@kitman-sh/sdk 0.9.0 → 0.10.53

package/dist/build/index.js

@@ -1,81 +1,229 @@
 // @bun
 import {
+  canonicalJson,
+  KitDigest,
   AgentDeclaration,
-  KitInstallationDeclaration,
-  KitAssignmentDeclaration,
-  PackageDeclarations
-} from "../chunk-36jhc745.js";
+  KitDeclarations
+} from "../chunk-tcbgb4wm.js";
 import {
   digestSha256,
+  digestSha512,
+  digestWith,
+  kitmanMcpServer,
   RunnerRpcProtocolVersion,
   describeFlag2,
   Described2
-} from "../chunk-e1tqypyy.js";
+} from "../chunk-zvzw3zs4.js";
 
-// packages/sdk/src/build/index.ts
+// packages/core/src/json.ts
+import * as Schema from "effect/Schema";
+var JsonFromString = Schema.fromJsonString(Schema.Json);
+var decodeJsonString = Schema.decodeUnknownEffect(JsonFromString);
+var decodeJsonStringOption = Schema.decodeUnknownOption(JsonFromString);
+var encodeJsonStringSync = Schema.encodeSync(JsonFromString);
+var encodePrettyJsonString = Schema.encodeEffect(Schema.fromJsonString(Schema.Json, { space: 2 }));
+var decodeJsonStringSync = Schema.decodeUnknownSync(JsonFromString);
+var encodeUnknownJsonStringSync = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
+
+// packages/core/src/npm-registry.ts
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
+import * as Schema2 from "effect/Schema";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientResponse from "effect/http/HttpClientResponse";
+var KitManifest = Schema2.Struct({
+  bundle: Schema2.String,
+  digest: KitDigest,
+  protocolVersion: Schema2.Int,
+  declarations: Schema2.String,
+  setup: Schema2.Record(KitDigest, Schema2.String)
+});
+
+class NpmRegistryError extends Data.TaggedError("NpmRegistryError") {
+}
+var Dist = Schema2.Struct({
+  tarball: Schema2.String,
+  integrity: Schema2.optionalKey(Schema2.String),
+  shasum: Schema2.optionalKey(Schema2.String)
+});
+var Packument = Schema2.Struct({
+  "dist-tags": Schema2.Record(Schema2.String, Schema2.String),
+  versions: Schema2.Record(Schema2.String, Schema2.Struct({ dist: Dist }))
+});
+var integrityAlgorithms = ["sha512", "sha384", "sha256", "sha1"];
+var tarballMatches = (tarball, dist) => {
+  if (dist.integrity === undefined)
+    return dist.shasum === digestWith("sha1", tarball, "hex");
+  const hashes = dist.integrity.split(/\s+/u).map((hash) => /^([^-]+)-([^?]+)/u.exec(hash));
+  const algorithm = integrityAlgorithms.find((candidate) => hashes.some((hash) => hash?.[1] === candidate));
+  return algorithm !== undefined && hashes.some((hash) => hash?.[1] === algorithm && hash[2] === digestWith(algorithm, tarball, "base64"));
+};
+var PackageJson = Schema2.Struct({ kitman: Schema2.optionalKey(Schema2.Unknown) });
+var decodePackageJson = Schema2.decodeUnknownOption(Schema2.fromJsonString(PackageJson));
+var decodeManifest = Schema2.decodeUnknownOption(KitManifest);
+var decodeJson = Schema2.decodeUnknownOption(Schema2.fromJsonString(Schema2.Unknown));
+var gunzip = (bytes) => Effect.tryPromise(() => new Response(new Blob([new Uint8Array(bytes)]).stream().pipeThrough(new DecompressionStream("gzip"))).arrayBuffer()).pipe(Effect.map((buffer) => new Uint8Array(buffer)));
+var text = (bytes) => new TextDecoder().decode(bytes).replace(/\0.*$/su, "");
+var untar = (tar) => {
+  const files = new Map;
+  let longName;
+  for (let offset = 0;offset + 512 <= tar.length; ) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0))
+      break;
+    const size = Number.parseInt(text(header.subarray(124, 136)).trim() || "0", 8);
+    if (!Number.isSafeInteger(size) || size < 0 || offset + 512 + size > tar.length)
+      return;
+    const type = String.fromCharCode(header[156] ?? 0);
+    const prefix = text(header.subarray(345, 500));
+    const body = tar.subarray(offset + 512, offset + 512 + size);
+    const name = longName ?? (prefix === "" ? text(header.subarray(0, 100)) : `${prefix}/${text(header.subarray(0, 100))}`);
+    longName = undefined;
+    if (type === "x")
+      longName = /(?:^|\n)\d+ path=([^\n]*)\n/u.exec(new TextDecoder().decode(body))?.[1];
+    else if (type === "L")
+      longName = text(body);
+    else if (type === "0" || type === "\x00")
+      files.set(name.replace(/^[^/]*\//u, ""), body);
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return files;
+};
+var registryUrl = Config.String("NPM_CONFIG_REGISTRY").pipe(Config.withDefault("https://registry.npmjs.org"));
+var npmRegistryAt = (url = registryUrl) => {
+  const base = (Predicate.isString(url) ? Effect.succeed(url) : Effect.orDie(url)).pipe(Effect.map((value) => value.replace(/\/+$/u, "")));
