@kindgi/cli 0.1.9 → 0.1.10-rc.0

package/README.md

@@ -321,7 +321,8 @@ On each boot, `kindgi dev`:
   settings or its key's name, so a difference only there gets the plain line.
 
 It records which providers it registered in `.kindgi/dev/providers.json`, per
-database and tenant.
+database and tenant. That file is `kindgi dev`'s local record, under the
+gitignored `.kindgi/`; a provider is declared in the config, which you commit.
 
 **Any OpenAI-compatible endpoint** — an open-source model you serve yourself
 (vLLM, llama.cpp's `llama-server`, Ollama, LM Studio), OpenRouter, a LiteLLM
@@ -500,11 +501,17 @@ Builds a signed pack image with a Kindgi build server, and writes
   and the `packageManager` field. A pnpm app with no `packageManager` gets the
   host's pnpm version (`pnpm --version`), the one that wrote the lockfile,
   never the newest. Build scripts are off during the install;
-  then `rebuild` runs the ones the app allows, and the install is pruned to
-  production dependencies.
+  then `rebuild` runs the ones the app allows. Only production dependencies
+  are installed, unless `image` has build steps (`prisma()`'s `prisma
+  generate`), whose tools can be dev dependencies: then dev dependencies are
+  installed too, and pruned after the steps. Yarn 2 or later always installs
+  them and prunes after, as its production install resolves what
+  `yarn.lock` lacks instead of failing, even with `enableImmutableInstalls`
+  on. The build says which (`✓ Install: …`).
 - **A workspace:** with pnpm, only the pack's project and what it depends on
   are installed, not the rest of the workspace. npm and yarn install the
-  whole workspace.
+  whole workspace. With `image.dependencies: 'loaded'`, the install is one
+  project, cut down to what the pack loads (below).
 - **Layout:** the lockfile's folder is `/app`, and a pack inside a workspace
   member sits at its own path.
 - **Runs:** the pack service, under tini, as `node`, on `$PORT` (8080).
@@ -534,12 +541,99 @@ export default {
   `prisma generate` after the install, before the prune. The app's own
   `postinstall` doesn't run in the image, because the install runs with
   scripts off.
-- `buildEnv` holds non-secret placeholders for the build steps, and for the
-  indexer, which imports the pack's modules. It's never in the final image.
+- `buildEnv` holds non-secret placeholders for the install, the build steps,
+  and the indexer, which imports the pack's modules. It's never in the final
+  image. The indexer imports them with `NODE_ENV=production`, as the deployed
+  service does, unless `buildEnv` sets `NODE_ENV`. A `NODE_ENV` there doesn't
+  change which dependencies the install takes.
 - `defineBuildExtension()` makes an app's own extension from the same parts:
   `contextFiles`, `systemPackages`, `postInstall` steps (a package's bin, run
   through the app's package manager) and `buildEnv`.
 
