@kindgi/cli 0.1.0 → 0.1.2

package/dist/sdk-skills/kindgi-authoring-guardrails/SKILL.md

@@ -15,8 +15,8 @@ description: >
   kindgi-authoring-agents.
 type: core
 library: "@kindgi/sdk"
-version: "0.3.5"
-sdk_version: "0.1.0"
+version: "0.3.6"
+sdk_version: "0.1.2"
 pack_languages: [node]
 sources:
   - packages/guardrails/src/types.ts
@@ -107,11 +107,17 @@ How the pack tooling reads this file:
   `configZod`, `configSchema` or `configJsonSchema`, or a top-level
   `configZod` / `configSchema`), and the declaration's `config` — what
   the check runs with. It does not record `description`, `budget` or
-  `judgeCapabilities`.
+  `judgeCapabilities`. It checks `config` (none counts as `{}`) against
+  the config schema: a config that doesn't fit, or a required field with
+  no default left out, is a file error naming where, and `kindgi build`
+  refuses the pack.
 - The **pack service** loads the same module to run the check. It uses
   the module's `evaluate` export, or the `default` / `check` export when
   that is a function or has an `evaluate` method — here, the named
-  `check` export.
+  `check` export. A `defineCheck` check's `evaluate` gets the config its
+  schema resolves: the schema's defaults applied (a guardrail that
+  declares no config gets them all), and a config that doesn't fit
+  refused, naming where.
 
 ## Validating a declaration in-process
 
@@ -167,7 +173,10 @@ available to the runtime that evaluates it.
 - **`config`** — the check's parameters, validated against the check's
   `configSchema` by `defineGuardrail`. In a pack, the declaration's
   `config` goes into the index and the check runs with it; without one
-  it runs with `{}`. `evaluate` receives the config as declared —
+  it runs with `{}`. A declaration a pack file default-exports isn't run
+  through `defineGuardrail`, so nothing validates its `config`: keep it
+  valid against the schema yourself. `evaluate` receives the config as
+  declared —
   schema defaults are not filled in — so handle absent optional fields.
 - **`action.on-violation`** — `'halt'`, `'retry'` (with
   `retry.maxAttempts`, 1–10), `'escalate'` (with `escalateTo`),
@@ -177,7 +186,9 @@ available to the runtime that evaluates it.
   any other action are reported in `AgentTurnResult.violations` and the
   turn completes. The action handlers in `@kindgi/guardrails`
   (`retryHandler`, `escalateHandler`, `compensateHandler`, …) record the
-  intent for callers that act on it.
+  intent for callers that act on it. In 0.1 the runtime acts only on
+  `halt`: `retry`, `escalate` and `compensate` are recorded on the
+  violation, with no second attempt, escalation or compensating call.
 - **`severity`** — `'info'` / `'warn'` / `'error'` (the default) /
   `'critical'`. Orthogonal to `action`: logs and dashboards group by
   severity; execution follows the action. A `log-only` guardrail can
@@ -236,8 +247,9 @@ guardrails: ['acme.no-fabricated-quotes'],
 
 At the start of each turn, the runtime resolves these ids against the
 guardrails available to the run. An id that isn't registered fails the
-turn with `unresolved-guardrail`, so register the guardrail before an
-agent references it.
+turn before the model is called (`Error [invalid-request]: Agent "…"
+references guardrails not in the registry: <id>`), so register the
+guardrail before an agent references it.
 
 ## Changing a guardrail
 
@@ -277,7 +289,7 @@ ready for the stricter enforcement.
 - Type surface: hover any `@kindgi/sdk/define` export for full JSDoc;
   `Guardrail`, `defineGuardrail` and the built-in checks are in
   `@kindgi/guardrails`.
-- Companion docs: `pnpm --filter @kindgi/sdk exec typedoc`.
+- API reference: https://docs.kindgi.com/v0.1/reference/typescript/sdk/kindgi/sdk/define/
 - Built-in check implementations: `packages/guardrails/src/checks.ts`.
 
