@camstack/system 1.2.380 → 1.2.382

package/dist/restore-archive-BV39nY46.mjs

@@ -0,0 +1,4045 @@
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CP5TTjwd.mjs";
+import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
+import { Buffer as Buffer$1 } from "buffer";
+import * as fsp from "node:fs/promises";
+import jn from "node:fs/promises";
+import * as path$1 from "node:path";
+import path, { basename, join, posix, win32 } from "node:path";
+import * as fs$1 from "node:fs";
+import Kt from "node:fs";
+import * as zlib from "node:zlib";
+import { EventEmitter } from "node:events";
+import As, { Transform } from "node:stream";
+import { StringDecoder } from "node:string_decoder";
+import I from "fs";
+import qs, { dirname as dirname$1, parse } from "path";
+import * as Ms from "zlib";
+import Jr from "zlib";
+import Pi from "assert";
+import $r, { EventEmitter as EventEmitter$1 } from "events";
+import { pipeline } from "node:stream/promises";
+import no from "node:assert";
+//#region src/builtins/system-backup/backup-encryption.ts
+/**
+* Backup archive encryption — public key, streaming, chunked AEAD (D-backup
+* encryption, operator decision 2026-10-09).
+*
+* ## Why a public-key scheme
+*
+* Scheduled backups run with nobody present, so the hub must be able to
+* ENCRYPT on its own. With a symmetric key the hub would also hold what
+* DECRYPTS every archive it ever shipped — in its database, in the nightly
+* appdata tar, in any copy of the data volume — and the archives on SMB / S3
+* would be exactly as safe as the hub. Here the hub keeps only the PUBLIC key:
+* an attacker with the hub, its database or its volume backup still cannot
+* open an archive that already left. The operator keeps the secret key (shown
+* once at setup) and gives it back at restore time. It is independent of the
+* keychain master key, so a restore onto a fresh hub needs nothing from the
+* old one, and a keychain reset does not strand the backups.
+*
+* ## Format `x25519-hkdf-aes256gcm-stream-v1` (age's STREAM construction, AES-GCM)
+*
+*     header (69 bytes)
+*       magic "CSBKENC1" (8) | version 1 (1) | chunk size u32 BE (4)
+*       | recipient key id (8) | ephemeral X25519 public key (32) | salt (16)
+*     chunks
+*       AES-256-GCM(payloadKey, nonce, plaintext[≤ chunk]) ‖ tag(16)
+*
+* `payloadKey = HKDF-SHA256(X25519(ephemeral, recipient), salt,
+*  "camstack-backup-v1" ‖ header)` — the whole header is bound into the key,
+* so a changed byte in it fails the first chunk. The nonce is an 11-byte
+* big-endian chunk counter plus a final-chunk flag: a reordered, dropped or
+* appended chunk fails authentication, and an archive cut at a chunk boundary
+* is refused because its last chunk is not marked final. Every archive has a
+* final chunk (empty when the plaintext is a multiple of the chunk size).
+*
+* Memory is one chunk (64 KiB by default) per stream, whatever the archive
+* size. `scripts/ops/backup-decrypt.mjs` implements the same format with
+* nothing but Node, for a restore without a hub.
+*/
+var BACKUP_ENCRYPTION_SCHEME = "x25519-hkdf-aes256gcm-stream-v1";
+var ENCRYPTED_BACKUP_SUFFIX = ".csbk";
+var MAGIC = Buffer.from("CSBKENC1", "ascii");
+var VERSION = 1;
+var KEY_ID_BYTES = 8;
+var SALT_BYTES = 16;
+var TAG_BYTES = 16;
+var INFO_LABEL = Buffer.from("camstack-backup-v1", "ascii");
+var BACKUP_ENCRYPTION_HEADER_BYTES = MAGIC.length + 1 + 4 + KEY_ID_BYTES + 32 + SALT_BYTES;
+var MAX_CHUNK_BYTES = 16 * 1024 * 1024;
+var SECRET_PREFIX = "camstack-backup-secret-v1:";
+var PUBLIC_PREFIX = "camstack-backup-public-v1:";
+var CHECKSUM_BYTES = 4;
+var PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+var SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+/** A key string that is not a backup key, or was mistyped. */
+var BackupKeyFormatError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BackupKeyFormatError";
+	}
+};
+/** The archive was encrypted to another backup key. */
+var BackupKeyMismatchError = class extends Error {
+	archiveKeyId;
+	givenKeyId;
+	constructor(archiveKeyId, givenKeyId) {
+		super(`this backup was encrypted to backup key ${archiveKeyId}; the key given is ${givenKeyId}. Use the key that was current when the backup was made.`);
+		this.archiveKeyId = archiveKeyId;
+		this.givenKeyId = givenKeyId;
+		this.name = "BackupKeyMismatchError";
+	}
+};
+/** The archive is damaged, truncated or tampered with. */
+var BackupDecryptError = class extends Error {
+	constructor(message) {
+		super(`encrypted backup is unreadable: ${message}`);
+		this.name = "BackupDecryptError";
+	}
+};
+function checksum(prefix, raw) {
+	return createHash("sha256").update(prefix).update(raw).digest().subarray(0, CHECKSUM_BYTES);
+}
+function encodeKey(prefix, raw) {
+	return `${prefix}${Buffer.concat([raw, checksum(prefix, raw)]).toString("base64url")}`;
+}
+function decodeKey(prefix, text, what) {
+	const trimmed = text.trim();
+	if (!trimmed.startsWith(prefix)) throw new BackupKeyFormatError(`not a backup ${what} key (it must start with "${prefix}")`);
+	const bytes = Buffer.from(trimmed.slice(prefix.length), "base64url");
+	if (bytes.length !== 36) throw new BackupKeyFormatError(`the backup ${what} key has the wrong length — copy it again`);
+	const raw = bytes.subarray(0, 32);
+	if (!checksum(prefix, raw).equals(bytes.subarray(32))) throw new BackupKeyFormatError(`the backup ${what} key does not check out — it was mistyped`);
+	return Buffer.from(raw);
+}
+function keyIdBytes(publicRaw) {
+	return createHash("sha256").update(publicRaw).digest().subarray(0, KEY_ID_BYTES);
+}
+function privateKeyObject(raw) {
+	return createPrivateKey({
+		key: Buffer.concat([PKCS8_PREFIX, raw]),
+		format: "der",
+		type: "pkcs8"
+	});
+}
+function publicKeyObject(raw) {
+	return createPublicKey({
+		key: Buffer.concat([SPKI_PREFIX, raw]),
+		format: "der",
+		type: "spki"
+	});
+}
+function rawPublic(key) {
+	return key.export({
+		format: "der",
+		type: "spki"
+	}).subarray(SPKI_PREFIX.length);
+}
+function rawPrivate(key) {
+	return key.export({
+		format: "der",
+		type: "pkcs8"
+	}).subarray(PKCS8_PREFIX.length);
+}
+function generateBackupKeyPair() {
+	const { privateKey, publicKey } = generateKeyPairSync("x25519");
+	const pub = rawPublic(publicKey);
+	return {
+		secretKey: encodeKey(SECRET_PREFIX, rawPrivate(privateKey)),
+		publicKey: encodeKey(PUBLIC_PREFIX, pub),
+		keyId: keyIdBytes(pub).toString("hex")
+	};
+}
+function parseBackupPublicKey(text) {
+	const raw = decodeKey(PUBLIC_PREFIX, text, "public");
+	return {
+		raw,
+		keyId: keyIdBytes(raw).toString("hex")
+	};
+}
+function parseBackupSecretKey(text) {
+	const key = privateKeyObject(decodeKey(SECRET_PREFIX, text, "secret"));
+	const publicRaw = rawPublic(createPublicKey(key));
+	return {
+		key,
+		publicRaw,
+		keyId: keyIdBytes(publicRaw).toString("hex")
+	};
+}
+function payloadKey(shared, salt, header) {
+	return Buffer.from(hkdfSync("sha256", shared, salt, Buffer.concat([INFO_LABEL, header]), 32));
+}
+function nonceFor(counter, final) {
+	const nonce = Buffer.alloc(12);
+	nonce.writeBigUInt64BE(counter, 3);
+	nonce[11] = final ? 1 : 0;
+	return nonce;
+}
+function seal(key, counter, final, plaintext) {
+	const cipher = createCipheriv("aes-256-gcm", key, nonceFor(counter, final));
+	const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+	return Buffer.concat([body, cipher.getAuthTag()]);
+}
+function open(key, counter, final, sealed) {
+	if (sealed.length < TAG_BYTES) return null;
+	const decipher = createDecipheriv("aes-256-gcm", key, nonceFor(counter, final));
+	decipher.setAuthTag(sealed.subarray(sealed.length - TAG_BYTES));
+	try {
+		return Buffer.concat([decipher.update(sealed.subarray(0, sealed.length - TAG_BYTES)), decipher.final()]);
+	} catch {
+		return null;
+	}
+}
+/** A growing byte queue that takes exact slices without re-concatenating everything. */
+var ByteQueue = class {
+	parts = [];
+	length = 0;
+	push(buf) {
+		if (buf.length === 0) return;
+		this.parts.push(buf);
+		this.length += buf.length;
+	}
+	take(n) {
+		const out = Buffer.allocUnsafe(n);
+		let filled = 0;
+		while (filled < n) {
+			const head = this.parts[0];
+			if (head === void 0) throw new Error("ByteQueue underflow");
+			const need = n - filled;
+			if (head.length <= need) {
+				head.copy(out, filled);
+				filled += head.length;
+				this.parts.shift();
+			} else {
+				head.copy(out, filled, 0, need);
+				this.parts[0] = head.subarray(need);
+				filled += need;
+			}
+		}
+		this.length -= n;
+		return out;
+	}
+};
+function toBuffer(chunk) {
+	if (Buffer.isBuffer(chunk)) return chunk;
+	if (chunk instanceof Uint8Array) return Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+	if (typeof chunk === "string") return Buffer.from(chunk);
+	throw new TypeError("backup encryption: a stream chunk must be bytes");
+}
+/** Encrypt a byte stream to the holder of `publicKey`'s secret key. */
+function createBackupEncryptStream(publicKey, opts) {
+	const recipient = parseBackupPublicKey(publicKey);
+	const chunkBytes = opts?.chunkBytes ?? 65536;
+	if (!Number.isInteger(chunkBytes) || chunkBytes < 1 || chunkBytes > MAX_CHUNK_BYTES) throw new RangeError(`backup encryption: chunk size ${chunkBytes} is out of range`);
+	const ephemeral = generateKeyPairSync("x25519");
+	const salt = randomBytes(SALT_BYTES);
+	const sizeField = Buffer.alloc(4);
+	sizeField.writeUInt32BE(chunkBytes);
+	const header = Buffer.concat([
+		MAGIC,
+		Buffer.from([VERSION]),
+		sizeField,
+		keyIdBytes(recipient.raw),
+		rawPublic(ephemeral.publicKey),
+		salt
+	]);
+	const key = payloadKey(diffieHellman({
+		privateKey: ephemeral.privateKey,
+		publicKey: publicKeyObject(recipient.raw)
+	}), salt, header);
+	const queue = new ByteQueue();
+	let counter = 0n;
+	let headerSent = false;
+	const sendHeader = (stream) => {
+		if (headerSent) return;
+		headerSent = true;
+		stream.push(header);
+	};
+	return new Transform({
+		transform(chunk, _enc, callback) {
+			try {
+				sendHeader(this);
+				queue.push(toBuffer(chunk));
+				while (queue.length > chunkBytes) {
+					this.push(seal(key, counter, false, queue.take(chunkBytes)));
+					counter += 1n;
+				}
+				callback();
+			} catch (err) {
+				callback(err instanceof Error ? err : new Error(String(err)));
+			}
+		},
+		flush(callback) {
+			try {
+				sendHeader(this);
+				this.push(seal(key, counter, true, queue.take(queue.length)));
+				callback();
+			} catch (err) {
+				callback(err instanceof Error ? err : new Error(String(err)));
+			}
+		}
+	});
+}
+function parseHeader(header) {
+	if (header.length < BACKUP_ENCRYPTION_HEADER_BYTES) return null;
+	if (!header.subarray(0, MAGIC.length).equals(MAGIC)) return null;
+	let at = MAGIC.length;
+	const version = header[at];
+	at += 1;
+	if (version !== VERSION) throw new BackupDecryptError(`format version ${String(version)} is not supported`);
+	const chunkBytes = header.readUInt32BE(at);
+	at += 4;
+	if (chunkBytes < 1 || chunkBytes > MAX_CHUNK_BYTES) throw new BackupDecryptError("the header names an impossible chunk size");
+	const keyId = header.subarray(at, at + KEY_ID_BYTES).toString("hex");
+	at += KEY_ID_BYTES;
+	const ephemeral = Buffer.from(header.subarray(at, at + 32));
+	at += 32;
+	return {
+		chunkBytes,
+		keyId,
+		ephemeral,
+		salt: Buffer.from(header.subarray(at, at + SALT_BYTES))
+	};
+}
+/** Decrypt a stream produced by {@link createBackupEncryptStream}. */
+function createBackupDecryptStream(secretKey) {
+	const recipient = parseBackupSecretKey(secretKey);
+	const queue = new ByteQueue();
+	let key = null;
+	let sealedChunk = 0;
+	let counter = 0n;
+	const openHeader = () => {
+		const header = queue.take(BACKUP_ENCRYPTION_HEADER_BYTES);
+		const parsed = parseHeader(header);
+		if (parsed === null) throw new BackupDecryptError("this is not an encrypted CamStack backup");
+		if (parsed.keyId !== recipient.keyId) throw new BackupKeyMismatchError(parsed.keyId, recipient.keyId);
+		key = payloadKey(diffieHellman({
+			privateKey: recipient.key,
+			publicKey: publicKeyObject(parsed.ephemeral)
+		}), parsed.salt, header);
+		sealedChunk = parsed.chunkBytes + TAG_BYTES;
+	};
+	const openChunk = (stream, sealed, final) => {
+		if (key === null) throw new BackupDecryptError("no header");
+		const plain = open(key, counter, final, sealed);
+		if (plain === null) throw new BackupDecryptError(final ? `the last chunk (${counter}) failed authentication — the archive is truncated, damaged or tampered with` : `chunk ${counter} failed authentication — the archive is damaged or tampered with`);
+		counter += 1n;
+		if (plain.length > 0) stream.push(plain);
+	};
+	return new Transform({
+		transform(chunk, _enc, callback) {
+			try {
+				queue.push(toBuffer(chunk));
+				if (key === null) {
+					if (queue.length < BACKUP_ENCRYPTION_HEADER_BYTES) return callback();
+					openHeader();
+				}
+				while (queue.length > sealedChunk) openChunk(this, queue.take(sealedChunk), false);
+				callback();
+			} catch (err) {
+				callback(err instanceof Error ? err : new Error(String(err)));
+			}
+		},
+		flush(callback) {
+			try {
+				if (key === null) {
+					if (queue.length < BACKUP_ENCRYPTION_HEADER_BYTES) throw new BackupDecryptError("the archive ends before its header does");
+					openHeader();
+				}
+				if (queue.length < TAG_BYTES) throw new BackupDecryptError("the archive ends without its final chunk — it is truncated");
+				openChunk(this, queue.take(queue.length), true);
+				callback();
+			} catch (err) {
+				callback(err instanceof Error ? err : new Error(String(err)));
+			}
+		}
+	});
+}
+/** The key id an encrypted archive names, or `null` for a plain (pre-encryption) archive. */
+async function readBackupEncryptionHeader(file) {
+	const handle = await fsp.open(file, "r");
+	try {
+		const header = Buffer.alloc(BACKUP_ENCRYPTION_HEADER_BYTES);
+		const { bytesRead } = await handle.read(header, 0, header.length, 0);
+		if (bytesRead < MAGIC.length || !header.subarray(0, MAGIC.length).equals(MAGIC)) return null;
+		const parsed = parseHeader(header.subarray(0, bytesRead));
+		if (parsed === null) throw new BackupDecryptError("the header is cut short");
+		return { keyId: parsed.keyId };
+	} finally {
+		await handle.close();
+	}
+}
+/**
+* File → file. A failure of any kind removes the partial output: a restore
+* must never find half a tar where the archive should be.
