@kitman-sh/sdk 0.0.0-stage → 0.7.0

package/dist/chunk-7hwhxthh.js

@@ -0,0 +1,1055 @@
+// @bun
+import {
+  AgentSandboxNetwork,
+  guard,
+  Id,
+  Timestamp,
+  LoopStepOutput,
+  StepBrief,
+  LoopManifest,
+  ManifestInvalid2,
+  loopManifest2,
+  StepFailed2,
+  agentWorkDeferred2,
+  answerDeferred2,
+  childDeferred2,
+  eventDeferred2,
+  verifyDeferred2,
+  loopWorkflow2,
+  executeLoop2,
+  LoopCheckError2,
+  checkLoop2
+} from "./chunk-zp7s46pz.js";
+// packages/core/src/repo-binding.ts
+import * as Schema from "effect/Schema";
+var RepoBindingPathPrefixPattern = "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.\\.?(?:/|$))(?!.*//)\\S+$";
+var RepoBindingProvider = Schema.Union([
+  Schema.Literal("github"),
+  Schema.Literal("gitlab"),
+  Schema.Literal("generic_git")
+]);
+var RepoBindingStatus = Schema.Union([Schema.Literal("active"), Schema.Literal("disabled")]);
+var RepoBindingCredentialProviderType = Schema.Union([
+  Schema.Literal("env"),
+  Schema.Literal("file"),
+  Schema.Literal("exec")
+]);
+var RepoBindingAccessMode = Schema.Union([
+  Schema.Literal("local_checkout"),
+  Schema.Literal("managed_clone"),
+  Schema.Literal("runner_secret_provider")
+]);
+var RepoBindingCredentialRef = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("none") }),
+  Schema.Struct({ kind: Schema.Literal("local_env"), envName: Schema.String.check(Schema.isMinLength(1)) }),
+  Schema.Struct({
+    kind: Schema.Literal("runner_secret"),
+    runnerSecretName: Schema.String.check(Schema.isMinLength(1)),
+    providerType: RepoBindingCredentialProviderType
+  }),
+  Schema.Struct({ kind: Schema.Literal("ssh_agent") })
+]);
+var RepoBinding = Schema.Struct({
+  id: Id,
+  workspaceId: Id,
+  projectId: Id,
+  provider: RepoBindingProvider,
+  host: Schema.String.check(Schema.isMinLength(1)),
+  owner: Schema.String.check(Schema.isMinLength(1)),
+  name: Schema.String.check(Schema.isMinLength(1)),
+  repositoryUrl: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  pathPrefix: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
+  defaultTargetBranch: Schema.String.check(Schema.isMinLength(1)),
+  expectedBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  expectedCommitSha: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  credentialRefs: Schema.Array(RepoBindingCredentialRef),
+  status: RepoBindingStatus,
+  webhook: Schema.optionalKey(Schema.Struct({
+    status: Schema.Literals(["active", "missing"]),
+    message: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(240)))
+  })),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+});
+var RepoBindingCreate = Schema.Struct({
+  provider: RepoBindingProvider,
+  host: Schema.String.check(Schema.isMinLength(1)),
+  owner: Schema.String.check(Schema.isMinLength(1)),
+  name: Schema.String.check(Schema.isMinLength(1)),
+  repositoryUrl: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  pathPrefix: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
+  defaultTargetBranch: Schema.String.check(Schema.isMinLength(1)),
+  expectedBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  expectedCommitSha: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  credentialRefs: Schema.optionalKey(Schema.Array(RepoBindingCredentialRef))
+});
+var RepoBindingTargetOverride = Schema.Struct({
+  targetBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+});
+var RepoBindingList = Schema.Struct({ items: Schema.Array(RepoBinding) });
+var RunnerRepoBindingCapability = Schema.Struct({
+  repoBindingId: Id,
+  provider: RepoBindingProvider,
+  host: Schema.String.check(Schema.isMinLength(1)),
+  accessModes: Schema.Array(RepoBindingAccessMode),
+  credentialProviderTypes: Schema.Array(RepoBindingCredentialProviderType),
+  authenticated: Schema.Boolean,
+  canPush: Schema.optionalKey(Schema.Boolean)
+});
+// packages/core/src/work-unit.ts
+import * as Schema2 from "effect/Schema";
+import * as Struct3 from "effect/Struct";
+var WorkUnitLease = Schema2.Struct({
+  leaseOwnerId: Id,
+  runnerReplicaId: Id,
+  leaseId: Id,
+  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
+  fencingToken: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240), Schema2.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
+  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  leaseExpiresAt: Timestamp,
+  lastHeartbeatAt: Timestamp
+});
+var WorkUnitLeaseProjection = Schema2.Struct(Struct3.map(WorkUnitLease.fields, Schema2.optionalKey));
+var WorkUnitRepoBinding = Schema2.Struct({
+  id: Id,
+  provider: RepoBindingProvider,
+  host: Schema2.String.check(Schema2.isMinLength(1)),
+  owner: Schema2.String.check(Schema2.isMinLength(1)),
+  name: Schema2.String.check(Schema2.isMinLength(1)),
+  repositoryUrl: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
+  pathPrefix: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
+  defaultTargetBranch: Schema2.String.check(Schema2.isMinLength(1)),
+  expectedBranch: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
+  expectedCommitSha: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1)))
+});
+var WorkUnitLeaseInput = Schema2.Struct({
+  leaseOwnerId: Id,
+  runnerReplicaId: Id,
+  leaseId: Id,
+  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
+  fencingToken: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240), Schema2.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
+  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240))
+});
+var WorkUnitStatus = Schema2.Union([
+  Schema2.Literal("pending"),
+  Schema2.Literal("claimed"),
+  Schema2.Literal("running"),
+  Schema2.Literal("waiting"),
+  Schema2.Literal("blocked"),
+  Schema2.Literal("completed"),
+  Schema2.Literal("failed"),
+  Schema2.Literal("canceled"),
+  Schema2.Literal("expired")
+]);
+var LoopCheckout = Schema2.Union([Schema2.Literal("none"), Schema2.Literal("read"), Schema2.Literal("write")]);
+var AgentStepWorkUnit = Schema2.Struct({
+  kind: Schema2.Literal("agent_step"),
+  id: Id,
+  projectId: Schema2.optionalKey(Id),
+  runId: Id,
+  stepKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
