@kitman-sh/cli 0.10.74 → 0.10.76

package/dist/{chunk-1rry0tsn.js → chunk-98sg1yyd.js}

@@ -22,7 +22,7 @@ import {
   map8,
   raceFirst,
   scoped
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   unwrap,
   drainFork,
@@ -31,7 +31,7 @@ import {
   runCollect,
   runDrain,
   mkString
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/internal/redacted.js
 var redactedRegistry = /* @__PURE__ */ new WeakMap;

package/dist/{chunk-60333x3q.js → chunk-9zd52pda.js}

@@ -7,11 +7,11 @@ import {
   decoded2,
   readOpencode2,
   runOpencodeReader2
-} from "./chunk-csbf77zs.js";
-import"./chunk-1rry0tsn.js";
-import"./chunk-v01c0k6j.js";
-import"./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-e8zm8z3a.js";
+import"./chunk-98sg1yyd.js";
+import"./chunk-tzz4fv17.js";
+import"./chunk-xb70ys3n.js";
+import"./chunk-jbwk6k6m.js";
 export {
   decoded2 as decoded,
   decodedOption2 as decodedOption,

package/dist/{chunk-3edjgnxf.js → chunk-b0cscqbw.js}

@@ -1,6 +1,8 @@
 // @bun
 import {
+  getOrElse,
   getOrUndefined,
+  liftThrowable,
   flatMap,
   toArray,
   decodeUnknownOption,
@@ -11,11 +13,11 @@ import {
   ArraySchema,
   decodeJsonStringOption,
   encodeUnknownJsonStringSync
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   replaceSecretReferences,
   secretReferencesIn
-} from "./chunk-rrnee9mk.js";
+} from "./chunk-545b129z.js";
 
 // packages/agent-runtime/src/srt-step.ts
 import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";
@@ -40,6 +42,20 @@ if (false)
 
 // packages/agent-runtime/src/secret-proxy.ts
 var basicPrefix = /^basic\s+/i;
+var tokenIssuingEndpoints = [
+  { path: "/copilot_internal/v2/token" },
+  { path: "/auto", hosts: ["*.githubcopilot.com", "api.githubcopilot.com"] },
+  { path: "/api/oauth/claude_cli/create_api_key" }
+];
+var normalizedPath = (target) => {
+  const path = (URL.canParse(target) ? new URL(target).pathname : target).split(/[?#]/, 1)[0] ?? "";
+  const decoded = getOrElse(liftThrowable(decodeURIComponent)(path), () => path);
+  return `/${decoded.toLowerCase().split("/").filter(Boolean).join("/")}`;
+};
+var issuesTokens = (request) => {
+  const path = normalizedPath(request.target);
+  return tokenIssuingEndpoints.some((endpoint) => (path === endpoint.path || path.startsWith(`${endpoint.path}/`)) && (endpoint.hosts === undefined || egressAllowed(endpoint.hosts, request.host, request.port)));
+};
 var basicCredential = (value) => {
   if (!basicPrefix.test(value))
     return;
@@ -63,13 +79,19 @@ var decideSecretRequest = (request, readRegistry) => {
   if (carrying.length === 0 && inTarget.length === 0)
     return { action: "allow" };
   const registry = readRegistry();
+  const carried = [...new Set(carrying.flatMap((header) => header.references))];
   const refusals = [
     ...inTarget.map((reference) => ({
       reference,
       host: request.host,
       reason: "A reference is swapped only in a header, never in a URL."
     })),
-    ...[...new Set(carrying.flatMap((header) => header.references))].flatMap((reference) => {
+    ...issuesTokens(request) ? carried.map((reference) => ({
+      reference,
+      host: request.host,
+      reason: "This endpoint answers with a new token, which the Runner obtains itself outside the sandbox."
+    })) : [],
+    ...carried.flatMap((reference) => {
       const entry = registry?.[reference];
       const reason = entry === undefined ? "The reference is unknown or revoked." : request.scheme !== "https" ? "A reference is swapped only over HTTPS." : !egressAllowed(entry.hosts, request.host, request.port) ? `The Secret may be sent only to ${entry.hosts.join(", ")}.` : undefined;
       return reason === undefined ? [] : [{ reference, host: request.host, reason }];