+*/
+async function decryptBackupFile(input, output, secretKey) {
+	const decrypt = createBackupDecryptStream(secretKey);
+	try {
+		await pipeline(fs$1.createReadStream(input), decrypt, fs$1.createWriteStream(output, { mode: 384 }));
+	} catch (err) {
+		await fsp.rm(output, { force: true }).catch(() => void 0);
+		throw err;
+	}
+}
+//#endregion
+//#region node_modules/tar/dist/esm/index.min.js
+var Mr = Object.defineProperty;
+var Br = (s, t) => {
+	for (var e in t) Mr(s, e, {
+		get: t[e],
+		enumerable: !0
+	});
+};
+var xs = typeof process == "object" && process ? process : {
+	stdout: null,
+	stderr: null
+}, zr = (s) => !!s && typeof s == "object" && (s instanceof A || s instanceof As || Ur(s) || Hr(s)), Ur = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.pipe == "function" && s.pipe !== As.Writable.prototype.pipe, Hr = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.write == "function" && typeof s.end == "function", q = Symbol("EOF"), Q = Symbol("maybeEmitEnd"), rt = Symbol("emittedEnd"), Le = Symbol("emittingEnd"), qt = Symbol("emittedError"), Ne = Symbol("closed"), Ls = Symbol("read"), De = Symbol("flush"), Ns = Symbol("flushChunk"), z = Symbol("encoding"), Mt = Symbol("decoder"), g = Symbol("flowing"), Qt = Symbol("paused"), Bt = Symbol("resume"), b = Symbol("buffer"), D = Symbol("pipes"), _ = Symbol("bufferLength"), gi = Symbol("bufferPush"), Ae = Symbol("bufferShift"), L = Symbol("objectMode"), w = Symbol("destroyed"), bi = Symbol("error"), _i = Symbol("emitData"), Ds = Symbol("emitEnd"), Oi = Symbol("emitEnd2"), Z = Symbol("async"), Ti = Symbol("abort"), Ie = Symbol("aborted"), Jt = Symbol("signal"), Rt = Symbol("dataListeners"), F = Symbol("discarded"), jt = (s) => Promise.resolve().then(s), Wr = (s) => s(), Gr = (s) => s === "end" || s === "finish" || s === "prefinish", Zr = (s) => s instanceof ArrayBuffer || !!s && typeof s == "object" && s.constructor && s.constructor.name === "ArrayBuffer" && s.byteLength >= 0, Yr = (s) => !Buffer.isBuffer(s) && ArrayBuffer.isView(s), Fe = class {
+	src;
+	dest;
+	opts;
+	ondrain;
+	constructor(t, e, i) {
+		this.src = t, this.dest = e, this.opts = i, this.ondrain = () => t[Bt](), this.dest.on("drain", this.ondrain);
+	}
+	unpipe() {
+		this.dest.removeListener("drain", this.ondrain);
+	}
+	proxyErrors(t) {}
+	end() {
+		this.unpipe(), this.opts.end && this.dest.end();
+	}
+}, xi = class extends Fe {
+	unpipe() {
+		this.src.removeListener("error", this.proxyErrors), super.unpipe();
+	}
+	constructor(t, e, i) {
+		super(t, e, i), this.proxyErrors = (r) => this.dest.emit("error", r), t.on("error", this.proxyErrors);
+	}
+}, Kr = (s) => !!s.objectMode, Vr = (s) => !s.objectMode && !!s.encoding && s.encoding !== "buffer", A = class extends EventEmitter {
+	[g] = !1;
+	[Qt] = !1;
+	[D] = [];
+	[b] = [];
+	[L];
+	[z];
+	[Z];
+	[Mt];
+	[q] = !1;
+	[rt] = !1;
+	[Le] = !1;
+	[Ne] = !1;
+	[qt] = null;
+	[_] = 0;
+	[w] = !1;
+	[Jt];
+	[Ie] = !1;
+	[Rt] = 0;
+	[F] = !1;
+	writable = !0;
+	readable = !0;
+	constructor(...t) {
+		let e = t[0] || {};
+		if (super(), e.objectMode && typeof e.encoding == "string") throw new TypeError("Encoding and objectMode may not be used together");
+		Kr(e) ? (this[L] = !0, this[z] = null) : Vr(e) ? (this[z] = e.encoding, this[L] = !1) : (this[L] = !1, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new StringDecoder(this[z]) : null, e && e.debugExposeBuffer === !0 && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === !0 && Object.defineProperty(this, "pipes", { get: () => this[D] });
+		let { signal: i } = e;
+		i && (this[Jt] = i, i.aborted ? this[Ti]() : i.addEventListener("abort", () => this[Ti]()));
+	}
+	get bufferLength() {
+		return this[_];
+	}
+	get encoding() {
+		return this[z];
+	}
+	set encoding(t) {
+		throw new Error("Encoding must be set at instantiation time");
+	}
+	setEncoding(t) {
+		throw new Error("Encoding must be set at instantiation time");
+	}
+	get objectMode() {
+		return this[L];
+	}
+	set objectMode(t) {
+		throw new Error("objectMode must be set at instantiation time");
+	}
+	get async() {
+		return this[Z];
+	}
+	set async(t) {
+		this[Z] = this[Z] || !!t;
+	}
+	[Ti]() {
+		this[Ie] = !0, this.emit("abort", this[Jt]?.reason), this.destroy(this[Jt]?.reason);
+	}
+	get aborted() {
+		return this[Ie];
+	}
+	set aborted(t) {}
+	write(t, e, i) {
+		if (this[Ie]) return !1;
+		if (this[q]) throw new Error("write after end");
+		if (this[w]) return this.emit("error", Object.assign(/* @__PURE__ */ new Error("Cannot call write after a stream was destroyed"), { code: "ERR_STREAM_DESTROYED" })), !0;
+		typeof e == "function" && (i = e, e = "utf8"), e || (e = "utf8");
+		let r = this[Z] ? jt : Wr;
+		if (!this[L] && !Buffer.isBuffer(t)) {
+			if (Yr(t)) t = Buffer.from(t.buffer, t.byteOffset, t.byteLength);
+			else if (Zr(t)) t = Buffer.from(t);
+			else if (typeof t != "string") throw new Error("Non-contiguous data written to non-objectMode stream");
+		}
+		return this[L] ? (this[g] && this[_] !== 0 && this[De](!0), this[g] ? this.emit("data", t) : this[gi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g] && this[_] !== 0 && this[De](!0), this[g] ? this.emit("data", t) : this[gi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g]);
+	}
+	read(t) {
+		if (this[w]) return null;
+		if (this[F] = !1, this[_] === 0 || t === 0 || t && t > this[_]) return this[Q](), null;
+		this[L] && (t = null), this[b].length > 1 && !this[L] && (this[b] = [this[z] ? this[b].join("") : Buffer.concat(this[b], this[_])]);
+		let e = this[Ls](t || null, this[b][0]);
+		return this[Q](), e;
+	}
+	[Ls](t, e) {
+		if (this[L]) this[Ae]();
+		else {
+			let i = e;
+			t === i.length || t === null ? this[Ae]() : typeof i == "string" ? (this[b][0] = i.slice(t), e = i.slice(0, t), this[_] -= t) : (this[b][0] = i.subarray(t), e = i.subarray(0, t), this[_] -= t);
+		}
+		return this.emit("data", e), !this[b].length && !this[q] && this.emit("drain"), e;
+	}
+	end(t, e, i) {
+		return typeof t == "function" && (i = t, t = void 0), typeof e == "function" && (i = e, e = "utf8"), t !== void 0 && this.write(t, e), i && this.once("end", i), this[q] = !0, this.writable = !1, (this[g] || !this[Qt]) && this[Q](), this;
+	}
+	[Bt]() {
+		this[w] || (!this[Rt] && !this[D].length && (this[F] = !0), this[Qt] = !1, this[g] = !0, this.emit("resume"), this[b].length ? this[De]() : this[q] ? this[Q]() : this.emit("drain"));
+	}
+	resume() {
+		return this[Bt]();
+	}
+	pause() {
+		this[g] = !1, this[Qt] = !0, this[F] = !1;
+	}
+	get destroyed() {
+		return this[w];
+	}
+	get flowing() {
+		return this[g];
+	}
+	get paused() {
+		return this[Qt];
+	}
+	[gi](t) {
+		this[L] ? this[_] += 1 : this[_] += t.length, this[b].push(t);
+	}
+	[Ae]() {
+		return this[L] ? this[_] -= 1 : this[_] -= this[b][0].length, this[b].shift();
+	}
+	[De](t = !1) {
+		do		;
+while (this[Ns](this[Ae]()) && this[b].length);
+		!t && !this[b].length && !this[q] && this.emit("drain");
+	}
+	[Ns](t) {
+		return this.emit("data", t), this[g];
+	}
+	pipe(t, e) {
+		if (this[w]) return t;
+		this[F] = !1;
+		let i = this[rt];
+		return e = e || {}, t === xs.stdout || t === xs.stderr ? e.end = !1 : e.end = e.end !== !1, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[D].push(e.proxyErrors ? new xi(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
+	}
+	unpipe(t) {
+		let e = this[D].find((i) => i.dest === t);
+		e && (this[D].length === 1 ? (this[g] && this[Rt] === 0 && (this[g] = !1), this[D] = []) : this[D].splice(this[D].indexOf(e), 1), e.unpipe());
+	}
+	addListener(t, e) {
+		return this.on(t, e);
+	}
+	on(t, e) {
+		let i = super.on(t, e);
+		if (t === "data") this[F] = !1, this[Rt]++, !this[D].length && !this[g] && this[Bt]();
+		else if (t === "readable" && this[_] !== 0) super.emit("readable");
+		else if (Gr(t) && this[rt]) super.emit(t), this.removeAllListeners(t);
+		else if (t === "error" && this[qt]) {
+			let r = e;
+			this[Z] ? jt(() => r.call(this, this[qt])) : r.call(this, this[qt]);
+		}
+		return i;
+	}
+	removeListener(t, e) {
+		return this.off(t, e);
+	}
+	off(t, e) {
+		let i = super.off(t, e);
+		return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[F] && !this[D].length && (this[g] = !1)), i;
+	}
+	removeAllListeners(t) {
+		let e = super.removeAllListeners(t);
+		return (t === "data" || t === void 0) && (this[Rt] = 0, !this[F] && !this[D].length && (this[g] = !1)), e;
+	}
+	get emittedEnd() {
+		return this[rt];
+	}
+	[Q]() {
+		!this[Le] && !this[rt] && !this[w] && this[b].length === 0 && this[q] && (this[Le] = !0, this.emit("end"), this.emit("prefinish"), this.emit("finish"), this[Ne] && this.emit("close"), this[Le] = !1);
+	}
+	emit(t, ...e) {
+		let i = e[0];
+		if (t !== "error" && t !== "close" && t !== w && this[w]) return !1;
+		if (t === "data") return !this[L] && !i ? !1 : this[Z] ? (jt(() => this[_i](i)), !0) : this[_i](i);
+		if (t === "end") return this[Ds]();
+		if (t === "close") {
+			if (this[Ne] = !0, !this[rt] && !this[w]) return !1;
+			let n = super.emit("close");
+			return this.removeAllListeners("close"), n;
+		} else if (t === "error") {
+			this[qt] = i, super.emit(bi, i);
+			let n = !this[Jt] || this.listeners("error").length ? super.emit("error", i) : !1;
+			return this[Q](), n;
+		} else if (t === "resume") {
+			let n = super.emit("resume");
+			return this[Q](), n;
+		} else if (t === "finish" || t === "prefinish") {
+			let n = super.emit(t);
+			return this.removeAllListeners(t), n;
+		}
+		let r = super.emit(t, ...e);
+		return this[Q](), r;
+	}
+	[_i](t) {
+		for (let i of this[D]) i.dest.write(t) === !1 && this.pause();
+		let e = this[F] ? !1 : super.emit("data", t);
+		return this[Q](), e;
+	}
+	[Ds]() {
+		return this[rt] ? !1 : (this[rt] = !0, this.readable = !1, this[Z] ? (jt(() => this[Oi]()), !0) : this[Oi]());
+	}
+	[Oi]() {
+		if (this[Mt]) {
+			let e = this[Mt].end();
+			if (e) {
+				for (let i of this[D]) i.dest.write(e);
+				this[F] || super.emit("data", e);
+			}
+		}
+		for (let e of this[D]) e.end();
+		let t = super.emit("end");
+		return this.removeAllListeners("end"), t;
+	}
+	async collect() {
+		let t = Object.assign([], { dataLength: 0 });
+		this[L] || (t.dataLength = 0);
+		let e = this.promise();
+		return this.on("data", (i) => {
+			t.push(i), this[L] || (t.dataLength += i.length);
+		}), await e, t;
+	}
+	async concat() {
+		if (this[L]) throw new Error("cannot concat in objectMode");
+		let t = await this.collect();
+		return this[z] ? t.join("") : Buffer.concat(t, t.dataLength);
+	}
+	async promise() {
+		return new Promise((t, e) => {
+			this.on(w, () => e(/* @__PURE__ */ new Error("stream destroyed"))), this.on("error", (i) => e(i)), this.on("end", () => t());
+		});
+	}
+	[Symbol.asyncIterator]() {
+		this[F] = !1;
+		let t = !1, e = async () => (this.pause(), t = !0, {
+			value: void 0,
+			done: !0
+		});
+		return {
+			next: () => {
+				if (t) return e();
+				let r = this.read();
+				if (r !== null) return Promise.resolve({
+					done: !1,
+					value: r
+				});
+				if (this[q]) return e();
+				let n, o, a = (d) => {
+					this.off("data", h), this.off("end", l), this.off(w, c), e(), o(d);
+				}, h = (d) => {
+					this.off("error", a), this.off("end", l), this.off(w, c), this.pause(), n({
+						value: d,
+						done: !!this[q]
+					});
+				}, l = () => {
+					this.off("error", a), this.off("data", h), this.off(w, c), e(), n({
+						done: !0,
+						value: void 0
+					});
+				}, c = () => a(/* @__PURE__ */ new Error("stream destroyed"));
+				return new Promise((d, S) => {
+					o = S, n = d, this.once(w, c), this.once("error", a), this.once("end", l), this.once("data", h);
+				});
+			},
+			throw: e,
+			return: e,
+			[Symbol.asyncIterator]() {
+				return this;
+			},
+			[Symbol.asyncDispose]: async () => {}
+		};
+	}
+	[Symbol.iterator]() {
+		this[F] = !1;
+		let t = !1, e = () => (this.pause(), this.off(bi, e), this.off(w, e), this.off("end", e), t = !0, {
+			done: !0,
+			value: void 0
+		}), i = () => {
+			if (t) return e();
+			let r = this.read();
+			return r === null ? e() : {
+				done: !1,
+				value: r
+			};
+		};
+		return this.once("end", e), this.once(bi, e), this.once(w, e), {
+			next: i,
+			throw: e,
+			return: e,
+			[Symbol.iterator]() {
+				return this;
+			},
+			[Symbol.dispose]: () => {}
+		};
+	}
+	destroy(t) {
+		if (this[w]) return t ? this.emit("error", t) : this.emit(w), this;
+		this[w] = !0, this[F] = !0, this[b].length = 0, this[_] = 0;
+		let e = this;
+		return typeof e.close == "function" && !this[Ne] && e.close(), t ? this.emit("error", t) : this.emit(w), this;
+	}
+	static get isStream() {
+		return zr;
+	}
+};
+var Xr = I.writev, ot = Symbol("_autoClose"), H = Symbol("_close"), te = Symbol("_ended"), m = Symbol("_fd"), Ni = Symbol("_finished"), j = Symbol("_flags"), Di = Symbol("_flush"), Ci = Symbol("_handleChunk"), ki = Symbol("_makeBuf"), ie = Symbol("_mode"), Ce = Symbol("_needDrain"), Ut = Symbol("_onerror"), Ht = Symbol("_onopen"), Ai = Symbol("_onread"), Pt = Symbol("_onwrite"), ht = Symbol("_open"), U = Symbol("_path"), nt = Symbol("_pos"), Y = Symbol("_queue"), zt = Symbol("_read"), Ii = Symbol("_readSize"), J = Symbol("_reading"), ee = Symbol("_remain"), Fi = Symbol("_size"), ke = Symbol("_write"), gt = Symbol("_writing"), ve = Symbol("_defaultFlag"), bt = Symbol("_errored"), _t = class extends A {
+	[bt] = !1;
+	[m];
+	[U];
+	[Ii];
+	[J] = !1;
+	[Fi];
+	[ee];
+	[ot];
+	constructor(t, e) {
+		if (e = e || {}, super(e), this.readable = !0, this.writable = !1, typeof t != "string") throw new TypeError("path must be a string");
+		this[bt] = !1, this[m] = typeof e.fd == "number" ? e.fd : void 0, this[U] = t, this[Ii] = e.readSize || 16 * 1024 * 1024, this[J] = !1, this[Fi] = typeof e.size == "number" ? e.size : Infinity, this[ee] = this[Fi], this[ot] = typeof e.autoClose == "boolean" ? e.autoClose : !0, typeof this[m] == "number" ? this[zt]() : this[ht]();
+	}
+	get fd() {
+		return this[m];
+	}
+	get path() {
+		return this[U];
+	}
+	write() {
+		throw new TypeError("this is a readable stream");
+	}
+	end() {
+		throw new TypeError("this is a readable stream");
+	}
+	[ht]() {
+		I.open(this[U], "r", (t, e) => this[Ht](t, e));
+	}
+	[Ht](t, e) {
+		t ? this[Ut](t) : (this[m] = e, this.emit("open", e), this[zt]());
+	}
+	[ki]() {
+		return Buffer.allocUnsafe(Math.min(this[Ii], this[ee]));
+	}
+	[zt]() {
+		if (!this[J]) {
+			this[J] = !0;
+			let t = this[ki]();
+			if (t.length === 0) return process.nextTick(() => this[Ai](null, 0, t));
+			I.read(this[m], t, 0, t.length, null, (e, i, r) => this[Ai](e, i, r));
+		}
+	}
+	[Ai](t, e, i) {
+		this[J] = !1, t ? this[Ut](t) : this[Ci](e, i) && this[zt]();
+	}
+	[H]() {
+		if (this[ot] && typeof this[m] == "number") {
+			let t = this[m];
+			this[m] = void 0, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+		}
+	}
+	[Ut](t) {
+		this[J] = !0, this[H](), this.emit("error", t);
+	}
+	[Ci](t, e) {
+		let i = !1;
+		return this[ee] -= t, t > 0 && (i = super.write(t < e.length ? e.subarray(0, t) : e)), (t === 0 || this[ee] <= 0) && (i = !1, this[H](), super.end()), i;
+	}
+	emit(t, ...e) {
+		switch (t) {
+			case "prefinish":
+			case "finish": return !1;
+			case "drain": return typeof this[m] == "number" && this[zt](), !1;
+			case "error": return this[bt] ? !1 : (this[bt] = !0, super.emit(t, ...e));
+			default: return super.emit(t, ...e);
+		}
+	}
+}, Me = class extends _t {
+	[ht]() {
+		let t = !0;
+		try {
+			this[Ht](null, I.openSync(this[U], "r")), t = !1;
+		} finally {
+			t && this[H]();
+		}
+	}
+	[zt]() {
+		let t = !0;
+		try {
+			if (!this[J]) {
+				this[J] = !0;
+				do {
+					let e = this[ki](), i = e.length === 0 ? 0 : I.readSync(this[m], e, 0, e.length, null);
+					if (!this[Ci](i, e)) break;
+				} while (!0);
+				this[J] = !1;
+			}
+			t = !1;
+		} finally {
+			t && this[H]();
+		}
+	}
+	[H]() {
+		if (this[ot] && typeof this[m] == "number") {
+			let t = this[m];
+			this[m] = void 0, I.closeSync(t), this.emit("close");
+		}
+	}
+}, tt = class extends $r {
+	readable = !1;
+	writable = !0;
+	[bt] = !1;
+	[gt] = !1;
+	[te] = !1;
+	[Y] = [];
+	[Ce] = !1;
+	[U];
+	[ie];
+	[ot];
+	[m];
+	[ve];
+	[j];
+	[Ni] = !1;
+	[nt];
+	constructor(t, e) {
+		e = e || {}, super(e), this[U] = t, this[m] = typeof e.fd == "number" ? e.fd : void 0, this[ie] = e.mode === void 0 ? 438 : e.mode, this[nt] = typeof e.start == "number" ? e.start : void 0, this[ot] = typeof e.autoClose == "boolean" ? e.autoClose : !0;
+		let i = this[nt] !== void 0 ? "r+" : "w";
+		this[ve] = e.flags === void 0, this[j] = e.flags === void 0 ? i : e.flags, this[m] === void 0 && this[ht]();
+	}
+	emit(t, ...e) {
+		if (t === "error") {
+			if (this[bt]) return !1;
+			this[bt] = !0;
+		}
+		return super.emit(t, ...e);
+	}
+	get fd() {
+		return this[m];
+	}
+	get path() {
+		return this[U];
+	}
+	[Ut](t) {
+		this[H](), this[gt] = !0, this.emit("error", t);
+	}
+	[ht]() {
+		I.open(this[U], this[j], this[ie], (t, e) => this[Ht](t, e));
+	}
+	[Ht](t, e) {
+		this[ve] && this[j] === "r+" && t && t.code === "ENOENT" ? (this[j] = "w", this[ht]()) : t ? this[Ut](t) : (this[m] = e, this.emit("open", e), this[gt] || this[Di]());
+	}
+	end(t, e) {
+		return t && this.write(t, e), this[te] = !0, !this[gt] && !this[Y].length && typeof this[m] == "number" && this[Pt](null, 0), this;
+	}
+	write(t, e) {
+		return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", /* @__PURE__ */ new Error("write() after end()")), !1) : this[m] === void 0 || this[gt] || this[Y].length ? (this[Y].push(t), this[Ce] = !0, !1) : (this[gt] = !0, this[ke](t), !0);
+	}
+	[ke](t) {
+		I.write(this[m], t, 0, t.length, this[nt], (e, i) => this[Pt](e, i));
+	}
+	[Pt](t, e) {
+		t ? this[Ut](t) : (this[nt] !== void 0 && typeof e == "number" && (this[nt] += e), this[Y].length ? this[Di]() : (this[gt] = !1, this[te] && !this[Ni] ? (this[Ni] = !0, this[H](), this.emit("finish")) : this[Ce] && (this[Ce] = !1, this.emit("drain"))));
+	}
+	[Di]() {
+		if (this[Y].length === 0) this[te] && this[Pt](null, 0);
+		else if (this[Y].length === 1) this[ke](this[Y].pop());
+		else {
+			let t = this[Y];
+			this[Y] = [], Xr(this[m], t, this[nt], (e, i) => this[Pt](e, i));
+		}
+	}
+	[H]() {
+		if (this[ot] && typeof this[m] == "number") {
+			let t = this[m];
+			this[m] = void 0, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+		}
+	}
+}, Wt = class extends tt {
+	[ht]() {
+		let t;
+		if (this[ve] && this[j] === "r+") try {
+			t = I.openSync(this[U], this[j], this[ie]);
+		} catch (e) {
+			if (e?.code === "ENOENT") return this[j] = "w", this[ht]();
+			throw e;
+		}