+  lease: WorkUnitLease,
+  brief: StepBrief,
+  stepCredential: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(512)),
+  checkout: LoopCheckout,
+  repoBinding: Schema2.optionalKey(WorkUnitRepoBinding),
+  branch: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
+  baseRevision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
+  network: Schema2.optionalKey(AgentSandboxNetwork),
+  sandbox: Schema2.optionalKey(Schema2.Literal("docker")),
+  secrets: Schema2.optionalKey(Schema2.Record(Schema2.String, Schema2.String)),
+  runBaseRevision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1)))
+});
+var RunJournal = Schema2.Struct({
+  activities: Schema2.Record(Schema2.String, Schema2.Unknown),
+  deferreds: Schema2.Record(Schema2.String, Schema2.Unknown)
+});
+var OrchestrationWorkUnit = Schema2.Struct({
+  kind: Schema2.Literal("orchestration"),
+  id: Id,
+  projectId: Schema2.optionalKey(Id),
+  runId: Id,
+  loopDigest: Schema2.String.check(Schema2.isMinLength(64), Schema2.isMaxLength(64), Schema2.isPattern(new RegExp("^[a-f0-9]{64}$", "u"))),
+  input: Schema2.Unknown,
+  granted: Schema2.Array(Schema2.String),
+  lease: WorkUnitLease,
+  journal: RunJournal,
+  network: Schema2.optionalKey(AgentSandboxNetwork),
+  program: Schema2.Struct({
+    loopId: Schema2.String.check(Schema2.isMinLength(1)),
+    credential: Schema2.String.check(Schema2.isMinLength(1))
+  })
+});
+var ProgramWorkUnit = OrchestrationWorkUnit.mapFields(Struct3.omit(["program"]));
+var ApprovedCheck = Schema2.Struct({
+  name: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120), Schema2.isPattern(new RegExp("^[A-Za-z0-9][A-Za-z0-9._:-]*$", "u"))),
+  command: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2000)),
+  workingDirectory: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(500)))
+});
+var VerificationWorkUnit = Schema2.Struct({
+  kind: Schema2.Literal("verification"),
+  id: Id,
+  projectId: Id,
+  runId: Id,
+  stepKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  lease: WorkUnitLease,
+  repoBinding: WorkUnitRepoBinding,
+  revision: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  checks: Schema2.Array(ApprovedCheck).check(Schema2.isMinLength(1), Schema2.isMaxLength(50))
+});
+var WorkUnit = Schema2.Union([OrchestrationWorkUnit, AgentStepWorkUnit, VerificationWorkUnit]);
+var WorkUnitClaimResult = Schema2.Struct({ workUnit: Schema2.optionalKey(WorkUnit) });
+var WorkUnitClaimInput = Schema2.Struct({
+  projectId: Schema2.optionalKey(Id),
+  runnerReplicaId: Id,
+  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  idempotencyKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  leaseDurationSeconds: Schema2.optionalKey(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(3600)))
+});
+var WorkUnitHeartbeatInput = Schema2.Struct({
+  workUnitId: Id,
+  lease: WorkUnitLeaseInput,
+  leaseDurationSeconds: Schema2.optionalKey(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(3600)))
+});
+var WorkUnitHeartbeatResult = Schema2.Struct({
+  settled: Schema2.Boolean,
+  outputSubmitted: Schema2.optionalKey(Schema2.Boolean)
+});
+var WorkUnitReleaseInput = Schema2.Struct({
+  workUnitId: Id,
+  lease: WorkUnitLeaseInput
+});
+var CheckEvidence = Schema2.Struct({
+  name: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120)),
+  command: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2000)),
+  status: Schema2.Union([Schema2.Literal("passed"), Schema2.Literal("failed")]),
+  exitCode: Schema2.optionalKey(Schema2.Int),
+  durationMs: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(0)),
+  outputTail: Schema2.String.check(Schema2.isMaxLength(8000))
+});
+var TreeEvidence = Schema2.Struct({
+  revision: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  tree: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120)),
+  checks: Schema2.Array(CheckEvidence).check(Schema2.isMaxLength(50))
+});
+var VerificationEvidence = Schema2.Struct({ head: TreeEvidence, baseline: Schema2.optionalKey(TreeEvidence) });
+var BoundaryChange = Schema2.Struct({
+  kind: Schema2.Literal("change"),
+  changedPaths: Schema2.Array(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4096))).check(Schema2.isMaxLength(1000)),
+  omittedPaths: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(0)),
+  files: Schema2.Array(Schema2.Struct({
+    path: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4096)),
+    excerpt: Schema2.String.check(Schema2.isMaxLength(250000)),
+    redacted: Schema2.Boolean,
+    truncated: Schema2.Boolean
+  })).check(Schema2.isMaxLength(20)),
+  truncated: Schema2.Boolean
+});
+var WorkUnitOutcome = Schema2.Struct({
+  status: Schema2.Union([
+    Schema2.Literal("completed"),
+    Schema2.Literal("failed"),
+    Schema2.Literal("blocked"),
+    Schema2.Literal("canceled")
+  ]),
+  result: Schema2.optionalKey(LoopStepOutput),
+  revision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120))),
+  evidence: Schema2.optionalKey(VerificationEvidence),
+  boundary: Schema2.optionalKey(BoundaryChange),
+  failureSummary: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4000)))
+});
+var WorkUnitCompletion = Schema2.Struct({
+  workUnitId: Id,
+  lease: WorkUnitLeaseInput,
+  idempotencyKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
+  outcome: WorkUnitOutcome
+});
+// packages/core/src/run-journal.ts
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Schema3 from "effect/Schema";
+var journalEntryMaxBytes = 256 * 1024;
+var JournalExit = Schema3.toCodecJson(Schema3.Exit(Schema3.Json, Schema3.Json, Schema3.Defect()));
+var encodeJournalExit = (exit) => Schema3.encodeUnknownEffect(JournalExit)(Exit.map(exit, (value) => value ?? null));
+var decodeJournalExit = Schema3.decodeUnknownEffect(JournalExit);
+var JournalStepFailed = Schema3.TaggedStruct("StepFailed", { step: Schema3.String, reason: Schema3.String });
+var JournalChildFailed = Schema3.TaggedStruct("ChildFailed", {
+  step: Schema3.String,
+  loop: Schema3.String,
+  reason: Schema3.String
+});
+var JournalWaitTimedOut = Schema3.TaggedStruct("WaitTimedOut", { step: Schema3.String, event: Schema3.String });
