npm - @tangle-network/sandbox-cli - Versions diffs - 0.22.104 → 0.22.105 - Mend

@tangle-network/sandbox-cli 0.22.104 → 0.22.105

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.mjs +14 -14
package/package.json +4 -4

package/dist/index.mjs CHANGED Viewed

@@ -144,15 +144,15 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
 Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(`  - ${e}`)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?z(i):U({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})})}function Xs(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Zs(e){e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=Xs(i.machines);t.json?z({fleetId:i.fleetId,machines:a}):R(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?z(i):(U({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),R(i.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?z({success:!0,fleetId:e}):B(`Fleet deleted: ${e}`)}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).action(async e=>{let{client:t}=J(e),n=H(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?z(r):(U({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),R(r.fleets,[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).action(async e=>{let{client:t}=J(e),n=H(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?z(r):(U({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),R(r.machines,[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))})}async function Qs(e,t){let n=await Ci({apiKey:t.apiKey,baseUrl:t.baseUrl??Qr()}),r=await fetch(`${n.baseUrl}/v1/agent-profiles/${encodeURIComponent(e)}`,{headers:{authorization:`Bearer ${n.token}`,accept:`application/json`}});if(!r.ok){let t=await r.text().catch(()=>``);throw r.status===404?Error(`profile '${e}' not found in the platform catalog (it may be a built-in, a stored profile you own, or neither — run 'tangle profile list' to see what is available)`):Error(`platform returned ${r.status}: ${t.slice(0,200)}`)}let i=await r.json();if(!i.definition||typeof i.definition!=`object`)throw Error(`profile '${e}' resolved but has no definition — the catalog entry is malformed`);return i.definition}async function $s(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await Hi();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function ec(e){if(e.secret===void 0)return;let t=e.backend===`claude-code`?`token`:e.backend===`codex`?`bundle`:void 0;if(!t)throw Error(`--cli-auth needs --backend claude-code or --backend codex`);if(e.apiKeyGiven)throw Error(`--cli-auth cannot be combined with --backend-api-key-env or --backend-api-key-stdin`);return{account:`cli`,secretEnv:e.secret,format:t}}function tc(e){if(e!==void 0)return e.map(e=>{if(e.includes(`@`)||e.includes(`:`))throw Error(`--secret ${e}: bare secret names only (box delivery). For proxy custody use --proxy-secret with a canonical binding`);return e})}function nc(e,t){let n={};return e.cpu!==void 0&&(n.cpuCores=Ws(e.cpu,`--cpu`)),e.memory!==void 0&&(n.memoryMB=Ws(e.memory,`--memory`)),e.disk!==void 0&&(n.diskGB=Ws(e.disk,`--disk`)),t&&(n.accelerator=t),Object.keys(n).length>0?n:void 0}function rc(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function ic(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=ac(r.join(`=`))}return t}function ac(e){try{return JSON.parse(e)}catch{return e}}function oc(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?Ws(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function sc(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:cc(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}function cc(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function lc(e){if(e===void 0)return;let t=[];for(let n of e){let e=n,r=`--proxy-secret <json>`;if(n.startsWith(`@`)){let t=n.slice(1);r=`--proxy-secret @${t}`;try{e=fe(t,`utf8`)}catch{throw Error(`${r}: file could not be read`)}}let i;try{i=JSON.parse(e)}catch(e){throw Error(`${r}: not valid JSON (${e instanceof Error?e.message:String(e)})`)}if(Array.isArray(i))t.push(...i);else if(typeof i==`object`&&i)t.push(i);else throw Error(`${r}: expected a binding object or an array of bindings`)}let n=D.parse(t);return n.length>0?n:void 0}function uc(e){V(`  Status: ${e.status}`),V(`  Provider: ${e.provider}`),V(`  GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&V(`  Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&V(`  Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(V(`  Billed seconds: ${e.billing.seconds}`),V(`  Customer cost: $${e.billing.customerCostUsd}`))}function dc(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),V(`Exit code: ${e.result.exitCode}`)}function fc(e){let t=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);t.command(`providers <id-or-name>`).description(`List GPU clouds, whether each credential works, and current prices`).option(`--accelerator-kind <kind>`,`Price this GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Checking GPU providers...`);i.start();let a=await(await Y(r,n,e)).gpu.providers(t.acceleratorKind?{accelerator:Ls({kind:t.acceleratorKind,count:t.acceleratorCount,memory:t.acceleratorMemory})}:{});if(i.stop(),t.json){z(a);return}R(a.statuses.map(e=>({provider:e.provider,state:e.state,gpu:e.estimate?.providerInstanceType??``,usdHr:e.estimate?e.estimate.customerPricePerHourUsd.toFixed(4):``,pricing:e.estimate?.pricingSource??``,needs:e.envVars.join(` `)})),[{key:`provider`,header:`Provider`},{key:`state`,header:`State`},{key:`gpu`,header:`GPU`},{key:`usdHr`,header:`$/hr`},{key:`pricing`,header:`Price`},{key:`needs`,header:`Needs`}]);for(let e of a.statuses){let t=e.state===`credential-invalid`?e.credential?.detail:e.estimateError;t&&V(`${e.provider}: ${t}`)}a.usable.length===0&&V(`No GPU provider is usable on this deployment: set the variables in Needs for one provider on the server.`)}),t.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Attaching GPU lease...