 ## When the framework itself is the problem

package/dist/sdk-skills/kindgi-authoring-mcp-servers/SKILL.md

@@ -18,7 +18,7 @@ description: >
 type: core
 library: "@kindgi/sdk"
 version: "0.3.0"
-sdk_version: "0.1.0"
+sdk_version: "0.1.2"
 pack_languages: [node, python]
 ---
 

package/dist/sdk-skills/kindgi-authoring-providers/SKILL.md

@@ -22,8 +22,8 @@ description: >
   kindgi-getting-started.
 type: core
 library: "@kindgi/sdk"
-version: "0.9.1"
-sdk_version: "0.1.0"
+version: "0.9.2"
+sdk_version: "0.1.2"
 pack_languages: [node, python]
 sources:
   - packages/adapters/model-anthropic/src/provider.ts
@@ -492,15 +492,12 @@ into one entry per model (`metadata.models[]`), filters the resulting
 tenant policy), then sorts survivors in this order:
 
 1. **Preferred provider / model.** Tuples matching the agent's
-   `preferredProvider` (and `preferredModel`, when the `Agent` object
-   carries one) are promoted to the front.
+   `preferredProvider` and `preferredModel` are promoted to the front.
      - Both set → promote the exact tuple.
      - Only `preferredModel` set → promote any provider exposing that model.
      - Only `preferredProvider` set → promote every model of that provider.
-   `defineAgent` accepts `preferredProvider` but not `preferredModel`
-   (`DefineAgentSpec` has no such field), so agents built with it can
-   only express a provider preference here. A Python `Agent` takes
-   both (`preferred_provider=`, `preferred_model=`).
+   `defineAgent` takes both (`preferredProvider`, `preferredModel`), and
+   so does a Python `Agent` (`preferred_provider=`, `preferred_model=`).
 2. **`capability.prefer[]` weights.** If the agent's capability
    declares `prefer: [{feature: 'thinking', weight: 3}, ...]`, tuples
    with matching model features (or provider attributes) get higher
@@ -597,7 +594,11 @@ defineAgent({
    be the FULL npm package name of the adapter — `"@kindgi/adapter-model-anthropic"`,
    NOT `"anthropic"`. Adapters are registered with the runtime under
    their full package names, and a short name matches none of them, so
-   the registration fails. Confirm valid ids with `kindgi adapters list`.
+   the registration fails. The model adapters are
+   `@kindgi/adapter-model-anthropic`, `@kindgi/adapter-model-gemini`,
+   `@kindgi/adapter-model-openai-compat` and
+   `@kindgi/adapter-model-in-process`; `kindgi providers presets` shows
+   the id each preset uses.
 
 1. **`envName` mismatch between the setter (`kindgi secrets set` or `env set`) and `provider.json`.**
    Both writers use `--env=<name>` (default `local`): `local` is the

package/dist/sdk-skills/kindgi-authoring-tools/SKILL.md

@@ -12,8 +12,8 @@ description: >
   authoring agents is covered by kindgi-authoring-agents.
 type: core
 library: "@kindgi/sdk"
-version: "0.4.1"
-sdk_version: "0.1.0"
+version: "0.4.4"
+sdk_version: "0.1.2"
 pack_languages: [node]
 sources:
   - packages/tools/src/types.ts
@@ -108,7 +108,7 @@ A handler must return a Promise; one with nothing to `await` can return `Promise
 The handler gets the **parsed** input, typed `z.infer` of `input` (Zod's output type):
 
 - **Defaults.** A `.default()` field is optional to the caller, the model included. The tool's advertised schema doesn't list it as required, and the handler always gets a value.
-- **Transforms and refinements.** `.transform()` results and `.refine()` checks apply before the handler runs. A failed refinement comes back as `input-validation-failed`, with the field's path.
+- **Transforms and refinements.** `.transform()` results and `.refine()` checks apply before the handler runs. A failed refinement comes back as `input-validation-failed`.
 - **Extra keys.** A plain `z.object` accepts them and strips them. Use `z.strictObject` to reject them.
 - **JSON-Schema-authored tools** get each property's `default` filled in the same way.
 
@@ -268,13 +268,34 @@ run start via `semver.maxSatisfying`. No implicit `:latest`.
    changes (breaking schema shape, semantic behavior), not when you
    save. See the "Iterating on a tool" section above.
 
