@camstack/system 1.2.381 → 1.2.383

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,3614 +1,9 @@
-import { In as storageOccupancyCapability, Ir as nodePin, Qr as EventCategory, Y as backupCapability, Yr as toNodeId, g as DATABASE_SNAPSHOT_SUFFIX, lr as BaseAddon, nn as mayWriteToLocation } from "../../dist-BC0GnGeg.mjs";
-import { randomBytes, randomUUID } from "node:crypto";
-import { Buffer as Buffer$1 } from "buffer";
+import { $r as toNodeId, Br as nodePin, Ln as storageOccupancyCapability, X as backupCapability, ni as EventCategory, rn as mayWriteToLocation, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
+import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-CZRtI1k9.mjs";
+import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
-import jn from "node:fs/promises";
 import * as path$1 from "node:path";
-import path, { basename, join, posix, win32 } from "node:path";
 import * as fs from "node:fs";
-import Kt from "node:fs";
-import * as zlib from "node:zlib";
-import { EventEmitter } from "node:events";
-import As, { Transform } from "node:stream";
-import { StringDecoder } from "node:string_decoder";
-import I from "fs";
-import qs, { dirname as dirname$1, parse } from "path";
-import * as Ms from "zlib";
-import Jr from "zlib";
-import Pi from "assert";
-import $r, { EventEmitter as EventEmitter$1 } from "events";
-import { pipeline } from "node:stream/promises";
-import no from "node:assert";
-//#region node_modules/tar/dist/esm/index.min.js
-var Mr = Object.defineProperty;
-var Br = (s, t) => {
-	for (var e in t) Mr(s, e, {
-		get: t[e],
-		enumerable: !0
-	});
-};
-var xs = typeof process == "object" && process ? process : {
-	stdout: null,
-	stderr: null
-}, zr = (s) => !!s && typeof s == "object" && (s instanceof A$1 || s instanceof As || Ur(s) || Hr(s)), Ur = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.pipe == "function" && s.pipe !== As.Writable.prototype.pipe, Hr = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.write == "function" && typeof s.end == "function", q = Symbol("EOF"), Q = Symbol("maybeEmitEnd"), rt = Symbol("emittedEnd"), Le = Symbol("emittingEnd"), qt = Symbol("emittedError"), Ne = Symbol("closed"), Ls = Symbol("read"), De = Symbol("flush"), Ns = Symbol("flushChunk"), z = Symbol("encoding"), Mt = Symbol("decoder"), g$1 = Symbol("flowing"), Qt = Symbol("paused"), Bt = Symbol("resume"), b$1 = Symbol("buffer"), D$1 = Symbol("pipes"), _$1 = Symbol("bufferLength"), gi = Symbol("bufferPush"), Ae = Symbol("bufferShift"), L = Symbol("objectMode"), w$1 = Symbol("destroyed"), bi = Symbol("error"), _i = Symbol("emitData"), Ds = Symbol("emitEnd"), Oi = Symbol("emitEnd2"), Z = Symbol("async"), Ti = Symbol("abort"), Ie = Symbol("aborted"), Jt = Symbol("signal"), Rt = Symbol("dataListeners"), F = Symbol("discarded"), jt = (s) => Promise.resolve().then(s), Wr = (s) => s(), Gr = (s) => s === "end" || s === "finish" || s === "prefinish", Zr = (s) => s instanceof ArrayBuffer || !!s && typeof s == "object" && s.constructor && s.constructor.name === "ArrayBuffer" && s.byteLength >= 0, Yr = (s) => !Buffer.isBuffer(s) && ArrayBuffer.isView(s), Fe = class {
-	src;
-	dest;
-	opts;
-	ondrain;
-	constructor(t, e, i) {
-		this.src = t, this.dest = e, this.opts = i, this.ondrain = () => t[Bt](), this.dest.on("drain", this.ondrain);
-	}
-	unpipe() {
-		this.dest.removeListener("drain", this.ondrain);
-	}
-	proxyErrors(t) {}
-	end() {
-		this.unpipe(), this.opts.end && this.dest.end();
-	}
-}, xi = class extends Fe {
-	unpipe() {
-		this.src.removeListener("error", this.proxyErrors), super.unpipe();
-	}
-	constructor(t, e, i) {
-		super(t, e, i), this.proxyErrors = (r) => this.dest.emit("error", r), t.on("error", this.proxyErrors);
-	}
-}, Kr = (s) => !!s.objectMode, Vr = (s) => !s.objectMode && !!s.encoding && s.encoding !== "buffer", A$1 = class extends EventEmitter {
-	[g$1] = !1;
-	[Qt] = !1;
-	[D$1] = [];
-	[b$1] = [];
-	[L];
-	[z];
-	[Z];
-	[Mt];
-	[q] = !1;
-	[rt] = !1;
-	[Le] = !1;
-	[Ne] = !1;
-	[qt] = null;
-	[_$1] = 0;
-	[w$1] = !1;
-	[Jt];
-	[Ie] = !1;
-	[Rt] = 0;
-	[F] = !1;
-	writable = !0;
-	readable = !0;
-	constructor(...t) {
-		let e = t[0] || {};
-		if (super(), e.objectMode && typeof e.encoding == "string") throw new TypeError("Encoding and objectMode may not be used together");
-		Kr(e) ? (this[L] = !0, this[z] = null) : Vr(e) ? (this[z] = e.encoding, this[L] = !1) : (this[L] = !1, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new StringDecoder(this[z]) : null, e && e.debugExposeBuffer === !0 && Object.defineProperty(this, "buffer", { get: () => this[b$1] }), e && e.debugExposePipes === !0 && Object.defineProperty(this, "pipes", { get: () => this[D$1] });
-		let { signal: i } = e;
-		i && (this[Jt] = i, i.aborted ? this[Ti]() : i.addEventListener("abort", () => this[Ti]()));
-	}
-	get bufferLength() {
-		return this[_$1];
-	}
-	get encoding() {
-		return this[z];
-	}
-	set encoding(t) {
-		throw new Error("Encoding must be set at instantiation time");
-	}
-	setEncoding(t) {
-		throw new Error("Encoding must be set at instantiation time");
-	}
-	get objectMode() {
-		return this[L];
-	}
-	set objectMode(t) {
-		throw new Error("objectMode must be set at instantiation time");
-	}
-	get async() {
-		return this[Z];
-	}
-	set async(t) {
-		this[Z] = this[Z] || !!t;
-	}
-	[Ti]() {
-		this[Ie] = !0, this.emit("abort", this[Jt]?.reason), this.destroy(this[Jt]?.reason);
-	}
-	get aborted() {
-		return this[Ie];
-	}
-	set aborted(t) {}
-	write(t, e, i) {
-		if (this[Ie]) return !1;
-		if (this[q]) throw new Error("write after end");
-		if (this[w$1]) return this.emit("error", Object.assign(/* @__PURE__ */ new Error("Cannot call write after a stream was destroyed"), { code: "ERR_STREAM_DESTROYED" })), !0;
-		typeof e == "function" && (i = e, e = "utf8"), e || (e = "utf8");
-		let r = this[Z] ? jt : Wr;
-		if (!this[L] && !Buffer.isBuffer(t)) {
-			if (Yr(t)) t = Buffer.from(t.buffer, t.byteOffset, t.byteLength);
-			else if (Zr(t)) t = Buffer.from(t);
-			else if (typeof t != "string") throw new Error("Non-contiguous data written to non-objectMode stream");
-		}
-		return this[L] ? (this[g$1] && this[_$1] !== 0 && this[De](!0), this[g$1] ? this.emit("data", t) : this[gi](t), this[_$1] !== 0 && this.emit("readable"), i && r(i), this[g$1]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g$1] && this[_$1] !== 0 && this[De](!0), this[g$1] ? this.emit("data", t) : this[gi](t), this[_$1] !== 0 && this.emit("readable"), i && r(i), this[g$1]) : (this[_$1] !== 0 && this.emit("readable"), i && r(i), this[g$1]);
-	}
-	read(t) {
-		if (this[w$1]) return null;
-		if (this[F] = !1, this[_$1] === 0 || t === 0 || t && t > this[_$1]) return this[Q](), null;
-		this[L] && (t = null), this[b$1].length > 1 && !this[L] && (this[b$1] = [this[z] ? this[b$1].join("") : Buffer.concat(this[b$1], this[_$1])]);
-		let e = this[Ls](t || null, this[b$1][0]);
-		return this[Q](), e;
-	}
-	[Ls](t, e) {
-		if (this[L]) this[Ae]();
-		else {
-			let i = e;
-			t === i.length || t === null ? this[Ae]() : typeof i == "string" ? (this[b$1][0] = i.slice(t), e = i.slice(0, t), this[_$1] -= t) : (this[b$1][0] = i.subarray(t), e = i.subarray(0, t), this[_$1] -= t);
-		}
-		return this.emit("data", e), !this[b$1].length && !this[q] && this.emit("drain"), e;
-	}
-	end(t, e, i) {
-		return typeof t == "function" && (i = t, t = void 0), typeof e == "function" && (i = e, e = "utf8"), t !== void 0 && this.write(t, e), i && this.once("end", i), this[q] = !0, this.writable = !1, (this[g$1] || !this[Qt]) && this[Q](), this;
-	}
-	[Bt]() {
-		this[w$1] || (!this[Rt] && !this[D$1].length && (this[F] = !0), this[Qt] = !1, this[g$1] = !0, this.emit("resume"), this[b$1].length ? this[De]() : this[q] ? this[Q]() : this.emit("drain"));
-	}
-	resume() {
-		return this[Bt]();
-	}
-	pause() {
-		this[g$1] = !1, this[Qt] = !0, this[F] = !1;
-	}
-	get destroyed() {
-		return this[w$1];
-	}
-	get flowing() {
-		return this[g$1];
-	}
-	get paused() {
-		return this[Qt];
-	}
-	[gi](t) {
-		this[L] ? this[_$1] += 1 : this[_$1] += t.length, this[b$1].push(t);
-	}
-	[Ae]() {
-		return this[L] ? this[_$1] -= 1 : this[_$1] -= this[b$1][0].length, this[b$1].shift();
-	}
-	[De](t = !1) {
-		do		;
-while (this[Ns](this[Ae]()) && this[b$1].length);
-		!t && !this[b$1].length && !this[q] && this.emit("drain");
-	}
-	[Ns](t) {
-		return this.emit("data", t), this[g$1];
-	}
-	pipe(t, e) {
-		if (this[w$1]) return t;
-		this[F] = !1;
-		let i = this[rt];
-		return e = e || {}, t === xs.stdout || t === xs.stderr ? e.end = !1 : e.end = e.end !== !1, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[D$1].push(e.proxyErrors ? new xi(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
-	}
-	unpipe(t) {
-		let e = this[D$1].find((i) => i.dest === t);
-		e && (this[D$1].length === 1 ? (this[g$1] && this[Rt] === 0 && (this[g$1] = !1), this[D$1] = []) : this[D$1].splice(this[D$1].indexOf(e), 1), e.unpipe());
-	}
-	addListener(t, e) {
-		return this.on(t, e);
-	}
-	on(t, e) {
-		let i = super.on(t, e);
-		if (t === "data") this[F] = !1, this[Rt]++, !this[D$1].length && !this[g$1] && this[Bt]();
-		else if (t === "readable" && this[_$1] !== 0) super.emit("readable");
-		else if (Gr(t) && this[rt]) super.emit(t), this.removeAllListeners(t);
-		else if (t === "error" && this[qt]) {
-			let r = e;
-			this[Z] ? jt(() => r.call(this, this[qt])) : r.call(this, this[qt]);
-		}
-		return i;
-	}
-	removeListener(t, e) {
-		return this.off(t, e);
-	}
-	off(t, e) {
-		let i = super.off(t, e);
-		return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[F] && !this[D$1].length && (this[g$1] = !1)), i;
-	}
-	removeAllListeners(t) {
-		let e = super.removeAllListeners(t);
-		return (t === "data" || t === void 0) && (this[Rt] = 0, !this[F] && !this[D$1].length && (this[g$1] = !1)), e;
-	}
-	get emittedEnd() {
-		return this[rt];
-	}
-	[Q]() {
-		!this[Le] && !this[rt] && !this[w$1] && this[b$1].length === 0 && this[q] && (this[Le] = !0, this.emit("end"), this.emit("prefinish"), this.emit("finish"), this[Ne] && this.emit("close"), this[Le] = !1);
-	}
-	emit(t, ...e) {
-		let i = e[0];
-		if (t !== "error" && t !== "close" && t !== w$1 && this[w$1]) return !1;
-		if (t === "data") return !this[L] && !i ? !1 : this[Z] ? (jt(() => this[_i](i)), !0) : this[_i](i);
-		if (t === "end") return this[Ds]();
-		if (t === "close") {
-			if (this[Ne] = !0, !this[rt] && !this[w$1]) return !1;
-			let n = super.emit("close");
-			return this.removeAllListeners("close"), n;
-		} else if (t === "error") {
-			this[qt] = i, super.emit(bi, i);
-			let n = !this[Jt] || this.listeners("error").length ? super.emit("error", i) : !1;
-			return this[Q](), n;
-		} else if (t === "resume") {
-			let n = super.emit("resume");
-			return this[Q](), n;
-		} else if (t === "finish" || t === "prefinish") {
-			let n = super.emit(t);
-			return this.removeAllListeners(t), n;
-		}
-		let r = super.emit(t, ...e);
-		return this[Q](), r;
-	}
-	[_i](t) {
-		for (let i of this[D$1]) i.dest.write(t) === !1 && this.pause();
-		let e = this[F] ? !1 : super.emit("data", t);
-		return this[Q](), e;
-	}
-	[Ds]() {
-		return this[rt] ? !1 : (this[rt] = !0, this.readable = !1, this[Z] ? (jt(() => this[Oi]()), !0) : this[Oi]());
-	}
-	[Oi]() {
-		if (this[Mt]) {
-			let e = this[Mt].end();
-			if (e) {
-				for (let i of this[D$1]) i.dest.write(e);
-				this[F] || super.emit("data", e);
-			}
-		}
-		for (let e of this[D$1]) e.end();
-		let t = super.emit("end");
-		return this.removeAllListeners("end"), t;
-	}
-	async collect() {
-		let t = Object.assign([], { dataLength: 0 });
-		this[L] || (t.dataLength = 0);
-		let e = this.promise();
-		return this.on("data", (i) => {
-			t.push(i), this[L] || (t.dataLength += i.length);
-		}), await e, t;
-	}
-	async concat() {
-		if (this[L]) throw new Error("cannot concat in objectMode");
-		let t = await this.collect();
-		return this[z] ? t.join("") : Buffer.concat(t, t.dataLength);
-	}
-	async promise() {
-		return new Promise((t, e) => {
-			this.on(w$1, () => e(/* @__PURE__ */ new Error("stream destroyed"))), this.on("error", (i) => e(i)), this.on("end", () => t());
-		});
-	}
-	[Symbol.asyncIterator]() {
-		this[F] = !1;
-		let t = !1, e = async () => (this.pause(), t = !0, {
-			value: void 0,
-			done: !0
-		});
-		return {
-			next: () => {
-				if (t) return e();
-				let r = this.read();
-				if (r !== null) return Promise.resolve({
-					done: !1,
-					value: r
-				});
-				if (this[q]) return e();
-				let n, o, a = (d) => {
-					this.off("data", h), this.off("end", l), this.off(w$1, c), e(), o(d);
-				}, h = (d) => {
-					this.off("error", a), this.off("end", l), this.off(w$1, c), this.pause(), n({
-						value: d,
-						done: !!this[q]
-					});
-				}, l = () => {
-					this.off("error", a), this.off("data", h), this.off(w$1, c), e(), n({
-						done: !0,
-						value: void 0
-					});
-				}, c = () => a(/* @__PURE__ */ new Error("stream destroyed"));
-				return new Promise((d, S) => {
-					o = S, n = d, this.once(w$1, c), this.once("error", a), this.once("end", l), this.once("data", h);
-				});
-			},
-			throw: e,
-			return: e,
-			[Symbol.asyncIterator]() {
-				return this;
-			},
-			[Symbol.asyncDispose]: async () => {}
-		};
-	}
-	[Symbol.iterator]() {
-		this[F] = !1;
-		let t = !1, e = () => (this.pause(), this.off(bi, e), this.off(w$1, e), this.off("end", e), t = !0, {
-			done: !0,
-			value: void 0
-		}), i = () => {
-			if (t) return e();
-			let r = this.read();
-			return r === null ? e() : {
-				done: !1,
-				value: r
-			};
-		};
-		return this.once("end", e), this.once(bi, e), this.once(w$1, e), {
-			next: i,
-			throw: e,
-			return: e,
-			[Symbol.iterator]() {
-				return this;
-			},
-			[Symbol.dispose]: () => {}
-		};
-	}
-	destroy(t) {
-		if (this[w$1]) return t ? this.emit("error", t) : this.emit(w$1), this;
-		this[w$1] = !0, this[F] = !0, this[b$1].length = 0, this[_$1] = 0;
-		let e = this;
-		return typeof e.close == "function" && !this[Ne] && e.close(), t ? this.emit("error", t) : this.emit(w$1), this;
-	}
-	static get isStream() {
-		return zr;
-	}
-};
-var Xr = I.writev, ot = Symbol("_autoClose"), H = Symbol("_close"), te = Symbol("_ended"), m$1 = Symbol("_fd"), Ni = Symbol("_finished"), j = Symbol("_flags"), Di = Symbol("_flush"), Ci = Symbol("_handleChunk"), ki = Symbol("_makeBuf"), ie = Symbol("_mode"), Ce = Symbol("_needDrain"), Ut = Symbol("_onerror"), Ht = Symbol("_onopen"), Ai = Symbol("_onread"), Pt = Symbol("_onwrite"), ht = Symbol("_open"), U = Symbol("_path"), nt = Symbol("_pos"), Y = Symbol("_queue"), zt = Symbol("_read"), Ii = Symbol("_readSize"), J = Symbol("_reading"), ee = Symbol("_remain"), Fi = Symbol("_size"), ke = Symbol("_write"), gt = Symbol("_writing"), ve = Symbol("_defaultFlag"), bt = Symbol("_errored"), _t = class extends A$1 {
-	[bt] = !1;
-	[m$1];
-	[U];
-	[Ii];
-	[J] = !1;
-	[Fi];
-	[ee];
-	[ot];
-	constructor(t, e) {
-		if (e = e || {}, super(e), this.readable = !0, this.writable = !1, typeof t != "string") throw new TypeError("path must be a string");
-		this[bt] = !1, this[m$1] = typeof e.fd == "number" ? e.fd : void 0, this[U] = t, this[Ii] = e.readSize || 16 * 1024 * 1024, this[J] = !1, this[Fi] = typeof e.size == "number" ? e.size : Infinity, this[ee] = this[Fi], this[ot] = typeof e.autoClose == "boolean" ? e.autoClose : !0, typeof this[m$1] == "number" ? this[zt]() : this[ht]();
-	}
-	get fd() {
-		return this[m$1];
-	}
-	get path() {
-		return this[U];
-	}
-	write() {
-		throw new TypeError("this is a readable stream");
-	}
-	end() {
-		throw new TypeError("this is a readable stream");
-	}
-	[ht]() {
-		I.open(this[U], "r", (t, e) => this[Ht](t, e));
-	}
-	[Ht](t, e) {
-		t ? this[Ut](t) : (this[m$1] = e, this.emit("open", e), this[zt]());
-	}
-	[ki]() {
-		return Buffer.allocUnsafe(Math.min(this[Ii], this[ee]));
-	}
-	[zt]() {
-		if (!this[J]) {
-			this[J] = !0;
-			let t = this[ki]();
-			if (t.length === 0) return process.nextTick(() => this[Ai](null, 0, t));
-			I.read(this[m$1], t, 0, t.length, null, (e, i, r) => this[Ai](e, i, r));
-		}
-	}
-	[Ai](t, e, i) {
-		this[J] = !1, t ? this[Ut](t) : this[Ci](e, i) && this[zt]();
-	}
-	[H]() {
-		if (this[ot] && typeof this[m$1] == "number") {
-			let t = this[m$1];
-			this[m$1] = void 0, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
-		}
-	}
-	[Ut](t) {
-		this[J] = !0, this[H](), this.emit("error", t);
-	}
-	[Ci](t, e) {
-		let i = !1;
-		return this[ee] -= t, t > 0 && (i = super.write(t < e.length ? e.subarray(0, t) : e)), (t === 0 || this[ee] <= 0) && (i = !1, this[H](), super.end()), i;
-	}
-	emit(t, ...e) {
-		switch (t) {
-			case "prefinish":
-			case "finish": return !1;
-			case "drain": return typeof this[m$1] == "number" && this[zt](), !1;
-			case "error": return this[bt] ? !1 : (this[bt] = !0, super.emit(t, ...e));
-			default: return super.emit(t, ...e);
-		}
-	}
-}, Me = class extends _t {
-	[ht]() {
-		let t = !0;
-		try {
-			this[Ht](null, I.openSync(this[U], "r")), t = !1;
-		} finally {
-			t && this[H]();
-		}
-	}
-	[zt]() {
-		let t = !0;
-		try {
-			if (!this[J]) {
-				this[J] = !0;
-				do {
-					let e = this[ki](), i = e.length === 0 ? 0 : I.readSync(this[m$1], e, 0, e.length, null);
-					if (!this[Ci](i, e)) break;
-				} while (!0);
-				this[J] = !1;
-			}
-			t = !1;
-		} finally {
-			t && this[H]();
-		}
-	}
-	[H]() {
-		if (this[ot] && typeof this[m$1] == "number") {
-			let t = this[m$1];
-			this[m$1] = void 0, I.closeSync(t), this.emit("close");
-		}
-	}
-}, tt = class extends $r {
-	readable = !1;
-	writable = !0;
-	[bt] = !1;
-	[gt] = !1;
-	[te] = !1;
-	[Y] = [];
-	[Ce] = !1;
-	[U];
-	[ie];
-	[ot];
-	[m$1];
-	[ve];
-	[j];
-	[Ni] = !1;
-	[nt];
-	constructor(t, e) {
-		e = e || {}, super(e), this[U] = t, this[m$1] = typeof e.fd == "number" ? e.fd : void 0, this[ie] = e.mode === void 0 ? 438 : e.mode, this[nt] = typeof e.start == "number" ? e.start : void 0, this[ot] = typeof e.autoClose == "boolean" ? e.autoClose : !0;
-		let i = this[nt] !== void 0 ? "r+" : "w";
-		this[ve] = e.flags === void 0, this[j] = e.flags === void 0 ? i : e.flags, this[m$1] === void 0 && this[ht]();
-	}
-	emit(t, ...e) {
-		if (t === "error") {
-			if (this[bt]) return !1;