`);i.start();let a=await(await Y(r,n,e)).gpu.attach(zs(t));i.stop(),t.json?z(a):(B(`GPU lease attached: ${a.id}`),uc(a))}),t.command(`run <id-or-name> <command...>`).description(`Attach a GPU, run a command or script, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).action(async(e,t,n)=>{let r,i,a,o;try{let{context:a,client:o}=J(n),s=await Y(o,a,e),c=H(`Attaching GPU lease...`);c.start(),r=await s.gpu.attach(zs(n)),c.stop();let l=H(`Running GPU command...`);l.start(),i=await s.gpu.exec(r.id,{command:Vs(t),...Hs(n),cwd:n.cwd}),l.stop(),n.json||dc(i)}catch(e){a=e}finally{if(r)try{let{context:t,client:i}=J(n);r=await(await Y(i,t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){G(a),o&&G(o);return}if(o){G(o);return}n.json?z({lease:r,result:i}):r&&B(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),t.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching GPU leases...`);i.start();let a=await(await Y(r,n,e)).gpu.list();i.stop(),t.json?z(a):a.length===0?V(`No GPU leases attached.`):R(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}),t.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command or script on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).action(async(e,t,n,r)=>{let{context:i,client:a}=J(r),o=H(`Running GPU command...`);o.start();let s=await(await Y(a,i,e)).gpu.exec(t,{command:Vs(n),...Hs(r),cwd:r.cwd});o.stop(),r.json?z(s):dc(s)}),t.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Detaching GPU lease...`);a.start();let o=await(await Y(i,r,e)).gpu.detach(t);a.stop(),n.json?z(o):(B(`GPU lease detached: ${o.id}`),uc(o))})}function pc(e,t){if(t){z(e);return}if(!e.id){e.kind===`snapshot`&&e.result?.snapshot?B(`Snapshot created: ${e.result.snapshot.snapshotId}`):B(`Sandbox ${e.sandboxId} stopped.`);return}B(`${e.kind===`snapshot`?`Snapshot`:`Stop`} of sandbox ${e.sandboxId} accepted.`),V(`Operation: ${e.id}`),V(`Status: ${e.statusUrl}`)}function mc(e){return`${e.name} (${e.id})`}async function hc(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function gc(e,t,n){if(t)return hc(e,t);let r=ti(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function _c(e,t){ni({id:e.id,name:e.name},t)}function vc(e){ri(e)}async function yc(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await hc(e.client,e.explicitTeam)).id:e.activeTeamId}async function bc(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await hc(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function xc(e){if(!e)return e;let t={...e};for(let e of[`authToken`,`execToken`])t[e]!==void 0&&(t[e]=`[REDACTED]`);return t}function Sc(e){e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=t.nonce===`auto`?g():t.nonce,a=H(`Fetching TEE attestation...`);a.start();let o=await(await Y(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?z(o):(B(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).action(async e=>{let{context:t,client:n}=J(e),r=H(`Fetching sandboxes...`);r.start();let i=await bc({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?z(a):R(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--profile`,`Show the active agent profile provenance (name, hash, skills)`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching sandbox...`);i.start();let a=await Y(r,n,e);if(i.stop(),t.profile){let e=a.getProfileProvenance?.();e?(V(`Agent profile provenance:`),V(`  Base profile: ${e.base.name??`(inline)`} (${e.base.sha256.slice(0,12)}...)`),V(`  Effective:    ${e.effective.name??`(inline)`} (${e.effective.sha256.slice(0,12)}...)`),V(`  Materialized: ${e.materializedAt}`),e.base.sha256!==e.effective.sha256&&V(`  ⚠ Profile changed since creation (base ≠ effective)`)):V(`No profile materialized (bare sandbox). Create with --profile <name> to install one.`);return}t.json?z(a):An({id:a.id,name:a.name,status:a.status,resources:a.resources,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}),e.command(`shapes`).description(`List the named sandbox sizes, the default, and this account's ceiling`).action(async e=>{let{client:t}=J(e),n=await t.shapes();if(e.json){z(n);return}let r=e=>e.cpuCores<=n.ceiling.cpuCores&&e.memoryMB<=n.ceiling.memoryMB&&e.diskGB<=n.ceiling.diskGB;R(n.presets.map(e=>({name:e.name===n.default?`${e.name} (default)`:e.name,cpu:e.cpuCores,memory:`${e.memoryMB} MB`,disk:`${e.diskGB} GB`,available:r(e)?`yes`:e.name===n.default?`clamped to ceiling`:`above ceiling`})),[{key:`name`,header:`Shape`,width:18},{key:`cpu`,header:`vCPU`,width:6},{key:`memory`,header:`Memory`,width:10},{key:`disk`,header:`Disk`,width:8},{key:`available`,header:`Available`,width:14}]),V(`Ceiling for this account: ${kn(n.ceiling)}`)}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).action(async(e,t)=>{if(!t.force&&!await Bi(`Delete sandbox ${e}? [y/N] `,`--force`)){V(`Cancelled.`);return}let{context:n,client:r}=J(t),i=H(`Deleting sandbox...`);i.start();let a=await Ni(r,n,e,{retryCleanup:t.retryCleanup,name:t.name});i.stop(),B(a===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--no-wait`,`Return once the stop is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Stopping sandbox...`);i.start();let a=await Y(r,n,e,{nameOnly:t.name});if(t.wait===!1){let e=await a.stop({wait:!1});i.stop(),pc(e.info,!!t.json);return}await a.stop(),i.stop(),B(`Sandbox ${e} stopped.`)}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).action(async(e,t)=>{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=K({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=q(r),a=H(`Resuming sandbox...`);a.start();let o=await Y(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),B(`Sandbox ${o.id} resumed.`)})}function Cc(e){e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,wc).addOption(Tc()).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets selected by bare name for box delivery (value in the sandbox env). For proxy custody use --proxy-secret`).option(`--proxy-secret <bindings...