@evolvingmachines/sdk 0.0.52-project-sable.20260810.ca7ed91 → 0.0.52-project-sable.20260815.143c2cd

package/dist/chunk-GZ2GWEIQ.js

@@ -0,0 +1,426 @@
+import {createWriteStream}from'fs';import {mkdir,rename,rm}from'fs/promises';import {join,basename}from'path';import {Readable}from'stream';import {pipeline}from'stream/promises';function Pe(e=""){let t=process.env.EVOLVE_GATEWAY_URL||"https://swarmkit-gateway-692833842999.us-central1.run.app";if(!e)return t;let n=e.startsWith("/")?e:`/${e}`;return `${t}${n}`}function we(e=""){let t=process.env.EVOLVE_DASHBOARD_URL||A;if(!e)return t;let n=e.startsWith("/")?e:`/${e}`;return `${t.replace(/\/$/,"")}${n}`}var Lt=["e2b","daytona","modal"];function se(e){return we(`/api/managed/${e}`)}function Jt(){return `${se("daytona")}/toolbox`}function Nt(){return se("e2b")}function Ut(e){return {"browser-use":{type:"http",url:Pe("/browser_use/mcp"),headers:{"x-litellm-api-key":`Bearer ${e}`}}}}var H="EVOLVE_API_KEY",jt="E2B_API_KEY",Mt="DAYTONA_API_KEY",$t="MODAL_TOKEN_ID",Gt="MODAL_TOKEN_SECRET",Vt="claude",Ft=36e5,qt=4,Ht=100,ae="/home/user";function Bt(e,t){return t?t.replace(/\/+$/,"")||"/":e?e==="root"?"/root":`/home/${e}`:ae}var A=process.env.EVOLVE_DASHBOARD_URL||"https://dashboard.evolvingmachines.ai",Yt="x-litellm-customer-id",Wt="x-litellm-tags",zt="run:",Xt=".evolve-sdk/observability/sessions",Qt=["tag","provider","agent","model","sandboxId","sandbox_id","timestamp","event","events"],Zt=100,en=5e3,tn=3,nn=1e3;function B(e){return e.delivery==="direct"}var le=18181,v="/tmp/evolve-managed-secrets",ue=`${v}/proxy.py`,K=`${v}/config.json`,x=`${v}/ca.crt`,L=`${v}/ca.key`,P=`${v}/ca-bundle.crt`,de=["HTTP_PROXY","HTTPS_PROXY","ALL_PROXY","http_proxy","https_proxy","all_proxy","NO_PROXY","no_proxy","NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","REQUESTS_CA_BUNDLE","CURL_CA_BUNDLE","GIT_SSL_CAINFO"];function an(){return [...de]}var on=String.raw`#!/usr/bin/env python3
+import base64
+import json
+import os
+import select
+import secrets
+import socket
+import ssl
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import urllib.error
+import urllib.request
+
+for key in ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"]:
+    os.environ.pop(key, None)
+
+CONFIG_PATH = sys.argv[1]
+with open(CONFIG_PATH, "r", encoding="utf-8") as f:
+    CONFIG = json.load(f)
+try:
+    os.unlink(CONFIG_PATH)
+except FileNotFoundError:
+    pass
+
+MAX_BODY_BYTES = int(CONFIG.get("max_body_bytes", 10 * 1024 * 1024))
+CONNECT_TIMEOUT_SECONDS = 15
+SOCKET_TIMEOUT_SECONDS = 130
+MAX_WORKERS = 100
+WORKERS = threading.BoundedSemaphore(MAX_WORKERS)
+HOST_PATTERNS = [h.lower() for h in CONFIG["hosts"]]
+PLACEHOLDERS = set(CONFIG["placeholders"])
+PLACEHOLDER_BYTES = [p.encode("utf-8") for p in CONFIG["placeholders"]]
+BASE_DIR = CONFIG["base_dir"]
+CERT_DIR = os.path.join(BASE_DIR, "certs")
+os.makedirs(CERT_DIR, exist_ok=True)
+CHANNEL_SECRET = secrets.token_urlsafe(32)
+
+def register_channel():
+    payload = json.dumps({}).encode("utf-8")
+    req = urllib.request.Request(
+        CONFIG["channel_url"],
+        data=payload,
+        method="POST",
+        headers={
+            "content-type": "application/json",
+            "accept": "application/json",
+            "x-evolve-managed-secret-token": CONFIG["token"],
+            "x-evolve-managed-secret-binding": CONFIG["binding"],
+            "x-evolve-managed-secret-channel": CHANNEL_SECRET,
+        },
+    )
+    with urllib.request.urlopen(req, timeout=30) as resp:
+        if resp.status < 200 or resp.status >= 300:
+            raise RuntimeError("managed secret channel registration failed")
+
+def host_matches(pattern, host):
+    host = host.lower()
+    if pattern.startswith("*."):
+        base = pattern[2:]
+        return host != base and host.endswith("." + base)
+    return host == pattern
+
+def is_managed_host(host):
+    clean = host.split(":", 1)[0].strip("[]").lower()
+    return any(host_matches(pattern, clean) for pattern in HOST_PATTERNS)
+
+def safe_name(host):
+    return "".join(ch if ch.isalnum() or ch in "._-" else "_" for ch in host)[:180]
+
+def ensure_cert(host):
+    name = safe_name(host)
+    cert = os.path.join(CERT_DIR, name + ".crt")
+    key = os.path.join(CERT_DIR, name + ".key")
+    if os.path.exists(cert) and os.path.exists(key):
+        return cert, key
+    csr = os.path.join(CERT_DIR, name + ".csr")
+    ext = os.path.join(CERT_DIR, name + ".ext")
+    san = "IP:" + host if host.replace(".", "").isdigit() else "DNS:" + host
+    with open(ext, "w", encoding="utf-8") as f:
+        f.write("basicConstraints=critical,CA:FALSE\n")
+        f.write("keyUsage=critical,digitalSignature,keyEncipherment\n")
+        f.write("subjectAltName=" + san + "\n")
+        f.write("extendedKeyUsage=serverAuth\n")
+    subprocess.run(
+        ["openssl", "req", "-newkey", "rsa:2048", "-nodes", "-keyout", key, "-subj", "/CN=" + host, "-out", csr],
+        check=True,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    subprocess.run(
+        [
+            "openssl", "x509", "-req", "-in", csr,
+            "-CA", CONFIG["ca_cert"], "-CAkey", CONFIG["ca_key"], "-CAcreateserial",
+            "-out", cert, "-days", "30", "-sha256", "-extfile", ext,
+        ],
+        check=True,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return cert, key
+
+def pipe_raw(client, host, port):
+    upstream = socket.create_connection((host, port), timeout=CONNECT_TIMEOUT_SECONDS)
+    client.settimeout(SOCKET_TIMEOUT_SECONDS)
+    upstream.settimeout(SOCKET_TIMEOUT_SECONDS)
+    try:
+        client.sendall(b"HTTP/1.1 200 Connection Established\r\n\r\n")
+        sockets = [client, upstream]
+        while True:
+            readable, _, _ = select.select(sockets, [], [], 120)
+            if not readable:
+                break
+            for sock in readable:
+                data = sock.recv(65536)
+                if not data:
+                    return
+                (upstream if sock is client else client).sendall(data)
+    finally:
+        upstream.close()
+
+def recv_until(sock, marker, limit=65536):
+    data = b""
+    while marker not in data:
+        chunk = sock.recv(4096)
+        if not chunk:
+            break
+        data += chunk
+        if len(data) > limit:
+            raise RuntimeError("request headers too large")
+    return data
+
+def parse_headers(blob):
+    head, rest = blob.split(b"\r\n\r\n", 1)
+    lines = head.decode("iso-8859-1").split("\r\n")
+    request_line = lines[0]
+    headers = {}
+    for line in lines[1:]:
+        if not line or ":" not in line:
+            continue
+        name, value = line.split(":", 1)
+        headers[name.strip()] = value.strip()
+    return request_line, headers, rest
+
+def header_value(headers, name):
+    wanted = name.lower()
+    for key, value in headers.items():
+        if key.lower() == wanted:
+            return value
+    return None
+
+def read_chunked_body(sock, initial):
+    data = initial
+    body = b""
+    while True:
+        while b"\r\n" not in data:
+            chunk = sock.recv(4096)
+            if not chunk:
+                raise RuntimeError("incomplete chunked request")
+            data += chunk
+        line, data = data.split(b"\r\n", 1)
+        size = int((line.split(b";", 1)[0].strip() or b"0"), 16)
+        if size == 0:
+            return body
+        if len(body) + size > MAX_BODY_BYTES:
+            raise RuntimeError("request body too large")
+        while len(data) < size + 2:
+            chunk = sock.recv(65536)
+            if not chunk:
+                raise RuntimeError("incomplete chunked request")
+            data += chunk
+        body += data[:size]
+        data = data[size + 2:]
+
+def read_request(tls_sock):
+    blob = recv_until(tls_sock, b"\r\n\r\n")
+    if not blob:
+        return None
+    request_line, headers, rest = parse_headers(blob)
+    transfer_encoding = (header_value(headers, "Transfer-Encoding") or "").lower()
+    if "chunked" in transfer_encoding:
+        return request_line, headers, read_chunked_body(tls_sock, rest)
+    length = int(header_value(headers, "Content-Length") or "0")
+    if length > MAX_BODY_BYTES:
+        raise RuntimeError("request body too large")
+    body = rest
+    while len(body) < length:
+        chunk = tls_sock.recv(min(65536, length - len(body)))
+        if not chunk:
+            break
+        body += chunk
+    return request_line, headers, body[:length]
+
+def uses_placeholder(path, headers, body):
+    if any(ph in path for ph in PLACEHOLDERS):
+        return True
+    if any(ph in value for ph in PLACEHOLDERS for value in headers.values()):
+        return True
+    return any(ph_b in body for ph_b in PLACEHOLDER_BYTES)
+
+def brokered_status(transport_status, transport_reason, payload):
+    # A brokered reply carries the TRUE upstream status inside the payload;
+    # the dashboard's own status reports only the health of the hop to it.