+  const unreachable = (name, version) => (error) => new NpmRegistryError({
+    kind: "unreachable",
+    message: `npm did not answer for ${name}@${version}: ${error.message}; try again`
+  });
+  const packument = (name, version) => Effect.gen(function* () {
+    const response = yield* HttpClient.get(`${yield* base}/${name.replace("/", "%2F")}`).pipe(Effect.mapError(unreachable(name, version)), Effect.provide(FetchHttpClient.layer));
+    if (response.status === 404)
+      return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no package ${name}` });
+    return yield* HttpClientResponse.filterStatusOk(response).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Packument)), Effect.mapError(unreachable(name, version)));
+  });
+  return {
+    latest: (name) => Effect.flatMap(packument(name, "latest"), (found) => {
+      const latest = found["dist-tags"].latest;
+      return latest === undefined ? Effect.fail(new NpmRegistryError({ kind: "not_found", message: `npm has no latest ${name}` })) : Effect.succeed(latest);
+    }),
+    kit: (name, wanted) => Effect.gen(function* () {
+      const found = yield* packument(name, wanted);
+      const version = found["dist-tags"][wanted] ?? wanted;
+      const dist = found.versions[version]?.dist;
+      if (dist === undefined)
+        return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no ${name}@${wanted}` });
+      const tarball = yield* HttpClient.get(dist.tarball).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk), Effect.flatMap((response) => response.arrayBuffer), Effect.map((buffer) => new Uint8Array(buffer)), Effect.mapError(unreachable(name, version)), Effect.provide(FetchHttpClient.layer));
+      if (!tarballMatches(tarball, dist))
+        return yield* new NpmRegistryError({
+          kind: "integrity",
+          message: `${name}@${version}'s tarball does not match npm's integrity: expected ${dist.integrity ?? `sha1 ${dist.shasum}`}, got sha512-${digestSha512(tarball, "base64")}; its publisher must publish a new version`
+        });
+      const notAKit = new NpmRegistryError({
+        kind: "not_a_kit",
+        message: `${name}@${version} is not a Kitman Kit: add \`kitman kit build\` to its prepack and publish again`
+      });
+      const files = untar(yield* gunzip(tarball).pipe(Effect.mapError(() => notAKit)));
+      if (files === undefined)
+        return yield* notAKit;
+      const file = (path) => Option.fromUndefinedOr(files.get(path.replace(/^\.\//u, "")));
+      const manifest = Option.flatMap(file("package.json"), (bytes) => Option.flatMap(decodePackageJson(new TextDecoder().decode(bytes)), (json) => decodeManifest(json.kitman)));
+      if (Option.isNone(manifest))
+        return yield* notAKit;
+      const bundle = file(manifest.value.bundle);
+      const declarations = file(manifest.value.declarations);
+      const setupArchives = Object.entries(manifest.value.setup).flatMap(([digest, path]) => Option.match(file(path), {
+        onNone: () => [],
+        onSome: (archive) => digestSha256(archive, "hex") === digest ? [{ digest, archive }] : []
+      }));
+      if (Option.isNone(bundle) || Option.isNone(declarations) || digestSha256(bundle.value, "hex") !== manifest.value.digest || setupArchives.length !== Object.keys(manifest.value.setup).length)
+        return yield* notAKit;
+      const parsed = decodeJson(new TextDecoder().decode(declarations.value));
+      if (Option.isNone(parsed))
+        return yield* notAKit;
+      return {
+        name,
+        version,
+        integrity: dist.integrity ?? `sha1-${digestWith("sha1", tarball, "base64")}`,
+        bundle: bundle.value,
+        digest: manifest.value.digest,
+        protocolVersion: manifest.value.protocolVersion,
+        declarations: parsed.value,
+        setupArchives
+      };
+    })
+  };
+};
+var NpmRegistry = Context.Reference("kitman/core/NpmRegistry", {
+  defaultValue: () => npmRegistryAt()
+});
+
+// packages/sdk/src/build/index.ts
+import * as Config2 from "effect/Config";
+import * as Context2 from "effect/Context";
+import * as Effect2 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
-import * as Predicate from "effect/Predicate";
-import * as Schema from "effect/Schema";
+import * as Predicate2 from "effect/Predicate";
+import * as Schema3 from "effect/Schema";
 import * as Stream from "effect/Stream";
+import { Base64 } from "effect/encoding";