package/dist/{chunk-g4fvd8r1.js → chunk-bcbne0ek.js}

@@ -248,7 +248,7 @@ import {
   decodeJsonStringOption,
   encodeJsonStringSync,
   encodePrettyJsonString
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   map,
   makeEquivalence,
@@ -315,7 +315,7 @@ import {
   String2,
   optionalEnv,
   harnessesUnsupportedInSrt2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   isDateTime,
   Numeric,
@@ -327,7 +327,7 @@ import {
   SecretName,
   SecretScope,
   SecretHosts
-} from "./chunk-rrnee9mk.js";
+} from "./chunk-545b129z.js";
 import {
   toJsonValue,
   isOneOf,
@@ -341,7 +341,7 @@ import {
   isSymbol,
   isUndefined,
   kindOf
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   isRedacted,
   make,
@@ -355,7 +355,7 @@ import {
   make3,
   parseFdName,
   fdName
-} from "./chunk-1rry0tsn.js";
+} from "./chunk-98sg1yyd.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Tuple.js
 var makeEquivalence3 = Tuple;
@@ -2958,6 +2958,7 @@ var setAll2 = /* @__PURE__ */ dual(2, (self, input) => {
   }
   return make23(params);
 });
+var toString = (input) => new URLSearchParams(fromInput2(input).params.map(([key, value]) => [key, unwrap3(value)])).toString();
 var redact3 = /* @__PURE__ */ dual(2, (self, key) => {
   const patterns = Array.isArray(key) ? key : [key];
   return self.params.map(([name, value]) => [name, typeof value === "string" && isRedactedName2(name, patterns) ? make(value) : value]);
@@ -9374,6 +9375,18 @@ var uint8Array = (body, contentType) => new Uint8Array2(body, contentType ?? "ap
 var encoder = /* @__PURE__ */ new TextEncoder;
 var buffer = globalThis.Buffer;
 var encodeText = buffer !== undefined ? (body) => buffer.from(body, "utf8") : (body) => encoder.encode(body);
+var text = (body, contentType) => {
+  if (typeof body !== "string") {
+    body = body === undefined ? "" : String(body);
+  }
+  if (buffer !== undefined) {
+    return new Uint8Array2(undefined, contentType ?? "text/plain", buffer.byteLength(body, "utf8"), body);
+  }
+  const bytes = encoder.encode(body);
+  return new Uint8Array2(bytes, contentType ?? "text/plain", bytes.length, body);
+};
+var jsonUnsafe = (body, contentType) => text(JSON.stringify(body), contentType ?? "application/json");
+var urlParams = (urlParams, contentType) => text(toString(fromInput2(urlParams)), contentType ?? "application/x-www-form-urlencoded");
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/http/HttpClientError.js
 var TypeId9 = "~effect/http/HttpClientError";
@@ -9593,6 +9606,7 @@ var make5 = (method) => (url, options) => modify(empty6, {
   ...options ?? undefined
 });
 var get = /* @__PURE__ */ make5("GET");
+var post = /* @__PURE__ */ make5("POST");
 var put = /* @__PURE__ */ make5("PUT");
 var modify = /* @__PURE__ */ dual(2, (self, options) => {
   let result = self;
@@ -9644,6 +9658,8 @@ var setBody = /* @__PURE__ */ dual(2, (self, body) => {
   return makeWith(self.method, self.url, self.urlParams, self.hash, updateHeaders(self.headers, body), body);
 });
 var bodyUint8Array = /* @__PURE__ */ dual((args) => isHttpClientRequest(args[0]), (self, body, contentType) => setBody(self, uint8Array(body, contentType)));
+var bodyJsonUnsafe = /* @__PURE__ */ dual(2, (self, body) => setBody(self, jsonUnsafe(body)));
+var bodyUrlParams = /* @__PURE__ */ dual(2, (self, input) => setBody(self, urlParams(fromInput2(input))));
 function toUrl(self) {
   const r = make26(self.url, self.urlParams, getOrUndefined(self.hash));
   if (isSuccess(r)) {
@@ -15580,4 +15596,4 @@ function checkServices(declaration) {
   return isSome(decoded) ? [...new Set(decoded.value.services)] : undefined;
 }
 
