@kindgi/cli 0.1.8 → 0.1.9-rc.0

package/dist/templates/woocommerce/agents/store-agent/index.test.ts.tmpl

@@ -39,6 +39,19 @@ describe('{{PACK_ID}}.store-agent', () => {
     expect(line).toMatch(/look it up again before you say what it has been refunded/);
   });
 
+  test('each tool that waits for a person needs a reviewer other than the person who asked', () => {
+    const tools = storeAgent.conversationPolicy?.hitl?.tools;
+    const free = new Set(
+      Object.entries(tools?.overrides ?? {})
+        .filter(([, mode]) => mode === 'never_ask')
+        .map(([id]) => id),
+    );
+    const waiting = storeAgent.tools.map((t) => t.id).filter((id) => !free.has(id));
+    const fourEyes = storeAgent.conversationPolicy?.hitl?.separateApprover;
+    if (typeof fourEyes !== 'object') throw new Error('separateApprover is set per tool');
+    for (const id of waiting) expect(fourEyes.overrides?.[id], id).toBe(true);
+  });
+
   test("its instructions don't tell it to say a call waits: it never answers while one does", () => {
     const { instructions } = storeAgent;
     if (typeof instructions !== 'string') throw new Error('The instructions are a prompt reference now: check the prompt.');

package/dist/templates/woocommerce/agents/store-agent/index.ts.tmpl

@@ -11,7 +11,10 @@
 //   - a larger refund, a price change and publishing a product each wait
 //     for a reviewer, who approves or rejects it in the console's approvals
 //     inbox (or by email). The tool runs only after an approval; a
-//     rejection is recorded in the audit, and the agent says so.
+//     rejection is recorded in the audit, and the agent says so;
+//   - those three need a reviewer other than the person who asked
+//     (`separateApprover`): whoever's turn asked for a large refund can't
+//     approve it themselves.
 import { defineAgent } from '@kindgi/sdk/define';
 import type { AgentId, GuardrailId, Semver } from '@kindgi/sdk/types';
 
@@ -54,6 +57,13 @@ const defined = defineAgent({
         },
       },
       defaultReviewerRole: 'standard',
+      separateApprover: {
+        overrides: {
+          '{{PACK_ID}}.woo.refund-large': true,
+          '{{PACK_ID}}.woo.set-price': true,
+          '{{PACK_ID}}.woo.publish-product': true,
+        },
+      },
     },
   },
   // A refused call goes back to the model instead of failing the turn: when

package/dist/templates/woocommerce/tools/publish-product/index.ts.tmpl

@@ -1,6 +1,8 @@
 // {{PACK_ID}}.woo.publish-product — publish a draft product, so shoppers can
 // see it. A store change, so the agent's approval policy has a person
-// approve every call.
+// approve every call. The tool also declares it waits in a run no person
+// started, so even an agent whose policy says `never_ask` can't run it
+// there unasked.
 import { defineTool } from '@kindgi/sdk/define';
 import type { ToolId } from '@kindgi/sdk/types';
 import { z } from 'zod';
@@ -15,6 +17,10 @@ const defined = defineTool({
   output: z.object({ productId: z.number().int(), name: z.string(), status: z.string() }),
   effects: [{ kind: 'writes', resource: 'external:woocommerce' }],
   mutating: true,
+  // In a run no person started (a webhook, a schedule or a service account's
+  // key started it), every call waits for a person's yes, whatever the
+  // agent's approval policy says.
+  needsApprovalWhenUnattended: true,
   needsSpec: WOO_NEEDS,
   handler: async ({ productId }, ctx) => {
     const product = await woo<{ readonly id: number; readonly name: string; readonly status: string }>(

package/dist/templates/woocommerce/tools/refund/index.ts.tmpl

@@ -1,5 +1,6 @@
 // {{PACK_ID}}.woo.refund — a refund of up to 100 (in the order's currency) on
-// an order, with no one to approve it.
+// an order, with no one to approve it when a person asks for it. In a run a
+// webhook or a schedule started, it waits for a person's yes.
 //
 // Kindgi's approval rules key on the tool, not on its arguments, so "refunds
 // over 100 need a person" is two tools: this one, which the agent's policy
@@ -39,7 +40,7 @@ export const RefundOutput = z.object({
 