-			this[bt] = !0;
-		}
-		return super.emit(t, ...e);
-	}
-	get fd() {
-		return this[m$1];
-	}
-	get path() {
-		return this[U];
-	}
-	[Ut](t) {
-		this[H](), this[gt] = !0, this.emit("error", t);
-	}
-	[ht]() {
-		I.open(this[U], this[j], this[ie], (t, e) => this[Ht](t, e));
-	}
-	[Ht](t, e) {
-		this[ve] && this[j] === "r+" && t && t.code === "ENOENT" ? (this[j] = "w", this[ht]()) : t ? this[Ut](t) : (this[m$1] = e, this.emit("open", e), this[gt] || this[Di]());
-	}
-	end(t, e) {
-		return t && this.write(t, e), this[te] = !0, !this[gt] && !this[Y].length && typeof this[m$1] == "number" && this[Pt](null, 0), this;
-	}
-	write(t, e) {
-		return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", /* @__PURE__ */ new Error("write() after end()")), !1) : this[m$1] === void 0 || this[gt] || this[Y].length ? (this[Y].push(t), this[Ce] = !0, !1) : (this[gt] = !0, this[ke](t), !0);
-	}
-	[ke](t) {
-		I.write(this[m$1], t, 0, t.length, this[nt], (e, i) => this[Pt](e, i));
-	}
-	[Pt](t, e) {
-		t ? this[Ut](t) : (this[nt] !== void 0 && typeof e == "number" && (this[nt] += e), this[Y].length ? this[Di]() : (this[gt] = !1, this[te] && !this[Ni] ? (this[Ni] = !0, this[H](), this.emit("finish")) : this[Ce] && (this[Ce] = !1, this.emit("drain"))));
-	}
-	[Di]() {
-		if (this[Y].length === 0) this[te] && this[Pt](null, 0);
-		else if (this[Y].length === 1) this[ke](this[Y].pop());
-		else {
-			let t = this[Y];
-			this[Y] = [], Xr(this[m$1], t, this[nt], (e, i) => this[Pt](e, i));
-		}
-	}
-	[H]() {
-		if (this[ot] && typeof this[m$1] == "number") {
-			let t = this[m$1];
-			this[m$1] = void 0, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
-		}
-	}
-}, Wt = class extends tt {
-	[ht]() {
-		let t;
-		if (this[ve] && this[j] === "r+") try {
-			t = I.openSync(this[U], this[j], this[ie]);
-		} catch (e) {
-			if (e?.code === "ENOENT") return this[j] = "w", this[ht]();
-			throw e;
-		}
-		else t = I.openSync(this[U], this[j], this[ie]);
-		this[Ht](null, t);
-	}
-	[H]() {
-		if (this[ot] && typeof this[m$1] == "number") {
-			let t = this[m$1];
-			this[m$1] = void 0, I.closeSync(t), this.emit("close");
-		}
-	}
-	[ke](t) {
-		let e = !0;
-		try {
-			this[Pt](null, I.writeSync(this[m$1], t, 0, t.length, this[nt])), e = !1;
-		} finally {
-			if (e) try {
-				this[H]();
-			} catch {}
-		}
-	}
-};
-var qr = new Map([
-	["C", "cwd"],
-	["f", "file"],
-	["z", "gzip"],
-	["P", "preservePaths"],
-	["U", "unlink"],
-	["strip-components", "strip"],
-	["stripComponents", "strip"],
-	["keep-newer", "newer"],
-	["keepNewer", "newer"],
-	["keep-newer-files", "newer"],
-	["keepNewerFiles", "newer"],
-	["k", "keep"],
-	["keep-existing", "keep"],
-	["keepExisting", "keep"],
-	["m", "noMtime"],
-	["no-mtime", "noMtime"],
-	["p", "preserveOwner"],
-	["L", "follow"],
-	["h", "follow"],
-	["onentry", "onReadEntry"]
-]), Is = (s) => !!s.sync && !!s.file, Fs = (s) => !s.sync && !!s.file, Cs = (s) => !!s.sync && !s.file, ks = (s) => !s.sync && !s.file;
-var vs = (s) => !!s.file;
-var Qr = (s) => {
-	return qr.get(s) || s;
-}, se = (s = {}) => {
-	if (!s) return {};
-	let t = {};
-	for (let [e, i] of Object.entries(s)) {
-		let r = Qr(e);
-		t[r] = i;
-	}
-	return t.chmod === void 0 && t.noChmod === !1 && (t.chmod = !0), delete t.noChmod, t;
-};
-var K = (s, t, e, i, r) => Object.assign((n = [], o, a) => {
-	Array.isArray(n) && (o = n, n = {}), typeof o == "function" && (a = o, o = void 0), o = o ? Array.from(o) : [];
-	let h = se(n);
-	if (r?.(h, o), Is(h)) {
-		if (typeof a == "function") throw new TypeError("callback not supported for sync tar functions");
-		return s(h, o);
-	} else if (Fs(h)) {
-		let l = t(h, o);
-		return a ? l.then(() => a(), a) : l;
-	} else if (Cs(h)) {
-		if (typeof a == "function") throw new TypeError("callback not supported for sync tar functions");
-		return e(h, o);
-	} else if (ks(h)) {
-		if (typeof a == "function") throw new TypeError("callback only supported with file option");
-		return i(h, o);
-	}
-	throw new Error("impossible options??");
-}, {
-	syncFile: s,
-	asyncFile: t,
-	syncNoFile: e,
-	asyncNoFile: i,
-	validate: r
-});
-var jr = Jr.constants || { ZLIB_VERNUM: 4736 }, M = Object.freeze(Object.assign(Object.create(null), {
-	Z_NO_FLUSH: 0,
-	Z_PARTIAL_FLUSH: 1,
-	Z_SYNC_FLUSH: 2,
-	Z_FULL_FLUSH: 3,
-	Z_FINISH: 4,
-	Z_BLOCK: 5,
-	Z_OK: 0,
-	Z_STREAM_END: 1,
-	Z_NEED_DICT: 2,
-	Z_ERRNO: -1,
-	Z_STREAM_ERROR: -2,
-	Z_DATA_ERROR: -3,
-	Z_MEM_ERROR: -4,
-	Z_BUF_ERROR: -5,
-	Z_VERSION_ERROR: -6,
-	Z_NO_COMPRESSION: 0,
-	Z_BEST_SPEED: 1,
-	Z_BEST_COMPRESSION: 9,
-	Z_DEFAULT_COMPRESSION: -1,
-	Z_FILTERED: 1,
-	Z_HUFFMAN_ONLY: 2,
-	Z_RLE: 3,
-	Z_FIXED: 4,
-	Z_DEFAULT_STRATEGY: 0,
-	DEFLATE: 1,
-	INFLATE: 2,
-	GZIP: 3,
-	GUNZIP: 4,
-	DEFLATERAW: 5,
-	INFLATERAW: 6,
-	UNZIP: 7,
-	BROTLI_DECODE: 8,
-	BROTLI_ENCODE: 9,
-	Z_MIN_WINDOWBITS: 8,
-	Z_MAX_WINDOWBITS: 15,
-	Z_DEFAULT_WINDOWBITS: 15,
-	Z_MIN_CHUNK: 64,
-	Z_MAX_CHUNK: Infinity,
-	Z_DEFAULT_CHUNK: 16384,
-	Z_MIN_MEMLEVEL: 1,
-	Z_MAX_MEMLEVEL: 9,
-	Z_DEFAULT_MEMLEVEL: 8,
-	Z_MIN_LEVEL: -1,
-	Z_MAX_LEVEL: 9,
-	Z_DEFAULT_LEVEL: -1,
-	BROTLI_OPERATION_PROCESS: 0,
-	BROTLI_OPERATION_FLUSH: 1,
-	BROTLI_OPERATION_FINISH: 2,
-	BROTLI_OPERATION_EMIT_METADATA: 3,
-	BROTLI_MODE_GENERIC: 0,
-	BROTLI_MODE_TEXT: 1,
-	BROTLI_MODE_FONT: 2,
-	BROTLI_DEFAULT_MODE: 0,
-	BROTLI_MIN_QUALITY: 0,
-	BROTLI_MAX_QUALITY: 11,
-	BROTLI_DEFAULT_QUALITY: 11,
-	BROTLI_MIN_WINDOW_BITS: 10,
-	BROTLI_MAX_WINDOW_BITS: 24,
-	BROTLI_LARGE_MAX_WINDOW_BITS: 30,
-	BROTLI_DEFAULT_WINDOW: 22,
-	BROTLI_MIN_INPUT_BLOCK_BITS: 16,
-	BROTLI_MAX_INPUT_BLOCK_BITS: 24,
-	BROTLI_PARAM_MODE: 0,
-	BROTLI_PARAM_QUALITY: 1,
-	BROTLI_PARAM_LGWIN: 2,
-	BROTLI_PARAM_LGBLOCK: 3,
-	BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING: 4,
-	BROTLI_PARAM_SIZE_HINT: 5,
-	BROTLI_PARAM_LARGE_WINDOW: 6,
-	BROTLI_PARAM_NPOSTFIX: 7,
-	BROTLI_PARAM_NDIRECT: 8,
-	BROTLI_DECODER_RESULT_ERROR: 0,
-	BROTLI_DECODER_RESULT_SUCCESS: 1,
-	BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT: 2,
-	BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT: 3,
-	BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION: 0,
-	BROTLI_DECODER_PARAM_LARGE_WINDOW: 1,
-	BROTLI_DECODER_NO_ERROR: 0,
-	BROTLI_DECODER_SUCCESS: 1,
-	BROTLI_DECODER_NEEDS_MORE_INPUT: 2,
-	BROTLI_DECODER_NEEDS_MORE_OUTPUT: 3,
-	BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE: -1,
-	BROTLI_DECODER_ERROR_FORMAT_RESERVED: -2,
-	BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE: -3,
-	BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET: -4,
-	BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME: -5,
-	BROTLI_DECODER_ERROR_FORMAT_CL_SPACE: -6,
-	BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE: -7,
-	BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT: -8,
-	BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1: -9,
-	BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2: -10,
-	BROTLI_DECODER_ERROR_FORMAT_TRANSFORM: -11,
-	BROTLI_DECODER_ERROR_FORMAT_DICTIONARY: -12,
-	BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS: -13,
-	BROTLI_DECODER_ERROR_FORMAT_PADDING_1: -14,
-	BROTLI_DECODER_ERROR_FORMAT_PADDING_2: -15,
-	BROTLI_DECODER_ERROR_FORMAT_DISTANCE: -16,
-	BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET: -19,
-	BROTLI_DECODER_ERROR_INVALID_ARGUMENTS: -20,
-	BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES: -21,
-	BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS: -22,
-	BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP: -25,
-	BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1: -26,
-	BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2: -27,
-	BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES: -30,
-	BROTLI_DECODER_ERROR_UNREACHABLE: -31
-}, jr));
-var tn = Buffer$1.concat, Bs = Object.getOwnPropertyDescriptor(Buffer$1, "concat"), en = (s) => s, Mi = Bs?.writable === !0 || Bs?.set !== void 0 ? (s) => {
-	Buffer$1.concat = s ? en : tn;
-} : (s) => {}, Tt = Symbol("_superWrite"), Gt = class extends Error {
-	code;
-	errno;
-	constructor(t, e) {
-		super("zlib: " + t.message, { cause: t }), this.code = t.code, this.errno = t.errno, this.code || (this.code = "ZLIB_ERROR"), this.message = "zlib: " + t.message, Error.captureStackTrace(this, e ?? this.constructor);
-	}
-	get name() {
-		return "ZlibError";
-	}
-}, Bi = Symbol("flushFlag"), re = class extends A$1 {
-	#t = !1;
-	#i = !1;
-	#s;
-	#n;
-	#r;
-	#e;
-	#o;
-	get sawError() {
-		return this.#t;
-	}
-	get handle() {
-		return this.#e;
-	}
-	get flushFlag() {
-		return this.#s;
-	}
-	constructor(t, e) {
-		if (!t || typeof t != "object") throw new TypeError("invalid options for ZlibBase constructor");
-		if (super(t), this.#s = t.flush ?? 0, this.#n = t.finishFlush ?? 0, this.#r = t.fullFlushFlag ?? 0, typeof Ms[e] != "function") throw new TypeError("Compression method not supported: " + e);
-		try {
-			this.#e = new Ms[e](t);
-		} catch (i) {
-			throw new Gt(i, this.constructor);
-		}
-		this.#o = (i) => {
-			this.#t || (this.#t = !0, this.close(), this.emit("error", i));
-		}, this.#e?.on("error", (i) => this.#o(new Gt(i))), this.once("end", () => this.close);
-	}
-	close() {
-		this.#e && (this.#e.close(), this.#e = void 0, this.emit("close"));
-	}
-	reset() {
-		if (!this.#t) return Pi(this.#e, "zlib binding closed"), this.#e.reset?.();
-	}
-	flush(t) {
-		this.ended || (typeof t != "number" && (t = this.#r), this.write(Object.assign(Buffer$1.alloc(0), { [Bi]: t })));
-	}
-	end(t, e, i) {
-		return typeof t == "function" && (i = t, e = void 0, t = void 0), typeof e == "function" && (i = e, e = void 0), t && (e ? this.write(t, e) : this.write(t)), this.flush(this.#n), this.#i = !0, super.end(i);
-	}
-	get ended() {
-		return this.#i;
-	}
-	[Tt](t) {
-		return super.write(t);
-	}
-	write(t, e, i) {
-		if (typeof e == "function" && (i = e, e = "utf8"), typeof t == "string" && (t = Buffer$1.from(t, e)), this.#t) return;
-		Pi(this.#e, "zlib binding closed");
-		let r = this.#e._handle, n = r.close;
-		r.close = () => {};
-		let o = this.#e.close;
-		this.#e.close = () => {}, Mi(!0);
-		let a;
-		try {
-			let l = typeof t[Bi] == "number" ? t[Bi] : this.#s;
-			a = this.#e._processChunk(t, l), Mi(!1);
-		} catch (l) {
-			Mi(!1), this.#o(new Gt(l, this.write));
-		} finally {
-			this.#e && (this.#e._handle = r, r.close = n, this.#e.close = o, this.#e.removeAllListeners("error"));
-		}
-		this.#e && this.#e.on("error", (l) => this.#o(new Gt(l, this.write)));
-		let h;
-		if (a) if (Array.isArray(a) && a.length > 0) {
-			let l = a[0];
-			h = this[Tt](Buffer$1.from(l));
-			for (let c = 1; c < a.length; c++) h = this[Tt](a[c]);
-		} else h = this[Tt](Buffer$1.from(a));
-		return i && i(), h;
-	}
-}, Be = class extends re {
-	#t;
-	#i;
-	constructor(t, e) {
-		t = t || {}, t.flush = t.flush || M.Z_NO_FLUSH, t.finishFlush = t.finishFlush || M.Z_FINISH, t.fullFlushFlag = M.Z_FULL_FLUSH, super(t, e), this.#t = t.level, this.#i = t.strategy;
-	}
-	params(t, e) {
-		if (!this.sawError) {
-			if (!this.handle) throw new Error("cannot switch params when binding is closed");
-			if (!this.handle.params) throw new Error("not supported in this implementation");
-			if (this.#t !== t || this.#i !== e) {
-				this.flush(M.Z_SYNC_FLUSH), Pi(this.handle, "zlib binding closed");
-				let i = this.handle.flush;
-				this.handle.flush = (r, n) => {
-					typeof r == "function" && (n = r, r = this.flushFlag), this.flush(r), n?.();
-				};
-				try {
-					this.handle.params(t, e);
-				} finally {
-					this.handle.flush = i;
-				}
-				this.handle && (this.#t = t, this.#i = e);
-			}
-		}
-	}
-};
-var Pe = class extends Be {
-	#t;
-	constructor(t) {
-		super(t, "Gzip"), this.#t = t && !!t.portable;
-	}
-	[Tt](t) {
-		return this.#t ? (this.#t = !1, t[9] = 255, super[Tt](t)) : super[Tt](t);
-	}
-};
-var ze = class extends Be {
-	constructor(t) {
-		super(t, "Unzip");
-	}
-}, Ue = class extends re {
-	constructor(t, e) {
-		t = t || {}, t.flush = t.flush || M.BROTLI_OPERATION_PROCESS, t.finishFlush = t.finishFlush || M.BROTLI_OPERATION_FINISH, t.fullFlushFlag = M.BROTLI_OPERATION_FLUSH, super(t, e);
-	}
-}, He = class extends Ue {
-	constructor(t) {
-		super(t, "BrotliCompress");
-	}
-}, We = class extends Ue {
-	constructor(t) {
-		super(t, "BrotliDecompress");
-	}
-}, Ge = class extends re {
-	constructor(t, e) {
-		t = t || {}, t.flush = t.flush || M.ZSTD_e_continue, t.finishFlush = t.finishFlush || M.ZSTD_e_end, t.fullFlushFlag = M.ZSTD_e_flush, super(t, e);
-	}
-}, Ze = class extends Ge {
-	constructor(t) {
-		super(t, "ZstdCompress");
-	}
-}, Ye = class extends Ge {
-	constructor(t) {
-		super(t, "ZstdDecompress");
-	}
-};
-var Ps = (s, t) => {
-	if (Number.isSafeInteger(s)) s < 0 ? nn(s, t) : rn(s, t);
-	else throw Error("cannot encode number outside of javascript safe integer range");
-	return t;
-}, rn = (s, t) => {
-	t[0] = 128;
-	for (var e = t.length; e > 1; e--) t[e - 1] = s & 255, s = Math.floor(s / 256);
-}, nn = (s, t) => {
-	t[0] = 255;
-	var e = !1;
-	s = s * -1;
-	for (var i = t.length; i > 1; i--) {
-		var r = s & 255;
-		s = Math.floor(s / 256), e ? t[i - 1] = Us(r) : r === 0 ? t[i - 1] = 0 : (e = !0, t[i - 1] = Hs(r));
-	}
-}, zs = (s) => {
-	let t = s[0], e = t === 128 ? hn(s.subarray(1, s.length)) : t === 255 ? on(s) : null;
-	if (e === null) throw Error("invalid base256 encoding");
-	if (!Number.isSafeInteger(e)) throw Error("parsed number outside of javascript safe integer range");
-	return e;
-}, on = (s) => {
-	for (var t = s.length, e = 0, i = !1, r = t - 1; r > -1; r--) {
-		var n = Number(s[r]), o;
-		i ? o = Us(n) : n === 0 ? o = n : (i = !0, o = Hs(n)), o !== 0 && (e -= o * Math.pow(256, t - r - 1));
-	}
-	return e;
-}, hn = (s) => {
-	for (var t = s.length, e = 0, i = t - 1; i > -1; i--) {
-		var r = Number(s[i]);
-		r !== 0 && (e += r * Math.pow(256, t - i - 1));
-	}
-	return e;
-}, Us = (s) => (255 ^ s) & 255, Hs = (s) => (255 ^ s) + 1 & 255;
-Br({}, {
-	code: () => Ke,
-	isCode: () => ne,
-	isName: () => ln,
-	name: () => oe,
-	normalFsTypes: () => zi
-});
-var ne = (s) => oe.has(s), ln = (s) => Ke.has(s), zi = new Set([
-	"0",
-	"",
-	"1",
-	"2",
-	"3",
-	"4",
-	"5",
-	"6",
-	"7",
-	"D"
-]), oe = new Map([
-	["0", "File"],
-	["", "OldFile"],
-	["1", "Link"],
-	["2", "SymbolicLink"],
-	["3", "CharacterDevice"],
-	["4", "BlockDevice"],
-	["5", "Directory"],
-	["6", "FIFO"],
-	["7", "ContiguousFile"],
-	["g", "GlobalExtendedHeader"],
-	["x", "ExtendedHeader"],
-	["A", "SolarisACL"],
-	["D", "GNUDumpDir"],
-	["I", "Inode"],
-	["K", "NextFileHasLongLinkpath"],
-	["L", "NextFileHasLongPath"],
-	["M", "ContinuationFile"],
-	["N", "OldGnuLongPath"],
-	["S", "SparseFile"],
-	["V", "TapeVolumeHeader"],
-	["X", "OldExtendedHeader"]
-]), Ke = new Map(Array.from(oe).map((s) => [s[1], s[0]]));
-var C$1 = class {
-	cksumValid = !1;
-	needPax = !1;
-	nullBlock = !1;
-	block;
-	path;
-	mode;
-	uid;
-	gid;
-	size;
-	cksum;
-	#t = "Unsupported";
-	linkpath;
-	uname;
-	gname;
-	devmaj = 0;
-	devmin = 0;
-	atime;
-	ctime;
-	mtime;
-	charset;
-	comment;
-	constructor(t, e = 0, i, r) {
-		Buffer.isBuffer(t) ? this.decode(t, e || 0, i, r) : t && this.#i(t);
-	}
-	decode(t, e, i, r) {
-		if (e || (e = 0), !t || !(t.length >= e + 512)) throw new Error("need 512 bytes for header");
-		let n = xt(t, e + 156, 1), o = zi.has(n), a = o ? i : void 0, h = o ? r : void 0;
-		if (this.path = a?.path ?? xt(t, e, 100), this.mode = a?.mode ?? h?.mode ?? at(t, e + 100, 8), this.uid = a?.uid ?? h?.uid ?? at(t, e + 108, 8), this.gid = a?.gid ?? h?.gid ?? at(t, e + 116, 8), this.size = a?.size ?? h?.size ?? at(t, e + 124, 12), this.mtime = a?.mtime ?? h?.mtime ?? Hi(t, e + 136, 12), this.cksum = at(t, e + 148, 12), h && this.#i(h, !0), a && this.#i(a), ne(n) && (this.#t = n || "0"), this.#t === "0" && this.path.slice(-1) === "/" && (this.#t = "5"), this.#t === "5" && (this.size = 0), this.linkpath = xt(t, e + 157, 100), t.subarray(e + 257, e + 265).toString() === "ustar\x0000") if (this.uname = a?.uname ?? h?.uname ?? xt(t, e + 265, 32), this.gname = a?.gname ?? h?.gname ?? xt(t, e + 297, 32), this.devmaj = a?.devmaj ?? h?.devmaj ?? at(t, e + 329, 8) ?? 0, this.devmin = a?.devmin ?? h?.devmin ?? at(t, e + 337, 8) ?? 0, t[e + 475] !== 0) {
-			let c = xt(t, e + 345, 155);
-			this.path = c + "/" + this.path;
-		} else {
-			let c = xt(t, e + 345, 130);
-			c && (this.path = c + "/" + this.path), this.atime = i?.atime ?? r?.atime ?? Hi(t, e + 476, 12), this.ctime = i?.ctime ?? r?.ctime ?? Hi(t, e + 488, 12);
-		}
-		let l = 256;
-		for (let c = e; c < e + 148; c++) l += t[c];
-		for (let c = e + 156; c < e + 512; c++) l += t[c];
-		this.cksumValid = l === this.cksum, this.cksum === void 0 && l === 256 && (this.nullBlock = !0);
-	}
-	#i(t, e = !1) {
-		Object.assign(this, Object.fromEntries(Object.entries(t).filter(([i, r]) => !(r == null || i === "path" && e || i === "linkpath" && e || i === "global"))));
-	}
-	encode(t, e = 0) {
-		if (t || (t = this.block = Buffer.alloc(512)), this.#t === "Unsupported" && (this.#t = "0"), !(t.length >= e + 512)) throw new Error("need 512 bytes for header");
-		let i = this.ctime || this.atime ? 130 : 155, r = cn(this.path || "", i), n = r[0], o = r[1];
-		this.needPax = !!r[2], this.needPax = Lt(t, e, 100, n) || this.needPax, this.needPax = lt(t, e + 100, 8, this.mode) || this.needPax, this.needPax = lt(t, e + 108, 8, this.uid) || this.needPax, this.needPax = lt(t, e + 116, 8, this.gid) || this.needPax, this.needPax = lt(t, e + 124, 12, this.size) || this.needPax, this.needPax = Wi(t, e + 136, 12, this.mtime) || this.needPax, t[e + 156] = Number(this.#t.codePointAt(0)), this.needPax = Lt(t, e + 157, 100, this.linkpath) || this.needPax, t.write("ustar\x0000", e + 257, 8), this.needPax = Lt(t, e + 265, 32, this.uname) || this.needPax, this.needPax = Lt(t, e + 297, 32, this.gname) || this.needPax, this.needPax = lt(t, e + 329, 8, this.devmaj) || this.needPax, this.needPax = lt(t, e + 337, 8, this.devmin) || this.needPax, this.needPax = Lt(t, e + 345, i, o) || this.needPax, t[e + 475] !== 0 ? this.needPax = Lt(t, e + 345, 155, o) || this.needPax : (this.needPax = Lt(t, e + 345, 130, o) || this.needPax, this.needPax = Wi(t, e + 476, 12, this.atime) || this.needPax, this.needPax = Wi(t, e + 488, 12, this.ctime) || this.needPax);
