@kindgi/cli 0.1.5 → 0.1.6-rc.0

package/dist/dev/runners.d.ts

@@ -9,6 +9,7 @@
 import type { PackServiceSupervisor, PackServiceSupervisorEvent } from '@kindgi/handler-runtime/pack-service';
 import type { ProjectDatabases } from './project-database.js';
 import type { ProjectOutcome } from './project.js';
+import type { ActiveDevSandbox, SandboxAvailability } from './sandbox/index.js';
 import type { JvmPackCode, PackCode } from './pack-code.js';
 /** The running Kindgi runtime `kindgi dev` talks to. */
 export interface RunningApiServer {
@@ -140,6 +141,13 @@ export interface IndexerRunOptions {
      * line as it comes; not the indexer's own result line.
      */
     readonly onOutput?: (line: string, stream: 'stdout' | 'stderr') => void;
+    /**
+     * The sandbox the indexer child runs in (`dev/sandbox`): it imports every
+     * primitive's module, so it runs the pack's code too. Absent, none.
+     */
+    readonly sandbox?: ActiveDevSandbox;
+    /** A notice for the user from starting the indexer in its sandbox. */
+    readonly onNotice?: (line: string) => void;
 }
 /** The local pack service `kindgi dev` runs the pack's code in. */
 export interface DevPackServiceOptions {
@@ -158,6 +166,10 @@ export interface DevPackServiceOptions {
      */
     readonly port?: number;
     readonly token?: string;
+    /** The sandbox the pack service runs in (`dev/sandbox`); absent, none. */
+    readonly sandbox?: ActiveDevSandbox;
+    /** A notice for the user from starting the pack service (the sandbox's). */
+    readonly onNotice?: (line: string) => void;
 }
 /**
  * The local pack service: the public supervisor, children behind a
@@ -196,6 +208,16 @@ export interface IndexOutcome {
         readonly message: string;
         readonly filePath?: string;
     }[];
+    /**
+     * What the pack should change but that doesn't stop the build (for
+     * example a check id without the pack's prefix). Absent from an indexer
+     * that reports none.
+     */
+    readonly warnings?: readonly {
+        readonly code: string;
+        readonly message: string;
+        readonly filePath?: string;
+    }[];
     /**
      * The parsed `index.json` payload — passed straight to the
      * registration bridge. Kept as `unknown` because the CLI does not
@@ -291,6 +313,8 @@ export interface DevRunners {
     }) => PackBuilder;
     /** The local pack service (not yet started). */
     readonly createPackService: (opts: DevPackServiceOptions) => DevPackService;
+    /** Whether this machine can sandbox the pack service, and with what (`dev/sandbox/detect.ts`). */
+    readonly detectSandbox: () => Promise<SandboxAvailability>;
     /**
      * Check a Python pack's interpreter can run pack code (`import kindgi`),
      * with the pack's environment: a one-line description, or why not.

package/dist/dev/runners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/dev/runners.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5D,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,iHAAiH;IACjH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,kHAAkH;IAClH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACrE,gDAAgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,0FAA0F;IAC1F,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;CACzE;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,QAAQ,CAAC;IAClD,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,kGAAkG;QAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,mFAAmF;QACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC/D,KAAK,WAAW,CAAC;IAClB,gDAAgD;IAChD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,cAAc,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EACtC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CACR;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,CACrB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CACR;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,IAAI,EACpB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,gEAAgE;QAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;KACnD,KACE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B;;;;;;;;;;;;;;;;OAgBG;IACH;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;KAC9B,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IACrC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D"}
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/dev/runners.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5D,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,iHAAiH;IACjH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,kHAAkH;IAClH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACrE,gDAAgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,0FAA0F;IAC1F,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,QAAQ,CAAC;IAClD,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACxB,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,kGAAkG;QAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,mFAAmF;QACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC/D,KAAK,WAAW,CAAC;IAClB,gDAAgD;IAChD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,cAAc,CAAC;IAC5E,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3D;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EACtC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CACR;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,CACrB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CACR;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,CAClB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,IAAI,EACpB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,gEAAgE;QAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;KACnD,KACE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B;;;;;;;;;;;;;;;;OAgBG;IACH;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;KAC9B,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IACrC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D"}

