@kindgi/handler-runtime 0.0.0-bootstrap.0 → 0.1.0

package/dist/protocol.js

@@ -0,0 +1,116 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Pack protocol v2 — the messages a runtime exchanges with a pack
+ * service (`./pack-service`) to run pack code: tool handlers and
+ * guardrail checks.
+ *
+ * A request names a tool or check by id; the pack service resolves it
+ * from its own `index.json`. The caller never chooses which module is
+ * imported, and the schemas that validate input and output are the
+ * ones the pack was built with.
+ *
+ * One request, one response. Every outcome of running pack code —
+ * success, a validation failure, a throw, a deadline, an unknown tool —
+ * is a response message. Transport problems (auth, overload, draining)
+ * are HTTP statuses, never messages.
+ */
+/** Wire version of every v2 message. */
+export const PACK_PROTOCOL_VERSION = 2;
+export function packError(code, message, extra = {}) {
+    return { v: PACK_PROTOCOL_VERSION, kind: 'error', code, message, ...extra };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function checkEnvelope(value) {
+    if (!isRecord(value)) {
+        return { kind: 'err', error: packError('malformed-message', 'Message must be a JSON object') };
+    }
+    if (value.v !== PACK_PROTOCOL_VERSION) {
+        return {
+            kind: 'err',
+            error: packError('unknown-protocol-version', `Expected protocol v${PACK_PROTOCOL_VERSION}, got ${JSON.stringify(value.v)}`),
+        };
+    }
+    return { kind: 'ok', value };
+}
+function parseContext(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    if (typeof raw.tenantId !== 'string' || typeof raw.runId !== 'string')
+        return undefined;
+    return raw;
+}
+/** Parse a request body (already JSON-decoded) into a v2 request. */
+export function parsePackRequest(value) {
+    const env = checkEnvelope(value);
+    if (env.kind === 'err')
+        return env;
+    const m = env.value;
+    if (m.kind === 'invoke')
+        return parseToolInvoke(m);
+    if (m.kind === 'check-invoke')
+        return parseCheckInvoke(m);
+    return {
+        kind: 'err',
+        error: packError('unexpected-message-kind', `Unknown request kind ${JSON.stringify(m.kind)}`),
+    };
+}
+function malformed(message) {
+    return { kind: 'err', error: packError('malformed-message', message) };
+}
+function parseToolInvoke(m) {
+    const tool = m.tool;
+    if (!isRecord(tool) || typeof tool.id !== 'string' || tool.id.length === 0) {
+        return malformed('`tool.id` is required');
+    }
+    if (tool.version !== undefined && typeof tool.version !== 'string') {
+        return malformed('`tool.version` must be a string');
+    }
+    if (parseContext(m.ctx) === undefined)
+        return malformed('`ctx` needs string `tenantId` and `runId`');
+    return { kind: 'ok', value: m };
+}
+function parseCheckInvoke(m) {
+    const check = m.check;
+    if (!isRecord(check) || typeof check.id !== 'string' || check.id.length === 0) {
+        return malformed('`check.id` is required');
+    }
+    if (!isRecord(m.config))
+        return malformed('`config` must be an object');
+    return { kind: 'ok', value: m };
+}
+/** Parse a response body (already JSON-decoded) into a v2 response. */
+export function parsePackResponse(value) {
+    const env = checkEnvelope(value);
+    if (env.kind === 'err')
+        return env;
+    const m = env.value;
+    if (m.kind === 'result' || m.kind === 'check-result') {
+        return { kind: 'ok', value: m };
+    }
+    if (m.kind === 'error' && typeof m.code === 'string' && typeof m.message === 'string') {
+        return { kind: 'ok', value: m };
+    }
+    return {
+        kind: 'err',
+        error: packError('unexpected-message-kind', `Unknown response kind ${JSON.stringify(m.kind)}`),
+    };
+}
+/**
+ * HTTP headers of the v2 transport. `Authorization` is deliberately not
+ * used: on platforms like Cloud Run it carries the platform's identity
+ * token, so the pack token travels separately.
+ */
+export const PACK_HEADERS = {
+    protocol: 'kindgi-protocol',
+    token: 'kindgi-pack-token',
+    /** Relative deadline for the call, in milliseconds. */
+    timeoutMs: 'kindgi-timeout-ms',
+    runId: 'kindgi-run-id',
+    requestId: 'kindgi-request-id',
+    artifactVersion: 'kindgi-artifact-version',
+    durationMs: 'kindgi-duration-ms',
+};
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAU,CAAC;AAyFhD,MAAM,UAAU,SAAS,CACvB,IAAmB,EACnB,OAAe,EACf,QAA4E,EAAE;IAE9E,OAAO,EAAE,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,SAAS,CACd,0BAA0B,EAC1B,sBAAsB,qBAAqB,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,GAAiC,CAAC;AAC3C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IACnC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,SAAS,CAAC,yBAAyB,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B;IACjD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS;QACnC,OAAO,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAiC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,CAA0B;IAClD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAkC,EAAE,CAAC;AACnE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IACnC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAgC,EAAE,CAAC;IACjE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,iBAAiB;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,uDAAuD;IACvD,SAAS,EAAE,mBAAmB;IAC9B,KAAK,EAAE,eAAe;IACtB,SAAS,EAAE,mBAAmB;IAC9B,eAAe,EAAE,yBAAyB;IAC1C,UAAU,EAAE,oBAAoB;CACxB,CAAC"}