-		let a = 256;
-		for (let h = e; h < e + 148; h++) a += t[h];
-		for (let h = e + 156; h < e + 512; h++) a += t[h];
-		return this.cksum = a, lt(t, e + 148, 8, this.cksum), this.cksumValid = !0, this.needPax;
-	}
-	get type() {
-		return this.#t === "Unsupported" ? this.#t : oe.get(this.#t);
-	}
-	get typeKey() {
-		return this.#t;
-	}
-	set type(t) {
-		let e = String(Ke.get(t));
-		if (ne(e) || e === "Unsupported") this.#t = e;
-		else if (ne(t)) this.#t = t;
-		else throw new TypeError("invalid entry type: " + t);
-	}
-}, cn = (s, t) => {
-	let i = s, r = "", n, o = posix.parse(s).root || ".";
-	if (Buffer.byteLength(i) < 100) n = [
-		i,
-		r,
-		!1
-	];
-	else {
-		r = posix.dirname(i), i = posix.basename(i);
-		do
-			Buffer.byteLength(i) <= 100 && Buffer.byteLength(r) <= t ? n = [
-				i,
-				r,
-				!1
-			] : Buffer.byteLength(i) > 100 && Buffer.byteLength(r) <= t ? n = [
-				i.slice(0, 99),
-				r,
-				!0
-			] : (i = posix.join(posix.basename(r), i), r = posix.dirname(r));
-		while (r !== o && n === void 0);
-		n || (n = [
-			s.slice(0, 99),
-			"",
-			!0
-		]);
-	}
-	return n;
-}, xt = (s, t, e) => s.subarray(t, t + e).toString("utf8").replace(/\0.*/, ""), Hi = (s, t, e) => fn(at(s, t, e)), fn = (s) => s === void 0 ? void 0 : /* @__PURE__ */ new Date(s * 1e3), at = (s, t, e) => Number(s[t]) & 128 ? zs(s.subarray(t, t + e)) : un(s, t, e), dn = (s) => isNaN(s) ? void 0 : s, un = (s, t, e) => dn(parseInt(s.subarray(t, t + e).toString("utf8").replace(/\0.*$/, "").trim(), 8)), mn = {
-	12: 8589934591,
-	8: 2097151
-}, lt = (s, t, e, i) => i === void 0 ? !1 : i > mn[e] || i < 0 ? (Ps(i, s.subarray(t, t + e)), !0) : (pn(s, t, e, i), !1), pn = (s, t, e, i) => s.write(En(i, e), t, e, "ascii"), En = (s, t) => wn(Math.floor(s).toString(8), t), wn = (s, t) => (s.length === t - 1 ? s : new Array(t - s.length - 1).join("0") + s + " ") + "\0", Wi = (s, t, e, i) => i === void 0 ? !1 : lt(s, t, e, i.getTime() / 1e3), Sn = new Array(156).join("\0"), Lt = (s, t, e, i) => i === void 0 ? !1 : (s.write(i + Sn, t, e, "utf8"), i.length !== Buffer.byteLength(i) || i.length > e);
-var ct = class s {
-	atime;
-	mtime;
-	ctime;
-	charset;
-	comment;
-	gid;
-	uid;
-	gname;
-	uname;
-	linkpath;
-	dev;
-	ino;
-	nlink;
-	path;
-	size;
-	mode;
-	global;
-	constructor(t, e = !1) {
-		this.atime = t.atime, this.charset = t.charset, this.comment = t.comment, this.ctime = t.ctime, this.dev = t.dev, this.gid = t.gid, this.global = e, this.gname = t.gname, this.ino = t.ino, this.linkpath = t.linkpath, this.mtime = t.mtime, this.nlink = t.nlink, this.path = t.path, this.size = t.size, this.uid = t.uid, this.uname = t.uname;
-	}
-	encode() {
-		let t = this.encodeBody();
-		if (t === "") return Buffer.allocUnsafe(0);
-		let e = Buffer.byteLength(t), i = 512 * Math.ceil(1 + e / 512), r = Buffer.allocUnsafe(i);
-		for (let n = 0; n < 512; n++) r[n] = 0;
-		new C$1({
-			path: ("PaxHeader/" + basename(this.path ?? "")).slice(0, 99),
-			mode: this.mode || 420,
-			uid: this.uid,
-			gid: this.gid,
-			size: e,
-			mtime: this.mtime,
-			type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader",
-			linkpath: "",
-			uname: this.uname || "",
-			gname: this.gname || "",
-			devmaj: 0,
-			devmin: 0,
-			atime: this.atime,
-			ctime: this.ctime
-		}).encode(r), r.write(t, 512, e, "utf8");
-		for (let n = e + 512; n < r.length; n++) r[n] = 0;
-		return r;
-	}
-	encodeBody() {
-		return this.encodeField("path") + this.encodeField("ctime") + this.encodeField("atime") + this.encodeField("dev") + this.encodeField("ino") + this.encodeField("nlink") + this.encodeField("charset") + this.encodeField("comment") + this.encodeField("gid") + this.encodeField("gname") + this.encodeField("linkpath") + this.encodeField("mtime") + this.encodeField("size") + this.encodeField("uid") + this.encodeField("uname");
-	}
-	encodeField(t) {
-		if (this[t] === void 0) return "";
-		let e = this[t], i = e instanceof Date ? e.getTime() / 1e3 : e, r = " " + (t === "dev" || t === "ino" || t === "nlink" ? "SCHILY." : "") + t + "=" + i + `
-`, n = Buffer.byteLength(r), o = Math.floor(Math.log(n) / Math.log(10)) + 1;
-		return n + o >= Math.pow(10, o) && (o += 1), o + n + r;
-	}
-	static parse(t, e, i = !1) {
-		return new s(Rn(gn(t), e), i);
-	}
-}, Rn = (s, t) => t ? Object.assign({}, t, s) : s, gn = (s) => s.replace(/\n$/, "").split(`
-`).reduce(bn, Object.create(null)), bn = (s, t) => {
-	let e = parseInt(t, 10);
-	if (e !== Buffer.byteLength(t) + 1) return s;
-	t = t.slice((e + " ").length);
-	let i = t.split("="), r = i.shift();
-	if (!r) return s;
-	let n = r.replace(/^SCHILY\.(dev|ino|nlink)/, "$1"), o = i.join("=");
-	return s[n] = /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(n) ? /* @__PURE__ */ new Date(Number(o) * 1e3) : /^[0-9]+$/.test(o) ? +o : o, s;
-};
-var f$1 = (process.env.TESTING_TAR_FAKE_PLATFORM || process.platform) !== "win32" ? (s) => s : (s) => s && s.replaceAll(/\\/g, "/");
-var Ve = class extends A$1 {
-	extended;
-	globalExtended;
-	header;
-	startBlockSize;
-	blockRemain;
-	remain;
-	type;
-	meta = !1;
-	ignore = !1;
-	path;
-	mode;
-	uid;
-	gid;
-	uname;
-	gname;
-	size = 0;
-	mtime;
-	atime;
-	ctime;
-	linkpath;
-	dev;
-	ino;
-	nlink;
-	invalid = !1;
-	absolute;
-	unsupported = !1;
-	constructor(t, e, i) {
-		switch (super({}), this.pause(), this.extended = e, this.globalExtended = i, this.header = t, this.remain = t.size ?? 0, this.startBlockSize = 512 * Math.ceil(this.remain / 512), this.blockRemain = this.startBlockSize, this.type = t.type, this.type) {
-			case "File":
-			case "OldFile":
-			case "Link":
-			case "SymbolicLink":
-			case "CharacterDevice":
-			case "BlockDevice":
-			case "Directory":
-			case "FIFO":
-			case "ContiguousFile":
-			case "GNUDumpDir": break;
-			case "NextFileHasLongLinkpath":
-			case "NextFileHasLongPath":
-			case "OldGnuLongPath":
-			case "GlobalExtendedHeader":
-			case "ExtendedHeader":
-			case "OldExtendedHeader":
-				this.meta = !0;
-				break;
-			default: this.ignore = !0;
-		}
-		if (!t.path) throw new Error("no path provided for tar.ReadEntry");
-		this.path = f$1(t.path), this.mode = t.mode, this.mode && (this.mode = this.mode & 4095), this.uid = t.uid, this.gid = t.gid, this.uname = t.uname, this.gname = t.gname, this.size = this.remain, this.mtime = t.mtime, this.atime = t.atime, this.ctime = t.ctime, this.linkpath = t.linkpath ? f$1(t.linkpath) : void 0, this.uname = t.uname, this.gname = t.gname, e && this.#t(e), i && this.#t(i, !0);
-	}
-	write(t) {
-		let e = t.length;
-		if (e > this.blockRemain) throw new Error("writing more to entry than is appropriate");
-		let i = this.remain, r = this.blockRemain;
-		return this.remain = Math.max(0, i - e), this.blockRemain = Math.max(0, r - e), this.ignore ? !0 : i >= e ? super.write(t) : super.write(t.subarray(0, i));
-	}
-	#t(t, e = !1) {
-		t.path && (t.path = f$1(t.path)), t.linkpath && (t.linkpath = f$1(t.linkpath)), Object.assign(this, Object.fromEntries(Object.entries(t).filter(([i, r]) => !(r == null || i === "path" && e))));
-	}
-};
-var Nt = (s, t, e, i = {}) => {
-	s.file && (i.file = s.file), s.cwd && (i.cwd = s.cwd), i.code = e instanceof Error && e.code || t, i.tarCode = t, !s.strict && i.recoverable !== !1 ? (e instanceof Error && (i = Object.assign(e, i), e = e.message), s.emit("warn", t, e, i)) : e instanceof Error ? s.emit("error", Object.assign(e, i)) : s.emit("error", Object.assign(/* @__PURE__ */ new Error(`${t}: ${e}`), i));
-};
-var Tn = 1024 * 1024, Vi = Buffer.from([31, 139]), $i = Buffer.from([
-	40,
-	181,
-	47,
-	253
-]), xn = Math.max(Vi.length, $i.length), B = Symbol("state"), Dt = Symbol("writeEntry"), et = Symbol("readEntry"), Gi = Symbol("nextEntry"), Ws = Symbol("processEntry"), V = Symbol("extendedHeader"), he = Symbol("globalExtendedHeader"), ft = Symbol("meta"), Gs = Symbol("emitMeta"), p$1 = Symbol("buffer"), it = Symbol("queue"), dt = Symbol("ended"), Zi = Symbol("emittedEnd"), At = Symbol("emit"), y = Symbol("unzip"), $e = Symbol("consumeChunk"), Xe = Symbol("consumeChunkSub"), Yi = Symbol("consumeBody"), Zs = Symbol("consumeMeta"), Ys = Symbol("consumeHeader"), ae = Symbol("consuming"), Ki = Symbol("bufferConcat"), qe = Symbol("maybeEnd"), Yt = Symbol("writing"), ut = Symbol("aborted"), Qe = Symbol("onDone"), It = Symbol("sawValidEntry"), Je = Symbol("sawNullBlock"), je = Symbol("sawEOF"), Ks = Symbol("closeStream"), Ln = () => !0, st = class extends EventEmitter$1 {
-	file;
-	strict;
-	maxMetaEntrySize;
-	filter;
-	brotli;
-	zstd;
-	writable = !0;
-	readable = !1;
-	[it] = [];
-	[p$1];
-	[et];
-	[Dt];
-	[B] = "begin";
-	[ft] = "";
-	[V];
-	[he];
-	[dt] = !1;
-	[y];
-	[ut] = !1;
-	[It];
-	[Je] = !1;
-	[je] = !1;
-	[Yt] = !1;
-	[ae] = !1;
-	[Zi] = !1;
-	constructor(t = {}) {
-		super(), this.file = t.file || "", this.on(Qe, () => {
-			(this[B] === "begin" || this[It] === !1) && this.warn("TAR_BAD_ARCHIVE", "Unrecognized archive format");
-		}), t.ondone ? this.on(Qe, t.ondone) : this.on(Qe, () => {
-			this.emit("prefinish"), this.emit("finish"), this.emit("end");
-		}), this.strict = !!t.strict, this.maxMetaEntrySize = t.maxMetaEntrySize || Tn, this.filter = typeof t.filter == "function" ? t.filter : Ln;
-		let e = t.file && (t.file.endsWith(".tar.br") || t.file.endsWith(".tbr"));
-		this.brotli = !(t.gzip || t.zstd) && t.brotli !== void 0 ? t.brotli : e ? void 0 : !1;
-		let i = t.file && (t.file.endsWith(".tar.zst") || t.file.endsWith(".tzst"));
-		this.zstd = !(t.gzip || t.brotli) && t.zstd !== void 0 ? t.zstd : i ? !0 : void 0, this.on("end", () => this[Ks]()), typeof t.onwarn == "function" && this.on("warn", t.onwarn), typeof t.onReadEntry == "function" && this.on("entry", t.onReadEntry);
-	}
-	warn(t, e, i = {}) {
-		Nt(this, t, e, i);
-	}
-	[Ys](t, e) {
-		this[It] === void 0 && (this[It] = !1);
-		let i;
-		try {
-			i = new C$1(t, e, this[V], this[he]);
-		} catch (r) {
-			return this.warn("TAR_ENTRY_INVALID", r);
-		}
-		if (i.nullBlock) this[Je] ? (this[je] = !0, this[B] === "begin" && (this[B] = "header"), this[At]("eof")) : (this[Je] = !0, this[At]("nullBlock"));
-		else if (this[Je] = !1, !i.cksumValid) this.warn("TAR_ENTRY_INVALID", "checksum failure", { header: i });
-		else if (!i.path) this.warn("TAR_ENTRY_INVALID", "path is required", { header: i });
-		else {
-			let r = i.type;
-			if (/^(Symbolic)?Link$/.test(r) && !i.linkpath) this.warn("TAR_ENTRY_INVALID", "linkpath required", { header: i });
-			else if (!/^(Symbolic)?Link$/.test(r) && !/^(Global)?ExtendedHeader$/.test(r) && i.linkpath) this.warn("TAR_ENTRY_INVALID", "linkpath forbidden", { header: i });
-			else {
-				let n = this[Dt] = new Ve(i, this[V], this[he]);
-				if (!this[It]) if (n.remain) {
-					let o = () => {
-						n.invalid || (this[It] = !0);
-					};
-					n.on("end", o);
-				} else this[It] = !0;
-				n.meta ? n.size > this.maxMetaEntrySize ? (n.ignore = !0, this[At]("ignoredEntry", n), this[B] = "ignore", n.resume()) : n.size > 0 && (this[ft] = "", n.on("data", (o) => this[ft] += o), this[B] = "meta") : (this[V] = void 0, n.ignore = n.ignore || !this.filter(n.path, n), n.ignore ? (this[At]("ignoredEntry", n), this[B] = n.remain ? "ignore" : "header", n.resume()) : (n.remain ? this[B] = "body" : (this[B] = "header", n.end()), this[et] ? this[it].push(n) : (this[it].push(n), this[Gi]())));
-			}
-		}
-	}
-	[Ks]() {
-		queueMicrotask(() => this.emit("close"));
-	}
-	[Ws](t) {
-		let e = !0;
-		if (!t) this[et] = void 0, e = !1;
-		else if (Array.isArray(t)) {
-			let [i, ...r] = t;
-			this.emit(i, ...r);
-		} else this[et] = t, this.emit("entry", t), t.emittedEnd || (t.on("end", () => this[Gi]()), e = !1);
-		return e;
-	}
-	[Gi]() {
-		do		;
-while (this[Ws](this[it].shift()));
-		if (this[it].length === 0) {
-			let t = this[et];
-			!t || t.flowing || t.size === t.remain ? this[Yt] || this.emit("drain") : t.once("drain", () => this.emit("drain"));
-		}
-	}
-	[Yi](t, e) {
-		let i = this[Dt];
-		if (!i) throw new Error("attempt to consume body without entry??");
-		let r = i.blockRemain ?? 0, n = r >= t.length && e === 0 ? t : t.subarray(e, e + r);
-		return i.write(n), i.blockRemain || (this[B] = "header", this[Dt] = void 0, i.end()), n.length;
-	}
-	[Zs](t, e) {
-		let i = this[Dt], r = this[Yi](t, e);
-		return !this[Dt] && i && this[Gs](i), r;
-	}
-	[At](t, e, i) {
-		this[it].length === 0 && !this[et] ? this.emit(t, e, i) : this[it].push([
-			t,
-			e,
-			i
-		]);
-	}
-	[Gs](t) {
-		switch (this[At]("meta", this[ft]), t.type) {
-			case "ExtendedHeader":
-			case "OldExtendedHeader":
-				this[V] = ct.parse(this[ft], this[V], !1);
-				break;
-			case "GlobalExtendedHeader":
-				this[he] = ct.parse(this[ft], this[he], !0);
-				break;
-			case "NextFileHasLongPath":
-			case "OldGnuLongPath": {
-				let e = this[V] ?? Object.create(null);
-				this[V] = e, e.path = this[ft].replace(/\0.*/, "");
-				break;
-			}
-			case "NextFileHasLongLinkpath": {
-				let e = this[V] || Object.create(null);
-				this[V] = e, e.linkpath = this[ft].replace(/\0.*/, "");
-				break;
-			}
-			default: throw new Error("unknown meta: " + t.type);
-		}
-	}
-	abort(t) {
-		this[ut] = !0, this.emit("abort", t), this.warn("TAR_ABORT", t, { recoverable: !1 });
-	}
-	write(t, e, i) {
-		if (typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, typeof e == "string" ? e : "utf8")), this[ut]) return i?.(), !1;
-		if ((this[y] === void 0 || this.brotli === void 0 && this[y] === !1) && t) {
-			if (this[p$1] && (t = Buffer.concat([this[p$1], t]), this[p$1] = void 0), t.length < xn) return this[p$1] = t, i?.(), !0;
-			for (let h = 0; this[y] === void 0 && h < Vi.length; h++) t[h] !== Vi[h] && (this[y] = !1);
-			let o = !1;
-			if (this[y] === !1 && this.zstd !== !1) {
-				o = !0;
-				for (let h = 0; h < $i.length; h++) if (t[h] !== $i[h]) {
-					o = !1;
-					break;
-				}
-			}
-			let a = this.brotli === void 0 && !o;
-			if (this[y] === !1 && a) if (t.length < 512) if (this[dt]) this.brotli = !0;
-			else return this[p$1] = t, i?.(), !0;
-			else try {
-				new C$1(t.subarray(0, 512)), this.brotli = !1;
-			} catch {
-				this.brotli = !0;
-			}
-			if (this[y] === void 0 || this[y] === !1 && (this.brotli || o)) {
-				let h = this[dt];
-				this[dt] = !1, this[y] = this[y] === void 0 ? new ze({}) : o ? new Ye({}) : new We({}), this[y].on("data", (c) => this[$e](c)), this[y].on("error", (c) => this.abort(c)), this[y].on("end", () => {
-					this[dt] = !0, this[$e]();
-				}), this[Yt] = !0;
-				let l = !!this[y][h ? "end" : "write"](t);
-				return this[Yt] = !1, i?.(), l;
-			}
-		}
-		this[Yt] = !0, this[y] ? this[y].write(t) : this[$e](t), this[Yt] = !1;
-		let n = this[it].length > 0 ? !1 : this[et] ? this[et].flowing : !0;
-		return !n && this[it].length === 0 && this[et]?.once("drain", () => this.emit("drain")), i?.(), n;
-	}
-	[Ki](t) {
-		t && !this[ut] && (this[p$1] = this[p$1] ? Buffer.concat([this[p$1], t]) : t);
-	}
-	[qe]() {
-		if (this[dt] && !this[Zi] && !this[ut] && !this[ae]) {
-			this[Zi] = !0;
-			let t = this[Dt];
-			if (t && t.blockRemain) {
-				let e = this[p$1] ? this[p$1].length : 0;
-				this.warn("TAR_BAD_ARCHIVE", `Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`, { entry: t }), this[p$1] && t.write(this[p$1]), t.end();
-			}
-			this[At](Qe);
-		}
-	}
-	[$e](t) {
-		if (this[ae] && t) this[Ki](t);
-		else if (!t && !this[p$1]) this[qe]();
-		else if (t) {
-			if (this[ae] = !0, this[p$1]) {
-				this[Ki](t);
-				let e = this[p$1];
-				this[p$1] = void 0, this[Xe](e);
-			} else this[Xe](t);
-			for (; this[p$1] && this[p$1]?.length >= 512 && !this[ut] && !this[je];) {
-				let e = this[p$1];
-				this[p$1] = void 0, this[Xe](e);
-			}
-			this[ae] = !1;
-		}
-		(!this[p$1] || this[dt]) && this[qe]();
-	}
-	[Xe](t) {
-		let e = 0, i = t.length;
-		for (; e + 512 <= i && !this[ut] && !this[je];) switch (this[B]) {
-			case "begin":
-			case "header":
-				this[Ys](t, e), e += 512;
-				break;
-			case "ignore":
-			case "body":
-				e += this[Yi](t, e);
-				break;
-			case "meta":
-				e += this[Zs](t, e);
-				break;
-			default: throw new Error("invalid state: " + this[B]);
-		}
-		e < i && (this[p$1] = this[p$1] ? Buffer.concat([t.subarray(e), this[p$1]]) : t.subarray(e));
-	}
-	end(t, e, i) {
-		return typeof t == "function" && (i = t, e = void 0, t = void 0), typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, e)), i && this.once("finish", i), this[ut] || (this[y] ? (t && this[y].write(t), this[y].end()) : (this[dt] = !0, (this.brotli === void 0 || this.zstd === void 0) && (t = t || Buffer.alloc(0)), t && this.write(t), this[qe]())), this;
-	}
-};
-var mt = (s) => {
-	let t = s.length - 1, e = -1;
-	for (; t > -1 && s.charAt(t) === "/";) e = t, t--;
-	return e === -1 ? s : s.slice(0, e);
-};
-var An = (s) => {
-	let t = s.onReadEntry;
-	s.onReadEntry = t ? (e) => {
-		t(e), e.resume();
-	} : (e) => e.resume();
-}, Xi = (s, t) => {
-	let e = new Map(t.map((n) => [mt(n), !0])), i = s.filter, r = (n, o = "") => {
-		let a = o || parse(n).root || ".", h;
-		if (n === a) h = !1;
-		else {
-			let l = e.get(n);
-			h = l !== void 0 ? l : r(dirname$1(n), a);
-		}
-		return e.set(n, h), h;
-	};
-	s.filter = i ? (n, o) => i(n, o) && r(mt(n)) : (n) => r(mt(n));
-}, In = (s) => {
-	let t = new st(s), e = s.file, i;
-	try {
-		i = Kt.openSync(e, "r");
-		let r = Kt.fstatSync(i), n = s.maxReadSize || 16 * 1024 * 1024;
-		if (r.size < n) {
-			let o = Buffer.allocUnsafe(r.size), a = Kt.readSync(i, o, 0, r.size, 0);
-			t.end(a === o.byteLength ? o : o.subarray(0, a));
-		} else {
-			let o = 0, a = Buffer.allocUnsafe(n);
-			for (; o < r.size;) {
-				let h = Kt.readSync(i, a, 0, n, o);
-				if (h === 0) break;
-				o += h, t.write(a.subarray(0, h));
-			}
-			t.end();
-		}
-	} finally {
-		if (typeof i == "number") try {
-			Kt.closeSync(i);
-		} catch {}
-	}
-}, Fn = (s, t) => {
-	let e = new st(s), i = s.maxReadSize || 16 * 1024 * 1024, r = s.file;
-	return new Promise((o, a) => {
-		e.on("error", a), e.on("end", o), Kt.stat(r, (h, l) => {
-			if (h) a(h);
-			else {
-				let c = new _t(r, {
-					readSize: i,
-					size: l.size
-				});
-				c.on("error", a), c.pipe(e);