+    # Servers older than the status lane omit it: those fall back.
+    status = payload.get("status")
+    if isinstance(status, bool) or not isinstance(status, int) or not 100 <= status <= 599:
+        return transport_status, transport_reason
+    reason = payload.get("statusText")
+    return status, reason if isinstance(reason, str) else ""
+
+def egress_failure(exc):
+    body = json.dumps({
+        "error": "managed secret egress request failed",
+        "detail": str(exc),
+    }).encode("utf-8")
+    return 502, "Managed Secret Egress Unavailable", {
+        "headers": {"content-type": "application/json"},
+        "bodyBase64": base64.b64encode(body).decode("ascii"),
+    }
+
+def call_dashboard(method, url, headers, body):
+    payload = json.dumps({
+        "method": method,
+        "url": url,
+        "headers": headers,
+        "bodyBase64": base64.b64encode(body).decode("ascii") if body else "",
+    }).encode("utf-8")
+    req = urllib.request.Request(
+        CONFIG["egress_url"],
+        data=payload,
+        method="POST",
+        headers={
+            "content-type": "application/json",
+            "accept": "application/json",
+            "x-evolve-managed-secret-token": CONFIG["token"],
+            "x-evolve-managed-secret-binding": CONFIG["binding"],
+            "x-evolve-managed-secret-channel": CHANNEL_SECRET,
+        },
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=130) as resp:
+            result = json.loads(resp.read().decode("utf-8"))
+            if not isinstance(result, dict):
+                raise ValueError("managed secret egress returned a non-object response")
+            status, reason = brokered_status(resp.status, resp.reason, result)
+            return status, reason, result
+    except urllib.error.HTTPError as err:
+        text = err.read().decode("utf-8", "replace")
+        return err.code, "Managed Secret Egress Error", {"headers": {"content-type": "application/json"}, "bodyBase64": base64.b64encode(text.encode()).decode("ascii")}
+    except (urllib.error.URLError, OSError, ValueError) as err:
+        # Connection reset, SSL EOF, timeout, or an unreadable body: the agent
+        # gets a typed 502 and the proxy keeps serving.
+        return egress_failure(err)
+
+def read_limited_response(stream):
+    chunks = []
+    total = 0
+    while True:
+        chunk = stream.read(65536)
+        if not chunk:
+            break
+        total += len(chunk)
+        if total > MAX_BODY_BYTES:
+            raise RuntimeError("response body too large")
+        chunks.append(chunk)
+    return b"".join(chunks)
+
+def call_direct(method, url, headers, body):
+    hop_by_hop = {"connection", "proxy-connection", "keep-alive", "transfer-encoding", "upgrade", "host", "content-length"}
+    request_headers = {k: v for k, v in headers.items() if k.lower() not in hop_by_hop}
+    req = urllib.request.Request(
+        url,
+        data=body if body else None,
+        method=method,
+        headers=request_headers,
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=130) as resp:
+            return resp.status, resp.reason, {
+                "headers": dict(resp.headers.items()),
+                "bodyBase64": base64.b64encode(read_limited_response(resp)).decode("ascii"),
+            }
+    except urllib.error.HTTPError as err:
+        return err.code, err.reason, {
+            "headers": dict(err.headers.items()),
+            "bodyBase64": base64.b64encode(read_limited_response(err)).decode("ascii"),
+        }
+
+def send_response(tls_sock, status, reason, result):
+    body = base64.b64decode(result.get("bodyBase64") or "")
+    headers = {str(k): str(v) for k, v in (result.get("headers") or {}).items()}
+    headers["content-length"] = str(len(body))
+    headers["connection"] = "close"
+    status_line = ("HTTP/1.1 %d %s\r\n" % (status, reason or "")).encode("ascii", "replace")
+    header_blob = b"".join((name + ": " + value + "\r\n").encode("iso-8859-1", "replace") for name, value in headers.items())
+    tls_sock.sendall(status_line + header_blob + b"\r\n" + body)
+
+def dispatch_managed_request(method, url, headers, body):
+    if uses_placeholder(url, headers, body):
+        return call_dashboard(method, url, headers, body)
+    return call_direct(method, url, headers, body)
+
+def handle_managed_connect(client, host, port):
+    client.sendall(b"HTTP/1.1 200 Connection Established\r\n\r\n")
+    cert, key = ensure_cert(host)
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.load_cert_chain(cert, key)
+    client.settimeout(SOCKET_TIMEOUT_SECONDS)
+    tls_sock = ctx.wrap_socket(client, server_side=True)
+    tls_sock.settimeout(SOCKET_TIMEOUT_SECONDS)
+    try:
+        request = read_request(tls_sock)
+        if not request:
+            return
+        request_line, headers, body = request
+        parts = request_line.split()
+        if len(parts) < 2:
+            raise RuntimeError("bad request line")
+        method, path = parts[0].upper(), parts[1]
+        if path.startswith("http://") or path.startswith("https://"):
+            url = path
+        else:
+            url = "https://%s%s" % (host if port == 443 else host + ":" + str(port), path)
+        status, reason, result = dispatch_managed_request(method, url, headers, body)
+        send_response(tls_sock, status, reason, result)
+    finally:
+        try:
+            tls_sock.close()
+        except Exception:
+            pass
+
+def handle_client(client):
+    try:
+        client.settimeout(SOCKET_TIMEOUT_SECONDS)
+        blob = recv_until(client, b"\r\n\r\n")
+        if not blob:
+            return
+        request_line, headers, rest = parse_headers(blob)
+        parts = request_line.split()
+        if len(parts) < 3:
+            return
+        if parts[0].upper() == "CONNECT":
+            target = parts[1]
+            if ":" in target:
+                host, port_s = target.rsplit(":", 1)
+                port = int(port_s)
+            else:
+                host, port = target, 443
+            host = host.strip("[]")
+            if is_managed_host(host):
+                handle_managed_connect(client, host, port)
+            else:
+                pipe_raw(client, host, port)
+            return
+        client.sendall(b"HTTP/1.1 501 Not Implemented\r\ncontent-length: 0\r\nconnection: close\r\n\r\n")
+    except Exception as exc:
+        try:
+            body = json.dumps({"error": str(exc)}).encode("utf-8")
+            client.sendall(b"HTTP/1.1 502 Bad Gateway\r\ncontent-type: application/json\r\ncontent-length: " + str(len(body)).encode() + b"\r\nconnection: close\r\n\r\n" + body)
+        except Exception:
+            pass
+    finally:
+        try:
+            client.close()
+        except Exception:
+            pass
+
+def close_quietly(sock):
+    try:
+        sock.close()
+    except Exception:
+        pass
+
+def reject_client(client):
+    try:
+        client.sendall(b"HTTP/1.1 503 Service Unavailable\r\ncontent-length: 0\r\nconnection: close\r\n\r\n")
+    except Exception:
+        pass
+    close_quietly(client)
+
+def serve():
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    server.bind(("127.0.0.1", int(CONFIG["port"])))
+    server.listen(100)
+    while True:
+        # The listener outlives every connection: nothing a single accept or
+        # handoff raises may end the loop, or the sandbox loses egress for the
+        # rest of the session.