package/package.json

@@ -1,7 +1,90 @@
 {
   "name": "@kindgi/handler-runtime",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Placeholder so a trusted publisher can be attached. Releases are published from https://github.com/kindgi/kindgi-sdk with provenance; use 0.1.0 or later.",
+  "version": "0.1.0",
+  "description": "Runtime-side primitives for running a Kindgi pack's own code. Ships the pack service (`pack-service`, process entry `pack-service-main`) — a long-lived HTTP server that runs a pack's tool handlers and guardrail checks over pack protocol v2 (`protocol`), validating each tool call's input and output against the tool's JSON Schemas, with a local supervisor for development; and the build-time pack indexer (`kindgi-index`, process entry `kindgi-index-main`), which writes the pack's `index.json`.",
   "license": "Apache-2.0",
-  "repository": { "type": "git", "url": "git+https://github.com/kindgi/kindgi-sdk.git" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kindgi/kindgi-sdk.git",
+    "directory": "packages/handler-runtime"
+  },
+  "homepage": "https://github.com/kindgi/kindgi-sdk/tree/main/packages/handler-runtime#readme",
+  "bugs": {
+    "url": "https://github.com/kindgi/kindgi-sdk/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./protocol": {
+      "types": "./dist/protocol.d.ts",
+      "import": "./dist/protocol.js"
+    },
+    "./pack-service": {
+      "types": "./dist/pack-service/index.d.ts",
+      "import": "./dist/pack-service/index.js"
+    },
+    "./pack-service-main": {
+      "types": "./dist/pack-service/main.d.ts",
+      "import": "./dist/pack-service/main.js"
+    },
+    "./kindgi-index": {
+      "types": "./dist/kindgi-index.d.ts",
+      "import": "./dist/kindgi-index.js"
+    },
+    "./kindgi-index-main": {
+      "types": "./dist/kindgi-index-main.d.ts",
+      "import": "./dist/kindgi-index-main.js"
+    },
+    "./build-extensions": {
+      "types": "./dist/build-extensions.d.ts",
+      "import": "./dist/build-extensions.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@kindgi/flow": "0.1.0",
+    "@kindgi/sandbox": "0.1.0",
+    "@kindgi/schema": "0.1.0",
+    "@kindgi/types": "0.1.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "smol-toml": "^1.9.0"
+  },
+  "peerDependencies": {
+    "zod": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "zod": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@kindgi/specs": "0.1.0",
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8",
+    "zod": "^4.6.5"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}