+import * as FetchHttpClient2 from "effect/http/FetchHttpClient";
+import * as HttpClient2 from "effect/http/HttpClient";
+import * as HttpClientResponse2 from "effect/http/HttpClientResponse";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-class DependencyInstallFailed extends Schema.TaggedError()("DependencyInstallFailed", {
-  reason: Schema.String
+class DependencyInstallFailed extends Schema3.TaggedError()("DependencyInstallFailed", {
+  reason: Schema3.String
 }) {
   get message() {
     return `Dependencies do not install from the lockfile: ${this.reason}`;
   }
 }
 
-class BundleFailed extends Schema.TaggedError()("BundleFailed", { reason: Schema.String }) {
+class BundleFailed extends Schema3.TaggedError()("BundleFailed", { reason: Schema3.String }) {
   get message() {
-    return `The Package does not bundle: ${this.reason}`;
+    return `The Kit does not bundle: ${this.reason}`;
   }
 }
 
-class DeclarationsInvalid extends Schema.TaggedError()("DeclarationsInvalid", {
-  reason: Schema.String
+class DeclarationsInvalid extends Schema3.TaggedError()("DeclarationsInvalid", {
+  reason: Schema3.String
 }) {
   get message() {
-    return `The Package's declarations are invalid: ${this.reason}`;
+    return `The Kit's declarations are invalid: ${this.reason}`;
   }
 }
-var RepositoryText = Schema.Union([Schema.String, Schema.Struct({ file: Schema.String })]);
-var ConfigAgents = Schema.Record(Schema.String, Schema.Struct({
-  extends: Schema.optionalKey(Schema.String),
-  instructions: Schema.optionalKey(RepositoryText),
-  harness: Schema.optionalKey(Schema.String),
-  model: Schema.optionalKey(Schema.String),
-  effort: AgentDeclaration.fields.effort,
-  kits: Schema.optionalKey(Schema.Array(Schema.String)),
-  network: Schema.optionalKey(Schema.Union([Schema.Struct({ hosts: Schema.Array(Schema.String) }), Schema.Literal("open")])),
-  sandbox: Schema.optionalKey(Schema.Literal("docker"))
+
+class SourceFetchFailed extends Schema3.TaggedError()("SourceFetchFailed", {
+  reason: Schema3.String
+}) {
+  get message() {
+    return `A setup source does not fetch: ${this.reason}`;
+  }
+}
+var RepositoryText = Schema3.Union([Schema3.String, Schema3.Struct({ file: Schema3.String })]);
+var ConfigAgents = Schema3.Record(Schema3.String, Schema3.Struct({
+  ...AgentDeclaration.fields,
+  instructions: Schema3.optionalKey(RepositoryText)
 }));
-var ConfigKits = Schema.Record(Schema.String, Schema.Union([
-  KitInstallationDeclaration,
-  KitAssignmentDeclaration,
-  Schema.Struct({
-    name: Schema.String,
-    kind: Schema.optionalKey(Schema.Literals(["technology", "brand", "domain", "process", "other"])),
-    description: Schema.optionalKey(Schema.String),
-    context: RepositoryText,
-    skills: Schema.optionalKey(Schema.Array(Schema.String))
-  })
-]));
-var run = (command, args, cwd) => Effect.gen(function* () {
+var run = (command, args, cwd) => Effect2.gen(function* () {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const handle = yield* spawner.spawn(ChildProcess.make(command, args, { cwd, stdin: "ignore" }));
-  const [stdout, stderr, exitCode] = yield* Effect.all([
+  const [stdout, stderr, exitCode] = yield* Effect2.all([
     Stream.mkString(Stream.decodeText(handle.stdout)),
     Stream.mkString(Stream.decodeText(handle.stderr)),
     handle.exitCode
   ], { concurrency: 3 });
   return { stdout, stderr, ok: exitCode === 0 };
-}).pipe(Effect.scoped);
+}).pipe(Effect2.scoped);
 var failure = (result) => (result.stderr.trim() || result.stdout.trim()).slice(-2000);
-var provenance = (directory) => Effect.gen(function* () {
-  const git = (...args) => run("git", args, directory).pipe(Effect.map((result) => result.ok ? result.stdout.trim() : undefined), Effect.orElseSucceed(() => {
+var provenance = (directory) => Effect2.gen(function* () {
+  const git = (...args) => run("git", args, directory).pipe(Effect2.map((result) => result.ok ? result.stdout.trim() : undefined), Effect2.orElseSucceed(() => {
     return;
   }));
   const repository = yield* git("remote", "get-url", "origin");
@@ -87,128 +235,395 @@ var provenance = (directory) => Effect.gen(function* () {
     clean: commit !== undefined && status === ""
   };
 });
-var inRepository = (directory, file, what) => Effect.gen(function* () {
+var inKit = (directory, file, what) => Effect2.gen(function* () {
   const path = yield* Path.Path;
   const resolved = path.resolve(directory, file);
   if (path.relative(directory, resolved).startsWith(".."))