-export { Clock, currentTimeMillis, WebCrypto, SecureRandom, layerWebCrypto, makeUnsafe, formatIso, empty, fromInput, merge, runMain, layer, layer2, Stdio, Terminal, layer3, error, log, toDate, parseDate, toIso, currentDate, wallClockMillis, waitingOnWords, queueWords, scanDurableSurface, redactResponseSurface, redactCredentials, redactedOutputTail, SafeJson, AgentHarnessIds, AgentSkillRequirement, AgentMcpServerRequirement, AgentEnvironmentFragment, findForbiddenAgentEnvironmentSecretPath, RepoBindingProviders, RepoBindingCredentialProviderTypes, findForbiddenRepoBindingSecretPath, AgentSandboxNetwork, runnerAgentSandboxPolicy, agentNetworkAllowlist, verificationNetworkAllowlist, programNetworkHosts, ContextPackModes, DefaultContextPackMode, ProposalStatuses, ProposalTargetTypes, canonicalJson, canonicalSha256, AgentEfforts, AgentCapabilities, LoopDataSchemaRef, RunDisplayStates, LoopVersion, ProgramLoop, AgentFallback, isTestReportName, checkTests, ProgramWorkUnit, MeasureSample, MeasureEvidence, catchUpPathLimit, CatchUp, RunnerOwnership, defaultRunnerCapabilities, MemoryStatuses, MemoryScopes, MaxMemoryListLimit, DecisionStatuses, Session, SessionEnd, SessionUpdate, SessionUpdateCreate, FixFlowRecoveryActions, KitmanAgentCapabilityNames, sha2562, isRunFileRefusalReason, runFileRefusalWords, RunFileRefused, runFileContentType, repositoryKey, createId, digestSha256, digestSha512, digestWith, sha256Hasher, AgentEvent, raw, make5, get, put, setHeaders, bodyUint8Array, schemaBodyJson, filterStatusOk, HttpClient, execute, get2, Fetch, layer4, Socket, SocketReadError, SocketError, WebSocketConstructor, layerWebSocketConstructorGlobal, layerWebSocket, runDisplayLabels, listedSummary, KitName, KitDigest, defaultKitName, KitSetup, SetupArchive, kitMcpSecretNames, kitmanMcpServer, KitmanClientError, KitmanEffectClient, CliError, DefaultApiUrl, resolveConfig, apiUrlFromEnv, stepCredentialFromEnv, stepWorkspaceFromEnv, stepSkillsDirFromEnv, stepFittingSkillsFromEnv, stepOutputOnlyFromEnv, mcpCredentialNameFromEnv, userConfigPath, userAuthPath, userHarnessSyncPath, kitSetupCacheDir, bundleCacheDir, localConfigPath, readUserConfig, writeUserConfig, sessionForApi, readAuthStore, storeSession, removeSession, removeAllSessions, agentCredentialForApi, storeAgentCredential, removeAgentCredential, normalizeApiUrl, isStoredAgentCredential, isStreamSchema, getStreamSchemas, make6, exitSchema, ParseOptions, RpcClientDefect, RpcClientError, make7, Service, RunnerHeaders, RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, UpdateAvailable, RunnerReplicaRpcs, RunnerRunFileRpcs, ProgramRpcs, parseCallbackUrl, revokeToken, toStoredSession, browserLogin, openBrowser, shouldRefresh, createSdkClient, refreshSession, AgentAuthClientError, executeAgentCapability, createAgentAuthBearerToken, McpPlatformLive, runMcpEffect, createAgentAuthSignedFetch, setupMcpAgentCredential, generateAgentKeyPair, HERDR_CORE_GENERATION2, HERDR_CORE_INSTALL_COMMAND2, HerdrCoreMissing2, HerdrCoreIncompatible2, HerdrCoreConnectionLost2, HerdrCoreRpcError2, HerdrCoreUpdateFailed2, HerdrCore2, herdrCoreLayer2, herdrCoreTransportLayer2, updateHerdrCore2, CommandFailed2, runCommand2, withoutPreloads2, shellOutputTailChars2, runProcess2, CommandRunner2, runShell2, detectHarnesses2, kitHarnesses, isKitHarness, instructionsStart, instructionsEnd, harnessNames, renderMcpServer, materializeKitSetup, tomlInline, herdrExecutionExtension2, herdrNativeExtensionIds2, herdrRunnerCapabilitiesForRepoBinding2, herdrRunnerCapabilities2, assertHerdrRunnerCapability2, declaredChecks, installCommand, checkServicesFile, checkServices };
+export { Clock, currentTimeMillis, WebCrypto, SecureRandom, layerWebCrypto, makeUnsafe, formatIso, empty, fromInput, merge, runMain, layer, layer2, Stdio, Terminal, layer3, error, log, toDate, parseDate, toIso, currentDate, wallClockMillis, waitingOnWords, queueWords, scanDurableSurface, redactResponseSurface, redactCredentials, redactedOutputTail, SafeJson, AgentHarnessIds, AgentSkillRequirement, AgentMcpServerRequirement, AgentEnvironmentFragment, findForbiddenAgentEnvironmentSecretPath, RepoBindingProviders, RepoBindingCredentialProviderTypes, findForbiddenRepoBindingSecretPath, AgentSandboxNetwork, runnerAgentSandboxPolicy, agentNetworkAllowlist, verificationNetworkAllowlist, programNetworkHosts, ContextPackModes, DefaultContextPackMode, ProposalStatuses, ProposalTargetTypes, canonicalJson, canonicalSha256, AgentEfforts, AgentCapabilities, LoopDataSchemaRef, RunDisplayStates, LoopVersion, ProgramLoop, AgentFallback, isTestReportName, checkTests, ProgramWorkUnit, MeasureSample, MeasureEvidence, catchUpPathLimit, CatchUp, RunnerOwnership, defaultRunnerCapabilities, MemoryStatuses, MemoryScopes, MaxMemoryListLimit, DecisionStatuses, Session, SessionEnd, SessionUpdate, SessionUpdateCreate, FixFlowRecoveryActions, KitmanAgentCapabilityNames, sha2562, isRunFileRefusalReason, runFileRefusalWords, RunFileRefused, runFileContentType, repositoryKey, createId, digestSha256, digestSha512, digestWith, sha256Hasher, AgentEvent, raw, make5, get, post, put, setHeaders, acceptJson, bodyUint8Array, bodyJsonUnsafe, bodyUrlParams, schemaBodyJson, filterStatusOk, HttpClient, execute, get2, Fetch, layer4, Socket, SocketReadError, SocketError, WebSocketConstructor, layerWebSocketConstructorGlobal, layerWebSocket, runDisplayLabels, listedSummary, KitName, KitDigest, defaultKitName, KitSetup, SetupArchive, kitMcpSecretNames, kitmanMcpServer, KitmanClientError, KitmanEffectClient, CliError, DefaultApiUrl, resolveConfig, apiUrlFromEnv, stepCredentialFromEnv, stepWorkspaceFromEnv, stepSkillsDirFromEnv, stepFittingSkillsFromEnv, stepOutputOnlyFromEnv, mcpCredentialNameFromEnv, userConfigPath, userAuthPath, userHarnessSyncPath, kitSetupCacheDir, bundleCacheDir, localConfigPath, readUserConfig, writeUserConfig, sessionForApi, readAuthStore, storeSession, removeSession, removeAllSessions, agentCredentialForApi, storeAgentCredential, removeAgentCredential, normalizeApiUrl, isStoredAgentCredential, isStreamSchema, getStreamSchemas, make6, exitSchema, ParseOptions, RpcClientDefect, RpcClientError, make7, Service, RunnerHeaders, RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, UpdateAvailable, RunnerReplicaRpcs, RunnerRunFileRpcs, ProgramRpcs, parseCallbackUrl, revokeToken, toStoredSession, browserLogin, openBrowser, shouldRefresh, createSdkClient, refreshSession, AgentAuthClientError, executeAgentCapability, createAgentAuthBearerToken, McpPlatformLive, runMcpEffect, createAgentAuthSignedFetch, setupMcpAgentCredential, generateAgentKeyPair, HERDR_CORE_GENERATION2, HERDR_CORE_INSTALL_COMMAND2, HerdrCoreMissing2, HerdrCoreIncompatible2, HerdrCoreConnectionLost2, HerdrCoreRpcError2, HerdrCoreUpdateFailed2, HerdrCore2, herdrCoreLayer2, herdrCoreTransportLayer2, updateHerdrCore2, CommandFailed2, runCommand2, withoutPreloads2, shellOutputTailChars2, runProcess2, CommandRunner2, runShell2, detectHarnesses2, kitHarnesses, isKitHarness, instructionsStart, instructionsEnd, harnessNames, renderMcpServer, materializeKitSetup, tomlInline, herdrExecutionExtension2, herdrNativeExtensionIds2, herdrRunnerCapabilitiesForRepoBinding2, herdrRunnerCapabilities2, assertHerdrRunnerCapability2, declaredChecks, installCommand, checkServicesFile, checkServices };