+9. **A package a tool imports, listed only in `devDependencies`.** The
+   deployed pack installs the app's production dependencies only, so the
+   import works under `kindgi dev` and fails in the image. When a tool
+   imports a new package (an ORM client such as `@prisma/client`, an API
+   SDK), check that the app's `package.json` lists it under
+   `dependencies`. Build-time tools (the `prisma` CLI, `typescript`) stay
+   in `devDependencies`. `kindgi dev` warns as soon as a tool imports one
+   ("⚠ The pack imports @prisma/client (in kindgi/tools/…), which
+   package.json lists only in devDependencies: …"), and `kindgi build`
+   refuses the pack until it moves.
+10. **A tool that needs the app's install scripts in the image.** The
+    image installs with scripts off, so the app's `postinstall` /
+    `prepare` (`prisma generate`, husky) don't run there; `kindgi build`
+    lists them ("✓ The app's own install scripts don't run in the image:
+    …"). A tool that uses Prisma's client then fails the build ("@prisma/client
+    did not initialize yet"). Add `prisma({ schema: 'prisma/schema.prisma' })`
+    (from `@kindgi/sdk/build`; add `config: 'prisma.config.ts'` when the app
+    has one) to `image.extensions` in `kindgi.config.ts`. Other generate
+    steps: `defineBuildExtension({ name, contextFiles, postInstall: [{ bin, args }] })`.
+    Debian packages: `image.systemPackages`. Placeholder env for those steps:
+    `image.buildEnv` (never secrets).
+
 ## References
 
 - Type surface: `hover any @kindgi/sdk/define export` in your editor
   for full JSDoc — every field on `DefineToolSpec` / `ToolManifest`
   documents purpose, when to set it, and gotchas.
-- Companion docs: `pnpm --filter @kindgi/sdk exec typedoc` regenerates
-  markdown API docs at `packages/sdk/docs/`.
+- API reference: https://docs.kindgi.com/v0.1/reference/typescript/sdk/kindgi/sdk/define/ (every `define*` spec, field by field).
 - Common patterns: check the `sample` template (`kindgi init
   --template=sample`) for working examples of both authoring modes.
 

package/dist/sdk-skills/kindgi-framework-feedback/SKILL.md

@@ -15,7 +15,7 @@ description: >
 type: core
 library: "@kindgi/sdk"
 version: "0.4.0"
-sdk_version: "0.1.0"
+sdk_version: "0.1.2"
 pack_languages: [node, python]
 ---
 

package/dist/sdk-skills/kindgi-getting-started/SKILL.md

@@ -14,8 +14,8 @@ description: >
   primitive.
 type: core
 library: "@kindgi/sdk"
-version: "0.3.2"
-sdk_version: "0.1.0"
+version: "0.3.5"
+sdk_version: "0.1.2"
 pack_languages: [node]
 ---
 
@@ -70,7 +70,9 @@ pnpm install          # or the app's own package manager
 
 This adds `kindgi.config.ts` and a `kindgi/` folder beside the app's code,
 and never creates env files: `kindgi dev` reads the app's own `.env` /
-`.env.local`.
+`.env.local`. A package a tool imports must be in the app's `dependencies`,
+not `devDependencies`: the deployed pack installs production dependencies
+only (see `kindgi-authoring-tools`).
 
 Either way, `init` adds `@kindgi/sdk` and `@kindgi/cli` to the project's
 `package.json`, so the project runs the `kindgi` it pins — never a global
@@ -95,22 +97,28 @@ needs on first run), indexes the pack, registers every primitive, and
 re-registers on every save. The banner prints the API URL, the seeded
 bearer token, and (if the console is bundled) the `/console/` URL.
 
-The local runtime includes a built-in `demo.echo-agent` you can hit to
-verify the harness before authoring anything.
+Until a model provider is registered, agents answer with `dev-echo`, a
+stand-in that calls the agent's first tool with `{"message": <userMessage>}`
+and replies with what the tool returned. It checks the wiring only: it can't
+fill in any other tool input or produce a typed `output` (that turn fails
+with `output-schema-violation`). Register a provider
+(`kindgi-authoring-providers`) before building a real agent.
 
 ## First run
 
 From a second terminal, with `cd my-pack`:
 
 ```bash
-pnpm exec kindgi runs start --agent=demo.echo-agent --input='{"userMessage":"hi"}'
+pnpm exec kindgi runs start --agent=my-pack.echo-agent --input='{"userMessage":"hi"}'
 ```
 
+`my-pack.echo-agent` is the agent the `sample` template ships (`<pack-id>.echo-agent`);
+a `minimal` pack has no agent until you write one.
+
 The CLI reads `.kindgirc.json` (auto-written by `kindgi dev`) for the
 API URL + token, so second-terminal commands work without flags.
 