-    return yield* new DeclarationsInvalid({ reason: `${what} ${file} is outside the repository` });
+    return yield* new DeclarationsInvalid({ reason: `${what} ${file} is outside the Kit` });
   return resolved;
 });
-var readText = (directory, text, what) => Effect.gen(function* () {
-  if (Predicate.isString(text))
+var readText = (directory, text, what) => Effect2.gen(function* () {
+  if (Predicate2.isString(text))
     return text;
   const fs = yield* FileSystem.FileSystem;
-  const file = yield* inRepository(directory, text.file, what);
-  return yield* fs.readFileString(file).pipe(Effect.mapError(() => new DeclarationsInvalid({ reason: `${what} ${text.file} does not read` })));
+  const file = yield* inKit(directory, text.file, what);
+  return yield* fs.readFileString(file).pipe(Effect2.mapError(() => new DeclarationsInvalid({ reason: `${what} ${text.file} does not read` })));
 });
-var readAgents = (directory, agents) => Effect.forEach(Object.entries(agents), ([id, { instructions, ...agent }]) => instructions === undefined ? Effect.succeed([id, agent]) : Effect.map(readText(directory, instructions, `Agent "${id}" instructions`), (text) => [id, { ...agent, instructions: text.trim() }])).pipe(Effect.map(Object.fromEntries));
+var readAgents = (directory, agents) => Effect2.forEach(Object.entries(agents), ([id, { instructions, ...agent }]) => instructions === undefined ? Effect2.succeed([id, agent]) : Effect2.map(readText(directory, instructions, `Agent "${id}" instructions`), (text) => [id, { ...agent, instructions: text.trim() }])).pipe(Effect2.map(Object.fromEntries));
 var utf8 = new TextDecoder("utf-8", { fatal: true });
-var readSkill = (directory, skill, what) => Effect.gen(function* () {
+var setupFile = (bytes) => {
+  try {
+    const text = utf8.decode(bytes);
+    return text.includes("\x00") ? { base64: Base64.encode(bytes) } : { utf8: text };
+  } catch {
+    return { base64: Base64.encode(bytes) };
+  }
+};
+var confined = (boundary, file, what) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const unreadable = () => new DeclarationsInvalid({ reason: `${what} does not read` });
+  const real = yield* fs.realPath(path.join(boundary, file)).pipe(Effect2.mapError(unreadable));
+  if (path.relative(yield* fs.realPath(boundary).pipe(Effect2.mapError(unreadable)), real).startsWith(".."))
+    return yield* new DeclarationsInvalid({ reason: `${what}: ${file} links outside its source` });
+  return real;
+});
+var readTree = (root, what, fetched = false) => Effect2.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const root = yield* inRepository(directory, skill, what);
-  const unreadable = () => new DeclarationsInvalid({ reason: `${what} ${skill} does not read` });
-  const entries = yield* fs.readDirectory(root, { recursive: true }).pipe(Effect.mapError(unreadable));
+  const unreadable = () => new DeclarationsInvalid({ reason: `${what} does not read` });
+  const entries = yield* fs.readDirectory(root, { recursive: true }).pipe(Effect2.mapError(unreadable));
   const files = {};
   for (const entry of entries.toSorted()) {
-    const file = path.join(root, entry);
-    if ((yield* fs.stat(file).pipe(Effect.mapError(unreadable))).type !== "File")
+    const relative = entry.split(path.sep).join("/");
+    if (relative === ".git" || relative.startsWith(".git/"))
       continue;
-    const bytes = yield* fs.readFile(file).pipe(Effect.mapError(unreadable));
-    const text = yield* Effect.try({
-      try: () => utf8.decode(bytes),
-      catch: () => new DeclarationsInvalid({ reason: `${what} ${skill} holds a binary file, ${entry}` })
-    });
-    if (text.includes("\x00"))
-      return yield* new DeclarationsInvalid({ reason: `${what} ${skill} holds a binary file, ${entry}` });
-    files[entry.split(path.sep).join("/")] = text;
+    const file = fetched ? yield* confined(root, entry, what) : path.join(root, entry);
+    if ((yield* fs.stat(file).pipe(Effect2.mapError(unreadable))).type !== "File")
+      continue;
+    files[relative] = yield* fs.readFile(file).pipe(Effect2.mapError(unreadable));
   }
-  if (files["SKILL.md"] === undefined)
-    return yield* new DeclarationsInvalid({ reason: `${what} ${skill} has no SKILL.md` });
-  return [path.basename(root), files];
-});
-var readKits = (directory, kits) => Effect.forEach(Object.entries(kits), ([key, kit]) => Effect.gen(function* () {
-  if (!("context" in kit))
-    return [key, kit];
-  const { context, skills, ...authored } = kit;
-  const what = `Kit "${key}"`;
-  return [
-    key,
-    {
-      ...authored,
-      context: yield* readText(directory, context, `${what} context`),
-      ...skills === undefined ? undefined : {
-        skills: Object.fromEntries(yield* Effect.forEach(skills, (skill) => readSkill(directory, skill, `${what} skill`)))
-      }
+  return files;
+});
+var licenseFiles = ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING"];
+var fetchedTree = (root, path, what) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const paths = yield* Path.Path;
+  const tree = yield* readTree(path === undefined ? root : yield* confined(root, path, what), what, true);