 const defined = defineTool({
   id: '{{PACK_ID}}.woo.refund' as ToolId,
-  description: `Refund up to ${REFUND_LIMIT} on an order, counting what it has been refunded already. Runs without approval. For more, use {{PACK_ID}}.woo.refund-large, which waits for a person.`,
+  description: `Refund up to ${REFUND_LIMIT} on an order, counting what it has been refunded already. Runs without approval when a person starts the turn; in a run a webhook or schedule started, it waits for a person. For more, use {{PACK_ID}}.woo.refund-large, which waits for a person.`,
   version: '{{PACK_VERSION}}',
   input: RefundInput,
   output: RefundOutput,
@@ -48,6 +49,10 @@ const defined = defineTool({
     { kind: 'external-side-effect', notes: 'Refunds money to the customer.' },
   ],
   mutating: true,
+  // In a run no person started (a webhook, a schedule or a service account's
+  // key started it), every call waits for a person's yes, whatever the
+  // agent's approval policy says.
+  needsApprovalWhenUnattended: true,
   needsSpec: REFUND_NEEDS,
   // The limit is checked after `createRefund` has looked for this call's own
   // refund: a call run again after its refund went out returns that refund,

package/dist/templates/woocommerce/tools/refund-large/index.ts.tmpl

@@ -2,8 +2,10 @@
 // agent's approval policy marks it `always_ask`: every call waits for a
 // person to approve it, and the refund happens only after they do, once:
 // the step resumed after the approval, or run again after a crash, finds the
-// refund it made (`createRefund` in `lib/woo.ts`). See
-// `{{PACK_ID}}.woo.refund` for why the store has two refund tools.
+// refund it made (`createRefund` in `lib/woo.ts`). The tool also declares
+// it waits in a run no person started, so even an agent whose policy says
+// `never_ask` can't run it there unasked. See `{{PACK_ID}}.woo.refund` for
+// why the store has two refund tools.
 import { defineTool } from '@kindgi/sdk/define';
 import type { ToolId } from '@kindgi/sdk/types';
 import { z } from 'zod';
@@ -33,6 +35,10 @@ const defined = defineTool({
     { kind: 'external-side-effect', notes: 'Refunds money to the customer.' },
   ],
   mutating: true,
+  // In a run no person started (a webhook, a schedule or a service account's
+  // key started it), every call waits for a person's yes, whatever the
+  // agent's approval policy says.
+  needsApprovalWhenUnattended: true,
   needsSpec: REFUND_NEEDS,
   handler: async (input, ctx) => createRefund(ctx, input),
 });

package/dist/templates/woocommerce/tools/set-price/index.ts.tmpl

@@ -1,5 +1,7 @@
 // {{PACK_ID}}.woo.set-price — change a product's regular price. A store
 // change, so the agent's approval policy has a person approve every call.
+// The tool also declares it waits in a run no person started, so even an
+// agent whose policy says `never_ask` can't run it there unasked.
 import { defineTool } from '@kindgi/sdk/define';
 import type { ToolId } from '@kindgi/sdk/types';
 import { z } from 'zod';
@@ -17,6 +19,10 @@ const defined = defineTool({
   output: z.object({ productId: z.number().int(), name: z.string(), regularPrice: z.string() }),
   effects: [{ kind: 'writes', resource: 'external:woocommerce' }],
   mutating: true,
+  // In a run no person started (a webhook, a schedule or a service account's
+  // key started it), every call waits for a person's yes, whatever the
+  // agent's approval policy says.
+  needsApprovalWhenUnattended: true,
   needsSpec: WOO_NEEDS,
   handler: async ({ productId, regularPrice }, ctx) => {
     const product = await woo<{ readonly id: number; readonly name: string; readonly regular_price: string }>(