-Once you author your own agent, replace `demo.echo-agent` with your
-own id.
+Once you author your own agent, run it by its own id.
 
 ## Layout
 
@@ -153,6 +161,48 @@ Most of the setup is automatable, but two require your knowledge:
   registered — `kindgi providers register --preset=anthropic` with the
   key in `.env`; see `kindgi-authoring-providers`.
 
+## Your app and Kindgi's data
+
+When the app keeps something a run did (a ticket a flow triaged, an answer
+an agent gave), its own row stores the run's id, in a column such as
+`kindgi_run_id`. The app starts the run and reads the rest through the API,
+server side, with `createClient()` from `@kindgi/sdk/client`:
+
+```ts
+import { createClient } from '@kindgi/sdk/client';
+
+const kindgi = createClient(); // KINDGI_API_URL + KINDGI_API_TOKEN
+const run = await kindgi.runs.start({
+  flow: 'my-pack.triage-ticket',
+  input: { ticketId },
+  options: { wait: false }, // the run id now; run.finished tells you when it ends
+});
+// save run.id as the ticket's kindgi_run_id
+```
+
+
+- **Status, output, timing:** `kindgi.runs.get(runId)`
+  (`GET /v1/runs/{runId}`); status and timing only: `kindgi.runs.progress(runId)`.
+- **The audit, step by step:** `kindgi.runs.journal(runId)`
+  (`GET /v1/runs/{runId}/journal`).
+- **Where an agent's answer came from:** `kindgi.provenance.get(runId)`
+  (`GET /v1/provenance/{runId}`). A flow run has none of its own: each agent
+  step's `step.completed` entry in the flow's journal names its turn's run
+  (`payload.output.runId`).
+- **When a run finished:** the `run.finished` webhook (the run's id and
+  outcome, no output; then `runs.get`), not polling.
+
+Show it in the app's own UI. **Never:**
+
+- **query Kindgi's database**, even on the app's own Postgres server, and
+  never map its tables into the app's ORM. Its schema is private and changes
+  with every release (migrations only go forward), row-level security guards
+  every tenant query, and a runtime Kindgi hosts gives no database access.
+- **link users to Kindgi's console** or any Kindgi UI for this data.
+
+To keep a copy (reporting, search), pull it through the API into the app's
+own tables. Docs: https://docs.kindgi.com/v0.1/guides/runs/show-runs-in-your-app/
+
 ## References
 
 - Full CLI surface: `kindgi --help`.

package/dist/sdk-skills/kindgi-python-authoring-agents/SKILL.md

@@ -16,7 +16,7 @@ description: >
 type: core
 library: "kindgi (Python)"
 version: "0.1.0"
-sdk_version: "0.1.0"
+sdk_version: "0.1.2"
 pack_languages: [python]
 sources:
   - sdks/python/src/kindgi/pack/define.py

package/dist/sdk-skills/kindgi-python-authoring-flows/SKILL.md

@@ -16,8 +16,8 @@ description: >
   kindgi-python-authoring-agents.
 type: core
 library: "kindgi (Python)"
-version: "0.1.0"
-sdk_version: "0.1.0"
+version: "0.1.1"
+sdk_version: "0.1.2"
 pack_languages: [python]
 sources:
   - sdks/python/src/kindgi/pack/define.py
@@ -200,9 +200,11 @@ the condition is true. Conditions are dicts:
 | `and` `or` | `{"op", "children": [...]}` |
 | `not` | `{"op", "child"}` |
 
-Each operand is `{"literal": …}` or `{"path": …}`. A comparison whose
-path doesn't resolve is **false**, `ne` included. So to branch on "not
-billing", write `not` around the `eq` (as above), not `ne`. A condition
+Each operand is `{"literal": …}` or `{"path": …}`. When a path doesn't
+resolve, `eq`, `lt`, `lte`, `gt` and `gte` are false and `ne` is true. So
+for the "otherwise" branch, write `not` around the condition (as above),
+rather than a second comparison: it covers exactly what the first edge
+doesn't. A condition
 used twice is easiest as a module-level constant (`IS_BILLING`).
 