+        try:
+            client, _ = server.accept()
+        except Exception:
+            time.sleep(0.05)
+            continue
+        if not WORKERS.acquire(blocking=False):
+            reject_client(client)
+            continue
+        # Bound per thread: the loop rebinds the client on the next accept.
+        def run_client(sock=client):
+            try:
+                handle_client(sock)
+            except Exception:
+                pass
+            finally:
+                WORKERS.release()
+        try:
+            threading.Thread(target=run_client, daemon=True).start()
+        except Exception:
+            WORKERS.release()
+            close_quietly(client)
+
+if __name__ == "__main__":
+    register_channel()
+    serve()
+`;function Ce(e){return (e||process.env.EVOLVE_DASHBOARD_URL||A).replace(/\/$/,"")}function De(e){let t=e.apiKey||process.env.EVOLVE_API_KEY;if(!t)throw new Error("EVOLVE_API_KEY is required for managed secrets");return t}async function Ie(e){return await e.text().catch(()=>"")}async function w(e,t,n={}){let r=await fetch(`${Ce(e.dashboardUrl)}${t}`,{...n,headers:{Authorization:`Bearer ${De(e)}`,accept:"application/json",...n.body?{"content-type":"application/json"}:{},...n.headers||{}}});if(!r.ok)throw new Error(`Managed secrets request failed (${r.status}): ${await Ie(r)}`);return await r.json()}function Oe(e){let t=n=>Array.isArray(n)?n.filter(r=>typeof r=="string"):[];return {id:String(e.id??""),name:String(e.name??""),...typeof e.label=="string"?{label:e.label}:{},...e.delivery==="brokered"||e.delivery==="direct"?{delivery:e.delivery}:{},allowedHosts:t(e.allowed_hosts??e.allowedHosts),allowedPathPrefixes:t(e.allowed_path_prefixes??e.allowedPathPrefixes),allowedMethods:t(e.allowed_methods??e.allowedMethods),createdAt:String(e.created_at??e.createdAt??""),updatedAt:String(e.updated_at??e.updatedAt??""),lastUsedAt:typeof(e.last_used_at??e.lastUsedAt)=="string"?e.last_used_at??e.lastUsedAt:null}}function ln(e={}){return {async list(){return (await w(e,"/api/managed-secrets")).secrets??[]},async set(t){let n={name:t.name,value:t.value,delivery:t.delivery,...t.label!==void 0?{label:t.label}:{},...t.allowedHosts!==void 0?{allowed_hosts:t.allowedHosts}:{},...t.allowedPathPrefixes!==void 0?{allowed_path_prefixes:t.allowedPathPrefixes}:{},...t.allowedMethods!==void 0?{allowed_methods:t.allowedMethods}:{}},r=await w(e,"/api/managed-secrets",{method:"POST",body:JSON.stringify(n)});return {status:r.status,secret:Oe(r.secret??{})}},async delete(t){let n=await w(e,"/api/managed-secrets",{method:"DELETE",body:JSON.stringify({name:t.name,...t.label!==void 0?{label:t.label}:{}})});return {ok:n.ok,name:n.name,label:n.label}}}}function Le(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")}function ie(e){try{return new URL(e).protocol==="https:"}catch{return  false}}function Je(e){if(!e||typeof e!="object"||Array.isArray(e))return  false;let t=e;return typeof t.token=="string"&&t.token.startsWith("evrt_")&&typeof t.bindingSecret=="string"&&t.bindingSecret.startsWith("evrb_")&&typeof t.egressUrl=="string"&&ie(t.egressUrl)&&typeof t.channelUrl=="string"&&ie(t.channelUrl)&&typeof t.expiresAt=="string"&&Array.isArray(t.env)&&t.env.every(n=>{if(!n||typeof n!="object"||Array.isArray(n))return  false;let r=n;return typeof r.name!="string"||typeof r.envName!="string"||!Le(r.allowedHosts)?false:r.delivery==="direct"?typeof r.value=="string"&&r.value.length>0:(r.delivery===void 0||r.delivery==="brokered")&&typeof r.placeholder=="string"&&r.placeholder.startsWith("evsec_")&&r.value===void 0})}async function un(e,t){let n=await w(e,"/api/managed-secrets/runtime-token",{method:"POST",body:JSON.stringify(t)});if(!Je(n))throw new Error("Invalid managed secret runtime token response");return n}async function dn(e,t){return (await w(e,"/api/managed-secrets/runtime-token",{method:"PATCH",body:JSON.stringify(t)})).ok}async function cn(e,t){return (await w(e,"/api/managed-secrets/runtime-token",{method:"DELETE",body:JSON.stringify(t)})).ok}var Ne=/^[A-Za-z0-9._-]{1,80}$/;function Ue(e){if(!Array.isArray(e)||e.length===0)throw new Error("withManagedSecrets() requires at least one secret");return e.map((t,n)=>{if(!t||typeof t!="object"||Array.isArray(t))throw new Error(`managedSecrets[${n}] must be an object with a name`);let r=oe(t.name,`managedSecrets[${n}].name`),s;if(t.label!==void 0){if(typeof t.label!="string"||!Ne.test(t.label.trim()))throw new Error(`managedSecrets[${n}].label may contain only letters, numbers, dots, underscores, and hyphens (at most 80 characters)`);s=t.label.trim();}let o=t.as===void 0?void 0:oe(t.as,`managedSecrets[${n}].as`);return {name:r,...s!==void 0?{label:s}:{},...o!==void 0?{as:o}:{}}})}function oe(e,t){if(typeof e!="string"||!e.trim())throw new Error(`${t} is required`);let n=e.trim().toUpperCase();if(!/^[A-Z_][A-Z0-9_]{0,127}$/.test(n))throw new Error(`${t} must be a valid environment variable name`);if(n.startsWith("EVOLVE_"))throw new Error(`${t} cannot use the reserved EVOLVE_ prefix`);return n}function je(e){let t=new Set(["EVOLVE_API_KEY","EVOLVE_PROVIDER_RUNTIME_BINDING","GEMINI_DEFAULT_AUTH_TYPE",...de]),n=r=>{r&&t.add(r);};n(e.apiKeyEnv),n(e.baseUrlEnv),n(e.customHeadersEnv),n(e.gatewayConfigEnv),e.spendTrackingEnvs&&(n(e.spendTrackingEnvs.sessionTagEnv),n(e.spendTrackingEnvs.runTagEnv));for(let r of Object.values(e.providerEnvMap??{}))n(r.keyEnv);return t}function pn(e,t){if(!e)return;let n=Ue(e),r=je(t),s=new Set;for(let o of n){let d=o.as||o.name;if(r.has(d))throw new Error(`${d} is reserved for Evolve-managed sandbox services and cannot be used as a managed secret env var`);if(s.has(d))throw new Error(`duplicate managed secret env var: ${d}`);s.add(d);}return n}function Me(e){return e.env.some(t=>!B(t))}function gn(e){let t={};for(let s of e.env)B(s)?t[s.envName]=s.value:t[s.envName]=s.placeholder;if(!Me(e))return t;let n=`http://127.0.0.1:${le}`;t.HTTPS_PROXY=n,t.https_proxy=n,t.NODE_EXTRA_CA_CERTS=x,t.SSL_CERT_FILE=P,t.REQUESTS_CA_BUNDLE=P,t.CURL_CA_BUNDLE=P,t.GIT_SSL_CAINFO=P;let r=new URL(e.egressUrl).hostname;return t.NO_PROXY=`localhost,127.0.0.1,::1,${r}`,t.no_proxy=t.NO_PROXY,t}function mn(e){let t=e.env.filter(r=>!B(r)),n=Array.from(new Set(t.flatMap(r=>r.allowedHosts)));return JSON.stringify({egress_url:e.egressUrl,channel_url:e.channelUrl,token:e.token,binding:e.bindingSecret,hosts:n,placeholders:t.map(r=>r.placeholder),base_dir:v,ca_cert:x,ca_key:L,port:le,max_body_bytes:10*1024*1024},null,2)}function _n(){return ["umask 077",`mkdir -p ${v}/certs`,`chmod 700 ${v} ${v}/certs`,`chmod 700 ${ue} 2>/dev/null || true`,`chmod 600 ${K} 2>/dev/null || true`,`if [ ! -f ${L} ]; then openssl genrsa -out ${L} 2048 >/dev/null 2>&1; fi`,`if [ ! -f ${x} ]; then openssl req -x509 -new -nodes -key ${L} -sha256 -days 30 -subj "/CN=Evolve Managed Secrets" -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign" -out ${x} >/dev/null 2>&1; fi`,`SYSTEM_CA_BUNDLE=""; for p in /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/ca-bundle.pem; do if [ -f "$p" ]; then SYSTEM_CA_BUNDLE="$p"; break; fi; done; if [ -n "$SYSTEM_CA_BUNDLE" ]; then cat "$SYSTEM_CA_BUNDLE" ${x} > ${P}; else cp ${x} ${P}; fi`,`if command -v update-ca-certificates >/dev/null 2>&1; then cp ${x} /usr/local/share/ca-certificates/evolve-managed-secrets.crt 2>/dev/null && update-ca-certificates >/dev/null 2>&1 || true; fi`].join(" && ")}function fn(){return `umask 077 && exec python3 ${ue} ${K}`}function bn(){return `rm -f ${K}`}var $e=["QUEUED","RUNNING","SCORING","SCORED","SCORING_ERROR","INFRASTRUCTURE_ERROR","INDETERMINATE","CANCELLED"],Ge=["e2b","daytona","modal"];function Ve(e){let t=e.stats?.evals??