB,OAAO,CAAC,cAAc,CAAC,CAYzB;AAgBD,kFAAkF;AAClF,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,YAAY,EACtB,EAAE,GAAE,QAAoB,GACvB,OAAO,CAAC,SAAS,CAAC,CAEpB;AAaD,wBAAgB,UAAU,CACxB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAmBhE;AAED,+CAA+C;AAC/C,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAG/F;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,GAAG,OAAO,CAEvE"}

package/dist/package-manager.js

@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The package manager a project uses — so the CLI prints commands that
+ * work there, and writes launch commands (`.mcp.json`) that run the
+ * project's OWN `kindgi`: never a global install, never a registry
+ * download (`npx kindgi` without `--no` would fetch the unscoped `kindgi`
+ * package, which Kindgi does not own).
+ */
+import { readFile, stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { CLI_VERSION } from './version-info.js';
+/** Lockfile / workspace marker → manager, checked in this order per directory. */
+const MARKERS = [
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['pnpm-workspace.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['bun.lock', 'bun'],
+    ['bun.lockb', 'bun'],
+    ['package-lock.json', 'npm'],
+    ['npm-shrinkwrap.json', 'npm'],
+];
+const defaultIo = {
+    readFile: async (path) => {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    },
+    exists: async (path) => {
+        try {
+            await stat(path);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+};
+/**
+ * Walk up from `dir`; at each level the `packageManager` field of
+ * `package.json` wins, then a lockfile / workspace marker. A pack inside
+ * a monorepo therefore inherits the root's manager. `npm` when nothing
+ * says otherwise.
+ */
+export async function detectPackageManager(dir, io = defaultIo) {
+    let current = dir;
+    for (;;) {
+        const declared = parsePackageManagerField(await io.readFile(join(current, 'package.json')));
+        if (declared !== undefined)
+            return declared;
+        for (const [file, pm] of MARKERS) {
+            if (await io.exists(join(current, file)))
+                return pm;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return 'npm';
+        current = parent;
+    }
+}
+function parsePackageManagerField(raw) {
+    if (raw === null)
+        return undefined;
+    try {
+        const field = JSON.parse(raw).packageManager;
+        if (typeof field !== 'string')
+            return undefined;
+        const name = field.split('@')[0];
+        return name === 'pnpm' || name === 'npm' || name === 'yarn' || name === 'bun'
+            ? name
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The pack's `BinRunner`: `path` for a Python pack, else its package manager. */
+export async function detectBinRunner(dir, language, io = defaultIo) {
+    return language === 'python' ? 'path' : await detectPackageManager(dir, io);
+}
+/**
+ * How to run a project-local bin — resolves `node_modules/.bin` and
+ * refuses to download when the bin is missing. `path` runs the bin on
+ * `PATH` (a Python pack's globally installed CLI).
+ */
+/** `@kindgi/cli@<major.minor>` of the running CLI (`@kindgi/cli` when unknown). */
+const PUBLISHED_CLI = (() => {
+    const minor = /^(\d+)\.(\d+)\./.exec(CLI_VERSION)?.slice(1, 3).join('.');
+    return minor === undefined ? '@kindgi/cli' : `@kindgi/cli@${minor}`;
+})();
+export function binCommand(runner, bin, args = []) {
+    switch (runner) {
+        case 'pnpm':
+            return { command: 'pnpm', args: ['exec', bin, ...args] };
+        case 'npm':
+            return { command: 'npx', args: ['--no', bin, ...args] };
+        case 'yarn':
+            return { command: 'yarn', args: [bin, ...args] };
+        case 'bun':
+            return { command: 'bun', args: ['run', bin, ...args] };
+        case 'path':
+            // No npm project to install the CLI into (a Python pack): the published
+            // CLI through npx, within this CLI's minor (as Python packs pin
+            // `kindgi>=0.1,<0.2`). `--yes`, so no install prompt stalls a person
+            // or a coding agent.
+            return bin === 'kindgi'
+                ? { command: 'npx', args: ['--yes', PUBLISHED_CLI, ...args] }
+                : { command: bin, args: [...args] };
+    }
+}
+/** `binCommand` as a line to show a person. */
+export function binDisplay(runner, bin, args = []) {
+    const c = binCommand(runner, bin, args);
+    return [c.command, ...c.args].join(' ');
+}
+export function installCommand(pm) {
+    return `${pm} install`;
+}
+/**
+ * Protocol for depending on a local directory by symlink. npm has no
+ * `link:`; its `file:` symlinks directories (npm ≥ 7).
+ */
+export function localLinkProtocol(pm) {
+    return pm === 'npm' ? 'file:' : 'link:';
+}
+//# sourceMappingURL=package-manager.js.map