package/dist/{chunk-8bhea26e.js → chunk-e3dmkypq.js}

@@ -23,24 +23,24 @@ import {
   fnUntraced,
   encodePrettyJsonString,
   decodeJsonStringSync
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   isJsonObject,
   isString
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   FileSystem,
   Path,
   optionalEnv
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   AgentHarnessIds,
   sha2562,
   runCommand2
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 import {
   NpmRegistry
-} from "./chunk-2v7pbpfw.js";
+} from "./chunk-fqhxxxmp.js";
 
 // packages/agent-runtime/src/config-convergence.ts
 var writeAgentEnvironmentConfigFile2 = fnUntraced(function* (file, content, keep = {}) {

package/dist/{chunk-csbf77zs.js → chunk-e8zm8z3a.js}

@@ -22,21 +22,21 @@ import {
   NullOr,
   Finite,
   encodeUnknownJsonStringSync
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   isNumber,
   isJsonObject,
   isString
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   make11,
   runForEach,
   compiled2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-1rry0tsn.js";
+} from "./chunk-98sg1yyd.js";
 
 // packages/agent-runtime/src/opencode-store.ts
 import { lstatSync, readFileSync, realpathSync } from "fs";

package/dist/{chunk-3ne401fy.js → chunk-f0stxany.js}

@@ -102,7 +102,7 @@ import {
   decodeJsonStringOption,
   encodeJsonStringSync,
   encodePrettyJsonString
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   currentTimeMillis,
   SecureRandom,
@@ -153,13 +153,13 @@ import {
   runMcpEffect,
   createAgentAuthSignedFetch,
   setupMcpAgentCredential
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 import {
   guard,
   Id,
   Timestamp,
   ActorType
-} from "./chunk-rrnee9mk.js";
+} from "./chunk-545b129z.js";
 import {
   toJsonValue,
   isOneOf,
@@ -173,7 +173,7 @@ import {
   isJsonObject,
   isString,
   kindOf
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   join,
   interrupt,
@@ -187,17 +187,17 @@ import {
   withDefault,
   option,
   String2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   nextInt
-} from "./chunk-q3c7vmby.js";
+} from "./chunk-76ctrqm6.js";
 import {
   layerJson,
   make4,
   withHeaders,
   layerProtocolSocket,
   ConnectionHooks
-} from "./chunk-ggax0n15.js";
+} from "./chunk-3teaa3qx.js";
 
 // apps/cli/src/mcp.ts
 import { tmpdir } from "os";

package/dist/{chunk-rm83dbpv.js → chunk-fq47a5yd.js}

@@ -14,8 +14,8 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-xb70ys3n.js";
+import"./chunk-jbwk6k6m.js";
 export {
   compiled2 as compiled,
   harnessesUnsupportedInSrt2 as harnessesUnsupportedInSrt,

package/dist/{chunk-2v7pbpfw.js → chunk-fqhxxxmp.js}

@@ -24,11 +24,11 @@ import {
   Record,
   Int,
   fromJsonString
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   withDefault,
   String2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   digestSha256,
   digestSha512,
@@ -38,7 +38,7 @@ import {
   get2,
   layer4,
   KitDigest
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 
 // packages/core/src/npm-registry.ts
 var KitManifest = Struct({

package/dist/{chunk-mzphfkyk.js → chunk-h3y4z2c0.js}

@@ -4,13 +4,13 @@ import {
   runnerRpcUrl2,
   makeRunnerRpcClient2,
   makeProgramRpcClient2
-} from "./chunk-xz1z7j2d.js";
-import"./chunk-ggax0n15.js";
-import"./chunk-g4fvd8r1.js";
-import"./chunk-rrnee9mk.js";
-import"./chunk-v01c0k6j.js";
-import"./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-p8g8qyev.js";
+import"./chunk-3teaa3qx.js";
+import"./chunk-bcbne0ek.js";
+import"./chunk-545b129z.js";
+import"./chunk-tzz4fv17.js";
+import"./chunk-xb70ys3n.js";
+import"./chunk-jbwk6k6m.js";
 export {
   makeProgramRpcClient2 as makeProgramRpcClient,
   makeRunnerRpcClient2 as makeRunnerRpcClient,