{},n=[];for(let r of Object.keys(t).sort()){let s=t[r]?.pass_at_k??{},o=[];for(let d of Object.keys(s)){let u=Number(d),a=s[d];!Number.isFinite(u)||typeof a!="number"||!Number.isFinite(a)||o.push({k:u,value:a});}o.length!==0&&(o.sort((d,u)=>d.k-u.k),n.push({evals_key:r,points:o}));}return n}var Fe=["trace-parsed","verifier","trace-stdout","trace-stderr","trace-atif","trajectory","agent-home"],ce=["missing_authorization","invalid_api_key","credential_service_unavailable","rate_limited","insufficient_credits","invalid_json","invalid_input","invalid_limit","invalid_status","invalid_cursor","invalid_after","invalid_format","invalid_ids","invalid_multipart","idempotency_key_reused","dataset_not_found","dataset_version_not_found","dataset_name_taken","dataset_in_use","dataset_not_owned","upstream_not_watchable","no_active_version","version_not_ready","version_not_activatable","unknown_task_names","no_tasks","agent_not_found","agent_name_taken","agent_name_reserved","agent_invalid_name","agent_source_required","agent_source_conflict","agent_invalid_env","agent_too_large","agent_limit_reached","skill_not_found","skill_name_not_found","skill_ref_invalid","skill_unresolvable","skill_invalid","skill_in_use","skill_too_large","skill_limit_reached","secret_not_found","secret_ambiguous","secret_brokered_unsupported","secret_exists","agent_version_not_found","agent_version_unresolvable","agent_kwarg_unsupported","agent_config_unsupported","agent_config_key_refused","agent_preset_unsupported","job_too_large","provider_unsupported","job_not_found","job_not_terminal","no_failed_trials","trial_not_found","trial_not_settled","concurrent_update","regrade_source_ineligible","no_regradable_trials","import_not_found","import_too_large","invalid_archive","unpinned_git_ref","package_not_retained","package_corrupt","package_missing","internal_error"];function Y(e){return typeof e=="string"&&ce.includes(e)}var qe=["level","binary","none"];function pe(e){let t={};for(let[n,r]of Object.entries(e)){let s=n.replace(/^\/+/,""),o=s.split("/");o.length>1&&o[0]==="root"?o.shift():o.length>2&&o[0]==="home"&&o.splice(0,2),o[0].length>1&&o[0].startsWith(".")&&(o[0]=o[0].slice(1));let d=o.join("/");d in t?t[s]=r:t[d]=r;}return t}function J(e){return JSON.stringify(e,null,2)+`
+`}function ge(e,t,n){return {trial_id:e.id,job_id:e.job_id,user_id:n,provider:e.sandbox_provider,gateway:{cost_usd:e.agent_result?.cost_usd??null,n_input_tokens:e.agent_result?.n_input_tokens??null,n_cache_tokens:e.agent_result?.n_cache_tokens??null,n_output_tokens:e.agent_result?.n_output_tokens??null,spend_source:e.spend_source,max_trial_spend_usd:e.max_trial_spend_usd,judge:e.judge_result?{cost_usd:e.judge_result.cost_usd,n_input_tokens:e.judge_result.n_input_tokens,n_cache_tokens:e.judge_result.n_cache_tokens,n_output_tokens:e.judge_result.n_output_tokens,spend_source:e.judge_spend_source??null}:null},regrade_lineage:{is_regrade:t?.is_regrade??false,source_jobs:t?.source_jobs??[],n_retries:e.n_retries,retries:e.retries}}}function He(e,t){return {job_id:e.id,user_id:t,provider:e.sandbox_provider,gateway:{cost_usd:e.stats.cost_usd??null,judge_cost_usd:e.stats.judge_cost_usd??null,n_input_tokens:e.stats.n_input_tokens??null,n_cache_tokens:e.stats.n_cache_tokens??null,n_output_tokens:e.stats.n_output_tokens??null,max_trial_spend_usd:e.max_trial_spend_usd,worst_case_spend_usd:e.worst_case_spend_usd},regrade_lineage:{is_regrade:e.is_regrade,source_jobs:e.source_jobs}}}function Be(e){let{trial:t}=e,n={};if(n["config.json"]=J({trial_name:t.id,task:{name:t.task_name,source:t.source},agent:{name:t.agent_info.name,version:t.agent_info.version,model_name:t.agent_info.model_info.name,reasoning_effort:t.agent_info.reasoning_effort}}),n["result.json"]=J({trial_name:t.id,task_name:t.task_name,status:t.status,reward:t.reward,verifier_result:t.verifier_result,exception_info:t.exception_info,agent_result:t.agent_result,started_at:t.started_at,finished_at:t.finished_at,environment_setup:t.environment_setup,agent_setup:t.agent_setup,agent_execution:t.agent_execution,verifier:t.verifier}),e.atif!==null&&(n["agent/trajectory.json"]=e.atif),e.stdout!==null&&(n["agent/stdout.log"]=e.stdout),e.stderr!==null&&(n["agent/stderr.log"]=e.stderr),e.events.length>0&&(n["agent/trace-parsed.jsonl"]=e.events.map(r=>JSON.stringify(r)).join(`
+`)+`
+`),e.home!==null){let r=pe(e.home);for(let s of Object.keys(r))n[`agent/sessions/${s}`]=r[s];}return e.verifierLog!==null&&(n["verifier/test-stdout.txt"]=e.verifierLog),t.verifier_result?.rewards&&(n["verifier/reward.json"]=J(t.verifier_result.rewards)),t.exception_info&&(n["exception.txt"]=`${t.exception_info.exception_type}: ${t.exception_info.exception_message}
+`),n["evolve.json"]=J(ge(t,e.job,e.userId)),n}var C=class extends Error{status;code;param;details;retryAfterSec;requestId;constructor(t,n,r,s){super(r),this.name="EvolveApiError",this.status=t,this.code=n,s?.param!==void 0&&(this.param=s.param),s?.details!==void 0&&(this.details=s.details),s?.retryAfterSec!==void 0&&(this.retryAfterSec=s.retryAfterSec),s?.requestId!==void 0&&(this.requestId=s.requestId);}isKnownCode(){return Y(this.code)}};function be(e,t){try{let o=JSON.parse(e)?.error?.retryAfterSec;if(typeof o=="number"&&Number.isFinite(o))return o}catch{}let n=t.headers?.get?.("retry-after");if(typeof n!="string"||n.trim()==="")return;let r=Number(n);return Number.isFinite(r)?r:void 0}async function ee(e){let t=await e.text().catch(()=>""),n=e.headers?.get?.