package/dist/dev/runtime-image.d.ts

@@ -9,7 +9,7 @@
  * The image is in private preview on Quay (pull credentials on request at
  * contact@kindgi.com, then `kindgi auth registry --username <name>`).
  */
-export declare const DEFAULT_RUNTIME_IMAGE = "quay.io/kindgi/runtime:0.1.5@sha256:aca8b5219584c82622d6544d9088633affbba4713dc763529fe530c64cc47eb0";
+export declare const DEFAULT_RUNTIME_IMAGE = "quay.io/kindgi/runtime:0.1.6-rc.0@sha256:fac3374f8f8aefac5eb91e0ab9d95bd93966cb632a3faec2557b916a63ff9c6c";
 /**
  * The registry an image reference is pulled from, read the way Docker
  * reads it: the first path component when it names a host (it has a `.`

package/dist/dev/runtime-image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-image.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,yGACsE,CAAC;AAKzG;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,QAAoC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvE"}
+{"version":3,"file":"runtime-image.d.ts","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,8GAC2E,CAAC;AAK9G;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,QAAoC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvE"}

package/dist/dev/runtime-image.js

@@ -11,7 +11,7 @@
  * The image is in private preview on Quay (pull credentials on request at
  * contact@kindgi.com, then `kindgi auth registry --username <name>`).
  */
-export const DEFAULT_RUNTIME_IMAGE = 'quay.io/kindgi/runtime:0.1.5@sha256:aca8b5219584c82622d6544d9088633affbba4713dc763529fe530c64cc47eb0';
+export const DEFAULT_RUNTIME_IMAGE = 'quay.io/kindgi/runtime:0.1.6-rc.0@sha256:fac3374f8f8aefac5eb91e0ab9d95bd93966cb632a3faec2557b916a63ff9c6c';
 /** Docker Hub, the registry of a reference that names none (`busybox`, `library/busybox`). */
 const DOCKER_HUB = 'docker.io';
 /**

package/dist/dev/runtime-image.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-image.js","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,sGAAsG,CAAC;AAEzG,8FAA8F;AAC9F,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAClG,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,sDAAsD;IACtD,OAAO,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC"}
+{"version":3,"file":"runtime-image.js","sourceRoot":"","sources":["../../src/dev/runtime-image.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,2GAA2G,CAAC;AAE9G,8FAA8F;AAC9F,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAClG,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,sDAAsD;IACtD,OAAO,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC"}

package/dist/dev/sandbox/bwrap.d.ts

@@ -0,0 +1,19 @@
+import type { SandboxPolicy } from './policy.js';
+export interface AppSecrets {
+    readonly files: readonly string[];
+    readonly dirs: readonly string[];
+    /** The search stopped at {@link MAX_ENTRIES}: secrets further down aren't masked. */
+    readonly truncated: boolean;
+}
+/** The secret files and folders in the app, as they are now. Symlinks aren't followed. */
+export declare function appSecrets(app: string): Promise<AppSecrets>;
+/** bwrap's arguments for the policy, before `--` and the command. */
+export declare function bwrapArgs(policy: SandboxPolicy, secrets: AppSecrets): string[];
+/**
+ * Runs bwrap with its arguments and forwards TERM and INT to the
+ * sandboxed process (bwrap reports its PID on `--info-fd`).
+ *
+ *   sh kindgi-dev-sandbox <bwrap args…> -- <command…>
+ */
+export declare const BWRAP_WRAPPER = "#!/bin/sh\n# kindgi-dev-sandbox: written by kindgi dev at every start. Do not edit.\n# Runs the pack service in bwrap and forwards TERM and INT to it: bwrap\n# doesn't, and a reload must let the old service drain.\nset -u\ninfo=$(mktemp \"${TMPDIR:-/tmp}/kindgi-dev-sandbox.XXXXXX\")\nbwrap --info-fd 3 \"$@\" 3>\"$info\" &\nbw=$!\nforward() {\n  child=$(sed -n 's/.*\"child-pid\": *\\([0-9][0-9]*\\).*/\\1/p' \"$info\")\n  if [ -n \"$child\" ]; then kill \"-$1\" \"$child\" 2>/dev/null; else kill \"-$1\" \"$bw\" 2>/dev/null; fi\n}\ntrap 'forward TERM' TERM\ntrap 'forward INT' INT\nstatus=0\nwhile :; do\n  wait \"$bw\"\n  status=$?\n  kill -0 \"$bw\" 2>/dev/null || break\ndone\nrm -f \"$info\"\nexit \"$status\"\n";
+//# sourceMappingURL=bwrap.d.ts.map