+**Only what the pack loads (`image.dependencies: 'loaded'`).** By default
+(`'all'`) the image carries every production dependency of the app: a Next.js
+app's `next`, `react` and their tooling ride along, though the tools only
+import a few packages. With `'loaded'`, it carries the packages the pack's
+bundles import by name, with their own dependencies (declared, optional and
+peer, as installed), and what `image.keep` names:
+
+```ts
+image: {
+  dependencies: 'loaded',
+  keep: ['pino-pretty'], // loaded by a name in a config string, which no import shows
+},
+```
+
+- **What the image downloads:** only those. `kindgi build` finds each
+  package as Node finds it from the pack folder, and cuts the app's
+  `package.json` and lockfile down to them and what they depend on, by the
+  lockfile: dependencies, optional ones for every platform, and peers as
+  installed. Each lockfile entry is copied as the app has it (version,
+  resolution, integrity), and the result is checked against the app's
+  lockfile before the image installs it, frozen, with the usual command.
+  pnpm (lockfile `9.0`, with its env document, catalogs, overrides and
+  patches), npm (lockfile 2 and 3) and Yarn 1.
+- **How it's chosen in the image:** each package is resolved again as Node
+  resolves it at run time, from the bundles' folder and then from each kept
+  package's own folder, over the layout the package manager made (pnpm's
+  links, npm's and Yarn's hoisting). Packages are kept whole.
+- **Most misses fail the build, naming the package:**
+  - an import that isn't installed fails the image's closure step, by name;
+  - every package the bundles import, lazily loaded ones included, is loaded
+    on the trimmed install before indexing, which also runs there;
+  - a `require(x)` / `import(x)` with a computed name in the pack's own code
+    fails `kindgi build`, by file and line (esbuild reports each one), until
+    `image.keep` names what it loads (or `dependencies` is `'all'`).
+- **The build says what it installs,** and which of the pack's own
+  dependencies its tools don't import. A Next.js app whose tools import
+  `@kindgi/sdk` and `zod`:
+
+  ```text
+      ✓ Install: only what the pack loads, 39 of the lockfile's 96 packages; production dependencies only
+        Left out 3 of the pack's own dependencies its tools don't import: next, react, react-dom
+  ```
+- **A `node_modules` out of date with the lockfile fails the build:** the
+  bundles were built against a version the lockfile doesn't pin. The message
+  names the package, its folder and the command that brings it back in line
+  (`pnpm install`, `npm ci`, `yarn install`).
+- **Where the install isn't cut down:** the image downloads the app's whole
+  install and trims it after, and the build says why. That happens with:
+  - Yarn 2 or later (its lockfile can't be cut down by hand and still install
+    immutably);
+  - another lockfile version (pnpm's other than `9.0`, npm's other than 2
+    and 3);
+  - a local package (`link:`, `file:`, `workspace:`) among what the pack
+    loads;
+  - a package the pack loads that's installed outside the project, above the
+    lockfile's folder;
+  - a build step (`defineBuildExtension`) whose program no dependency of the
+    pack has;
+  - a lockfile entry it can't follow, such as one version installed twice
+    under different peers, where its folder doesn't say which.
+
+  An app whose tools import its own `@acme/ui` by `link:`:
+
+  ```text
+      ✓ Install: production dependencies only, then trimmed to what the pack loads
+        It downloads the app's whole install first, since @acme/ui is a local package (link:../../packages/ui).
+  ```
+
+  The image's closure step then says what it kept. The Next.js app above,
+  installed in full and trimmed:
+
+  ```text
+  … kindgi-closure: kept 36 of 59 packages (27.5 MB of 354 MB)
+  … kindgi-closure: dropped 3 of the pack's own dependencies its tools don't import: next, react, react-dom
+  ```
+- **What no check can see reaches a run:** a package loaded by a name in a
+  string (a plugin named in a config), through a `createRequire` alias or
+  `module.require`, or a dependency's own undeclared one. That call fails,
+  saying what to add to `image.keep`.
+- Extensions keep what they need: `prisma()` keeps Prisma 6's generated
+  `.prisma/client` when it's there.
+- Python packs keep every dependency for now: `dependencies = "loaded"` in
+  `[tool.kindgi.image]` is refused.
+
 **`--local`:** builds the image of a TypeScript or Python pack with this
 machine's Docker (`docker buildx build --load`) into its image store, as
 `kindgi-pack/<packId>:<artifactVersion>`, with the same integrity gate. There

package/dist/build/bundle.d.ts

@@ -39,11 +39,12 @@ export declare const REQUIRE_BANNER = "import { createRequire as __kindgiCreateR
  * Which packages are external doesn't depend on `importBy`: a dev bundle
  * and an image's leave out the same ones. `onExternal` (optional) is told
  * each external import: the package's name (`@scope/name` of
- * `@scope/name/sub`), and the absolute path of the file importing it.
+ * `@scope/name/sub`), the absolute path of the file importing it, and
+ * the specifier as written (`@scope/name/sub`).
  */
 export declare function nodeModulesExternalPlugin(options?: {
     readonly importBy?: 'resolved' | 'bare';
-    readonly onExternal?: (name: string, importer: string) => void;
+    readonly onExternal?: (name: string, importer: string, specifier: string) => void;
 }): Plugin;
 /**
  * How a dev bundle names a file it imports from `node_modules`. An

package/dist/build/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/build/bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAUD,gEAAgE;AAChE,eAAO,MAAM,cAAc,kIACsG,CAAC;AAIlI;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE;IACP,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3D,GACL,MAAM,CAwBR;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAGR"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/build/bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,MAAM,EAAE,CAAC,CAQnB;AAUD,gEAAgE;AAChE,eAAO,MAAM,cAAc,kIACsG,CAAC;AAIlI;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE;IACP,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9E,GACL,MAAM,CAwBR;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAGR"}

package/dist/build/bundle.js

@@ -90,7 +90,8 @@ const SKIP = Symbol('kindgi-externals-resolving');
  * Which packages are external doesn't depend on `importBy`: a dev bundle
  * and an image's leave out the same ones. `onExternal` (optional) is told
  * each external import: the package's name (`@scope/name` of
- * `@scope/name/sub`), and the absolute path of the file importing it.
+ * `@scope/name/sub`), the absolute path of the file importing it, and
+ * the specifier as written (`@scope/name/sub`).
  */
 export function nodeModulesExternalPlugin(options = {}) {
     const importBy = options.importBy ?? 'resolved';
@@ -110,7 +111,7 @@ export function nodeModulesExternalPlugin(options = {}) {
                 if (resolved.errors.length > 0 || resolved.external)
                     return undefined;
                 if (/[\\/]node_modules[\\/]/.test(resolved.path)) {
-                    onExternal?.(packageName(args.path), args.importer);
+                    onExternal?.(packageName(args.path), args.importer, args.path);
                     const path = importBy === 'bare' ? args.path : resolvedSpecifier(resolved.path, args.kind);
                     return { path, external: true };
                 }