package/dist/{chunk-yzm5s3ng.js → chunk-jb01khjp.js}

@@ -75,10 +75,10 @@ import {
   toEquivalence,
   toCodecJson,
   Json
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   guard
-} from "./chunk-rrnee9mk.js";
+} from "./chunk-545b129z.js";
 import {
   currentTimeMillis,
   WebCrypto,
@@ -105,11 +105,11 @@ import {
   KitDigest,
   KitSetup,
   RunnerRpcError
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 import {
   runForEach,
   FileSystem
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/crypto/internal/webCrypto.js
 var subtleUnavailable = () => new Error("crypto.subtle is unavailable; browsers expose it only in secure contexts");

package/dist/{chunk-d3ksv8y1.js → chunk-jbwk6k6m.js}

@@ -1506,7 +1506,7 @@ var Number2 = /* @__PURE__ */ make((self, that) => {
   return self < that ? -1 : 1;
 });
 var mapInput = /* @__PURE__ */ dual(2, (self, f) => make((b1, b2) => self(f(b1), f(b2))));
-var isGreaterThan = (O) => dual(2, (self, that) => O(self, that) === 1);
+var isGreaterThan2 = (O) => dual(2, (self, that) => O(self, that) === 1);
 var isLessThanOrEqualTo2 = (O) => dual(2, (self, that) => O(self, that) !== 1);
 var isGreaterThanOrEqualTo2 = (O) => dual(2, (self, that) => O(self, that) !== -1);
 var min3 = (O) => dual(2, (self, that) => self === that || O(self, that) < 1 ? self : that);
@@ -1536,7 +1536,7 @@ var liftThrowable = (f) => (...a) => {
 var map4 = /* @__PURE__ */ dual(2, (self, f) => isNone(self) ? none() : some(f(self.value)));
 var flatMap = /* @__PURE__ */ dual(2, (self, f) => isNone(self) ? none() : f(self.value));
 var toArray = (self) => isNone(self) ? [] : [self.value];
-var filter = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
+var filter2 = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Context.js
 var ServiceTypeId = "~effect/Context/Service";
@@ -4472,7 +4472,7 @@ var forEachConcurrent = /* @__PURE__ */ iterateConcurrentImpl({
   }
 });
 var filterOrElse = /* @__PURE__ */ dual(3, (self, predicate, orElse) => flatMap2(self, (a) => predicate(a) ? succeed2(a) : orElse(a)));
-var filter3 = /* @__PURE__ */ dual((args) => isIterable(args[0]) && !isEffect2(args[0]), (elements, predicate, options) => map7(forEach2(elements, (a, i) => {
+var filter = /* @__PURE__ */ dual((args) => isIterable(args[0]) && !isEffect2(args[0]), (elements, predicate, options) => map7(forEach2(elements, (a, i) => {
   const result = predicate(a, i);
   if (typeof result === "boolean") {
     return succeed2(result ? some(a) : none());
@@ -4948,7 +4948,7 @@ var logLevelToOrder = (level) => {
   }
 };
 var LogLevelOrder = /* @__PURE__ */ mapInput(Number2, logLevelToOrder);
-var isLogLevelGreaterThan = /* @__PURE__ */ isGreaterThan(LogLevelOrder);
+var isLogLevelGreaterThan = /* @__PURE__ */ isGreaterThan2(LogLevelOrder);
 var CurrentLoggers = /* @__PURE__ */ Reference("effect/Logger/CurrentLoggers", {
   defaultValue: () => new Set([defaultLogger, tracerLogger])
 });
@@ -5650,7 +5650,7 @@ var delay = delay2;
 var sleep = sleep2;
 var raceAllFirst = raceAllFirst2;
 var raceFirst = raceFirst2;
-var filter2 = filter3;
+var filter3 = filter;
 var filterOrFail = filterOrFail2;
 var when = when2;
 var matchCauseEffect = matchCauseEffect2;
@@ -6209,7 +6209,7 @@ function omit2() {
 }
 function withDefault(defaultValue) {
   return transformOptionalEffect((o) => {
-    const filtered = filter(o, isNotUndefined);
+    const filtered = filter2(o, isNotUndefined);
     return isSome(filtered) ? succeed6(filtered) : mapEager(defaultValue, some);
   });
 }
@@ -9364,6 +9364,22 @@ function isBase64(annotations) {
   });
 }
 var Finite = /* @__PURE__ */ make17(finite);
+function makeIsGreaterThan(options) {
+  const gt = isGreaterThan2(options.order);
+  const formatter = options.formatter ?? format;
+  return (exclusiveMinimum, annotations) => {
+    return makeFilter((input) => gt(input, exclusiveMinimum), {
+      expected: `a value greater than ${formatter(exclusiveMinimum)}`,
+      arbitraryConstraint: {
+        order: options.order,
+        minimum: exclusiveMinimum,
+        exclusiveMinimum: true
+      },
+      ...options.annotate?.(exclusiveMinimum),
+      ...annotations
+    });
+  };
+}
 function makeIsGreaterThanOrEqualTo(options) {
   const gte = isGreaterThanOrEqualTo2(options.order);
   const formatter = options.formatter ?? format;
@@ -9400,6 +9416,23 @@ function encodeNumberPayload(number) {
   }
   return number;
 }
+var isGreaterThan = /* @__PURE__ */ makeIsGreaterThan({
+  order: Number2,
+  annotate: (exclusiveMinimum) => ({
+    representation: {
+      id: "effect/schema/isGreaterThan",
+      payload: {
+        exclusiveMinimum: encodeNumberPayload(exclusiveMinimum)
+      }
+    },
+    toJsonSchema: () => ({
+      exclusiveMinimum
+    }),
+    toCode: () => ({
+      runtime: `Schema.isGreaterThan(${format(exclusiveMinimum)})`
+    })
+  })
+});
 var isGreaterThanOrEqualTo = /* @__PURE__ */ makeIsGreaterThanOrEqualTo({
   order: Number2,
   annotate: (minimum) => ({
@@ -9491,6 +9524,9 @@ function makeIsMinLength(minLength, minCodePoints, annotations) {
     ...annotations
   });
 }
+function isNonEmpty(annotations) {
+  return makeIsMinLength(1, 1, annotations);
+}
 function isMaxLength(maxLength, annotations) {
   maxLength = normalizeCardinality(maxLength);
   return makeFilter((input) => input.length <= maxLength, {
@@ -9602,6 +9638,7 @@ function isUnique(annotations) {
     ...annotations
   });
 }
+var NonEmptyString = /* @__PURE__ */ String4.check(/* @__PURE__ */ isNonEmpty());
 var getErrorOptionsKey = (options) => (options?.includeStack === true ? 1 : 0) | (options?.excludeCause === true ? 2 : 0);
 var getErrorOptions = (key) => {
   switch (key) {
@@ -10121,4 +10158,4 @@ var encodePrettyJsonString = encodeEffect(fromJsonString(Json, { space: 2 }));
 var decodeJsonStringSync = decodeUnknownSync(JsonFromString);
 var encodeUnknownJsonStringSync = encodeSync(fromJsonString(Unknown));
 