package/src/build-extensions.ts

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * A TypeScript pack image's build extensions: what an app's image needs
+ * beyond installing the app's dependencies — Debian packages, a step
+ * that generates code after the install (Prisma's client), placeholder
+ * env for build steps. `image` in `kindgi.config.*`:
+ *
+ * ```ts
+ * import { prisma } from '@kindgi/sdk/build';
+ *
+ * export default {
+ *   pack: { id: 'acme.app', version: '1.0.0' },
+ *   image: {
+ *     systemPackages: ['tesseract-ocr'],
+ *     extensions: [prisma({ schema: 'prisma/schema.prisma', config: 'prisma.config.ts' })],
+ *     buildEnv: { DATABASE_URL: 'postgresql://build-placeholder' },
+ *   },
+ * };
+ * ```
+ *
+ * Data only: nothing here runs at build time. `kindgi build` renders it
+ * into the image's Containerfile — system packages in the base stage,
+ * `buildEnv` in the install stage only (never in the final image), each
+ * `postInstall` step after the install and before the prune to
+ * production, through the app's own package manager.
+ */
+
+/** A package's bin, run through the app's package manager (`pnpm exec`, `npx --no`, `yarn`). */
+export interface BuildStep {
+  readonly bin: string;
+  readonly args?: readonly string[];
+}
+
+export interface BuildExtension {
+  readonly name: string;
+  /**
+   * Files the steps read, relative to the pack folder: copied into the
+   * image's install stage, at the same paths.
+   */
+  readonly contextFiles?: readonly string[];
+  /** Debian packages the image needs. */
+  readonly systemPackages?: readonly string[];
+  /**
+   * Steps after the install, before the prune: dev dependencies (a
+   * generator's CLI) are still there. Run in the pack folder.
+   */
+  readonly postInstall?: readonly BuildStep[];
+  /**
+   * Env for the build steps, and for the indexer stage that imports the
+   * pack's modules: non-secret placeholders only. Never in the final
+   * image.
+   */
+  readonly buildEnv?: Readonly<Record<string, string>>;
+}
+
+/** `image` in `kindgi.config.*` (a TypeScript pack). */
+export interface ImageConfig {
+  /** Debian packages the image needs (as a Python pack's `[tool.kindgi.image] system-packages`). */
+  readonly systemPackages?: readonly string[];
+  readonly extensions?: readonly BuildExtension[];
+  /** Env for the build steps, merged over the extensions' (see `BuildExtension.buildEnv`). */
+  readonly buildEnv?: Readonly<Record<string, string>>;
+}
+
+/** An app's own extension: the shape checked by the type, returned as is. */
+export function defineBuildExtension(extension: BuildExtension): BuildExtension {
+  return extension;
+}
+
+export interface PrismaExtensionOptions {
+  /** The Prisma schema, relative to the pack folder. */
+  readonly schema: string;
+  /** The Prisma config file (`prisma.config.ts`), when the app has one; it names the schema. */
+  readonly config?: string;
+}
+
+/**
+ * Prisma's generated client in the image. The app's own `postinstall:
+ * prisma generate` doesn't run (the image installs with scripts off), so
+ * this copies the schema (and config) in and runs `prisma generate` after
+ * the install, with the app's `prisma` CLI.
+ */
+export function prisma(options: PrismaExtensionOptions): BuildExtension {
+  return {
+    name: 'prisma',
+    contextFiles:
+      options.config !== undefined ? [options.schema, options.config] : [options.schema],
+    postInstall: [
+      {
+        bin: 'prisma',
+        args:
+          options.config !== undefined
+            ? ['generate', '--config', options.config]
+            : ['generate', '--schema', options.schema],
+      },
+    ],
+  };
+}