+var journalEntryBytes = (entry) => new TextEncoder().encode(JSON.stringify(entry)).byteLength;
+// packages/sdk/src/program/engine.ts
+import * as Cause from "effect/Cause";
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect2 from "effect/Effect";
+import * as Exit3 from "effect/Exit";
+import * as Fiber from "effect/Fiber";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema5 from "effect/Schema";
+
+// packages/live/src/rpc/runner-group.ts
+import * as Schema4 from "effect/Schema";
+import { Rpc, RpcGroup, RpcMiddleware } from "effect/rpc";
+var RunnerHeaders = { runnerId: "x-kitman-runner-id", protocolVersion: "x-kitman-rpc-protocol" };
+var RunnerRpcProtocolVersion = 1;
+
+class RunnerRpcError extends Schema4.TaggedError()("RunnerRpcError", {
+  code: Schema4.String,
+  message: Schema4.String,
+  status: Schema4.Finite
+}) {
+}
+
+class RunnerAuthentication extends RpcMiddleware.Service()("RunnerAuthentication", {
+  error: RunnerRpcError
+}) {
+}
+var EventFilterValue = Schema4.Union([Schema4.String, Schema4.Finite, Schema4.Boolean, Schema4.Null]);
+var WorkAvailable = Schema4.TaggedStruct("WorkAvailable", {});
+var LeaseRevoked = Schema4.TaggedStruct("LeaseRevoked", { workUnitId: Schema4.String });
+var Settled = Schema4.TaggedStruct("Settled", { workUnitId: Schema4.String });
+var Canceled = Schema4.TaggedStruct("Canceled", { workUnitId: Schema4.String });
+var RunSettled = Schema4.TaggedStruct("RunSettled", { runId: Schema4.String });
+var Steer = Schema4.TaggedStruct("Steer", {
+  workUnitId: Schema4.String,
+  messageId: Schema4.String,
+  text: Schema4.String
+});
+var SessionUpdated = Schema4.TaggedStruct("SessionUpdated", { workUnitId: Schema4.String });
+var RunnerSignal = Schema4.Union([
+  WorkAvailable,
+  LeaseRevoked,
+  Settled,
+  Canceled,
+  RunSettled,
+  Steer,
+  SessionUpdated
+]);
+var ProgramLease = Schema4.Struct({
+  workUnitId: Schema4.String,
+  leaseOwnerId: Schema4.String,
+  runnerReplicaId: Schema4.String,
+  leaseId: Schema4.String,
+  attempt: Schema4.Int,
+  fencingToken: Schema4.String,
+  capacitySlot: Schema4.String
+});
+var CheckpointSession = Schema4.Struct({
+  harness: Schema4.String,
+  id: Schema4.String,
+  name: Schema4.String,
+  content: Schema4.Uint8ArrayFromBase64
+});
+var StepCheckpoint = Schema4.Struct({
+  ref: Schema4.optionalKey(Schema4.String),
+  revision: Schema4.optionalKey(Schema4.String),
+  session: Schema4.optionalKey(CheckpointSession)
+});
+var SuggestedVerification = Schema4.Struct({
+  name: Schema4.String,
+  command: Schema4.String,
+  workingDirectory: Schema4.optional(Schema4.String)
+});
+var ProgramOutcome = Schema4.Union([
+  Schema4.Struct({ status: Schema4.Literal("completed"), output: Schema4.Json }),
+  Schema4.Struct({ status: Schema4.Literal("failed"), failureSummary: Schema4.String })
+]);
+
+class RunnerRpcs extends RpcGroup.make(Rpc.make("Claim", {
+  payload: WorkUnitClaimInput,
+  success: WorkUnitClaimResult,
+  error: RunnerRpcError
+}), Rpc.make("Heartbeat", {
+  payload: WorkUnitHeartbeatInput,
+  success: WorkUnitHeartbeatResult,
+  error: RunnerRpcError
+}), Rpc.make("Complete", {
+  payload: WorkUnitCompletion,
+  error: RunnerRpcError
+}), Rpc.make("Release", {
+  payload: WorkUnitReleaseInput,
+  error: RunnerRpcError
+}), Rpc.make("RecordActivity", {
+  payload: { lease: ProgramLease, name: Schema4.String, attempt: Schema4.Int, exit: Schema4.Json },
+  error: RunnerRpcError
+}), Rpc.make("DeferredDone", {
+  payload: { lease: ProgramLease, name: Schema4.String, exit: Schema4.Json },
+  error: RunnerRpcError
+}), Rpc.make("ScheduleClock", {
+  payload: { lease: ProgramLease, name: Schema4.String, deferredName: Schema4.String, durationMillis: Schema4.Int },
+  error: RunnerRpcError
+}), Rpc.make("PutQuestion", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    prompt: Schema4.String,
+    options: Schema4.optional(Schema4.Array(Schema4.String)),
+    verification: Schema4.optional(SuggestedVerification),
+    deferredName: Schema4.String
+  },
+  success: Schema4.Struct({ questionId: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("StartAgentStep", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    deferredName: Schema4.String,
+    role: Schema4.String,
+    agentId: Schema4.String,
+    prompt: Schema4.String,
+    outputSchema: Schema4.Json,
+    secrets: Schema4.optionalKey(Schema4.Array(Schema4.String))
+  },
+  success: Schema4.Struct({ stepAttemptId: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("StartVerification", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    deferredName: Schema4.String,
+    revision: Schema4.optionalKey(Schema4.String),
+    checks: Schema4.optional(Schema4.Array(Schema4.String))
+  },
+  success: Schema4.Struct({ verificationId: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("KnownEvidence", {
+  payload: { lease: ProgramLease, trees: Schema4.Array(Schema4.String) },
+  success: Schema4.Array(Schema4.Struct({ tree: Schema4.String, name: Schema4.String, command: Schema4.String })),
+  error: RunnerRpcError
+}), Rpc.make("AwaitEvent", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    deferredName: Schema4.String,
+    event: Schema4.String,
+    filter: Schema4.optional(Schema4.Record(Schema4.String, Schema4.Union([EventFilterValue, Schema4.Array(EventFilterValue)]))),
+    timeoutMillis: Schema4.Int
+  },
+  error: RunnerRpcError
+}), Rpc.make("AdmitChild", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    loop: Schema4.String,
+    input: Schema4.Json,
+    deferredName: Schema4.String
+  },
+  success: Schema4.Struct({ runId: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("StoreArtifact", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    kind: Schema4.String,
+    title: Schema4.String,
+    text: Schema4.String,
+    data: Schema4.optional(Schema4.Json)
+  },
+  success: Schema4.Struct({ artifactId: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("RecordNote", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    text: Schema4.String,
+    artifactId: Schema4.optional(Schema4.String)