("x-request-id")??void 0,r=be(t,e);try{let s=JSON.parse(t);if(s?.error&&typeof s.error=="object"){let o=typeof s.error.code=="string"?s.error.code:"unknown_error",d=typeof s.error.message=="string"?s.error.message:e.statusText;throw new C(e.status,o,d,{param:typeof s.error.param=="string"?s.error.param:void 0,details:s.error.details&&typeof s.error.details=="object"?s.error.details:void 0,retryAfterSec:r,requestId:typeof s.error.requestId=="string"?s.error.requestId:n})}}catch(s){if(s instanceof C)throw s}throw new C(e.status,"unknown_error",t||e.statusText,{retryAfterSec:r,requestId:n})}var z=class extends Error{dataset;constructor(t){super(`Dataset "${t}" has no active version`),this.name="NoActiveVersionError",this.dataset=t;}},X=class extends Error{name="GateRunningError";code="gate_running";dataset;version;gate;constructor(t,n,r,s){super(r),this.dataset=t,this.version=n,this.gate=s;}};function tt(e){let t=e&&typeof e=="object"&&!Array.isArray(e)?e:{};return {status:typeof t.status=="string"?t.status:"PENDING",tasks:typeof t.tasks=="number"?t.tasks:0,unverified:typeof t.unverified=="number"?t.unverified:0,ineligible:typeof t.ineligible=="number"?t.ineligible:0}}var nt=1e3,rt=3e4,st=new Set(["COMPLETED","CANCELLED","FAILED"]),at=new Set(["job.completed","job.cancelled","job.failed"]),it=2e3,ot=new Set(["COMPLETED","FAILED"]);function D(e,t){let n=t?.apiKey||process.env[H];if(!n)throw new Error(`${e}() requires an API key. Set ${H} or pass { apiKey } in config.`);let r=(t?.baseUrl||process.env.EVOLVE_DASHBOARD_URL||A).replace(/\/$/,"");return {apiKey:n,baseUrl:r}}async function c(e,t,n){let r=await fetch(`${e.baseUrl}${t}`,{...n,headers:{Authorization:`Bearer ${e.apiKey}`,...n?.headers}});return r.ok||await ee(r),r}function me(e){let t=e.indexOf("@");if(t===-1)return {name:e.trim()};let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw new Error(`Invalid dataset ref "${e}": expected "name" or "name@version"`);return {name:n,version:r}}function ye(e){return {name:e.name,version:e.version}}function he(e){let t=e.kwargs,n=Array.isArray(e.skills)?e.skills.filter(o=>typeof o=="string"):[],r=Array.isArray(e.skill_locks)?e.skill_locks:null,s=r?r.flatMap(o=>{if(!o||typeof o!="object")return [];let d=o;return typeof d.name!="string"||typeof d.digest!="string"?[]:[{name:d.name,source:typeof d.source=="string"?d.source:"",digest:d.digest,git_url:typeof d.git_url=="string"?d.git_url:null,git_commit_id:typeof d.git_commit_id=="string"?d.git_commit_id:null}]}):null;return {name:e.name,model_name:e.model_name,version:e.version??null,reasoning_effort:e.reasoning_effort??null,kwargs:t&&typeof t=="object"&&!Array.isArray(t)?t:null,preset:typeof e.preset=="string"?e.preset:null,skills:n,skill_locks:s}}function lt(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e;if(typeof t.status!="string")return null;let n=t.failure&&typeof t.failure=="object"&&!Array.isArray(t.failure)?t.failure:{},r=typeof t.code=="string"?t.code:n.code,s=typeof t.message=="string"?t.message:n.message,o=ut(Array.isArray(t.failed_tasks)?t.failed_tasks:n.failed_tasks),d=typeof t.failed_task_count=="number"?t.failed_task_count:n.failed_task_count;return {status:t.status,attempts:typeof t.attempts=="number"?t.attempts:0,code:typeof r=="string"?r:null,message:typeof s=="string"?s:null,failed_tasks:o,failed_task_count:typeof d=="number"?d:o.length}}function ut(e){if(!Array.isArray(e))return [];let t=[];for(let n of e){if(!n||typeof n!="object"||Array.isArray(n))continue;let r=n;typeof r.task_name=="string"&&t.push({task_name:r.task_name,outcome:typeof r.outcome=="string"?r.outcome:null,reasons:Array.isArray(r.reasons)?r.reasons.filter(s=>typeof s=="string"):[]});}return t}function dt(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e;if(typeof t.name!="string")return null;let n=Array.isArray(t.authors)?t.authors.flatMap(r=>{if(!r||typeof r!="object"||Array.isArray(r))return [];let s=r;return typeof s.name!="string"?[]:[{name:s.name,email:typeof s.email=="string"?s.email:null}]}):[];return {name:t.name,version:typeof t.version=="string"?t.version:null,description:typeof t.description=="string"?t.description:"",authors:n,keywords:Array.isArray(t.keywords)?t.keywords.filter(r=>typeof r=="string"):[],task_count:typeof t.task_count=="number"?t.task_count:null}}function ct(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e;return typeof t.ref!="string"||typeof t.commit!="string"?null:{git_url:typeof t.git_url=="string"?t.git_url:null,ref:t.ref,commit:t.commit,path:typeof t.path=="string"?t.path:null}}function N(e){return {version:e.version,state:e.state,created_at:e.created_at,task_count:e.task_count??0,manifest:dt(e.manifest),source:ct(e.source),gate:lt(e.gate)}}function pt(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e;return typeof t.outcome!="string"?null:{outcome:t.outcome,flaky:t.flaky===true,reasons:Array.isArray(t.reasons)?t.reasons.filter(n=>typeof n=="string"):[],ran_at:typeof t.ran_at=="string"?t.ran_at:null}}function gt(e){return {task_name:e.task_name,agent_timeout_sec:e.agent_timeout_sec,verifier_timeout_sec:e.verifier_timeout_sec,gpus:typeof e.gpus=="number"&&e.gpus>0?e.gpus:0,gpu_types:Array.isArray(e.gpu_types)&&e.gpu_types.length>0?e.gpu_types.map(String):null,providers:e.providers,gate:pt(e.gate)}}function mt(e){return {action:e.action,type:e.type,job_id:e.job_id}}function _t(e){let t=e&&typeof e=="object"?e:{};return {max_retries:typeof t.max_retries=="number"?t.max_retries:0,include_exceptions:Array.isArray(t.include_exceptions)?t.include_exceptions:null,exclude_exceptions:Array.isArray(t.exclude_exceptions)?t.exclude_exceptions:[],wait_multiplier:typeof t.wait_multiplier=="number"?t.wait_multiplier:1,min_wait_sec:typeof t.min_wait_sec=="number"?t.min_wait_sec:1,max_wait_sec:typeof t.max_wait_sec=="number"?t.max_wait_sec:60}}function ft(e){return {attempt_number:e.attempt_number,exception_info:e.exception_info??{exception_type:"InfrastructureError",exception_message:""},cost_usd:e.cost_usd??null,started_at:e.started_at??null,settled_at:e.settled_at??null}}function U(e){return typeof e=="number"?e:null}function k(e){let t=e.trials??{};return {id:e.id,job_name:e.job_name,status:e.status,datasets:(e.datasets??[]).map(ye),agents:(e.agents??[]).map(he),n_attempts:e.n_attempts,n_concurrent_trials:e.n_concurrent_trials,max_trial_spend_usd:e.max_trial_spend_usd,worst_case_spend_usd:e.worst_case_spend_usd,retry:_t(e.retry),timeout_multiplier:typeof e.timeout_multiplier=="number"?e.timeout_multiplier:1,agent_timeout_multiplier:U(e.agent_timeout_multiplier),verifier_timeout_multiplier:U(e.verifier_timeout_multiplier),agent_setup_timeout_multiplier:U(e.agent_setup_timeout_multiplier),environment_build_timeout_multiplier:U(e.environment_build_timeout_multiplier),sandbox_provider:e.sandbox_provider,counts:e.counts,n_total_trials:e.n_total_trials??0,trials:{total:t.total??0,byStatus:t.byStatus??{}},stats:e.stats??{},failure:e.failure??null,source_jobs:(e.source_jobs??[]).map(mt),is_regrade:e.is_regrade===true,idempotent_replay:e.idempotent_replay===true,started_at:e.started_at,updated_at:e.updated_at,finished_at:e.finished_at??null}}function b(e,t){let n=e??