-export { pipeArguments, dual, identity, constant, constTrue, constFalse, constVoid, pipe, flow, memoize, isString2, isNumber2, isBoolean2, isBigInt2, isSymbol2, isFunction2, isUndefined2, isNotUndefined, isNotNull, isNullish, isObjectOrArray, isObject2, hasProperty, isTagged, isUint8Array, symbol, hash, combine, number, string, structure, array, symbol2, equals, asEquivalence, symbolRedactable, redact, currentFiberTypeId, format, NodeInspectSymbol, toJson, BaseProto, Class, getStackTraceLimit, setStackTraceLimit, assignProperty, args, evaluate, PipeInspectableProto, isExit, causeFail, makePrimitive, exitSucceed, exitFailCause, exitFail, withFiber, Done, Prototype, make14, strictEqual, Tuple, String3, Number2, mapInput, none, some, isNone, isSome, match, getOrElse, orElse, fromNullishOr, fromUndefinedOr, getOrUndefined, liftThrowable, map4, flatMap, toArray, Service2, makeUnsafe4, empty3, make15, add, getOrUndefined2, getOrUndefinedUnsafe, getUnsafe, get4, merge3, Reference, fromInputUnsafe, isFinite, zero, infinity, millis, seconds, minutes, toMillis, min, max, subtract, format2, normalize, succeed, fail3, try_, isResult, isFailure, isSuccess, map5, getOrElse2, getOrThrow, all2, allocate, fromIterable, isArrayNonEmpty, isReadonlyArrayNonEmpty, isCanonicalArrayIndex, getUnsafe2, sort, of, map6, makeEquivalence2, TaggedClass, Error2, TaggedError, encode, DisablePropagation, getCurrentFiber, fiberJoin, fiberInterrupt, succeed2, sync, suspend2, succeedNone, void_, callback2, asSome, andThen, flatMap2, map7, exitInterrupt, exitVoid, exitZipRight, scopeAddFinalizer, scope, onExitPrimitive, onExitUnsafe, uninterruptibleMask, fiberRunIn, makeLatchUnsafe, makeLatch, ClockRef, currentTimeMillis2, ConsoleRef, succeed3, failCause2, fail4, die, interrupt2, void_2, isSuccess2, isFailure2, hasInterrupts, asVoidAll, makeUnsafe5, make16, _await, fail5, interruptWith, isDone, isDoneUnsafe, succeed4, doneUnsafe, TracerTimingEnabled, Scope, makeUnsafe6, provide, addFinalizerExit, addFinalizer, forkUnsafe, close, build, buildWithScope, succeed5, effect, effectContext, effectDiscard, mergeAll, provide2, provideMerge, isCause, isFailReason, isDieReason, fromReasons, fail6, die2, makeFailReason, makeDieReason, hasInterruptsOnly, squash, findError, findErrorOption, hasInterrupts2, interruptors, pretty, isDone2, Done2, done, IllegalArgumentError, UnknownError, reasonAnnotations, Random, catchDone, isDoneCause, filterDone, doneExitFromCause, matchEffect, max2, during, min2, exponential, jittered, spaced, isEffect, all3, findFirst, forEach, whileLoop, promise, tryPromise, succeed6, suspend3, sync2, void_3, undefined_, callback3, never, gen, fail7, failSync, failCause3, die3, try_2, yieldNow, withFiber2, fromResult, fromNullishOr2, flatMap3, flatten, andThen2, tap2, result, option2, exit, map8, as, asSome2, asVoid, zipWith, catch_, catchTag, catchTags, catchReason, catchCause2, catchDefect, catchIf, catchCauseIf, mapError2, orDie, tapError2, tapCause, retry, retryOrElse, ignore, ignoreCause, orElseSucceed, timeout, timeoutOption, timeoutOrElse, delay, sleep, raceAllFirst, raceFirst, filter2, filterOrFail, when, matchCauseEffect, matchEffect2, context, contextWith, provide3, provideContext2, service, serviceOption, updateContext, updateService, provideService, scope2, scoped, scopedWith, acquireRelease, acquireUseRelease, addFinalizer2, ensuring2, onError, onExitPrimitive2, onExit, cached, interrupt3, interruptible, onInterrupt, uninterruptible, uninterruptibleMask2, forever, repeat, annotateCurrentSpan, makeSpanScoped, useSpan, withSpan, withParentSpan, forkChild, forkIn, forkScoped, forkDetach, runFork, runForkWith, runPromise, runPromiseWith, runSync, runSyncExitWith, fnUntraced, fn, clockWith, logWarning, logError, annotateLogs, effectify, mapEager, flatMapEager, catchEager, encode2, decode, Pointer, makeFormatterStandardSchemaV1, passthrough, transformEffect, Transformation, transform, defaultParseOptions, unknown, getIndexSignatureKeys, applyToSelfOrLastLinkEncoding, decodeTo, toEncoded, decodeUnknownEffect, omit, map9, declare, SchemaError, is, decodeUnknownEffect2, decodeEffect, decodeUnknownExit, decodeUnknownOption, decodeOption, decodeSync, encodeEffect, make17, isSchema, optionalKey, optional, toType, Literal, Never, Unknown, Null, String4, Boolean2, Void, Struct, Record, StructWithRest, ArraySchema, NonEmptyArray, Union, Literals, NullOr, UndefinedOr, suspend4, decodeTo2, withDecodingDefaultKey, tag, TaggedStruct, makeFilter, isPattern, Finite, isGreaterThanOrEqualTo, isLessThanOrEqualTo, Int, isMinLength, isMaxLength, isMinProperties, isMaxProperties, isUnique, Defect, Date2, fromJsonString, FiniteFromString, Cause, Exit, Class2, Error3, TaggedError2, toEquivalence, toCodecJson, toCodecStringTree, Json, JsonObject, decodeJsonString, decodeJsonStringOption, encodeJsonStringSync, encodePrettyJsonString, decodeJsonStringSync, encodeUnknownJsonStringSync };