package/dist/build/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/build/bundle.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAY5E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,QAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;iBACtC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;oBACzB,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,MAAyC;IAEzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GACzB,+HAA+H,CAAC;AAElI,MAAM,IAAI,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAGI,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC;gBAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBACtE,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,UAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACpD,MAAM,IAAI,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAClC,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,IAAgB,EAChB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/build/bundle.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAY5E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,QAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;iBACtC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;oBACzB,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,MAAyC;IAEzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GACzB,+HAA+H,CAAC;AAElI,MAAM,IAAI,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAGI,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC;gBAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBACtE,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,UAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/D,MAAM,IAAI,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAClC,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,IAAgB,EAChB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;AAC3F,CAAC"}

package/dist/build/computed-imports.d.ts

@@ -0,0 +1,27 @@
+export interface ComputedImport {
+    /** Absolute path. */
+    readonly file: string;
+    /** 1-based. */
+    readonly line: number;
+    /** The line, trimmed. */
+    readonly text: string;
+}
+/** The pack build's `logOverride` with `'loaded'`: those notes, as warnings. */
+export declare const COMPUTED_IMPORT_LOG_OVERRIDE: Readonly<Record<string, 'warning'>>;
+/** The subset of an esbuild message this reads. */
+export interface BuildMessage {
+    readonly id?: string;
+    readonly location?: {
+        readonly file: string;
+        readonly line: number;
+        readonly lineText: string;
+    } | null;
+}
+/**
+ * The computed imports among a build's warnings: file (resolved against
+ * the build's working folder), line, and the line's text, in file and
+ * line order, each site once. Calls inside `node_modules` aren't the
+ * pack's (they're externals, not bundled).
+ */
+export declare function computedImportsFrom(warnings: readonly BuildMessage[], workingDir: string): ComputedImport[];
+//# sourceMappingURL=computed-imports.d.ts.map

package/dist/build/computed-imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"computed-imports.d.ts","sourceRoot":"","sources":["../../src/build/computed-imports.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AASD,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAE5E,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;CACV;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,UAAU,EAAE,MAAM,GACjB,cAAc,EAAE,CAYlB"}

package/dist/build/computed-imports.js

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Computed imports in a pack's own code: `require(name)`, `import(name)`,
+ * or `require` passed around (`const r = require; r(name)`). In an image
+ * that carries only what the pack loads (`image.dependencies: 'loaded'`),
+ * the package such a call loads is invisible to the closure, so the build
+ * names each one (file:line) and asks for `image.keep`.
+ *
+ * esbuild knows them: it leaves each such call as it is, with a note at
+ * debug level. A `'loaded'` pack build raises those notes to warnings
+ * (`COMPUTED_IMPORT_LOG_OVERRIDE`), and they're read from the build's
+ * warnings here. Two residual forms esbuild can't see either, a
+ * `createRequire` alias and `module.require`, are left to the run-time
+ * hint.
+ */
+import { resolve } from 'node:path';
+/** esbuild's notes for a call it can't bundle because its argument is computed. */
+const COMPUTED_IMPORT_NOTES = [
+    'unsupported-require-call',
+    'unsupported-dynamic-import',
+    'indirect-require',
+];
+/** The pack build's `logOverride` with `'loaded'`: those notes, as warnings. */
+export const COMPUTED_IMPORT_LOG_OVERRIDE = Object.fromEntries(COMPUTED_IMPORT_NOTES.map((id) => [id, 'warning']));
+/**
+ * The computed imports among a build's warnings: file (resolved against
+ * the build's working folder), line, and the line's text, in file and
+ * line order, each site once. Calls inside `node_modules` aren't the
+ * pack's (they're externals, not bundled).
+ */
+export function computedImportsFrom(warnings, workingDir) {
+    const sites = new Map();
+    for (const warning of warnings) {
+        const at = warning.location;
+        if (at == null || !COMPUTED_IMPORT_NOTES.includes(warning.id))
+            continue;
+        const file = resolve(workingDir, at.file);
+        if (/[\\/]node_modules[\\/]/.test(file))
+            continue;
+        sites.set(`${file}:${at.line}`, { file, line: at.line, text: at.lineText.trim() });
+    }
+    return [...sites.values()].sort((a, b) => a.file === b.file ? a.line - b.line : a.file < b.file ? -1 : 1);
+}
+//# sourceMappingURL=computed-imports.js.map

package/dist/build/computed-imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computed-imports.js","sourceRoot":"","sources":["../../src/build/computed-imports.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,mFAAmF;AACnF,MAAM,qBAAqB,GAAG;IAC5B,0BAA0B;IAC1B,4BAA4B;IAC5B,kBAAkB;CACV,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAwC,MAAM,CAAC,WAAW,CACjG,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CACnD,CAAC;AAYF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAiC,EACjC,UAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,IAAI,EAAE,IAAI,IAAI,IAAI,CAAE,qBAAyD,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7G,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/dist/build/containerfile.d.ts