{};return {items:Array.isArray(n.items)?n.items.map(t):[],nextCursor:n.nextCursor??null,hasMore:n.hasMore===true}}function y(e,t){let n=new URLSearchParams;e?.limit!==void 0&&n.set("limit",String(e.limit)),e?.cursor&&n.set("cursor",e.cursor);for(let[s,o]of Object.entries(t??{}))o!==void 0&&n.set(s,o);let r=n.toString();return r?`?${r}`:""}function j(e){if(!e||typeof e!="object")return null;let t=e;return {started_at:t.started_at??null,finished_at:t.finished_at??null}}function bt(e){let t=e.model_info??{};return {name:e.name,version:e.version??null,model_info:{name:t.name,provider:t.provider??null},reasoning_effort:e.reasoning_effort??null}}function yt(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let{from:t,to:n,reason:r}=e;return typeof t!="string"||typeof n!="string"||typeof r!="string"?null:{from:t,to:n,reason:r}}function Q(e){return {id:e.id,job_id:e.job_id,task_name:e.task_name,source:e.source,agent_info:bt(e.agent_info||{}),attempt:e.attempt,status:e.status,reward:e.reward??null,verifier_result:e.verifier_result??null,exception_info:e.exception_info??null,agent_result:e.agent_result??null,judge_result:e.judge_result??null,environment_setup:j(e.environment_setup),agent_setup:j(e.agent_setup),agent_execution:j(e.agent_execution),verifier:j(e.verifier),step_results:e.step_results??null,spend_source:e.spend_source??null,judge_spend_source:e.judge_spend_source??null,live_spent_usd:e.live_spent_usd??null,live_spend_at:e.live_spend_at??null,max_trial_spend_usd:e.max_trial_spend_usd??null,sandbox_provider:e.sandbox_provider??null,sandbox_provider_degrade:yt(e.sandbox_provider_degrade),sandbox_id:e.sandbox_id??null,verifier_sandbox_id:e.verifier_sandbox_id??null,verifier_environment_mode:e.verifier_environment_mode??null,attempt_phase:e.attempt_phase??null,n_retries:e.n_retries??0,retries:Array.isArray(e.retries)?e.retries.map(ft):[],session_ref:e.session_ref??null,started_at:e.started_at??null,finished_at:e.finished_at??null}}function M(e){return {name:e.name,source:e.source,run_command:e.run_command,env:e.env??{},created_at:e.created_at,updated_at:e.updated_at}}function $(e){let t={id:e.id,status:e.status,name:e.name,version:e.version,failure:e.failure??null,warnings:e.warnings??[]};return typeof e.task_count=="number"&&(t.task_count=e.task_count),typeof e.created_at=="string"&&(t.created_at=e.created_at),typeof e.updated_at=="string"&&(t.updated_at=e.updated_at),t}function Re(e){let t=e??{};return {scored:t.scored??0,total:t.total??0}}function ht(e){return {id:e.id,datasets:(e.datasets??[]).map(ye),status:e.status,mean_reward:e.mean_reward??null,coverage:Re(e.coverage),cost_usd:e.cost_usd??0,agents:(e.agents||[]).map(he),started_at:e.started_at}}function Rt(e){return {job_id:e.job_id,status:e.status,mean_reward:e.mean_reward??null,coverage:Re(e.coverage)}}function vt(e){return {task_name:e.task_name,disagreement:e.disagreement===true,cells:(e.cells||[]).map(Rt)}}function ve(e){return {seq:e.seq,type:e.type,data:e.data??{}}}function kt(e){return {trial_id:e.trial_id,task_name:e.task_name??null,match_count:e.match_count,events:(e.events||[]).map(ve)}}function St(e){return e?e.suffix!==void 0?`bytes=-${e.suffix}`:e.start===void 0?null:`bytes=${e.start}-${e.end??""}`:null}function Z(e){if(e?.aborted)throw e.reason instanceof Error?e.reason:new Error("Watch aborted")}function _e(e,t){return t?.aborted?true:e?.name==="AbortError"}function I(e,t){return new Promise((n,r)=>{let s=setTimeout(()=>{t?.removeEventListener("abort",o),n();},e),o=()=>{clearTimeout(s),r(t?.reason instanceof Error?t.reason:new Error("Watch aborted"));};t?.addEventListener("abort",o,{once:true});})}function Et(e){let t="",n=false;return {push(r){n&&(r="\r"+r,n=false),r.endsWith("\r")&&(r=r.slice(0,-1),n=true),t+=r.replace(/\r\n|\r/g,`
+`);let s;for(;(s=t.indexOf(`
+
+`))!==-1;){let o=t.slice(0,s);t=t.slice(s+2);let d,u,a=[];for(let i of o.split(`
+`)){if(!i||i.startsWith(":"))continue;let l=i.indexOf(":"),g=l===-1?i:i.slice(0,l),p=l===-1?"":i.slice(l+1);p.startsWith(" ")&&(p=p.slice(1)),g==="id"?d=p:g==="event"?u=p:g==="data"&&a.push(p);}(d!==void 0||u!==void 0||a.length>0)&&e({id:d,event:u,data:a.join(`
+`)});}}}}function T(e,t){let n,r=()=>n??=e({limit:t?.limit,cursor:t?.cursor});return {then(s,o){return r().then(s,o)},catch(s){return r().catch(s)},finally(s){return r().finally(s)},async*[Symbol.asyncIterator](){let s=t?.cursor;for(;;){let o=await e({limit:t?.limit,cursor:s});for(let d of o.items)yield d;if(!o.nextCursor)return;s=o.nextCursor;}}}}function O(e,t){let n=new FormData;for(let[r,s]of Object.entries(e))s!==void 0&&n.set(r,s);return t&&n.set("archive",new Blob([t.bytes],{type:"application/gzip"}),t.filename),n}function xt(e){let t,n=()=>(t||(t=(async()=>{let r=await e.next();for(;!r.done;)r=await e.next();return r.value})()),t);return {then(r,s){return n().then(r,s)},catch(r){return n().catch(r)},finally(r){return n().finally(r)},[Symbol.asyncIterator](){return e}}}var ke="x-package-sha256",G=class extends Error{constructor(n,r){super(`downloaded bytes do not match the digest the server stated (expected ${n}, got ${r})`);this.expected=n;this.actual=r;}name="EvolveDigestMismatchError"},V=class extends Error{constructor(n,r){super(`download ended early: the server declared ${n} bytes and ${r} arrived`);this.expectedBytes=n;this.receivedBytes=r;}name="EvolveIncompleteDownloadError"};function Se(e,t){let n=e.headers.get("Content-Length");if(n===null)return;let r=Number(n);if(Number.isFinite(r)&&t!==r)throw new V(r,t)}async function Ee(e,t){let n=e.headers.get(ke);if(!n)return;let{createHash:r}=await import('crypto'),s=r("sha256").update(t).digest("hex");if(s!==n)throw new G(n,s)}function Tt(e,t){let r=(e.headers.get("Content-Disposition")||"").match(/filename="([^"]+)"/);if(!r)return t;let s=basename(r[1]);return s===""||s==="."||s===".."||/[/\\]/.test(s)||/[\u0000-\u001f]/.test(s)?t:s}async function xe(e,t,n){if(!e.body)throw new Error("Download response has no body");await mkdir(t,{recursive:true});let r=join(t,Tt(e,n)),{createHash:s,randomBytes:o}=await import('crypto'),d=`${r}.${o(8).toString("hex")}.part`,u=s("sha256"),a=0,i=Readable.fromWeb(e.body);i.on("data",l=>{u.update(l),a+=l.length;});try{await pipeline(i,createWriteStream(d));let l=e.headers.get("Content-Length");if(l!==null&&a!==Number(l))throw new V(Number(l),a);let g=e.headers.get(ke),p=u.digest("hex");if(g&&p!==g)throw new G(g,p);await rename(d,r);}catch(l){throw await rm(d,{force:true}).catch(()=>{}),l}return r}function At(e){let t=D("datasets",e);async function n(a){let i=await c(t,`/api/datasets/imports/${encodeURIComponent(a)}`);return $(await i.json())}function r(a){if(!a||typeof a!