+		else t = I.openSync(this[U], this[j], this[ie]);
+		this[Ht](null, t);
+	}
+	[H]() {
+		if (this[ot] && typeof this[m] == "number") {
+			let t = this[m];
+			this[m] = void 0, I.closeSync(t), this.emit("close");
+		}
+	}
+	[ke](t) {
+		let e = !0;
+		try {
+			this[Pt](null, I.writeSync(this[m], t, 0, t.length, this[nt])), e = !1;
+		} finally {
+			if (e) try {
+				this[H]();
+			} catch {}
+		}
+	}
+};
+var qr = new Map([
+	["C", "cwd"],
+	["f", "file"],
+	["z", "gzip"],
+	["P", "preservePaths"],
+	["U", "unlink"],
+	["strip-components", "strip"],
+	["stripComponents", "strip"],
+	["keep-newer", "newer"],
+	["keepNewer", "newer"],
+	["keep-newer-files", "newer"],
+	["keepNewerFiles", "newer"],
+	["k", "keep"],
+	["keep-existing", "keep"],
+	["keepExisting", "keep"],
+	["m", "noMtime"],
+	["no-mtime", "noMtime"],
+	["p", "preserveOwner"],
+	["L", "follow"],
+	["h", "follow"],
+	["onentry", "onReadEntry"]
+]), Is = (s) => !!s.sync && !!s.file, Fs = (s) => !s.sync && !!s.file, Cs = (s) => !!s.sync && !s.file, ks = (s) => !s.sync && !s.file;
+var vs = (s) => !!s.file;
+var Qr = (s) => {
+	return qr.get(s) || s;
+}, se = (s = {}) => {
+	if (!s) return {};
+	let t = {};
+	for (let [e, i] of Object.entries(s)) {
+		let r = Qr(e);
+		t[r] = i;
+	}
+	return t.chmod === void 0 && t.noChmod === !1 && (t.chmod = !0), delete t.noChmod, t;
+};
+var K = (s, t, e, i, r) => Object.assign((n = [], o, a) => {
+	Array.isArray(n) && (o = n, n = {}), typeof o == "function" && (a = o, o = void 0), o = o ? Array.from(o) : [];
+	let h = se(n);
+	if (r?.(h, o), Is(h)) {
+		if (typeof a == "function") throw new TypeError("callback not supported for sync tar functions");
+		return s(h, o);
+	} else if (Fs(h)) {
+		let l = t(h, o);
+		return a ? l.then(() => a(), a) : l;
+	} else if (Cs(h)) {
+		if (typeof a == "function") throw new TypeError("callback not supported for sync tar functions");
+		return e(h, o);
+	} else if (ks(h)) {
+		if (typeof a == "function") throw new TypeError("callback only supported with file option");
+		return i(h, o);
+	}
+	throw new Error("impossible options??");
+}, {
+	syncFile: s,
+	asyncFile: t,
+	syncNoFile: e,
+	asyncNoFile: i,
+	validate: r
+});
+var jr = Jr.constants || { ZLIB_VERNUM: 4736 }, M = Object.freeze(Object.assign(Object.create(null), {
+	Z_NO_FLUSH: 0,
+	Z_PARTIAL_FLUSH: 1,
+	Z_SYNC_FLUSH: 2,
+	Z_FULL_FLUSH: 3,
+	Z_FINISH: 4,
+	Z_BLOCK: 5,
+	Z_OK: 0,
+	Z_STREAM_END: 1,
+	Z_NEED_DICT: 2,
+	Z_ERRNO: -1,
+	Z_STREAM_ERROR: -2,
+	Z_DATA_ERROR: -3,
+	Z_MEM_ERROR: -4,
+	Z_BUF_ERROR: -5,
+	Z_VERSION_ERROR: -6,
+	Z_NO_COMPRESSION: 0,
+	Z_BEST_SPEED: 1,
+	Z_BEST_COMPRESSION: 9,
+	Z_DEFAULT_COMPRESSION: -1,
+	Z_FILTERED: 1,
+	Z_HUFFMAN_ONLY: 2,
+	Z_RLE: 3,
+	Z_FIXED: 4,
+	Z_DEFAULT_STRATEGY: 0,
+	DEFLATE: 1,
+	INFLATE: 2,
+	GZIP: 3,
+	GUNZIP: 4,
+	DEFLATERAW: 5,
+	INFLATERAW: 6,
+	UNZIP: 7,
+	BROTLI_DECODE: 8,
+	BROTLI_ENCODE: 9,
+	Z_MIN_WINDOWBITS: 8,
+	Z_MAX_WINDOWBITS: 15,
+	Z_DEFAULT_WINDOWBITS: 15,
+	Z_MIN_CHUNK: 64,
+	Z_MAX_CHUNK: Infinity,
+	Z_DEFAULT_CHUNK: 16384,
+	Z_MIN_MEMLEVEL: 1,
+	Z_MAX_MEMLEVEL: 9,
+	Z_DEFAULT_MEMLEVEL: 8,
+	Z_MIN_LEVEL: -1,
+	Z_MAX_LEVEL: 9,
+	Z_DEFAULT_LEVEL: -1,
+	BROTLI_OPERATION_PROCESS: 0,
+	BROTLI_OPERATION_FLUSH: 1,
+	BROTLI_OPERATION_FINISH: 2,
+	BROTLI_OPERATION_EMIT_METADATA: 3,
+	BROTLI_MODE_GENERIC: 0,
+	BROTLI_MODE_TEXT: 1,
+	BROTLI_MODE_FONT: 2,
+	BROTLI_DEFAULT_MODE: 0,
+	BROTLI_MIN_QUALITY: 0,
+	BROTLI_MAX_QUALITY: 11,
+	BROTLI_DEFAULT_QUALITY: 11,
+	BROTLI_MIN_WINDOW_BITS: 10,
+	BROTLI_MAX_WINDOW_BITS: 24,
+	BROTLI_LARGE_MAX_WINDOW_BITS: 30,
+	BROTLI_DEFAULT_WINDOW: 22,
+	BROTLI_MIN_INPUT_BLOCK_BITS: 16,
+	BROTLI_MAX_INPUT_BLOCK_BITS: 24,
+	BROTLI_PARAM_MODE: 0,
+	BROTLI_PARAM_QUALITY: 1,
+	BROTLI_PARAM_LGWIN: 2,
+	BROTLI_PARAM_LGBLOCK: 3,
+	BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING: 4,
+	BROTLI_PARAM_SIZE_HINT: 5,
+	BROTLI_PARAM_LARGE_WINDOW: 6,
+	BROTLI_PARAM_NPOSTFIX: 7,
+	BROTLI_PARAM_NDIRECT: 8,
+	BROTLI_DECODER_RESULT_ERROR: 0,
+	BROTLI_DECODER_RESULT_SUCCESS: 1,
+	BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT: 2,
+	BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT: 3,
+	BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION: 0,
+	BROTLI_DECODER_PARAM_LARGE_WINDOW: 1,
+	BROTLI_DECODER_NO_ERROR: 0,
+	BROTLI_DECODER_SUCCESS: 1,
+	BROTLI_DECODER_NEEDS_MORE_INPUT: 2,
+	BROTLI_DECODER_NEEDS_MORE_OUTPUT: 3,
+	BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE: -1,
+	BROTLI_DECODER_ERROR_FORMAT_RESERVED: -2,
+	BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE: -3,
+	BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET: -4,
+	BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME: -5,
+	BROTLI_DECODER_ERROR_FORMAT_CL_SPACE: -6,
+	BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE: -7,
+	BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT: -8,
+	BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1: -9,
+	BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2: -10,
+	BROTLI_DECODER_ERROR_FORMAT_TRANSFORM: -11,
+	BROTLI_DECODER_ERROR_FORMAT_DICTIONARY: -12,
+	BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS: -13,
+	BROTLI_DECODER_ERROR_FORMAT_PADDING_1: -14,
+	BROTLI_DECODER_ERROR_FORMAT_PADDING_2: -15,
+	BROTLI_DECODER_ERROR_FORMAT_DISTANCE: -16,
+	BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET: -19,
+	BROTLI_DECODER_ERROR_INVALID_ARGUMENTS: -20,
+	BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES: -21,
+	BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS: -22,
+	BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP: -25,
+	BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1: -26,
+	BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2: -27,
+	BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES: -30,
+	BROTLI_DECODER_ERROR_UNREACHABLE: -31
+}, jr));
+var tn = Buffer$1.concat, Bs = Object.getOwnPropertyDescriptor(Buffer$1, "concat"), en = (s) => s, Mi = Bs?.writable === !0 || Bs?.set !== void 0 ? (s) => {
+	Buffer$1.concat = s ? en : tn;
+} : (s) => {}, Tt = Symbol("_superWrite"), Gt = class extends Error {
+	code;
+	errno;
+	constructor(t, e) {
+		super("zlib: " + t.message, { cause: t }), this.code = t.code, this.errno = t.errno, this.code || (this.code = "ZLIB_ERROR"), this.message = "zlib: " + t.message, Error.captureStackTrace(this, e ?? this.constructor);
+	}
+	get name() {
+		return "ZlibError";
+	}
+}, Bi = Symbol("flushFlag"), re = class extends A {
+	#t = !1;
+	#i = !1;
+	#s;
+	#n;
+	#r;
+	#e;
+	#o;
+	get sawError() {
+		return this.#t;
+	}
+	get handle() {
+		return this.#e;
+	}
+	get flushFlag() {
+		return this.#s;
+	}
+	constructor(t, e) {
+		if (!t || typeof t != "object") throw new TypeError("invalid options for ZlibBase constructor");
+		if (super(t), this.#s = t.flush ?? 0, this.#n = t.finishFlush ?? 0, this.#r = t.fullFlushFlag ?? 0, typeof Ms[e] != "function") throw new TypeError("Compression method not supported: " + e);
+		try {
+			this.#e = new Ms[e](t);
+		} catch (i) {
+			throw new Gt(i, this.constructor);
+		}
+		this.#o = (i) => {
+			this.#t || (this.#t = !0, this.close(), this.emit("error", i));
+		}, this.#e?.on("error", (i) => this.#o(new Gt(i))), this.once("end", () => this.close);
+	}
+	close() {
+		this.#e && (this.#e.close(), this.#e = void 0, this.emit("close"));
+	}
+	reset() {
+		if (!this.#t) return Pi(this.#e, "zlib binding closed"), this.#e.reset?.();
+	}
+	flush(t) {
+		this.ended || (typeof t != "number" && (t = this.#r), this.write(Object.assign(Buffer$1.alloc(0), { [Bi]: t })));
+	}
+	end(t, e, i) {
+		return typeof t == "function" && (i = t, e = void 0, t = void 0), typeof e == "function" && (i = e, e = void 0), t && (e ? this.write(t, e) : this.write(t)), this.flush(this.#n), this.#i = !0, super.end(i);
+	}
+	get ended() {
+		return this.#i;
+	}
+	[Tt](t) {
+		return super.write(t);
+	}
+	write(t, e, i) {
+		if (typeof e == "function" && (i = e, e = "utf8"), typeof t == "string" && (t = Buffer$1.from(t, e)), this.#t) return;
+		Pi(this.#e, "zlib binding closed");
+		let r = this.#e._handle, n = r.close;
+		r.close = () => {};
+		let o = this.#e.close;
+		this.#e.close = () => {}, Mi(!0);
+		let a;
+		try {
+			let l = typeof t[Bi] == "number" ? t[Bi] : this.#s;
+			a = this.#e._processChunk(t, l), Mi(!1);
+		} catch (l) {
+			Mi(!1), this.#o(new Gt(l, this.write));
+		} finally {
+			this.#e && (this.#e._handle = r, r.close = n, this.#e.close = o, this.#e.removeAllListeners("error"));
+		}
+		this.#e && this.#e.on("error", (l) => this.#o(new Gt(l, this.write)));
+		let h;
+		if (a) if (Array.isArray(a) && a.length > 0) {
+			let l = a[0];
+			h = this[Tt](Buffer$1.from(l));
+			for (let c = 1; c < a.length; c++) h = this[Tt](a[c]);
+		} else h = this[Tt](Buffer$1.from(a));
+		return i && i(), h;
+	}
+}, Be = class extends re {
+	#t;
+	#i;
+	constructor(t, e) {
+		t = t || {}, t.flush = t.flush || M.Z_NO_FLUSH, t.finishFlush = t.finishFlush || M.Z_FINISH, t.fullFlushFlag = M.Z_FULL_FLUSH, super(t, e), this.#t = t.level, this.#i = t.strategy;
+	}
+	params(t, e) {
+		if (!this.sawError) {
+			if (!this.handle) throw new Error("cannot switch params when binding is closed");
+			if (!this.handle.params) throw new Error("not supported in this implementation");
+			if (this.#t !== t || this.#i !== e) {
+				this.flush(M.Z_SYNC_FLUSH), Pi(this.handle, "zlib binding closed");
+				let i = this.handle.flush;
+				this.handle.flush = (r, n) => {
+					typeof r == "function" && (n = r, r = this.flushFlag), this.flush(r), n?.();
+				};
+				try {
+					this.handle.params(t, e);
+				} finally {
+					this.handle.flush = i;
+				}
+				this.handle && (this.#t = t, this.#i = e);
+			}
+		}
+	}
+};
+var Pe = class extends Be {
+	#t;
+	constructor(t) {
+		super(t, "Gzip"), this.#t = t && !!t.portable;
+	}
+	[Tt](t) {
+		return this.#t ? (this.#t = !1, t[9] = 255, super[Tt](t)) : super[Tt](t);
+	}
+};
+var ze = class extends Be {
+	constructor(t) {
+		super(t, "Unzip");
+	}
+}, Ue = class extends re {
+	constructor(t, e) {
+		t = t || {}, t.flush = t.flush || M.BROTLI_OPERATION_PROCESS, t.finishFlush = t.finishFlush || M.BROTLI_OPERATION_FINISH, t.fullFlushFlag = M.BROTLI_OPERATION_FLUSH, super(t, e);
+	}
+}, He = class extends Ue {
+	constructor(t) {
+		super(t, "BrotliCompress");
+	}
+}, We = class extends Ue {
+	constructor(t) {
+		super(t, "BrotliDecompress");
+	}
+}, Ge = class extends re {
+	constructor(t, e) {
+		t = t || {}, t.flush = t.flush || M.ZSTD_e_continue, t.finishFlush = t.finishFlush || M.ZSTD_e_end, t.fullFlushFlag = M.ZSTD_e_flush, super(t, e);
+	}
+}, Ze = class extends Ge {
+	constructor(t) {
+		super(t, "ZstdCompress");
+	}
+}, Ye = class extends Ge {
+	constructor(t) {
+		super(t, "ZstdDecompress");
+	}
+};
+var Ps = (s, t) => {
+	if (Number.isSafeInteger(s)) s < 0 ? nn(s, t) : rn(s, t);
+	else throw Error("cannot encode number outside of javascript safe integer range");
+	return t;
+}, rn = (s, t) => {
+	t[0] = 128;
+	for (var e = t.length; e > 1; e--) t[e - 1] = s & 255, s = Math.floor(s / 256);
+}, nn = (s, t) => {
+	t[0] = 255;
+	var e = !1;
+	s = s * -1;
+	for (var i = t.length; i > 1; i--) {
+		var r = s & 255;
+		s = Math.floor(s / 256), e ? t[i - 1] = Us(r) : r === 0 ? t[i - 1] = 0 : (e = !0, t[i - 1] = Hs(r));
+	}
+}, zs = (s) => {
+	let t = s[0], e = t === 128 ? hn(s.subarray(1, s.length)) : t === 255 ? on(s) : null;
+	if (e === null) throw Error("invalid base256 encoding");
+	if (!Number.isSafeInteger(e)) throw Error("parsed number outside of javascript safe integer range");
+	return e;
+}, on = (s) => {
+	for (var t = s.length, e = 0, i = !1, r = t - 1; r > -1; r--) {
+		var n = Number(s[r]), o;
+		i ? o = Us(n) : n === 0 ? o = n : (i = !0, o = Hs(n)), o !== 0 && (e -= o * Math.pow(256, t - r - 1));
+	}
+	return e;
+}, hn = (s) => {
+	for (var t = s.length, e = 0, i = t - 1; i > -1; i--) {
+		var r = Number(s[i]);
+		r !== 0 && (e += r * Math.pow(256, t - i - 1));
+	}
+	return e;
+}, Us = (s) => (255 ^ s) & 255, Hs = (s) => (255 ^ s) + 1 & 255;
+Br({}, {
+	code: () => Ke,
+	isCode: () => ne,
+	isName: () => ln,
+	name: () => oe,
+	normalFsTypes: () => zi
+});
+var ne = (s) => oe.has(s), ln = (s) => Ke.has(s), zi = new Set([
+	"0",
+	"",
+	"1",
+	"2",
+	"3",
+	"4",
+	"5",
+	"6",
+	"7",
+	"D"
+]), oe = new Map([
+	["0", "File"],
+	["", "OldFile"],
+	["1", "Link"],
+	["2", "SymbolicLink"],
+	["3", "CharacterDevice"],
+	["4", "BlockDevice"],
+	["5", "Directory"],
+	["6", "FIFO"],
+	["7", "ContiguousFile"],
+	["g", "GlobalExtendedHeader"],
+	["x", "ExtendedHeader"],
+	["A", "SolarisACL"],
+	["D", "GNUDumpDir"],
+	["I", "Inode"],
+	["K", "NextFileHasLongLinkpath"],
+	["L", "NextFileHasLongPath"],
+	["M", "ContinuationFile"],
+	["N", "OldGnuLongPath"],
+	["S", "SparseFile"],
+	["V", "TapeVolumeHeader"],
+	["X", "OldExtendedHeader"]
+]), Ke = new Map(Array.from(oe).map((s) => [s[1], s[0]]));
+var C = class {
+	cksumValid = !1;
+	needPax = !1;
+	nullBlock = !1;
+	block;
+	path;
+	mode;
+	uid;
+	gid;
+	size;
+	cksum;
+	#t = "Unsupported";
+	linkpath;
+	uname;
+	gname;
+	devmaj = 0;
+	devmin = 0;
+	atime;
+	ctime;
+	mtime;
+	charset;
+	comment;
+	constructor(t, e = 0, i, r) {
+		Buffer.isBuffer(t) ? this.decode(t, e || 0, i, r) : t && this.#i(t);
+	}
+	decode(t, e, i, r) {
+		if (e || (e = 0), !t || !(t.length >= e + 512)) throw new Error("need 512 bytes for header");
+		let n = xt(t, e + 156, 1), o = zi.has(n), a = o ? i : void 0, h = o ? r : void 0;
+		if (this.path = a?.path ?? xt(t, e, 100), this.mode = a?.mode ?? h?.mode ?? at(t, e + 100, 8), this.uid = a?.uid ?? h?.uid ?? at(t, e + 108, 8), this.gid = a?.gid ?? h?.gid ?? at(t, e + 116, 8), this.size = a?.size ?? h?.size ?? at(t, e + 124, 12), this.mtime = a?.mtime ?? h?.mtime ?? Hi(t, e + 136, 12), this.cksum = at(t, e + 148, 12), h && this.#i(h, !0), a && this.#i(a), ne(n) && (this.#t = n || "0"), this.#t === "0" && this.path.slice(-1) === "/" && (this.#t = "5"), this.#t === "5" && (this.size = 0), this.linkpath = xt(t, e + 157, 100), t.subarray(e + 257, e + 265).toString() === "ustar\x0000") if (this.uname = a?.uname ?? h?.uname ?? xt(t, e + 265, 32), this.gname = a?.gname ?? h?.gname ?? xt(t, e + 297, 32), this.devmaj = a?.devmaj ?? h?.devmaj ?? at(t, e + 329, 8) ?? 0, this.devmin = a?.devmin ?? h?.devmin ?? at(t, e + 337, 8) ?? 0, t[e + 475] !== 0) {
+			let c = xt(t, e + 345, 155);
+			this.path = c + "/" + this.path;
+		} else {
+			let c = xt(t, e + 345, 130);
+			c && (this.path = c + "/" + this.path), this.atime = i?.atime ?? r?.atime ?? Hi(t, e + 476, 12), this.ctime = i?.ctime ?? r?.ctime ?? Hi(t, e + 488, 12);
+		}
+		let l = 256;
+		for (let c = e; c < e + 148; c++) l += t[c];
+		for (let c = e + 156; c < e + 512; c++) l += t[c];
+		this.cksumValid = l === this.cksum, this.cksum === void 0 && l === 256 && (this.nullBlock = !0);
+	}
+	#i(t, e = !1) {
+		Object.assign(this, Object.fromEntries(Object.entries(t).filter(([i, r]) => !(r == null || i === "path" && e || i === "linkpath" && e || i === "global"))));
+	}
+	encode(t, e = 0) {
+		if (t || (t = this.block = Buffer.alloc(512)), this.#t === "Unsupported" && (this.#t = "0"), !(t.length >= e + 512)) throw new Error("need 512 bytes for header");
+		let i = this.ctime || this.atime ? 130 : 155, r = cn(this.path || "", i), n = r[0], o = r[1];
+		this.needPax = !!r[2], this.needPax = Lt(t, e, 100, n) || this.needPax, this.needPax = lt(t, e + 100, 8, this.mode) || this.needPax, this.needPax = lt(t, e + 108, 8, this.uid) || this.needPax, this.needPax = lt(t, e + 116, 8, this.gid) || this.needPax, this.needPax = lt(t, e + 124, 12, this.size) || this.needPax, this.needPax = Wi(t, e + 136, 12, this.mtime) || this.needPax, t[e + 156] = Number(this.#t.codePointAt(0)), this.needPax = Lt(t, e + 157, 100, this.linkpath) || this.needPax, t.write("ustar\x0000", e + 257, 8), this.needPax = Lt(t, e + 265, 32, this.uname) || this.needPax, this.needPax = Lt(t, e + 297, 32, this.gname) || this.needPax, this.needPax = lt(t, e + 329, 8, this.devmaj) || this.needPax, this.needPax = lt(t, e + 337, 8, this.devmin) || this.needPax, this.needPax = Lt(t, e + 345, i, o) || this.needPax, t[e + 475] !== 0 ? this.needPax = Lt(t, e + 345, 155, o) || this.needPax : (this.needPax = Lt(t, e + 345, 130, o) || this.needPax, this.needPax = Wi(t, e + 476, 12, this.atime) || this.needPax, this.needPax = Wi(t, e + 488, 12, this.ctime) || this.needPax);
+		let a = 256;
+		for (let h = e; h < e + 148; h++) a += t[h];
+		for (let h = e + 156; h < e + 512; h++) a += t[h];
+		return this.cksum = a, lt(t, e + 148, 8, this.cksum), this.cksumValid = !0, this.needPax;
+	}
+	get type() {
+		return this.#t === "Unsupported" ? this.#t : oe.get(this.#t);
+	}
+	get typeKey() {
+		return this.#t;
+	}
+	set type(t) {
+		let e = String(Ke.get(t));
+		if (ne(e) || e === "Unsupported") this.#t = e;
+		else if (ne(t)) this.#t = t;
+		else throw new TypeError("invalid entry type: " + t);
+	}
+}, cn = (s, t) => {
+	let i = s, r = "", n, o = posix.parse(s).root || ".";
+	if (Buffer.byteLength(i) < 100) n = [
+		i,
+		r,
+		!1
+	];
+	else {
+		r = posix.dirname(i), i = posix.basename(i);
+		do
+			Buffer.byteLength(i) <= 100 && Buffer.byteLength(r) <= t ? n = [
+				i,
+				r,
+				!1
+			] : Buffer.byteLength(i) > 100 && Buffer.byteLength(r) <= t ? n = [
+				i.slice(0, 99),
+				r,
+				!0
+			] : (i = posix.join(posix.basename(r), i), r = posix.dirname(r));
+		while (r !== o && n === void 0);
+		n || (n = [
+			s.slice(0, 99),
+			"",
+			!0
+		]);
+	}
+	return n;
+}, xt = (s, t, e) => s.subarray(t, t + e).toString("utf8").replace(/\0.*/, ""), Hi = (s, t, e) => fn(at(s, t, e)), fn = (s) => s === void 0 ? void 0 : /* @__PURE__ */ new Date(s * 1e3), at = (s, t, e) => Number(s[t]) & 128 ? zs(s.subarray(t, t + e)) : un(s, t, e), dn = (s) => isNaN(s) ? void 0 : s, un = (s, t, e) => dn(parseInt(s.subarray(t, t + e).toString("utf8").replace(/\0.*$/, "").trim(), 8)), mn = {
+	12: 8589934591,
+	8: 2097151
+}, lt = (s, t, e, i) => i === void 0 ? !1 : i > mn[e] || i < 0 ? (Ps(i, s.subarray(t, t + e)), !0) : (pn(s, t, e, i), !1), pn = (s, t, e, i) => s.write(En(i, e), t, e, "ascii"), En = (s, t) => wn(Math.floor(s).toString(8), t), wn = (s, t) => (s.length === t - 1 ? s : new Array(t - s.length - 1).join("0") + s + " ") + "\0", Wi = (s, t, e, i) => i === void 0 ? !1 : lt(s, t, e, i.getTime() / 1e3), Sn = new Array(156).join("\0"), Lt = (s, t, e, i) => i === void 0 ? !1 : (s.write(i + Sn, t, e, "utf8"), i.length !== Buffer.byteLength(i) || i.length > e);
+var ct = class s {
+	atime;
+	mtime;
+	ctime;
+	charset;
+	comment;
+	gid;
+	uid;
+	gname;
+	uname;
+	linkpath;
+	dev;
+	ino;
+	nlink;
+	path;
+	size;
+	mode;
+	global;
+	constructor(t, e = !1) {