@@ -1,11 +1,11 @@
-import type { HostInstall, InstallCommands } from './host-install.js';
+import { type HostInstall, type InstallCommands } from './host-install.js';
 import type { ResolvedImage } from './image-config.js';
 export interface RenderContainerfileInputs {
     readonly baseImageRef: string;
     readonly artifactVersion: string;
     readonly publishedAt: string;
     readonly buildTarget: string;
-    readonly install: Pick<HostInstall, 'manager' | 'managerSpec' | 'hostPnpm' | 'packRel' | 'secrets' | 'yarnBerry'>;
+    readonly install: Pick<HostInstall, 'manager' | 'managerSpec' | 'hostPnpm' | 'packRel' | 'secrets' | 'yarnBerry' | 'reduced'>;
     readonly commands: InstallCommands;
     /** What `image` in `kindgi.config` adds (`image-config.ts`). */
     readonly image: ResolvedImage;

package/dist/build/containerfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"containerfile.d.ts","sourceRoot":"","sources":["../../src/build/containerfile.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,IAAI,CACpB,WAAW,EACX,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAC7E,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,iCAAiC,CAAC;AAE7D,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAUjD,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CA6H7E"}
+{"version":3,"file":"containerfile.d.ts","sourceRoot":"","sources":["../../src/build/containerfile.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAsB,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,IAAI,CACpB,WAAW,EACX,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CACzF,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,iCAAiC,CAAC;AAE7D,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAUjD,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAqJ7E"}

package/dist/build/containerfile.js

@@ -8,12 +8,24 @@
  *            packages `image` asks for (corepack on)
  *   deps     the app's dependencies, with its own package manager from
  *            its own lockfile, frozen and scripts off; then the build
- *            scripts it allows; then the extensions' steps (`prisma
- *            generate`); then pruned to production
+ *            scripts it allows. With `image.dependencies: 'loaded'`, only
+ *            what the pack loads, from a manifest and lockfile cut down
+ *            to it (`loaded-install.ts`), when the lockfile allows. Production dependencies only, unless the
+ *            extensions have steps (`prisma generate`) or the manager is
+ *            yarn berry (`whyDevDependencies`): then dev dependencies
+ *            too, the steps, and a prune to production
  *   code     the bundles (`dist/`): the pack's, the framework's, the
  *            config, the bundle map
- *   indexer  `index.json`, indexed from the bundles
- *   final    deps + code + index.json, as the `node` user
+ *   closure  (`image.dependencies: 'loaded'`) the install trimmed to the
+ *            packages the bundles import, their own dependencies and
+ *            `image.keep` (`kindgi-closure trim`)
+ *   trimmed  (the same) the trimmed install, on the system stage
+ *   indexer  `index.json`, indexed from the bundles: on `deps`, or with
+ *            `'loaded'` on `trimmed`, after `kindgi-closure check` loads
+ *            every package the bundles import there, so a miss fails the
+ *            build. With `NODE_ENV=production`, as the service loads
+ *            them, unless `buildEnv` sets `NODE_ENV`
+ *   final    deps (or trimmed) + code + index.json, as the `node` user
  *
  * Image layout: the install root at `/app`, the pack at
  * `/app/<packRel>` (the working directory) with its bundles in `dist/`,
@@ -40,6 +52,7 @@
  */
 import { binCommand } from '../package-manager.js';
 import { renderAptGetStep } from './apt.js';
+import { whyDevDependencies } from './host-install.js';
 /**
  * pnpm's store in the install stage: the cache mount's own folder, set
  * explicitly (`pnpm_config_store_dir` for pnpm 11, `npm_config_store_dir`
@@ -84,6 +97,14 @@ export function renderContainerfile(inputs) {
     const env = Object.entries(inputs.image.buildEnv)
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
         .map(([name, value]) => `ENV ${name}=${dockerfileString(value)}`);
+    const loaded = inputs.image.dependencies === 'loaded';
+    const installed = loaded ? 'trimmed' : 'deps';
+    const devDependencies = whyDevDependencies(install, inputs.image.steps);
+    // The indexer loads the modules as the service will; a `NODE_ENV` in buildEnv is
+    // already set there (from deps, or the preamble), so it stands.
+    const indexerNodeEnv = Object.hasOwn(inputs.image.buildEnv, 'NODE_ENV')
+        ? ''
+        : '\n# The modules load as in the service: NODE_ENV=production (buildEnv can set it).\nENV NODE_ENV=production';
     const steps = inputs.image.steps.map((step) => {
         const { command, args } = binCommand(install.manager, step.bin, step.args ?? []);
         return `# ${step.extension}\n${run(`cd ${packDir} && ${[command, ...args].map(shellWord).join(' ')}`)}`;
@@ -124,16 +145,18 @@ USER node${pinPnpm
 # host's), never the newest one corepack would take.
 RUN corepack install -g pnpm@${install.hostPnpm}`
         : ''}
-COPY --chown=node:node host/ ./${env.length > 0 ? `\n# Build env: the build steps and the indexer stage only, never the final image.\n${env.join('\n')}` : ''}
-${run(commands.install)}${inputs.image.contextFiles.length > 0 ? '\nCOPY --chown=node:node ext/ ./' : ''}${steps.length > 0 ? `\n${steps.join('\n')}` : ''}
-${run(commands.prune)}
+COPY --chown=node:node host/ ./${env.length > 0 ? `\n# Build env: the install, the build steps and the indexer stage only, never the final image.\n${env.join('\n')}` : ''}${install.reduced === undefined
+        ? ''
+        : `\n# Only what the pack loads: ${install.reduced.kept} of the lockfile's ${install.reduced.total} packages, from the manifest and lockfile kindgi build cut down to them.`}
+# ${devDependencies === undefined ? 'Production dependencies only, as there are no build steps.' : `Dev dependencies too, ${devDependencies}; pruned to production after.`}
+${run(commands.install)}${inputs.image.contextFiles.length > 0 ? '\nCOPY --chown=node:node ext/ ./' : ''}${steps.length > 0 ? `\n${steps.join('\n')}` : ''}${commands.prune === undefined ? '' : `\n${run(commands.prune)}`}
 