+  },
+  error: RunnerRpcError
+}), Rpc.make("PerformHostEffect", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    effect: Schema4.Union([
+      Schema4.Struct({ kind: Schema4.Literal("post_comment"), changeRequestId: Schema4.String, body: Schema4.String }),
+      Schema4.Struct({
+        kind: Schema4.Literal("change_request"),
+        title: Schema4.String,
+        body: Schema4.String,
+        integration: Schema4.optionalKey(Schema4.String)
+      }),
+      Schema4.Struct({
+        kind: Schema4.Literal("write_back"),
+        milestone: Schema4.optionalKey(Schema4.Literals(["started", "change_request_opened", "merged", "failed"])),
+        changeRequestUrl: Schema4.optionalKey(Schema4.String)
+      })
+    ])
+  },
+  success: Schema4.UndefinedOr(Schema4.Struct({ id: Schema4.String, number: Schema4.String, url: Schema4.String })),
+  error: RunnerRpcError
+}), Rpc.make("CreatePlanTasks", {
+  payload: {
+    lease: ProgramLease,
+    tickets: Schema4.Array(Schema4.Struct({
+      key: Schema4.String,
+      title: Schema4.String,
+      body: Schema4.String,
+      acceptanceCriteria: Schema4.Array(Schema4.String),
+      blockedBy: Schema4.Array(Schema4.String),
+      outcome: Schema4.optionalKey(Schema4.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration"]))
+    }))
+  },
+  success: Schema4.Array(Schema4.Struct({ key: Schema4.String, taskId: Schema4.String })),
+  error: RunnerRpcError
+}), Rpc.make("IntegrationBranch", {
+  payload: { lease: ProgramLease, repoBindingId: Schema4.optionalKey(Schema4.String) },
+  success: Schema4.Struct({ repoBindingId: Schema4.String, branch: Schema4.String, revision: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("MergeChangeRequest", {
+  payload: { lease: ProgramLease, step: Schema4.String, changeRequestId: Schema4.String },
+  success: Schema4.Union([
+    Schema4.Struct({ status: Schema4.Literal("merged"), revision: Schema4.String }),
+    Schema4.Struct({ status: Schema4.Literal("conflict") })
+  ]),
+  error: RunnerRpcError
+}), Rpc.make("PublishRelease", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema4.String,
+    tag: Schema4.String,
+    revision: Schema4.optionalKey(Schema4.String),
+    title: Schema4.String,
+    notes: Schema4.String
+  },
+  success: Schema4.Struct({ tag: Schema4.String, revision: Schema4.String, url: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("ReportSteer", {
+  payload: { workUnitId: Schema4.String, messageId: Schema4.String, delivered: Schema4.Boolean },
+  success: Schema4.Void,
+  error: RunnerRpcError
+}), Rpc.make("SaveCheckpoint", {
+  payload: { lease: ProgramLease, checkpoint: StepCheckpoint },
+  success: Schema4.Void,
+  error: RunnerRpcError
+}), Rpc.make("ResumeCheckpoint", {
+  payload: { lease: ProgramLease },
+  success: Schema4.UndefinedOr(StepCheckpoint),
+  error: RunnerRpcError
+}), Rpc.make("SettledCheckpoints", {
+  success: Schema4.Array(Schema4.Struct({
+    stepAttemptId: Schema4.String,
+    ref: Schema4.optionalKey(Schema4.String),
+    repoBinding: Schema4.optionalKey(WorkUnitRepoBinding)
+  })),
+  error: RunnerRpcError
+}), Rpc.make("ForgetCheckpoints", {
+  payload: { stepAttemptIds: Schema4.Array(Schema4.String) },
+  success: Schema4.Void,
+  error: RunnerRpcError
+}), Rpc.make("Bundle", {
+  payload: { digest: Schema4.String },
+  success: Schema4.Struct({ bundle: Schema4.String }),
+  error: RunnerRpcError
+}), Rpc.make("SettledRuns", {
+  payload: { runIds: Schema4.Array(Schema4.String) },
+  success: Schema4.Array(Schema4.String),
+  error: RunnerRpcError
+}), Rpc.make("ProgramSecrets", {
+  payload: { lease: ProgramLease },
+  success: Schema4.Record(Schema4.String, Schema4.String),
+  error: RunnerRpcError
+}), Rpc.make("Suspend", { payload: { lease: ProgramLease }, error: RunnerRpcError }), Rpc.make("FinishProgram", { payload: { lease: ProgramLease, outcome: ProgramOutcome }, error: RunnerRpcError }), Rpc.make("Signals", {
+  payload: { runnerReplicaId: Schema4.String },
+  success: RunnerSignal,
+  error: RunnerRpcError,
+  stream: true
+})).middleware(RunnerAuthentication) {
+}
+
+// packages/sdk/src/program/engine.ts
+import { Workflow, WorkflowEngine } from "effect/workflow";
+
+class JournalWriteFailed2 extends Data.TaggedError("JournalWriteFailed") {
+  get message() {
+    return `Journal write failed: ${this.cause.message}`;
+  }
+}
+var written = (effect) => effect.pipe(Effect2.catch((cause) => Effect2.die(new JournalWriteFailed2({ cause }))));
+var entryFor = (name, exit) => Effect2.gen(function* () {
+  const entry = yield* Effect2.orDie(encodeJournalExit(exit));
+  const bytes = journalEntryBytes(entry);
+  if (bytes > journalEntryMaxBytes)
+    return yield* Effect2.die(`"${name}" result is over the ${journalEntryMaxBytes}-byte journal cap (${bytes} bytes); store large content as a Run artifact`);
+  return entry;
+});
+var decoded = (entry) => Effect2.orDie(decodeJournalExit(entry));
+var JournalEntries = Schema5.Record(Schema5.String, Schema5.Json);
+var isSuspended = Schema5.is(Workflow.Suspended);
+var makeEncodedEngine = (recorded, journal) => Effect2.gen(function* () {
+  const scope2 = yield* Effect2.scope;
+  const entries = (journalPart) => Effect2.map(Effect2.orDie(Schema5.decodeUnknownEffect(JournalEntries)(journalPart)), Object.entries);
+  const activities = new Map(yield* entries(recorded.activities));
+  const deferreds = new Map(yield* entries(recorded.deferreds));
+  const workflows = new Map;
+  const executions = new Map;
+  const start = (executionId, execution) => Effect2.gen(function* () {
+    const execute = workflows.get(execution.workflow._tag);
+    if (execute === undefined)
+      return yield* Effect2.die(`Workflow ${execution.workflow._tag} is not registered`);
+    const instance = WorkflowEngine.WorkflowInstance.initial(execution.workflow, executionId);
+    execution.fiber = yield* execute(execution.payload, executionId).pipe(Workflow.intoResult, Effect2.provideService(WorkflowEngine.WorkflowEngine, engine), Effect2.provideService(WorkflowEngine.WorkflowInstance, instance), Effect2.forkIn(scope2));