+		this.atime = t.atime, this.charset = t.charset, this.comment = t.comment, this.ctime = t.ctime, this.dev = t.dev, this.gid = t.gid, this.global = e, this.gname = t.gname, this.ino = t.ino, this.linkpath = t.linkpath, this.mtime = t.mtime, this.nlink = t.nlink, this.path = t.path, this.size = t.size, this.uid = t.uid, this.uname = t.uname;
+	}
+	encode() {
+		let t = this.encodeBody();
+		if (t === "") return Buffer.allocUnsafe(0);
+		let e = Buffer.byteLength(t), i = 512 * Math.ceil(1 + e / 512), r = Buffer.allocUnsafe(i);
+		for (let n = 0; n < 512; n++) r[n] = 0;
+		new C({
+			path: ("PaxHeader/" + basename(this.path ?? "")).slice(0, 99),
+			mode: this.mode || 420,
+			uid: this.uid,
+			gid: this.gid,
+			size: e,
+			mtime: this.mtime,
+			type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader",
+			linkpath: "",
+			uname: this.uname || "",
+			gname: this.gname || "",
+			devmaj: 0,
+			devmin: 0,
+			atime: this.atime,
+			ctime: this.ctime
+		}).encode(r), r.write(t, 512, e, "utf8");
+		for (let n = e + 512; n < r.length; n++) r[n] = 0;
+		return r;
+	}
+	encodeBody() {
+		return this.encodeField("path") + this.encodeField("ctime") + this.encodeField("atime") + this.encodeField("dev") + this.encodeField("ino") + this.encodeField("nlink") + this.encodeField("charset") + this.encodeField("comment") + this.encodeField("gid") + this.encodeField("gname") + this.encodeField("linkpath") + this.encodeField("mtime") + this.encodeField("size") + this.encodeField("uid") + this.encodeField("uname");
+	}
+	encodeField(t) {
+		if (this[t] === void 0) return "";
+		let e = this[t], i = e instanceof Date ? e.getTime() / 1e3 : e, r = " " + (t === "dev" || t === "ino" || t === "nlink" ? "SCHILY." : "") + t + "=" + i + `
+`, n = Buffer.byteLength(r), o = Math.floor(Math.log(n) / Math.log(10)) + 1;
+		return n + o >= Math.pow(10, o) && (o += 1), o + n + r;
+	}
+	static parse(t, e, i = !1) {
+		return new s(Rn(gn(t), e), i);
+	}
+}, Rn = (s, t) => t ? Object.assign({}, t, s) : s, gn = (s) => s.replace(/\n$/, "").split(`
+`).reduce(bn, Object.create(null)), bn = (s, t) => {
+	let e = parseInt(t, 10);
+	if (e !== Buffer.byteLength(t) + 1) return s;
+	t = t.slice((e + " ").length);
+	let i = t.split("="), r = i.shift();
+	if (!r) return s;
+	let n = r.replace(/^SCHILY\.(dev|ino|nlink)/, "$1"), o = i.join("=");
+	return s[n] = /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(n) ? /* @__PURE__ */ new Date(Number(o) * 1e3) : /^[0-9]+$/.test(o) ? +o : o, s;
+};
+var f = (process.env.TESTING_TAR_FAKE_PLATFORM || process.platform) !== "win32" ? (s) => s : (s) => s && s.replaceAll(/\\/g, "/");
+var Ve = class extends A {
+	extended;
+	globalExtended;
+	header;
+	startBlockSize;
+	blockRemain;
+	remain;
+	type;
+	meta = !1;
+	ignore = !1;
+	path;
+	mode;
+	uid;
+	gid;
+	uname;
+	gname;
+	size = 0;
+	mtime;
+	atime;
+	ctime;
+	linkpath;
+	dev;
+	ino;
+	nlink;
+	invalid = !1;
+	absolute;
+	unsupported = !1;
+	constructor(t, e, i) {
+		switch (super({}), this.pause(), this.extended = e, this.globalExtended = i, this.header = t, this.remain = t.size ?? 0, this.startBlockSize = 512 * Math.ceil(this.remain / 512), this.blockRemain = this.startBlockSize, this.type = t.type, this.type) {
+			case "File":
+			case "OldFile":
+			case "Link":
+			case "SymbolicLink":
+			case "CharacterDevice":
+			case "BlockDevice":
+			case "Directory":
+			case "FIFO":
+			case "ContiguousFile":
+			case "GNUDumpDir": break;
+			case "NextFileHasLongLinkpath":
+			case "NextFileHasLongPath":
+			case "OldGnuLongPath":
+			case "GlobalExtendedHeader":
+			case "ExtendedHeader":
+			case "OldExtendedHeader":
+				this.meta = !0;
+				break;
+			default: this.ignore = !0;
+		}
+		if (!t.path) throw new Error("no path provided for tar.ReadEntry");
+		this.path = f(t.path), this.mode = t.mode, this.mode && (this.mode = this.mode & 4095), this.uid = t.uid, this.gid = t.gid, this.uname = t.uname, this.gname = t.gname, this.size = this.remain, this.mtime = t.mtime, this.atime = t.atime, this.ctime = t.ctime, this.linkpath = t.linkpath ? f(t.linkpath) : void 0, this.uname = t.uname, this.gname = t.gname, e && this.#t(e), i && this.#t(i, !0);
+	}
+	write(t) {
+		let e = t.length;
+		if (e > this.blockRemain) throw new Error("writing more to entry than is appropriate");
+		let i = this.remain, r = this.blockRemain;
+		return this.remain = Math.max(0, i - e), this.blockRemain = Math.max(0, r - e), this.ignore ? !0 : i >= e ? super.write(t) : super.write(t.subarray(0, i));
+	}
+	#t(t, e = !1) {
+		t.path && (t.path = f(t.path)), t.linkpath && (t.linkpath = f(t.linkpath)), Object.assign(this, Object.fromEntries(Object.entries(t).filter(([i, r]) => !(r == null || i === "path" && e))));
+	}
+};
+var Nt = (s, t, e, i = {}) => {
+	s.file && (i.file = s.file), s.cwd && (i.cwd = s.cwd), i.code = e instanceof Error && e.code || t, i.tarCode = t, !s.strict && i.recoverable !== !1 ? (e instanceof Error && (i = Object.assign(e, i), e = e.message), s.emit("warn", t, e, i)) : e instanceof Error ? s.emit("error", Object.assign(e, i)) : s.emit("error", Object.assign(/* @__PURE__ */ new Error(`${t}: ${e}`), i));
+};
+var Tn = 1024 * 1024, Vi = Buffer.from([31, 139]), $i = Buffer.from([
+	40,
+	181,
+	47,
+	253
+]), xn = Math.max(Vi.length, $i.length), B = Symbol("state"), Dt = Symbol("writeEntry"), et = Symbol("readEntry"), Gi = Symbol("nextEntry"), Ws = Symbol("processEntry"), V = Symbol("extendedHeader"), he = Symbol("globalExtendedHeader"), ft = Symbol("meta"), Gs = Symbol("emitMeta"), p = Symbol("buffer"), it = Symbol("queue"), dt = Symbol("ended"), Zi = Symbol("emittedEnd"), At = Symbol("emit"), y = Symbol("unzip"), $e = Symbol("consumeChunk"), Xe = Symbol("consumeChunkSub"), Yi = Symbol("consumeBody"), Zs = Symbol("consumeMeta"), Ys = Symbol("consumeHeader"), ae = Symbol("consuming"), Ki = Symbol("bufferConcat"), qe = Symbol("maybeEnd"), Yt = Symbol("writing"), ut = Symbol("aborted"), Qe = Symbol("onDone"), It = Symbol("sawValidEntry"), Je = Symbol("sawNullBlock"), je = Symbol("sawEOF"), Ks = Symbol("closeStream"), Ln = () => !0, st = class extends EventEmitter$1 {
+	file;
+	strict;
+	maxMetaEntrySize;
+	filter;
+	brotli;
+	zstd;
+	writable = !0;
+	readable = !1;
+	[it] = [];
+	[p];
+	[et];
+	[Dt];
+	[B] = "begin";
+	[ft] = "";
+	[V];
+	[he];
+	[dt] = !1;
+	[y];
+	[ut] = !1;
+	[It];
+	[Je] = !1;
+	[je] = !1;
+	[Yt] = !1;
+	[ae] = !1;
+	[Zi] = !1;
+	constructor(t = {}) {
+		super(), this.file = t.file || "", this.on(Qe, () => {
+			(this[B] === "begin" || this[It] === !1) && this.warn("TAR_BAD_ARCHIVE", "Unrecognized archive format");
+		}), t.ondone ? this.on(Qe, t.ondone) : this.on(Qe, () => {
+			this.emit("prefinish"), this.emit("finish"), this.emit("end");
+		}), this.strict = !!t.strict, this.maxMetaEntrySize = t.maxMetaEntrySize || Tn, this.filter = typeof t.filter == "function" ? t.filter : Ln;
+		let e = t.file && (t.file.endsWith(".tar.br") || t.file.endsWith(".tbr"));
+		this.brotli = !(t.gzip || t.zstd) && t.brotli !== void 0 ? t.brotli : e ? void 0 : !1;
+		let i = t.file && (t.file.endsWith(".tar.zst") || t.file.endsWith(".tzst"));
+		this.zstd = !(t.gzip || t.brotli) && t.zstd !== void 0 ? t.zstd : i ? !0 : void 0, this.on("end", () => this[Ks]()), typeof t.onwarn == "function" && this.on("warn", t.onwarn), typeof t.onReadEntry == "function" && this.on("entry", t.onReadEntry);
+	}
+	warn(t, e, i = {}) {
+		Nt(this, t, e, i);
+	}
+	[Ys](t, e) {
+		this[It] === void 0 && (this[It] = !1);
+		let i;
+		try {
+			i = new C(t, e, this[V], this[he]);
+		} catch (r) {
+			return this.warn("TAR_ENTRY_INVALID", r);
+		}
+		if (i.nullBlock) this[Je] ? (this[je] = !0, this[B] === "begin" && (this[B] = "header"), this[At]("eof")) : (this[Je] = !0, this[At]("nullBlock"));
+		else if (this[Je] = !1, !i.cksumValid) this.warn("TAR_ENTRY_INVALID", "checksum failure", { header: i });
+		else if (!i.path) this.warn("TAR_ENTRY_INVALID", "path is required", { header: i });
+		else {
+			let r = i.type;
+			if (/^(Symbolic)?Link$/.test(r) && !i.linkpath) this.warn("TAR_ENTRY_INVALID", "linkpath required", { header: i });
+			else if (!/^(Symbolic)?Link$/.test(r) && !/^(Global)?ExtendedHeader$/.test(r) && i.linkpath) this.warn("TAR_ENTRY_INVALID", "linkpath forbidden", { header: i });
+			else {
+				let n = this[Dt] = new Ve(i, this[V], this[he]);
+				if (!this[It]) if (n.remain) {
+					let o = () => {
+						n.invalid || (this[It] = !0);
+					};
+					n.on("end", o);
+				} else this[It] = !0;
+				n.meta ? n.size > this.maxMetaEntrySize ? (n.ignore = !0, this[At]("ignoredEntry", n), this[B] = "ignore", n.resume()) : n.size > 0 && (this[ft] = "", n.on("data", (o) => this[ft] += o), this[B] = "meta") : (this[V] = void 0, n.ignore = n.ignore || !this.filter(n.path, n), n.ignore ? (this[At]("ignoredEntry", n), this[B] = n.remain ? "ignore" : "header", n.resume()) : (n.remain ? this[B] = "body" : (this[B] = "header", n.end()), this[et] ? this[it].push(n) : (this[it].push(n), this[Gi]())));
+			}
+		}
+	}
+	[Ks]() {
+		queueMicrotask(() => this.emit("close"));
+	}
+	[Ws](t) {
+		let e = !0;
+		if (!t) this[et] = void 0, e = !1;
+		else if (Array.isArray(t)) {
+			let [i, ...r] = t;
+			this.emit(i, ...r);
+		} else this[et] = t, this.emit("entry", t), t.emittedEnd || (t.on("end", () => this[Gi]()), e = !1);
+		return e;
+	}
+	[Gi]() {
+		do		;
+while (this[Ws](this[it].shift()));
+		if (this[it].length === 0) {
+			let t = this[et];
+			!t || t.flowing || t.size === t.remain ? this[Yt] || this.emit("drain") : t.once("drain", () => this.emit("drain"));
+		}
+	}
+	[Yi](t, e) {
+		let i = this[Dt];
+		if (!i) throw new Error("attempt to consume body without entry??");
+		let r = i.blockRemain ?? 0, n = r >= t.length && e === 0 ? t : t.subarray(e, e + r);
+		return i.write(n), i.blockRemain || (this[B] = "header", this[Dt] = void 0, i.end()), n.length;
+	}
+	[Zs](t, e) {
+		let i = this[Dt], r = this[Yi](t, e);
+		return !this[Dt] && i && this[Gs](i), r;
+	}
+	[At](t, e, i) {
+		this[it].length === 0 && !this[et] ? this.emit(t, e, i) : this[it].push([
+			t,
+			e,
+			i
+		]);
+	}
+	[Gs](t) {
+		switch (this[At]("meta", this[ft]), t.type) {
+			case "ExtendedHeader":
+			case "OldExtendedHeader":
+				this[V] = ct.parse(this[ft], this[V], !1);
+				break;
+			case "GlobalExtendedHeader":
+				this[he] = ct.parse(this[ft], this[he], !0);
+				break;
+			case "NextFileHasLongPath":
+			case "OldGnuLongPath": {
+				let e = this[V] ?? Object.create(null);
+				this[V] = e, e.path = this[ft].replace(/\0.*/, "");
+				break;
+			}
+			case "NextFileHasLongLinkpath": {
+				let e = this[V] || Object.create(null);
+				this[V] = e, e.linkpath = this[ft].replace(/\0.*/, "");
+				break;
+			}
+			default: throw new Error("unknown meta: " + t.type);
+		}
+	}
+	abort(t) {
+		this[ut] = !0, this.emit("abort", t), this.warn("TAR_ABORT", t, { recoverable: !1 });
+	}
+	write(t, e, i) {
+		if (typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, typeof e == "string" ? e : "utf8")), this[ut]) return i?.(), !1;
+		if ((this[y] === void 0 || this.brotli === void 0 && this[y] === !1) && t) {
+			if (this[p] && (t = Buffer.concat([this[p], t]), this[p] = void 0), t.length < xn) return this[p] = t, i?.(), !0;
+			for (let h = 0; this[y] === void 0 && h < Vi.length; h++) t[h] !== Vi[h] && (this[y] = !1);
+			let o = !1;
+			if (this[y] === !1 && this.zstd !== !1) {
+				o = !0;
+				for (let h = 0; h < $i.length; h++) if (t[h] !== $i[h]) {
+					o = !1;
+					break;
+				}
+			}
+			let a = this.brotli === void 0 && !o;
+			if (this[y] === !1 && a) if (t.length < 512) if (this[dt]) this.brotli = !0;
+			else return this[p] = t, i?.(), !0;
+			else try {
+				new C(t.subarray(0, 512)), this.brotli = !1;
+			} catch {
+				this.brotli = !0;
+			}
+			if (this[y] === void 0 || this[y] === !1 && (this.brotli || o)) {
+				let h = this[dt];
+				this[dt] = !1, this[y] = this[y] === void 0 ? new ze({}) : o ? new Ye({}) : new We({}), this[y].on("data", (c) => this[$e](c)), this[y].on("error", (c) => this.abort(c)), this[y].on("end", () => {
+					this[dt] = !0, this[$e]();
+				}), this[Yt] = !0;
+				let l = !!this[y][h ? "end" : "write"](t);
+				return this[Yt] = !1, i?.(), l;
+			}
+		}
+		this[Yt] = !0, this[y] ? this[y].write(t) : this[$e](t), this[Yt] = !1;
+		let n = this[it].length > 0 ? !1 : this[et] ? this[et].flowing : !0;
+		return !n && this[it].length === 0 && this[et]?.once("drain", () => this.emit("drain")), i?.(), n;
+	}
+	[Ki](t) {
+		t && !this[ut] && (this[p] = this[p] ? Buffer.concat([this[p], t]) : t);
+	}
+	[qe]() {
+		if (this[dt] && !this[Zi] && !this[ut] && !this[ae]) {
+			this[Zi] = !0;
+			let t = this[Dt];
+			if (t && t.blockRemain) {
+				let e = this[p] ? this[p].length : 0;
+				this.warn("TAR_BAD_ARCHIVE", `Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`, { entry: t }), this[p] && t.write(this[p]), t.end();
+			}
+			this[At](Qe);
+		}
+	}
+	[$e](t) {
+		if (this[ae] && t) this[Ki](t);
+		else if (!t && !this[p]) this[qe]();
+		else if (t) {
+			if (this[ae] = !0, this[p]) {
+				this[Ki](t);
+				let e = this[p];
+				this[p] = void 0, this[Xe](e);
+			} else this[Xe](t);
+			for (; this[p] && this[p]?.length >= 512 && !this[ut] && !this[je];) {
+				let e = this[p];
+				this[p] = void 0, this[Xe](e);
+			}
+			this[ae] = !1;
+		}
+		(!this[p] || this[dt]) && this[qe]();
+	}
+	[Xe](t) {
+		let e = 0, i = t.length;
+		for (; e + 512 <= i && !this[ut] && !this[je];) switch (this[B]) {
+			case "begin":
+			case "header":
+				this[Ys](t, e), e += 512;
+				break;
+			case "ignore":
+			case "body":
+				e += this[Yi](t, e);
+				break;
+			case "meta":
+				e += this[Zs](t, e);
+				break;
+			default: throw new Error("invalid state: " + this[B]);
+		}
+		e < i && (this[p] = this[p] ? Buffer.concat([t.subarray(e), this[p]]) : t.subarray(e));
+	}
+	end(t, e, i) {
+		return typeof t == "function" && (i = t, e = void 0, t = void 0), typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, e)), i && this.once("finish", i), this[ut] || (this[y] ? (t && this[y].write(t), this[y].end()) : (this[dt] = !0, (this.brotli === void 0 || this.zstd === void 0) && (t = t || Buffer.alloc(0)), t && this.write(t), this[qe]())), this;
+	}
+};
+var mt = (s) => {
+	let t = s.length - 1, e = -1;
+	for (; t > -1 && s.charAt(t) === "/";) e = t, t--;
+	return e === -1 ? s : s.slice(0, e);
+};
+var An = (s) => {
+	let t = s.onReadEntry;
+	s.onReadEntry = t ? (e) => {
+		t(e), e.resume();
+	} : (e) => e.resume();
+}, Xi = (s, t) => {
+	let e = new Map(t.map((n) => [mt(n), !0])), i = s.filter, r = (n, o = "") => {
+		let a = o || parse(n).root || ".", h;
+		if (n === a) h = !1;
+		else {
+			let l = e.get(n);
+			h = l !== void 0 ? l : r(dirname$1(n), a);
+		}
+		return e.set(n, h), h;
+	};
+	s.filter = i ? (n, o) => i(n, o) && r(mt(n)) : (n) => r(mt(n));
+}, In = (s) => {
+	let t = new st(s), e = s.file, i;
+	try {
+		i = Kt.openSync(e, "r");
+		let r = Kt.fstatSync(i), n = s.maxReadSize || 16 * 1024 * 1024;
+		if (r.size < n) {
+			let o = Buffer.allocUnsafe(r.size), a = Kt.readSync(i, o, 0, r.size, 0);
+			t.end(a === o.byteLength ? o : o.subarray(0, a));
+		} else {
+			let o = 0, a = Buffer.allocUnsafe(n);
+			for (; o < r.size;) {
+				let h = Kt.readSync(i, a, 0, n, o);
+				if (h === 0) break;
+				o += h, t.write(a.subarray(0, h));
+			}
+			t.end();
+		}
+	} finally {
+		if (typeof i == "number") try {
+			Kt.closeSync(i);
+		} catch {}
+	}
+}, Fn = (s, t) => {
+	let e = new st(s), i = s.maxReadSize || 16 * 1024 * 1024, r = s.file;
+	return new Promise((o, a) => {
+		e.on("error", a), e.on("end", o), Kt.stat(r, (h, l) => {
+			if (h) a(h);
+			else {
+				let c = new _t(r, {
+					readSize: i,
+					size: l.size
+				});
+				c.on("error", a), c.pipe(e);
+			}
+		});
+	});
+}, Ft = K(In, Fn, (s) => new st(s), (s) => new st(s), (s, t) => {
+	t?.length && Xi(s, t), s.noResume || An(s);
+});
+var qi = (s, t, e) => (s &= 4095, e && (s = (s | 384) & -19), t && (s & 256 && (s |= 64), s & 32 && (s |= 8), s & 4 && (s |= 1)), s);
+var { isAbsolute: kn, parse: Vs } = win32, le = (s) => {
+	let t = "", e = Vs(s);
+	for (; kn(s) || e.root;) {
+		let i = s.charAt(0) === "/" && s.slice(0, 4) !== "//?/" ? "/" : e.root;
+		s = s.slice(i.length), t += i, e = Vs(s);
+	}
+	return [t, s];
+};
+var ti = [
+	"|",
+	"<",
+	">",
+	"?",
+	":"
+], Qi = ti.map((s) => String.fromCodePoint(61440 + Number(s.codePointAt(0)))), vn = new Map(ti.map((s, t) => [s, Qi[t]])), Mn = new Map(Qi.map((s, t) => [s, ti[t]])), Ji = (s) => ti.reduce((t, e) => t.split(e).join(vn.get(e)), s), $s = (s) => Qi.reduce((t, e) => t.split(e).join(Mn.get(e)), s);
+var er = (s, t) => t ? (s = f(s).replace(/^\.(\/|$)/, ""), mt(t) + "/" + s) : f(s), Bn = 16 * 1024 * 1024, Qs = Symbol("process"), Js = Symbol("file"), js = Symbol("directory"), ts = Symbol("symlink"), tr = Symbol("hardlink"), ce = Symbol("header"), ei = Symbol("read"), es = Symbol("lstat"), ii = Symbol("onlstat"), is = Symbol("onread"), ss = Symbol("onreadlink"), rs = Symbol("openfile"), ns = Symbol("onopenfile"), pt = Symbol("close"), si = Symbol("mode"), os = Symbol("awaitDrain"), ji = Symbol("ondrain"), X = Symbol("prefix"), fe = class extends A {
+	path;
+	portable;
+	myuid = process.getuid && process.getuid() || 0;
+	myuser = process.env.USER || "";
+	maxReadSize;
+	linkCache;
+	statCache;
+	preservePaths;
+	cwd;
+	strict;
+	mtime;
+	noPax;
+	noMtime;
+	prefix;
+	fd;
+	blockLen = 0;
+	blockRemain = 0;
+	buf;
+	pos = 0;
+	remain = 0;
+	length = 0;
+	offset = 0;
+	win32;
+	absolute;
+	header;
+	type;
+	linkpath;
+	stat;
+	onWriteEntry;
+	#t = !1;
+	constructor(t, e = {}) {
+		let i = se(e);
+		super(), this.path = f(t), this.portable = !!i.portable, this.maxReadSize = i.maxReadSize || Bn, this.linkCache = i.linkCache || /* @__PURE__ */ new Map(), this.statCache = i.statCache || /* @__PURE__ */ new Map(), this.preservePaths = !!i.preservePaths, this.cwd = f(i.cwd || process.cwd()), this.strict = !!i.strict, this.noPax = !!i.noPax, this.noMtime = !!i.noMtime, this.mtime = i.mtime, this.prefix = i.prefix ? f(i.prefix) : void 0, this.onWriteEntry = i.onWriteEntry, typeof i.onwarn == "function" && this.on("warn", i.onwarn);
+		let r = !1;
+		if (!this.preservePaths) {
+			let [o, a] = le(this.path);
+			o && typeof a == "string" && (this.path = a, r = o);
+		}
+		this.win32 = !!i.win32 || process.platform === "win32", this.win32 && (this.path = $s(this.path.replaceAll(/\\/g, "/")), t = t.replaceAll(/\\/g, "/")), this.absolute = f(i.absolute || qs.resolve(this.cwd, t)), this.path === "" && (this.path = "./"), r && this.warn("TAR_ENTRY_INFO", `stripping ${r} from absolute path`, {
+			entry: this,