-			}
-		});
-	});
-}, Ft = K(In, Fn, (s) => new st(s), (s) => new st(s), (s, t) => {
-	t?.length && Xi(s, t), s.noResume || An(s);
-});
-var qi = (s, t, e) => (s &= 4095, e && (s = (s | 384) & -19), t && (s & 256 && (s |= 64), s & 32 && (s |= 8), s & 4 && (s |= 1)), s);
-var { isAbsolute: kn, parse: Vs } = win32, le = (s) => {
-	let t = "", e = Vs(s);
-	for (; kn(s) || e.root;) {
-		let i = s.charAt(0) === "/" && s.slice(0, 4) !== "//?/" ? "/" : e.root;
-		s = s.slice(i.length), t += i, e = Vs(s);
-	}
-	return [t, s];
-};
-var ti = [
-	"|",
-	"<",
-	">",
-	"?",
-	":"
-], Qi = ti.map((s) => String.fromCodePoint(61440 + Number(s.codePointAt(0)))), vn = new Map(ti.map((s, t) => [s, Qi[t]])), Mn = new Map(Qi.map((s, t) => [s, ti[t]])), Ji = (s) => ti.reduce((t, e) => t.split(e).join(vn.get(e)), s), $s = (s) => Qi.reduce((t, e) => t.split(e).join(Mn.get(e)), s);
-var er = (s, t) => t ? (s = f$1(s).replace(/^\.(\/|$)/, ""), mt(t) + "/" + s) : f$1(s), Bn = 16 * 1024 * 1024, Qs = Symbol("process"), Js = Symbol("file"), js = Symbol("directory"), ts = Symbol("symlink"), tr = Symbol("hardlink"), ce = Symbol("header"), ei = Symbol("read"), es = Symbol("lstat"), ii = Symbol("onlstat"), is = Symbol("onread"), ss = Symbol("onreadlink"), rs = Symbol("openfile"), ns = Symbol("onopenfile"), pt = Symbol("close"), si = Symbol("mode"), os = Symbol("awaitDrain"), ji = Symbol("ondrain"), X = Symbol("prefix"), fe = class extends A$1 {
-	path;
-	portable;
-	myuid = process.getuid && process.getuid() || 0;
-	myuser = process.env.USER || "";
-	maxReadSize;
-	linkCache;
-	statCache;
-	preservePaths;
-	cwd;
-	strict;
-	mtime;
-	noPax;
-	noMtime;
-	prefix;
-	fd;
-	blockLen = 0;
-	blockRemain = 0;
-	buf;
-	pos = 0;
-	remain = 0;
-	length = 0;
-	offset = 0;
-	win32;
-	absolute;
-	header;
-	type;
-	linkpath;
-	stat;
-	onWriteEntry;
-	#t = !1;
-	constructor(t, e = {}) {
-		let i = se(e);
-		super(), this.path = f$1(t), this.portable = !!i.portable, this.maxReadSize = i.maxReadSize || Bn, this.linkCache = i.linkCache || /* @__PURE__ */ new Map(), this.statCache = i.statCache || /* @__PURE__ */ new Map(), this.preservePaths = !!i.preservePaths, this.cwd = f$1(i.cwd || process.cwd()), this.strict = !!i.strict, this.noPax = !!i.noPax, this.noMtime = !!i.noMtime, this.mtime = i.mtime, this.prefix = i.prefix ? f$1(i.prefix) : void 0, this.onWriteEntry = i.onWriteEntry, typeof i.onwarn == "function" && this.on("warn", i.onwarn);
-		let r = !1;
-		if (!this.preservePaths) {
-			let [o, a] = le(this.path);
-			o && typeof a == "string" && (this.path = a, r = o);
-		}
-		this.win32 = !!i.win32 || process.platform === "win32", this.win32 && (this.path = $s(this.path.replaceAll(/\\/g, "/")), t = t.replaceAll(/\\/g, "/")), this.absolute = f$1(i.absolute || qs.resolve(this.cwd, t)), this.path === "" && (this.path = "./"), r && this.warn("TAR_ENTRY_INFO", `stripping ${r} from absolute path`, {
-			entry: this,
-			path: r + this.path
-		});
-		let n = this.statCache.get(this.absolute);
-		n ? this[ii](n) : this[es]();
-	}
-	warn(t, e, i = {}) {
-		return Nt(this, t, e, i);
-	}
-	emit(t, ...e) {
-		return t === "error" && (this.#t = !0), super.emit(t, ...e);
-	}
-	[es]() {
-		I.lstat(this.absolute, (t, e) => {
-			if (t) return this.emit("error", t);
-			this[ii](e);
-		});
-	}
-	[ii](t) {
-		this.statCache.set(this.absolute, t), this.stat = t, t.isFile() || (t.size = 0), this.type = Pn(t), this.emit("stat", t), this[Qs]();
-	}
-	[Qs]() {
-		switch (this.type) {
-			case "File": return this[Js]();
-			case "Directory": return this[js]();
-			case "SymbolicLink": return this[ts]();
-			default: return this.end();
-		}
-	}
-	[si](t) {
-		return qi(t, this.type === "Directory", this.portable);
-	}
-	[X](t) {
-		return er(t, this.prefix);
-	}
-	[ce]() {
-		if (!this.stat) throw new Error("cannot write header before stat");
-		this.type === "Directory" && this.portable && (this.noMtime = !0), this.onWriteEntry?.(this), this.header = new C$1({
-			path: this[X](this.path),
-			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
-			mode: this[si](this.stat.mode),
-			uid: this.portable ? void 0 : this.stat.uid,
-			gid: this.portable ? void 0 : this.stat.gid,
-			size: this.stat.size,
-			mtime: this.noMtime ? void 0 : this.mtime || this.stat.mtime,
-			type: this.type === "Unsupported" ? void 0 : this.type,
-			uname: this.portable ? void 0 : this.stat.uid === this.myuid ? this.myuser : "",
-			atime: this.portable ? void 0 : this.stat.atime,
-			ctime: this.portable ? void 0 : this.stat.ctime
-		}), this.header.encode() && !this.noPax && super.write(new ct({
-			atime: this.portable ? void 0 : this.header.atime,
-			ctime: this.portable ? void 0 : this.header.ctime,
-			gid: this.portable ? void 0 : this.header.gid,
-			mtime: this.noMtime ? void 0 : this.mtime || this.header.mtime,
-			path: this[X](this.path),
-			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
-			size: this.header.size,
-			uid: this.portable ? void 0 : this.header.uid,
-			uname: this.portable ? void 0 : this.header.uname,
-			dev: this.portable ? void 0 : this.stat.dev,
-			ino: this.portable ? void 0 : this.stat.ino,
-			nlink: this.portable ? void 0 : this.stat.nlink
-		}).encode());
-		let t = this.header?.block;
-		if (!t) throw new Error("failed to encode header");
-		super.write(t);
-	}
-	[js]() {
-		if (!this.stat) throw new Error("cannot create directory entry without stat");
-		this.path.slice(-1) !== "/" && (this.path += "/"), this.stat.size = 0, this[ce](), this.end();
-	}
-	[ts]() {
-		I.readlink(this.absolute, (t, e) => {
-			if (t) return this.emit("error", t);
-			this[ss](e);
-		});
-	}
-	[ss](t) {
-		this.linkpath = f$1(t), this[ce](), this.end();
-	}
-	[tr](t) {
-		if (!this.stat) throw new Error("cannot create link entry without stat");
-		this.type = "Link", this.linkpath = f$1(qs.relative(this.cwd, t)), this.stat.size = 0, this[ce](), this.end();
-	}
-	[Js]() {
-		if (!this.stat) throw new Error("cannot create file entry without stat");
-		if (this.stat.nlink > 1) {
-			let t = `${this.stat.dev}:${this.stat.ino}`, e = this.linkCache.get(t);
-			if (e?.indexOf(this.cwd) === 0) return this[tr](e);
-			this.linkCache.set(t, this.absolute);
-		}
-		if (this[ce](), this.stat.size === 0) return this.end();
-		this[rs]();
-	}
-	[rs]() {
-		I.open(this.absolute, "r", (t, e) => {
-			if (t) return this.emit("error", t);
-			this[ns](e);
-		});
-	}
-	[ns](t) {
-		if (this.fd = t, this.#t) return this[pt]();
-		if (!this.stat) throw new Error("should stat before calling onopenfile");
-		this.blockLen = 512 * Math.ceil(this.stat.size / 512), this.blockRemain = this.blockLen;
-		let e = Math.min(this.blockLen, this.maxReadSize);
-		this.buf = Buffer.allocUnsafe(e), this.offset = 0, this.pos = 0, this.remain = this.stat.size, this.length = this.buf.length, this[ei]();
-	}
-	[ei]() {
-		let { fd: t, buf: e, offset: i, length: r, pos: n } = this;
-		if (t === void 0 || e === void 0) throw new Error("cannot read file without first opening");
-		I.read(t, e, i, r, n, (o, a) => {
-			if (o) return this[pt](() => this.emit("error", o));
-			this[is](a);
-		});
-	}
-	[pt](t = () => {}) {
-		this.fd !== void 0 && I.close(this.fd, t);
-	}
-	[is](t) {
-		if (t <= 0 && this.remain > 0) {
-			let r = Object.assign(/* @__PURE__ */ new Error("encountered unexpected EOF"), {
-				path: this.absolute,
-				syscall: "read",
-				code: "EOF"
-			});
-			return this[pt](() => this.emit("error", r));
-		}
-		if (t > this.remain) {
-			let r = Object.assign(/* @__PURE__ */ new Error("did not encounter expected EOF"), {
-				path: this.absolute,
-				syscall: "read",
-				code: "EOF"
-			});
-			return this[pt](() => this.emit("error", r));
-		}
-		if (!this.buf) throw new Error("should have created buffer prior to reading");
-		if (t === this.remain) for (let r = t; r < this.length && t < this.blockRemain; r++) this.buf[r + this.offset] = 0, t++, this.remain++;
-		let e = this.offset === 0 && t === this.buf.length ? this.buf : this.buf.subarray(this.offset, this.offset + t);
-		this.write(e) ? this[ji]() : this[os](() => this[ji]());
-	}
-	[os](t) {
-		this.once("drain", t);
-	}
-	write(t, e, i) {
-		if (typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, typeof e == "string" ? e : "utf8")), this.blockRemain < t.length) {
-			let r = Object.assign(/* @__PURE__ */ new Error("writing more data than expected"), { path: this.absolute });
-			return this.emit("error", r);
-		}
-		return this.remain -= t.length, this.blockRemain -= t.length, this.pos += t.length, this.offset += t.length, super.write(t, null, i);
-	}
-	[ji]() {
-		if (!this.remain) return this.blockRemain && super.write(Buffer.alloc(this.blockRemain)), this[pt]((t) => t ? this.emit("error", t) : this.end());
-		if (!this.buf) throw new Error("buffer lost somehow in ONDRAIN");
-		this.offset >= this.length && (this.buf = Buffer.allocUnsafe(Math.min(this.blockRemain, this.buf.length)), this.offset = 0), this.length = this.buf.length - this.offset, this[ei]();
-	}
-}, ri = class extends fe {
-	sync = !0;
-	[es]() {
-		this[ii](I.lstatSync(this.absolute));
-	}
-	[ts]() {
-		this[ss](I.readlinkSync(this.absolute));
-	}
-	[rs]() {
-		this[ns](I.openSync(this.absolute, "r"));
-	}
-	[ei]() {
-		let t = !0;
-		try {
-			let { fd: e, buf: i, offset: r, length: n, pos: o } = this;
-			if (e === void 0 || i === void 0) throw new Error("fd and buf must be set in READ method");
-			let a = I.readSync(e, i, r, n, o);
-			this[is](a), t = !1;
-		} finally {
-			if (t) try {
-				this[pt](() => {});
-			} catch {}
-		}
-	}
-	[os](t) {
-		t();
-	}
-	[pt](t = () => {}) {
-		this.fd !== void 0 && I.closeSync(this.fd), t();
-	}
-}, ni = class extends A$1 {
-	blockLen = 0;
-	blockRemain = 0;
-	buf = 0;
-	pos = 0;
-	remain = 0;
-	length = 0;
-	preservePaths;
-	portable;
-	strict;
-	noPax;
-	noMtime;
-	readEntry;
-	type;
-	prefix;
-	path;
-	mode;
-	uid;
-	gid;
-	uname;
-	gname;
-	header;
-	mtime;
-	atime;
-	ctime;
-	linkpath;
-	size;
-	onWriteEntry;
-	warn(t, e, i = {}) {
-		return Nt(this, t, e, i);
-	}
-	constructor(t, e = {}) {
-		let i = se(e);
-		super(), this.preservePaths = !!i.preservePaths, this.portable = !!i.portable, this.strict = !!i.strict, this.noPax = !!i.noPax, this.noMtime = !!i.noMtime, this.onWriteEntry = i.onWriteEntry, this.readEntry = t;
-		let { type: r } = t;
-		if (r === "Unsupported") throw new Error("writing entry that should be ignored");
-		this.type = r, this.type === "Directory" && this.portable && (this.noMtime = !0), this.prefix = i.prefix, this.path = f$1(t.path), this.mode = t.mode !== void 0 ? this[si](t.mode) : void 0, this.uid = this.portable ? void 0 : t.uid, this.gid = this.portable ? void 0 : t.gid, this.uname = this.portable ? void 0 : t.uname, this.gname = this.portable ? void 0 : t.gname, this.size = t.size, this.mtime = this.noMtime ? void 0 : i.mtime || t.mtime, this.atime = this.portable ? void 0 : t.atime, this.ctime = this.portable ? void 0 : t.ctime, this.linkpath = t.linkpath !== void 0 ? f$1(t.linkpath) : void 0, typeof i.onwarn == "function" && this.on("warn", i.onwarn);
-		let n = !1;
-		if (!this.preservePaths) {
-			let [a, h] = le(this.path);
-			a && typeof h == "string" && (this.path = h, n = a);
-		}
-		this.remain = t.size, this.blockRemain = t.startBlockSize, this.onWriteEntry?.(this), this.header = new C$1({
-			path: this[X](this.path),
-			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
-			mode: this.mode,
-			uid: this.portable ? void 0 : this.uid,
-			gid: this.portable ? void 0 : this.gid,
-			size: this.size,
-			mtime: this.noMtime ? void 0 : this.mtime,
-			type: this.type,
-			uname: this.portable ? void 0 : this.uname,
-			atime: this.portable ? void 0 : this.atime,
-			ctime: this.portable ? void 0 : this.ctime
-		}), n && this.warn("TAR_ENTRY_INFO", `stripping ${n} from absolute path`, {
-			entry: this,
-			path: n + this.path
-		}), this.header.encode() && !this.noPax && super.write(new ct({
-			atime: this.portable ? void 0 : this.atime,
-			ctime: this.portable ? void 0 : this.ctime,
-			gid: this.portable ? void 0 : this.gid,
-			mtime: this.noMtime ? void 0 : this.mtime,
-			path: this[X](this.path),
-			linkpath: this.type === "Link" && this.linkpath !== void 0 ? this[X](this.linkpath) : this.linkpath,
-			size: this.size,
-			uid: this.portable ? void 0 : this.uid,
-			uname: this.portable ? void 0 : this.uname,
-			dev: this.portable ? void 0 : this.readEntry.dev,
-			ino: this.portable ? void 0 : this.readEntry.ino,
-			nlink: this.portable ? void 0 : this.readEntry.nlink
-		}).encode());
-		let o = this.header?.block;
-		if (!o) throw new Error("failed to encode header");
-		super.write(o), t.pipe(this);
-	}
-	[X](t) {
-		return er(t, this.prefix);
-	}
-	[si](t) {
-		return qi(t, this.type === "Directory", this.portable);
-	}
-	write(t, e, i) {
-		typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, typeof e == "string" ? e : "utf8"));
-		let r = t.length;
-		if (r > this.blockRemain) throw new Error("writing more to entry than is appropriate");
-		return this.blockRemain -= r, super.write(t, i);
-	}
-	end(t, e, i) {
-		return this.blockRemain && super.write(Buffer.alloc(this.blockRemain)), typeof t == "function" && (i = t, e = void 0, t = void 0), typeof e == "function" && (i = e, e = void 0), typeof t == "string" && (t = Buffer.from(t, e ?? "utf8")), i && this.once("finish", i), t ? super.end(t, i) : super.end(i), this;
-	}
-}, Pn = (s) => s.isFile() ? "File" : s.isDirectory() ? "Directory" : s.isSymbolicLink() ? "SymbolicLink" : "Unsupported";
-var oi = class s {
-	tail;
-	head;
-	length = 0;
-	static create(t = []) {
-		return new s(t);
-	}
-	constructor(t = []) {
-		for (let e of t) this.push(e);
-	}
-	*[Symbol.iterator]() {
-		for (let t = this.head; t; t = t.next) yield t.value;
-	}
-	removeNode(t) {
-		if (t.list !== this) throw new Error("removing node which does not belong to this list");
-		let e = t.next, i = t.prev;
-		return e && (e.prev = i), i && (i.next = e), t === this.head && (this.head = e), t === this.tail && (this.tail = i), this.length--, t.next = void 0, t.prev = void 0, t.list = void 0, e;
-	}
-	unshiftNode(t) {
-		if (t === this.head) return;
-		t.list && t.list.removeNode(t);
-		let e = this.head;
-		t.list = this, t.next = e, e && (e.prev = t), this.head = t, this.tail || (this.tail = t), this.length++;
-	}
-	pushNode(t) {
-		if (t === this.tail) return;
-		t.list && t.list.removeNode(t);
-		let e = this.tail;
-		t.list = this, t.prev = e, e && (e.next = t), this.tail = t, this.head || (this.head = t), this.length++;
-	}
-	push(...t) {
-		for (let e = 0, i = t.length; e < i; e++) Un(this, t[e]);
-		return this.length;
-	}
-	unshift(...t) {
-		for (var e = 0, i = t.length; e < i; e++) Hn(this, t[e]);
-		return this.length;
-	}
-	pop() {
-		if (!this.tail) return;
-		let t = this.tail.value, e = this.tail;
-		return this.tail = this.tail.prev, this.tail ? this.tail.next = void 0 : this.head = void 0, e.list = void 0, this.length--, t;
-	}
-	shift() {
-		if (!this.head) return;
-		let t = this.head.value, e = this.head;
-		return this.head = this.head.next, this.head ? this.head.prev = void 0 : this.tail = void 0, e.list = void 0, this.length--, t;
-	}
-	forEach(t, e) {
-		e = e || this;
-		for (let i = this.head, r = 0; i; r++) t.call(e, i.value, r, this), i = i.next;
-	}
-	forEachReverse(t, e) {
-		e = e || this;
-		for (let i = this.tail, r = this.length - 1; i; r--) t.call(e, i.value, r, this), i = i.prev;
-	}
-	get(t) {
-		let e = 0, i = this.head;
-		for (; i && e < t; e++) i = i.next;
-		if (e === t && i) return i.value;
-	}
-	getReverse(t) {
-		let e = 0, i = this.tail;
-		for (; i && e < t; e++) i = i.prev;
-		if (e === t && i) return i.value;
-	}
-	map(t, e) {
-		e = e || this;
-		let i = new s();
-		for (let r = this.head; r;) i.push(t.call(e, r.value, this)), r = r.next;
-		return i;
-	}
-	mapReverse(t, e) {
-		e = e || this;
-		var i = new s();
-		for (let r = this.tail; r;) i.push(t.call(e, r.value, this)), r = r.prev;
-		return i;
-	}
-	reduce(t, e) {
-		let i, r = this.head;
-		if (arguments.length > 1) i = e;
-		else if (this.head) r = this.head.next, i = this.head.value;
-		else throw new TypeError("Reduce of empty list with no initial value");
-		for (var n = 0; r; n++) i = t(i, r.value, n), r = r.next;
-		return i;
-	}
-	reduceReverse(t, e) {
-		let i, r = this.tail;
-		if (arguments.length > 1) i = e;
-		else if (this.tail) r = this.tail.prev, i = this.tail.value;
-		else throw new TypeError("Reduce of empty list with no initial value");
-		for (let n = this.length - 1; r; n--) i = t(i, r.value, n), r = r.prev;
-		return i;
-	}
-	toArray() {
-		let t = new Array(this.length);
-		for (let e = 0, i = this.head; i; e++) t[e] = i.value, i = i.next;
-		return t;
-	}
-	toArrayReverse() {
-		let t = new Array(this.length);
-		for (let e = 0, i = this.tail; i; e++) t[e] = i.value, i = i.prev;
-		return t;
-	}
-	slice(t = 0, e = this.length) {
-		e < 0 && (e += this.length), t < 0 && (t += this.length);
-		let i = new s();
-		if (e < t || e < 0) return i;
-		t < 0 && (t = 0), e > this.length && (e = this.length);
-		let r = this.head, n = 0;
-		for (n = 0; r && n < t; n++) r = r.next;
-		for (; r && n < e; n++, r = r.next) i.push(r.value);
-		return i;
-	}
-	sliceReverse(t = 0, e = this.length) {
-		e < 0 && (e += this.length), t < 0 && (t += this.length);
-		let i = new s();
-		if (e < t || e < 0) return i;
-		t < 0 && (t = 0), e > this.length && (e = this.length);
-		let r = this.length, n = this.tail;
-		for (; n && r > e; r--) n = n.prev;
-		for (; n && r > t; r--, n = n.prev) i.push(n.value);
-		return i;
-	}
-	splice(t, e = 0, ...i) {
-		t > this.length && (t = this.length - 1), t < 0 && (t = this.length + t);
-		let r = this.head;
-		for (let o = 0; r && o < t; o++) r = r.next;
-		let n = [];
-		for (let o = 0; r && o < e; o++) n.push(r.value), r = this.removeNode(r);
-		r ? r !== this.tail && (r = r.prev) : r = this.tail;
-		for (let o of i) r = zn(this, r, o);
-		return n;
-	}
-	reverse() {
-		let t = this.head, e = this.tail;
-		for (let i = t; i; i = i.prev) {
-			let r = i.prev;
-			i.prev = i.next, i.next = r;
-		}
-		return this.head = e, this.tail = t, this;
-	}
-};