 **Joining branches.** A node with several incoming edges runs once every
@@ -227,7 +229,7 @@ A node with several incoming edges ignores them.
 Its keys are the tool's input **as it travels**: a pydantic field's name,
 or its alias if it has one (a `customer_id` field is the key
 `customer_id`; with `alias="customerId"`, it's `customerId`). Paths are
-dot-separated, with no array indexing, rooted at:
+dot-separated (a number segment indexes an array: `items.0.sku`), rooted at:
 - `runInput.…`: the input the run was started with;
 - `nodeOutputs.<nodeId>.…`: a step's output. For an agent step, add
   `.output.<field>` to read its typed answer;
@@ -289,9 +291,10 @@ the output), not on every save.
 1. **Building a flow without asking what goes in and comes out.** The
    pack's `echo_flow` proves the runtime works. It isn't a template for
    the user's flow.
-2. **`ne` on a path that may be missing, to mean "otherwise".** A missing
-   path makes every comparison false, so neither branch fires and
-   everything after is skipped. Use `not` around the positive condition.
+2. **A second comparison for "otherwise".** On a path that may be
+   missing, `eq` is false and `ne` is true, and `lt`/`gt` are both false,
+   so a hand-written opposite can miss a case or overlap. Use `not` around
+   the positive condition: it covers exactly what the first edge doesn't.
 3. **Reading an agent step's answer at `nodeOutputs.<step>.<field>`.**
    The typed answer is under `.output`: `nodeOutputs.<step>.output.<field>`.
    An agent without `output=` has only `text`.