package/dist/package-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.js","sourceRoot":"","sources":["../src/package-manager.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAUhD,kFAAkF;AAClF,MAAM,OAAO,GAAmD;IAC9D,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAC/B,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,mBAAmB,EAAE,KAAK,CAAC;IAC5B,CAAC,qBAAqB,EAAE,KAAK,CAAC;CAC/B,CAAC;AAOF,MAAM,SAAS,GAAa;IAC1B,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,KAAe,SAAS;IAExB,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAkB;IAClD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkC,CAAC,cAAc,CAAC;QAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK;YAC3E,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,QAAsB,EACtB,KAAe,SAAS;IAExB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,mFAAmF;AACnF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,KAAK,EAAE,CAAC;AACtE,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,UAAU,UAAU,CACxB,MAAiB,EACjB,GAAW,EACX,OAA0B,EAAE;IAE5B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3D,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM;YACT,wEAAwE;YACxE,gEAAgE;YAChE,qEAAqE;YACrE,qBAAqB;YACrB,OAAO,GAAG,KAAK,QAAQ;gBACrB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,EAAE;gBAC7D,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,GAAW,EAAE,OAA0B,EAAE;IACrF,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAkB;IAC/C,OAAO,GAAG,EAAE,UAAU,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAkB;IAClD,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1C,CAAC"}

package/dist/parse.d.ts

@@ -0,0 +1,88 @@
+import type { OutputFormat } from './output.js';
+/**
+ * Global flags recognised on every command. Kept small on purpose —
+ * per-command flags are declared in each command's handler and merged
+ * on parse.
+ */
+export declare const GLOBAL_OPTION_SPEC: {
+    readonly url: {
+        readonly type: "string";
+        readonly description: "The Kindgi API's URL. Overrides `KINDGI_API_URL` and the config files.";
+    };
+    readonly token: {
+        readonly type: "string";
+        readonly description: "The API token. Overrides `KINDGI_API_TOKEN` and the config files.";
+    };
+    readonly verbose: {
+        readonly type: "boolean";
+        readonly short: "v";
+        readonly description: "Show more detail when a command fails.";
+    };
+    readonly help: {
+        readonly type: "boolean";
+        readonly short: "h";
+        readonly description: "Show help.";
+    };
+    readonly version: {
+        readonly type: "boolean";
+        readonly description: "Print the CLI's version.";
+    };
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Output pretty-printed JSON (the default).";
+    };
+    readonly table: {
+        readonly type: "boolean";
+        readonly description: "Output a table, for commands that list.";
+    };
+    readonly raw: {
+        readonly type: "boolean";
+        readonly description: "Output compact, one-line JSON.";
+    };
+    readonly quiet: {
+        readonly type: "boolean";
+        readonly description: "Print nothing: the exit code alone reports the result.";
+    };
+};
+export interface GlobalFlags {
+    readonly url?: string;
+    readonly token?: string;
+    readonly verbose: boolean;
+    readonly help: boolean;
+    readonly version: boolean;
+    readonly format: OutputFormat;
+    /**
+     * The caller named the format (`--json`, `--table`, `--raw` or
+     * `--quiet`); `false` when `format` is the default. A command whose
+     * output is for people (`kindgi dev`) prints JSON only when asked.
+     */
+    readonly formatRequested: boolean;
+}
+export interface CommandParse {
+    readonly globals: GlobalFlags;
+    readonly positionals: readonly string[];
+    readonly options: Readonly<Record<string, string | boolean | undefined>>;
+}
+/**
+ * Parse a token vector against a merged option spec (globals + the
+ * command's own options). `parseArgs` is used with `allowPositionals:
+ * true` and `strict: true`; unknown flags fail loudly.
+ */
+export declare function parseCommand(tokens: readonly string[], extraOptionSpec?: Readonly<Record<string, ParseArgsOption>>): CommandParse;
+type ParseArgsOption = {
+    type: 'string';
+    multiple?: boolean;
+    short?: string;
+    default?: string;
+    /** See `commands/types.ts`. */
+    optionalValue?: boolean;
+    description?: string;
+} | {
+    type: 'boolean';
+    multiple?: boolean;
+    short?: string;
+    default?: boolean;
+    description?: string;
+};
+export {};
+//# sourceMappingURL=parse.d.ts.map