>`,`Canonical proxy custody binding(s): one binding as inline JSON, or @file with a JSON array. The value stays at the egress proxy and is redeemed only within the binding's scope (hosts/methods/paths/TTL); the box reads a placeholder. Repeatable`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,"CPU cores (omit for the platform default; see `sandbox shapes`)").option(`--memory <mb>`,`Memory in MB (omit for the platform default)`).option(`--disk <gb>`,`Disk size in GB (omit for the platform default)`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).addOption(new C(`--driver <type>`,`Run on Tangle network operators instead of the platform's hosts (--tee needs it)`).choices([`tangle`])).option(`--backend <type>`,`Backend agent type (${n.join(`, `)})`).option(`--backend-model <model>`,`Model override (format: provider/model)`).addOption(new C(`--reasoning-effort <level>`,`Reasoning effort for the backend's model; overrides the profile's model.reasoningEffort`).choices(O)).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--cli-auth <secret>`,"Run --backend claude-code or codex on your own subscription: the stored secret holding a `claude setup-token` token or a Codex auth.json (see `tangle secret create`)").option(`--profile <path>`,`Path to an AgentProfile JSON file to install as the sandbox's backend profile (carries skills, tools, MCP, model). Use with --backend; the profile's inline skills materialize into the harness's native skill directory on first turn`).option(`--profile-stdin`,`Read the AgentProfile JSON from stdin instead of a file (use with --profile)`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).action(async e=>{let t=await $s({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),n=await $s({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),r=await $s({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),i=ec({secret:e.cliAuth,backend:e.backend,apiKeyGiven:r!==void 0}),a;if(e.profileStdin){let e=await Hi(`--profile-stdin`,`the AgentProfile JSON`);try{a=JSON.parse(e)}catch{G(Error(`--profile-stdin: the input is not valid JSON`));return}}else if(e.profile){let t=String(e.profile);if(t.startsWith(`.`)||t.startsWith(`/`)||t.endsWith(`.json`))try{a=JSON.parse(fe(t,`utf8`))}catch(e){G(Error(`--profile ${t}: ${e.message}`));return}else try{a=await Qs(t,e)}catch(e){G(Error(`--profile ${t}: ${e.message}`));return}}a=Dc(a,e.reasoningEffort);let o=K({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),s=q(o),c=H(`Creating sandbox...`);c.start();let l=await yc({client:s,explicitTeam:e.team,personal:e.personal,activeTeamId:o.activeTeamId}),u=Us(e.env??[],`--env`,`env`),d=e.metadata?ic(e.metadata):void 0,f=oc(e,t),p=sc(e,n),m=e.acceleratorKind?Ls({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,g=Rs({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!m,`Create-time GPU lease flags require --accelerator-kind`),v=e.driver?{type:`tangle`}:void 0,y=e.backend||e.backendModel||a?{...e.backend?{type:_(e.backend)}:{},...a?{profile:a}:{},model:e.backendModel||r||i?{...e.backendModel?rc(e.backendModel):{},apiKey:r,...i?{cliAuth:i}:{}}:void 0}:void 0,b=tc(e.secret),x=i?[...new Set([...b??[],i.secretEnv])]:b,S=lc(e.proxySecret),C=nc(e,m),w=e.sshKeyFile??(e.ssh&&!e.sshKey&&!e.sshKeys?.length?[Ec()]:[]),T=[...e.sshKey?[e.sshKey]:[],...w.map(e=>fe(e,`utf8`).trim())],E={name:e.name,environment:e.environment,runtime:e.runtime,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||T.length>0||!!e.sshKeys?.length,sshPublicKeys:T.length>0?T:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(u).length>0?u:void 0,git:f,...C?{resources:C}:{},gpuLease:g,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:p,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:l,...e.billingOwner?{billingOwnerId:e.billingOwner}:{},secrets:x,...S?{proxySecrets:S}:{},metadata:d,driver:v,backend:y},D=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,O=D?await h(s,{...E,confidential:D,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,k=O?.sandbox??await s.create(E);e.wait&&(c.text=`Waiting for sandbox to start...`,await k.waitFor(`running`,{timeoutMs:12e4}),await k.refresh()),c.stop(),e.json?z({id:k.id,name:k.name,status:k.status,resources:k.resources,createdAt:k.createdAt,expiresAt:k.expiresAt,connection:xc(k.connection),teamId:l,gpuLease:k.gpuLease,confidential:D,attestation:O?.attestation,attestationNonce:O?.attestationNonce}):(B(`Sandbox created: ${k.id}`),An({id:k.id,name:k.name,status:k.status,resources:k.resources,createdAt:k.createdAt?.toISOString(),expiresAt:k.expiresAt?.toISOString(),connection:k.connection}),l&&console.log(`Team: ${l}`),k.gpuLease&&(console.log(`GPU lease: ${k.gpuLease.id}`),uc(k.gpuLease)),D&&(console.log(`TEE: ${D.tee}`),console.log(`Attestation: ${O?.attestation?`present`:`not returned`}`),O?.attestationNonce&&console.log(`Attestation nonce: ${O.attestationNonce}`)))})}const wc="A catalog environment, a container image reference, or a built image ID. Firecracker runs only images pinned by repository@sha256 that the cell's Firecracker hosts carry; `environments list` shows each image's runtimes";function Tc(){return new C(`--runtime <runtime>`,`Isolation on the platform's hosts: docker runs a container on the host kernel, firecracker a microVM with its own kernel. Omit for the platform default`).choices(c)}function Ec(){let e=[`id_ed25519`,`id_ecdsa`,`id_rsa`].map(e=>`${N()}/.ssh/${e}.pub`),t=e.find(e=>ue(e));if(!t)throw Error(`--ssh needs a public key and found none at ${e.join(`, `)}. Run ssh-keygen -t ed25519, or pass --ssh-key-file.`);return t}function Dc(e,t){if(!t)return e;let n=e?.model??{};return{...e,model:{...n,reasoningEffort:t}}}function Oc(e){if(e.spec){let t=JSON.parse(fe(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=jc(e),n=Mc(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.runtime?