package/dist/dev/sandbox/bwrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bwrap.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/bwrap.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmBjD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,0FAA0F;AAC1F,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAejE;AAqBD,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,CA6B9E;AAgBD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,ktBAsBzB,CAAC"}

package/dist/dev/sandbox/bwrap.js

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The pack service's bubblewrap sandbox on Linux.
+ *
+ * The root is bound read-only; the home folder, `/tmp`, `/var/tmp` and
+ * `/run` are replaced by empty tmpfs (keys, cloud credentials, the Docker
+ * socket, agents' sockets, other tools' temp files all gone); the runtime
+ * and the dependencies are bound back read-only, the app read-write.
+ * bwrap can't match names, so the secrets inside the app are found at
+ * every start and masked one by one (`.env*` and the like with
+ * `/dev/null`, `.git` and other `.kindgi` folders with an empty tmpfs;
+ * this app's `.kindgi` with a tmpfs and its dev outputs bound back). The
+ * service keeps the host's network (an outbound call, its loopback
+ * listener) and gets its own PID namespace, so it can't see other
+ * processes (or read their environment), and its own session, so it
+ * can't push keystrokes into the terminal `kindgi dev` runs in
+ * (`TIOCSTI`). The app's Kindgi configuration files are bound read-only
+ * (`kindgi dev` loads them, and they say how wide this is); the
+ * indexer's output folder is bound back read-write.
+ *
+ * bwrap doesn't forward signals, and its PID-namespace init ignores
+ * SIGTERM: a reload would never let the old service drain. So the service
+ * runs as PID 1 (`--as-pid-1`, it has its own handlers), started through
+ * a small `sh` wrapper ({@link BWRAP_WRAPPER}) that reads its PID from
+ * `--info-fd` and forwards TERM and INT to it.
+ */
+import { existsSync } from 'node:fs';
+import { lstat, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { devBundleMapPath, devDistDir, devIndexPath, devJvmDir, devStagedIndexPath, devStagedPackIndexPath, } from '../paths.js';
+/** File names masked wherever they are in the app. */
+const SECRET_FILE = /^(\.env.*|kindgi\.env|pack\.env|\.kindgirc\.json|\.npmrc|\.pypirc|\.netrc)$/;
+/** Folders masked whole wherever they are in the app. */
+const SECRET_DIR = /^(\.git|\.kindgi)$/;
+/** Folders not searched: dependencies and build output hold no secret of the app's. */
+const SKIPPED_DIR = new Set([
+    'node_modules',
+    '.venv',
+    'venv',
+    '__pycache__',
+    'target',
+    '.next',
+    '.turbo',
+]);
+/** How many entries the search looks at, at most. */
+const MAX_ENTRIES = 100_000;
+/** The secret files and folders in the app, as they are now. Symlinks aren't followed. */
+export async function appSecrets(app) {
+    const found = { files: [], dirs: [] };
+    let seen = 0;
+    const queue = [app];
+    while (queue.length > 0) {
+        const dir = queue.shift();
+        const entries = await readdir(dir).catch(() => []);
+        seen += entries.length;
+        if (seen > MAX_ENTRIES)
+            return { ...found, truncated: true };
+        for (const name of entries) {
+            const next = await classify(join(dir, name), name, found);
+            if (next !== undefined)
+                queue.push(next);
+        }
+    }
+    return { ...found, truncated: false };
+}
+/** Records a secret; returns a folder to search next. */
+async function classify(path, name, found) {
+    const info = await lstat(path).catch(() => undefined);
+    if (info === undefined || info.isSymbolicLink())
+        return undefined;
+    if (!info.isDirectory()) {
+        if (SECRET_FILE.test(name))
+            found.files.push(path);
+        return undefined;
+    }
+    if (SECRET_DIR.test(name)) {
+        found.dirs.push(path);
+        return undefined;
+    }
+    return SKIPPED_DIR.has(name) ? undefined : path;
+}
+/** bwrap's arguments for the policy, before `--` and the command. */
+export function bwrapArgs(policy, secrets) {
+    const { app, home } = policy;
+    const args = [
+        '--die-with-parent',
+        '--new-session',
+        '--unshare-pid',
+        '--as-pid-1',
+        '--unshare-ipc',
+    ];
+    args.push('--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc');
+    args.push('--tmpfs', home, '--tmpfs', '/tmp', '--tmpfs', '/var/tmp', '--tmpfs', '/run');
+    // DNS on a systemd-resolved host: resolv.conf points into /run.
+    const resolved = '/run/systemd/resolve';
+    const sockets = policy.allowUnixSockets.filter((s) => existsSync(s));
+    if (existsSync(resolved))
+        args.push('--ro-bind', resolved, resolved);
+    for (const socket of sockets)
+        args.push('--bind', socket, socket);
+    for (const root of policy.readRoots)
+        args.push('--ro-bind', root, root);
+    // The links what it runs resolves through, where a tmpfs took them away (the home folder).
+    for (const link of policy.links)
+        args.push('--symlink', link.target, link.path);
+    args.push('--bind', app, app);
+    for (const file of secrets.files)
+        args.push('--ro-bind', '/dev/null', file);
+    for (const dir of secrets.dirs)
+        args.push('--tmpfs', dir);
+    if (secrets.dirs.includes(join(app, '.kindgi')))
+        args.push(...devOutputBinds(app));
+    for (const dir of policy.writable.filter((d) => existsSync(d)))
+        args.push('--bind', dir, dir);
+    // A missing name can't be bound without creating it in the app: those stay writable here.
+    for (const file of policy.readOnly.filter((f) => existsSync(f)))
+        args.push('--ro-bind', file, file);
+    args.push('--chdir', app, '--setenv', 'TMPDIR', '/tmp');
+    return args;
+}
+/** The dev outputs the service runs, bound back over this app's masked `.kindgi`. */
+function devOutputBinds(app) {
+    const outputs = [
+        devDistDir(app),
+        devJvmDir(app, 'java'),
+        devJvmDir(app, 'scala'),
+        devIndexPath(app),
+        devStagedIndexPath(app),
+        devStagedPackIndexPath(app),
+        devBundleMapPath(app),
+    ];
+    return outputs.filter((p) => existsSync(p)).flatMap((p) => ['--ro-bind', p, p]);
+}
+/**
+ * Runs bwrap with its arguments and forwards TERM and INT to the
+ * sandboxed process (bwrap reports its PID on `--info-fd`).
+ *
+ *   sh kindgi-dev-sandbox <bwrap args…> -- <command…>
+ */
+export const BWRAP_WRAPPER = `#!/bin/sh
+# kindgi-dev-sandbox: written by kindgi dev at every start. Do not edit.
+# Runs the pack service in bwrap and forwards TERM and INT to it: bwrap
+# doesn't, and a reload must let the old service drain.
+set -u
+info=$(mktemp "\${TMPDIR:-/tmp}/kindgi-dev-sandbox.XXXXXX")
+bwrap --info-fd 3 "$@" 3>"$info" &
+bw=$!
+forward() {
+  child=$(sed -n 's/.*"child-pid": *\\([0-9][0-9]*\\).*/\\1/p' "$info")
+  if [ -n "$child" ]; then kill "-$1" "$child" 2>/dev/null; else kill "-$1" "$bw" 2>/dev/null; fi
+}
+trap 'forward TERM' TERM
+trap 'forward INT' INT
+status=0
+while :; do
+  wait "$bw"
+  status=$?
+  kill -0 "$bw" 2>/dev/null || break
+done
+rm -f "$info"
+exit "$status"
+`;
+//# sourceMappingURL=bwrap.js.map