+			path: r + this.path
+		});
+		let n = this.statCache.get(this.absolute);
+		n ? this[ii](n) : this[es]();
+	}
+	warn(t, e, i = {}) {
+		return Nt(this, t, e, i);
+	}
+	emit(t, ...e) {
+		return t === "error" && (this.#t = !0), super.emit(t, ...e);
+	}
+	[es]() {
+		I.lstat(this.absolute, (t, e) => {
+			if (t) return this.emit("error", t);
+			this[ii](e);
+		});
+	}
+	[ii](t) {
+		this.statCache.set(this.absolute, t), this.stat = t, t.isFile() || (t.size = 0), this.type = Pn(t), this.emit("stat", t), this[Qs]();
+	}
+	[Qs]() {
+		switch (this.type) {
+			case "File": return this[Js]();
+			case "Directory": return this[js]();
+			case "SymbolicLink": return this[ts]();
+			default: return this.end();
+		}
+	}
+	[si](t) {
+		return qi(t, this.type === "Directory", this.portable);
+	}
+	[X](t) {
+		return er(t, this.prefix);
+	}
+	[ce]() {
+		if (!this.stat) throw new Error("cannot write header before stat");
+		this.type === "Directory" && this.portable && (this.noMtime = !0), this.onWriteEntry?.(this), this.header = new C({
+			path: this[X](this.path),
+			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
+			mode: this[si](this.stat.mode),
+			uid: this.portable ? void 0 : this.stat.uid,
+			gid: this.portable ? void 0 : this.stat.gid,
+			size: this.stat.size,
+			mtime: this.noMtime ? void 0 : this.mtime || this.stat.mtime,
+			type: this.type === "Unsupported" ? void 0 : this.type,
+			uname: this.portable ? void 0 : this.stat.uid === this.myuid ? this.myuser : "",
+			atime: this.portable ? void 0 : this.stat.atime,
+			ctime: this.portable ? void 0 : this.stat.ctime
+		}), this.header.encode() && !this.noPax && super.write(new ct({
+			atime: this.portable ? void 0 : this.header.atime,
+			ctime: this.portable ? void 0 : this.header.ctime,
+			gid: this.portable ? void 0 : this.header.gid,
+			mtime: this.noMtime ? void 0 : this.mtime || this.header.mtime,
+			path: this[X](this.path),
+			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
+			size: this.header.size,
+			uid: this.portable ? void 0 : this.header.uid,
+			uname: this.portable ? void 0 : this.header.uname,
+			dev: this.portable ? void 0 : this.stat.dev,
+			ino: this.portable ? void 0 : this.stat.ino,
+			nlink: this.portable ? void 0 : this.stat.nlink
+		}).encode());
+		let t = this.header?.block;
+		if (!t) throw new Error("failed to encode header");
+		super.write(t);
+	}
+	[js]() {
+		if (!this.stat) throw new Error("cannot create directory entry without stat");
+		this.path.slice(-1) !== "/" && (this.path += "/"), this.stat.size = 0, this[ce](), this.end();
+	}
+	[ts]() {
+		I.readlink(this.absolute, (t, e) => {
+			if (t) return this.emit("error", t);
+			this[ss](e);
+		});
+	}
+	[ss](t) {
+		this.linkpath = f(t), this[ce](), this.end();
+	}
+	[tr](t) {
+		if (!this.stat) throw new Error("cannot create link entry without stat");
+		this.type = "Link", this.linkpath = f(qs.relative(this.cwd, t)), this.stat.size = 0, this[ce](), this.end();
+	}
+	[Js]() {
+		if (!this.stat) throw new Error("cannot create file entry without stat");
+		if (this.stat.nlink > 1) {
+			let t = `${this.stat.dev}:${this.stat.ino}`, e = this.linkCache.get(t);
+			if (e?.indexOf(this.cwd) === 0) return this[tr](e);
+			this.linkCache.set(t, this.absolute);
+		}
+		if (this[ce](), this.stat.size === 0) return this.end();
+		this[rs]();
+	}
+	[rs]() {
+		I.open(this.absolute, "r", (t, e) => {
+			if (t) return this.emit("error", t);
+			this[ns](e);
+		});
+	}
+	[ns](t) {
+		if (this.fd = t, this.#t) return this[pt]();
+		if (!this.stat) throw new Error("should stat before calling onopenfile");
+		this.blockLen = 512 * Math.ceil(this.stat.size / 512), this.blockRemain = this.blockLen;
+		let e = Math.min(this.blockLen, this.maxReadSize);
+		this.buf = Buffer.allocUnsafe(e), this.offset = 0, this.pos = 0, this.remain = this.stat.size, this.length = this.buf.length, this[ei]();
+	}
+	[ei]() {
+		let { fd: t, buf: e, offset: i, length: r, pos: n } = this;
+		if (t === void 0 || e === void 0) throw new Error("cannot read file without first opening");
+		I.read(t, e, i, r, n, (o, a) => {
+			if (o) return this[pt](() => this.emit("error", o));
+			this[is](a);
+		});
+	}
+	[pt](t = () => {}) {
+		this.fd !== void 0 && I.close(this.fd, t);
+	}
+	[is](t) {
+		if (t <= 0 && this.remain > 0) {
+			let r = Object.assign(/* @__PURE__ */ new Error("encountered unexpected EOF"), {
+				path: this.absolute,
+				syscall: "read",
+				code: "EOF"
+			});
+			return this[pt](() => this.emit("error", r));
+		}
+		if (t > this.remain) {
+			let r = Object.assign(/* @__PURE__ */ new Error("did not encounter expected EOF"), {
+				path: this.absolute,
+				syscall: "read",
+				code: "EOF"
+			});
+			return this[pt](() => this.emit("error", r));
+		}
+		if (!this.buf) throw new Error("should have created buffer prior to reading");
+		if (t === this.remain) for (let r = t; r < this.length && t < this.blockRemain; r++) this.buf[r + this.offset] = 0, t++, this.remain++;
+		let e = this.offset === 0 && t === this.buf.length ? this.buf : this.buf.subarray(this.offset, this.offset + t);
+		this.write(e) ? this[ji]() : this[os](() => this[ji]());
+	}
+	[os](t) {
+		this.once("drain", t);
+	}
+	write(t, e, i) {
+		if (typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, typeof e == "string" ? e : "utf8")), this.blockRemain < t.length) {
+			let r = Object.assign(/* @__PURE__ */ new Error("writing more data than expected"), { path: this.absolute });
+			return this.emit("error", r);
+		}
+		return this.remain -= t.length, this.blockRemain -= t.length, this.pos += t.length, this.offset += t.length, super.write(t, null, i);
+	}
+	[ji]() {
+		if (!this.remain) return this.blockRemain && super.write(Buffer.alloc(this.blockRemain)), this[pt]((t) => t ? this.emit("error", t) : this.end());
+		if (!this.buf) throw new Error("buffer lost somehow in ONDRAIN");
+		this.offset >= this.length && (this.buf = Buffer.allocUnsafe(Math.min(this.blockRemain, this.buf.length)), this.offset = 0), this.length = this.buf.length - this.offset, this[ei]();
+	}
+}, ri = class extends fe {
+	sync = !0;
+	[es]() {
+		this[ii](I.lstatSync(this.absolute));
+	}
+	[ts]() {
+		this[ss](I.readlinkSync(this.absolute));
+	}
+	[rs]() {
+		this[ns](I.openSync(this.absolute, "r"));
+	}
+	[ei]() {
+		let t = !0;
+		try {
+			let { fd: e, buf: i, offset: r, length: n, pos: o } = this;
+			if (e === void 0 || i === void 0) throw new Error("fd and buf must be set in READ method");
+			let a = I.readSync(e, i, r, n, o);
+			this[is](a), t = !1;
+		} finally {
+			if (t) try {
+				this[pt](() => {});
+			} catch {}
+		}
+	}
+	[os](t) {
+		t();
+	}
+	[pt](t = () => {}) {
+		this.fd !== void 0 && I.closeSync(this.fd), t();
+	}
+}, ni = class extends A {
+	blockLen = 0;
+	blockRemain = 0;
+	buf = 0;
+	pos = 0;
+	remain = 0;
+	length = 0;
+	preservePaths;
+	portable;
+	strict;
+	noPax;
+	noMtime;
+	readEntry;
+	type;
+	prefix;
+	path;
+	mode;
+	uid;
+	gid;
+	uname;
+	gname;
+	header;
+	mtime;
+	atime;
+	ctime;
+	linkpath;
+	size;
+	onWriteEntry;
+	warn(t, e, i = {}) {
+		return Nt(this, t, e, i);
+	}
+	constructor(t, e = {}) {
+		let i = se(e);
+		super(), this.preservePaths = !!i.preservePaths, this.portable = !!i.portable, this.strict = !!i.strict, this.noPax = !!i.noPax, this.noMtime = !!i.noMtime, this.onWriteEntry = i.onWriteEntry, this.readEntry = t;
+		let { type: r } = t;
+		if (r === "Unsupported") throw new Error("writing entry that should be ignored");
+		this.type = r, this.type === "Directory" && this.portable && (this.noMtime = !0), this.prefix = i.prefix, this.path = f(t.path), this.mode = t.mode !== void 0 ? this[si](t.mode) : void 0, this.uid = this.portable ? void 0 : t.uid, this.gid = this.portable ? void 0 : t.gid, this.uname = this.portable ? void 0 : t.uname, this.gname = this.portable ? void 0 : t.gname, this.size = t.size, this.mtime = this.noMtime ? void 0 : i.mtime || t.mtime, this.atime = this.portable ? void 0 : t.atime, this.ctime = this.portable ? void 0 : t.ctime, this.linkpath = t.linkpath !== void 0 ? f(t.linkpath) : void 0, typeof i.onwarn == "function" && this.on("warn", i.onwarn);
+		let n = !1;
+		if (!this.preservePaths) {
+			let [a, h] = le(this.path);
+			a && typeof h == "string" && (this.path = h, n = a);
+		}
+		this.remain = t.size, this.blockRemain = t.startBlockSize, this.onWriteEntry?.(this), this.header = new C({
+			path: this[X](this.path),
+			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
+			mode: this.mode,
+			uid: this.portable ? void 0 : this.uid,
+			gid: this.portable ? void 0 : this.gid,
+			size: this.size,
+			mtime: this.noMtime ? void 0 : this.mtime,
+			type: this.type,
+			uname: this.portable ? void 0 : this.uname,
+			atime: this.portable ? void 0 : this.atime,
+			ctime: this.portable ? void 0 : this.ctime
+		}), n && this.warn("TAR_ENTRY_INFO", `stripping ${n} from absolute path`, {
+			entry: this,
+			path: n + this.path
+		}), this.header.encode() && !this.noPax && super.write(new ct({
+			atime: this.portable ? void 0 : this.atime,
+			ctime: this.portable ? void 0 : this.ctime,
+			gid: this.portable ? void 0 : this.gid,
+			mtime: this.noMtime ? void 0 : this.mtime,
+			path: this[X](this.path),
+			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
+			size: this.size,
+			uid: this.portable ? void 0 : this.uid,
+			uname: this.portable ? void 0 : this.uname,
+			dev: this.portable ? void 0 : this.readEntry.dev,
+			ino: this.portable ? void 0 : this.readEntry.ino,
+			nlink: this.portable ? void 0 : this.readEntry.nlink
+		}).encode());
+		let o = this.header?.block;
+		if (!o) throw new Error("failed to encode header");
+		super.write(o), t.pipe(this);
+	}
+	[X](t) {
+		return er(t, this.prefix);
+	}
+	[si](t) {
+		return qi(t, this.type === "Directory", this.portable);
+	}
+	write(t, e, i) {
+		typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, typeof e == "string" ? e : "utf8"));
+		let r = t.length;
+		if (r > this.blockRemain) throw new Error("writing more to entry than is appropriate");
+		return this.blockRemain -= r, super.write(t, i);
+	}
+	end(t, e, i) {
+		return this.blockRemain && super.write(Buffer.alloc(this.blockRemain)), typeof t == "function" && (i = t, e = void 0, t = void 0), typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, e ?? "utf8")), i && this.once("finish", i), t ? super.end(t, i) : super.end(i), this;
+	}
+}, Pn = (s) => s.isFile() ? "File" : s.isDirectory() ? "Directory" : s.isSymbolicLink() ? "SymbolicLink" : "Unsupported";
+var oi = class s {
+	tail;
+	head;
+	length = 0;
+	static create(t = []) {
+		return new s(t);
+	}
+	constructor(t = []) {
+		for (let e of t) this.push(e);
+	}
+	*[Symbol.iterator]() {
+		for (let t = this.head; t; t = t.next) yield t.value;
+	}
+	removeNode(t) {
+		if (t.list !== this) throw new Error("removing node which does not belong to this list");
+		let e = t.next, i = t.prev;
+		return e && (e.prev = i), i && (i.next = e), t === this.head && (this.head = e), t === this.tail && (this.tail = i), this.length--, t.next = void 0, t.prev = void 0, t.list = void 0, e;
+	}
+	unshiftNode(t) {
+		if (t === this.head) return;
+		t.list && t.list.removeNode(t);
+		let e = this.head;
+		t.list = this, t.next = e, e && (e.prev = t), this.head = t, this.tail || (this.tail = t), this.length++;
+	}
+	pushNode(t) {
+		if (t === this.tail) return;
+		t.list && t.list.removeNode(t);
+		let e = this.tail;
+		t.list = this, t.prev = e, e && (e.next = t), this.tail = t, this.head || (this.head = t), this.length++;
+	}
+	push(...t) {
+		for (let e = 0, i = t.length; e < i; e++) Un(this, t[e]);
+		return this.length;
+	}
+	unshift(...t) {
+		for (var e = 0, i = t.length; e < i; e++) Hn(this, t[e]);
+		return this.length;
+	}
+	pop() {
+		if (!this.tail) return;
+		let t = this.tail.value, e = this.tail;
+		return this.tail = this.tail.prev, this.tail ? this.tail.next = void 0 : this.head = void 0, e.list = void 0, this.length--, t;
+	}
+	shift() {
+		if (!this.head) return;
+		let t = this.head.value, e = this.head;
+		return this.head = this.head.next, this.head ? this.head.prev = void 0 : this.tail = void 0, e.list = void 0, this.length--, t;
+	}
+	forEach(t, e) {
+		e = e || this;
+		for (let i = this.head, r = 0; i; r++) t.call(e, i.value, r, this), i = i.next;
+	}
+	forEachReverse(t, e) {
+		e = e || this;
+		for (let i = this.tail, r = this.length - 1; i; r--) t.call(e, i.value, r, this), i = i.prev;
+	}
+	get(t) {
+		let e = 0, i = this.head;
+		for (; i && e < t; e++) i = i.next;
+		if (e === t && i) return i.value;
+	}
+	getReverse(t) {
+		let e = 0, i = this.tail;
+		for (; i && e < t; e++) i = i.prev;
+		if (e === t && i) return i.value;
+	}
+	map(t, e) {
+		e = e || this;
+		let i = new s();
+		for (let r = this.head; r;) i.push(t.call(e, r.value, this)), r = r.next;
+		return i;
+	}
+	mapReverse(t, e) {
+		e = e || this;
+		var i = new s();
+		for (let r = this.tail; r;) i.push(t.call(e, r.value, this)), r = r.prev;
+		return i;
+	}
+	reduce(t, e) {
+		let i, r = this.head;
+		if (arguments.length > 1) i = e;
+		else if (this.head) r = this.head.next, i = this.head.value;
+		else throw new TypeError("Reduce of empty list with no initial value");
+		for (var n = 0; r; n++) i = t(i, r.value, n), r = r.next;
+		return i;
+	}
+	reduceReverse(t, e) {
+		let i, r = this.tail;
+		if (arguments.length > 1) i = e;
+		else if (this.tail) r = this.tail.prev, i = this.tail.value;
+		else throw new TypeError("Reduce of empty list with no initial value");
+		for (let n = this.length - 1; r; n--) i = t(i, r.value, n), r = r.prev;
+		return i;
+	}
+	toArray() {
+		let t = new Array(this.length);
+		for (let e = 0, i = this.head; i; e++) t[e] = i.value, i = i.next;
+		return t;
+	}
+	toArrayReverse() {
+		let t = new Array(this.length);
+		for (let e = 0, i = this.tail; i; e++) t[e] = i.value, i = i.prev;
+		return t;
+	}
+	slice(t = 0, e = this.length) {
+		e < 0 && (e += this.length), t < 0 && (t += this.length);
+		let i = new s();
+		if (e < t || e < 0) return i;
+		t < 0 && (t = 0), e > this.length && (e = this.length);
+		let r = this.head, n = 0;
+		for (n = 0; r && n < t; n++) r = r.next;
+		for (; r && n < e; n++, r = r.next) i.push(r.value);
+		return i;
+	}
+	sliceReverse(t = 0, e = this.length) {
+		e < 0 && (e += this.length), t < 0 && (t += this.length);
+		let i = new s();
+		if (e < t || e < 0) return i;
+		t < 0 && (t = 0), e > this.length && (e = this.length);
+		let r = this.length, n = this.tail;
+		for (; n && r > e; r--) n = n.prev;
+		for (; n && r > t; r--, n = n.prev) i.push(n.value);
+		return i;
+	}
+	splice(t, e = 0, ...i) {
+		t > this.length && (t = this.length - 1), t < 0 && (t = this.length + t);
+		let r = this.head;
+		for (let o = 0; r && o < t; o++) r = r.next;
+		let n = [];
+		for (let o = 0; r && o < e; o++) n.push(r.value), r = this.removeNode(r);
+		r ? r !== this.tail && (r = r.prev) : r = this.tail;
+		for (let o of i) r = zn(this, r, o);
+		return n;
+	}
+	reverse() {
+		let t = this.head, e = this.tail;
+		for (let i = t; i; i = i.prev) {
+			let r = i.prev;
+			i.prev = i.next, i.next = r;
+		}
+		return this.head = e, this.tail = t, this;
+	}
+};
+function zn(s, t, e) {
+	let n = new de(e, t, t ? t.next : s.head, s);
+	return n.next === void 0 && (s.tail = n), n.prev === void 0 && (s.head = n), s.length++, n;
+}
+function Un(s, t) {
+	s.tail = new de(t, s.tail, void 0, s), s.head || (s.head = s.tail), s.length++;
+}
+function Hn(s, t) {
+	s.head = new de(t, void 0, s.head, s), s.tail || (s.tail = s.head), s.length++;
+}
+var de = class {
+	list;
+	next;
+	prev;
+	value;
+	constructor(t, e, i, r) {
+		this.list = r, this.value = t, e ? (e.next = this, this.prev = e) : this.prev = void 0, i ? (i.prev = this, this.next = i) : this.next = void 0;
+	}
+};
+var mi = class {
+	path;
+	absolute;
+	entry;
+	stat;
+	readdir;
+	pending = !1;
+	pendingLink = !1;
+	ignore = !1;
+	piped = !1;
+	constructor(t, e) {
+		this.path = t || "./", this.absolute = e;
+	}
+}, ir = Buffer.alloc(1024), ai = Symbol("onStat"), ue = Symbol("ended"), W = Symbol("queue"), me = Symbol("pendingLinks"), Et = Symbol("current"), Ct = Symbol("process"), pe = Symbol("processing"), hi = Symbol("processJob"), G = Symbol("jobs"), hs = Symbol("jobDone"), li = Symbol("addFSEntry"), sr = Symbol("addTarEntry"), cs = Symbol("stat"), fs = Symbol("readdir"), ci = Symbol("onreaddir"), fi = Symbol("pipe"), rr = Symbol("entry"), as = Symbol("entryOpt"), di = Symbol("writeEntryClass"), or = Symbol("write"), ls = Symbol("ondrain"), wt = class extends A {
+	sync = !1;
+	opt;
+	cwd;
+	maxReadSize;
+	preservePaths;
+	strict;
+	noPax;
+	prefix;
+	linkCache;
+	statCache;
+	file;
+	portable;
+	zip;
+	readdirCache;
+	noDirRecurse;
+	follow;
+	noMtime;
+	mtime;
+	filter;
+	jobs;
+	[di];
+	onWriteEntry;
+	[W];
+	[me] = /* @__PURE__ */ new Map();
+	[G] = 0;
+	[pe] = !1;
+	[ue] = !1;
+	constructor(t = {}) {
+		if (super(), this.opt = t, this.file = t.file || "", this.cwd = t.cwd || process.cwd(), this.maxReadSize = t.maxReadSize, this.preservePaths = !!t.preservePaths, this.strict = !!t.strict, this.noPax = !!t.noPax, this.prefix = f(t.prefix || ""), this.linkCache = t.linkCache || /* @__PURE__ */ new Map(), this.statCache = t.statCache || /* @__PURE__ */ new Map(), this.readdirCache = t.readdirCache || /* @__PURE__ */ new Map(), this.onWriteEntry = t.onWriteEntry, this[di] = fe, typeof t.onwarn == "function" && this.on("warn", t.onwarn), this.portable = !!t.portable, t.gzip || t.brotli || t.zstd) {
+			if ((t.gzip ? 1 : 0) + (t.brotli ? 1 : 0) + (t.zstd ? 1 : 0) > 1) throw new TypeError("gzip, brotli, zstd are mutually exclusive");
+			if (t.gzip && (typeof t.gzip != "object" && (t.gzip = {}), this.portable && (t.gzip.portable = !0), this.zip = new Pe(t.gzip)), t.brotli && (typeof t.brotli != "object" && (t.brotli = {}), this.zip = new He(t.brotli)), t.zstd && (typeof t.zstd != "object" && (t.zstd = {}), this.zip = new Ze(t.zstd)), !this.zip) throw new Error("impossible");
+			let e = this.zip;
+			e.on("data", (i) => super.write(i)), e.on("end", () => super.end()), e.on("drain", () => this[ls]()), this.on("resume", () => e.resume());
+		} else this.on("drain", this[ls]);
+		this.noDirRecurse = !!t.noDirRecurse, this.follow = !!t.follow, this.noMtime = !!t.noMtime, t.mtime && (this.mtime = t.mtime), this.filter = typeof t.filter == "function" ? t.filter : () => !0, this[W] = new oi(), this[G] = 0, this.jobs = Number(t.jobs) || 4, this[pe] = !1, this[ue] = !1;
+	}
+	[or](t) {
+		return super.write(t);
+	}
+	add(t) {
+		return this.write(t), this;
+	}
+	end(t, e, i) {