{runtime:e.runtime}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=Nc(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function kc(e){let{base:t,machines:n}=Oc(e);return{...t,machines:n}}function Ac(e){let{base:t,machines:n}=Oc(e);return{...t,workers:n}}function jc(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=Ls({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function Mc(e,t){return Rs({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function Nc(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function Pc(e){e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,wc).addOption(Tc()).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <gb>`,`Minimum memory per GPU in decimal GB`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated (no driver supports shared yet)`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).action(async e=>{let{client:t}=J(e),n=H(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(Ac(e)):await t.fleets.create(kc(e));n.stop();let i=Xs(r.machines);e.json?z({fleetId:r.fleetId,machines:i}):(B(`Fleet created: ${r.fleetId}`),R(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))})}function Fc(e){e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).action(async(e,t,n)=>{let{client:r}=J(n),i=H(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)z(a);else{R(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}),e.command(`run [prompt]`).description(`Create a fleet of agents, run one turn on every agent, print each result, then delete the fleet`).requiredOption(`--agents <n|file>`,`Number of agents, or a JSON file with an array of agent specs (agentId, harness, model, profile or { profileId, revision }, task)`).option(`--placement <mode>`,`auto (pack by sandbox memory), dedicated (one sandbox per agent), or a number of agents per sandbox`,`auto`).option(`--model <id>`,`Model every agent runs, e.g. gpt-4.1-mini`).option(`--memory <mb>`,`Memory in MB per sandbox; auto placement packs by it`).option(`--environment <environment>`,`Environment for each sandbox`).option(`--max-spend-usd <usd>`,`Budget for the fleet in USD, enforced by the Platform on the fleet's own key`).option(`--timeout <ms>`,`Per-agent turn timeout in milliseconds`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--parent-fleet <id>`,`Fleet that spawns this one; its cap must cover this cap`).option(`--parent-agent <id>`,`Agent of --parent-fleet that spawns this one`).option(`--keep`,`Keep the fleet after the run instead of deleting it`).action(async(e,t)=>{let n=/^\d+$/.test(t.agents)?Number(t.agents):JSON.parse(fe(t.agents,`utf8`));if(!Array.isArray(n)&&e===void 0)throw Error(`A prompt is required unless --agents names a file whose agents carry tasks`);let{client:r}=J(t);if(!!t.parentFleet!=!!t.parentAgent)throw Error(`--parent-fleet and --parent-agent go together`);let i=t.placement===`auto`||t.placement===`dedicated`?t.placement:{agentsPerSandbox:Number(t.placement)},a=t.maxSpendUsd?Number(t.maxSpendUsd):void 0,o=H(`Creating fleet...`);o.start();let s=Date.now(),c=await r.fleets.create({fleetId:t.fleetId,agents:n,placement:i,defaults:{...t.environment?{environment:t.environment}:{},...t.memory?{resources:{memoryMB:Number(t.memory)}}:{},...t.model?{backend:{type:`opencode`,model:{model:t.model}}}:{}},...a===void 0?{}:{budgetUsd:a},...t.parentFleet?{parent:{fleetId:t.parentFleet,agentId:t.parentAgent}}:{}}),l=Date.now()-s;o.stop(),t.json||B(`Fleet ${c.fleetId}: ${c.agents.length} agents on ${c.machines.size} sandboxes in ${l} ms`);let u=[],d;try{for await(let n of c.run(e,{timeoutMs:t.timeout?Number(t.timeout):void 0})){if(n.type===`agent.finished`&&!t.json){let e=n.result;console.log(`[${e.agentId}] ${e.harness??`default`}/${e.model??`default`} ${e.status} ${e.durationMs}ms ${e.costUsd===void 0?`no cost reported`:`$${e.costUsd.toFixed(5)}`} ${e.result?.response??e.error??``}`)}n.type===`fleet.finished`&&(u=n.results,d=n.spend)}}finally{t.keep||await c.delete({continueOnError:!0})}t.json?z({fleetId:c.fleetId,createMs:l,sandboxes:c.machines.size,results:u,spend:d,deleted:!t.keep}):U({fleetId:c.fleetId,completed:u.filter(e=>e.status===`completed`).length,agents:u.length,spend:JSON.stringify(d),deleted:!t.keep}),u.some(e=>e.status!==`completed`)&&(process.exitCode=1)}),e.command(`cancel <fleet-id>`).description(`Interrupt every agent of a fleet and cancel its child fleets; sandboxes keep running`).action(async(e,t)=>{let{client:n}=J(t),r=await(await n.fleets.list({fleetId:e})).cancel();t.json?z({fleetId:e,...r}):B(`Fleet ${e}: interrupted ${r.interrupted} agents, cancelled ${r.children} child fleets`)})}const Ic=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function Lc(e){if(!(!e||e.length===0)){for(let t of e)if(!Ic.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${Ic.join(`, `)}`);return e}}function Rc(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function zc(e){e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write (prompt grants nothing since fleet prompt dispatch was removed)`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:Lc(t.action),ttlMinutes:t.ttlMinutes?Number(t.ttlMinutes):void 0});r.stop(),t.json?z(i):(U({"Fleet ID":i.fleetId,Token:Rc(i.token),"Expires at":new Date(i.expiresAt).toISOString(),Actions:i.actions.join(`, `)}),console.log(`