package/dist/dev/sandbox/bwrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bwrap.js","sourceRoot":"","sources":["../../../src/dev/sandbox/bwrap.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,sDAAsD;AACtD,MAAM,WAAW,GAAG,6EAA6E,CAAC;AAClG,yDAAyD;AACzD,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,uFAAuF;AACvF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,cAAc;IACd,OAAO;IACP,MAAM;IACN,aAAa;IACb,QAAQ;IACR,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AACH,qDAAqD;AACrD,MAAM,WAAW,GAAG,OAAO,CAAC;AAS5B,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,EAAc,EAAE,IAAI,EAAE,EAAc,EAAE,CAAC;IAC9D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;QAC/D,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;QACvB,IAAI,IAAI,GAAG,WAAW;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1D,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,IAAY,EACZ,KAA0C;IAE1C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,MAAqB,EAAE,OAAmB;IAClE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7B,MAAM,IAAI,GAAG;QACX,mBAAmB;QACnB,eAAe;QACf,eAAe;QACf,YAAY;QACZ,eAAe;KAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxF,gEAAgE;IAChE,MAAM,QAAQ,GAAG,sBAAsB,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,2FAA2F;IAC3F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC5E,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9F,0FAA0F;IAC1F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG;QACd,UAAU,CAAC,GAAG,CAAC;QACf,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC;QACvB,YAAY,CAAC,GAAG,CAAC;QACjB,kBAAkB,CAAC,GAAG,CAAC;QACvB,sBAAsB,CAAC,GAAG,CAAC;QAC3B,gBAAgB,CAAC,GAAG,CAAC;KACtB,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsB5B,CAAC"}