+  if (path === undefined)
+    return tree;
+  for (const license of licenseFiles)
+    if (tree[license] === undefined && (yield* fs.exists(paths.join(root, license))))
+      return { ...tree, [license]: yield* fs.readFile(yield* confined(root, license, what)).pipe(Effect2.orDie) };
+  return tree;
+});
+var GitSourceLocation = Context2.Reference("kitman/sdk/build/GitSourceLocation", { defaultValue: () => (declared) => declared });
+var fetchGit = (declared, what) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const { url, ref } = (yield* GitSourceLocation)(declared);
+  const checkout = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-git-" });
+  for (const args of [
+    ["init", "--quiet"],
+    ["fetch", "--quiet", "--depth", "1", "--", url, ref ?? "HEAD"],
+    ["checkout", "--quiet", "FETCH_HEAD"]
+  ]) {
+    const result = yield* run("git", args, checkout);
+    if (!result.ok)
+      return yield* new SourceFetchFailed({
+        reason: `${what}: git ${url}${ref === undefined ? "" : ` at ${ref}`}: ${failure(result)}`
+      });
+  }
+  return checkout;
+});
+var fetchNpm = (name, wanted, what) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const registry = yield* Config2.String("NPM_CONFIG_REGISTRY").pipe(Config2.withDefault("https://registry.npmjs.org"), Effect2.orDie);
+  const failed = (reason) => new SourceFetchFailed({ reason: `${what}: npm ${name}@${wanted}: ${reason}` });
+  const packument = yield* HttpClient2.get(`${registry.replace(/\/+$/, "")}/${name.replace("/", "%2F")}`).pipe(Effect2.flatMap(HttpClientResponse2.filterStatusOk), Effect2.flatMap(HttpClientResponse2.schemaBodyJson(Packument)), Effect2.mapError((error) => failed(error.message)));
+  const dist = packument.versions[packument["dist-tags"][wanted] ?? wanted]?.dist;
+  if (dist === undefined)
+    return yield* failed("npm has no such version or dist-tag");
+  const tarball = yield* HttpClient2.get(dist.tarball).pipe(Effect2.flatMap(HttpClientResponse2.filterStatusOk), Effect2.flatMap((response) => response.arrayBuffer), Effect2.map((buffer) => new Uint8Array(buffer)), Effect2.mapError((error) => failed(error.message)));
+  if (!tarballMatches(tarball, dist))
+    return yield* failed(`the tarball does not match its integrity ${dist.integrity ?? `sha1 ${dist.shasum}`}`);
+  const directory = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-npm-" });
+  yield* fs.writeFile(path.join(directory, "package.tgz"), tarball).pipe(Effect2.orDie);
+  const extracted = yield* run("tar", ["-xzf", "package.tgz"], directory);
+  if (!extracted.ok)
+    return yield* failed(`the tarball does not extract: ${failure(extracted)}`);
+  return yield* confined(directory, "package", what);
+}).pipe(Effect2.provide(FetchHttpClient2.layer));
+var sourceTree = (directory, source, what, checkouts) => Effect2.gen(function* () {
+  switch (source.kind) {
+    case "local_path":
+      return yield* readTree(yield* inKit(directory, source.path, what), what);
+    case "git": {
+      const key = `${source.url}#${source.ref ?? ""}`;
+      const checkout = checkouts.get(key) ?? (yield* fetchGit({ url: source.url, ref: source.ref }, what));
+      checkouts.set(key, checkout);
+      return yield* fetchedTree(checkout, "path" in source ? source.path : undefined, what);
     }
-  ];
-})).pipe(Effect.map(Object.fromEntries));
-var PackageJson = Schema.fromJsonString(Schema.Struct({ name: Schema.String }));
-var packageName = (root) => Effect.gen(function* () {
+    case "package":
+      return yield* fetchedTree(yield* fetchNpm(source.packageName, source.version ?? "latest", what), "path" in source ? source.path : undefined, what);
+    default:
+      return yield* new DeclarationsInvalid({
+        reason: `${what} comes from a ${source.kind} source, which a build cannot copy in; use a local path, git or npm`
+      });
+  }
+});
+var setupArchive = (directory, kit, setup, checkouts) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const files = {};
+  const place = (prefix, tree) => {
+    for (const [file, bytes] of Object.entries(tree))
+      files[`${prefix}/${file}`] = setupFile(bytes);
+    return { kind: "local_path", path: prefix };
+  };
+  if (setup.instructions !== undefined) {
+    const what = `Kit ${kit} instructions`;
+    const file = yield* inKit(directory, setup.instructions, what);
+    files["instructions.md"] = setupFile(yield* fs.readFile(file).pipe(Effect2.mapError(() => new DeclarationsInvalid({ reason: `${what} do not read` }))));
+  }
+  const skills = setup.skills === undefined ? undefined : yield* Effect2.forEach(setup.skills, (skill) => Effect2.map(sourceTree(directory, skill.source, `Kit ${kit} skill ${skill.name}`, checkouts), (tree) => ({
+    ...skill,
+    source: place(`skills/${skill.name}`, tree)
+  })));
+  const plugins = setup.plugins === undefined ? undefined : yield* Effect2.forEach(setup.plugins, (plugin) => Effect2.map(sourceTree(directory, plugin.sources[0], `Kit ${kit} plugin ${plugin.name}`, checkouts), (tree) => ({
+    ...plugin,
+    sources: [place(`plugins/${plugin.name}`, tree)]