 Re-run with --json to print the full token value.`))})}function Bc(){let e=new S(`workspace`).description(`Manage a fleet's shared workspace`);return e.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Creating workspace snapshot...`);r.start();let i=await n.fleets.createWorkspaceSnapshot(e);r.stop(),t.json?z(i):B(`Workspace snapshot created: ${i.snapshotId??i.id}`)}),e.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).action(async(e,t,n)=>{let{client:r}=J(n),i=H(`Restoring workspace...`);i.start();let a=await r.fleets.restoreWorkspaceSnapshot(e,t);i.stop(),n.json?z(a):B(`Workspace restored from ${a.snapshotId??t}`)}),e.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).action(async(e,t)=>{let{client:n}=J(t),r=H(`Reconciling workspace...`);r.start();let i=await n.fleets.reconcileWorkspace(e);r.stop(),t.json?z(i):(U({"Fleet ID":i.fleetId,Checked:i.checked,"Orphaned mounts":i.orphanedMounts}),R(i.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}),e}function Vc(){let e=new S(`fleet`).description(`Manage sandbox fleets`);return Pc(e),Zs(e),e.addCommand(Bc()),Fc(e),Ys(e),zc(e),e}function Hc(){let e=new S(`fs`).description(`File system operations on sandboxes`);return e.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).action(async(e,t,n,r)=>{let{context:i,client:a}=J(r),o=await Y(a,i,e);if(o=await X(o),!se.existsSync(t))throw Error(`Local file not found: ${t}`);let s=se.statSync(t),c=Date.now();r.json||console.error(`Uploading ${t} to ${n}...`),await o.fs.upload(t,n,{onProgress:e=>{if(r.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c;r.json||console.error(``),r.json?z({success:!0,localPath:t,remotePath:n,size:s.size,durationMs:l}):console.log(`✓ Uploaded ${s.size} bytes in ${l}ms`)}),e.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).action(async(e,t,n,r)=>{let{context:i,client:a}=J(r),o=await Y(a,i,e);o=await X(o);let s=Date.now();r.json||console.error(`Downloading ${t} to ${n}...`),await o.fs.download(t,n,{onProgress:e=>{if(r.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let c=Date.now()-s,l=se.statSync(n);r.json||console.error(``),r.json?z({success:!0,remotePath:t,localPath:n,size:l.size,durationMs:c}):console.log(`✓ Downloaded ${l.size} bytes in ${c}ms`)}),e.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a);let o=await a.fs.list(t,{all:n.all,long:n.long});if(n.json)z(o);else if(n.long)jn([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],o.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=Uc(e.permissions),r=e.isDir?`<DIR>`:Wc(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=o.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(`  `))}}),e.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a);let o=await a.fs.stat(t);n.json?z(o):(console.log(`  File: ${o.name}`),console.log(`  Path: ${o.path}`),console.log(`  Size: ${Wc(o.size)} (${o.size} bytes)`),console.log(`  Type: ${o.isDir?`directory`:o.isSymlink?`symlink`:`file`}`),console.log(`  Mode: ${Uc(o.permissions)} (${o.permissions.toString(8)})`),console.log(`  Owner: ${o.owner}`),console.log(`  Group: ${o.group}`),console.log(`  Modified: ${o.modTime.toISOString()}`),console.log(`  Accessed: ${o.accessTime.toISOString()}`))}),e.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a);let o=await a.read(t);n.json?z({path:t,content:o}):console.log(o)}),e.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a),await a.fs.delete(t,{recursive:n.recursive}),n.json?z({success:!0,path:t,deleted:!0}):console.log(`✓ Deleted: ${t}`)}),e.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a),await a.fs.mkdir(t,{recursive:n.parents}),n.json?z({success:!0,path:t,created:!0}):console.log(`✓ Created: ${t}`)}),e.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a);let o=await a.fs.exists(t);n.json?z({path:t,exists:o}):(console.log(o?`exists`:`not found`),process.exit(+!o))}),e}function Uc(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function Wc(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function Gc(){let e=new S(`git`).description(`Git operations in a sandbox workspace`);return e.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching status...`);t.json||i.start();let a=await Y(r,n,e);a=await X(a);let o=await a.git.status();if(i.stop(),t.json)z(o);else if(!o.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch:    ${o.branch??`unknown`}`),console.log(`HEAD:      ${o.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty:     ${o.isDirty?`yes`:`no`}`),o.ahead&&console.log(`Ahead:     ${o.ahead}`),o.behind&&console.log(`Behind:    ${o.behind}`),o.staged.length>0){console.log(`\nStaged (${o.staged.length}):`);for(let e of o.staged)console.log(`  + ${e}`)}if(o.modified.length>0){console.log(`\nModified (${o.modified.length}):`);for(let e of o.modified)console.log(`  M ${e}`)}if(o.untracked.length>0){console.log(`\nUntracked (${o.untracked.length}):`);for(let e of o.untracked)console.log(`  ? ${e}`)}}}),e.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching log...`);t.json||i.start();let a=await Y(r,n,e);a=await X(a);let o=await a.git.log(Number.parseInt(t.limit,10));if(i.stop(),t.json)z(o);else if(o.length===0)console.log(`No commits found`);else for(let e of o)console.log(`${e.shortSha} ${e.message.split(`
 `)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching diff...`);t.json||i.start();let a=await Y(r,n,e);a=await X(a);let o=await a.git.diff(t.ref);i.stop(),t.json?z(o):o.raw?console.log(o.raw):console.log(`${o.additions} additions, ${o.deletions} deletions across ${o.files.length} files`)}),e.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a),await a.git.add(t),B(`Staged: ${t.join(`, `)}`)}),e.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=await Y(r,n,e);i=await X(i);let a=await i.git.commit(t.message,{amend:t.amend});t.json?z(a):B(`Committed: ${a.shortSha} ${a.message}`)}),e.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Pushing...`);i.start();let a=await Y(r,n,e);a=await X(a),await a.git.push({force:t.force}),i.stop(),B(`Pushed to remote`)}),e.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Pulling...`);i.start();let a=await Y(r,n,e);a=await X(a),await a.git.pull({rebase:t.rebase}),i.stop(),B(`Pulled from remote`)}),e.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching branches...`);t.json||i.start();let a=await Y(r,n,e);a=await X(a);let o=await a.git.branches();i.stop(),t.json?z(o):o.length===0?console.log(`No branches found`):jn([`Name`,`Current`,`Remote`],o.map(e=>[e.name,e.current?`* `:`  `,e.upstream??`-`]))}),e.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a),await a.git.checkout(t,{create:n.create}),B(`Checked out: ${t}${n.create?` (new)`:``}`)}),e}function Kc(e,t=16){if(!Number.isInteger(t)||t<=0||t>64)throw TypeError(`stableHashHex: lengthHex must be in [1, 64] (got ${t})`);let n=typeof e==`string`?e:JSON.stringify(e,(e,t)=>{if(t&&typeof t==`object`&&!Array.isArray(t)){let e={},n=t;for(let t of Object.keys(n).sort())e[t]=n[t];return e}return t});return w(`sha256`).update(n).digest(`hex`).slice(0,t)}Object.freeze([`HS256`]),Object.freeze([`RS256`]);async function qc(e,t,n=`tangle --help`){let r=new AbortController,i=e??r.signal,a=()=>{r.abort(),process.stderr.write(`Stopping…