package/dist/dev/sandbox/detect.d.ts

@@ -0,0 +1,26 @@
+/** The page that says how to set the sandbox up, and what it does, on this CLI's release line. */
+export declare const DEV_SANDBOX_DOCS: string;
+export type SandboxEngine = 'seatbelt' | 'bwrap';
+export type SandboxAvailability = {
+    readonly kind: 'available';
+    readonly engine: SandboxEngine;
+} | {
+    readonly kind: 'unavailable';
+    /** Why, in a phrase: "bubblewrap (bwrap) isn't installed". */
+    readonly reason: string;
+    /** What would make it work, in a sentence. */
+    readonly fix: string;
+};
+/** A finished process: its exit code (`null` when it didn't start) and stderr. */
+export interface ProbeResult {
+    readonly code: number | null;
+    readonly stderr: string;
+    /** The spawn error's code when it didn't start (`ENOENT`). */
+    readonly errorCode?: string;
+}
+export type ProbeRunner = (program: string, args: readonly string[]) => Promise<ProbeResult>;
+export declare const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+/** Run a probe to its end: its exit code and stderr, or why it didn't start. */
+export declare function probeReal(program: string, args: readonly string[]): Promise<ProbeResult>;
+export declare function detectDevSandbox(platform: NodeJS.Platform, run: ProbeRunner): Promise<SandboxAvailability>;
+//# sourceMappingURL=detect.d.ts.map

package/dist/dev/sandbox/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/detect.ts"],"names":[],"mappings":"AAyBA,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,QAAsD,CAAC;AAEpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC9D;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE7F,eAAO,MAAM,YAAY,0BAA0B,CAAC;AAEpD,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAgBxF;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,mBAAmB,CAAC,CAe9B"}