package/dist/value-target.d.ts

@@ -0,0 +1,139 @@
+import type { KindgiClient } from '@kindgi/client';
+import type { CommandResult } from './commands/types.js';
+import type { CommandContext } from './context.js';
+/**
+ * What a runtime says it serves (whoami's `servedEnv`): the env its tools'
+ * values are read under, and whether it refuses values under any other.
+ */
+export interface ServedEnv {
+    readonly envName: string;
+    readonly refusesOtherEnvs: boolean;
+}
+/**
+ * The runtime's `servedEnv`, or `undefined` when it doesn't say (a runtime
+ * that serves no env, or an older one) or can't be asked. Then every default
+ * stays as it was, and a runtime that refuses other envs still refuses the
+ * write itself (`409 env-not-served`).
+ */
+export declare function servedEnvOf(client: () => KindgiClient): Promise<ServedEnv | undefined>;
+/**
+ * A pack's environments: each name in its config's `environments`, with
+ * the project (id or slug) its `project` names, if it names one.
+ */
+export type PackEnvironments = Readonly<Record<string, string | undefined>>;
+/** A pack environment `--env` named, and the project its config names for it. */
+export interface MappedEnvironment {
+    readonly name: string;
+    /** As the config names it: an id or a slug. */
+    readonly projectRef: string;
+}
+/** The env a value command acts under, or why there's none. */
+export type ValueTarget = {
+    readonly kind: 'ok';
+    readonly envName: string;
+    /**
+     * `served`: `--env` was left out, and the runtime refuses other envs.
+     * `environment`: `--env` named a pack environment with a project, on
+     * such a runtime.
+     */
+    readonly from: 'flag' | 'served' | 'default' | 'environment';
+    /** With `from: 'environment'`: the environment, whose project is the value's scope. */
+    readonly environment?: MappedEnvironment;
+}
+/** No `--env`, and neither a default nor a runtime that names one: the command's own message. */
+ | {
+    readonly kind: 'missing';
+} | {
+    readonly kind: 'refused';
+    readonly stderr: string;
+};
+/** A pack environment `--env` named, with its project resolved to an id. */
+export interface ResolvedEnvironment extends MappedEnvironment {
+    readonly projectId: string;
+}
+/** `ValueTarget` for a command: a named environment's project resolved to its id. */
+export type CommandValueTarget = (Extract<ValueTarget, {
+    kind: 'ok';
+}> & {
+    readonly environment?: ResolvedEnvironment;
+}) | Exclude<ValueTarget, {
+    kind: 'ok';
+}>;
+/**
+ * Where a value command's value goes. `flag` is `--env` as given, `fallback`
+ * the command's own default (none: `--env` is required).
+ *
+ * On a runtime that refuses other envs, `--env` defaults to the env it
+ * serves, and a write (`write`) under another is refused here, before
+ * anything is sent: it would never be read. A read or a delete may still
+ * name another env, to find and remove what was stored there before.
+ * There, `--env` may also name one of the pack's `environments` that has a
+ * `project`: the value is that project's, under the env the runtime serves.
+ * The environment picks the scope, so a `--scope` with it (`scope`, as
+ * given) may only name that project: `project`, or `project:<its id>`
+ * (`valueTargetFor` compares the id).
+ * Anywhere else: `flag`, then `fallback`, as before.
+ *
+ * `what` names what would be stored, for the refusal (`a secret`).
+ * `mayOmit: false` when leaving `--env` out isn't the way (it picks more
+ * than the env), so the refusal doesn't suggest it. A refused `local`
+ * also says where `local` is: a `kindgi dev` runtime, which the CLI talks
+ * to in its pack. `environments` is the pack's (none: outside a pack).
+ */
+export declare function resolveValueTarget(input: {
+    readonly flag: string | undefined;
+    readonly fallback?: string;
+    readonly served: ServedEnv | undefined;
+    readonly write: boolean;
+    readonly what: string;
+    readonly mayOmit?: boolean;
+    readonly environments?: PackEnvironments;
+    readonly scope?: string;
+}): ValueTarget;
+/** A pack config's environments, each with the project it names (`projectOfEnv`). */
+export declare function environmentsOf(config: {
+    readonly environments?: unknown;
+}): PackEnvironments;
+/** What a value command passes to `valueEnvFor` and `valueTargetFor`. */
+interface ValueTargetOptions {
+    readonly write: boolean;
+    readonly what: string;
+    readonly fallback?: string;
+    readonly mayOmit?: boolean;
+    readonly scope?: string;
+}
+/**
+ * `resolveValueTarget` for a command, with a named pack environment's
+ * project as the config gives it (not looked up): for a command that uses
+ * the env alone. Asks the runtime what it serves only when that can change
+ * the answer: when `--env` is left out, the command writes, or `--env`
+ * names one of the pack's environments with a project. The pack's
+ * environments are read only when `--env` is given. On a runtime that
+ * refuses other envs, a pack config that can't be read is refused, before
+ * anything is sent: whether `--env` names one of its environments isn't
+ * known.
+ */
+export declare function valueEnvFor(ctx: CommandContext, flag: string | undefined, options: ValueTargetOptions): Promise<ValueTarget>;
+/**
+ * `valueEnvFor`, with the named pack environment's project looked up (a
+ * slug that names none or several is refused), and a `--scope` naming a
+ * project compared with it.
+ */
+export declare function valueTargetFor(ctx: CommandContext, flag: string | undefined, options: ValueTargetOptions): Promise<CommandValueTarget>;
+/**
+ * A command's result, with the line saying which project and env a pack
+ * environment named by `--env` stood for. Nothing for any other target.
+ */
+export declare function withEnvironmentNote(result: CommandResult, target: {
+    readonly envName: string;
+    readonly environment?: ResolvedEnvironment;
+}): CommandResult;
+/**
+ * A command's result for `thrown`, with where `local` is added when the
+ * runtime refused a value under `local` (`409 env-not-served`). For a write
+ * the CLI sends anyway, since only the runtime knows whether a registration
+ * still reads it there.
+ */
+export declare function withLocalEnvHint(result: CommandResult, thrown: unknown, envName: string): CommandResult;
+export {};
+//# sourceMappingURL=value-target.d.ts.map