-function zn(s, t, e) {
-	let n = new de(e, t, t ? t.next : s.head, s);
-	return n.next === void 0 && (s.tail = n), n.prev === void 0 && (s.head = n), s.length++, n;
-}
-function Un(s, t) {
-	s.tail = new de(t, s.tail, void 0, s), s.head || (s.head = s.tail), s.length++;
-}
-function Hn(s, t) {
-	s.head = new de(t, void 0, s.head, s), s.tail || (s.tail = s.head), s.length++;
-}
-var de = class {
-	list;
-	next;
-	prev;
-	value;
-	constructor(t, e, i, r) {
-		this.list = r, this.value = t, e ? (e.next = this, this.prev = e) : this.prev = void 0, i ? (i.prev = this, this.next = i) : this.next = void 0;
-	}
-};
-var mi = class {
-	path;
-	absolute;
-	entry;
-	stat;
-	readdir;
-	pending = !1;
-	pendingLink = !1;
-	ignore = !1;
-	piped = !1;
-	constructor(t, e) {
-		this.path = t || "./", this.absolute = e;
-	}
-}, ir = Buffer.alloc(1024), ai = Symbol("onStat"), ue = Symbol("ended"), W$1 = Symbol("queue"), me = Symbol("pendingLinks"), Et = Symbol("current"), Ct = Symbol("process"), pe = Symbol("processing"), hi = Symbol("processJob"), G = Symbol("jobs"), hs = Symbol("jobDone"), li = Symbol("addFSEntry"), sr = Symbol("addTarEntry"), cs = Symbol("stat"), fs$1 = Symbol("readdir"), ci = Symbol("onreaddir"), fi = Symbol("pipe"), rr = Symbol("entry"), as = Symbol("entryOpt"), di = Symbol("writeEntryClass"), or = Symbol("write"), ls = Symbol("ondrain"), wt = class extends A$1 {
-	sync = !1;
-	opt;
-	cwd;
-	maxReadSize;
-	preservePaths;
-	strict;
-	noPax;
-	prefix;
-	linkCache;
-	statCache;
-	file;
-	portable;
-	zip;
-	readdirCache;
-	noDirRecurse;
-	follow;
-	noMtime;
-	mtime;
-	filter;
-	jobs;
-	[di];
-	onWriteEntry;
-	[W$1];
-	[me] = /* @__PURE__ */ new Map();
-	[G] = 0;
-	[pe] = !1;
-	[ue] = !1;
-	constructor(t = {}) {
-		if (super(), this.opt = t, this.file = t.file || "", this.cwd = t.cwd || process.cwd(), this.maxReadSize = t.maxReadSize, this.preservePaths = !!t.preservePaths, this.strict = !!t.strict, this.noPax = !!t.noPax, this.prefix = f$1(t.prefix || ""), this.linkCache = t.linkCache || /* @__PURE__ */ new Map(), this.statCache = t.statCache || /* @__PURE__ */ new Map(), this.readdirCache = t.readdirCache || /* @__PURE__ */ new Map(), this.onWriteEntry = t.onWriteEntry, this[di] = fe, typeof t.onwarn == "function" && this.on("warn", t.onwarn), this.portable = !!t.portable, t.gzip || t.brotli || t.zstd) {
-			if ((t.gzip ? 1 : 0) + (t.brotli ? 1 : 0) + (t.zstd ? 1 : 0) > 1) throw new TypeError("gzip, brotli, zstd are mutually exclusive");
-			if (t.gzip && (typeof t.gzip != "object" && (t.gzip = {}), this.portable && (t.gzip.portable = !0), this.zip = new Pe(t.gzip)), t.brotli && (typeof t.brotli != "object" && (t.brotli = {}), this.zip = new He(t.brotli)), t.zstd && (typeof t.zstd != "object" && (t.zstd = {}), this.zip = new Ze(t.zstd)), !this.zip) throw new Error("impossible");
-			let e = this.zip;
-			e.on("data", (i) => super.write(i)), e.on("end", () => super.end()), e.on("drain", () => this[ls]()), this.on("resume", () => e.resume());
-		} else this.on("drain", this[ls]);
-		this.noDirRecurse = !!t.noDirRecurse, this.follow = !!t.follow, this.noMtime = !!t.noMtime, t.mtime && (this.mtime = t.mtime), this.filter = typeof t.filter == "function" ? t.filter : () => !0, this[W$1] = new oi(), this[G] = 0, this.jobs = Number(t.jobs) || 4, this[pe] = !1, this[ue] = !1;
-	}
-	[or](t) {
-		return super.write(t);
-	}
-	add(t) {
-		return this.write(t), this;
-	}
-	end(t, e, i) {
-		return typeof t == "function" && (i = t, t = void 0), typeof e == "function" && (i = e, e = void 0), t && this.add(t), this[ue] = !0, this[Ct](), i && i(), this;
-	}
-	write(t) {
-		if (this[ue]) throw new Error("write after end");
-		return typeof t == "string" ? this[li](t) : this[sr](t), this.flowing;
-	}
-	[sr](t) {
-		let e = f$1(qs.resolve(this.cwd, t.path));
-		if (!this.filter(t.path, t)) t.resume();
-		else {
-			let i = new mi(t.path, e);
-			i.entry = new ni(t, this[as](i)), i.entry.on("end", () => this[hs](i)), this[G] += 1, this[W$1].push(i);
-		}
-		this[Ct]();
-	}
-	[li](t) {
-		let e = f$1(qs.resolve(this.cwd, t));
-		this[W$1].push(new mi(t, e)), this[Ct]();
-	}
-	[cs](t) {
-		t.pending = !0, this[G] += 1;
-		I[this.follow ? "stat" : "lstat"](t.absolute, (i, r) => {
-			t.pending = !1, this[G] -= 1, i ? this.emit("error", i) : this[ai](t, r);
-		});
-	}
-	[ai](t, e) {
-		if (this.statCache.set(t.absolute, e), t.stat = e, !this.filter(t.path, e)) t.ignore = !0;
-		else if (e.isFile() && e.nlink > 1 && !this.linkCache.get(`${e.dev}:${e.ino}`) && !this.sync) if (t === this[Et]) this[hi](t);
-		else {
-			let i = `${e.dev}:${e.ino}`, r = this[me].get(i);
-			r ? r.push(t) : this[me].set(i, [t]), t.pendingLink = !0, t.pending = !0;
-		}
-		this[Ct]();
-	}
-	[fs$1](t) {
-		t.pending = !0, this[G] += 1, I.readdir(t.absolute, (e, i) => {
-			if (t.pending = !1, this[G] -= 1, e) return this.emit("error", e);
-			this[ci](t, i);
-		});
-	}
-	[ci](t, e) {
-		this.readdirCache.set(t.absolute, e), t.readdir = e, this[Ct]();
-	}
-	[Ct]() {
-		if (!this[pe]) {
-			this[pe] = !0;
-			for (let t = this[W$1].head; t && this[G] < this.jobs; t = t.next) if (this[hi](t.value), t.value.ignore) {
-				let e = t.next;
-				this[W$1].removeNode(t), t.next = e;
-			}
-			this[pe] = !1, this[ue] && this[W$1].length === 0 && this[G] === 0 && (this.zip ? this.zip.end(ir) : (super.write(ir), super.end()));
-		}
-	}
-	get [Et]() {
-		return this[W$1] && this[W$1].head && this[W$1].head.value;
-	}
-	[hs](t) {
-		this[W$1].shift(), this[G] -= 1;
-		let { stat: e } = t;
-		if (e && e.isFile() && e.nlink > 1) {
-			let i = `${e.dev}:${e.ino}`, r = this[me].get(i);
-			if (r) {
-				this[me].delete(i);
-				for (let n of r) n.pending = !1, this[hi](n);
-			}
-		}
-		this[Ct]();
-	}
-	[hi](t) {
-		if (t.pending && t.pendingLink && t === this[Et] && (t.pending = !1, t.pendingLink = !1), !t.pending) {
-			if (t.entry) {
-				t === this[Et] && !t.piped && this[fi](t);
-				return;
-			}
-			if (!t.stat) {
-				let e = this.statCache.get(t.absolute);
-				e ? this[ai](t, e) : this[cs](t);
-			}
-			if (t.stat && !t.ignore) {
-				if (!this.noDirRecurse && t.stat.isDirectory() && !t.readdir) {
-					let e = this.readdirCache.get(t.absolute);
-					if (e ? this[ci](t, e) : this[fs$1](t), !t.readdir) return;
-				}
-				if (t.entry = this[rr](t), !t.entry) {
-					t.ignore = !0;
-					return;
-				}
-				t === this[Et] && !t.piped && this[fi](t);
-			}
-		}
-	}
-	[as](t) {
-		return {
-			onwarn: (e, i, r) => this.warn(e, i, r),
-			noPax: this.noPax,
-			cwd: this.cwd,
-			absolute: t.absolute,
-			preservePaths: this.preservePaths,
-			maxReadSize: this.maxReadSize,
-			strict: this.strict,
-			portable: this.portable,
-			linkCache: this.linkCache,
-			statCache: this.statCache,
-			noMtime: this.noMtime,
-			mtime: this.mtime,
-			prefix: this.prefix,
-			onWriteEntry: this.onWriteEntry
-		};
-	}
-	[rr](t) {
-		this[G] += 1;
-		try {
-			return new this[di](t.path, this[as](t)).on("end", () => this[hs](t)).on("error", (i) => this.emit("error", i));
-		} catch (e) {
-			this.emit("error", e);
-		}
-	}
-	[ls]() {
-		this[Et] && this[Et].entry && this[Et].entry.resume();
-	}
-	[fi](t) {
-		t.piped = !0, t.readdir && t.readdir.forEach((r) => {
-			let n = t.path, o = n === "./" ? "" : n.replace(/\/*$/, "/");
-			this[li](o + r);
-		});
-		let e = t.entry, i = this.zip;
-		if (!e) throw new Error("cannot pipe without source");
-		i ? e.on("data", (r) => {
-			i.write(r) || e.pause();
-		}) : e.on("data", (r) => {
-			super.write(r) || e.pause();
-		});
-	}
-	pause() {
-		return this.zip && this.zip.pause(), super.pause();
-	}
-	warn(t, e, i = {}) {
-		Nt(this, t, e, i);
-	}
-}, kt = class extends wt {
-	sync = !0;
-	constructor(t) {
-		super(t), this[di] = ri;
-	}
-	pause() {}
-	resume() {}
-	[cs](t) {
-		let e = this.follow ? "statSync" : "lstatSync";
-		this[ai](t, I[e](t.absolute));
-	}
-	[fs$1](t) {
-		this[ci](t, I.readdirSync(t.absolute));
-	}
-	[fi](t) {
-		let e = t.entry, i = this.zip;
-		if (t.readdir && t.readdir.forEach((r) => {
-			let n = t.path, o = n === "./" ? "" : n.replace(/\/*$/, "/");
-			this[li](o + r);
-		}), !e) throw new Error("Cannot pipe without source");
-		i ? e.on("data", (r) => {
-			i.write(r);
-		}) : e.on("data", (r) => {
-			super[or](r);
-		});
-	}
-};
-var Wn = (s, t) => {
-	let e = new kt(s), i = new Wt(s.file, { mode: s.mode || 438 });
-	e.pipe(i), ar(e, t);
-}, Gn = (s, t) => {
-	let e = new wt(s), i = new tt(s.file, { mode: s.mode || 438 });
-	e.pipe(i);
-	let r = new Promise((n, o) => {
-		i.on("error", o), i.on("close", n), e.on("error", o);
-	});
-	return lr(e, t).catch((n) => e.emit("error", n)), r;
-}, ar = (s, t) => {
-	t.forEach((e) => {
-		e.charAt(0) === "@" ? Ft({
-			file: path.resolve(s.cwd, e.slice(1)),
-			sync: !0,
-			noResume: !0,
-			onReadEntry: (i) => s.add(i)
-		}) : s.add(e);
-	}), s.end();
-}, lr = async (s, t) => {
-	for (let e of t) e.charAt(0) === "@" ? await Ft({
-		file: path.resolve(String(s.cwd), e.slice(1)),
-		noResume: !0,
-		onReadEntry: (i) => {
-			s.add(i);
-		}
-	}) : s.add(e);
-	s.end();
-}, Zn = (s, t) => {
-	let e = new kt(s);
-	return ar(e, t), e;
-}, Yn = (s, t) => {
-	let e = new wt(s);
-	return lr(e, t).catch((i) => e.emit("error", i)), e;
-}, Kn = K(Wn, Gn, Zn, Yn, (s, t) => {
-	if (!t?.length) throw new TypeError("no paths specified to add to archive");
-});
-var ur = (process.env.__FAKE_PLATFORM__ || process.platform) === "win32", { O_CREAT: mr, O_NOFOLLOW: cr, O_TRUNC: pr, O_WRONLY: Er } = I.constants, wr = Number(process.env.__FAKE_FS_O_FILENAME__) || I.constants.UV_FS_O_FILEMAP || 0, $n = ur && !!wr, Xn = 512 * 1024, qn = wr | pr | mr | Er, fr = !ur && typeof cr == "number" ? cr | pr | mr | Er : null, ds = fr !== null ? () => fr : $n ? (s) => s < Xn ? qn : "w" : () => "w";
-var us = (s, t, e) => {
-	try {
-		return Kt.lchownSync(s, t, e);
-	} catch (i) {
-		if (i?.code !== "ENOENT") throw i;
-	}
-}, pi = (s, t, e, i) => {
-	Kt.lchown(s, t, e, (r) => {
-		i(r && r?.code !== "ENOENT" ? r : null);
-	});
-}, Qn = (s, t, e, i, r) => {
-	if (t.isDirectory()) ms(path.resolve(s, t.name), e, i, (n) => {
-		if (n) return r(n);
-		pi(path.resolve(s, t.name), e, i, r);
-	});
-	else pi(path.resolve(s, t.name), e, i, r);
-}, ms = (s, t, e, i) => {
-	Kt.readdir(s, { withFileTypes: !0 }, (r, n) => {
-		if (r) {
-			if (r.code === "ENOENT") return i();
-			if (r.code !== "ENOTDIR" && r.code !== "ENOTSUP") return i(r);
-		}
-		if (r || !n.length) return pi(s, t, e, i);
-		let o = n.length, a = null, h = (l) => {
-			if (!a) {
-				if (l) return i(a = l);
-				if (--o === 0) return pi(s, t, e, i);
-			}
-		};
-		for (let l of n) Qn(s, l, t, e, h);
-	});
-}, Jn = (s, t, e, i) => {
-	t.isDirectory() && ps(path.resolve(s, t.name), e, i), us(path.resolve(s, t.name), e, i);
-}, ps = (s, t, e) => {
-	let i;
-	try {
-		i = Kt.readdirSync(s, { withFileTypes: !0 });
-	} catch (r) {
-		let n = r;
-		if (n?.code === "ENOENT") return;
-		if (n?.code === "ENOTDIR" || n?.code === "ENOTSUP") return us(s, t, e);
-		throw n;
-	}
-	for (let r of i) Jn(s, r, t, e);
-	return us(s, t, e);
-};
-var we = class extends Error {
-	path;
-	code;
-	syscall = "chdir";
-	constructor(t, e) {
-		super(`${e}: Cannot cd into '${t}'`), this.path = t, this.code = e;
-	}
-	get name() {
-		return "CwdError";
-	}
-};
-var St = class extends Error {
-	path;
-	symlink;
-	syscall = "symlink";
-	code = "TAR_SYMLINK_ERROR";
-	constructor(t, e) {
-		super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"), this.symlink = t, this.path = e;
-	}
-	get name() {
-		return "SymlinkError";
-	}
-};
-var to = (s, t) => {
-	Kt.stat(s, (e, i) => {
-		(e || !i.isDirectory()) && (e = new we(s, e?.code || "ENOTDIR")), t(e);
-	});
-}, Sr = (s, t, e) => {
-	s = f$1(s);
-	let i = t.umask ?? 18, r = t.mode | 448, n = (r & i) !== 0, o = t.uid, a = t.gid, h = typeof o == "number" && typeof a == "number" && (o !== t.processUid || a !== t.processGid), l = t.preserve, c = t.unlink, d = f$1(t.cwd), S = (E, x) => {
-		E ? e(E) : x && h ? ms(x, o, a, (xe) => S(xe)) : n ? Kt.chmod(s, r, e) : e();
-	};
-	if (s === d) return to(s, S);
-	if (l) return jn.mkdir(s, {
-		mode: r,
-		recursive: !0
-	}).then((E) => S(null, E ?? void 0), S);
-	Es(d, f$1(path.relative(d, s)).split("/"), r, c, d, void 0, S);
-}, Es = (s, t, e, i, r, n, o) => {
-	if (t.length === 0) return o(null, n);
-	let a = t.shift(), h = f$1(path.resolve(s + "/" + a));
-	Kt.mkdir(h, e, yr(h, t, e, i, r, n, o));
-}, yr = (s, t, e, i, r, n, o) => (a) => {
-	a ? Kt.lstat(s, (h, l) => {
-		if (h) h.path = h.path && f$1(h.path), o(h);
-		else if (l.isDirectory()) Es(s, t, e, i, r, n, o);
-		else if (i) Kt.unlink(s, (c) => {
-			if (c) return o(c);
-			Kt.mkdir(s, e, yr(s, t, e, i, r, n, o));
-		});
-		else {
-			if (l.isSymbolicLink()) return o(new St(s, s + "/" + t.join("/")));
-			o(a);
-		}
-	}) : (n = n || s, Es(s, t, e, i, r, n, o));
-}, eo = (s) => {
-	let t = !1, e;
-	try {
-		t = Kt.statSync(s).isDirectory();
-	} catch (i) {
-		e = i?.code;
-	} finally {
-		if (!t) throw new we(s, e ?? "ENOTDIR");
-	}
-}, Rr = (s, t) => {
-	s = f$1(s);
-	let e = t.umask ?? 18, i = t.mode | 448, r = (i & e) !== 0, n = t.uid, o = t.gid, a = typeof n == "number" && typeof o == "number" && (n !== t.processUid || o !== t.processGid), h = t.preserve, l = t.unlink, c = f$1(t.cwd), d = (E) => {
-		E && a && ps(E, n, o), r && Kt.chmodSync(s, i);
-	};
-	if (s === c) return eo(c), d();
-	if (h) return d(Kt.mkdirSync(s, {
-		mode: i,
-		recursive: !0
-	}) ?? void 0);
-	let T = f$1(path.relative(c, s)).split("/"), N;
-	for (let E = T.shift(), x = c; E && (x += "/" + E); E = T.shift()) {
-		x = f$1(path.resolve(x));
-		try {
-			Kt.mkdirSync(x, i), N = N || x;
-		} catch {
-			let xe = Kt.lstatSync(x);
-			if (xe.isDirectory()) continue;
-			if (l) {
-				Kt.unlinkSync(x), Kt.mkdirSync(x, i), N = N || x;
-				continue;
-			} else if (xe.isSymbolicLink()) return new St(x, x + "/" + T.join("/"));
-		}
-	}
-	return d(N);
-};
-var ws = Object.create(null), gr = 1e4, Vt = /* @__PURE__ */ new Set(), br = (s) => {
-	Vt.has(s) ? Vt.delete(s) : ws[s] = s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"), Vt.add(s);
-	let t = ws[s], e = Vt.size - gr;
-	if (e > gr / 10) {
-		for (let i of Vt) if (Vt.delete(i), delete ws[i], --e <= 0) break;
-	}
-	return t;
-};
-var so = (process.env.TESTING_TAR_FAKE_PLATFORM || process.platform) === "win32", ro = (s) => s.split("/").slice(0, -1).reduce((e, i) => {
-	let r = e.at(-1);
-	return r !== void 0 && (i = join(r, i)), e.push(i || "/"), e;
-}, []), Si = class {
-	#t = /* @__PURE__ */ new Map();
-	#i = /* @__PURE__ */ new Map();
-	#s = /* @__PURE__ */ new Set();
-	reserve(t, e) {
-		t = so ? ["win32 parallelization disabled"] : t.map((r) => mt(join(br(r))));
-		let i = new Set(t.map((r) => ro(r)).reduce((r, n) => r.concat(n)));
-		this.#i.set(e, {
-			dirs: i,
-			paths: t
-		});
-		for (let r of t) {
-			let n = this.#t.get(r);
-			n ? n.push(e) : this.#t.set(r, [e]);
-		}
-		for (let r of i) {
-			let n = this.#t.get(r);
-			if (!n) this.#t.set(r, [new Set([e])]);
-			else {
-				let o = n.at(-1);
-				o instanceof Set ? o.add(e) : n.push(new Set([e]));
-			}
-		}
-		return this.#r(e);
-	}
-	#n(t) {
-		let e = this.#i.get(t);
-		if (!e) throw new Error("function does not have any path reservations");
-		return {
-			paths: e.paths.map((i) => this.#t.get(i)),
-			dirs: [...e.dirs].map((i) => this.#t.get(i))
-		};
-	}
-	check(t) {
-		let { paths: e, dirs: i } = this.#n(t);
-		return e.every((r) => r && r[0] === t) && i.every((r) => r && r[0] instanceof Set && r[0].has(t));
-	}
-	#r(t) {
-		return this.#s.has(t) || !this.check(t) ? !1 : (this.#s.add(t), t(() => this.#e(t)), !0);
-	}
-	#e(t) {
-		if (!this.#s.has(t)) return !1;
-		let e = this.#i.get(t);
-		if (!e) throw new Error("invalid reservation");
-		let { paths: i, dirs: r } = e, n = /* @__PURE__ */ new Set();
-		for (let o of i) {
-			let a = this.#t.get(o);
-			if (!a || a?.[0] !== t) continue;
-			let h = a[1];
-			if (!h) {
-				this.#t.delete(o);
-				continue;
-			}
-			if (a.shift(), typeof h == "function") n.add(h);
-			else for (let l of h) n.add(l);
-		}
-		for (let o of r) {
-			let a = this.#t.get(o), h = a?.[0];
-			if (!(!a || !(h instanceof Set))) if (h.size === 1 && a.length === 1) {
-				this.#t.delete(o);
-				continue;
-			} else if (h.size === 1) {
-				a.shift();
-				let l = a[0];
-				typeof l == "function" && n.add(l);
-			} else h.delete(t);
-		}
-		return this.#s.delete(t), n.forEach((o) => this.#r(o)), !0;
-	}
-};
-var Or = () => process.umask();
-var Tr = Symbol("onEntry"), gs = Symbol("checkFs"), xr = Symbol("checkFs2"), bs = Symbol("isReusable"), P$1 = Symbol("makeFs"), _s = Symbol("file"), Os = Symbol("directory"), Ri = Symbol("link"), Lr = Symbol("symlink"), Nr = Symbol("hardlink"), ye = Symbol("ensureNoSymlink"), Dr = Symbol("unsupported"), Ar = Symbol("checkPath"), Ss = Symbol("stripAbsolutePath"), yt = Symbol("mkdir"), O$1 = Symbol("onError"), yi = Symbol("pending"), Ir = Symbol("pend"), $t = Symbol("unpend"), ys = Symbol("ended"), Rs = Symbol("maybeClose"), Ts = Symbol("skip"), Re = Symbol("doChown"), ge = Symbol("uid"), be = Symbol("gid"), _e = Symbol("checkedCwd"), Oe = (process.env.TESTING_TAR_FAKE_PLATFORM || process.platform) === "win32", ho = 1024, ao = (s, t) => {
-	if (!Oe) return Kt.unlink(s, t);
-	let e = s + ".DELETE." + randomBytes(16).toString("hex");
-	Kt.rename(s, e, (i) => {
-		if (i) return t(i);
-		Kt.unlink(e, t);
-	});
-}, lo = (s) => {
-	if (!Oe) return Kt.unlinkSync(s);
-	let t = s + ".DELETE." + randomBytes(16).toString("hex");
-	Kt.renameSync(s, t), Kt.unlinkSync(t);
-}, Fr = (s, t, e) => s !== void 0 && s === s >>> 0 ? s : t !== void 0 && t === t >>> 0 ? t : e, Xt = class extends st {
-	[ys] = !1;
-	[_e] = !1;
-	[yi] = 0;
-	reservations = new Si();
-	transform;
-	writable = !0;
-	readable = !1;
-	uid;
-	gid;
-	setOwner;
-	preserveOwner;
-	processGid;
-	processUid;
-	maxDepth;
-	forceChown;
-	win32;
-	newer;
-	keep;
-	noMtime;
-	preservePaths;
-	unlink;
-	cwd;
-	strip;
-	processUmask;
-	umask;
-	dmode;
-	fmode;
-	chmod;
-	constructor(t = {}) {
-		if (t.ondone = () => {
-			this[ys] = !0, this[Rs]();