 # --- stage: code ---
 FROM scratch AS code
 COPY dist/ /dist/
-
+${loaded ? closureStages(packDir, inputs.image) : ''}
 # --- stage: indexer ---
-FROM deps AS indexer
+FROM ${installed} AS indexer${loaded ? indexerPreamble(env) : ''}${indexerNodeEnv}
 ARG SOURCE_DATE_EPOCH=0
 ARG KINDGI_BUILD_TARGET=${buildTarget}
 ARG KINDGI_ARTIFACT_VERSION=${artifactVersion}
@@ -143,7 +166,11 @@ ENV KINDGI_BUILD_TARGET=\${KINDGI_BUILD_TARGET}
 ENV KINDGI_ARTIFACT_VERSION=\${KINDGI_ARTIFACT_VERSION}
 ENV KINDGI_PUBLISHED_AT=\${KINDGI_PUBLISHED_AT}
 COPY --from=code --chown=node:node /dist ${packDir}/dist
-WORKDIR ${packDir}
+WORKDIR ${packDir}${loaded
+        ? `
+# Every package the bundles import loads from the trimmed install.
+RUN node ./dist/kindgi-closure.mjs check --bundle-dir ${packDir}/dist --externals ./dist/externals.json`
+        : ''}
 RUN node --enable-source-maps ./dist/kindgi-index.mjs \\
       --pack-dir . \\
       --config ./dist/kindgi.config.mjs \\
@@ -160,11 +187,15 @@ ARG KINDGI_ARTIFACT_VERSION=${artifactVersion}
 ARG KINDGI_PUBLISHED_AT=${publishedAt}
 ENV KINDGI_ARTIFACT_VERSION=\${KINDGI_ARTIFACT_VERSION}
 ENV KINDGI_PUBLISHED_AT=\${KINDGI_PUBLISHED_AT}
-ENV NODE_ENV=production
+ENV NODE_ENV=production${loaded
+        ? `
+# The pack service names a package the trimmed install doesn't have.
+ENV KINDGI_IMAGE_DEPENDENCIES=loaded`
+        : ''}
 ENV PORT=8080
 USER node
 WORKDIR ${packDir}
-COPY --from=deps --chown=node:node /app /app
+COPY --from=${installed} --chown=node:node /app /app
 COPY --from=code --chown=node:node /dist ./dist${inputs.hasIncludes
         ? `
 COPY --chown=node:node include/ ./`
@@ -178,6 +209,44 @@ ENTRYPOINT ${entrypoint}
 CMD []
 `;
 }
+/**
+ * The closure and trimmed stages (`image.dependencies: 'loaded'`): the
+ * install trimmed to what the bundles load, with no network and no
+ * secrets, then laid on the system stage.
+ */
+function closureStages(packDir, image) {
+    const keep = [
+        ...image.keep.map((name) => `--keep ${shellWord(name)}`),
+        ...image.keepIfInstalled.map((name) => `--keep-if-installed ${shellWord(name)}`),
+    ];
+    const args = [
+        '--root /app',
+        `--bundle-dir ${packDir}/dist`,
+        '--externals /home/node/closure-in/externals.json',
+        ...keep,
+        '--out /home/node/closure',
+    ];
+    return `
+# --- stage: closure (image.dependencies: 'loaded') ---
+# Only what the pack loads: the packages its bundles import, their own
+# dependencies, and image.keep.
+FROM deps AS closure
+COPY --from=code --chown=node:node /dist/kindgi-closure.mjs /dist/externals.json /home/node/closure-in/
+RUN node /home/node/closure-in/kindgi-closure.mjs trim \\
+      ${args.join(' \\\n      ')}
+
+# --- stage: trimmed ---
+FROM system AS trimmed
+COPY --from=closure --chown=node:node /home/node/closure /app
+`;
+}
+/** The indexer on the trimmed install: as the deps stage leaves it, the `node` user and the build env. */
+function indexerPreamble(env) {
+    const buildEnv = env.length > 0
+        ? `\n# Build env: the indexer stage only, never the final image.\n${env.join('\n')}`
+        : '';
+    return `\nUSER node${buildEnv}`;
+}
 /** The secret mounts for registry config, and the package manager's download cache. */
 function installMounts(install) {
     const owner = 'uid=1000,gid=1000';