+		return typeof t == "function" && (i = t, t = void 0), typeof e == "function" && (i = e, e = void 0), t && this.add(t), this[ue] = !0, this[Ct](), i && i(), this;
+	}
+	write(t) {
+		if (this[ue]) throw new Error("write after end");
+		return typeof t == "string" ? this[li](t) : this[sr](t), this.flowing;
+	}
+	[sr](t) {
+		let e = f(qs.resolve(this.cwd, t.path));
+		if (!this.filter(t.path, t)) t.resume();
+		else {
+			let i = new mi(t.path, e);
+			i.entry = new ni(t, this[as](i)), i.entry.on("end", () => this[hs](i)), this[G] += 1, this[W].push(i);
+		}
+		this[Ct]();
+	}
+	[li](t) {
+		let e = f(qs.resolve(this.cwd, t));
+		this[W].push(new mi(t, e)), this[Ct]();
+	}
+	[cs](t) {
+		t.pending = !0, this[G] += 1;
+		I[this.follow ? "stat" : "lstat"](t.absolute, (i, r) => {
+			t.pending = !1, this[G] -= 1, i ? this.emit("error", i) : this[ai](t, r);
+		});
+	}
+	[ai](t, e) {
+		if (this.statCache.set(t.absolute, e), t.stat = e, !this.filter(t.path, e)) t.ignore = !0;
+		else if (e.isFile() && e.nlink > 1 && !this.linkCache.get(`${e.dev}:${e.ino}`) && !this.sync) if (t === this[Et]) this[hi](t);
+		else {
+			let i = `${e.dev}:${e.ino}`, r = this[me].get(i);
+			r ? r.push(t) : this[me].set(i, [t]), t.pendingLink = !0, t.pending = !0;
+		}
+		this[Ct]();
+	}
+	[fs](t) {
+		t.pending = !0, this[G] += 1, I.readdir(t.absolute, (e, i) => {
+			if (t.pending = !1, this[G] -= 1, e) return this.emit("error", e);
+			this[ci](t, i);
+		});
+	}
+	[ci](t, e) {
+		this.readdirCache.set(t.absolute, e), t.readdir = e, this[Ct]();
+	}
+	[Ct]() {
+		if (!this[pe]) {
+			this[pe] = !0;
+			for (let t = this[W].head; t && this[G] < this.jobs; t = t.next) if (this[hi](t.value), t.value.ignore) {
+				let e = t.next;
+				this[W].removeNode(t), t.next = e;
+			}
+			this[pe] = !1, this[ue] && this[W].length === 0 && this[G] === 0 && (this.zip ? this.zip.end(ir) : (super.write(ir), super.end()));
+		}
+	}
+	get [Et]() {
+		return this[W] && this[W].head && this[W].head.value;
+	}
+	[hs](t) {
+		this[W].shift(), this[G] -= 1;
+		let { stat: e } = t;
+		if (e && e.isFile() && e.nlink > 1) {
+			let i = `${e.dev}:${e.ino}`, r = this[me].get(i);
+			if (r) {
+				this[me].delete(i);
+				for (let n of r) n.pending = !1, this[hi](n);
+			}
+		}
+		this[Ct]();
+	}
+	[hi](t) {
+		if (t.pending && t.pendingLink && t === this[Et] && (t.pending = !1, t.pendingLink = !1), !t.pending) {
+			if (t.entry) {
+				t === this[Et] && !t.piped && this[fi](t);
+				return;
+			}
+			if (!t.stat) {
+				let e = this.statCache.get(t.absolute);
+				e ? this[ai](t, e) : this[cs](t);
+			}
+			if (t.stat && !t.ignore) {
+				if (!this.noDirRecurse && t.stat.isDirectory() && !t.readdir) {
+					let e = this.readdirCache.get(t.absolute);
+					if (e ? this[ci](t, e) : this[fs](t), !t.readdir) return;
+				}
+				if (t.entry = this[rr](t), !t.entry) {
+					t.ignore = !0;
+					return;
+				}
+				t === this[Et] && !t.piped && this[fi](t);
+			}
+		}
+	}
+	[as](t) {
+		return {
+			onwarn: (e, i, r) => this.warn(e, i, r),
+			noPax: this.noPax,
+			cwd: this.cwd,
+			absolute: t.absolute,
+			preservePaths: this.preservePaths,
+			maxReadSize: this.maxReadSize,
+			strict: this.strict,
+			portable: this.portable,
+			linkCache: this.linkCache,
+			statCache: this.statCache,
+			noMtime: this.noMtime,
+			mtime: this.mtime,
+			prefix: this.prefix,
+			onWriteEntry: this.onWriteEntry
+		};
+	}
+	[rr](t) {
+		this[G] += 1;
+		try {
+			return new this[di](t.path, this[as](t)).on("end", () => this[hs](t)).on("error", (i) => this.emit("error", i));
+		} catch (e) {
+			this.emit("error", e);
+		}
+	}
+	[ls]() {
+		this[Et] && this[Et].entry && this[Et].entry.resume();
+	}
+	[fi](t) {
+		t.piped = !0, t.readdir && t.readdir.forEach((r) => {
+			let n = t.path, o = n === "./" ? "" : n.replace(/\/*$/, "/");
+			this[li](o + r);
+		});
+		let e = t.entry, i = this.zip;
+		if (!e) throw new Error("cannot pipe without source");
+		i ? e.on("data", (r) => {
+			i.write(r) || e.pause();
+		}) : e.on("data", (r) => {
+			super.write(r) || e.pause();
+		});
+	}
+	pause() {
+		return this.zip && this.zip.pause(), super.pause();
+	}
+	warn(t, e, i = {}) {
+		Nt(this, t, e, i);
+	}
+}, kt = class extends wt {
+	sync = !0;
+	constructor(t) {
+		super(t), this[di] = ri;
+	}
+	pause() {}
+	resume() {}
+	[cs](t) {
+		let e = this.follow ? "statSync" : "lstatSync";
+		this[ai](t, I[e](t.absolute));
+	}
+	[fs](t) {
+		this[ci](t, I.readdirSync(t.absolute));
+	}
+	[fi](t) {
+		let e = t.entry, i = this.zip;
+		if (t.readdir && t.readdir.forEach((r) => {
+			let n = t.path, o = n === "./" ? "" : n.replace(/\/*$/, "/");
+			this[li](o + r);
+		}), !e) throw new Error("Cannot pipe without source");
+		i ? e.on("data", (r) => {
+			i.write(r);
+		}) : e.on("data", (r) => {
+			super[or](r);
+		});
+	}
+};
+var Wn = (s, t) => {
+	let e = new kt(s), i = new Wt(s.file, { mode: s.mode || 438 });
+	e.pipe(i), ar(e, t);
+}, Gn = (s, t) => {
+	let e = new wt(s), i = new tt(s.file, { mode: s.mode || 438 });
+	e.pipe(i);
+	let r = new Promise((n, o) => {
+		i.on("error", o), i.on("close", n), e.on("error", o);
+	});
+	return lr(e, t).catch((n) => e.emit("error", n)), r;
+}, ar = (s, t) => {
+	t.forEach((e) => {
+		e.charAt(0) === "@" ? Ft({
+			file: path.resolve(s.cwd, e.slice(1)),
+			sync: !0,
+			noResume: !0,
+			onReadEntry: (i) => s.add(i)
+		}) : s.add(e);
+	}), s.end();
+}, lr = async (s, t) => {
+	for (let e of t) e.charAt(0) === "@" ? await Ft({
+		file: path.resolve(String(s.cwd), e.slice(1)),
+		noResume: !0,
+		onReadEntry: (i) => {
+			s.add(i);
+		}
+	}) : s.add(e);
+	s.end();
+}, Zn = (s, t) => {
+	let e = new kt(s);
+	return ar(e, t), e;
+}, Yn = (s, t) => {
+	let e = new wt(s);
+	return lr(e, t).catch((i) => e.emit("error", i)), e;
+}, Kn = K(Wn, Gn, Zn, Yn, (s, t) => {
+	if (!t?.length) throw new TypeError("no paths specified to add to archive");
+});
+var ur = (process.env.__FAKE_PLATFORM__ || process.platform) === "win32", { O_CREAT: mr, O_NOFOLLOW: cr, O_TRUNC: pr, O_WRONLY: Er } = I.constants, wr = Number(process.env.__FAKE_FS_O_FILENAME__) || I.constants.UV_FS_O_FILEMAP || 0, $n = ur && !!wr, Xn = 512 * 1024, qn = wr | pr | mr | Er, fr = !ur && typeof cr == "number" ? cr | pr | mr | Er : null, ds = fr !== null ? () => fr : $n ? (s) => s < Xn ? qn : "w" : () => "w";
+var us = (s, t, e) => {
+	try {
+		return Kt.lchownSync(s, t, e);
+	} catch (i) {
+		if (i?.code !== "ENOENT") throw i;
+	}
+}, pi = (s, t, e, i) => {
+	Kt.lchown(s, t, e, (r) => {
+		i(r && r?.code !== "ENOENT" ? r : null);
+	});
+}, Qn = (s, t, e, i, r) => {
+	if (t.isDirectory()) ms(path.resolve(s, t.name), e, i, (n) => {
+		if (n) return r(n);
+		pi(path.resolve(s, t.name), e, i, r);
+	});
+	else pi(path.resolve(s, t.name), e, i, r);
+}, ms = (s, t, e, i) => {
+	Kt.readdir(s, { withFileTypes: !0 }, (r, n) => {
+		if (r) {
+			if (r.code === "ENOENT") return i();
+			if (r.code !== "ENOTDIR" && r.code !== "ENOTSUP") return i(r);
+		}
+		if (r || !n.length) return pi(s, t, e, i);
+		let o = n.length, a = null, h = (l) => {
+			if (!a) {
+				if (l) return i(a = l);
+				if (--o === 0) return pi(s, t, e, i);
+			}
+		};
+		for (let l of n) Qn(s, l, t, e, h);
+	});
+}, Jn = (s, t, e, i) => {
+	t.isDirectory() && ps(path.resolve(s, t.name), e, i), us(path.resolve(s, t.name), e, i);
+}, ps = (s, t, e) => {
+	let i;
+	try {
+		i = Kt.readdirSync(s, { withFileTypes: !0 });
+	} catch (r) {
+		let n = r;
+		if (n?.code === "ENOENT") return;
+		if (n?.code === "ENOTDIR" || n?.code === "ENOTSUP") return us(s, t, e);
+		throw n;
+	}
+	for (let r of i) Jn(s, r, t, e);
+	return us(s, t, e);
+};
+var we = class extends Error {
+	path;
+	code;
+	syscall = "chdir";
+	constructor(t, e) {
+		super(`${e}: Cannot cd into '${t}'`), this.path = t, this.code = e;
+	}
+	get name() {
+		return "CwdError";
+	}
+};
+var St = class extends Error {
+	path;
+	symlink;
+	syscall = "symlink";
+	code = "TAR_SYMLINK_ERROR";
+	constructor(t, e) {
+		super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"), this.symlink = t, this.path = e;
+	}
+	get name() {
+		return "SymlinkError";
+	}
+};
+var to = (s, t) => {
+	Kt.stat(s, (e, i) => {
+		(e || !i.isDirectory()) && (e = new we(s, e?.code || "ENOTDIR")), t(e);
+	});
+}, Sr = (s, t, e) => {
+	s = f(s);
+	let i = t.umask ?? 18, r = t.mode | 448, n = (r & i) !== 0, o = t.uid, a = t.gid, h = typeof o == "number" && typeof a == "number" && (o !== t.processUid || a !== t.processGid), l = t.preserve, c = t.unlink, d = f(t.cwd), S = (E, x) => {
+		E ? e(E) : x && h ? ms(x, o, a, (xe) => S(xe)) : n ? Kt.chmod(s, r, e) : e();
+	};
+	if (s === d) return to(s, S);
+	if (l) return jn.mkdir(s, {
+		mode: r,
+		recursive: !0
+	}).then((E) => S(null, E ?? void 0), S);
+	Es(d, f(path.relative(d, s)).split("/"), r, c, d, void 0, S);
+}, Es = (s, t, e, i, r, n, o) => {
+	if (t.length === 0) return o(null, n);
+	let a = t.shift(), h = f(path.resolve(s + "/" + a));
+	Kt.mkdir(h, e, yr(h, t, e, i, r, n, o));
+}, yr = (s, t, e, i, r, n, o) => (a) => {
+	a ? Kt.lstat(s, (h, l) => {
+		if (h) h.path = h.path && f(h.path), o(h);
+		else if (l.isDirectory()) Es(s, t, e, i, r, n, o);
+		else if (i) Kt.unlink(s, (c) => {
+			if (c) return o(c);
+			Kt.mkdir(s, e, yr(s, t, e, i, r, n, o));
+		});
+		else {
+			if (l.isSymbolicLink()) return o(new St(s, s + "/" + t.join("/")));
+			o(a);
+		}
+	}) : (n = n || s, Es(s, t, e, i, r, n, o));
+}, eo = (s) => {
+	let t = !1, e;
+	try {
+		t = Kt.statSync(s).isDirectory();
+	} catch (i) {
+		e = i?.code;
+	} finally {
+		if (!t) throw new we(s, e ?? "ENOTDIR");
+	}
+}, Rr = (s, t) => {
+	s = f(s);
+	let e = t.umask ?? 18, i = t.mode | 448, r = (i & e) !== 0, n = t.uid, o = t.gid, a = typeof n == "number" && typeof o == "number" && (n !== t.processUid || o !== t.processGid), h = t.preserve, l = t.unlink, c = f(t.cwd), d = (E) => {
+		E && a && ps(E, n, o), r && Kt.chmodSync(s, i);
+	};
+	if (s === c) return eo(c), d();
+	if (h) return d(Kt.mkdirSync(s, {
+		mode: i,
+		recursive: !0
+	}) ?? void 0);
+	let T = f(path.relative(c, s)).split("/"), N;
+	for (let E = T.shift(), x = c; E && (x += "/" + E); E = T.shift()) {
+		x = f(path.resolve(x));
+		try {
+			Kt.mkdirSync(x, i), N = N || x;
+		} catch {
+			let xe = Kt.lstatSync(x);
+			if (xe.isDirectory()) continue;
+			if (l) {
+				Kt.unlinkSync(x), Kt.mkdirSync(x, i), N = N || x;
+				continue;
+			} else if (xe.isSymbolicLink()) return new St(x, x + "/" + T.join("/"));
+		}
+	}
+	return d(N);
+};
+var ws = Object.create(null), gr = 1e4, Vt = /* @__PURE__ */ new Set(), br = (s) => {
+	Vt.has(s) ? Vt.delete(s) : ws[s] = s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"), Vt.add(s);
+	let t = ws[s], e = Vt.size - gr;
+	if (e > gr / 10) {
+		for (let i of Vt) if (Vt.delete(i), delete ws[i], --e <= 0) break;
+	}
+	return t;
+};
+var so = (process.env.TESTING_TAR_FAKE_PLATFORM || process.platform) === "win32", ro = (s) => s.split("/").slice(0, -1).reduce((e, i) => {
+	let r = e.at(-1);
+	return r !== void 0 && (i = join(r, i)), e.push(i || "/"), e;
+}, []), Si = class {
+	#t = /* @__PURE__ */ new Map();
+	#i = /* @__PURE__ */ new Map();
+	#s = /* @__PURE__ */ new Set();
+	reserve(t, e) {
+		t = so ? ["win32 parallelization disabled"] : t.map((r) => mt(join(br(r))));
+		let i = new Set(t.map((r) => ro(r)).reduce((r, n) => r.concat(n)));
+		this.#i.set(e, {
+			dirs: i,
+			paths: t
+		});
+		for (let r of t) {
+			let n = this.#t.get(r);
+			n ? n.push(e) : this.#t.set(r, [e]);
+		}
+		for (let r of i) {
+			let n = this.#t.get(r);
+			if (!n) this.#t.set(r, [new Set([e])]);
+			else {
+				let o = n.at(-1);
+				o instanceof Set ? o.add(e) : n.push(new Set([e]));
+			}
+		}
+		return this.#r(e);
+	}
+	#n(t) {
+		let e = this.#i.get(t);
+		if (!e) throw new Error("function does not have any path reservations");
+		return {
+			paths: e.paths.map((i) => this.#t.get(i)),
+			dirs: [...e.dirs].map((i) => this.#t.get(i))
+		};
+	}
+	check(t) {
+		let { paths: e, dirs: i } = this.#n(t);
+		return e.every((r) => r && r[0] === t) && i.every((r) => r && r[0] instanceof Set && r[0].has(t));
+	}
+	#r(t) {
+		return this.#s.has(t) || !this.check(t) ? !1 : (this.#s.add(t), t(() => this.#e(t)), !0);
+	}
+	#e(t) {
+		if (!this.#s.has(t)) return !1;
+		let e = this.#i.get(t);
+		if (!e) throw new Error("invalid reservation");
+		let { paths: i, dirs: r } = e, n = /* @__PURE__ */ new Set();
+		for (let o of i) {
+			let a = this.#t.get(o);
+			if (!a || a?.[0] !== t) continue;
+			let h = a[1];
+			if (!h) {
+				this.#t.delete(o);
+				continue;
+			}
+			if (a.shift(), typeof h == "function") n.add(h);
+			else for (let l of h) n.add(l);
+		}
+		for (let o of r) {
+			let a = this.#t.get(o), h = a?.[0];
+			if (!(!a || !(h instanceof Set))) if (h.size === 1 && a.length === 1) {
+				this.#t.delete(o);
+				continue;
+			} else if (h.size === 1) {
+				a.shift();
+				let l = a[0];
+				typeof l == "function" && n.add(l);
+			} else h.delete(t);
+		}
+		return this.#s.delete(t), n.forEach((o) => this.#r(o)), !0;
+	}
+};
+var Or = () => process.umask();
+var Tr = Symbol("onEntry"), gs = Symbol("checkFs"), xr = Symbol("checkFs2"), bs = Symbol("isReusable"), P = Symbol("makeFs"), _s = Symbol("file"), Os = Symbol("directory"), Ri = Symbol("link"), Lr = Symbol("symlink"), Nr = Symbol("hardlink"), ye = Symbol("ensureNoSymlink"), Dr = Symbol("unsupported"), Ar = Symbol("checkPath"), Ss = Symbol("stripAbsolutePath"), yt = Symbol("mkdir"), O = Symbol("onError"), yi = Symbol("pending"), Ir = Symbol("pend"), $t = Symbol("unpend"), ys = Symbol("ended"), Rs = Symbol("maybeClose"), Ts = Symbol("skip"), Re = Symbol("doChown"), ge = Symbol("uid"), be = Symbol("gid"), _e = Symbol("checkedCwd"), Oe = (process.env.TESTING_TAR_FAKE_PLATFORM || process.platform) === "win32", ho = 1024, ao = (s, t) => {
+	if (!Oe) return Kt.unlink(s, t);
+	let e = s + ".DELETE." + randomBytes(16).toString("hex");
+	Kt.rename(s, e, (i) => {
+		if (i) return t(i);
+		Kt.unlink(e, t);
+	});
+}, lo = (s) => {
+	if (!Oe) return Kt.unlinkSync(s);
+	let t = s + ".DELETE." + randomBytes(16).toString("hex");
+	Kt.renameSync(s, t), Kt.unlinkSync(t);
+}, Fr = (s, t, e) => s !== void 0 && s === s >>> 0 ? s : t !== void 0 && t === t >>> 0 ? t : e, Xt = class extends st {
+	[ys] = !1;
+	[_e] = !1;
+	[yi] = 0;
+	reservations = new Si();
+	transform;
+	writable = !0;
+	readable = !1;
+	uid;
+	gid;
+	setOwner;
+	preserveOwner;
+	processGid;
+	processUid;
+	maxDepth;
+	forceChown;
+	win32;
+	newer;
+	keep;
+	noMtime;
+	preservePaths;
+	unlink;
+	cwd;
+	strip;
+	processUmask;
+	umask;
+	dmode;
+	fmode;
+	chmod;
+	constructor(t = {}) {
+		if (t.ondone = () => {
+			this[ys] = !0, this[Rs]();
+		}, super(t), this.transform = t.transform, this.chmod = !!t.chmod, typeof t.uid == "number" || typeof t.gid == "number") {
+			if (typeof t.uid != "number" || typeof t.gid != "number") throw new TypeError("cannot set owner without number uid and gid");
+			if (t.preserveOwner) throw new TypeError("cannot preserve owner in archive and also set owner explicitly");
+			this.uid = t.uid, this.gid = t.gid, this.setOwner = !0;
+		} else this.uid = void 0, this.gid = void 0, this.setOwner = !1;
+		this.preserveOwner = t.preserveOwner === void 0 && typeof t.uid != "number" ? !!(process.getuid && process.getuid() === 0) : !!t.preserveOwner, this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0, this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0, this.maxDepth = typeof t.maxDepth == "number" ? t.maxDepth : ho, this.forceChown = t.forceChown === !0, this.win32 = !!t.win32 || Oe, this.newer = !!t.newer, this.keep = !!t.keep, this.noMtime = !!t.noMtime, this.preservePaths = !!t.preservePaths, this.unlink = !!t.unlink, this.cwd = f(path.resolve(t.cwd || process.cwd())), this.strip = Number(t.strip) || 0, this.processUmask = this.chmod ? typeof t.processUmask == "number" ? t.processUmask : Or() : 0, this.umask = typeof t.umask == "number" ? t.umask : this.processUmask, this.dmode = t.dmode || 511 & ~this.umask, this.fmode = t.fmode || 438 & ~this.umask, this.on("entry", (e) => this[Tr](e));
+	}
+	warn(t, e, i = {}) {
+		return (t === "TAR_BAD_ARCHIVE" || t === "TAR_ABORT") && (i.recoverable = !1), super.warn(t, e, i);
+	}
+	[Rs]() {
+		this[ys] && this[yi] === 0 && (this.emit("prefinish"), this.emit("finish"), this.emit("end"));
+	}
+	[Ss](t, e) {
+		let i = t[e], { type: r } = t;
+		if (!i || this.preservePaths) return !0;
+		let [n, o] = le(i), a = o.replaceAll(/\\/g, "/").split("/");
+		if (a.includes("..") || Oe && /^[a-z]:\.\.$/i.test(a[0] ?? "")) {
+			if (e === "path" || r === "Link") return this.warn("TAR_ENTRY_ERROR", `${e} contains '..'`, {
+				entry: t,
+				[e]: i
+			}), !1;
+			let h = path.posix.dirname(t.path), l = path.posix.normalize(path.posix.join(h, a.join("/")));
+			if (l.startsWith("../") || l === "..") return this.warn("TAR_ENTRY_ERROR", `${e} escapes extraction directory`, {
+				entry: t,
+				[e]: i
+			}), !1;
+		}
+		return n && (t[e] = String(o), this.warn("TAR_ENTRY_INFO", `stripping ${n} from absolute ${e}`, {
+			entry: t,
+			[e]: i
+		})), !0;
+	}
+	[Ar](t) {
+		let e = f(t.path), i = e.split("/");
+		if (this.strip) {
+			if (i.length < this.strip) return !1;
+			if (t.type === "Link") {
+				let r = f(String(t.linkpath)).split("/");
+				if (r.length >= this.strip) t.linkpath = r.slice(this.strip).join("/");
+				else return !1;
+			}
+			i.splice(0, this.strip), t.path = i.join("/");
+		}
+		if (isFinite(this.maxDepth) && i.length > this.maxDepth) return this.warn("TAR_ENTRY_ERROR", "path excessively deep", {
+			entry: t,
+			path: e,
+			depth: i.length,
+			maxDepth: this.maxDepth
+		}), !1;
+		if (!this[Ss](t, "path") || !this[Ss](t, "linkpath")) return !1;
+		if (t.absolute = path.isAbsolute(t.path) ? f(path.resolve(t.path)) : f(path.resolve(this.cwd, t.path)), !this.preservePaths && typeof t.absolute == "string" && t.absolute.indexOf(this.cwd + "/") !== 0 && t.absolute !== this.cwd) return this.warn("TAR_ENTRY_ERROR", "path escaped extraction target", {
+			entry: t,
+			path: f(t.path),
+			resolvedPath: t.absolute,
+			cwd: this.cwd
+		}), !1;
+		if (t.absolute === this.cwd && t.type !== "Directory" && t.type !== "GNUDumpDir") return !1;
+		if (this.win32) {
+			let { root: r } = path.win32.parse(String(t.absolute));
+			t.absolute = r + Ji(String(t.absolute).slice(r.length));
+			let { root: n } = path.win32.parse(t.path);
+			t.path = n + Ji(t.path.slice(n.length));
+		}
+		return !0;
+	}
+	[Tr](t) {
+		if (!this[Ar](t)) return t.resume();
+		switch (no.equal(typeof t.absolute, "string"), t.type) {
+			case "Directory":
+			case "GNUDumpDir": t.mode && (t.mode = t.mode | 448);