-		}, super(t), this.transform = t.transform, this.chmod = !!t.chmod, typeof t.uid == "number" || typeof t.gid == "number") {
-			if (typeof t.uid != "number" || typeof t.gid != "number") throw new TypeError("cannot set owner without number uid and gid");
-			if (t.preserveOwner) throw new TypeError("cannot preserve owner in archive and also set owner explicitly");
-			this.uid = t.uid, this.gid = t.gid, this.setOwner = !0;
-		} else this.uid = void 0, this.gid = void 0, this.setOwner = !1;
-		this.preserveOwner = t.preserveOwner === void 0 && typeof t.uid != "number" ? !!(process.getuid && process.getuid() === 0) : !!t.preserveOwner, this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0, this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0, this.maxDepth = typeof t.maxDepth == "number" ? t.maxDepth : ho, this.forceChown = t.forceChown === !0, this.win32 = !!t.win32 || Oe, this.newer = !!t.newer, this.keep = !!t.keep, this.noMtime = !!t.noMtime, this.preservePaths = !!t.preservePaths, this.unlink = !!t.unlink, this.cwd = f$1(path.resolve(t.cwd || process.cwd())), this.strip = Number(t.strip) || 0, this.processUmask = this.chmod ? typeof t.processUmask == "number" ? t.processUmask : Or() : 0, this.umask = typeof t.umask == "number" ? t.umask : this.processUmask, this.dmode = t.dmode || 511 & ~this.umask, this.fmode = t.fmode || 438 & ~this.umask, this.on("entry", (e) => this[Tr](e));
-	}
-	warn(t, e, i = {}) {
-		return (t === "TAR_BAD_ARCHIVE" || t === "TAR_ABORT") && (i.recoverable = !1), super.warn(t, e, i);
-	}
-	[Rs]() {
-		this[ys] && this[yi] === 0 && (this.emit("prefinish"), this.emit("finish"), this.emit("end"));
-	}
-	[Ss](t, e) {
-		let i = t[e], { type: r } = t;
-		if (!i || this.preservePaths) return !0;
-		let [n, o] = le(i), a = o.replaceAll(/\\/g, "/").split("/");
-		if (a.includes("..") || Oe && /^[a-z]:\.\.$/i.test(a[0] ?? "")) {
-			if (e === "path" || r === "Link") return this.warn("TAR_ENTRY_ERROR", `${e} contains '..'`, {
-				entry: t,
-				[e]: i
-			}), !1;
-			let h = path.posix.dirname(t.path), l = path.posix.normalize(path.posix.join(h, a.join("/")));
-			if (l.startsWith("../") || l === "..") return this.warn("TAR_ENTRY_ERROR", `${e} escapes extraction directory`, {
-				entry: t,
-				[e]: i
-			}), !1;
-		}
-		return n && (t[e] = String(o), this.warn("TAR_ENTRY_INFO", `stripping ${n} from absolute ${e}`, {
-			entry: t,
-			[e]: i
-		})), !0;
-	}
-	[Ar](t) {
-		let e = f$1(t.path), i = e.split("/");
-		if (this.strip) {
-			if (i.length < this.strip) return !1;
-			if (t.type === "Link") {
-				let r = f$1(String(t.linkpath)).split("/");
-				if (r.length >= this.strip) t.linkpath = r.slice(this.strip).join("/");
-				else return !1;
-			}
-			i.splice(0, this.strip), t.path = i.join("/");
-		}
-		if (isFinite(this.maxDepth) && i.length > this.maxDepth) return this.warn("TAR_ENTRY_ERROR", "path excessively deep", {
-			entry: t,
-			path: e,
-			depth: i.length,
-			maxDepth: this.maxDepth
-		}), !1;
-		if (!this[Ss](t, "path") || !this[Ss](t, "linkpath")) return !1;
-		if (t.absolute = path.isAbsolute(t.path) ? f$1(path.resolve(t.path)) : f$1(path.resolve(this.cwd, t.path)), !this.preservePaths && typeof t.absolute == "string" && t.absolute.indexOf(this.cwd + "/") !== 0 && t.absolute !== this.cwd) return this.warn("TAR_ENTRY_ERROR", "path escaped extraction target", {
-			entry: t,
-			path: f$1(t.path),
-			resolvedPath: t.absolute,
-			cwd: this.cwd
-		}), !1;
-		if (t.absolute === this.cwd && t.type !== "Directory" && t.type !== "GNUDumpDir") return !1;
-		if (this.win32) {
-			let { root: r } = path.win32.parse(String(t.absolute));
-			t.absolute = r + Ji(String(t.absolute).slice(r.length));
-			let { root: n } = path.win32.parse(t.path);
-			t.path = n + Ji(t.path.slice(n.length));
-		}
-		return !0;
-	}
-	[Tr](t) {
-		if (!this[Ar](t)) return t.resume();
-		switch (no.equal(typeof t.absolute, "string"), t.type) {
-			case "Directory":
-			case "GNUDumpDir": t.mode && (t.mode = t.mode | 448);
-			case "File":
-			case "OldFile":
-			case "ContiguousFile":
-			case "Link":
-			case "SymbolicLink": return this[gs](t);
-			default: return this[Dr](t);
-		}
-	}
-	[O$1](t, e) {
-		t.name === "CwdError" ? this.emit("error", t) : (this.warn("TAR_ENTRY_ERROR", t, { entry: e }), this[$t](), e.resume());
-	}
-	[yt](t, e, i) {
-		Sr(f$1(t), {
-			uid: this.uid,
-			gid: this.gid,
-			processUid: this.processUid,
-			processGid: this.processGid,
-			umask: this.processUmask,
-			preserve: this.preservePaths,
-			unlink: this.unlink,
-			cwd: this.cwd,
-			mode: e
-		}, i);
-	}
-	[Re](t) {
-		return this.forceChown || this.preserveOwner && (typeof t.uid == "number" && t.uid !== this.processUid || typeof t.gid == "number" && t.gid !== this.processGid) || typeof this.uid == "number" && this.uid !== this.processUid || typeof this.gid == "number" && this.gid !== this.processGid;
-	}
-	[ge](t) {
-		return Fr(this.uid, t.uid, this.processUid);
-	}
-	[be](t) {
-		return Fr(this.gid, t.gid, this.processGid);
-	}
-	[_s](t, e) {
-		let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = new tt(String(t.absolute), {
-			flags: ds(t.size),
-			mode: i,
-			autoClose: !1
-		});
-		r.on("error", (h) => {
-			r.fd && Kt.close(r.fd, () => {}), r.write = () => !0, this[O$1](h, t), e();
-		});
-		let n = 1, o = (h) => {
-			if (h) {
-				r.fd && Kt.close(r.fd, () => {}), this[O$1](h, t), e();
-				return;
-			}
-			--n === 0 && r.fd !== void 0 && Kt.close(r.fd, (l) => {
-				l ? this[O$1](l, t) : this[$t](), e();
-			});
-		};
-		r.on("finish", () => {
-			let h = String(t.absolute), l = r.fd;
-			if (typeof l == "number" && t.mtime && !this.noMtime) {
-				n++;
-				let c = t.atime || /* @__PURE__ */ new Date(), d = t.mtime;
-				Kt.futimes(l, c, d, (S) => S ? Kt.utimes(h, c, d, (T) => o(T && S)) : o());
-			}
-			if (typeof l == "number" && this[Re](t)) {
-				n++;
-				let c = this[ge](t), d = this[be](t);
-				typeof c == "number" && typeof d == "number" && Kt.fchown(l, c, d, (S) => S ? Kt.chown(h, c, d, (T) => o(T && S)) : o());
-			}
-			o();
-		});
-		let a = this.transform && this.transform(t) || t;
-		a !== t && (a.on("error", (h) => {
-			this[O$1](h, t), e();
-		}), t.pipe(a)), a.pipe(r);
-	}
-	[Os](t, e) {
-		let i = typeof t.mode == "number" ? t.mode & 4095 : this.dmode;
-		this[yt](String(t.absolute), i, (r) => {
-			if (r) {
-				this[O$1](r, t), e();
-				return;
-			}
-			let n = 1, o = () => {
-				--n === 0 && (e(), this[$t](), t.resume());
-			};
-			t.mtime && !this.noMtime && (n++, Kt.utimes(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime, o)), this[Re](t) && (n++, Kt.chown(String(t.absolute), Number(this[ge](t)), Number(this[be](t)), o)), o();
-		});
-	}
-	[Dr](t) {
-		t.unsupported = !0, this.warn("TAR_ENTRY_UNSUPPORTED", `unsupported entry type: ${t.type}`, { entry: t }), t.resume();
-	}
-	[Lr](t, e) {
-		let i = f$1(path.relative(this.cwd, path.resolve(path.dirname(String(t.absolute)), String(t.linkpath)))).split("/");
-		this[ye](t, this.cwd, i, () => this[Ri](t, String(t.linkpath), "symlink", e), (r) => {
-			this[O$1](r, t), e();
-		});
-	}
-	[Nr](t, e) {
-		let i = f$1(path.resolve(this.cwd, String(t.linkpath))), r = f$1(String(t.linkpath)).split("/");
-		this[ye](t, this.cwd, r, () => this[Ri](t, i, "link", e), (n) => {
-			this[O$1](n, t), e();
-		});
-	}
-	[ye](t, e, i, r, n) {
-		let o = i.shift();
-		if (this.preservePaths || o === void 0) return r();
-		let a = path.resolve(e, o);
-		Kt.lstat(a, (h, l) => {
-			if (h) return r();
-			if (l?.isSymbolicLink()) return n(new St(a, path.resolve(a, i.join("/"))));
-			this[ye](t, a, i, r, n);
-		});
-	}
-	[Ir]() {
-		this[yi]++;
-	}
-	[$t]() {
-		this[yi]--, this[Rs]();
-	}
-	[Ts](t) {
-		this[$t](), t.resume();
-	}
-	[bs](t, e) {
-		return t.type === "File" && !this.unlink && e.isFile() && e.nlink <= 1 && !Oe;
-	}
-	[gs](t) {
-		this[Ir]();
-		let e = [t.path];
-		t.linkpath && e.push(t.linkpath), this.reservations.reserve(e, (i) => this[xr](t, i));
-	}
-	[xr](t, e) {
-		let i = (a) => {
-			e(a);
-		}, r = () => {
-			this[yt](this.cwd, this.dmode, (a) => {
-				if (a) {
-					this[O$1](a, t), i();
-					return;
-				}
-				this[_e] = !0, n();
-			});
-		}, n = () => {
-			if (t.absolute !== this.cwd) {
-				let a = f$1(path.dirname(String(t.absolute)));
-				if (a !== this.cwd) return this[yt](a, this.dmode, (h) => {
-					if (h) {
-						this[O$1](h, t), i();
-						return;
-					}
-					o();
-				});
-			}
-			o();
-		}, o = () => {
-			Kt.lstat(String(t.absolute), (a, h) => {
-				if (h && (this.keep || this.newer && h.mtime > (t.mtime ?? h.mtime))) {
-					this[Ts](t), i();
-					return;
-				}
-				if (a || this[bs](t, h)) return this[P$1](null, t, i);
-				if (h.isDirectory()) {
-					if (t.type === "Directory") {
-						let l = this.chmod && t.mode && (h.mode & 4095) !== t.mode, c = (d) => this[P$1](d ?? null, t, i);
-						return l ? Kt.chmod(String(t.absolute), Number(t.mode), c) : c();
-					}
-					if (t.absolute !== this.cwd) return Kt.rmdir(String(t.absolute), (l) => this[P$1](l ?? null, t, i));
-				}
-				if (t.absolute === this.cwd) return this[P$1](null, t, i);
-				ao(String(t.absolute), (l) => this[P$1](l ?? null, t, i));
-			});
-		};
-		this[_e] ? n() : r();
-	}
-	[P$1](t, e, i) {
-		if (t) {
-			this[O$1](t, e), i();
-			return;
-		}
-		switch (e.type) {
-			case "File":
-			case "OldFile":
-			case "ContiguousFile": return this[_s](e, i);
-			case "Link": return this[Nr](e, i);
-			case "SymbolicLink": return this[Lr](e, i);
-			case "Directory":
-			case "GNUDumpDir": return this[Os](e, i);
-		}
-	}
-	[Ri](t, e, i, r) {
-		Kt[i](e, String(t.absolute), (n) => {
-			n ? this[O$1](n, t) : (this[$t](), t.resume()), r();
-		});
-	}
-}, Se = (s) => {
-	try {
-		return [null, s()];
-	} catch (t) {
-		return [t, null];
-	}
-}, Te = class extends Xt {
-	sync = !0;
-	[P$1](t, e) {
-		return super[P$1](t, e, () => {});
-	}
-	[gs](t) {
-		if (!this[_e]) {
-			let n = this[yt](this.cwd, this.dmode);
-			if (n) return this[O$1](n, t);
-			this[_e] = !0;
-		}
-		if (t.absolute !== this.cwd) {
-			let n = f$1(path.dirname(String(t.absolute)));
-			if (n !== this.cwd) {
-				let o = this[yt](n, this.dmode);
-				if (o) return this[O$1](o, t);
-			}
-		}
-		let [e, i] = Se(() => Kt.lstatSync(String(t.absolute)));
-		if (i && (this.keep || this.newer && i.mtime > (t.mtime ?? i.mtime))) return this[Ts](t);
-		if (e || this[bs](t, i)) return this[P$1](null, t);
-		if (i.isDirectory()) {
-			if (t.type === "Directory") {
-				let [a] = this.chmod && t.mode && (i.mode & 4095) !== t.mode ? Se(() => {
-					Kt.chmodSync(String(t.absolute), Number(t.mode));
-				}) : [];
-				return this[P$1](a, t);
-			}
-			let [n] = Se(() => Kt.rmdirSync(String(t.absolute)));
-			this[P$1](n, t);
-		}
-		let [r] = t.absolute === this.cwd ? [] : Se(() => lo(String(t.absolute)));
-		this[P$1](r, t);
-	}
-	[_s](t, e) {
-		let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = (a) => {
-			let h;
-			try {
-				Kt.closeSync(n);
-			} catch (l) {
-				h = l;
-			}
-			(a || h) && this[O$1](a || h, t), e();
-		}, n;
-		try {
-			n = Kt.openSync(String(t.absolute), ds(t.size), i);
-		} catch (a) {
-			return r(a);
-		}
-		let o = this.transform && this.transform(t) || t;
-		o !== t && (o.on("error", (a) => this[O$1](a, t)), t.pipe(o)), o.on("data", (a) => {
-			try {
-				Kt.writeSync(n, a, 0, a.length);
-			} catch (h) {
-				r(h);
-			}
-		}), o.on("end", () => {
-			let a = null;
-			if (t.mtime && !this.noMtime) {
-				let h = t.atime || /* @__PURE__ */ new Date(), l = t.mtime;
-				try {
-					Kt.futimesSync(n, h, l);
-				} catch (c) {
-					try {
-						Kt.utimesSync(String(t.absolute), h, l);
-					} catch {
-						a = c;
-					}
-				}
-			}
-			if (this[Re](t)) {
-				let h = this[ge](t), l = this[be](t);
-				try {
-					Kt.fchownSync(n, Number(h), Number(l));
-				} catch (c) {
-					try {
-						Kt.chownSync(String(t.absolute), Number(h), Number(l));
-					} catch {
-						a = a || c;
-					}
-				}
-			}
-			r(a);
-		});
-	}
-	[Os](t, e) {
-		let i = typeof t.mode == "number" ? t.mode & 4095 : this.dmode, r = this[yt](String(t.absolute), i);
-		if (r) {
-			this[O$1](r, t), e();
-			return;
-		}
-		if (t.mtime && !this.noMtime) try {
-			Kt.utimesSync(String(t.absolute), t.atime || /* @__PURE__ */ new Date(), t.mtime);
-		} catch {}
-		if (this[Re](t)) try {
-			Kt.chownSync(String(t.absolute), Number(this[ge](t)), Number(this[be](t)));
-		} catch {}
-		e(), t.resume();
-	}
-	[yt](t, e) {
-		try {
-			return Rr(f$1(t), {
-				uid: this.uid,
-				gid: this.gid,
-				processUid: this.processUid,
-				processGid: this.processGid,
-				umask: this.processUmask,
-				preserve: this.preservePaths,
-				unlink: this.unlink,
-				cwd: this.cwd,
-				mode: e
-			});
-		} catch (i) {
-			return i;
-		}
-	}
-	[ye](t, e, i, r, n) {
-		if (this.preservePaths || i.length === 0) return r();
-		let o = e;
-		for (let a of i) {
-			o = path.resolve(o, a);
-			let [h, l] = Se(() => Kt.lstatSync(o));
-			if (h) return r();
-			if (l.isSymbolicLink()) return n(new St(o, path.resolve(e, i.join("/"))));
-		}
-		r();
-	}
-	[Ri](t, e, i, r) {
-		let n = `${i}Sync`;
-		try {
-			Kt[n](e, String(t.absolute)), r(), t.resume();
-		} catch (o) {
-			return this[O$1](o, t);
-		}
-	}
-}, co = (s) => {
-	let t = new Te(s), e = s.file, i = Kt.statSync(e);
-	new Me(e, {
-		readSize: s.maxReadSize || 16 * 1024 * 1024,
-		size: i.size
-	}).pipe(t);
-}, fo = (s, t) => {
-	let e = new Xt(s), i = s.maxReadSize || 16 * 1024 * 1024, r = s.file;
-	return new Promise((o, a) => {
-		e.on("error", a), e.on("close", o), Kt.stat(r, (h, l) => {
-			if (h) a(h);
-			else {
-				let c = new _t(r, {
-					readSize: i,
-					size: l.size
-				});
-				c.on("error", a), c.pipe(e);
-			}
-		});
-	});
-};
-K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
-	t?.length && Xi(s, t);
-});
-var mo = (s, t) => {
-	let e = new kt(s), i = !0, r, n;
-	try {
-		try {
-			r = Kt.openSync(s.file, "r+");
-		} catch (h) {
-			if (h?.code === "ENOENT") r = Kt.openSync(s.file, "w+");
-			else throw h;
-		}
-		let o = Kt.fstatSync(r), a = Buffer.alloc(512);
-		t: for (n = 0; n < o.size; n += 512) {
-			for (let c = 0, d = 0; c < 512; c += d) {
-				if (d = Kt.readSync(r, a, c, a.length - c, n + c), n === 0 && a[0] === 31 && a[1] === 139) throw new Error("cannot append to compressed archives");
-				if (!d) break t;
-			}
-			let h = new C$1(a);
-			if (!h.cksumValid) break;
-			let l = 512 * Math.ceil((h.size || 0) / 512);
-			if (n + l + 512 > o.size) break;
-			n += l, s.mtimeCache && h.mtime && s.mtimeCache.set(String(h.path), h.mtime);
-		}
-		i = !1, po(s, e, n, r, t);
-	} finally {
-		if (i) try {
-			Kt.closeSync(r);
-		} catch {}
-	}
-}, po = (s, t, e, i, r) => {
-	let n = new Wt(s.file, {
-		fd: i,
-		start: e
-	});
-	t.pipe(n), wo(t, r);
-}, Eo = (s, t) => {
-	t = Array.from(t);
-	let e = new wt(s), i = (n, o, a) => {
-		let h = (T, N) => {
-			T ? Kt.close(n, (E) => a(T)) : a(null, N);
-		}, l = 0;
-		if (o === 0) return h(null, 0);
-		let c = 0, d = Buffer.alloc(512), S = (T, N) => {
-			if (T || N === void 0) return h(T);
-			if (c += N, c < 512 && N) return Kt.read(n, d, c, d.length - c, l + c, S);
-			if (l === 0 && d[0] === 31 && d[1] === 139) return h(/* @__PURE__ */ new Error("cannot append to compressed archives"));
-			if (c < 512) return h(null, l);
-			let E = new C$1(d);
-			if (!E.cksumValid) return h(null, l);
-			let x = 512 * Math.ceil((E.size ?? 0) / 512);
-			if (l + x + 512 > o || (l += x + 512, l >= o)) return h(null, l);
-			s.mtimeCache && E.mtime && s.mtimeCache.set(String(E.path), E.mtime), c = 0, Kt.read(n, d, 0, 512, l, S);
-		};
-		Kt.read(n, d, 0, 512, l, S);
-	};
-	return new Promise((n, o) => {
-		e.on("error", o);
-		let a = "r+", h = (l, c) => {
-			if (l && l.code === "ENOENT" && a === "r+") return a = "w+", Kt.open(s.file, a, h);
-			if (l || !c) return o(l);
-			Kt.fstat(c, (d, S) => {
-				if (d) return Kt.close(c, () => o(d));
-				i(c, S.size, (T, N) => {
-					if (T) return o(T);
-					let E = new tt(s.file, {
-						fd: c,
-						start: N
-					});
-					e.pipe(E), E.on("error", o), E.on("close", n), So(e, t);
-				});
-			});
-		};
-		Kt.open(s.file, a, h);
-	});
-}, wo = (s, t) => {
-	t.forEach((e) => {
-		e.charAt(0) === "@" ? Ft({
-			file: path.resolve(s.cwd, e.slice(1)),
-			sync: !0,
-			noResume: !0,
-			onReadEntry: (i) => s.add(i)
-		}) : s.add(e);
-	}), s.end();
-}, So = async (s, t) => {
-	for (let e of t) e.charAt(0) === "@" ? await Ft({
-		file: path.resolve(String(s.cwd), e.slice(1)),
-		noResume: !0,
-		onReadEntry: (i) => s.add(i)
-	}) : s.add(e);
-	s.end();
-}, vt = K(mo, Eo, () => {
-	throw new TypeError("file is required");
-}, () => {
-	throw new TypeError("file is required");
-}, (s, t) => {
-	if (!vs(s)) throw new TypeError("file is required");
-	if (s.gzip || s.brotli || s.zstd || s.file.endsWith(".br") || s.file.endsWith(".tbr")) throw new TypeError("cannot append to compressed archives");
-	if (!t?.length) throw new TypeError("no paths specified to add/replace");
-});
-K(vt.syncFile, vt.asyncFile, vt.syncNoFile, vt.asyncNoFile, (s, t = []) => {
-	vt.validate?.(s, t), Ro(s);
-});
-var Ro = (s) => {
-	let t = s.filter;
-	s.mtimeCache || (s.mtimeCache = /* @__PURE__ */ new Map()), s.filter = t ? (e, i) => t(e, i) && !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0)) : (e, i) => !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0));
-};
-//#endregion
-//#region src/builtins/system-backup/system-backup.service.ts
-/**
-* Thrown when an archive build (or a backup run driving one) is
-* stopped via its `AbortSignal`. Callers use `instanceof` to tell a
-* deliberate operator cancel from a real failure — a cancelled run is
-* an outcome, not an error to alert on. (D342)
-*/
-var BackupCancelledError = class extends Error {
-	constructor(message = "backup run cancelled") {
-		super(message);
-		this.name = "BackupCancelledError";
-	}
-};
-/**
-* Thrown when an archive would carry a live database and its owner could not
-* produce a verified snapshot of it (D693). Nothing was built: a run that
-* "succeeded" without the database — or with a torn copy of it — would push
-* the oldest good archive out of every destination's retention.