-`)};e||(process.once(`SIGINT`,a),process.once(`SIGTERM`,a));try{return i.throwIfAborted(),await t(i)}catch(e){if(!i.aborted||e instanceof W&&e.code===`RUN_STOPPED`)throw e;let t=new W(`RUN_STOPPED`,`Command interrupted`,`A stop request ended this execution`,n);throw e instanceof Error&&`runId`in e&&typeof e.runId==`string`&&Object.assign(t,{runId:e.runId}),t}finally{e||(process.off(`SIGINT`,a),process.off(`SIGTERM`,a))}}function Jc(e,t){for(let[n,r]of Object.entries(t)){let t=e.gates?.find(e=>e.id===n);if(!t||!t.choices.includes(r))throw new W(`GATE_CHOICE_INVALID`,`Invalid choice for gate '${n}'`,t?`Choose one of: ${t.choices.join(`, `)}`:`The graph does not declare this gate`,`tangle graph run --help`)}}function Yc(e,t){let n=t.signal;return async r=>{let i=Object.hasOwn(e,r.gate)?e[r.gate]:void 0,a=`--param ${qe(`gate.${r.gate}=<choice>`)}`,o=`${r.question} Choose one of: ${r.choices.join(`, `)}`,s=()=>new W(`GATE_ANSWER_REQUIRED`,`Gate '${r.gate}' needs an answer. ${o}. Pass ${a}`,o,`tangle graph run <graph> ${a}`);if(i!==void 0)return{kind:`choose`,choice:i,by:`cli:param`};if(t.json||!process.stdin.isTTY)throw s();let c;try{c=await Vi(`${r.question} [${r.choices.join(` / `)}]`,void 0,n)}catch{if(n.aborted)return{kind:`stop`,reason:`Gate input interrupted or timed out`,by:`cli:terminal`};throw s()}if(!r.choices.includes(c))throw s();return{kind:`choose`,choice:c,by:`cli:terminal`}}}const Xc=P.strictObject({sourceId:P.string().min(1),generation:P.string().regex(/^kg_[a-f0-9]{64}$/)}),Zc=P.discriminatedUnion(`kind`,[P.strictObject({kind:P.literal(`local`),root:P.string().refine(ve),sourceDigest:P.string().regex(/^sha256:[a-f0-9]{64}$/)}),P.strictObject({kind:P.literal(`hub`),references:P.array(Xc).min(1)})]);async function Qc(e){let t=await I(e);return{kind:`local`,root:t,sourceDigest:`sha256:${await lt(t)}`}}function $c(e){throw Object.assign(Error(e),{code:`KNOWLEDGE_BACKEND_UNSUPPORTED`})}const el=P.strictObject({question:P.string().trim().min(1).max(16e3),limit:P.number().int().min(1).max(20).default(5)}),tl=P.object({results:P.array(P.object({sourceId:P.string().min(1),generation:P.string().regex(/^kg_[a-f0-9]{64}$/),hits:P.array(P.object({id:P.string(),snippet:P.string()}).passthrough()),evidence:P.object({receipt:P.unknown(),visibility:P.unknown(),sources:P.array(P.object({id:P.string(),uri:P.string(),contentHash:P.string()}))})}).passthrough()),failures:P.array(P.unknown()),partial:P.boolean()}).passthrough();let nl;function rl(){return nl??=(async()=>{let e=t(`@tangle-network/agent-knowledge`,import.meta.url);if(!e)throw Error(`Cannot identify the installed Knowledge retriever`);return JSON.parse(await F(e,`utf8`)).version})(),nl}async function il(e){let t=Zc.parse(e.binding),n=Object.freeze({...e.context});if(t.kind===`hub`){let r=e.queryHub;return r||$c(`This backend has no owner-authorized Hub knowledge query binding`),[{name:`knowledge_search`,description:`Search the graph's exact owner-authorized knowledge generations and retain retrieval evidence.`,inputSchema:el,inputSchemaJson:P.toJSONSchema(el),handler:async i=>{let a=el.parse(i),o=await r({query:a.question,limit:a.limit,expectedReferences:t.references,context:n},e.signal),s=tl.parse(o);if(!s.partial&&(s.results.length!==t.references.length||t.references.some(e=>s.results.filter(t=>t.sourceId===e.sourceId&&t.generation===e.generation).length!==1)))throw Error(`Hub knowledge omitted or duplicated a selected source generation`);let c=[],l=[];for(let r of s.results){let i=mt(r.evidence.receipt),o=r.evidence.visibility,s=ct(o);if(i.runId!==n.runId||i.actorId!==n.nodeId||i.profileDigest!==n.profileDigest||i.query!==a.question)throw Error(`Hub knowledge receipt does not match the trusted graph invocation`);if(i.attributes.sourceId!==r.sourceId||i.attributes.generation!==r.generation||!t.references.some(e=>e.sourceId===r.sourceId&&e.generation===r.generation))throw Error(`Hub knowledge receipt does not match an exact selected source generation`);if(r.hits.length!==i.results.length||r.hits.some((e,t)=>e.id!==i.results[t]?.pageId||e.snippet!==i.results[t]?.snippet))throw Error(`Hub knowledge hits do not match their retrieval receipt`);await it(i,()=>s),c.push(await e.record({context:n,binding:t,receipt:i,visibility:o,sources:r.evidence.sources})),l.push({sourceId:r.sourceId,generation:r.generation,hits:r.hits,retrievalReceiptDigest:i.receiptDigest})}return{partial:s.partial,failures:s.failures,results:l,retainedEvidence:c}}},{name:`knowledge_record`,description:`Retain an isolated knowledge proposal; it does not alter published source generations.`,inputSchema:P.strictObject({proposal:P.string().min(1)}),inputSchemaJson:{type:`object`,properties:{proposal:{type:`string`}},required:[`proposal`],additionalProperties:!1},handler:async r=>{let{proposal:i}=P.strictObject({proposal:P.string().min(1)}).parse(r);return dt(i),{isolated:!0,evaluated:!1,artifact:await e.recordProposal({context:n,binding:t,proposal:i,digest:A({context:n,binding:t,proposal:i})}),activation:`unsupported-for-hub-generations`}}}]}let r=async()=>{if(`sha256:${await lt(t.root)}`!==t.sourceDigest)throw Error(`The graph's pinned local knowledge changed`)};if(await r(),!e.storeRoot)throw Error(`Local graph Knowledge needs its private run-store root`);let i=await I(t.root),a=be(e.storeRoot),o=(e,t)=>{let n=ye(e,t);return n===``||!n.startsWith(`..