+export { pipeArguments, dual, identity, constant, constTrue, constFalse, constVoid, pipe, flow, memoize, isString2, isNumber2, isBoolean2, isBigInt2, isSymbol2, isFunction2, isUndefined2, isNotUndefined, isNotNull, isNullish, isObjectOrArray, isObject2, hasProperty, isTagged, isUint8Array, symbol, hash, combine, number, string, structure, array, symbol2, equals, asEquivalence, symbolRedactable, redact, currentFiberTypeId, format, NodeInspectSymbol, toJson, BaseProto, Class, getStackTraceLimit, setStackTraceLimit, assignProperty, args, evaluate, PipeInspectableProto, isExit, causeFail, makePrimitive, exitSucceed, exitFailCause, exitFail, withFiber, Done, Prototype, make14, strictEqual, Tuple, String3, Number2, mapInput, none, some, isNone, isSome, match, getOrElse, orElse, fromNullishOr, fromUndefinedOr, getOrUndefined, liftThrowable, map4, flatMap, toArray, filter2, Service2, makeUnsafe4, empty3, make15, add, getOrUndefined2, getOrUndefinedUnsafe, getUnsafe, get4, merge3, Reference, fromInputUnsafe, isFinite, zero, infinity, millis, seconds, minutes, toMillis, min, max, subtract, format2, normalize, succeed, fail3, try_, isResult, isFailure, isSuccess, map5, getOrElse2, getOrThrow, all2, allocate, fromIterable, isArrayNonEmpty, isReadonlyArrayNonEmpty, isCanonicalArrayIndex, getUnsafe2, sort, of, map6, makeEquivalence2, TaggedClass, Error2, TaggedError, encode, DisablePropagation, getCurrentFiber, fiberJoin, fiberInterrupt, succeed2, sync, suspend2, succeedNone, void_, callback2, asSome, andThen, flatMap2, map7, exitInterrupt, exitVoid, exitZipRight, scopeAddFinalizer, scope, onExitPrimitive, onExitUnsafe, uninterruptibleMask, fiberRunIn, makeLatchUnsafe, makeLatch, ClockRef, currentTimeMillis2, ConsoleRef, succeed3, failCause2, fail4, die, interrupt2, void_2, isSuccess2, isFailure2, hasInterrupts, asVoidAll, makeUnsafe5, make16, _await, fail5, interruptWith, isDone, isDoneUnsafe, succeed4, doneUnsafe, TracerTimingEnabled, Scope, makeUnsafe6, provide, addFinalizerExit, addFinalizer, forkUnsafe, close, build, buildWithScope, succeed5, effect, effectContext, effectDiscard, mergeAll, provide2, provideMerge, isCause, isFailReason, isDieReason, fromReasons, fail6, die2, makeFailReason, makeDieReason, hasInterruptsOnly, squash, findError, findErrorOption, hasInterrupts2, interruptors, pretty, isDone2, Done2, done, IllegalArgumentError, UnknownError, reasonAnnotations, Random, catchDone, isDoneCause, filterDone, doneExitFromCause, matchEffect, max2, during, min2, exponential, jittered, spaced, isEffect, all3, findFirst, forEach, whileLoop, promise, tryPromise, succeed6, suspend3, sync2, void_3, undefined_, callback3, never, gen, fail7, failSync, failCause3, die3, try_2, yieldNow, withFiber2, fromResult, fromNullishOr2, flatMap3, flatten, andThen2, tap2, result, option2, exit, map8, as, asSome2, asVoid, zipWith, catch_, catchTag, catchTags, catchReason, catchCause2, catchDefect, catchIf, catchCauseIf, mapError2, orDie, tapError2, tapCause, retry, retryOrElse, ignore, ignoreCause, orElseSucceed, timeout, timeoutOption, timeoutOrElse, delay, sleep, raceAllFirst, raceFirst, filter3, filterOrFail, when, matchCauseEffect, matchEffect2, context, contextWith, provide3, provideContext2, service, serviceOption, updateContext, updateService, provideService, scope2, scoped, scopedWith, acquireRelease, acquireUseRelease, addFinalizer2, ensuring2, onError, onExitPrimitive2, onExit, cached, interrupt3, interruptible, onInterrupt, uninterruptible, uninterruptibleMask2, forever, repeat, annotateCurrentSpan, makeSpanScoped, useSpan, withSpan, withParentSpan, forkChild, forkIn, forkScoped, forkDetach, runFork, runForkWith, runPromise, runPromiseWith, runSync, runSyncExitWith, fnUntraced, fn, clockWith, logWarning, logError, annotateLogs, effectify, mapEager, flatMapEager, catchEager, encode2, decode, Pointer, makeFormatterStandardSchemaV1, passthrough, transformEffect, Transformation, transform, defaultParseOptions, unknown, getIndexSignatureKeys, applyToSelfOrLastLinkEncoding, decodeTo, toEncoded, decodeUnknownEffect, omit, map9, declare, SchemaError, is, decodeUnknownEffect2, decodeEffect, decodeUnknownExit, decodeUnknownOption, decodeOption, decodeSync, encodeEffect, make17, isSchema, optionalKey, optional, toType, Literal, Never, Unknown, Null, String4, Boolean2, Void, Struct, Record, StructWithRest, ArraySchema, NonEmptyArray, Union, Literals, NullOr, UndefinedOr, suspend4, decodeTo2, withDecodingDefaultKey, tag, TaggedStruct, makeFilter, isPattern, Finite, isGreaterThan, isGreaterThanOrEqualTo, isLessThanOrEqualTo, Int, isMinLength, isMaxLength, isMinProperties, isMaxProperties, isUnique, NonEmptyString, Defect, Date2, fromJsonString, FiniteFromString, Cause, Exit, Class2, Error3, TaggedError2, toEquivalence, toCodecJson, toCodecStringTree, Json, JsonObject, decodeJsonString, decodeJsonStringOption, encodeJsonStringSync, encodePrettyJsonString, decodeJsonStringSync, encodeUnknownJsonStringSync };