="object")return null;let i=a;return {git_url:i.git_url??null,ref:i.ref,current_commit:i.current_commit,path:i.path??null,latest_commit:i.latest_commit??null,acked_commit:i.acked_commit??null,moved:i.moved===true,behind_by:typeof i.behind_by=="number"?i.behind_by:null,checked_at:i.checked_at??null,error:i.error??null,auto_import:i.auto_import===true}}function s(a){return {name:a.name,title:a.title??null,description:a.description??null,active_version:a.active_version?N(a.active_version):null,versions:(a.versions||[]).map(N),selected_version:a.selected_version?N(a.selected_version):null,tasks:b(a.tasks,gt),upstream:r(a.upstream),created_at:a.created_at,updated_at:a.updated_at}}async function o(a,i){let l=me(a),g=y(i,{version:l.version}),p=await c(t,`/api/datasets/${encodeURIComponent(l.name)}${g}`);return s(await p.json())}function d(a){return {name:a.name,title:a.title??null,description:a.description??null,active_version:a.active_version?N(a.active_version):null,upstream:r(a.upstream)}}async function u(a){let i=await c(t,`/api/datasets${y(a,{search:a?.search})}`);return b(await i.json(),d)}return {list(a){return T(i=>u({...i,search:a?.search}),a)},get:o,async getActive(a,i){let l=await o(a,i);if(l.active_version===null)throw new z(a);return {name:l.name,title:l.title,description:l.description,active_version:l.active_version,version:l.active_version.version,tasks:l.tasks??{items:[],nextCursor:null,hasMore:false},versions:l.versions??[],created_at:l.created_at,updated_at:l.updated_at}},async publish(a){let i=a.source;if(i?.directory){if(a.name===void 0||a.version===void 0){let{existsSync:m}=await import('fs'),{join:S}=await import('path');if(!(m(S(i.directory,"dataset.toml"))||m(S(i.directory,"tasks","dataset.toml"))))throw new Error(`datasets().publish() needs ${a.name===void 0?"a name":"a version"} \u2014 pass it explicitly, or add a dataset.toml manifest to the corpus directory (the server then derives name and version from it)`)}let{tarGzipDirectory:l}=await import('./tar-KTM2224F.js'),g=await l(i.directory),p=await c(t,"/api/datasets/publish",{method:"POST",body:O({name:a.name,version:a.version},{bytes:g,filename:"corpus.tar.gz"})});return $(await p.json())}if(i&&"git_url"in i&&i.git_url){if(a.name===void 0||a.version===void 0)throw new Error("datasets().publish() requires name and version for a git source \u2014 a dataset.toml manifest can only supply them for a directory source, because a git repository is cloned server-side after the publish is accepted");let l=await c(t,"/api/datasets/publish",{method:"POST",body:O({name:a.name,version:a.version,git_url:i.git_url,git_ref:i.git_ref,...i.git_path!==void 0?{git_path:i.git_path}:{}})});return $(await l.json())}throw new Error("datasets().publish() requires either a git source ({ source: { git_url, git_ref } }) or a local corpus directory ({ source: { directory } }), plus name and version (both optional for a directory whose corpus carries a dataset.toml manifest)")},getImport:n,async watchImport(a,i){let l=i?.pollIntervalMs??it,g=null;for(;;){Z(i?.signal);let p;try{p=await n(a);}catch(m){if(m instanceof C&&(m.status===429||m.status===503)){await I(Math.max((m.retryAfterSec??0)*1e3,l),i?.signal);continue}throw m}if(p.status!==g&&(g=p.status,i?.onStatus?.(p)),ot.has(p.status))return p;await I(l,i?.signal);}},download:(async(a,i)=>{let l=me(a),g=l.version?`?version=${encodeURIComponent(l.version)}`:"",p=await c(t,`/api/datasets/${encodeURIComponent(l.name)}/download${g}`);if(i?.stream){if(!p.body)throw new Error("Package response has no body");return p.body}if(i?.to)return xe(p,i.to,`${l.name}-corpus.tar.gz`);let m=Buffer.from(await p.arrayBuffer());return Se(p,m.length),await Ee(p,m),m}),listImports(a){return T(async i=>{let l=new URLSearchParams;i.limit!==void 0&&l.set("limit",String(i.limit)),i.cursor!==void 0&&l.set("cursor",i.cursor),a?.status!==void 0&&l.set("status",a.status),a?.dataset!==void 0&&l.set("dataset",a.dataset);let g=l.toString()?`?${l}`:"",p=await c(t,`/api/datasets/imports${g}`);return b(await p.json(),$)},a)},async activate(a,i){let l=await c(t,`/api/datasets/${encodeURIComponent(a)}/versions/${encodeURIComponent(i)}/activate`,{method:"POST"});if(l.status===202){let g=await l.json();throw new X(a,i,typeof g.message=="string"?g.message:`Dataset "${a}" version "${i}" is still being proven by its activation gate`,tt(g.gate))}return s(await l.json())},async update(a,i){let l=await c(t,`/api/datasets/${encodeURIComponent(a)}`,{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});return d(await l.json())},async delete(a){await c(t,`/api/datasets/${encodeURIComponent(a)}`,{method:"DELETE"});}}}function Pt(e){let t=D("agents",e);return {async create(n){let r=await fe("agents().create()",n),s=await c(t,"/api/agents",{method:"POST",body:r});return M(await s.json())},list(n){return T(async r=>{let s=await c(t,`/api/agents${y(r)}`);return b(await s.json(),M)},n)},async get(n){let r=await c(t,`/api/agents/${encodeURIComponent(n)}`);return M(await r.json())},async delete(n){await c(t,`/api/agents/${encodeURIComponent(n)}`,{method:"DELETE"});},async upsert(n,r){let s=await fe("agents().upsert()",{...r,name:n}),o=await c(t,`/api/agents/${encodeURIComponent(n)}`,{method:"PUT",body:s});return M(await o.json())}}}async function fe(e,t){let n=typeof t.install_script=="string",r=typeof t.directory=="string";if(n&&r)throw new Error(`${e} takes EITHER an install script ({ install_script }) or a local directory ({ directory }), not both`);if(!n&&!r)throw new Error(`${e} requires either an install script ({ install_script }) or a local directory ({ directory }), plus run_command`);let s={name:t.name,run_command:t.run_command,...t.env!==void 0?{env:JSON.stringify(t.env)}:{},...n?{install_script:t.install_script}:{}};if(r){let{tarGzipDirectory:o}=await import('./tar-KTM2224F.js'),d=await o(t.directory);return O(s,{bytes:d,filename:"source.tar.gz"})}return O(s)}function W(e){return {id:e.id,name:e.name,digest:e.digest,size_bytes:e.size_bytes??0,description:e.description??null,ref:e.ref??`upload:${e.id}`,created_at:e.created_at}}function wt(e){let t=D("skills",e);return {async upload(n){if(typeof n!="string"||!n.trim())throw new Error("skills().upload() requires a local skill directory path");let{tarGzipDirectory:r}=await import('./tar-KTM2224F.js'),{basename:s,resolve:o}=await import('path'),d=s(o(n)),u=await r(n),i=await(await c(t,"/api/skills",{method:"POST",body:O({name:d||void 0},{bytes:u,filename:"skill.tar.gz"})})).json();return (Array.isArray(i.skills)?i.skills:[i]).map(W)},list(n){return T(async r=>{let s=await c(t,`/api/skills${y(r)}`);return b(await s.json(),W)},n)},async get(n){let s=await(await c(t,`/api/skills/${encodeURIComponent(n)}`)).json();return {...W(s),skill_md:s.skill_md??null}},async delete(n){await c(t,`/api/skills/${encodeURIComponent(n)}`,{method:"DELETE"});}}}function Ct(e){let t=D("jobs",e);async function n(u){let a=await c(t,`/api/jobs/${encodeURIComponent(u)}`);return k(await a.json())}async function r(u){let a=await c(t,`/api/jobs${y(u,{search:u?.search})}`);return b(await a.json(),k)}function s(u){let a=u.trials??