`)&&!ve(n)};if(o(i,a)||o(a,i))throw Error(`Knowledge run stores must be separate from the curated corpus`);let s=ot({root:a,sharedRoot:i});await s.init(n.runId);let c=new Map;return at({stores:s,runId:n.runId,actorId:n.nodeId,retrieverVersion:await rl(),retainHistory:!0,recordRetrieval:async i=>{if(await r(),!i.visibility.artifact)throw Error(`Knowledge did not retain the visibility snapshot`);let a=await F(new URL(i.visibility.artifact.uri));await it(i,()=>a);let o=st(a),s=await ut(t.root),l=new Set(o.entries.flatMap(e=>e.sourceIds)),u=Object.values(s.sources).filter(e=>l.has(e.id)).map(({id:e,uri:t,contentHash:n})=>({id:e,uri:t,contentHash:n}));c.set(i.receiptDigest,await e.record({context:n,binding:t,receipt:i,visibility:o,sources:u}))}}).map(t=>({...t,handler:async(n,i)=>{e.signal?.throwIfAborted(),await r();let a=await t.handler(n,i);return await r(),a&&typeof a==`object`&&`retrievalReceiptDigest`in a?{...a,retainedEvidence:c.get(String(a.retrievalReceiptDigest))}:a}}))}function al(e){return async t=>{if(!Object.entries(t.profile.tools??{}).some(([e,t])=>t===!0&&/_knowledge_(search|read|record|resolve)$/.test(e)))return[];if(!t.identity.profileDigest)throw Error(`Knowledge tools require Runtime's exact profile identity`);return(await il({...e,...e.storeRoot?{storeRoot:M(e.storeRoot,t.nodeId)}:{},context:{runId:t.runId,nodeId:t.nodeId,profileDigest:t.identity.profileDigest}})).map(e=>{if(!e.inputSchemaJson)throw Error(`Knowledge tool lacks its wire input schema`);return{name:e.name,description:e.description,inputSchema:e.inputSchemaJson,handler:t=>e.handler(t,{})}})}}async function ol(e,t,n){let r=Zc.parse(e);r.kind!==`local`&&$c(`Measured file-backed Knowledge candidates cannot activate Hub generations; use the source generation owner's publication path`);let i=rt.parse(t);if(`sha256:${i.baseHash}`!==r.sourceDigest)throw Error(`Knowledge candidate does not match the graph's pinned baseline`);return n===`promote`?ft({root:r.root,candidate:i}):pt({root:r.root,candidate:i})}function sl(e,t,n,r){if(e==null)return;let i=Zc.parse(e);if(i.kind!==`local`)throw Error(`A local graph needs a pinned local Knowledge binding; Hub generations require the hosted workflow owner`);return al({binding:i,storeRoot:M(t,`knowledge`),signal:r,record:async e=>n.put({executionId:e.context.nodeId,purpose:`executor-native-evidence`,bytes:Buffer.from(JSON.stringify(e))}),recordProposal:async e=>n.put({executionId:e.context.nodeId,purpose:`task-output`,bytes:Buffer.from(JSON.stringify(e))})})}function cl(e){let t=e.command(`knowledge`).description(`Exact measured Knowledge candidate transitions`);t.command(`bind <root>`).description(`Identify exact bytes of an existing local Knowledge store`).action(async e=>z(await Qc(e)));for(let e of[`promote`,`restore`])t.command(`${e} <binding> <candidate>`).description(`${e} the exact measured local Knowledge candidate through its owner`).action(async(t,n)=>{let r=Zc.parse(JSON.parse(await F(t,`utf8`))),i=await ol(r,JSON.parse(await F(n,`utf8`)),e);z({...i,nextBinding:{...r,sourceDigest:`sha256:${i.mutation.afterHash}`}})})}const ll=()=>new C(`--mcp-secret <key=variable>`,`Private local MCP secret reference binding; repeatable, values are never recorded`).argParser((e,t)=>[...t,e]).default([]);function ul(e=[]){let t=new Map;for(let n of e){let e=n.indexOf(`=`),r=n.slice(0,e).trim(),i=n.slice(e+1).trim();if(e<1||!r||!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i)||t.has(r)&&t.get(r)!==i)throw new W(`GRAPH_MCP_SECRET_BINDING`,`Invalid private MCP credential binding`,`Use one unambiguous key=ENVIRONMENT_VARIABLE per declared secret reference`,`tangle graph run --help`);t.set(r,i)}return Object.fromEntries(t)}async function dl(e){try{return ke.parse(JSON.parse(await F(e,`utf8`)))}catch(e){throw new W(`GRAPH_MCP_POLICY_INVALID`,`The graph MCP policy is invalid`,e instanceof Error?e.message:String(e),`tangle graph run --help`)}}const fl=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],pl=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function ml(e){let t=ie(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function hl(e){let t=e.harness??`claude-code`;if(!fl.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${fl.join(`, `)}.`);let n=gl(e.maxTokens,2e5,`--max-tokens`),r=gl(e.maxIterations,50,`--max-iterations`),i=e.maxWorkers===void 0?void 0:gl(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:n,maxIterations:r,...i===void 0?{}:{maxWorkers:i}}}function gl(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function _l(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function vl(e){let t=e.spentTotal,n=e.kind===`no-winner`?``:e.out;return{text:typeof n==`string`?n:typeof n==`object`&&n&&`content`in n&&typeof n.content==`string`?n.content:JSON.stringify(n),tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd,status:e.kind===`no-winner`?`no-winner (${e.reason})`:`winner`}}let yl=null;function bl(){return yl??=import(`@tangle-network/agent-runtime/kernel`).catch(e=>{throw yl=null,e?.code===`ERR_MODULE_NOT_FOUND`?new W(`RUNTIME_UNAVAILABLE`,`Agent Runtime could not be loaded`,e.message,`npm install -g @tangle-network/sandbox-cli@latest`):e}),yl}async function xl(e,t,n){let r=K({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=q(r),{budget:a,perWorker:o}=_l(t),s=[],c={async create(e){let{TANGLE_API_KEY:t,...r}=e?.env??{},a=await i.create(e?.env?{...e,env:r}:e);return s.push({id:a.id,status:`spawned`}),n.json||V(`worker ${a.id} spawned`),a}},l=await bl(),u=l.workerFromBackend({backend:`sandbox`,sandboxClient:c,maxIterations:1}),d=(e,n)=>u({...e,harness:t.harness},n),f={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-3.5-flash-lite`,provider:t.model?ml(t.model):`google`},tools:{agent_runtime_coordination_spawn_worker:!0,agent_runtime_coordination_observe_agent:!0}},p={routerBaseUrl:pl,routerKey:r.apiKey},m=vl(await l.supervise(f,{goal:e},{budget:a,makeWorkerAgent:d,router:p,...o?{perWorker:o}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${E()}`})),h=m.status===`winner`?