package/dist/value-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-target.d.ts","sourceRoot":"","sources":["../src/value-target.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKnD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAS5F;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE5E,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,+DAA+D;AAC/D,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;IAC7D,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CAC1C;AACH,iGAAiG;GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC1B,CAAC,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAAC,GACvF,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,WAAW,CAqBd;AAyED,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,gBAAgB,CAM5F;AAED,yEAAyE;AACzE,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CA0BtB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAE,GAC/E,aAAa,CAWf;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,aAAa,CAIf"}

package/dist/value-target.js

@@ -0,0 +1,231 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { isAbsolute, resolve } from 'node:path';
+import { LOCAL_ENV_NAME } from '@kindgi/secrets-dotenv';
+import { projectOfEnv } from './commands/build.js';
+import { UsageError, extractKindgiError } from './errors.js';
+import { loadPackConfig } from './pack-config.js';
+import { resolveProjectRef } from './project-ref.js';
+/**
+ * The runtime's `servedEnv`, or `undefined` when it doesn't say (a runtime
+ * that serves no env, or an older one) or can't be asked. Then every default
+ * stays as it was, and a runtime that refuses other envs still refuses the
+ * write itself (`409 env-not-served`).
+ */
+export async function servedEnvOf(client) {
+    try {
+        const served = (await client().identity.whoami()).servedEnv;
+        return served === undefined
+            ? undefined
+            : { envName: served.envName, refusesOtherEnvs: served.refusesOtherEnvs };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Where a value command's value goes. `flag` is `--env` as given, `fallback`
+ * the command's own default (none: `--env` is required).
+ *
+ * On a runtime that refuses other envs, `--env` defaults to the env it
+ * serves, and a write (`write`) under another is refused here, before
+ * anything is sent: it would never be read. A read or a delete may still
+ * name another env, to find and remove what was stored there before.
+ * There, `--env` may also name one of the pack's `environments` that has a
+ * `project`: the value is that project's, under the env the runtime serves.
+ * The environment picks the scope, so a `--scope` with it (`scope`, as
+ * given) may only name that project: `project`, or `project:<its id>`
+ * (`valueTargetFor` compares the id).
+ * Anywhere else: `flag`, then `fallback`, as before.
+ *
+ * `what` names what would be stored, for the refusal (`a secret`).
+ * `mayOmit: false` when leaving `--env` out isn't the way (it picks more
+ * than the env), so the refusal doesn't suggest it. A refused `local`
+ * also says where `local` is: a `kindgi dev` runtime, which the CLI talks
+ * to in its pack. `environments` is the pack's (none: outside a pack).
+ */
+export function resolveValueTarget(input) {
+    const { flag, served } = input;
+    if (served?.refusesOtherEnvs === true) {
+        if (flag === undefined)
+            return { kind: 'ok', envName: served.envName, from: 'served' };
+        const projectRef = input.environments?.[flag];
+        if (projectRef !== undefined) {
+            return environmentTarget({ name: flag, projectRef }, served, input.scope);
+        }
+        if (flag !== served.envName && input.write) {
+            return {
+                kind: 'refused',
+                stderr: `env-not-served: this runtime keeps its values under \`${served.envName}\` only, so ${input.what} under \`${flag}\` would never be read. Use --env=${served.envName}${input.mayOmit === false ? '' : ', or leave --env out'}.\n${environmentsHint(flag, input.environments)}${localEnvHint(flag)}`,