+  });
+  const encoded = {
+    register: (workflow, execute) => Effect2.sync(() => void workflows.set(workflow._tag, execute)),
+    execute: (workflow, options) => Effect2.gen(function* () {
+      let execution = executions.get(options.executionId);
+      if (execution === undefined) {
+        execution = { workflow, payload: options.payload, fiber: undefined };
+        executions.set(options.executionId, execution);
+        yield* start(options.executionId, execution);
+      }
+      if (options.discard || execution.fiber === undefined)
+        return;
+      return yield* Fiber.join(execution.fiber);
+    }),
+    poll: (_workflow, executionId) => Effect2.sync(() => {
+      const exit = executions.get(executionId)?.fiber?.pollUnsafe();
+      return exit !== undefined && Exit3.isSuccess(exit) ? Option.some(exit.value) : Option.none();
+    }),
+    interrupt: (_workflow, executionId) => interrupt2(executionId),
+    interruptUnsafe: (_workflow, executionId) => interrupt2(executionId),
+    resume: (_workflow, executionId) => Effect2.suspend(() => {
+      const execution = executions.get(executionId);
+      const exit = execution?.fiber?.pollUnsafe();
+      return execution !== undefined && exit !== undefined && Exit3.isSuccess(exit) && isSuspended(exit.value) ? start(executionId, execution) : Effect2.void;
+    }),
+    activityExecute: (activity, attempt) => Effect2.gen(function* () {
+      const key = `${activity.name}/${attempt}`;
+      const replayed = activities.get(key);
+      if (replayed !== undefined)
+        return new Workflow.Complete({ exit: yield* decoded(replayed) });
+      const instance = yield* WorkflowEngine.WorkflowInstance;
+      const result = yield* activity.executeEncoded.pipe(Workflow.intoResult, Effect2.provideService(WorkflowEngine.WorkflowInstance, WorkflowEngine.WorkflowInstance.initial(instance.workflow, instance.executionId)));
+      if (result instanceof Workflow.Complete && !(Exit3.isFailure(result.exit) && journalLoss(result.exit.cause))) {
+        const entry = yield* entryFor(activity.name, result.exit);
+        yield* written(journal.recordActivity({ name: activity.name, attempt, exit: entry }));
+        activities.set(key, entry);
+      }
+      return result;
+    }),
+    deferredResult: (deferred) => Effect2.suspend(() => {
+      const entry = deferreds.get(deferred.name);
+      return entry === undefined ? Effect2.succeedNone : Effect2.asSome(decoded(entry));
+    }),
+    deferredDone: (options) => Effect2.gen(function* () {
+      if (deferreds.has(options.deferredName))
+        return;
+      const entry = yield* entryFor(options.deferredName, options.exit);
+      yield* written(journal.deferredDone({ name: options.deferredName, exit: entry }));
+      deferreds.set(options.deferredName, entry);
+      yield* encoded.resume(executions.get(options.executionId)?.workflow ?? emptyWorkflow, options.executionId);
+    }),
+    scheduleClock: (_workflow, { clock }) => deferreds.has(clock.deferred.name) ? Effect2.void : written(journal.scheduleClock({
+      name: clock.name,
+      deferredName: clock.deferred.name,
+      durationMillis: Duration.toMillis(clock.duration)
+    }))
+  };
+  const interrupt2 = (executionId) => Effect2.suspend(() => {
+    const fiber = executions.get(executionId)?.fiber;
+    return fiber === undefined ? Effect2.void : Fiber.interrupt(fiber);
+  });
+  const engine = WorkflowEngine.makeUnsafe(encoded);
+  return { engine, encoded };
+});
+var emptyWorkflow = Workflow.make("kitman-loop/none", { payload: {}, idempotencyKey: () => "none" });
+var replayStatuses = new Set([401, 403, 409, 429]);
+var isRunnerRpcError = Schema5.is(RunnerRpcError);
+var refusedStep2 = (cause) => {
+  if ("code" in cause && (cause.code === "capability_denied" || cause.code === "step_refused"))
+    return true;
+  return isRunnerRpcError(cause) && cause.status >= 400 && cause.status < 500 && !replayStatuses.has(cause.status);
+};
+var requested = (step, request) => request.pipe(Effect2.catch((cause) => refusedStep2(cause) ? Effect2.fail(new StepFailed2({ step, reason: cause.message })) : Effect2.die(new JournalWriteFailed2({ cause }))));
+var runnerHost = (journal) => ({
+  putQuestion: (launch) => requested(launch.step, journal.putQuestion({
+    step: launch.step,
+    prompt: launch.prompt,
+    deferredName: answerDeferred2(launch.step).name,
+    ...launch.options === undefined ? undefined : { options: launch.options },
+    ...launch.verification === undefined ? undefined : { verification: launch.verification }
+  })).pipe(Effect2.asVoid),
+  startVerification: (launch) => requested(launch.step, journal.startVerification({
+    step: launch.step,
+    deferredName: verifyDeferred2(launch.step).name,
+    ...launch.revision === undefined ? undefined : { revision: launch.revision },
+    ...launch.checks === undefined ? undefined : { checks: launch.checks }
+  })).pipe(Effect2.asVoid),
+  startAgentWork: (launch) => requested(launch.step, journal.startAgentStep({
+    step: launch.step,
+    deferredName: agentWorkDeferred2(launch.step).name,
+    role: launch.role,
+    agentId: launch.agent,
+    prompt: launch.prompt,
+    outputSchema: launch.output,
+    ...launch.secrets === undefined ? undefined : { secrets: launch.secrets }
+  })).pipe(Effect2.asVoid),
+  admitChild: (launch) => requested(launch.step, journal.admitChild({
+    step: launch.step,
+    loop: launch.loop,
+    input: launch.input,
+    deferredName: childDeferred2(launch.step).name
+  })).pipe(Effect2.asVoid),
+  awaitEvent: (launch) => requested(launch.step, journal.awaitEvent({
+    step: launch.step,
+    deferredName: eventDeferred2(launch.step).name,
+    event: launch.event,
+    ...launch.filter === undefined ? undefined : { filter: launch.filter },
+    timeoutMillis: launch.timeoutMillis
+  }))
+});
+var runnerActivities = (journal) => ({
+  changeRequest: {
+    run: (request, step) => requested(step, journal.performHostEffect({
+      step,
+      effect: {
+        kind: "change_request",
+        title: request.title,
+        body: request.body,