-*/
-var BackupSnapshotRefusedError = class extends Error {
-	constructor(reason) {
-		super(`settings database snapshot failed — no archive built, nothing uploaded, retention untouched: ${reason}`);
-		this.name = "BackupSnapshotRefusedError";
-	}
-};
-/**
-* Settle with `pending`, or reject with {@link BackupCancelledError} as soon as
-* `signal` fires. A pending call abandoned by the cancel still settles later:
-* `onAbandoned` runs then, to clean up what it produced.
-*/
-function raceAbort(pending, signal, onAbandoned) {
-	if (signal === void 0) return pending;
-	return new Promise((resolve, reject) => {
-		let abandoned = false;
-		const onAbort = () => {
-			abandoned = true;
-			reject(new BackupCancelledError());
-		};
-		if (signal.aborted) onAbort();
-		else signal.addEventListener("abort", onAbort, { once: true });
-		pending.then((value) => {
-			signal.removeEventListener("abort", onAbort);
-			if (abandoned) onAbandoned();
-			else resolve(value);
-		}, (err) => {
-			signal.removeEventListener("abort", onAbort);
-			if (abandoned) onAbandoned();
-			else reject(err);
-		});
-	});
-}
-/** Throw `BackupCancelledError` when the signal has fired. */
-function throwIfCancelled(signal) {
-	if (signal?.aborted) throw new BackupCancelledError();
-}
-/**
-* Default set of paths considered part of a "system backup". Includes
-* everything that isn't pure backend code — config, sqlite, addons
-* (runtime overlay), addons-data (per-addon private dir), TLS certs,
-* auto-update marker.
-*
-* Anything not listed is excluded by omission — recordings/, media/,
-* models/, logs/, cache/ (too large or fully recreatable). Note this
-* covers only TOP-LEVEL trees: bulk nested INSIDE a listed location
-* is excluded via `DEFAULT_BACKUP_EXCLUDES` + the node_modules rule
-* below, enforced in the walk and the tar filter alike.
-*/
-var DEFAULT_BACKUP_LOCATIONS = [
-	"config.yaml",
-	"addons",
-	"addons-data",
-	"tls",
-	"auto-update.json"
-];
-/**
-* Subtrees never captured by a system backup even though they live
-* under a `DEFAULT_BACKUP_LOCATIONS` entry. Paths are dataDir-relative
-* prefixes. Two lessons from the live hub (2026-09-04, D-record
-* "backup excludes"):
-*
-* - `addons-data/backup-orchestrator/staging` — the orchestrator's
-*   LEGACY staging dir (now `<dataDir>/backup-staging`, outside every
-*   location). Before Jul 28 every archive nested all previous
-*   archives (175M → 503M → 4.5G); leaked files from that era must
-*   never be re-swept into new backups.
-* - `addons-data/recorder/exports` — operator-exported clips (8.4 GB
-*   on the hub). Media, not system state; a restore has no use for it.
-*/
-var DEFAULT_BACKUP_EXCLUDES = ["addons-data/backup-orchestrator/staging", "addons-data/recorder/exports"];
-/**
-* Directory name excluded wherever it appears in the tree.
-* `AddonInstaller` materialises runtime deps under
-* `addons/@camstack/<addon>/node_modules` (~196 MB on the hub); only
-* built `dist` + package.json + assets are restore-worthy — deps are
-* reinstalled from npm on demand. node_modules is NEVER archived.
-*/
-var EXCLUDED_DIR_NAME = "node_modules";
-/**
-* True when a dataDir-relative path must be omitted from archives,
-* manifests and location stats. Accepts tar-style paths (`./` prefix,
-* trailing `/`) and backslash separators.
-*/
-function isExcludedFromBackup(relPath) {
-	const norm = normalizeArchivePath(relPath);
-	if (norm.length === 0) return false;
-	const segments = norm.split("/");
-	if (segments.includes(EXCLUDED_DIR_NAME)) return true;
-	if (segments.some((seg) => seg.endsWith(".backup-snapshot-partial"))) return true;
-	if (norm.endsWith(".backup-snapshot")) return true;
-	return DEFAULT_BACKUP_EXCLUDES.some((prefix) => norm === prefix || norm.startsWith(`${prefix}/`));
-}
-/** `./a/b/` and `a\\b` → `a/b`: the one spelling every archive-path comparison uses. */
-function normalizeArchivePath(relPath) {
-	return relPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
-}
-/** The files SQLite keeps beside a database. A live one is never archived. */
-var SQLITE_SIDECAR_SUFFIXES = [
-	"-wal",
-	"-shm",
-	"-journal"
-];
-var SQLITE_DATABASE_SUFFIXES = [
-	".db",
-	".sqlite",
-	".sqlite3"
-];
-/**
-* The database a `-wal` / `-shm` / `-journal` belongs to, or null for any other
-* path. The base must name a database (`.db` / `.sqlite` / `.sqlite3`): a
-* `build-journal` is not a sidecar, and must not stop every backup as a "live
-* database" that does not exist.
-*/
-function databaseOfSidecar(relPath) {
-	for (const suffix of SQLITE_SIDECAR_SUFFIXES) {
-		if (!relPath.endsWith(suffix)) continue;
-		const db = relPath.slice(0, -suffix.length);
-		return SQLITE_DATABASE_SUFFIXES.some((dbSuffix) => db.endsWith(dbSuffix)) ? db : null;
-	}
-	return null;
-}
-/** A SQLite database file, or a sidecar of one. */
-function isSqlitePath(relPath) {
-	const db = databaseOfSidecar(relPath) ?? relPath;
-	return SQLITE_DATABASE_SUFFIXES.some((suffix) => db.endsWith(suffix));
-}
-/** Path of the manifest file embedded inside every archive. */
-var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
-var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
-/**
-* System-level archive primitives. Construct one per server boot;
-* methods are pure I/O.
-*/
-var SystemBackupService = class {
-	dataDir;
-	logger;
-	statCacheTtlMs;
-	statCache = /* @__PURE__ */ new Map();
-	constructor(dataDir, logger, opts) {
-		this.dataDir = dataDir;
-		this.logger = logger;
-		this.statCacheTtlMs = opts?.statCacheTtlMs ?? DEFAULT_STAT_CACHE_TTL_MS;
-	}
-	/**
-	* Snapshot the current size + file count of each well-known
-	* location. Used by the admin UI to render an opt-in checklist
-	* before triggering a backup, and by `createArchive` to derive the
-	* embedded manifest.
-	*
-	* The walk is async (yields to the event loop per directory) and
-	* per-location results are cached + single-flighted: the service
-	* runs in-process in the hub, and a synchronous walk of the 70k+
-	* file `addons` location blocked the event loop long enough to kill
-	* WS keepalives cluster-wide.
-	*/
-	statLocations(locations = DEFAULT_BACKUP_LOCATIONS) {
-		return Promise.all(locations.map((loc) => this.statLocationCached(loc)));
-	}
-	statLocationCached(loc) {
-		const now = Date.now();
-		const hit = this.statCache.get(loc);
-		if (hit && now - hit.at < this.statCacheTtlMs) return hit.value;
-		const value = this.statLocation(loc);
-		this.statCache.set(loc, {
-			at: now,
-			value
-		});
-		value.catch(() => this.statCache.delete(loc));
-		return value;
-	}
-	async statLocation(loc) {
-		const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
-		if (!fs.existsSync(abs)) return {
-			name: loc,
-			sizeBytes: 0,
-			fileCount: 0,
-			present: false
-		};
-		const walked = await walkAbs(abs, abs, this.exclusionPredicate());
-		return {
-			name: loc,
-			sizeBytes: walked.reduce((acc, e) => acc + e.sizeBytes, 0),
-			fileCount: walked.filter((e) => e.kind === "file").length,
-			present: true
-		};
-	}
-	/**
-	* Create a tar.gz of the given locations. Uses the `tar` npm package
-	* (used by npm itself) instead of shelling out — gives us:
-	*
-	*   - Symlink dereference (`follow: true`) so dev mode's
-	*     `addons/<name> → packages/<name>` overlay archives content,
-	*     not just link stubs.
-	*   - Programmatic walk → we build a manifest of every entry while
-	*     copying so the archive can self-describe.
-	*
-	* Locations that don't exist are silently skipped. Throws if zero
-	* locations would be included.
-	*
-	* Cancellation: `signal` aborts the build IN FLIGHT — the manifest
-	* walk checks it per filesystem node and the tar phase runs through
-	* `stream.pipeline(..., { signal })`, which destroys the pack and
-	* the file sink immediately. On abort the half-written archive is
-	* deleted here (never left for the caller to remember) and the call
-	* rejects with {@link BackupCancelledError}. (D342)
-	*
-	* Progress: `onArchiveBytes` receives the cumulative compressed
-	* bytes written to `archivePath` — the live "how large has staging
-	* grown" counter `backup.listRuns` exposes.
-	*/
-	async createArchive(opts) {
-		throwIfCancelled(opts.signal);
-		const requested = opts.locations ?? DEFAULT_BACKUP_LOCATIONS;
-		const present = [];
-		for (const loc of requested) {
-			const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
-			if (fs.existsSync(abs)) present.push(loc);
-			else this.logger.debug("createArchive: skipping missing location", { meta: { location: loc } });
-		}
-		if (present.length === 0) throw new Error(`createArchive: no locations from {${requested.join(", ")}} exist under ${this.dataDir}`);
-		fs.mkdirSync(path$1.dirname(opts.archivePath), { recursive: true });
-		const walked = [];
-		for (const loc of present) {
-			throwIfCancelled(opts.signal);
-			const abs = path$1.join(this.dataDir, loc);
-			const stat = await fsp.stat(abs);
-			if (stat.isDirectory()) for (const e of await walkAbs(abs, this.dataDir, this.exclusionPredicate(), opts.signal)) walked.push(e);
-			else if (!isExcludedFromBackup(path$1.relative(this.dataDir, abs))) walked.push(toArchiveEntry(abs, this.dataDir, stat));
-		}
-		const walkedPaths = new Set(walked.map((e) => e.path));
-		const owned = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Set();
-		const unowned = /* @__PURE__ */ new Set();
-		for (const e of walked) {
-			const db = databaseOfSidecar(e.path);
-			if (db !== null && !owned.has(db)) unowned.add(db);
-		}
-		if (unowned.size > 0) {
-			const databases = [...unowned].sort();
-			this.logger.error("createArchive: a live SQLite database has no owner snapshot — no archive built", { meta: {
-				databases,
-				archivePath: opts.archivePath
-			} });
-			throw new BackupSnapshotRefusedError(`live SQLite database ${databases.join(", ")} has no owner that can snapshot it — a copy of its files would be torn; remove its stale -wal/-shm/-journal if nothing has it open, or leave its location out of the backup`);
-		}
-		const snapshot = owned.size > 0 && opts.owner ? await this.takeOwnerSnapshot(opts.owner, owned, opts.signal) : null;
-		try {
-			const liveFiles = /* @__PURE__ */ new Set();
-			for (const db of owned) {
-				liveFiles.add(db);
-				for (const suffix of SQLITE_SIDECAR_SUFFIXES) liveFiles.add(db + suffix);
-			}
-			const entries = walked.filter((e) => !liveFiles.has(e.path));
-			if (snapshot !== null) entries.push(snapshot.entry);
-			const manifest = {
-				archiveVersion: 1,
-				createdAt: Date.now(),
-				dataDir: this.dataDir,
-				locations: present,
-				entries,
-				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
-				totalFiles: entries.filter((e) => e.kind === "file").length,
-				...snapshot !== null ? { sqliteSnapshots: [snapshot.archived] } : {}
-			};
-			const carriedSnapshot = snapshot?.archived.snapshotPath ?? null;
-			return await this.writeArchive({
-				archivePath: opts.archivePath,
-				present,
-				manifest,
-				excluded: (rel) => {
-					if (rel === carriedSnapshot) return false;
-					return liveFiles.has(rel) || isExcludedFromBackup(rel);
-				},
-				...opts.signal ? { signal: opts.signal } : {},
-				...opts.onArchiveBytes ? { onArchiveBytes: opts.onArchiveBytes } : {}
-			});
-		} finally {
-			if (snapshot !== null) await this.removeSnapshot(snapshot.absPath);
-		}
-	}
-	/**
-	* Tar `present` (filtered by `excluded`) plus the staged manifest into
-	* `archivePath`.
-	*/
-	async writeArchive(opts) {
-		const { present, manifest } = opts;
-		const manifestStagePath = `${opts.archivePath}.${process.pid}.manifest.json`;
-		fs.writeFileSync(manifestStagePath, JSON.stringify(manifest, null, 2), "utf-8");
-		this.logger.info("createArchive: tarring", { meta: {
-			archivePath: opts.archivePath,
-			locations: [...present],
-			totalFiles: manifest.totalFiles,
-			totalBytes: manifest.totalBytes
-		} });
-		try {
-			const stagedInDataDir = path$1.join(this.dataDir, ARCHIVE_MANIFEST_NAME);
-			fs.copyFileSync(manifestStagePath, stagedInDataDir);
-			const stagingRel = path$1.relative(this.dataDir, path$1.dirname(opts.archivePath));
-			const excludePrefix = stagingRel && !stagingRel.startsWith("..") && !path$1.isAbsolute(stagingRel) ? stagingRel : null;
-			try {
-				const pack = Kn({
-					gzip: true,
-					cwd: this.dataDir,
-					follow: true,
-					portable: true,
-					filter: (entryPath) => {
-						const norm = normalizeArchivePath(entryPath);
-						if (opts.excluded(norm)) return false;
-						if (!excludePrefix) return true;
-						return norm !== excludePrefix && !norm.startsWith(`${excludePrefix}/`);
-					}
-				}, [ARCHIVE_MANIFEST_NAME, ...present]);
-				const sink = fs.createWriteStream(opts.archivePath);
-				try {
-					await pipeline(pack, byteCountingPassthrough(opts.onArchiveBytes), sink, opts.signal ? { signal: opts.signal } : {});
-				} catch (err) {
-					try {
-						fs.rmSync(opts.archivePath, { force: true });
-					} catch {}
-					if (opts.signal?.aborted) throw new BackupCancelledError();
-					throw err;
-				}
-			} finally {
-				try {
-					fs.rmSync(stagedInDataDir, { force: true });
-				} catch {}
-			}
-		} finally {
-			try {
-				fs.rmSync(manifestStagePath, { force: true });
-			} catch {}
-		}
-		const sizeBytes = fs.statSync(opts.archivePath).size;
-		return {
-			archivePath: opts.archivePath,
-			includedLocations: [...present],
-			sizeBytes,
-			manifest
-		};
-	}
-	/**
-	* without extracting payload files. Streams the tar.gz, parses the
-	* one entry we care about, then aborts.
-	*/
-	async readArchiveManifest(archivePath) {
-		if (!fs.existsSync(archivePath)) throw new Error(`readArchiveManifest: ${archivePath} does not exist`);
-		return new Promise((resolve, reject) => {
-			const chunks = [];
-			let found = false;
-			let resolved = false;
-			const parser = new st({ onentry: (entry) => {
-				if (entry.path === ".camstack-backup-manifest.json" && !found) {
-					found = true;
-					entry.on("data", (chunk) => chunks.push(chunk));
-					entry.on("end", () => {
-						try {
-							const json = Buffer.concat(chunks).toString("utf-8");
-							const parsed = JSON.parse(json);
-							resolved = true;
-							resolve(parsed);
-						} catch (err) {
-							resolved = true;
-							reject(err instanceof Error ? err : new Error(String(err)));
-						}
-					});
-				} else entry.resume();
-			} });
-			parser.on("end", () => {
-				if (!resolved) resolve(found ? null : null);
-			});
-			const gunzip = zlib.createGunzip();
-			gunzip.on("error", (err) => {
-				if (!resolved) {
-					resolved = true;
-					reject(err);
-				}
-			});
-			const reader = fs.createReadStream(archivePath);
-			reader.on("error", (err) => {
-				if (!resolved) {
-					resolved = true;
-					reject(err);
-				}
-			});
-			reader.pipe(gunzip).pipe(parser);
-		});
-	}
-	/**
-	* Schedule a restore for the next boot by writing a marker file.
-	* `locations` (optional) carries through to the launcher's boot-time
-	* restore (`server/backend/src/launcher.ts`, the only restore there is)
-	* so the operator's "restore only X and Y" choice survives the process
-	* restart.