package/dist/sdk-skills/kindgi-python-authoring-guardrails/SKILL.md

@@ -14,8 +14,8 @@ description: >
   kindgi-python-authoring-tools.
 type: core
 library: "kindgi (Python)"
-version: "0.1.0"
-sdk_version: "0.1.0"
+version: "0.1.1"
+sdk_version: "0.1.2"
 pack_languages: [python]
 sources:
   - sdks/python/src/kindgi/pack/define.py
@@ -106,7 +106,9 @@ def no_fabricated_quotes(config: Config, trace: RunTrace) -> CheckResult:
   In an agent turn a failed `halt` guardrail fails the turn
   (`guardrail-violation`) and the answer is not stored; any other action
   reports the failure in the turn result's `violations` and the turn
-  completes.
+  completes. In 0.1 the runtime acts only on `halt`: `retry`, `escalate`
+  and `compensate` are recorded on the violation, with no second attempt,
+  escalation or compensating call.
 - **`severity`** — `"info"`, `"warn"`, `"error"` (default), `"critical"`.
   Independent of the action: dashboards group by severity, execution
   follows the action.
@@ -147,8 +149,9 @@ brief_writer = Agent(..., guardrails=[no_fabricated_quotes])
 ```
 
 The `Guardrail` object (or its id). `kindgi dev` registers the pack's
-guardrails; an agent naming an id with no registered guardrail fails
-its turn (`unresolved-guardrail`).
+guardrails; an agent naming an id with no registered guardrail fails the
+turn before the model is called (`Error [invalid-request]: Agent "…"
+references guardrails not in the registry: <id>`).
 
 ## Common mistakes
 
@@ -158,8 +161,8 @@ its turn (`unresolved-guardrail`).
 2. **Snake_case keys in `config=`.** It is keyed like the wire — the
    model's aliases (`{"minLookups": 2}`), not the field names.
 3. **Both `on_violation=` and `action=`, or neither** — `DefinitionError`.
-4. **Expecting retries from `halt`.** `halt` stops the turn; use
-   `action={"on-violation": "retry", …}` for another attempt.
+4. **Expecting another attempt.** `halt` stops the turn, and in 0.1
+   `retry` doesn't run the turn again: it's only recorded.
 5. **Calling a model from the check.** Not available; keep checks pure.
 6. **Raising for a broken rule.** Return `CheckResult(passed=False,
    reason=…)`; an exception is an evaluation error, not a violation.

package/dist/sdk-skills/kindgi-python-authoring-tools/SKILL.md

@@ -14,8 +14,8 @@ description: >
   kindgi-python-getting-started.
 type: core
 library: "kindgi (Python)"
-version: "0.1.0"
-sdk_version: "0.1.0"
+version: "0.1.1"
+sdk_version: "0.1.2"
 pack_languages: [python]
 sources:
   - sdks/python/src/kindgi/pack/define.py
@@ -290,6 +290,12 @@ removed field, a narrower type — not on every save.
    and an agent's tool approval gate asks before it on first use.
 10. **`mutating=False` on a tool that writes.** A dry run then runs it
     for real.
+11. **A package a tool imports, only in a dev group.** The deployed pack
+    installs without dev dependencies (`uv sync --no-dev`, or Poetry's
+    main group only), so the import works under `kindgi dev` and fails in
+    the image. Put what tools import in `[project].dependencies` (in a
+    Poetry 1 app, `[tool.poetry.dependencies]`); test and build tools stay
+    in dev groups.
 
 ## When the framework itself is the problem
 

package/dist/sdk-skills/kindgi-python-getting-started/SKILL.md

@@ -14,8 +14,8 @@ description: >
   kindgi-python-authoring-agents; models by kindgi-authoring-providers.
 type: core
 library: "kindgi (Python)"
-version: "0.1.0"
-sdk_version: "0.1.0"
+version: "0.1.3"
+sdk_version: "0.1.2"
 pack_languages: [python]
 sources:
   - sdks/python/README.md
@@ -26,7 +26,7 @@ sources:
 # Getting started with Kindgi in Python
 
 > **Running `kindgi`:** a Python pack has no Node project, so the
-> `kindgi` CLI (a Node 22+ program) is the one on `PATH`. Python
+> `kindgi` CLI (a Node 22.12+ program) is the one on `PATH`. Python
 > commands run in the pack's environment: `uv run …`.
 
 ## What a pack is
@@ -90,7 +90,9 @@ name (`from acme.text import normalize`); inside `kindgi/`, import the pack's
 modules relatively. Don't add an `__init__.py` to `kindgi/` — the folder
 would then shadow the `kindgi` package. `kindgi dev` reads the app's `.env`
 / `.env.local` — keys already there reach the tools as environment
-variables.
+variables. A package a tool imports must be in the app's main dependencies,
+not a dev group: the deployed pack installs without dev dependencies (see
+`kindgi-python-authoring-tools`).
 
 ## Layout of the template
 
@@ -180,6 +182,37 @@ for event in client.runs.stream(str(run.id)):
 `AsyncKindgi` is the asyncio twin. `kindgi dev` prints the URL and the
 token; `.kindgirc.json` in the pack holds them for the CLI.
 
+## Your app and Kindgi's data
+
+When the app keeps something a run did (a ticket a flow triaged, an answer
+an agent gave), its own row stores the run's id, in a column such as
+`kindgi_run_id` (`run = client.runs.start(flow=…, input=…, options={"wait": False})`,
+then `run.id`). The app reads the rest through the API, server side, with
+`Kindgi()` from `kindgi.client`:
+
+- **Status, output, timing:** `client.runs.get(run_id)`
+  (`GET /v1/runs/{runId}`); status and timing only: `client.runs.progress(run_id)`.
+- **The audit, step by step:** `client.runs.journal(run_id).data`
+  (`GET /v1/runs/{runId}/journal`).
+- **Where an agent's answer came from:** `client.provenance.get(run_id)`
+  (`GET /v1/provenance/{runId}`). A flow run has none of its own: each agent