+        ...request.integration === undefined ? undefined : { integration: request.integration }
+      }
+    })).pipe(Effect2.filterOrFail((opened) => opened !== undefined, () => new StepFailed2({ step, reason: "Kitman opened no ChangeRequest" })))
+  },
+  writeBack: {
+    run: (request, step) => requested(step, journal.performHostEffect({
+      step,
+      effect: {
+        kind: "write_back",
+        ...request.milestone === undefined ? undefined : { milestone: request.milestone },
+        ...request.changeRequestUrl === undefined ? undefined : { changeRequestUrl: request.changeRequestUrl }
+      }
+    })).pipe(Effect2.asVoid)
+  },
+  artifact: { run: (request, step) => requested(step, journal.storeArtifact({ step, ...request })) },
+  note: { run: (request, step) => requested(step, journal.recordNote({ step, ...request })) },
+  createTasks: {
+    run: (request, step) => requested(step, Effect2.map(journal.createPlanTasks(request.tickets), (tasks) => ({ tasks })))
+  },
+  integrationBranch: {
+    run: (request, step) => requested(step, journal.integrationBranch(request.repoBindingId))
+  },
+  mergeChangeRequest: {
+    run: (request, step) => requested(step, journal.mergeChangeRequest({ step, ...request }))
+  },
+  release: {
+    run: ({ revision, ...request }, step) => requested(step, journal.publishRelease({ step, ...request, ...revision === undefined ? undefined : { revision } }))
+  },
+  comment: {
+    run: (request, step) => requested(step, journal.performHostEffect({ step, effect: { kind: "post_comment", ...request } })).pipe(Effect2.asVoid)
+  }
+});
+var describeFailure = (cause) => {
+  const error = Cause.squash(cause);
+  const summary = error instanceof Error ? "_tag" in error ? `${String(error._tag)}: ${error.message}` : error.message : String(error);
+  return summary.slice(0, 4000) || "Program failed";
+};
+var journalLoss = (cause) => cause.reasons.flatMap((reason) => Cause.isDieReason(reason) && reason.defect instanceof JournalWriteFailed2 ? [reason.defect] : [])[0];
+var runProgram2 = (loop, work, journal) => Effect2.scoped(Effect2.gen(function* () {
+  const { engine, encoded } = yield* makeEncodedEngine(work.journal, journal);
+  const workflow = loopWorkflow2(loop);
+  const execute = executeLoop2(loop, {
+    host: runnerHost(journal),
+    activities: runnerActivities(journal),
+    granted: new Set(loop.capabilities.filter((capability) => work.granted.includes(capability)))
+  });
+  yield* Layer.build(workflow.toLayer(execute).pipe(Layer.provide(Layer.succeed(WorkflowEngine.WorkflowEngine)(engine))));
+  const result = yield* encoded.execute(workflow, {
+    executionId: work.runId,
+    payload: { input: work.input },
+    discard: false
+  });
+  if (isSuspended(result)) {
+    yield* written(journal.suspend);
+    return "suspended";
+  }
+  if (Exit3.isSuccess(result.exit)) {
+    const output = yield* Schema5.encodeUnknownEffect(Schema5.toCodecJson(loop.output))(result.exit.value).pipe(Effect2.flatMap(Schema5.decodeUnknownEffect(Schema5.Json)), Effect2.option);
+    if (Option.isSome(output)) {
+      yield* written(journal.finish({ status: "completed", output: output.value }));
+      return "completed";
+    }
+    yield* written(journal.finish({ status: "failed", failureSummary: "Program output does not encode as JSON" }));
+    return "failed";
+  }
+  const lost = journalLoss(result.exit.cause);
+  if (lost !== undefined)
+    return yield* lost;
+  yield* written(journal.finish({ status: "failed", failureSummary: describeFailure(result.exit.cause) }));
+  return "failed";
+})).pipe(Effect2.catchDefect((defect) => defect instanceof JournalWriteFailed2 ? Effect2.fail(defect) : Effect2.die(defect)));
+var programLease2 = (work) => ({
+  workUnitId: work.id,
+  leaseOwnerId: work.lease.leaseOwnerId,
+  runnerReplicaId: work.lease.runnerReplicaId,
+  leaseId: work.lease.leaseId,
+  attempt: work.lease.attempt,
+  fencingToken: work.lease.fencingToken,
+  capacitySlot: work.lease.capacitySlot
+});
+var rpcProgramJournal2 = (rpc, work) => {
+  const lease = programLease2(work);
+  return {
+    recordActivity: (entry) => rpc.recordActivity({ lease, ...entry }),
+    deferredDone: (entry) => rpc.deferredDone({ lease, ...entry }),
+    scheduleClock: (clock) => rpc.scheduleClock({ lease, ...clock }),
+    putQuestion: (question) => rpc.putQuestion({
+      lease,
+      step: question.step,
+      prompt: question.prompt,
+      deferredName: question.deferredName,
+      ...question.options === undefined ? undefined : { options: [...question.options] },
+      ...question.verification === undefined ? undefined : { verification: question.verification }
+    }),
+    startVerification: (verification) => rpc.startVerification({
+      lease,
+      step: verification.step,
+      deferredName: verification.deferredName,
+      ...verification.revision === undefined ? undefined : { revision: verification.revision },
+      ...verification.checks === undefined ? undefined : { checks: [...verification.checks] }
+    }),
+    startAgentStep: ({ secrets, ...step }) => rpc.startAgentStep({ lease, ...step, ...secrets === undefined ? undefined : { secrets: [...secrets] } }),
+    awaitEvent: (wait) => rpc.awaitEvent({ lease, ...wait }),
+    admitChild: (child) => rpc.admitChild({ lease, ...child }),
+    storeArtifact: (artifact) => rpc.storeArtifact({ lease, ...artifact }),
+    recordNote: (note) => rpc.recordNote({ lease, ...note }),
+    performHostEffect: (request) => rpc.performHostEffect({ lease, ...request }),
+    createPlanTasks: (tickets) => rpc.createPlanTasks({
+      lease,
+      tickets: tickets.map((ticket) => ({
+        key: ticket.key,
+        title: ticket.title,
+        body: ticket.body,
+        acceptanceCriteria: ticket.acceptanceCriteria,
+        blockedBy: ticket.blockedBy,
+        ...ticket.outcome === undefined ? undefined : { outcome: ticket.outcome }
+      }))
+    }),
+    integrationBranch: (repoBindingId) => rpc.integrationBranch({ lease, ...repoBindingId === undefined ? undefined : { repoBindingId } }),