package/dist/build/containerfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerfile.js","sourceRoot":"","sources":["../../src/build/containerfile.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAoB5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAE7D,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,MAAM;IACN,sBAAsB;IACtB,gCAAgC;IAChC,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,QAAQ;IACR,cAAc;IACd,wBAAwB;CACzB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC9F,wFAAwF;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC;IAChF,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE,CACtC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,OAAO,EAAE,CAAC;IAChG,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM;QACN,IAAI;QACJ,oHAAoH;KACrH,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,KAAK,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;;;;OAWF,YAAY;EACjB,MAAM,GACL,QAAQ;QACN,CAAC,CAAC;;sCAE+B;QACjC,CAAC,CAAC,EACN;;qBAEoB,eAAe,CAAC,OAAO,CAAC;;;;;6FAM1C,OAAO,CAAC,OAAO,KAAK,MAAM;QACxB,CAAC,CAAC;;;4BAGqB,cAAc;2BACf,cAAc,EAAE;QACtC,CAAC,CAAC,EACN;WAEE,OAAO;QACL,CAAC,CAAC;;;+BAGwB,OAAO,CAAC,QAAQ,EAAE;QAC5C,CAAC,CAAC,EACN;iCACgC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sFAAsF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;EAC3J,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;EACxJ,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;;;;;;;;;0BASK,WAAW;8BACP,eAAe;0BACnB,WAAW;;;;;2CAKM,OAAO;UACxC,OAAO;;;;;;;;;;;;;8BAaa,eAAe;0BACnB,WAAW;;;;;;UAM3B,OAAO;;iDAGd,MAAM,CAAC,WAAW;QAChB,CAAC,CAAC;mCAC4B;QAC9B,CAAC,CAAC,EACN;;;8CAG6C,WAAW;;;aAG5C,UAAU;;CAEtB,CAAC;AACF,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,OAA6C;IAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,IAAI,KAAK,iBAAiB,CACtF,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,kDAAkD,cAAc,IAAI,KAAK,EAAE;QAC3E,6DAA6D;QAC7D,yEAAyE,KAAK,EAAE,CACjF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,iEAAiE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAA6C;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACrG,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;IAChF,OAAO,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QACjE,CAAC,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,QAAQ,cAAc;QACjD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"containerfile.js","sourceRoot":"","sources":["../../src/build/containerfile.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAA0C,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAmB/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAE7D,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,MAAM;IACN,sBAAsB;IACtB,gCAAgC;IAChC,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,QAAQ;IACR,cAAc;IACd,wBAAwB;CACzB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC9F,wFAAwF;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC;IAChF,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAU,EAAE,CACtC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,OAAO,EAAE,CAAC;IAChG,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM;QACN,IAAI;QACJ,oHAAoH;KACrH,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxE,iFAAiF;IACjF,gEAAgE;IAChE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QACrE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6GAA6G,CAAC;IAClH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,KAAK,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;;;;OAWF,YAAY;EACjB,MAAM,GACL,QAAQ;QACN,CAAC,CAAC;;sCAE+B;QACjC,CAAC,CAAC,EACN;;qBAEoB,eAAe,CAAC,OAAO,CAAC;;;;;6FAM1C,OAAO,CAAC,OAAO,KAAK,MAAM;QACxB,CAAC,CAAC;;;4BAGqB,cAAc;2BACf,cAAc,EAAE;QACtC,CAAC,CAAC,EACN;WAEE,OAAO;QACL,CAAC,CAAC;;;+BAGwB,OAAO,CAAC,QAAQ,EAAE;QAC5C,CAAC,CAAC,EACN;iCACgC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mGAAmG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GACvK,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,iCAAiC,OAAO,CAAC,OAAO,CAAC,IAAI,sBAAsB,OAAO,CAAC,OAAO,CAAC,KAAK,0EACtG;IACG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,yBAAyB,eAAe,+BAA+B;EACxK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;;;;;EAKzN,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;;OAE7C,SAAS,cAAc,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc;;0BAEvD,WAAW;8BACP,eAAe;0BACnB,WAAW;;;;;2CAKM,OAAO;UACxC,OAAO,GACd,MAAM;QACJ,CAAC,CAAC;;wDAEiD,OAAO,yCAAyC;QACnG,CAAC,CAAC,EACN;;;;;;;;;;;;;8BAa6B,eAAe;0BACnB,WAAW;;;yBAIlC,MAAM;QACJ,CAAC,CAAC;;qCAE8B;QAChC,CAAC,CAAC,EACN;;;UAGS,OAAO;cACH,SAAS;iDAEpB,MAAM,CAAC,WAAW;QAChB,CAAC,CAAC;mCAC4B;QAC9B,CAAC,CAAC,EACN;;;8CAG6C,WAAW;;;aAG5C,UAAU;;CAEtB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAoB;IAC1D,MAAM,IAAI,GAAG;QACX,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;KACjF,CAAC;IACF,MAAM,IAAI,GAAG;QACX,aAAa;QACb,gBAAgB,OAAO,OAAO;QAC9B,kDAAkD;QAClD,GAAG,IAAI;QACP,0BAA0B;KAC3B,CAAC;IACF,OAAO;;;;;;;QAOD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;;;;;CAK/B,CAAC;AACF,CAAC;AAED,0GAA0G;AAC1G,SAAS,eAAe,CAAC,GAAsB;IAC7C,MAAM,QAAQ,GACZ,GAAG,CAAC,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,kEAAkE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpF,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,cAAc,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,OAA6C;IAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,IAAI,KAAK,iBAAiB,CACtF,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,kDAAkD,cAAc,IAAI,KAAK,EAAE;QAC3E,6DAA6D;QAC7D,yEAAyE,KAAK,EAAE,CACjF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,iEAAiE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAA6C;IACpE,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACrG,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;IAChF,OAAO,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QACjE,CAAC,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,QAAQ,cAAc;QACjD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/build/defaults.d.ts