package/dist/{chunk-xz1z7j2d.js → chunk-p8g8qyev.js}

@@ -6,10 +6,10 @@ import {
   gen,
   flatMap3,
   provideContext2
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   runForEach
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   WebSocketConstructor,
   layerWebSocketConstructorGlobal,
@@ -19,13 +19,13 @@ import {
   RunnerReplicaRpcs,
   RunnerRunFileRpcs,
   ProgramRpcs
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 import {
   layerJson,
   make4,
   withHeaders,
   layerProtocolSocket
-} from "./chunk-ggax0n15.js";
+} from "./chunk-3teaa3qx.js";
 
 // packages/live/src/rpc/runner-client.ts
 var proxiedWebSocket = (proxy) => succeed5(WebSocketConstructor)((target) => {

package/dist/{chunk-gmnqchsc.js → chunk-t07tn0ay.js}

@@ -4,10 +4,10 @@ import {
   opaqueTunnelRefusal2,
   isOpaqueConnectReason2,
   runSrtStep2
-} from "./chunk-3edjgnxf.js";
-import"./chunk-rrnee9mk.js";
-import"./chunk-v01c0k6j.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-b0cscqbw.js";
+import"./chunk-545b129z.js";
+import"./chunk-tzz4fv17.js";
+import"./chunk-jbwk6k6m.js";
 export {
   isOpaqueConnectReason2 as isOpaqueConnectReason,
   opaqueTunnelRefusal2 as opaqueTunnelRefusal,

package/dist/{chunk-v01c0k6j.js → chunk-tzz4fv17.js}

@@ -8,7 +8,7 @@ import {
   isFunction2,
   isUndefined2,
   isObjectOrArray
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 
 // packages/core/src/runtime-type.ts
 var UnsafeJsonObjectKeys = new Set(["__proto__", "constructor", "prototype"]);

package/dist/{chunk-dk0ftqwg.js → chunk-xb70ys3n.js}

@@ -199,7 +199,7 @@ import {
   String4,
   toCodecStringTree,
   encodeUnknownJsonStringSync
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Iterable.js
 var headUnsafe = (self) => {