package/dist/dev/sandbox/detect.js

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Whether this machine can sandbox the pack service, and with what:
+ * macOS's Seatbelt (`sandbox-exec`), or Linux's bubblewrap (`bwrap`,
+ * the system's). Each is tried once with an empty policy, so the answer
+ * is what happens, not a guess:
+ *
+ * - `sandbox-exec` refuses inside a process that is already sandboxed by a
+ *   profile that restricts anything (`sandbox_apply: Operation not
+ *   permitted`): a coding agent's sandbox around `kindgi dev`.
+ * - `bwrap` needs unprivileged user namespaces. Ubuntu 23.10 and later
+ *   restrict them with AppArmor (`setting up uid map: Permission
+ *   denied`); a default Docker container doesn't allow them (`Creating
+ *   new namespace failed: Operation not permitted`).
+ * - Windows has none `kindgi dev` can use: under WSL, the Linux one.
+ */
+import { spawn } from 'node:child_process';
+import { docsUrl } from '@kindgi/client/sso-handoff';
+import { CLI_VERSION } from '../../version-info.js';
+/** The page that says how to set the sandbox up, and what it does, on this CLI's release line. */
+export const DEV_SANDBOX_DOCS = docsUrl('guides/secrets/dev-sandbox/', CLI_VERSION);
+export const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+/** Run a probe to its end: its exit code and stderr, or why it didn't start. */
+export function probeReal(program, args) {
+    return new Promise((resolve) => {
+        const child = spawn(program, [...args], { stdio: ['ignore', 'ignore', 'pipe'] });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk.toString('utf8');
+        });
+        child.once('error', (err) => resolve({
+            code: null,
+            stderr: err.message,
+            ...(err.code !== undefined && { errorCode: err.code }),
+        }));
+        child.once('close', (code) => resolve({ code, stderr }));
+    });
+}
+export async function detectDevSandbox(platform, run) {
+    if (platform === 'darwin') {
+        return seatbeltAvailability(await run(SANDBOX_EXEC, ['-p', '(version 1)(allow default)', '/usr/bin/true']));
+    }
+    if (platform === 'linux')
+        return bwrapAvailability(await run('bwrap', ['--ro-bind', '/', '/', 'true']));
+    if (platform === 'win32') {
+        return unavailable('Windows has no sandbox kindgi dev can use', 'Run kindgi dev under WSL, where it uses the Linux one.');
+    }
+    return unavailable(`kindgi dev has no sandbox for ${platform}`, `See ${DEV_SANDBOX_DOCS}.`);
+}
+function unavailable(reason, fix) {
+    return { kind: 'unavailable', reason, fix };
+}
+/** What an empty `sandbox-exec` profile run says. */
+function seatbeltAvailability(probe) {
+    if (probe.code === 0)
+        return { kind: 'available', engine: 'seatbelt' };
+    if (probe.errorCode === 'ENOENT') {
+        return unavailable(`${SANDBOX_EXEC} isn't on this Mac`, `See ${DEV_SANDBOX_DOCS}.`);
+    }
+    if (/sandbox_apply/i.test(probe.stderr)) {
+        return unavailable('kindgi dev is already inside a sandbox (a coding agent’s?) that won’t let it add its own', 'Run kindgi dev in your own terminal.');
+    }
+    return unavailable(`sandbox-exec failed: ${firstLine(probe.stderr)}`, `See ${DEV_SANDBOX_DOCS}.`);
+}
+/** What an empty `bwrap` run says. */
+function bwrapAvailability(probe) {
+    if (probe.code === 0)
+        return { kind: 'available', engine: 'bwrap' };
+    if (probe.errorCode === 'ENOENT') {
+        return unavailable("bubblewrap (bwrap) isn't installed", 'Install bubblewrap (Debian, Ubuntu: sudo apt-get install bubblewrap; Fedora: sudo dnf install bubblewrap).');
+    }
+    if (/uid map|setting up uid/i.test(probe.stderr)) {
+        return unavailable('this system blocks the user namespaces bwrap needs (Ubuntu 23.10 and later)', `Allow bwrap to use them: ${DEV_SANDBOX_DOCS}#where-it-runs.`);
+    }
+    if (/new namespace|namespace failed|No permissions to create/i.test(probe.stderr)) {
+        return unavailable("this system doesn't allow user namespaces (a container, or a kernel setting)", `In a container, the container is the boundary; elsewhere see ${DEV_SANDBOX_DOCS}#where-it-runs.`);
+    }
+    return unavailable(`bwrap failed: ${firstLine(probe.stderr)}`, `See ${DEV_SANDBOX_DOCS}#where-it-runs.`);
+}
+function firstLine(text) {
+    return text.trim().split('\n')[0]?.trim() || 'no message';
+}
+//# sourceMappingURL=detect.js.map

package/dist/dev/sandbox/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../../src/dev/sandbox/detect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAC;AAwBpF,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAEpD,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAuB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE,CACjD,OAAO,CAAC;YACN,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;SACvD,CAAC,CACH,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAyB,EACzB,GAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,oBAAoB,CACzB,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,4BAA4B,EAAE,eAAe,CAAC,CAAC,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QACtB,OAAO,iBAAiB,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,WAAW,CAChB,2CAA2C,EAC3C,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,iCAAiC,QAAQ,EAAE,EAAE,OAAO,gBAAgB,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW;IAC9C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED,qDAAqD;AACrD,SAAS,oBAAoB,CAAC,KAAkB;IAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,WAAW,CAAC,GAAG,YAAY,oBAAoB,EAAE,OAAO,gBAAgB,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,WAAW,CAChB,0FAA0F,EAC1F,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,wBAAwB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,gBAAgB,GAAG,CAAC,CAAC;AACpG,CAAC;AAED,sCAAsC;AACtC,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,WAAW,CAChB,oCAAoC,EACpC,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO,WAAW,CAChB,6EAA6E,EAC7E,4BAA4B,gBAAgB,iBAAiB,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,OAAO,WAAW,CAChB,8EAA8E,EAC9E,gEAAgE,gBAAgB,iBAAiB,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAChB,iBAAiB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAC1C,OAAO,gBAAgB,iBAAiB,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;AAC5D,CAAC"}