-	*/
-	scheduleRestoreMarker(opts) {
-		if (!fs.existsSync(opts.archivePath)) throw new Error(`scheduleRestoreMarker: ${opts.archivePath} missing`);
-		const markerPath = this.getRestoreMarkerPath();
-		const marker = {
-			archivePath: opts.archivePath,
-			requestedAt: Date.now(),
-			source: opts.source,
-			...opts.locations ? { locations: [...opts.locations] } : {}
-		};
-		fs.mkdirSync(path$1.dirname(markerPath), { recursive: true });
-		fs.writeFileSync(markerPath, JSON.stringify(marker, null, 2), { mode: 384 });
-		return markerPath;
-	}
-	/** Read the pending-restore marker if one is present. */
-	readPendingMarker() {
-		const markerPath = this.getRestoreMarkerPath();
-		if (!fs.existsSync(markerPath)) return null;
-		try {
-			const raw = fs.readFileSync(markerPath, "utf-8");
-			const parsed = JSON.parse(raw);
-			if (typeof parsed === "object" && parsed != null && typeof parsed.archivePath === "string") return parsed;
-		} catch (err) {
-			this.logger.warn("readPendingMarker: malformed marker — ignoring", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		}
-		return null;
-	}
-	/** Drop the marker after a successful boot-time restore. */
-	clearPendingMarker() {
-		const markerPath = this.getRestoreMarkerPath();
-		if (fs.existsSync(markerPath)) fs.rmSync(markerPath, { force: true });
-	}
-	/**
-	* The databases the owner declares, archive-relative, that this walk found.
-	* One outside this data root is not in scope. An owner that cannot answer
-	* stops the archive: without the answer, nothing says which file is live.
-	*/
-	async ownedDatabasesInScope(owner, walked) {
-		if (owner === void 0) return /* @__PURE__ */ new Set();
-		let declared;
-		try {
-			declared = await owner.listDatabases();
-		} catch (err) {
-			const reason = err instanceof Error ? err.message : String(err);
-			this.logger.error("createArchive: the database owner did not say what it owns — no archive built", { meta: { error: reason } });
-			throw new BackupSnapshotRefusedError(`the database owner could not be asked: ${reason}`);
-		}
-		const inScope = /* @__PURE__ */ new Set();
-		for (const abs of declared) {
-			const rel = this.archiveRelative(abs);
-			if (rel !== null && walked.has(rel)) inScope.add(rel);
-		}
-		return inScope;
-	}
-	/**
-	* Ask the owner for its snapshot, and place it in this archive. The snapshot
-	* must sit on THIS data root — the call is pinned to this node, so a path
-	* elsewhere means it reached another host, and that file is not ours to
-	* read — beside an owned database in scope, and it must cover EVERY owned
-	* database in scope. Anything else is refused.
-	*
-	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
-	* a name this process derives itself. A path the owner ANSWERS is never
-	* deleted on its word — answering the live database as the snapshot would
-	* otherwise delete the live database. A file at any other path is left to
-	* the owner's own sweep.
-	*
-	* A cancel is honoured while the owner is still copying; the copy it may
-	* finish afterwards is removed when that call settles.
-	*/
-	async takeOwnerSnapshot(owner, owned, signal) {
-		const removeOwnedSnapshots = async () => {
-			for (const db of owned) await this.removeSnapshot(path$1.join(this.dataDir, db + DATABASE_SNAPSHOT_SUFFIX));
-		};
-		let result;
-		try {
-			result = await raceAbort(owner.writeSnapshot(), signal, () => {
-				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: { databases: [...owned] } });
-				return removeOwnedSnapshots();
-			});
-		} catch (err) {
-			if (err instanceof BackupCancelledError) throw err;
-			const reason = err instanceof Error ? err.message : String(err);
-			this.logger.error("createArchive: the owner could not snapshot its live database — no archive built", { meta: {
-				databases: [...owned],
-				error: reason
-			} });
-			await removeOwnedSnapshots();
-			throw new BackupSnapshotRefusedError(reason);
-		}
-		try {
-			const livePath = this.archiveRelative(result.livePath);
-			const snapshotPath = this.archiveRelative(result.snapshotPath);
-			if (livePath === null || snapshotPath === null) {
-				this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
-					snapshot: result.snapshotPath,
-					dataDir: this.dataDir
-				} });
-				throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
-			}
-			if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
-			const uncovered = [...owned].filter((db) => db !== livePath);
-			if (!owned.has(livePath) || uncovered.length > 0) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath}, but the owned database(s) in this archive are ${[...owned].join(", ")}`);
-			const absPath = path$1.join(this.dataDir, snapshotPath);
-			const stat = await fsp.stat(absPath);
-			this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
-				database: livePath,
-				snapshot: snapshotPath,
-				sizeBytes: stat.size,
-				tables: result.tables.length,
-				copyMs: result.copyMs,
-				verifyMs: result.verifyMs
-			} });
-			return {
-				absPath,
-				archived: {
-					...result,
-					livePath,
-					snapshotPath
-				},
-				entry: toArchiveEntry(absPath, this.dataDir, stat)
-			};
-		} catch (err) {
-			await removeOwnedSnapshots();
-			throw err;
-		}
-	}
-	async removeSnapshot(absPath) {
-		try {
-			await fsp.rm(absPath, { force: true });
-		} catch (err) {
-			this.logger.warn("createArchive: owner snapshot could not be removed", { meta: {
-				snapshot: absPath,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		}
-	}
-	/** `abs` relative to the data root, or null when it lies outside it. */
-	archiveRelative(abs) {
-		const rel = path$1.relative(path$1.resolve(this.dataDir), path$1.resolve(abs));
-		if (rel.length === 0 || rel.startsWith("..") || path$1.isAbsolute(rel)) return null;
-		return normalizeArchivePath(rel);
-	}
-	getRestoreMarkerPath() {
-		return path$1.join(this.dataDir, ".pending-restore.json");
-	}
-	/**
-	* Absolute-path form of {@link isExcludedFromBackup}, anchored on
-	* this service's dataDir. Shared by the manifest walk and the location
-	* stats so both agree with the tar filter about what a backup contains.
-	*/
-	exclusionPredicate() {
-		return (abs) => isExcludedFromBackup(path$1.relative(this.dataDir, abs));
-	}
-};
-/**
-* Recursively walk a directory and produce one `ArchiveEntry` per
-* filesystem node. `dataDir` is used to compute the archive-relative
-* path. Symlinks are dereferenced (matches the `follow: true` flag we
-* pass to tar.create).
-*/
-async function walkAbs(absRoot, dataDir, shouldSkip, signal) {
-	const out = [];
-	await walkRec(absRoot, dataDir, out, shouldSkip, signal);
-	return out;
-}
-async function walkRec(abs, dataDir, out, shouldSkip, signal) {
-	throwIfCancelled(signal);
-	if (shouldSkip?.(abs)) return;
-	let stat;
-	try {
-		stat = await fsp.stat(abs);
-	} catch {
-		return;
-	}
-	out.push(toArchiveEntry(abs, dataDir, stat));
-	if (stat.isDirectory()) {
-		let children;
-		try {
-			children = await fsp.readdir(abs);
-		} catch {
-			return;
-		}
-		for (const child of children) await walkRec(path$1.join(abs, child), dataDir, out, shouldSkip, signal);
-	}
-}
-/**
-* Pass-through transform that reports the CUMULATIVE bytes flowed so
-* far. Sits between the tar pack and the file sink so the caller's
-* progress counter tracks the compressed archive as it grows on disk.
-*/
-function byteCountingPassthrough(onBytes) {
-	let total = 0;
-	return new Transform({ transform(chunk, _encoding, callback) {
-		if (Buffer.isBuffer(chunk)) total += chunk.byteLength;
-		onBytes?.(total);
-		callback(null, chunk);
-	} });
-}
-function toArchiveEntry(abs, dataDir, stat) {
-	const rel = path$1.relative(dataDir, abs).replace(/\\/g, "/");
-	const kind = stat.isDirectory() ? "dir" : stat.isSymbolicLink() ? "symlink" : "file";
-	return {
-		path: rel || path$1.basename(abs),
-		kind,
-		sizeBytes: kind === "file" ? stat.size : 0,
-		mtime: stat.mtimeMs
-	};
-}
-//#endregion
 //#region ../../node_modules/croner/dist/croner.js
 function T(s) {
 	return Date.UTC(s.y, s.m - 1, s.d, s.h, s.i, s.s);
@@ -4678,6 +1073,131 @@ async function downloadArchiveToCache(input) {
 	}
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/encryption-key-store.ts
+/**
+* @durable class=config owner=backup-orchestrator
+*   write="`setupEncryption` inserts one row per generated key and retires the
+*     previous active row; `disableEncryption` retires the active row"
+*   retention="none — one small row per key ever generated; a retired row
+*     names the key older archives need"
+*/
+var BACKUP_ENCRYPTION_KEYS_COLLECTION = "backup_encryption_keys";
+var COLUMNS = [
+	{
+		name: "key_id",
+		type: "TEXT",
+		primaryKey: true
+	},
+	{
+		name: "public_key",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "created_at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "retired_at",
+		type: "INTEGER"
+	}
+];
+var BackupEncryptionKeyStore = class {
+	store;
+	now;
+	declared = false;
+	constructor(store, now = Date.now) {
+		this.store = store;
+		this.now = now;
+	}
+	async ensureDeclared() {
+		if (this.declared) return;
+		await this.store.declareCollection({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			columns: COLUMNS
+		});
+		this.declared = true;
+	}
+	/** Every key, newest first. */
+	async list() {
+		await this.ensureDeclared();
+		const rows = await this.store.query({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			filter: { orderBy: {
+				field: "created_at",
+				direction: "desc"
+			} }
+		});
+		const out = [];
+		for (const row of rows) {
+			const record = toRecord(row.data);
+			if (record !== null) out.push(record);
+		}
+		return out;
+	}
+	/** The key new archives are encrypted to; `null` = encryption off. */
+	async active() {
+		return (await this.list()).find((k) => k.retiredAt === null) ?? null;
+	}
+	/** Make `publicKey` the active key; the previous one is retired, kept listed. */
+	async activate(input) {
+		const parsed = parseBackupPublicKey(input.publicKey);
+		const t = this.now();
+		await this.retireActive(t);
+		const record = {
+			keyId: parsed.keyId,
+			publicKey: input.publicKey.trim(),
+			createdAt: t,
+			retiredAt: null
+		};
+		await this.write(record);
+		return record;
+	}
+	/** Encryption off: the active key is retired. Archives already made keep needing it. */
+	async disable() {
+		await this.retireActive(this.now());
+	}
+	async retireActive(at) {
+		for (const key of await this.list()) if (key.retiredAt === null) await this.write({
+			...key,
+			retiredAt: at
+		});
+	}
+	async write(record) {
+		await this.ensureDeclared();
+		await this.store.deleteWhere({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			filter: { where: { key_id: record.keyId } }
+		});
+		await this.store.insert({
+			collection: BACKUP_ENCRYPTION_KEYS_COLLECTION,
+			record: {
+				id: record.keyId,
+				data: {
+					key_id: record.keyId,
+					public_key: record.publicKey,
+					created_at: record.createdAt,
+					retired_at: record.retiredAt
+				}
+			}
+		});
+	}
+};
+function toRecord(row) {
+	const keyId = row["key_id"];
+	const publicKey = row["public_key"];
+	const createdAt = row["created_at"];
+	if (typeof keyId !== "string" || typeof publicKey !== "string") return null;
+	const retired = row["retired_at"];
+	return {
+		keyId,
+		publicKey,
+		createdAt: typeof createdAt === "number" ? createdAt : Number(createdAt ?? 0),
+		retiredAt: typeof retired === "number" ? retired : null
+	};
+}
+//#endregion
 //#region src/builtins/backup-orchestrator/manifest-store.ts
 /** File path (relative to the location root) where the index lives. */
 var MANIFESTS_FILENAME = "manifests.json";
@@ -4748,7 +1268,8 @@ function normalizeManifest(raw) {
 			createdAt: Number(cand["createdAt"]),
 			sizeBytes: Number(cand["sizeBytes"]),
 			...typeof cand["label"] === "string" ? { label: cand["label"] } : {},
-			manifest
+			manifest,
+			...encryptionOf(cand["encryption"])
 		};
 		archives.push(entry);
 	}
@@ -4761,6 +1282,32 @@ var EMPTY_MANIFEST = {
 	version: 1,
 	archives: []
 };
+function encryptionOf(raw) {
+	if (typeof raw !== "object" || raw === null) return {};
+	const scheme = Reflect.get(raw, "scheme");
+	const keyId = Reflect.get(raw, "keyId");
+	if (typeof scheme !== "string" || typeof keyId !== "string") return {};
+	return { encryption: {
+		scheme,
+		keyId
+	} };
+}
+/**
+* What the destination's clear-text index may say about an encrypted archive:
+* the outline a restore needs (locations, sizes, the snapshot promise) — not
+* the list of files, which stays inside the ciphertext.
+*/
+function outlineOfManifest(manifest) {
+	return {
+		archiveVersion: manifest.archiveVersion,
+		createdAt: manifest.createdAt,
+		dataDir: manifest.dataDir,
+		locations: [...manifest.locations],
+		entries: [],
+		totalBytes: manifest.totalBytes,
+		totalFiles: manifest.totalFiles
+	};
+}
 /**
 * Build a `ManifestArchiveEntry` from the raw inputs collected during
 * a successful upload. Pure transform — no I/O — kept here so the
@@ -4773,7 +1320,8 @@ function buildArchiveEntry(input) {
 		createdAt: input.createdAt,
 		sizeBytes: input.sizeBytes,
 		...input.label !== void 0 ? { label: input.label } : {},
-		manifest: input.manifest
+		manifest: input.encryption !== void 0 ? outlineOfManifest(input.manifest) : input.manifest,
+		...input.encryption !== void 0 ? { encryption: input.encryption } : {}
 	};
 }
 /**
@@ -5466,6 +2014,9 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 	systemBackup = null;
 	policies = null;
 	schedules = null;
+	/** Backup encryption keys — PUBLIC keys only (see encryption-key-store.ts). */
+	encryptionKeys = null;
+	warnedNoEncryptionStore = false;
 	dataDir = "";
 	/**
 	* Transient build buffer for archive fan-out. The tar is built here
@@ -5521,6 +2072,8 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			this.ctx.logger.error("backup-orchestrator: schedule table init failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			this.schedules = null;
 		}
+		const settingsStore = this.ctx.kernel.capabilityRegistry?.getSingleton("settings-store");
+		this.encryptionKeys = settingsStore ? new BackupEncryptionKeyStore(settingsStore) : null;
 		const provider = {
 			listDestinations: () => this.listDestinations(),
 			list: () => this.aggregatedList(),
@@ -5530,6 +2083,10 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			cancel: (input) => this.cancelRun(input),
 			getEntries: (input) => this.getEntries(input),
 			restore: (input) => this.scheduleRestore(input),
+			getEncryption: () => this.getEncryption(),
+			setupEncryption: () => this.setupEncryption(),
+			disableEncryption: () => this.disableEncryption(),
+			checkBackupKey: (input) => this.checkBackupKey(input),
 			delete: (input) => this.deleteArchive(input),
 			listArchives: (input) => this.listArchives(input),
 			upsertDestinationPolicy: (input) => this.upsertDestinationPolicy(input),
@@ -5753,7 +2310,8 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 					createdAt: a.createdAt,
 					sizeBytes: a.sizeBytes,
 					...a.label !== void 0 ? { label: a.label } : {},
-					locations: [...a.manifest.locations]
+					locations: [...a.manifest.locations],
+					...a.encryption !== void 0 ? { encryption: a.encryption } : {}
 				};
 				out.push(entry);
 			}
@@ -5881,8 +2439,9 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		}
 		progress.setDestinations(targets.map((t) => t.id));
 		const policies = await this.loadPoliciesIndexed(targets.map((t) => t.id));
+		const encryptTo = await this.activeEncryptionKey();
 		const archiveId = randomUUID();
-		const archiveFilename = `${archiveId}.tar.gz`;
+		const archiveFilename = encryptTo === null ? `${archiveId}.tar.gz` : `${archiveId}.tar.gz${ENCRYPTED_BACKUP_SUFFIX}`;
 		const cachePath = await this.stagingPath(archiveFilename);
 		let result;
 		try {
@@ -5891,7 +2450,8 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 				...input.locations ? { locations: [...input.locations] } : {},
 				signal,
 				onArchiveBytes: (bytes) => progress.setStagedBytes(bytes),
-				owner: this.databaseOwner()
+				owner: this.databaseOwner(),
+				...encryptTo !== null ? { encryptTo: encryptTo.publicKey } : {}
 			});
 		} catch (err) {
 			if (err instanceof BackupSnapshotRefusedError) for (const dest of targets) {
@@ -5925,6 +2485,7 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 						retentionCount: input.retentionCount ?? policy.retentionCount,
 						createdAt,
 						label: formatArchiveLabel(dest.id, createdAt, input.label),
+						...result.encryption !== void 0 ? { encryption: result.encryption } : {},
 						signal,
 						onUploadedBytes: (bytes) => progress.setUploadedBytes(bytes)
 					});
@@ -6046,7 +2607,8 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			createdAt: input.createdAt,
 			sizeBytes: input.sizeBytes,
 			label: input.label,
-			manifest: input.archiveManifest
+			manifest: input.archiveManifest,
+			...input.encryption !== void 0 ? { encryption: input.encryption } : {}
 		});
 		await this.manifestLock.run(input.locationId, async () => {
 			const { keep, drop } = applyRetention([...(await readLocationManifest(this.storageApi(), input.locationId)).archives, entry], input.retentionCount);
@@ -6075,7 +2637,8 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			createdAt: input.createdAt,
 			sizeBytes: input.sizeBytes,
 			label: input.label,
-			locations: [...input.archiveManifest.locations]
+			locations: [...input.archiveManifest.locations],
+			...input.encryption !== void 0 ? { encryption: input.encryption } : {}
 		};
 	}
 	/**
@@ -6101,7 +2664,8 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			createdAt: a.createdAt,
 			sizeBytes: a.sizeBytes,
 			...a.label !== void 0 ? { label: a.label } : {},
-			locations: [...a.manifest.locations]
+			locations: [...a.manifest.locations],
+			...a.encryption !== void 0 ? { encryption: a.encryption } : {}
 		}));
 	}
 	/**
@@ -6209,15 +2773,26 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		if (!this.systemBackup) throw new Error("orchestrator not initialized");
 		const entry = (await readLocationManifest(this.storageApi(), input.destinationId)).archives.find((a) => a.id === input.backupId);
 		if (!entry) throw new Error(`backup restore: backup "${input.backupId}" not found at location "${input.destinationId}"`);
+		precheckRestoreKey(entry.encryption?.keyId, input.backupSecretKey);
+		const downloaded = await this.stagingPath(`restore-${input.backupId}.download`);
 		const cachePath = await this.stagingPath(`restore-${input.backupId}.tar.gz`);
 		await downloadArchiveToCache({
 			api: this.ctx.api.storage,
 			locationId: input.destinationId,
 			filename: entry.filename,
-			cachePath,
+			cachePath: downloaded,
 			chunkBytes: UPLOAD_CHUNK_BYTES,
 			logger: this.ctx.logger
 		});
+		const prepared = await prepareRestoreArchive({
+			downloaded,
+			target: cachePath,
+			...input.backupSecretKey !== void 0 ? { secretKey: input.backupSecretKey } : {}
+		});
+		if (prepared.encrypted) this.ctx.logger.info("backup restore: encrypted archive decrypted into staging", { meta: {
+			backupId: input.backupId,
+			keyId: prepared.keyId
+		} });
 		this.systemBackup.scheduleRestoreMarker({
 			archivePath: cachePath,
 			source: input.backupId,
@@ -6237,6 +2812,98 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			}
 		});
 	}
+	requireEncryptionKeys() {
+		if (this.encryptionKeys === null) throw new Error("backup encryption: no settings-store — the setting cannot be read or saved");
+		return this.encryptionKeys;
+	}
+	/**
+	* The key a run encrypts to; `null` = encryption off. THROWS when the
+	* setting cannot be read — a run must fail rather than ship a plain archive
+	* an operator asked to be encrypted.
+	*/
+	async activeEncryptionKey() {
+		const store = this.encryptionKeys;
+		if (store === null) {
+			if (!this.warnedNoEncryptionStore) {
+				this.warnedNoEncryptionStore = true;
+				this.ctx.logger.warn("backup encryption unavailable on this node (no settings-store) — archives are plain");
+			}
+			return null;
+		}
+		try {
+			const active = await store.active();
+			return active === null ? null : {
+				keyId: active.keyId,
+				publicKey: active.publicKey
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(`backup encryption setting unreadable — no archive built, so none leaves unencrypted: ${message}`, { cause: err });
+		}
+	}
+	async getEncryption() {
+		const keys = await this.requireEncryptionKeys().list();
+		const active = keys.find((k) => k.retiredAt === null) ?? null;
+		return {
+			enabled: active !== null,
+			active: active === null ? null : {
+				keyId: active.keyId,
+				publicKey: active.publicKey,
+				createdAt: active.createdAt
+			},
+			keys: keys.map((k) => ({
+				keyId: k.keyId,
+				createdAt: k.createdAt,
+				retiredAt: k.retiredAt
+			}))
+		};
+	}
+	async setupEncryption() {
+		const store = this.requireEncryptionKeys();
+		const previous = await store.active();
+		const pair = generateBackupKeyPair();
+		const record = await store.activate({ publicKey: pair.publicKey });
+		this.ctx.logger.warn("backup encryption key generated — new archives are encrypted to it", { meta: {
+			keyId: record.keyId,
+			replacedKeyId: previous?.keyId ?? null
+		} });
+		return {
+			keyId: record.keyId,
+			secretKey: pair.secretKey,
+			publicKey: record.publicKey,
+			createdAt: record.createdAt,
+			replacedKeyId: previous?.keyId ?? null
+		};
+	}
+	async disableEncryption() {
+		const store = this.requireEncryptionKeys();
+		const previous = await store.active();
+		await store.disable();
+		if (previous !== null) this.ctx.logger.warn("backup encryption turned OFF — new archives are plain", { meta: { disabledKeyId: previous.keyId } });
+		return { disabledKeyId: previous?.keyId ?? null };
+	}
+	async checkBackupKey(input) {
+		let keyId;
+		try {
+			keyId = parseBackupSecretKey(input.backupSecretKey).keyId;
+		} catch (err) {
+			if (!(err instanceof BackupKeyFormatError)) throw err;
+			return {
+				valid: false,
+				keyId: null,
+				known: false,
+				active: false,
+				error: err.message
+			};
+		}
+		const match = (await this.requireEncryptionKeys().list()).find((k) => k.keyId === keyId);
+		return {
+			valid: true,
+			keyId,
+			known: match !== void 0,
+			active: match !== void 0 && match.retiredAt === null
+		};
+	}
 	/**
 	* Resolve a target destination set — see {@link selectBackupTargets} for the
 	* rule. Caller-provided list wins over the per-destination policy flag;