@@ -15,8 +15,8 @@ export declare function runLocalIndexerReal(opts: RunLocalIndexerOptions): Promi
  *     `node_modules` (imported by name);
  *   - the framework's process entries, `kindgi-index.mjs` and
  *     `kindgi-pack-service.mjs`: self-contained, from the CLI's own
- *     `@kindgi/handler-runtime` (the pack's install has none once
- *     pruned);
+ *     `@kindgi/handler-runtime` (the image's install has none: it has
+ *     production dependencies only);
  *   - `bundle-map.json`: each primitive's source path → its bundle.
  */
 export declare function esbuildBundleReal(opts: EsbuildBundleOptions): Promise<EsbuildBundleResult>;
@@ -24,6 +24,7 @@ export declare function writeContainerfileReal(opts: WriteContainerfileOptions):
 /**
  * Write the image's build context into `contextDir` (emptied first):
  *   host/          the files the install reads, at their paths under the install root
+ *                  (with `'loaded'`, the manifest and lockfile cut down to what the pack loads)
  *   ext/           the files the build extensions read, at their paths under the install root
  *   dist/          the bundles
  *   include/       `bundle.include` files, at their pack-relative paths

package/dist/build/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/build/defaults.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAMtB;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAkE3B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAgE9B;AAsBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F;AAMD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B/E;AAED,oEAAoE;AACpE,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAE9E;AAkBD,mFAAmF;AACnF,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAE,kBA2BlC,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,eA0C/B,CAAC;AAMF,wBAAsB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyDpF;AAwCD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAuCD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAkC/B;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqD1F;AA6ED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuB7E;AAMD,eAAO,MAAM,kBAAkB,EAAE,YAchC,CAAC;AAIF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/build/defaults.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAMtB;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAkE3B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAiF9B;AAsBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/E;AAED,oEAAoE;AACpE,wBAAsB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAE9E;AAkBD,mFAAmF;AACnF,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAE,kBA2BlC,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,eA0C/B,CAAC;AAMF,wBAAsB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyDpF;AAwCD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAuCD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAkC/B;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqD1F;AA6ED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuB7E;AAMD,eAAO,MAAM,kBAAkB,EAAE,YAehC,CAAC;AAIF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD"}