+			case "File":
+			case "OldFile":
+			case "ContiguousFile":
+			case "Link":
+			case "SymbolicLink": return this[gs](t);
+			default: return this[Dr](t);
+		}
+	}
+	[O](t, e) {
+		t.name === "CwdError" ? this.emit("error", t) : (this.warn("TAR_ENTRY_ERROR", t, { entry: e }), this[$t](), e.resume());
+	}
+	[yt](t, e, i) {
+		Sr(f(t), {
+			uid: this.uid,
+			gid: this.gid,
+			processUid: this.processUid,
+			processGid: this.processGid,
+			umask: this.processUmask,
+			preserve: this.preservePaths,
+			unlink: this.unlink,
+			cwd: this.cwd,
+			mode: e
+		}, i);
+	}
+	[Re](t) {
+		return this.forceChown || this.preserveOwner && (typeof t.uid == "number" && t.uid !== this.processUid || typeof t.gid == "number" && t.gid !== this.processGid) || typeof this.uid == "number" && this.uid !== this.processUid || typeof this.gid == "number" && this.gid !== this.processGid;
+	}
+	[ge](t) {
+		return Fr(this.uid, t.uid, this.processUid);
+	}
+	[be](t) {
+		return Fr(this.gid, t.gid, this.processGid);
+	}
+	[_s](t, e) {
+		let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = new tt(String(t.absolute), {
+			flags: ds(t.size),
+			mode: i,
+			autoClose: !1
+		});
+		r.on("error", (h) => {
+			r.fd && Kt.close(r.fd, () => {}), r.write = () => !0, this[O](h, t), e();
+		});
+		let n = 1, o = (h) => {
+			if (h) {
+				r.fd && Kt.close(r.fd, () => {}), this[O](h, t), e();
+				return;
+			}
+			--n === 0 && r.fd !== void 0 && Kt.close(r.fd, (l) => {
+				l ? this[O](l, t) : this[$t](), e();
+			});
+		};
+		r.on("finish", () => {
+			let h = String(t.absolute), l = r.fd;
+			if (typeof l == "number" && t.mtime && !this.noMtime) {
+				n++;
+				let c = t.atime || /* @__PURE__ */ new Date(), d = t.mtime;
+				Kt.futimes(l, c, d, (S) => S ? Kt.utimes(h, c, d, (T) => o(T && S)) : o());
+			}
+			if (typeof l == "number" && this[Re](t)) {
+				n++;
+				let c = this[ge](t), d = this[be](t);
+				typeof c == "number" && typeof d == "number" && Kt.fchown(l, c, d, (S) => S ? Kt.chown(h, c, d, (T) => o(T && S)) : o());
+			}
+			o();
+		});
+		let a = this.transform && this.transform(t) || t;
+		a !== t && (a.on("error", (h) => {
+			this[O](h, t), e();
+		}), t.pipe(a)), a.pipe(r);
+	}
+	[Os](t, e) {
+		let i = typeof t.mode == "number" ? t.mode & 4095 : this.dmode;
+		this[yt](String(t.absolute), i, (r) => {
+			if (r) {
+				this[O](r, t), e();
+				return;
+			}
+			let n = 1, o = () => {
+				--n === 0 && (e(), this[$t](), t.resume());
+			};
+			t.mtime && !this.noMtime && (n++, Kt.utimes(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime, o)), this[Re](t) && (n++, Kt.chown(String(t.absolute), Number(this[ge](t)), Number(this[be](t)), o)), o();
+		});
+	}
+	[Dr](t) {
+		t.unsupported = !0, this.warn("TAR_ENTRY_UNSUPPORTED", `unsupported entry type: ${t.type}`, { entry: t }), t.resume();
+	}
+	[Lr](t, e) {
+		let i = f(path.relative(this.cwd, path.resolve(path.dirname(String(t.absolute)), String(t.linkpath)))).split("/");
+		this[ye](t, this.cwd, i, () => this[Ri](t, String(t.linkpath), "symlink", e), (r) => {
+			this[O](r, t), e();
+		});
+	}
+	[Nr](t, e) {
+		let i = f(path.resolve(this.cwd, String(t.linkpath))), r = f(String(t.linkpath)).split("/");
+		this[ye](t, this.cwd, r, () => this[Ri](t, i, "link", e), (n) => {
+			this[O](n, t), e();
+		});
+	}
+	[ye](t, e, i, r, n) {
+		let o = i.shift();
+		if (this.preservePaths || o === void 0) return r();
+		let a = path.resolve(e, o);
+		Kt.lstat(a, (h, l) => {
+			if (h) return r();
+			if (l?.isSymbolicLink()) return n(new St(a, path.resolve(a, i.join("/"))));
+			this[ye](t, a, i, r, n);
+		});
+	}
+	[Ir]() {
+		this[yi]++;
+	}
+	[$t]() {
+		this[yi]--, this[Rs]();
+	}
+	[Ts](t) {
+		this[$t](), t.resume();
+	}
+	[bs](t, e) {
+		return t.type === "File" && !this.unlink && e.isFile() && e.nlink <= 1 && !Oe;
+	}
+	[gs](t) {
+		this[Ir]();
+		let e = [t.path];
+		t.linkpath && e.push(t.linkpath), this.reservations.reserve(e, (i) => this[xr](t, i));
+	}
+	[xr](t, e) {
+		let i = (a) => {
+			e(a);
+		}, r = () => {
+			this[yt](this.cwd, this.dmode, (a) => {
+				if (a) {
+					this[O](a, t), i();
+					return;
+				}
+				this[_e] = !0, n();
+			});
+		}, n = () => {
+			if (t.absolute !== this.cwd) {
+				let a = f(path.dirname(String(t.absolute)));
+				if (a !== this.cwd) return this[yt](a, this.dmode, (h) => {
+					if (h) {
+						this[O](h, t), i();
+						return;
+					}
+					o();
+				});
+			}
+			o();
+		}, o = () => {
+			Kt.lstat(String(t.absolute), (a, h) => {
+				if (h && (this.keep || this.newer && h.mtime > (t.mtime ?? h.mtime))) {
+					this[Ts](t), i();
+					return;
+				}
+				if (a || this[bs](t, h)) return this[P](null, t, i);
+				if (h.isDirectory()) {
+					if (t.type === "Directory") {
+						let l = this.chmod && t.mode && (h.mode & 4095) !== t.mode, c = (d) => this[P](d ?? null, t, i);
+						return l ? Kt.chmod(String(t.absolute), Number(t.mode), c) : c();
+					}
+					if (t.absolute !== this.cwd) return Kt.rmdir(String(t.absolute), (l) => this[P](l ?? null, t, i));
+				}
+				if (t.absolute === this.cwd) return this[P](null, t, i);
+				ao(String(t.absolute), (l) => this[P](l ?? null, t, i));
+			});
+		};
+		this[_e] ? n() : r();
+	}
+	[P](t, e, i) {
+		if (t) {
+			this[O](t, e), i();
+			return;
+		}
+		switch (e.type) {
+			case "File":
+			case "OldFile":
+			case "ContiguousFile": return this[_s](e, i);
+			case "Link": return this[Nr](e, i);
+			case "SymbolicLink": return this[Lr](e, i);
+			case "Directory":
+			case "GNUDumpDir": return this[Os](e, i);
+		}
+	}
+	[Ri](t, e, i, r) {
+		Kt[i](e, String(t.absolute), (n) => {
+			n ? this[O](n, t) : (this[$t](), t.resume()), r();
+		});
+	}
+}, Se = (s) => {
+	try {
+		return [null, s()];
+	} catch (t) {
+		return [t, null];
+	}
+}, Te = class extends Xt {
+	sync = !0;
+	[P](t, e) {
+		return super[P](t, e, () => {});
+	}
+	[gs](t) {
+		if (!this[_e]) {
+			let n = this[yt](this.cwd, this.dmode);
+			if (n) return this[O](n, t);
+			this[_e] = !0;
+		}
+		if (t.absolute !== this.cwd) {
+			let n = f(path.dirname(String(t.absolute)));
+			if (n !== this.cwd) {
+				let o = this[yt](n, this.dmode);
+				if (o) return this[O](o, t);
+			}
+		}
+		let [e, i] = Se(() => Kt.lstatSync(String(t.absolute)));
+		if (i && (this.keep || this.newer && i.mtime > (t.mtime ?? i.mtime))) return this[Ts](t);
+		if (e || this[bs](t, i)) return this[P](null, t);
+		if (i.isDirectory()) {
+			if (t.type === "Directory") {
+				let [a] = this.chmod && t.mode && (i.mode & 4095) !== t.mode ? Se(() => {
+					Kt.chmodSync(String(t.absolute), Number(t.mode));
+				}) : [];
+				return this[P](a, t);
+			}
+			let [n] = Se(() => Kt.rmdirSync(String(t.absolute)));
+			this[P](n, t);
+		}
+		let [r] = t.absolute === this.cwd ? [] : Se(() => lo(String(t.absolute)));
+		this[P](r, t);
+	}
+	[_s](t, e) {
+		let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = (a) => {
+			let h;
+			try {
+				Kt.closeSync(n);
+			} catch (l) {
+				h = l;
+			}
+			(a || h) && this[O](a || h, t), e();
+		}, n;
+		try {
+			n = Kt.openSync(String(t.absolute), ds(t.size), i);
+		} catch (a) {
+			return r(a);
+		}
+		let o = this.transform && this.transform(t) || t;
+		o !== t && (o.on("error", (a) => this[O](a, t)), t.pipe(o)), o.on("data", (a) => {
+			try {
+				Kt.writeSync(n, a, 0, a.length);
+			} catch (h) {
+				r(h);
+			}
+		}), o.on("end", () => {
+			let a = null;
+			if (t.mtime && !this.noMtime) {
+				let h = t.atime || /* @__PURE__ */ new Date(), l = t.mtime;
+				try {
+					Kt.futimesSync(n, h, l);
+				} catch (c) {
+					try {
+						Kt.utimesSync(String(t.absolute), h, l);
+					} catch {
+						a = c;
+					}
+				}
+			}
+			if (this[Re](t)) {
+				let h = this[ge](t), l = this[be](t);
+				try {
+					Kt.fchownSync(n, Number(h), Number(l));
+				} catch (c) {
+					try {
+						Kt.chownSync(String(t.absolute), Number(h), Number(l));
+					} catch {
+						a = a || c;
+					}
+				}
+			}
+			r(a);
+		});
+	}
+	[Os](t, e) {
+		let i = typeof t.mode == "number" ? t.mode & 4095 : this.dmode, r = this[yt](String(t.absolute), i);
+		if (r) {
+			this[O](r, t), e();
+			return;
+		}
+		if (t.mtime && !this.noMtime) try {
+			Kt.utimesSync(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime);
+		} catch {}
+		if (this[Re](t)) try {
+			Kt.chownSync(String(t.absolute), Number(this[ge](t)), Number(this[be](t)));
+		} catch {}
+		e(), t.resume();
+	}
+	[yt](t, e) {
+		try {
+			return Rr(f(t), {
+				uid: this.uid,
+				gid: this.gid,
+				processUid: this.processUid,
+				processGid: this.processGid,
+				umask: this.processUmask,
+				preserve: this.preservePaths,
+				unlink: this.unlink,
+				cwd: this.cwd,
+				mode: e
+			});
+		} catch (i) {
+			return i;
+		}
+	}
+	[ye](t, e, i, r, n) {
+		if (this.preservePaths || i.length === 0) return r();
+		let o = e;
+		for (let a of i) {
+			o = path.resolve(o, a);
+			let [h, l] = Se(() => Kt.lstatSync(o));
+			if (h) return r();
+			if (l.isSymbolicLink()) return n(new St(o, path.resolve(e, i.join("/"))));
+		}
+		r();
+	}
+	[Ri](t, e, i, r) {
+		let n = `${i}Sync`;
+		try {
+			Kt[n](e, String(t.absolute)), r(), t.resume();
+		} catch (o) {
+			return this[O](o, t);
+		}
+	}
+}, co = (s) => {
+	let t = new Te(s), e = s.file, i = Kt.statSync(e);
+	new Me(e, {
+		readSize: s.maxReadSize || 16 * 1024 * 1024,
+		size: i.size
+	}).pipe(t);
+}, fo = (s, t) => {
+	let e = new Xt(s), i = s.maxReadSize || 16 * 1024 * 1024, r = s.file;
+	return new Promise((o, a) => {
+		e.on("error", a), e.on("close", o), Kt.stat(r, (h, l) => {
+			if (h) a(h);
+			else {
+				let c = new _t(r, {
+					readSize: i,
+					size: l.size
+				});
+				c.on("error", a), c.pipe(e);
+			}
+		});
+	});
+};
+K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
+	t?.length && Xi(s, t);
+});
+var mo = (s, t) => {
+	let e = new kt(s), i = !0, r, n;
+	try {
+		try {
+			r = Kt.openSync(s.file, "r+");
+		} catch (h) {
+			if (h?.code === "ENOENT") r = Kt.openSync(s.file, "w+");
+			else throw h;
+		}
+		let o = Kt.fstatSync(r), a = Buffer.alloc(512);
+		t: for (n = 0; n < o.size; n += 512) {
+			for (let c = 0, d = 0; c < 512; c += d) {
+				if (d = Kt.readSync(r, a, c, a.length - c, n + c), n === 0 && a[0] === 31 && a[1] === 139) throw new Error("cannot append to compressed archives");
+				if (!d) break t;
+			}
+			let h = new C(a);
+			if (!h.cksumValid) break;
+			let l = 512 * Math.ceil((h.size || 0) / 512);
+			if (n + l + 512 > o.size) break;
+			n += l, s.mtimeCache && h.mtime && s.mtimeCache.set(String(h.path), h.mtime);
+		}
+		i = !1, po(s, e, n, r, t);
+	} finally {
+		if (i) try {
+			Kt.closeSync(r);
+		} catch {}
+	}
+}, po = (s, t, e, i, r) => {
+	let n = new Wt(s.file, {
+		fd: i,
+		start: e
+	});
+	t.pipe(n), wo(t, r);
+}, Eo = (s, t) => {
+	t = Array.from(t);
+	let e = new wt(s), i = (n, o, a) => {
+		let h = (T, N) => {
+			T ? Kt.close(n, (E) => a(T)) : a(null, N);
+		}, l = 0;
+		if (o === 0) return h(null, 0);
+		let c = 0, d = Buffer.alloc(512), S = (T, N) => {
+			if (T || N === void 0) return h(T);
+			if (c += N, c < 512 && N) return Kt.read(n, d, c, d.length - c, l + c, S);
+			if (l === 0 && d[0] === 31 && d[1] === 139) return h(/* @__PURE__ */ new Error("cannot append to compressed archives"));
+			if (c < 512) return h(null, l);
+			let E = new C(d);
+			if (!E.cksumValid) return h(null, l);
+			let x = 512 * Math.ceil((E.size ?? 0) / 512);
+			if (l + x + 512 > o || (l += x + 512, l >= o)) return h(null, l);
+			s.mtimeCache && E.mtime && s.mtimeCache.set(String(E.path), E.mtime), c = 0, Kt.read(n, d, 0, 512, l, S);
+		};
+		Kt.read(n, d, 0, 512, l, S);
+	};
+	return new Promise((n, o) => {
+		e.on("error", o);
+		let a = "r+", h = (l, c) => {
+			if (l && l.code === "ENOENT" && a === "r+") return a = "w+", Kt.open(s.file, a, h);
+			if (l || !c) return o(l);
+			Kt.fstat(c, (d, S) => {
+				if (d) return Kt.close(c, () => o(d));
+				i(c, S.size, (T, N) => {
+					if (T) return o(T);
+					let E = new tt(s.file, {
+						fd: c,
+						start: N
+					});
+					e.pipe(E), E.on("error", o), E.on("close", n), So(e, t);
+				});
+			});
+		};
+		Kt.open(s.file, a, h);
+	});
+}, wo = (s, t) => {
+	t.forEach((e) => {
+		e.charAt(0) === "@" ? Ft({
+			file: path.resolve(s.cwd, e.slice(1)),
+			sync: !0,
+			noResume: !0,
+			onReadEntry: (i) => s.add(i)
+		}) : s.add(e);
+	}), s.end();
+}, So = async (s, t) => {
+	for (let e of t) e.charAt(0) === "@" ? await Ft({
+		file: path.resolve(String(s.cwd), e.slice(1)),
+		noResume: !0,
+		onReadEntry: (i) => s.add(i)
+	}) : s.add(e);
+	s.end();
+}, vt = K(mo, Eo, () => {
+	throw new TypeError("file is required");
+}, () => {
+	throw new TypeError("file is required");
+}, (s, t) => {
+	if (!vs(s)) throw new TypeError("file is required");
+	if (s.gzip || s.brotli || s.zstd || s.file.endsWith(".br") || s.file.endsWith(".tbr")) throw new TypeError("cannot append to compressed archives");
+	if (!t?.length) throw new TypeError("no paths specified to add/replace");
+});
+K(vt.syncFile, vt.asyncFile, vt.syncNoFile, vt.asyncNoFile, (s, t = []) => {
+	vt.validate?.(s, t), Ro(s);
+});
+var Ro = (s) => {
+	let t = s.filter;
+	s.mtimeCache || (s.mtimeCache = /* @__PURE__ */ new Map()), s.filter = t ? (e, i) => t(e, i) && !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0)) : (e, i) => !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0));
+};
+//#endregion
+//#region src/builtins/system-backup/system-backup.service.ts
+/**
+* Thrown when an archive build (or a backup run driving one) is
+* stopped via its `AbortSignal`. Callers use `instanceof` to tell a
+* deliberate operator cancel from a real failure — a cancelled run is
+* an outcome, not an error to alert on. (D342)
+*/
+var BackupCancelledError = class extends Error {
+	constructor(message = "backup run cancelled") {
+		super(message);
+		this.name = "BackupCancelledError";
+	}
+};
+/**
+* Thrown when an archive would carry a live database and its owner could not
+* produce a verified snapshot of it (D693). Nothing was built: a run that
+* "succeeded" without the database — or with a torn copy of it — would push
+* the oldest good archive out of every destination's retention.
+*/
+var BackupSnapshotRefusedError = class extends Error {
+	constructor(reason) {
+		super(`settings database snapshot failed — no archive built, nothing uploaded, retention untouched: ${reason}`);
+		this.name = "BackupSnapshotRefusedError";
+	}
+};
+/**
+* Settle with `pending`, or reject with {@link BackupCancelledError} as soon as
+* `signal` fires. A pending call abandoned by the cancel still settles later:
+* `onAbandoned` runs then, to clean up what it produced.
+*/
+function raceAbort(pending, signal, onAbandoned) {
+	if (signal === void 0) return pending;
+	return new Promise((resolve, reject) => {
+		let abandoned = false;
+		const onAbort = () => {
+			abandoned = true;
+			reject(new BackupCancelledError());
+		};
+		if (signal.aborted) onAbort();
+		else signal.addEventListener("abort", onAbort, { once: true });
+		pending.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			if (abandoned) onAbandoned();
+			else resolve(value);
+		}, (err) => {
+			signal.removeEventListener("abort", onAbort);
+			if (abandoned) onAbandoned();
+			else reject(err);
+		});
+	});
+}
+/** Throw `BackupCancelledError` when the signal has fired. */
+function throwIfCancelled(signal) {
+	if (signal?.aborted) throw new BackupCancelledError();
+}
+/**
+* Default set of paths considered part of a "system backup". Includes
+* everything that isn't pure backend code — config, sqlite, addons
+* (runtime overlay), addons-data (per-addon private dir), TLS certs,
+* auto-update marker.
+*
+* Anything not listed is excluded by omission — recordings/, media/,
+* models/, logs/, cache/ (too large or fully recreatable). Note this
+* covers only TOP-LEVEL trees: bulk nested INSIDE a listed location
+* is excluded via `DEFAULT_BACKUP_EXCLUDES` + the node_modules rule
+* below, enforced in the walk and the tar filter alike.
+*/
+var DEFAULT_BACKUP_LOCATIONS = [
+	"config.yaml",
+	"addons",
+	"addons-data",
+	"tls",
+	"auto-update.json"
+];
+/**
+* Subtrees never captured by a system backup even though they live
+* under a `DEFAULT_BACKUP_LOCATIONS` entry. Paths are dataDir-relative
+* prefixes. Two lessons from the live hub (2026-09-04, D-record
+* "backup excludes"):
+*
+* - `addons-data/backup-orchestrator/staging` — the orchestrator's
+*   LEGACY staging dir (now `<dataDir>/backup-staging`, outside every
+*   location). Before Jul 28 every archive nested all previous
+*   archives (175M → 503M → 4.5G); leaked files from that era must
+*   never be re-swept into new backups.
+* - `addons-data/recorder/exports` — operator-exported clips (8.4 GB
+*   on the hub). Media, not system state; a restore has no use for it.
+*/
+var DEFAULT_BACKUP_EXCLUDES = ["addons-data/backup-orchestrator/staging", "addons-data/recorder/exports"];
+/**
+* Directory name excluded wherever it appears in the tree.
+* `AddonInstaller` materialises runtime deps under
+* `addons/@camstack/<addon>/node_modules` (~196 MB on the hub); only
+* built `dist` + package.json + assets are restore-worthy — deps are
+* reinstalled from npm on demand. node_modules is NEVER archived.
+*/
+var EXCLUDED_DIR_NAME = "node_modules";
+/**
+* True when a dataDir-relative path must be omitted from archives,
+* manifests and location stats. Accepts tar-style paths (`./` prefix,
+* trailing `/`) and backslash separators.
+*/
+function isExcludedFromBackup(relPath) {
+	const norm = normalizeArchivePath(relPath);
+	if (norm.length === 0) return false;
+	const segments = norm.split("/");
+	if (segments.includes(EXCLUDED_DIR_NAME)) return true;
+	if (segments.some((seg) => seg.endsWith(".backup-snapshot-partial"))) return true;
+	if (norm.endsWith(".backup-snapshot")) return true;
+	return DEFAULT_BACKUP_EXCLUDES.some((prefix) => norm === prefix || norm.startsWith(`${prefix}/`));
+}
+/** `./a/b/` and `a\\b` → `a/b`: the one spelling every archive-path comparison uses. */
+function normalizeArchivePath(relPath) {
+	return relPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+/** The files SQLite keeps beside a database. A live one is never archived. */
+var SQLITE_SIDECAR_SUFFIXES = [
+	"-wal",
+	"-shm",
+	"-journal"
+];
+var SQLITE_DATABASE_SUFFIXES = [
+	".db",
+	".sqlite",
+	".sqlite3"
+];
+/**
+* The database a `-wal` / `-shm` / `-journal` belongs to, or null for any other
+* path. The base must name a database (`.db` / `.sqlite` / `.sqlite3`): a
+* `build-journal` is not a sidecar, and must not stop every backup as a "live
+* database" that does not exist.