+  })));
+  const archive = {
+    setup: {
+      ...setup,
+      ...setup.instructions === undefined ? undefined : { instructions: "instructions.md" },
+      ...skills === undefined ? undefined : { skills },
+      ...plugins === undefined ? undefined : { plugins }
+    },
+    files
+  };
+  const bytes = new TextEncoder().encode(canonicalJson(archive));
+  return { digest: digestSha256(bytes, "hex"), archive: bytes };
+});
+var PackageJson2 = Schema3.fromJsonString(Schema3.Struct({
+  name: Schema3.String,
+  version: Schema3.optionalKey(Schema3.String),
+  dependencies: Schema3.optionalKey(Schema3.Record(Schema3.String, Schema3.String))
+}));
+var readPackageJson = (directory) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  return yield* fs.readFileString(path.join(directory, "package.json")).pipe(Effect2.flatMap(Schema3.decodeEffect(PackageJson2)), Effect2.mapError(() => new DeclarationsInvalid({ reason: `${directory}/package.json has no name` })));
+});
+var identityOf = (manifest) => ({
+  name: manifest.name,
+  version: manifest.version ?? "0.0.0"
+});
+var installedPackage = (name, directory) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  for (let at = directory;; at = path.dirname(at)) {
+    const candidate = path.join(at, "node_modules", name);
+    if (yield* fs.exists(path.join(candidate, "package.json")))
+      return yield* fs.realPath(candidate);
+    if (path.dirname(at) === at)
+      return;
+  }
+});
+var importedFile = (file, specifier) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const target = path.resolve(path.dirname(file), specifier);
+  for (const candidate of [target, `${target}.ts`, path.join(target, "kitman.config.ts")])
+    if (yield* fs.stat(candidate).pipe(Effect2.map((info) => info.type === "File"), Effect2.orElseSucceed(() => false)))
+      return candidate;
+  return;
+});
+var packageDirectory = (file) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  for (let at = path.dirname(file);; at = path.dirname(at)) {
+    if (yield* fs.exists(path.join(at, "package.json")).pipe(Effect2.orElseSucceed(() => false)))
+      return at;
+    if (path.dirname(at) === at)
+      return;
+  }
+});
+var kitModules = (root) => Effect2.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  return yield* fs.readFileString(path.join(root, "package.json")).pipe(Effect.flatMap(Schema.decodeEffect(PackageJson)), Effect.map((manifest) => manifest.name), Effect.mapError(() => new DeclarationsInvalid({ reason: "package.json has no name" })));
+  const found = [];
+  const visited = new Set;
+  const packages = new Set([root]);
+  const known = (directory) => packages.has(directory);
+  const visitPackage = (directory) => Effect2.gen(function* () {
+    for (const name of Object.keys((yield* readPackageJson(directory)).dependencies ?? {})) {
+      const installed = yield* installedPackage(name, directory).pipe(Effect2.orElseSucceed(() => {
+        return;
+      }));
+      const module = installed === undefined ? undefined : path.join(installed, "kitman.config.ts");
+      if (installed === undefined || module === undefined || known(installed))
+        continue;
+      if (!(yield* fs.exists(module).pipe(Effect2.orElseSucceed(() => false))))
+        continue;
+      packages.add(installed);
+      found.push({ directory: installed, module, identity: identityOf(yield* readPackageJson(installed)) });
+      yield* visitPackage(installed);
+      yield* visitImports(module);
+    }
+  });
+  const visitImports = (file) => Effect2.gen(function* () {
+    if (visited.has(file))
+      return;
+    visited.add(file);
+    const transpiled = yield* run("bun", ["build", "--no-bundle", file], root).pipe(Effect2.map((result) => result.ok ? result.stdout : ""), Effect2.orElseSucceed(() => ""));
+    for (const [, specifier] of transpiled.matchAll(/\b(?:from|import)\s*"(\.{1,2}\/[^"]+)"/gu)) {
+      const module = specifier === undefined ? undefined : yield* importedFile(file, specifier);
+      if (module === undefined || visited.has(module))
+        continue;
+      const directory = yield* packageDirectory(module);
+      if (directory !== undefined && directory !== root) {
+        found.push({ directory, module, identity: identityOf(yield* readPackageJson(directory)) });
+        if (!known(directory)) {
+          packages.add(directory);
+          yield* visitPackage(directory);
+        }
+      }
+      yield* visitImports(module);
+    }
+  });
+  yield* visitPackage(root);
+  yield* visitImports(path.join(root, "kitman.config.ts"));
+  return found;
 });
+var buildEntry = (identity, modules) => [
+  "import config from './kitman.config.ts'",
+  "import { runKit } from '@kitman-sh/sdk/program'",
+  ...modules.map((kit, index) => `import * as kit${index} from ${JSON.stringify(kit.module)}`),
+  "",
+  `runKit(config, ${JSON.stringify(identity)}, [${modules.map((kit, index) => `[kit${index}.default, ${JSON.stringify(kit.identity)}]`).join(", ")}])`,
+  ""
+].join(`
+`);
 var renamedKey = (declarations, what, from, to) => {