+            };
+        }
+        return { kind: 'ok', envName: flag, from: 'flag' };
+    }
+    if (flag !== undefined)
+        return { kind: 'ok', envName: flag, from: 'flag' };
+    if (input.fallback !== undefined) {
+        return { kind: 'ok', envName: input.fallback, from: 'default' };
+    }
+    return { kind: 'missing' };
+}
+/**
+ * `--env` naming a pack environment with a project, on a runtime that
+ * refuses other envs: that project, under the env the runtime serves. A
+ * `--scope` (`scope`, as given) may only name that project.
+ */
+function environmentTarget(environment, served, scope) {
+    const { name, projectRef } = environment;
+    if (scope === 'project:') {
+        return {
+            kind: 'refused',
+            stderr: 'Malformed --scope: expected --scope=project:<projectId>, got "project:".\n',
+        };
+    }
+    if (scope !== undefined && scope !== 'project' && !scope.startsWith('project:')) {
+        return {
+            kind: 'refused',
+            stderr: `--env=${name} is the pack's environment ${name}, so its scope is its project, ${projectRef}, not ${scope}. For a value every environment without its own reads, leave --env out (--scope=${scope}).\n`,
+        };
+    }
+    return { kind: 'ok', envName: served.envName, from: 'environment', environment };
+}
+/**
+ * What the pack's environments offer in place of a refused `--env`: the
+ * ones with a project, and how to give one a project. Nothing outside a
+ * pack, or for `local`, which has its own (`localEnvHint`).
+ */
+function environmentsHint(flag, environments) {
+    if (environments === undefined || flag === LOCAL_ENV_NAME)
+        return '';
+    const mapped = Object.entries(environments).filter((entry) => entry[1] !== undefined);
+    const unmapped = flag in environments
+        ? `The pack's environment ${flag} names no project: add \`environments.${flag}.project\` to kindgi.config.ts, and --env=${flag} stores values in that project.\n`
+        : '';
+    if (mapped.length === 0) {
+        return (unmapped ||
+            "No environment in the pack's config names a project: add `environments.<name>.project` to kindgi.config.ts, and --env=<name> stores values in that project.\n");
+    }
+    const list = mapped.map(([name, project]) => `${name} (project ${project})`).join(', ');
+    return `${unmapped}The pack's environments: ${list}. --env=<one of them> stores a value in its project.\n`;
+}
+/** The environments of the pack at `--path`, else the cwd. */
+async function packEnvironmentsOf(ctx) {
+    const raw = ctx.options.path;
+    const dir = typeof raw === 'string' && raw !== '' ? raw : '.';
+    const loaded = await loadPackConfig(ctx, isAbsolute(dir) ? dir : resolve(ctx.cwd, dir));
+    if (loaded.kind === 'ok')
+        return { kind: 'ok', environments: environmentsOf(loaded.config) };
+    return loaded.kind === 'invalid'
+        ? { kind: 'invalid', message: loaded.message }
+        : { kind: 'missing' };
+}
+/** A pack config's environments, each with the project it names (`projectOfEnv`). */
+export function environmentsOf(config) {
+    const { environments } = config;
+    if (environments === null || typeof environments !== 'object')
+        return {};
+    return Object.fromEntries(Object.keys(environments).map((name) => [name, projectOfEnv(config, name)]));
+}
+/**
+ * `resolveValueTarget` for a command, with a named pack environment's
+ * project as the config gives it (not looked up): for a command that uses
+ * the env alone. Asks the runtime what it serves only when that can change
+ * the answer: when `--env` is left out, the command writes, or `--env`
+ * names one of the pack's environments with a project. The pack's
+ * environments are read only when `--env` is given. On a runtime that
+ * refuses other envs, a pack config that can't be read is refused, before
+ * anything is sent: whether `--env` names one of its environments isn't
+ * known.
+ */
+export async function valueEnvFor(ctx, flag, options) {
+    let served;
+    let read = { kind: 'missing' };