+    mergeChangeRequest: (request) => rpc.mergeChangeRequest({ lease, ...request }),
+    publishRelease: (request) => rpc.publishRelease({ lease, ...request }),
+    suspend: rpc.suspend({ lease }),
+    finish: (outcome) => rpc.finishProgram({ lease, outcome })
+  };
+};
+
+// packages/live/src/rpc/runner-client.ts
+import * as Effect3 from "effect/Effect";
+import * as Layer2 from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { RpcClient, RpcSerialization } from "effect/rpc";
+import * as Socket from "effect/socket/Socket";
+var proxiedWebSocket = (proxy) => Layer2.succeed(Socket.WebSocketConstructor)((target) => {
+  const options = { proxy };
+  return Reflect.construct(globalThis.WebSocket, [target, options]);
+});
+var runnerWebSocketProtocol = (url, options = {}) => RpcClient.layerProtocolSocket({ retryTransientErrors: true }).pipe(Layer2.provide(Socket.layerWebSocket(url)), Layer2.provide(options.proxy === undefined ? Socket.layerWebSocketConstructorGlobal : proxiedWebSocket(options.proxy)), Layer2.provide(RpcSerialization.layerJson));
+function runnerRpcUrl(apiUrl) {
+  const url = new URL("/v1/runners/rpc", apiUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return url.toString();
+}
+var makeRunnerRpcClient = (options) => Effect3.gen(function* () {
+  const protocol = yield* Layer2.build(options.protocol);
+  const client = yield* RpcClient.make(RunnerRpcs).pipe(Effect3.provideContext(protocol));
+  const authorized = (call) => Effect3.flatMap(options.bearer, (token) => RpcClient.withHeaders(call, {
+    authorization: `Bearer ${token}`,
+    [RunnerHeaders.runnerId]: options.runnerId,
+    [RunnerHeaders.protocolVersion]: String(RunnerRpcProtocolVersion)
+  }));
+  return {
+    claim: (input) => authorized(client.Claim(input)),
+    heartbeat: (input) => authorized(client.Heartbeat(input)),
+    complete: (input) => authorized(client.Complete(input)),
+    release: (input) => authorized(client.Release(input)),
+    recordActivity: (input) => authorized(client.RecordActivity(input)),
+    deferredDone: (input) => authorized(client.DeferredDone(input)),
+    scheduleClock: (input) => authorized(client.ScheduleClock(input)),
+    putQuestion: (input) => authorized(client.PutQuestion(input)),
+    programSecrets: (input) => authorized(client.ProgramSecrets(input)),
+    suspend: (input) => authorized(client.Suspend(input)),
+    finishProgram: (input) => authorized(client.FinishProgram(input)),
+    startAgentStep: (input) => authorized(client.StartAgentStep(input)),
+    startVerification: (input) => authorized(client.StartVerification(input)),
+    knownEvidence: (input) => authorized(client.KnownEvidence(input)),
+    awaitEvent: (input) => authorized(client.AwaitEvent(input)),
+    admitChild: (input) => authorized(client.AdmitChild(input)),
+    storeArtifact: (input) => authorized(client.StoreArtifact(input)),
+    recordNote: (input) => authorized(client.RecordNote(input)),
+    performHostEffect: (input) => authorized(client.PerformHostEffect(input)),
+    createPlanTasks: (input) => authorized(client.CreatePlanTasks(input)),
+    integrationBranch: (input) => authorized(client.IntegrationBranch(input)),
+    mergeChangeRequest: (input) => authorized(client.MergeChangeRequest(input)),
+    publishRelease: (input) => authorized(client.PublishRelease(input)),
+    bundle: (digest) => authorized(client.Bundle({ digest })),
+    settledRuns: (runIds) => authorized(client.SettledRuns({ runIds })),
+    reportSteer: (input) => authorized(client.ReportSteer(input)),
+    saveCheckpoint: (input) => authorized(client.SaveCheckpoint(input)),
+    resumeCheckpoint: (input) => authorized(client.ResumeCheckpoint(input)),
+    settledCheckpoints: authorized(client.SettledCheckpoints()),
+    forgetCheckpoints: (stepAttemptIds) => authorized(client.ForgetCheckpoints({ stepAttemptIds })),
+    listen: (runnerReplicaId, onSignal) => authorized(Stream.runForEach(client.Signals({ runnerReplicaId }), onSignal))
+  };
+});
+
+// packages/sdk/src/program/host.ts
+import * as BunRuntime from "@effect/platform-bun/BunRuntime";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect4 from "effect/Effect";
+import * as Option2 from "effect/Option";
+import * as Redacted2 from "effect/Redacted";
+import * as Schema6 from "effect/Schema";
+var describeFlag2 = "--kitman-describe";
+var Described2 = Schema6.Union([
+  Schema6.TaggedStruct("Described", {
+    loops: Schema6.Array(LoopManifest),
+    agents: Schema6.Record(Schema6.String, Schema6.Json),
+    schedules: Schema6.optionalKey(Schema6.Record(Schema6.String, Schema6.Json)),
+    kits: Schema6.optionalKey(Schema6.Record(Schema6.String, Schema6.Json))
+  }),
+  Schema6.TaggedStruct("Refused", { error: Schema6.Union([ManifestInvalid2, LoopCheckError2]) })
+]);
+var encodeDescribed = Schema6.encodeEffect(Schema6.fromJsonString(Schema6.toCodecJson(Described2)));
+
+class ProgramRefused extends Schema6.TaggedError()("ProgramRefused", { reason: Schema6.String }) {
+  get message() {
+    return this.reason;
+  }
+}
+var programSecrets2 = (rpc, lease) => rpc.programSecrets({ lease }).pipe(Effect4.asSome, Effect4.catchIf(refusedStep2, (error) => Effect4.as(rpc.finishProgram({
+  lease,
+  outcome: { status: "failed", failureSummary: `Kitman refused the Loop its Secrets: ${error.message}` }
+}), Option2.none())));
+var programHostsEnv2 = "KITMAN_PROGRAM_HOSTS";
+var undeclaredHostsEnv2 = "KITMAN_UNDECLARED_HOSTS";
+var allows = (hosts, host) => hosts.some((entry) => entry === host || entry.startsWith("*.") && host.endsWith(entry.slice(1)));
+var redirectStatuses = new Set([301, 302, 303, 307, 308]);
+var maxRedirects = 20;
+var requestBodyHeaders = [
+  "content-type",
+  "content-length",
+  "content-encoding",
+  "content-language",
+  "content-location"
+];
+var credentialHeaders = ["authorization", "cookie", "proxy-authorization"];
+var networkGuard2 = (input) => {
+  const warned = new Set;
+  let refused;
+  const refusalOf = (host) => {
+    if (allows(input.hosts, host))
+      return;
+    const undeclared = `The program called ${host}, a host its Loop does not declare. Add it to \`network\` in defineLoop`;