package/dist/build/defaults.js

@@ -18,13 +18,15 @@ import { readSse } from '@kindgi/sdk/client';
 import { runJavaIndexer, runPythonIndexer } from '../dev/defaults.js';
 import { createJavaPackBuilder } from '../dev/java-builder.js';
 import { createScalaPackBuilder } from '../dev/scala-builder.js';
-import { REQUIRE_BANNER, collectPackEntries, nodeModulesExternalPlugin } from './bundle.js';
+import { REQUIRE_BANNER, collectPackEntries, nodeModulesExternalPlugin, } from './bundle.js';
+import { COMPUTED_IMPORT_LOG_OVERRIDE, computedImportsFrom } from './computed-imports.js';
 import { loadEsbuild } from '../esbuild-loader.js';
 import { readPnpmVersion } from '../package-manager.js';
 import { renderContainerfile } from './containerfile.js';
 import { BuildServiceRefusal, retryAfterSeconds } from './hosted.js';
 import { installCommands, withoutInstallScripts } from './host-install.js';
 import { renderJavaContainerfile } from './java-image.js';
+import { loadedInstall } from './loaded-install.js';
 import { renderScalaContainerfile } from './scala-image.js';
 import { renderPythonContainerfile } from './python-image.js';
 // ---------------------------------------------------------------------
@@ -110,8 +112,8 @@ export async function runLocalIndexerReal(opts) {
  *     `node_modules` (imported by name);
  *   - the framework's process entries, `kindgi-index.mjs` and
  *     `kindgi-pack-service.mjs`: self-contained, from the CLI's own
- *     `@kindgi/handler-runtime` (the pack's install has none once
- *     pruned);
+ *     `@kindgi/handler-runtime` (the image's install has none: it has
+ *     production dependencies only);
  *   - `bundle-map.json`: each primitive's source path → its bundle.
  */
 export async function esbuildBundleReal(opts) {
@@ -135,10 +137,15 @@ export async function esbuildBundleReal(opts) {
     };
     const packEntries = await collectPackEntries(opts.packDir, opts.discoveryPatterns);
     const externalPackages = new Set();
+    const externalSpecifiers = new Set();
     const externals = nodeModulesExternalPlugin({
         importBy: 'bare',
-        onExternal: (name) => externalPackages.add(name),
+        onExternal: (name, _importer, specifier) => {
+            externalPackages.add(name);
+            externalSpecifiers.add(specifier);
+        },
     });
+    const loaded = opts.dependencies === 'loaded';
     const pack = await esbuild.build({
         ...common,
         entryPoints: [
@@ -146,6 +153,8 @@ export async function esbuildBundleReal(opts) {
             { in: opts.configPath, out: 'kindgi.config' },
         ],
         plugins: [externals],
+        // Only what the pack loads: esbuild's notes on computed imports, as warnings.
+        ...(loaded && { logOverride: COMPUTED_IMPORT_LOG_OVERRIDE }),
     });
     // Resolved from the CLI's own package, whose dependency it is.
     const cliRoot = await cliPackageRoot();
@@ -155,8 +164,13 @@ export async function esbuildBundleReal(opts) {
         entryPoints: [
             { in: '@kindgi/handler-runtime/kindgi-index-main', out: 'kindgi-index' },
             { in: '@kindgi/handler-runtime/pack-service-main', out: 'kindgi-pack-service' },
+            // Only what the pack loads: the image's closure and load check.
+            ...(loaded ? [{ in: '@kindgi/handler-runtime/kindgi-closure-main', out: 'kindgi-closure' }] : []),
         ],
     });
+    if (loaded) {
+        await writeFile(join(opts.outputDir, 'externals.json'), `${JSON.stringify({ packages: [...externalPackages].sort(), specifiers: [...externalSpecifiers].sort() }, null, 2)}\n`, 'utf8');
+    }
     const bundleMap = {};
     for (const entry of packEntries)
         bundleMap[entry.sourceRel] = `${entry.outRel}.mjs`;
@@ -170,6 +184,7 @@ export async function esbuildBundleReal(opts) {
         emitted: outputs.map(([p]) => p).sort(),
         totalBytes: outputs.reduce((sum, [, o]) => sum + o.bytes, 0),
         externals: [...externalPackages].sort(),
+        computedImports: loaded ? computedImportsFrom(pack.warnings, opts.packDir) : [],
         bundleMap,
     };
 }
@@ -201,7 +216,7 @@ export async function writeContainerfileReal(opts) {
         publishedAt: opts.publishedAt,
         buildTarget: opts.buildTarget,
         install: opts.install,
-        commands: installCommands(opts.install),
+        commands: installCommands(opts.install, opts.image.steps),
         image: opts.image,
         hasIncludes: opts.hasIncludes,
     });
@@ -214,6 +229,7 @@ export async function writeContainerfileReal(opts) {
 /**
  * Write the image's build context into `contextDir` (emptied first):
  *   host/          the files the install reads, at their paths under the install root
+ *                  (with `'loaded'`, the manifest and lockfile cut down to what the pack loads)
  *   ext/           the files the build extensions read, at their paths under the install root
  *   dist/          the bundles
  *   include/       `bundle.include` files, at their pack-relative paths
@@ -225,10 +241,15 @@ export async function writeContextReal(opts) {
     await rm(opts.contextDir, { recursive: true, force: true });
     await mkdir(opts.contextDir, { recursive: true });
     const projectManifests = new Set(opts.install.projectManifests);
+    const written = opts.install.reduced?.written ?? {};
     for (const rel of opts.install.files) {
         const dest = join(opts.contextDir, 'host', rel);
         await mkdir(dirname(dest), { recursive: true });
-        if (projectManifests.has(rel)) {
+        const text = written[rel];
+        if (text !== undefined) {
+            await writeFile(dest, text, 'utf8');
+        }
+        else if (projectManifests.has(rel)) {
             // The app's own install scripts never run in the image.
             const text = await readFile(join(opts.install.root, rel), 'utf8');
             await writeFile(dest, withoutInstallScripts(text), 'utf8');
@@ -734,6 +755,7 @@ export const REAL_BUILD_RUNNERS = {
     python: PYTHON_BUILD_RUNNERS,
     jvm: JVM_BUILD_RUNNERS,
     hostPnpmVersion: readPnpmVersion,
+    loadedInstall,
 };
 // Re-export utility for callers that want a portable tmp workdir for
 // the image-pull path.