-  const key = Object.keys(declarations ?? {}).find((key) => Predicate.hasProperty(declarations?.[key], from));
+  const key = Object.keys(declarations ?? {}).find((key) => Predicate2.hasProperty(declarations?.[key], from));
   return key === undefined ? undefined : new DeclarationsInvalid({ reason: `${what} "${key}" names \`${from}\`, which is now \`${to}\`` });
 };
-var duplicateLoopId = (loops) => loops.map((loop) => loop.id).find((id, index, ids) => ids.indexOf(id) !== index);
-var buildPackage = (directory) => Effect.gen(function* () {
+var resolveNames = (names) => {
+  const winners = new Map;
+  const overrides = [];
+  for (const named of names) {
+    const key = `${named.what}\x00${named.name}`;
+    const winner = winners.get(key);
+    if (winner === undefined)
+      winners.set(key, named.kit);
+    else if (winner === named.kit)
+      return new DeclarationsInvalid({ reason: `Kit ${named.kit} names ${named.what} ${named.name} twice` });
+    else
+      overrides.push({ what: named.what, name: named.name, winner, replaced: named.kit });
+  }
+  return { wins: (named) => winners.get(`${named.what}\x00${named.name}`) === named.kit, overrides };
+};
+var buildKit = (directory, options = {}) => Effect2.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const root = path.resolve(directory);
   const source = yield* provenance(root);
-  const name = yield* packageName(root);
-  const installed = yield* run("bun", ["install", "--frozen-lockfile", "--ignore-scripts"], root).pipe(Effect.mapError((error) => new DependencyInstallFailed({ reason: error.message })));
+  const identity = { ...identityOf(yield* readPackageJson(root)), ...options };
+  const installed = yield* run("bun", ["install", "--frozen-lockfile", "--ignore-scripts"], root).pipe(Effect2.mapError((error) => new DependencyInstallFailed({ reason: error.message })));
   if (!installed.ok)
     return yield* new DependencyInstallFailed({ reason: failure(installed) });
+  const packages = yield* kitModules(root);
   const entry = path.join(root, ".kitman-build-entry.ts");
-  yield* Effect.acquireRelease(fs.writeFileString(entry, `import config from './kitman.config.ts'
-import { runPackage } from '@kitman-sh/sdk/program'
-
-runPackage(config)
-`), () => Effect.ignore(fs.remove(entry)));
-  const out = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-package-" });
+  yield* Effect2.acquireRelease(fs.writeFileString(entry, buildEntry(identity, packages)), () => Effect2.ignore(fs.remove(entry)));
+  const out = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-kit-" });
   const bundleFile = path.join(out, "bundle.js");
   const bundled = yield* run("bun", ["build", entry, "--target=bun", "--format=esm", "--outfile", bundleFile], root);
   if (!bundled.ok)
-    return yield* new BundleFailed({ reason: failure(bundled) });
+    return yield* failure(bundled).includes('"defineConfig"') ? new DeclarationsInvalid({
+      reason: "defineConfig is now defineKit; import defineKit from @kitman-sh/sdk/loop"
+    }) : new BundleFailed({ reason: failure(bundled) });
   const described = yield* run("bun", [bundleFile, describeFlag2], out);
   if (!described.ok)
     return yield* new BundleFailed({ reason: `the bundle does not load: ${failure(described)}` });
-  const result = yield* Schema.decodeEffect(Schema.fromJsonString(Schema.toCodecJson(Described2)))(described.stdout).pipe(Effect.mapError((error) => new BundleFailed({ reason: `the bundle described itself wrongly: ${error.message}` })));
-  if (Predicate.isTagged(result, "Refused"))
+  const result = yield* Schema3.decodeEffect(Schema3.fromJsonString(Schema3.toCodecJson(Described2)))(described.stdout).pipe(Effect2.mapError((error) => new BundleFailed({ reason: `the bundle described itself wrongly: ${error.message}` })));
+  if (Predicate2.isTagged(result, "Refused"))
     return yield* result.error;
-  const duplicate = duplicateLoopId(result.loops);
-  if (duplicate !== undefined)
-    return yield* new DeclarationsInvalid({ reason: `Loop "${duplicate}" is declared twice` });
-  const renamed = renamedKey(result.schedules, "Schedule", "project", "team") ?? renamedKey(result.schedules, "Schedule", "codebase", "team") ?? renamedKey(result.kits, "Kit", "projects", "teams") ?? renamedKey(result.kits, "Kit", "codebases", "teams");
+  const [own] = result.kits;
+  if (own === undefined)
+    return yield* new BundleFailed({ reason: "the bundle described no Kit" });
+  const renamed = renamedKey(own.schedules, "Schedule", "project", "team") ?? renamedKey(own.schedules, "Schedule", "codebase", "team");
   if (renamed !== undefined)
     return yield* renamed;
-  const agents = yield* Schema.decodeUnknownEffect(ConfigAgents)(result.agents).pipe(Effect.mapError((error) => new DeclarationsInvalid({ reason: error.message })));
-  const kits = result.kits === undefined ? undefined : yield* Schema.decodeUnknownEffect(ConfigKits)(result.kits).pipe(Effect.mapError((error) => new DeclarationsInvalid({ reason: error.message })));
-  const declarations = yield* Schema.decodeUnknownEffect(PackageDeclarations)({
-    loops: result.loops,
-    agents: yield* readAgents(root, agents),