+    if (flag === undefined || options.write) {
+        served = await servedEnvOf(ctx.client);
+        if (flag !== undefined && served?.refusesOtherEnvs === true) {
+            read = await packEnvironmentsOf(ctx);
+        }
+    }
+    else {
+        read = await packEnvironmentsOf(ctx);
+        if (read.kind === 'invalid' || (read.kind === 'ok' && read.environments[flag] !== undefined)) {
+            served = await servedEnvOf(ctx.client);
+        }
+    }
+    if (read.kind === 'invalid' && flag !== undefined && served?.refusesOtherEnvs === true) {
+        return {
+            kind: 'refused',
+            stderr: `Couldn't read the pack config: ${read.message.trimEnd()}\nOn this runtime, --env=${flag} may name one of the pack's environments, whose values are in its project, so nothing was sent. Fix the config and run this again.\n`,
+        };
+    }
+    return resolveValueTarget({
+        flag,
+        served,
+        ...(read.kind === 'ok' && { environments: read.environments }),
+        ...options,
+    });
+}
+/**
+ * `valueEnvFor`, with the named pack environment's project looked up (a
+ * slug that names none or several is refused), and a `--scope` naming a
+ * project compared with it.
+ */
+export async function valueTargetFor(ctx, flag, options) {
+    const target = await valueEnvFor(ctx, flag, options);
+    if (target.kind !== 'ok' || target.environment === undefined) {
+        return target;
+    }
+    const { name, projectRef } = target.environment;
+    let projectId;
+    try {
+        projectId = await resolveProjectRef(ctx, projectRef);
+    }
+    catch (err) {
+        if (!(err instanceof UsageError))
+            throw err;
+        return { kind: 'refused', stderr: `The pack's environment ${name}: ${err.message}\n` };
+    }
+    const named = options.scope?.startsWith('project:') === true ? options.scope.slice(8) : undefined;
+    if (named !== undefined && named !== projectId) {
+        return {
+            kind: 'refused',
+            stderr: `--env=${name} is the pack's environment ${name}, project ${projectRef} (${projectId}), but --scope names project ${named}. Name one: --env=${name} with --scope=project, or --scope=project:${named} without --env.\n`,
+        };
+    }
+    return { ...target, environment: { name, projectRef, projectId } };
+}
+/**
+ * A command's result, with the line saying which project and env a pack
+ * environment named by `--env` stood for. Nothing for any other target.
+ */
+export function withEnvironmentNote(result, target) {
+    const { environment } = target;
+    if (environment === undefined)
+        return result;
+    const shown = environment.projectRef === environment.projectId
+        ? environment.projectId
+        : `${environment.projectRef} (${environment.projectId})`;
+    const note = `Environment ${environment.name}: project ${shown}, values under ${target.envName}.\n`;
+    return result.kind === 'ok'
+        ? { ...result, rendered: { ...result.rendered, stderr: `${note}${result.rendered.stderr}` } }
+        : { ...result, stderr: `${note}${result.stderr}` };
+}
+/** Where `local` is, when that's the env a refused value named; otherwise nothing. */
+function localEnvHint(envName) {
+    return envName === LOCAL_ENV_NAME
+        ? "`local` is a `kindgi dev` runtime's env: in a pack where `kindgi dev` runs, the CLI talks to that runtime, unless --url or KINDGI_API_URL names another.\n"
+        : '';
+}
+/**
+ * A command's result for `thrown`, with where `local` is added when the
+ * runtime refused a value under `local` (`409 env-not-served`). For a write
+ * the CLI sends anyway, since only the runtime knows whether a registration
+ * still reads it there.
+ */
+export function withLocalEnvHint(result, thrown, envName) {
+    const wire = extractKindgiError(thrown);
+    if (result.kind !== 'error' || wire?.reason !== 'env-not-served')
+        return result;
+    return { ...result, stderr: `${result.stderr}${localEnvHint(envName)}` };
+}
+//# sourceMappingURL=value-target.js.map