+  step's `step.completed` entry in the flow's journal names its turn's run
+  (`entry.payload["output"]["runId"]`).
+- **When a run finished:** the `run.finished` webhook (the run's id and
+  outcome, no output; then `runs.get`), not polling.
+
+Show it in the app's own UI. **Never:**
+
+- **query Kindgi's database**, even on the app's own Postgres server, and
+  never map its tables into the app's ORM (SQLAlchemy, Django models). Its
+  schema is private and changes with every release (migrations only go
+  forward), row-level security guards every tenant query, and a runtime
+  Kindgi hosts gives no database access.
+- **link users to Kindgi's console** or any Kindgi UI for this data.
+
+To keep a copy (reporting, search), pull it through the API into the app's
+own tables. Docs: https://docs.kindgi.com/v0.1/guides/runs/show-runs-in-your-app/
+
 ## Build an image
 
 `kindgi build --env=<name>` (an `[tool.kindgi.environments.<name>]`

package/dist/templates/minimal/package.json.tmpl

@@ -6,7 +6,7 @@
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/dist/templates/minimal/pnpm-workspace.yaml

@@ -1,6 +1,8 @@
 # pnpm 12+ reads settings from this file, not from `package.json`'s
-# `pnpm` block. `allowBuilds` grants postinstall permission to
-# specific dependencies — esbuild ships a native binary via
-# postinstall that the vitest transform pipeline depends on.
+# `pnpm` block. `allowBuilds` records, per dependency, whether pnpm runs
+# its install script (true) or skips it (false); pnpm 11+ stops an install
+# until each one has a decision. esbuild (the CLI's bundler, and vitest's
+# transform) works without its script: its native binary comes from its
+# `@esbuild/<platform>` package, so the script stays off.
 allowBuilds:
-  esbuild: true
+  esbuild: false

package/dist/templates/sample/guardrails/response-not-empty/index.ts.tmpl

@@ -7,7 +7,7 @@
 // `kind` at the top level; the runtime registers the inline check at
 // boot.
 
-import { defineCheck } from '@kindgi/sdk/define';
+import { type DefinedCheck, defineCheck } from '@kindgi/sdk/define';
 import { z } from 'zod';
 
 const ConfigSchema = z.object({
@@ -31,15 +31,23 @@ const check = defineCheck({
   },
 });
 
+// The check as the runtime registers it, typed with the SDK's
+// `DefinedCheck`. Left to inference, its type would name
+// `@kindgi/guardrails`, which the pack reaches only through
+// `@kindgi/sdk` — `tsc` then stops with TS2742 (`declaration: true`).
+type InlineCheck = Pick<DefinedCheck<typeof ConfigSchema>, 'id' | 'evaluate' | 'validateConfig'>;
+
+const inlineCheck: InlineCheck = {
+  id: check.id,
+  evaluate: check.evaluate,
+  ...(check.validateConfig !== undefined && { validateConfig: check.validateConfig }),
+};
+
 const guardrail = {
   id: '{{PACK_ID}}.response-not-empty',
   name: 'Response is non-empty',
   kind: 'zero-llm' as const,
-  check: {
-    id: check.id,
-    evaluate: check.evaluate,
-    ...(check.validateConfig !== undefined && { validateConfig: check.validateConfig }),
-  },
+  check: inlineCheck,
   configSchema: check.configJsonSchema,
   action: { 'on-violation': 'halt' } as const,
   severity: 'error' as const,

package/dist/templates/sample/package.json.tmpl

@@ -6,7 +6,7 @@
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/dist/templates/sample/pnpm-workspace.yaml

@@ -1,6 +1,8 @@
 # pnpm 12+ reads settings from this file, not from `package.json`'s
-# `pnpm` block. `allowBuilds` grants postinstall permission to
-# specific dependencies — esbuild ships a native binary via
-# postinstall that the vitest transform pipeline depends on.
+# `pnpm` block. `allowBuilds` records, per dependency, whether pnpm runs
+# its install script (true) or skips it (false); pnpm 11+ stops an install
+# until each one has a decision. esbuild (the CLI's bundler, and vitest's
+# transform) works without its script: its native binary comes from its
+# `@esbuild/<platform>` package, so the script stays off.
 allowBuilds:
-  esbuild: true
+  esbuild: false

package/dist/terminal-input.d.ts

@@ -0,0 +1,17 @@
+/** A prompt whose answer isn't echoed. Tests hand in a fake. */
+export interface TtySeam {
+    /** Rejects with `PromptCancelled` when the person presses Ctrl+C (or Ctrl+D) instead. */
+    promptHidden(prompt: string): Promise<string>;
+    close(): void;
+}
+/** The person cancelled a prompt (Ctrl+C, or Ctrl+D): no answer, not an empty one. */
+export declare class PromptCancelled extends Error {
+    constructor();
+}
+/** Whether stdin is a terminal, so a hidden prompt can read from it. */
+export declare function stdinIsTty(): boolean;
+export declare function stripTrailingNewline(s: string): string;
+export declare function readStdinToEnd(): Promise<string>;
+/** The hidden prompt on the real terminal: the prompt on stderr, keystrokes from stdin. */
+export declare function realTtySeam(): TtySeam;
+//# sourceMappingURL=terminal-input.d.ts.map

package/dist/terminal-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-input.d.ts","sourceRoot":"","sources":["../src/terminal-input.ts"],"names":[],"mappings":"AAaA,gEAAgE;AAChE,MAAM,WAAW,OAAO;IACtB,yFAAyF;IACzF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,sFAAsF;AACtF,qBAAa,eAAgB,SAAQ,KAAK;;CAKzC;AAED,wEAAwE;AACxE,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAMtD;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,IAAI,OAAO,CAsDrC"}