package/dist/dev/sandbox/index.d.ts

@@ -0,0 +1,44 @@
+import type { PackCode } from '../pack-code.js';
+import { type SandboxEngine } from './detect.js';
+import { type SandboxPolicy } from './policy.js';
+import type { DevSandboxSettings } from './settings.js';
+export { DEV_SANDBOX_DOCS, type SandboxAvailability, type SandboxEngine, detectDevSandbox, } from './detect.js';
+export { DEV_SANDBOX_VAR, type DevSandboxMode, type DevSandboxSettings, devSandboxSettings, } from './settings.js';
+/** The sandbox this `kindgi dev` runs the pack service in. */
+export interface ActiveDevSandbox {
+    readonly engine: SandboxEngine;
+    readonly settings: DevSandboxSettings;
+    /** The home folder it closes. */
+    readonly home: string;
+}
+/** What the sandbox calls itself in `kindgi dev`'s output. */
+export declare function sandboxLabel(engine: SandboxEngine): string;
+/** The pack service's own temp folder on macOS: one per app, under the user's temp folder. */
+export declare function sandboxTmpDir(packDir: string): string;
+/** Which process runs inside: each gets its own profile file, so the two never share one mid-write. */
+export type SandboxedProcess = 'pack-service' | 'indexer';
+export interface SandboxedCommandOptions {
+    readonly packDir: string;
+    readonly code: PackCode;
+    /** The command, unsandboxed. */
+    readonly command: readonly [string, ...string[]];
+    /** Its environment. */
+    readonly env: Readonly<Record<string, string>>;
+    /** Node: the binary and the entrypoint (the pack service's, or the indexer child's). */
+    readonly node: {
+        readonly execPath: string;
+        readonly entry: string;
+    };
+    /** Default `pack-service`. */
+    readonly process?: SandboxedProcess;
+    /** Folders inside the app's `.kindgi` it may write (made here if missing). */
+    readonly writable?: readonly string[];
+    /** A notice for the user: a root left out because it holds the home folder, a search cut short. */
+    readonly onNotice?: (line: string) => void;
+}
+export interface SandboxedCommand {
+    readonly command: readonly [string, ...string[]];
+    readonly policy: SandboxPolicy;
+}
+export declare function sandboxedCommand(sandbox: ActiveDevSandbox, opts: SandboxedCommandOptions): Promise<SandboxedCommand>;
+//# sourceMappingURL=index.d.ts.map

package/dist/dev/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/index.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAEhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE1D;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASrD;AAED,uGAAuG;AACvG,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,uBAAuB;IACvB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,8BAA8B;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAsC3B"}