package/dist/value-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-target.js","sourceRoot":"","sources":["../src/value-target.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGhD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAA0B;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;QAC5D,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AA2CD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KASlC;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACvF,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,yDAAyD,MAAM,CAAC,OAAO,eAAe,KAAK,CAAC,IAAI,YAAY,IAAI,qCAAqC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE;aAC3S,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,WAA8B,EAC9B,MAAiB,EACjB,KAAyB;IAEzB,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;IACzC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS,IAAI,8BAA8B,IAAI,kCAAkC,UAAU,SAAS,KAAK,mFAAmF,KAAK,MAAM;SAChN,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,YAA0C;IAChF,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAChD,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC7D,CAAC;IACF,MAAM,QAAQ,GACZ,IAAI,IAAI,YAAY;QAClB,CAAC,CAAC,0BAA0B,IAAI,yCAAyC,IAAI,6CAA6C,IAAI,mCAAmC;QACjK,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CACL,QAAQ;YACR,+JAA+J,CAChK,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,GAAG,QAAQ,4BAA4B,IAAI,wDAAwD,CAAC;AAC7G,CAAC;AAUD,8DAA8D;AAC9D,KAAK,UAAU,kBAAkB,CAC/B,GAAkE;IAElE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS;QAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,MAA2C;IACxE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAChC,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAmB,EACnB,IAAwB,EACxB,OAA2B;IAE3B,IAAI,MAA6B,CAAC;IAClC,IAAI,IAAI,GAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YAC7F,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,kCAAkC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,4BAA4B,IAAI,sIAAsI;SACvO,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;QACxB,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9D,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAmB,EACnB,IAAwB,EACxB,OAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,MAA4B,CAAC;IACtC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAChD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;YAAE,MAAM,GAAG,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,IAAI,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS,IAAI,8BAA8B,IAAI,aAAa,UAAU,KAAK,SAAS,gCAAgC,KAAK,qBAAqB,IAAI,6CAA6C,KAAK,mBAAmB;SAChO,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,MAAgF;IAEhF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC/B,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC7C,MAAM,KAAK,GACT,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,SAAS;QAC9C,CAAC,CAAC,WAAW,CAAC,SAAS;QACvB,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,SAAS,GAAG,CAAC;IAC7D,MAAM,IAAI,GAAG,eAAe,WAAW,CAAC,IAAI,aAAa,KAAK,kBAAkB,MAAM,CAAC,OAAO,KAAK,CAAC;IACpG,OAAO,MAAM,CAAC,IAAI,KAAK,IAAI;QACzB,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE;QAC7F,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,KAAK,cAAc;QAC/B,CAAC,CAAC,4JAA4J;QAC9J,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqB,EACrB,MAAe,EACf,OAAe;IAEf,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAyC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAChF,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC3E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/cli",
-  "version": "0.1.8",
+  "version": "0.1.9-rc.0",
   "description": "Command-line interface for Kindgi™. Create a pack, run it on your machine (`kindgi dev`), build, sign and deploy it, and work with a running Kindgi API from the terminal.",
   "license": "Apache-2.0",
   "repository": {
@@ -37,18 +37,18 @@
     "provenance": true
   },
   "dependencies": {
-    "@kindgi/agents": "0.1.8",
-    "@kindgi/client": "0.1.8",
-    "@kindgi/dotenv-file": "0.1.8",
-    "@kindgi/crypto": "0.1.8",
-    "@kindgi/env-schema": "0.1.8",
-    "@kindgi/flow": "0.1.8",
-    "@kindgi/handler-runtime": "0.1.8",
-    "@kindgi/log": "0.1.8",
-    "@kindgi/secrets-dotenv": "0.1.8",
-    "@kindgi/platform": "0.1.8",
-    "@kindgi/sdk": "0.1.8",
-    "@kindgi/types": "0.1.8",
+    "@kindgi/agents": "0.1.9-rc.0",
+    "@kindgi/client": "0.1.9-rc.0",
+    "@kindgi/dotenv-file": "0.1.9-rc.0",
+    "@kindgi/crypto": "0.1.9-rc.0",
+    "@kindgi/env-schema": "0.1.9-rc.0",
+    "@kindgi/flow": "0.1.9-rc.0",
+    "@kindgi/handler-runtime": "0.1.9-rc.0",
+    "@kindgi/log": "0.1.9-rc.0",
+    "@kindgi/secrets-dotenv": "0.1.9-rc.0",
+    "@kindgi/platform": "0.1.9-rc.0",
+    "@kindgi/sdk": "0.1.9-rc.0",
+    "@kindgi/types": "0.1.9-rc.0",
     "esbuild": "^0.24.0",
     "semver": "^7.8.5",
     "smol-toml": "^1.9.0",