+    if (input.undeclared === "fail") {
+      refused ??= `${undeclared}.`;
+      return new Error(`${undeclared}.`);
+    }
+    if (!warned.has(host))
+      input.warn(`${undeclared}; a shared Runner refuses it.`);
+    warned.add(host);
+    return;
+  };
+  const follow = (first) => Effect4.gen(function* () {
+    let request = first;
+    for (let hops = 0;; hops++) {
+      const refusal = refusalOf(new URL(request.url).hostname);
+      if (refusal !== undefined)
+        return yield* Effect4.die(refusal);
+      const sent = request;
+      if (sent.redirect !== "follow")
+        return yield* Effect4.promise(() => input.fetch(sent));
+      const resend = sent.clone();
+      const response = yield* Effect4.promise(() => input.fetch(sent, { redirect: "manual" }));
+      const location = response.headers.get("location");
+      if (!redirectStatuses.has(response.status) || location === null)
+        return response;
+      if (hops === maxRedirects)
+        return yield* Effect4.die(new TypeError("The program followed too many redirects."));
+      response.body?.cancel();
+      const url = new URL(location, sent.url);
+      const asGet = response.status === 303 && sent.method !== "HEAD" || (response.status === 301 || response.status === 302) && sent.method === "POST";
+      const headers = new Headers(Array.from(resend.headers));
+      if (asGet)
+        for (const name of requestBodyHeaders)
+          headers.delete(name);
+      if (url.origin !== new URL(sent.url).origin)
+        for (const name of credentialHeaders)
+          headers.delete(name);
+      request = new Request(url.href, {
+        method: asGet ? "GET" : resend.method,
+        headers,
+        body: asGet || resend.body === null ? null : yield* Effect4.promise(() => resend.arrayBuffer()),
+        signal: sent.signal
+      });
+    }
+  });
+  const fetch = (resource, init) => Effect4.runPromise(Effect4.suspend(() => follow(resource instanceof Request ? new Request(resource, init) : new Request(resource instanceof URL ? resource.href : resource, init))));
+  const refusal = () => refused === undefined ? undefined : { status: "failed", failureSummary: refused };
+  const journal = (journal) => ({
+    ...journal,
+    suspend: Effect4.suspend(() => {
+      const failed = refusal();
+      return failed === undefined ? journal.suspend : journal.finish(failed);
+    }),
+    finish: (outcome) => Effect4.suspend(() => journal.finish(refusal() ?? outcome))
+  });
+  return { fetch, journal };
+};
+var describe = (config) => Effect4.gen(function* () {
+  const loops = yield* Effect4.forEach(config.loops, loopManifest2);
+  for (const loop of config.loops)
+    for (const check of loop.checks ?? [])
+      yield* checkLoop2(loop, check);
+  return {
+    _tag: "Described",
+    loops,
+    agents: config.agents ?? {},
+    ...config.schedules === undefined ? undefined : { schedules: config.schedules },
+    ...config.kits === undefined ? undefined : { kits: config.kits }
+  };
+}).pipe(Effect4.catch((error) => Effect4.succeed({ _tag: "Refused", error })), Effect4.flatMap(encodeDescribed), Effect4.flatMap((described) => Effect4.callback((resume) => void process.stdout.write(described, () => resume(Effect4.void)))), Effect4.as(0));
+var readStdin = Effect4.tryPromise(() => Bun.stdin.text());
+var isWorkUnit = guard(ProgramWorkUnit);
+var host = (config) => Effect4.gen(function* () {
+  const loopId = yield* Config.String("KITMAN_LOOP_ID");
+  const apiUrl = yield* Config.String("KITMAN_API_URL");
+  const credential = yield* Config.Redacted("KITMAN_PROGRAM_CREDENTIAL");
+  const work = yield* Schema6.decodeEffect(Schema6.fromJsonString(Schema6.Unknown))(yield* readStdin);
+  if (!isWorkUnit(work))
+    return yield* new ProgramRefused({ reason: "stdin holds no orchestration Work Unit" });
+  const loop = config.loops.find((candidate) => candidate.id === loopId);
+  if (loop === undefined)
+    return yield* new ProgramRefused({ reason: `The Package declares no Loop "${loopId}"` });
+  const hosts = yield* Config.option(Config.String(programHostsEnv2));
+  const undeclared = yield* Config.option(Config.Literals(["fail", "warn"], undeclaredHostsEnv2));
+  const proxy = yield* Config.option(Config.String("HTTPS_PROXY"));
+  const rpc = yield* makeRunnerRpcClient({
+    runnerId: work.lease.leaseOwnerId,
+    bearer: Effect4.sync(() => Redacted2.value(credential)),
+    protocol: runnerWebSocketProtocol(runnerRpcUrl(apiUrl), Option2.isSome(proxy) ? { proxy: proxy.value } : {})
+  });
+  const secrets = (loop.secrets ?? []).length === 0 ? Option2.some({}) : yield* programSecrets2(rpc, programLease2(work));
+  if (Option2.isNone(secrets))
+    return 0;
+  const guard = Option2.isNone(hosts) ? undefined : networkGuard2({
+    hosts: hosts.value.split(",").filter((host) => host.length > 0),
+    undeclared: Option2.getOrElse(undeclared, () => "warn"),
+    fetch: globalThis.fetch,
+    warn: (line) => void process.stderr.write(`${line}
+`)
+  });
+  if (guard !== undefined)
+    globalThis.fetch = Object.assign(guard.fetch, { preconnect: globalThis.fetch.preconnect });
+  const journal = rpcProgramJournal2(rpc, work);
+  return yield* runProgram2(loop, work, guard === undefined ? journal : guard.journal(journal)).pipe(Effect4.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown(secrets.value)), Effect4.as(0), Effect4.catchTag("JournalWriteFailed", (error) => Effect4.as(Effect4.logError(error.message), 1)));
+}).pipe(Effect4.scoped, Effect4.catch((error) => Effect4.as(Effect4.logError(error.message), 2)));
+var runPackage2 = (config) => {
+  const program = process.argv.includes(describeFlag2) ? describe(config) : host(config);
+  BunRuntime.runMain(program.pipe(Effect4.flatMap((code) => Effect4.sync(() => process.exit(code)))));
+};
+
+export { RunnerRpcProtocolVersion, JournalWriteFailed2, refusedStep2, runProgram2, programLease2, rpcProgramJournal2, describeFlag2, Described2, programSecrets2, programHostsEnv2, undeclaredHostsEnv2, networkGuard2, runPackage2 };