package/dist/dev/sandbox/index.js

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * `kindgi dev` runs the pack's code sandboxed, in both processes that run
+ * it: the pack service, and the indexer (which imports every primitive's
+ * module, so runs its top-level code). The tool and module code a coding
+ * agent writes can't read the user's keys, other projects, or the Docker
+ * socket, and can't write outside the app. It still reaches the network,
+ * and reads and writes the app's own files (but Kindgi's configuration).
+ * The guide: https://docs.kindgi.com/v0.1/guides/secrets/dev-sandbox/.
+ *
+ * At every start, {@link sandboxedCommand} works out what this start runs
+ * (the runtime, the dependencies: `policy.ts`), writes the sandbox for it
+ * (macOS: a Seatbelt profile; Linux: bwrap's arguments and a wrapper), and
+ * returns the command inside it.
+ */
+import { createHash } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { BWRAP_WRAPPER, appSecrets, bwrapArgs } from './bwrap.js';
+import { SANDBOX_EXEC } from './detect.js';
+import { sandboxPolicy } from './policy.js';
+import { seatbeltProfile } from './seatbelt.js';
+export { DEV_SANDBOX_DOCS, detectDevSandbox, } from './detect.js';
+export { DEV_SANDBOX_VAR, devSandboxSettings, } from './settings.js';
+/** What the sandbox calls itself in `kindgi dev`'s output. */
+export function sandboxLabel(engine) {
+    return engine === 'seatbelt' ? 'macOS Seatbelt' : 'bubblewrap';
+}
+/** The pack service's own temp folder on macOS: one per app, under the user's temp folder. */
+export function sandboxTmpDir(packDir) {
+    const hash = createHash('sha256').update(packDir).digest('hex').slice(0, 12);
+    let base = tmpdir();
+    try {
+        base = realpathSync(base);
+    }
+    catch {
+        // The real path is only for the profile's match; the folder is made below.
+    }
+    return join(base, `kindgi-dev-${hash}`);
+}
+export async function sandboxedCommand(sandbox, opts) {
+    const tmpDir = sandbox.engine === 'seatbelt' ? sandboxTmpDir(opts.packDir) : '/tmp';
+    if (sandbox.engine === 'seatbelt')
+        await mkdir(tmpDir, { recursive: true, mode: 0o700 });
+    for (const dir of opts.writable ?? [])
+        await mkdir(dir, { recursive: true });
+    const which = opts.process ?? 'pack-service';
+    const policy = await sandboxPolicy({
+        packDir: opts.packDir,
+        home: sandbox.home,
+        code: opts.code,
+        settings: sandbox.settings,
+        tmpDir,
+        env: opts.env,
+        node: opts.node,
+        ...(opts.writable !== undefined && { writable: opts.writable }),
+    });
+    for (const root of policy.skipped) {
+        opts.onNotice?.(`dev sandbox: not opening ${root}: it holds your home folder, which stays closed`);
+    }
+    const devDir = join(opts.packDir, '.kindgi', 'dev');
+    await mkdir(devDir, { recursive: true });
+    if (sandbox.engine === 'seatbelt') {
+        const profile = join(devDir, which === 'indexer' ? 'sandbox-indexer.sb' : 'sandbox.sb');
+        await writeFile(profile, seatbeltProfile(policy), { mode: 0o600 });
+        return { command: [SANDBOX_EXEC, '-f', profile, ...opts.command], policy };
+    }
+    const wrapper = join(devDir, 'kindgi-dev-sandbox');
+    await writeFile(wrapper, BWRAP_WRAPPER, { mode: 0o755 });
+    await chmod(wrapper, 0o755);
+    const secrets = await appSecrets(policy.app);
+    if (secrets.truncated) {
+        opts.onNotice?.('dev sandbox: the app is too large to search for secret files in full; files such as .env further down stay readable');
+    }
+    const args = bwrapArgs(policy, secrets);
+    return { command: ['sh', wrapper, ...args, '--', ...opts.command], policy };
+}
+//# sourceMappingURL=index.js.map

package/dist/dev/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dev/sandbox/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAsB,aAAa,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EACL,gBAAgB,EAGhB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAUvB,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;AACjE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AA2BD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,IAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;QAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CACb,4BAA4B,IAAI,iDAAiD,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACxF,MAAM,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,MAAM,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,EAAE,CACb,qHAAqH,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC"}

package/dist/dev/sandbox/notices.d.ts

@@ -0,0 +1,23 @@
+import type { PackConfigRecord } from '../../pack-config.js';
+import { type SandboxAvailability } from './detect.js';
+import { type ActiveDevSandbox } from './index.js';
+export type DevSandboxOutcome = {
+    readonly kind: 'ok';
+    /** The sandbox the pack service runs in; absent, none. */
+    readonly sandbox: ActiveDevSandbox | undefined;
+    /** What to print, in order. */
+    readonly lines: readonly string[];
+} | {
+    readonly kind: 'error';
+    readonly message: string;
+};
+export declare function resolveDevSandbox(opts: {
+    readonly config: PackConfigRecord | undefined;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly packDir: string;
+    readonly home: string;
+    readonly detect: () => Promise<SandboxAvailability>;
+}): Promise<DevSandboxOutcome>;
+/** The Kindgi configuration files in the app: `kindgi.config.*`, `kindgi.config.json`, a `pyproject.toml` with `[tool.kindgi]`. */
+export declare function kindgiConfigFiles(packDir: string): string[];
+//# sourceMappingURL=notices.d.ts.map

package/dist/dev/sandbox/notices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/notices.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,KAAK,gBAAgB,EAAgB,MAAM,YAAY,CAAC;AAGjE,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC/C,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACrD,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwD7B;AAED,mIAAmI;AACnI,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D"}