+*/
+function databaseOfSidecar(relPath) {
+	for (const suffix of SQLITE_SIDECAR_SUFFIXES) {
+		if (!relPath.endsWith(suffix)) continue;
+		const db = relPath.slice(0, -suffix.length);
+		return SQLITE_DATABASE_SUFFIXES.some((dbSuffix) => db.endsWith(dbSuffix)) ? db : null;
+	}
+	return null;
+}
+/** A SQLite database file, or a sidecar of one. */
+function isSqlitePath(relPath) {
+	const db = databaseOfSidecar(relPath) ?? relPath;
+	return SQLITE_DATABASE_SUFFIXES.some((suffix) => db.endsWith(suffix));
+}
+/** Path of the manifest file embedded inside every archive. */
+var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
+var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
+/**
+* System-level archive primitives. Construct one per server boot;
+* methods are pure I/O.
+*/
+var SystemBackupService = class {
+	dataDir;
+	logger;
+	statCacheTtlMs;
+	statCache = /* @__PURE__ */ new Map();
+	constructor(dataDir, logger, opts) {
+		this.dataDir = dataDir;
+		this.logger = logger;
+		this.statCacheTtlMs = opts?.statCacheTtlMs ?? DEFAULT_STAT_CACHE_TTL_MS;
+	}
+	/**
+	* Snapshot the current size + file count of each well-known
+	* location. Used by the admin UI to render an opt-in checklist
+	* before triggering a backup, and by `createArchive` to derive the
+	* embedded manifest.
+	*
+	* The walk is async (yields to the event loop per directory) and
+	* per-location results are cached + single-flighted: the service
+	* runs in-process in the hub, and a synchronous walk of the 70k+
+	* file `addons` location blocked the event loop long enough to kill
+	* WS keepalives cluster-wide.
+	*/
+	statLocations(locations = DEFAULT_BACKUP_LOCATIONS) {
+		return Promise.all(locations.map((loc) => this.statLocationCached(loc)));
+	}
+	statLocationCached(loc) {
+		const now = Date.now();
+		const hit = this.statCache.get(loc);
+		if (hit && now - hit.at < this.statCacheTtlMs) return hit.value;
+		const value = this.statLocation(loc);
+		this.statCache.set(loc, {
+			at: now,
+			value
+		});
+		value.catch(() => this.statCache.delete(loc));
+		return value;
+	}
+	async statLocation(loc) {
+		const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
+		if (!fs$1.existsSync(abs)) return {
+			name: loc,
+			sizeBytes: 0,
+			fileCount: 0,
+			present: false
+		};
+		const walked = await walkAbs(abs, abs, this.exclusionPredicate());
+		return {
+			name: loc,
+			sizeBytes: walked.reduce((acc, e) => acc + e.sizeBytes, 0),
+			fileCount: walked.filter((e) => e.kind === "file").length,
+			present: true
+		};
+	}
+	/**
+	* Create a tar.gz of the given locations. Uses the `tar` npm package
+	* (used by npm itself) instead of shelling out — gives us:
+	*
+	*   - Symlink dereference (`follow: true`) so dev mode's
+	*     `addons/<name> → packages/<name>` overlay archives content,
+	*     not just link stubs.
+	*   - Programmatic walk → we build a manifest of every entry while
+	*     copying so the archive can self-describe.
+	*
+	* Locations that don't exist are silently skipped. Throws if zero
+	* locations would be included.
+	*
+	* Cancellation: `signal` aborts the build IN FLIGHT — the manifest
+	* walk checks it per filesystem node and the tar phase runs through
+	* `stream.pipeline(..., { signal })`, which destroys the pack and
+	* the file sink immediately. On abort the half-written archive is
+	* deleted here (never left for the caller to remember) and the call
+	* rejects with {@link BackupCancelledError}. (D342)
+	*
+	* Progress: `onArchiveBytes` receives the cumulative compressed
+	* bytes written to `archivePath` — the live "how large has staging
+	* grown" counter `backup.listRuns` exposes.
+	*/
+	async createArchive(opts) {
+		throwIfCancelled(opts.signal);
+		const recipient = opts.encryptTo !== void 0 ? parseBackupPublicKey(opts.encryptTo) : null;
+		const requested = opts.locations ?? DEFAULT_BACKUP_LOCATIONS;
+		const present = [];
+		for (const loc of requested) {
+			const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
+			if (fs$1.existsSync(abs)) present.push(loc);
+			else this.logger.debug("createArchive: skipping missing location", { meta: { location: loc } });
+		}
+		if (present.length === 0) throw new Error(`createArchive: no locations from {${requested.join(", ")}} exist under ${this.dataDir}`);
+		fs$1.mkdirSync(path$1.dirname(opts.archivePath), { recursive: true });
+		const walked = [];
+		for (const loc of present) {
+			throwIfCancelled(opts.signal);
+			const abs = path$1.join(this.dataDir, loc);
+			const stat = await fsp.stat(abs);
+			if (stat.isDirectory()) for (const e of await walkAbs(abs, this.dataDir, this.exclusionPredicate(), opts.signal)) walked.push(e);
+			else if (!isExcludedFromBackup(path$1.relative(this.dataDir, abs))) walked.push(toArchiveEntry(abs, this.dataDir, stat));
+		}
+		const walkedPaths = new Set(walked.map((e) => e.path));
+		const owned = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Set();
+		const unowned = /* @__PURE__ */ new Set();
+		for (const e of walked) {
+			const db = databaseOfSidecar(e.path);
+			if (db !== null && !owned.has(db)) unowned.add(db);
+		}
+		if (unowned.size > 0) {
+			const databases = [...unowned].sort();
+			this.logger.error("createArchive: a live SQLite database has no owner snapshot — no archive built", { meta: {
+				databases,
+				archivePath: opts.archivePath
+			} });
+			throw new BackupSnapshotRefusedError(`live SQLite database ${databases.join(", ")} has no owner that can snapshot it — a copy of its files would be torn; remove its stale -wal/-shm/-journal if nothing has it open, or leave its location out of the backup`);
+		}
+		const snapshot = owned.size > 0 && opts.owner ? await this.takeOwnerSnapshot(opts.owner, owned, opts.signal) : null;
+		try {
+			const liveFiles = /* @__PURE__ */ new Set();
+			for (const db of owned) {
+				liveFiles.add(db);
+				for (const suffix of SQLITE_SIDECAR_SUFFIXES) liveFiles.add(db + suffix);
+			}
+			const entries = walked.filter((e) => !liveFiles.has(e.path));
+			if (snapshot !== null) entries.push(snapshot.entry);
+			const manifest = {
+				archiveVersion: 1,
+				createdAt: Date.now(),
+				dataDir: this.dataDir,
+				locations: present,
+				entries,
+				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
+				totalFiles: entries.filter((e) => e.kind === "file").length,
+				...snapshot !== null ? { sqliteSnapshots: [snapshot.archived] } : {}
+			};
+			const carriedSnapshot = snapshot?.archived.snapshotPath ?? null;
+			return await this.writeArchive({
+				archivePath: opts.archivePath,
+				present,
+				manifest,
+				excluded: (rel) => {
+					if (rel === carriedSnapshot) return false;
+					return liveFiles.has(rel) || isExcludedFromBackup(rel);
+				},
+				...opts.signal ? { signal: opts.signal } : {},
+				...opts.onArchiveBytes ? { onArchiveBytes: opts.onArchiveBytes } : {},
+				...opts.encryptTo !== void 0 ? { encryptTo: opts.encryptTo } : {}
+			}).then((result) => recipient === null ? result : {
+				...result,
+				encryption: {
+					scheme: BACKUP_ENCRYPTION_SCHEME,
+					keyId: recipient.keyId
+				}
+			});
+		} finally {
+			if (snapshot !== null) await this.removeSnapshot(snapshot.absPath);
+		}
+	}
+	/**
+	* Tar `present` (filtered by `excluded`) plus the staged manifest into
+	* `archivePath`.
+	*/
+	async writeArchive(opts) {
+		const { present, manifest } = opts;
+		const manifestStagePath = `${opts.archivePath}.${process.pid}.manifest.json`;
+		fs$1.writeFileSync(manifestStagePath, JSON.stringify(manifest, null, 2), "utf-8");
+		this.logger.info("createArchive: tarring", { meta: {
+			archivePath: opts.archivePath,
+			locations: [...present],
+			totalFiles: manifest.totalFiles,
+			totalBytes: manifest.totalBytes
+		} });
+		try {
+			const stagedInDataDir = path$1.join(this.dataDir, ARCHIVE_MANIFEST_NAME);
+			fs$1.copyFileSync(manifestStagePath, stagedInDataDir);
+			const stagingRel = path$1.relative(this.dataDir, path$1.dirname(opts.archivePath));
+			const excludePrefix = stagingRel && !stagingRel.startsWith("..") && !path$1.isAbsolute(stagingRel) ? stagingRel : null;
+			try {
+				const pack = Kn({
+					gzip: true,
+					cwd: this.dataDir,
+					follow: true,
+					portable: true,
+					filter: (entryPath) => {
+						const norm = normalizeArchivePath(entryPath);
+						if (opts.excluded(norm)) return false;
+						if (!excludePrefix) return true;
+						return norm !== excludePrefix && !norm.startsWith(`${excludePrefix}/`);
+					}
+				}, [ARCHIVE_MANIFEST_NAME, ...present]);
+				const sink = fs$1.createWriteStream(opts.archivePath, { mode: 384 });
+				try {
+					const streamOpts = opts.signal ? { signal: opts.signal } : {};
+					if (opts.encryptTo !== void 0) await pipeline(pack, createBackupEncryptStream(opts.encryptTo), byteCountingPassthrough(opts.onArchiveBytes), sink, streamOpts);
+					else await pipeline(pack, byteCountingPassthrough(opts.onArchiveBytes), sink, streamOpts);
+				} catch (err) {
+					try {
+						fs$1.rmSync(opts.archivePath, { force: true });
+					} catch {}
+					if (opts.signal?.aborted) throw new BackupCancelledError();
+					throw err;
+				}
+			} finally {
+				try {
+					fs$1.rmSync(stagedInDataDir, { force: true });
+				} catch {}
+			}
+		} finally {
+			try {
+				fs$1.rmSync(manifestStagePath, { force: true });
+			} catch {}
+		}
+		const sizeBytes = fs$1.statSync(opts.archivePath).size;
+		return {
+			archivePath: opts.archivePath,
+			includedLocations: [...present],
+			sizeBytes,
+			manifest
+		};
+	}
+	/**
+	* without extracting payload files. Streams the tar.gz, parses the
+	* one entry we care about, then aborts.
+	*/
+	async readArchiveManifest(archivePath) {
+		if (!fs$1.existsSync(archivePath)) throw new Error(`readArchiveManifest: ${archivePath} does not exist`);
+		return new Promise((resolve, reject) => {
+			const chunks = [];
+			let found = false;
+			let resolved = false;
+			const parser = new st({ onentry: (entry) => {
+				if (entry.path === ".camstack-backup-manifest.json" && !found) {
+					found = true;
+					entry.on("data", (chunk) => chunks.push(chunk));
+					entry.on("end", () => {
+						try {
+							const json = Buffer.concat(chunks).toString("utf-8");
+							const parsed = JSON.parse(json);
+							resolved = true;
+							resolve(parsed);
+						} catch (err) {
+							resolved = true;
+							reject(err instanceof Error ? err : new Error(String(err)));
+						}
+					});
+				} else entry.resume();
+			} });
+			parser.on("end", () => {
+				if (!resolved) resolve(found ? null : null);
+			});
+			const gunzip = zlib.createGunzip();
+			gunzip.on("error", (err) => {
+				if (!resolved) {
+					resolved = true;
+					reject(err);
+				}
+			});
+			const reader = fs$1.createReadStream(archivePath);
+			reader.on("error", (err) => {
+				if (!resolved) {
+					resolved = true;
+					reject(err);
+				}
+			});
+			reader.pipe(gunzip).pipe(parser);
+		});
+	}
+	/**
+	* Schedule a restore for the next boot by writing a marker file.
+	* `locations` (optional) carries through to the launcher's boot-time
+	* restore (`server/backend/src/launcher.ts`, the only restore there is)
+	* so the operator's "restore only X and Y" choice survives the process
+	* restart.
+	*/
+	scheduleRestoreMarker(opts) {
+		if (!fs$1.existsSync(opts.archivePath)) throw new Error(`scheduleRestoreMarker: ${opts.archivePath} missing`);
+		const markerPath = this.getRestoreMarkerPath();
+		const marker = {
+			archivePath: opts.archivePath,
+			requestedAt: Date.now(),
+			source: opts.source,
+			...opts.locations ? { locations: [...opts.locations] } : {}
+		};
+		fs$1.mkdirSync(path$1.dirname(markerPath), { recursive: true });
+		fs$1.writeFileSync(markerPath, JSON.stringify(marker, null, 2), { mode: 384 });
+		return markerPath;
+	}
+	/** Read the pending-restore marker if one is present. */
+	readPendingMarker() {
+		const markerPath = this.getRestoreMarkerPath();
+		if (!fs$1.existsSync(markerPath)) return null;
+		try {
+			const raw = fs$1.readFileSync(markerPath, "utf-8");
+			const parsed = JSON.parse(raw);
+			if (typeof parsed === "object" && parsed != null && typeof parsed.archivePath === "string") return parsed;
+		} catch (err) {
+			this.logger.warn("readPendingMarker: malformed marker — ignoring", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+		return null;
+	}
+	/** Drop the marker after a successful boot-time restore. */
+	clearPendingMarker() {
+		const markerPath = this.getRestoreMarkerPath();
+		if (fs$1.existsSync(markerPath)) fs$1.rmSync(markerPath, { force: true });
+	}
+	/**
+	* The databases the owner declares, archive-relative, that this walk found.
+	* One outside this data root is not in scope. An owner that cannot answer
+	* stops the archive: without the answer, nothing says which file is live.
+	*/
+	async ownedDatabasesInScope(owner, walked) {
+		if (owner === void 0) return /* @__PURE__ */ new Set();
+		let declared;
+		try {
+			declared = await owner.listDatabases();
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			this.logger.error("createArchive: the database owner did not say what it owns — no archive built", { meta: { error: reason } });
+			throw new BackupSnapshotRefusedError(`the database owner could not be asked: ${reason}`);
+		}
+		const inScope = /* @__PURE__ */ new Set();
+		for (const abs of declared) {
+			const rel = this.archiveRelative(abs);
+			if (rel !== null && walked.has(rel)) inScope.add(rel);
+		}
+		return inScope;
+	}
+	/**
+	* Ask the owner for its snapshot, and place it in this archive. The snapshot
+	* must sit on THIS data root — the call is pinned to this node, so a path
+	* elsewhere means it reached another host, and that file is not ours to
+	* read — beside an owned database in scope, and it must cover EVERY owned
+	* database in scope. Anything else is refused.
+	*
+	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
+	* a name this process derives itself. A path the owner ANSWERS is never
+	* deleted on its word — answering the live database as the snapshot would
+	* otherwise delete the live database. A file at any other path is left to
+	* the owner's own sweep.
+	*
+	* A cancel is honoured while the owner is still copying; the copy it may
+	* finish afterwards is removed when that call settles.
+	*/
+	async takeOwnerSnapshot(owner, owned, signal) {
+		const removeOwnedSnapshots = async () => {
+			for (const db of owned) await this.removeSnapshot(path$1.join(this.dataDir, db + DATABASE_SNAPSHOT_SUFFIX));
+		};
+		let result;
+		try {
+			result = await raceAbort(owner.writeSnapshot(), signal, () => {
+				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: { databases: [...owned] } });
+				return removeOwnedSnapshots();
+			});
+		} catch (err) {
+			if (err instanceof BackupCancelledError) throw err;
+			const reason = err instanceof Error ? err.message : String(err);
+			this.logger.error("createArchive: the owner could not snapshot its live database — no archive built", { meta: {
+				databases: [...owned],
+				error: reason
+			} });
+			await removeOwnedSnapshots();
+			throw new BackupSnapshotRefusedError(reason);
+		}
+		try {
+			const livePath = this.archiveRelative(result.livePath);
+			const snapshotPath = this.archiveRelative(result.snapshotPath);
+			if (livePath === null || snapshotPath === null) {
+				this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
+					snapshot: result.snapshotPath,
+					dataDir: this.dataDir
+				} });
+				throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
+			}
+			if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
+			const uncovered = [...owned].filter((db) => db !== livePath);
+			if (!owned.has(livePath) || uncovered.length > 0) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath}, but the owned database(s) in this archive are ${[...owned].join(", ")}`);
+			const absPath = path$1.join(this.dataDir, snapshotPath);
+			const stat = await fsp.stat(absPath);
+			this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
+				database: livePath,
+				snapshot: snapshotPath,
+				sizeBytes: stat.size,
+				tables: result.tables.length,
+				copyMs: result.copyMs,
+				verifyMs: result.verifyMs
+			} });
+			return {
+				absPath,
+				archived: {
+					...result,
+					livePath,
+					snapshotPath
+				},
+				entry: toArchiveEntry(absPath, this.dataDir, stat)
+			};
+		} catch (err) {
+			await removeOwnedSnapshots();
+			throw err;
+		}
+	}
+	async removeSnapshot(absPath) {
+		try {
+			await fsp.rm(absPath, { force: true });
+		} catch (err) {
+			this.logger.warn("createArchive: owner snapshot could not be removed", { meta: {
+				snapshot: absPath,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+	/** `abs` relative to the data root, or null when it lies outside it. */
+	archiveRelative(abs) {
+		const rel = path$1.relative(path$1.resolve(this.dataDir), path$1.resolve(abs));
+		if (rel.length === 0 || rel.startsWith("..") || path$1.isAbsolute(rel)) return null;
+		return normalizeArchivePath(rel);
+	}
+	getRestoreMarkerPath() {
+		return path$1.join(this.dataDir, ".pending-restore.json");
+	}
+	/**
+	* Absolute-path form of {@link isExcludedFromBackup}, anchored on
+	* this service's dataDir. Shared by the manifest walk and the location
+	* stats so both agree with the tar filter about what a backup contains.
+	*/
+	exclusionPredicate() {
+		return (abs) => isExcludedFromBackup(path$1.relative(this.dataDir, abs));
+	}
+};
+/**
+* Recursively walk a directory and produce one `ArchiveEntry` per
+* filesystem node. `dataDir` is used to compute the archive-relative
+* path. Symlinks are dereferenced (matches the `follow: true` flag we
+* pass to tar.create).
+*/
+async function walkAbs(absRoot, dataDir, shouldSkip, signal) {
+	const out = [];
+	await walkRec(absRoot, dataDir, out, shouldSkip, signal);
+	return out;
+}
+async function walkRec(abs, dataDir, out, shouldSkip, signal) {
+	throwIfCancelled(signal);
+	if (shouldSkip?.(abs)) return;
+	let stat;
+	try {
+		stat = await fsp.stat(abs);
+	} catch {
+		return;
+	}
+	out.push(toArchiveEntry(abs, dataDir, stat));
+	if (stat.isDirectory()) {
+		let children;
+		try {
+			children = await fsp.readdir(abs);
+		} catch {
+			return;
+		}
+		for (const child of children) await walkRec(path$1.join(abs, child), dataDir, out, shouldSkip, signal);
+	}
+}
+/**
+* Pass-through transform that reports the CUMULATIVE bytes flowed so
+* far. Sits between the tar pack and the file sink so the caller's
+* progress counter tracks the compressed archive as it grows on disk.
+*/
+function byteCountingPassthrough(onBytes) {
+	let total = 0;
+	return new Transform({ transform(chunk, _encoding, callback) {
+		if (Buffer.isBuffer(chunk)) total += chunk.byteLength;
+		onBytes?.(total);
+		callback(null, chunk);
+	} });
+}
+function toArchiveEntry(abs, dataDir, stat) {
+	const rel = path$1.relative(dataDir, abs).replace(/\\/g, "/");
+	const kind = stat.isDirectory() ? "dir" : stat.isSymbolicLink() ? "symlink" : "file";
+	return {
+		path: rel || path$1.basename(abs),
+		kind,
+		sizeBytes: kind === "file" ? stat.size : 0,
+		mtime: stat.mtimeMs
+	};
+}
+//#endregion
+//#region src/builtins/backup-orchestrator/restore-archive.ts
+/**
+* Turn a downloaded backup into the plain `.tar.gz` the boot-time restore
+* extracts (`server/backend/src/pending-restore.ts`, unchanged).
+*
+* An encrypted archive is decrypted HERE, before the restart, with the backup
+* secret key the operator typed into the restore dialog: the launcher runs
+* before any runner and has no way to ask for a key. The plaintext lands only
+* in the hub's private staging directory (0600), where the restore marker
+* points at it, and is swept with the rest of staging once consumed.
+*
+* A plain archive — every backup made before encryption, or with it off — is
+* used as it is: existing backups stay restorable.
+*/
+/** An encrypted backup was asked to restore without its key. */
+var BackupKeyRequiredError = class extends Error {
+	keyId;
+	constructor(keyId) {
+		super(`this backup is encrypted to backup key ${keyId} — enter that key's secret to restore it`);
+		this.keyId = keyId;
+		this.name = "BackupKeyRequiredError";
+	}
+};
+/**
+* Before downloading gigabytes: does the operator's key fit what the
+* destination's manifest says the archive needs? `archiveKeyId` undefined =
+* the manifest records no encryption (the header check after the download
+* remains the authority).
+*/
+function precheckRestoreKey(archiveKeyId, secretKey) {
+	if (archiveKeyId === void 0) return;
+	if (secretKey === void 0 || secretKey.trim().length === 0) throw new BackupKeyRequiredError(archiveKeyId);
+	const given = parseBackupSecretKey(secretKey).keyId;
+	if (given !== archiveKeyId) throw new BackupKeyMismatchError(archiveKeyId, given);
+}
+async function prepareRestoreArchive(input) {
+	let header;
+	try {
+		header = await readBackupEncryptionHeader(input.downloaded);
+	} catch (err) {
+		await fsp.rm(input.downloaded, { force: true });
+		throw err;
+	}
+	if (header === null) {
+		await fsp.rename(input.downloaded, input.target);
+		return { encrypted: false };
+	}
+	try {
+		if (input.secretKey === void 0 || input.secretKey.trim().length === 0) throw new BackupKeyRequiredError(header.keyId);
+		await decryptBackupFile(input.downloaded, input.target, input.secretKey);
+		return {
+			encrypted: true,
+			keyId: header.keyId
+		};
+	} finally {
+		await fsp.rm(input.downloaded, { force: true });
+	}
+}
+//#endregion
+export { BackupSnapshotRefusedError as a, BackupKeyFormatError as c, generateBackupKeyPair as d, parseBackupPublicKey as f, BackupCancelledError as i, BackupKeyMismatchError as l, readBackupEncryptionHeader as m, precheckRestoreKey as n, SystemBackupService as o, parseBackupSecretKey as p, prepareRestoreArchive as r, BackupDecryptError as s, BackupKeyRequiredError as t, ENCRYPTED_BACKUP_SUFFIX as u };