{};return {task_name:u.task_name,source:u.source,trials:{total:a.total??0,byStatus:a.byStatus??{}},mean_reward:u.mean_reward??null,cost_usd:u.cost_usd??null}}async function o(u,a){let i=y(a,{status:a?.status?.length?a.status.join(","):void 0,dataset:a?.dataset}),l=await c(t,`/api/jobs/${encodeURIComponent(u)}/trials${i}`);return b(await l.json(),Q)}async function*d(u,a){let{onEvent:i,signal:l}=a??{},g=a?.reconnectDelayMs??nt,p=a?.maxReconnectDelayMs??rt,m=null,S=false,F=false,f=g;for(;!S;){Z(l);let h;try{h=await fetch(`${t.baseUrl}/api/jobs/${encodeURIComponent(u)}/events`,{headers:{Authorization:`Bearer ${t.apiKey}`,Accept:"text/event-stream",...m!==null?{"Last-Event-ID":String(m)}:{}},signal:l});}catch(_){if(_e(_,l))throw _;await I(f,l),f=Math.min(f*2,p);continue}if(!h.ok){if(h.status===429||h.status>=500){let _=await h.text().catch(()=>""),R=be(_,h)??0,E=R>0?Math.max(R*1e3,f):f;await I(E,l),f=Math.min(f*2,p);continue}await ee(h);}if(!h.body)throw new Error("Event stream response has no body");let te=false,q=[],Te=Et(_=>{let R=Number(_.id),E={seq:Number.isInteger(R)?R:-1,type:_.event||"message",data:_.data?It(_.data):{}};Number.isInteger(R)&&(m=R),te=true,at.has(E.type)&&(S=true),q.push(E);}),ne=h.body.getReader(),Ae=new TextDecoder;try{for(;!S;){let{done:_,value:R}=await ne.read();if(_)break;Te.push(Ae.decode(R,{stream:!0}));for(let E of q)i?.(E),yield E;q.length=0;}}catch(_){if(_e(_,l))throw _}finally{await ne.cancel().catch(()=>{});}if(S)break;Z(l);let re=await n(u);if(st.has(re.status)){if(F)return re;F=true;continue}te&&(f=g),await I(f,l),f=Math.min(f*2,p);}return n(u)}return {async start(u,a){let i=await c(t,"/api/jobs",{method:"POST",headers:{"Content-Type":"application/json",...a?.idempotencyKey?{"Idempotency-Key":a.idempotencyKey}:{}},body:JSON.stringify(u)});return k(await i.json())},get:n,list(u){return T(a=>r({...a,search:u?.search}),u)},trials(u,a){return T(i=>o(u,{...i,status:a?.status,dataset:a?.dataset}),a)},tasks(u,a){return T(async i=>{let l=await c(t,`/api/jobs/${encodeURIComponent(u)}/tasks${y(i)}`);return b(await l.json(),s)},a)},watch(u,a){return xt(d(u,a))},async cancel(u){let a=await c(t,`/api/jobs/${encodeURIComponent(u)}/cancel`,{method:"POST"});return k(await a.json())},async compare(u){let a=u.map(encodeURIComponent).join(","),l=await(await c(t,`/api/jobs/compare?ids=${a}`)).json();return {jobs:(l.jobs||[]).map(ht),taskMatrix:(l.taskMatrix||[]).map(vt)}},async resume(u,a,i){let l=await c(t,`/api/jobs/${encodeURIComponent(u)}/resume`,{method:"POST",headers:{"Content-Type":"application/json",...i?.idempotencyKey?{"Idempotency-Key":i.idempotencyKey}:{}},body:JSON.stringify(a??{})});return k(await l.json())},async retry(u,a,i){let l=await c(t,`/api/jobs/${encodeURIComponent(u)}/retry`,{method:"POST",headers:{"Content-Type":"application/json",...i?.idempotencyKey?{"Idempotency-Key":i.idempotencyKey}:{}},body:JSON.stringify(a??{})});return k(await l.json())},async regrade(u,a){let i={};a?.statuses?.length&&(i.statuses=a.statuses),a?.task_name!==void 0&&(i.task_name=a.task_name);let l=await c(t,`/api/jobs/${encodeURIComponent(u)}/regrade`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});return k(await l.json())},download:(async(u,a)=>{let i=await c(t,`/api/jobs/${encodeURIComponent(u)}/download`);if(a?.stream){if(!i.body)throw new Error("Download response has no body");return i.body}if(a?.to)return xe(i,a.to,`job-${u}-results.tar.gz`);let l=Buffer.from(await i.arrayBuffer());return Se(i,l.length),await Ee(i,l),l}),async grep(u,a,i){let l=await c(t,`/api/jobs/${encodeURIComponent(u)}/grep${y(i,{q:a,type:i?.type})}`);return b(await l.json(),kt)}}}function Dt(e){let t=D("trials",e);async function n(s,o){let d=await c(t,`/api/trials/${encodeURIComponent(s)}/trace${y(o,{type:o?.type,grep:o?.grep,tail:o?.tail!==void 0?String(o.tail):void 0})}`);return b(await d.json(),ve)}async function r(s,o){let u=await(await c(t,`/api/trials/${encodeURIComponent(s)}/trace?stream=${o}`)).json();return o==="agent-home"?u.files??null:u.log??null}return {async get(s){let o=await c(t,`/api/trials/${encodeURIComponent(s)}`);return Q(await o.json())},trace:n,artifact:r,async*traceEvents(s,o){let d=o?.cursor;for(;;){let u=await n(s,{...o,cursor:d});for(let a of u.items)yield a;if(!u.nextCursor)return;d=u.nextCursor;}},async regrade(s){let o=await c(t,`/api/trials/${encodeURIComponent(s)}/regrade`,{method:"POST"});return k(await o.json())},async retry(s,o){let d=await c(t,`/api/trials/${encodeURIComponent(s)}/retry`,{method:"POST",...o?.idempotencyKey?{headers:{"Idempotency-Key":o.idempotencyKey}}:{}});return k(await d.json())},async stop(s){let d=await(await c(t,"/api/trials/stop",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({trial_ids:s})})).json();return {stopped:(d.stopped??[]).map(Q),already_terminal:d.already_terminal??[],not_found:d.not_found??[]}},async files(s,o){let d=await c(t,`/api/trials/${encodeURIComponent(s)}/files${y(o)}`);return b(await d.json(),u=>({path:u.path,size_bytes:u.size_bytes}))},async file(s,o,d){let u=o.split("/").filter(Boolean).map(encodeURIComponent).join("/"),a=St(d),i=await c(t,`/api/trials/${encodeURIComponent(s)}/files/${u}`,a?{headers:{Range:a}}:void 0);return Buffer.from(await i.arrayBuffer())}}}function Pn(e){let t=D("auth",e);return {async status(){let r=await(await c(t,"/api/auth/status")).json(),s=r.key??{};return {user_id:r.user_id,email:r.email??null,key:{id:s.id,label:s.label??null,created_at:s.created_at,last_used_at:s.last_used_at??null}}}}}function It(e){try{let t=JSON.parse(e);return t&&typeof t=="object"?t:{value:t}}catch{return {raw:e}}}function wn(e){let t,n,r,s,o;return {get datasets(){return t??=At(e)},get agents(){return n??=Pt(e)},get jobs(){return r??=Ct(e)},get trials(){return s??=Dt(e)},get skills(){return o??=wt(e)},meta(){return Ot(e)}}}async function Ot(e){let t=(e?.baseUrl||process.env.EVOLVE_DASHBOARD_URL||A).replace(/\/$/,""),n=await fetch(`${t}/api/meta`);return n.ok||await ee(n),await n.json()}export{He as $,tn as A,nn as B,le as C,v as D,ue as E,K as F,an as G,on as H,ln as I,un as J,dn as K,cn as L,pn as M,Me as N,gn as O,mn as P,_n as Q,fn as R,bn as S,$e as T,Ge as U,Ve as V,Fe as W,ce as X,Y,qe as Z,ge as _,Pe as a,Be as aa,we as b,C as ba,Lt as c,z as ca,se as d,X as da,Jt as e,G as ea,Nt as f,V as fa,Ut as g,At as ga,H as h,Pt as ha,jt as i,wt as ia,Mt as j,Ct as ja,$t as k,Dt as ka,Gt as l,Pn as la,Vt as m,wn as ma,Ft as n,Ot as na,qt as o,Ht as p,ae as q,Bt as r,A as s,Yt as t,Wt as u,zt as v,Xt as w,Qt as x,Zt as y,en as z};