-    ...result.schedules === undefined ? undefined : { schedules: result.schedules },
-    ...kits === undefined ? undefined : { kits: yield* readKits(root, kits) }
-  }).pipe(Effect.mapError((error) => new DeclarationsInvalid({ reason: error.message })));
-  const bundle = yield* fs.readFile(bundleFile).pipe(Effect.mapError((error) => new BundleFailed({ reason: error.message })));
+  const directories = new Map([
+    [`${identity.name}@${identity.version}`, root],
+    ...packages.map((kit) => [`${kit.identity.name}@${kit.identity.version}`, kit.directory])
+  ]);
+  const kits = yield* Effect2.forEach(result.kits, (kit) => Effect2.gen(function* () {
+    const at = directories.get(`${kit.name}@${kit.version}`) ?? root;
+    const invalid = (error) => new DeclarationsInvalid({ reason: `Kit ${kit.name}: ${error.message}` });
+    const agents = yield* Schema3.decodeUnknownEffect(ConfigAgents)(kit.agents).pipe(Effect2.mapError(invalid));
+    return { ...kit, directory: at, agents: yield* readAgents(at, agents), setup: kit.setup ?? {} };
+  }));
+  const named = kits.flatMap((kit) => [
+    ...kit.loops.map((loop) => ({ kit: kit.name, what: "Loop", name: loop.id })),
+    ...Object.keys(kit.agents).map((agent) => ({ kit: kit.name, what: "Agent", name: agent })),
+    ...(kit.setup.skills ?? []).map((skill) => ({ kit: kit.name, what: "skill", name: skill.name })),
+    ...(kit.setup.plugins ?? []).map((plugin) => ({ kit: kit.name, what: "plugin", name: plugin.name })),
+    ...(kit.setup.mcpServers ?? []).map((server) => ({ kit: kit.name, what: "MCP server", name: server.name }))
+  ]);
+  const kitman = named.find((entry) => entry.what === "MCP server" && entry.name === kitmanMcpServer);
+  if (kitman !== undefined)
+    return yield* new DeclarationsInvalid({
+      reason: `Kit ${kitman.kit} declares an MCP server named ${kitmanMcpServer}, which Kitman provides`
+    });
+  const names = resolveNames(named);
+  if (Predicate2.isTagged(names, "DeclarationsInvalid"))
+    return yield* names;
+  const winning = kits.map((kit) => ({
+    ...kit,
+    loops: kit.loops.filter((loop) => names.wins({ kit: kit.name, what: "Loop", name: loop.id })),
+    agents: Object.fromEntries(Object.entries(kit.agents).filter(([agent]) => names.wins({ kit: kit.name, what: "Agent", name: agent })))
+  }));
+  const checkouts = new Map;
+  const archives = yield* Effect2.forEach(kits, (kit) => setupArchive(kit.directory, kit.name, kit.setup, checkouts));
+  const carried = winning.map((kit, index) => ({
+    name: kit.name,
+    version: kit.version,
+    setup: archives[index]?.digest ?? "",
+    loops: kit.loops.map((loop) => loop.id),
+    agents: Object.keys(kit.agents)
+  }));
+  const declarations = yield* Schema3.decodeUnknownEffect(KitDeclarations)({
+    loops: winning.flatMap((kit) => kit.loops),
+    agents: Object.assign({}, ...winning.map((kit) => kit.agents)),
+    ...own.schedules === undefined ? undefined : { schedules: own.schedules },
+    carried
+  }).pipe(Effect2.mapError((error) => new DeclarationsInvalid({ reason: error.message })));
+  const bundle = yield* fs.readFile(bundleFile).pipe(Effect2.mapError((error) => new BundleFailed({ reason: error.message })));
   return {
-    name,
+    ...identity,
     bundle,
     digest: digestSha256(bundle, "hex"),
     declarations,
+    setupArchives: archives,
     protocolVersion: RunnerRpcProtocolVersion,
-    provenance: source
+    provenance: source,
+    overrides: names.overrides
   };
-}).pipe(Effect.scoped, Effect.catchTags({
-  PlatformError: (error) => Effect.fail(new BundleFailed({ reason: error.message }))
+}).pipe(Effect2.scoped, Effect2.catchTags({
+  PlatformError: (error) => Effect2.fail(new BundleFailed({ reason: error.message }))
 }));
+var writeKit = (directory, built, out) => Effect2.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const inKit = (file) => path.relative(directory, path.join(out, file));
+  const setup = {};
+  yield* fs.makeDirectory(path.join(out, "setup"), { recursive: true });
+  yield* fs.writeFile(path.join(out, "bundle.js"), built.bundle);
+  yield* fs.writeFileString(path.join(out, "declarations.json"), yield* encodePrettyJsonString(built.declarations));
+  for (const { digest, archive } of built.setupArchives) {
+    yield* fs.writeFile(path.join(out, "setup", `${digest}.json`), archive);
+    setup[digest] = inKit(`setup/${digest}.json`);
+  }
+  const manifestPath = path.join(directory, "package.json");
+  const manifest = yield* fs.readFileString(manifestPath).pipe(Effect2.flatMap(Schema3.decodeEffect(Schema3.fromJsonString(Schema3.Record(Schema3.String, Schema3.Json)))));
+  const kitman = {
+    bundle: inKit("bundle.js"),
+    digest: built.digest,
+    protocolVersion: built.protocolVersion,
+    declarations: inKit("declarations.json"),
+    setup
+  };
+  yield* fs.writeFileString(manifestPath, `${yield* encodePrettyJsonString({ ...manifest, kitman })}
+`);
+});
 export {
   BundleFailed,
   DeclarationsInvalid,
   DependencyInstallFailed,
-  buildPackage
+  GitSourceLocation,
+  SourceFetchFailed,
+  buildKit,
+  writeKit
 };