package/src/discovery.ts

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * Discovery-glob primitives shared by the indexer and anything that
+ * watches a pack (a dev watch loop) — so "which files are primitives"
+ * has one answer.
+ *
+ * Supported syntax: `**` (any depth, including none), `*` (within one
+ * segment), `?` (one character), `{a,b,c}` alternation. Negations and
+ * extglobs are not supported.
+ *
+ * Every pattern has a **static prefix** — the directory segments before
+ * the first wildcard (`kindgi/tools/**\/*.ts` → `kindgi/tools`). Walking
+ * or watching only that prefix matters when a pack lives inside a large
+ * application: the indexer must not crawl the whole host repo to find
+ * `kindgi/**`.
+ */
+
+const GLOB_CHARS = /[*?{[]/;
+
+/** Test / spec files sit next to primitives and are never primitives. */
+export const TEST_FILE_REGEX = /\.(test|spec)\.(ts|js|mjs|cjs)$/;
+
+/** Compile a discovery pattern to an anchored RegExp over `/`-separated relative paths. */
+export function globToRegex(pattern: string): RegExp {
+  let re = '';
+  let i = 0;
+  while (i < pattern.length) {
+    const [piece, next] = globToken(pattern, i);
+    re += piece;
+    i = next;
+  }
+  return new RegExp(`^${re}$`);
+}
+
+/** The regex source for the token at `i`, and the index after it. */
+function globToken(pattern: string, i: number): readonly [string, number] {
+  const c = pattern.charAt(i);
+  if (c === '*' && pattern.charAt(i + 1) === '*') {
+    // `**/` may match zero segments; a trailing `**` matches anything.
+    return pattern.charAt(i + 2) === '/' ? ['(?:.*/)?', i + 3] : ['.*', i + 2];
+  }
+  if (c === '*') return ['[^/]*', i + 1];
+  if (c === '?') return ['[^/]', i + 1];
+  const close = c === '{' ? pattern.indexOf('}', i) : -1;
+  if (close !== -1) {
+    const options = pattern
+      .slice(i + 1, close)
+      .split(',')
+      .map(escapeRegex);
+    return [`(?:${options.join('|')})`, close + 1];
+  }
+  return [escapeRegex(c), i + 1];
+}
+
+function escapeRegex(s: string): string {
+  return s.replace(/[.+^$()|[\]\\{}]/g, '\\$&');
+}
+
+/**
+ * Directory prefix before the first wildcard segment, `''` for the pack
+ * root. A pattern without wildcards names a file; its prefix is that
+ * file's directory.
+ */
+export function globStaticPrefix(pattern: string): string {
+  const segments = pattern.split('/');
+  const firstGlob = segments.findIndex((s) => GLOB_CHARS.test(s));
+  const dirSegments = firstGlob === -1 ? segments.slice(0, -1) : segments.slice(0, firstGlob);
+  return dirSegments.filter((s) => s !== '' && s !== '.').join('/');
+}
+
+/**
+ * The directories to walk or watch for a set of patterns: each pattern's
+ * static prefix, with any prefix inside another one dropped. `['']`
+ * means the pack root.
+ */
+export function discoveryRoots(patterns: readonly string[]): readonly string[] {
+  const prefixes = [...new Set(patterns.map(globStaticPrefix))].sort();
+  return prefixes.filter(
+    (p) => !prefixes.some((other) => other !== p && (other === '' || p.startsWith(`${other}/`))),
+  );
+}
+
+/** `(relPath) => true` when the path matches any pattern and is not a test file. */
+export function createGlobMatcher(patterns: readonly string[]): (relPath: string) => boolean {
+  const regexes = patterns.map(globToRegex);
+  return (relPath) => !TEST_FILE_REGEX.test(relPath) && regexes.some((r) => r.test(relPath));
+}

package/src/entrypoint.ts

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+import { realpathSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+/**
+ * Whether the module at `moduleUrl` is the process entrypoint (`node <file>`).
+ *
+ * Node resolves symlinks for the main module's `import.meta.url` but leaves
+ * `process.argv[1]` as given, so the two are compared through the real path:
+ * a package started through `node_modules/@kindgi/…` (a pnpm symlink) still
+ * runs its `main()`.
+ */
+export function isProcessEntrypoint(moduleUrl: string): boolean {
+  const entry = process.argv[1];
+  if (entry === undefined) return false;
+  try {
+    return moduleUrl === pathToFileURL(realpathSync(entry)).href;
+  } catch {
+    return false;
+  }
+}