`settled`:`failed`;for(let e of s)e.status=h,n.json||V(`worker ${e.id} settled (${e.status})`);return{task:e,result:m.text,workers:s,tokenUsage:m.tokenUsage,costUsd:m.costUsd,status:m.status}}function Sl(){let e=new S(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${fl.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).action(async(e,t)=>{let n=hl({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,maxWorkers:t.maxWorkers});t.json||(V(`Supervising: ${e}`),V(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it`),console.log());let r=await xl(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){z(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.result&&(console.log(r.result),console.log()),U({"Input Tokens":r.tokenUsage.input??`Unavailable`,"Output Tokens":r.tokenUsage.output??`Unavailable`,Cost:r.costUsd===null?`Unavailable`:`$${r.costUsd.toFixed(4)}`}),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`)}),e}const Cl=`graph-task-workspaces`,wl=P.number().int().positive().max(2**53-1),Tl=P.strictObject({maxArchiveBytes:wl.optional(),maxEmbeddedArtifactBytes:wl.optional(),maxFiles:wl.optional(),maxFileBytes:wl.optional(),maxTotalFileBytes:wl.optional(),maxPathBytes:wl.optional(),maxRepositoryBundleBytes:wl.optional()}),El=ee.shape,Dl=P.strictObject({snapshot:P.strictObject({kind:El.kind,digest:El.digest,manifest:k,archive:k}).superRefine((e,t)=>{(e.digest!==e.manifest.sha256||!e.manifest.byteLength||!e.archive.byteLength)&&t.addIssue({code:`custom`,message:`The canonical workspace manifest, digest and archive must agree`})}),capture:P.strictObject({mode:P.literal(`git-working-tree`),runtimeVersion:P.string().min(1),limits:Tl}),gaps:P.tuple([P.literal(`environment-and-toolchain-not-snapshotted`),P.literal(`git-ignored-files-excluded`)])}),Ol=e=>A(Dl.parse(e));function kl(e){for(let t of[e.snapshot.manifest,e.snapshot.archive])if(t.locator.kind!==`private-cas`||t.locator.namespace!==Cl)throw Error(`Task workspace artifacts require their original local private CAS; cross-backend activation is unsupported`)}async function Al(){let e=M(N(),`.tangle`);return await Ze(e,{recursive:!0,mode:448}),I(e)}const jl=e=>Ct(M(e,`artifacts`),Cl);async function Ml(e){let t=await $e(be(e),le.O_RDONLY|le.O_NOFOLLOW);try{if(!(await t.stat()).isFile())throw Error(`Task workspace reference must be a regular file`);let e=Dl.parse(JSON.parse(await t.readFile(`utf8`)));return kl(e),e}finally{await t.close()}}async function Nl(e,n={}){n.signal?.throwIfAborted();let r=be(e),i=await Xe(r);if(!i.isDirectory()||i.isSymbolicLink())throw Error(`Task workspace must be one real repository root`);let a=await I(r),o=await I(N()),s=await Al();if(a===o||a===ge(a)||Sf(s,a)||Sf(a,s))throw Error(`Task workspace capture cannot include the home, filesystem or private evidence root`);let{release:c}=ht({lockPath:`${a}.graph-workspace.lock`});try{let e=Tl.parse(n.limits??{}),r=await bt(a,{includeRepository:!0,repositoryContents:`working-tree`,limits:e,artifactPersistence:{executionId:E(),outputArtifacts:jl(s),signal:n.signal}}),i=t(`@tangle-network/agent-runtime`,import.meta.url);if(!i)throw Error(`Cannot identify the Runtime workspace archive owner`);let o=JSON.parse(await F(i,`utf8`));return Dl.parse({snapshot:r,capture:{mode:`git-working-tree`,runtimeVersion:o.version,limits:e},gaps:[`environment-and-toolchain-not-snapshotted`,`git-ignored-files-excluded`]})}finally{c()}}async function Pl(e,t){let n=P.uuid().parse(t.runId),r=Dl.parse(e);kl(r);let i=await Al(),a=M(i,`workspaces`);if(await Ze(a,{recursive:!0,mode:448}),await I(a)!==a)throw Error(`Task workspace allocation root redirects elsewhere`);let o=M(a,n),{release:s}=ht({lockPath:`${o}.lock`});try{t.signal?.throwIfAborted();let e=`${o}.task-workspace.json`,a;try{a=JSON.parse(await F(e,`utf8`))}catch(e){if(e.code!==`ENOENT`)throw e}let c=Ol(r);if(a!==void 0){let e=P.strictObject({runId:P.uuid(),identity:P.string()}).parse(a);if(e.runId!==n||e.identity!==c||t.resumeCwd!==void 0&&be(t.resumeCwd)!==o||await I(o)!==o||!(await Xe(o)).isDirectory())throw Error(`The retained task workspace no longer names this exact native run allocation`)}else{if(t.resumeCwd!==void 0)throw Error(`The retained task workspace allocation receipt is missing`);await xt({snapshot:r.snapshot,artifacts:jl(i),destination:o,limits:r.capture.limits,signal:t.signal}),await L(e,JSON.stringify({runId:n,identity:c}),{flag:`wx`,mode:384,flush:!0})}if(!t.validationOnly||a!==void 0)return{cwd:o,release:s};let l=await Promise.all([Xe(o,{bigint:!0}),Xe(e,{bigint:!0})]);return{cwd:o,release:async()=>{try{for(let[t,r]of[o,e].entries()){let e=await Xe(r,{bigint:!0});if(!(t===0?e.isDirectory():e.isFile())||e.dev!==l[t]?.dev||e.ino!==l[t]?.ino||await I(r)!==r)throw Error(`Validation allocation ${n} changed; retained`)}if(A(JSON.parse(await F(e,`utf8`)))!==A({runId:n,identity:c}))throw Error(`Validation allocation ${n} receipt changed; retained`);try{throw await Xe(M(i,`runs`,n)),Error(`Validation allocation ${n} has run state; retained`)}catch(e){if(e.code!==`ENOENT`)throw e}await nt(o,{recursive:!0}),await nt(e)}finally{s()}}}}catch(e){throw s(),e}}function Fl(e){e.command(`workspace`).description(`Capture immutable local task files for graph replay`).command(`capture <repository>`).description(`Capture Git HEAD, index, tracked and unignored files into private local artifacts`).requiredOption(`--output <file>`,`New reference file outside the source repository`).option(`--limits <file>`,`JSON overrides for the maintained Runtime archive limits`).action(async(e,t)=>{let n=await I(be(e)),r=M(await I(ge(be(t.output))),he(be(t.output)));if(Sf(n,r))throw Error(`The task reference must be written outside the original workspace`);try{throw await Xe(r),Error(`Task workspace reference already exists; choose a new output file`)}catch(e){if(e.code!==`ENOENT`)throw e}let i=await Nl(n,{limits:t.limits?Tl.parse(JSON.parse(await F(t.limits,`utf8`))):void 0});await L(r,JSON.stringify(i),{flag:`wx`,mode:384,flush:!0}),z(i)})}const Il=P.string().regex(/^[a-f0-9]{64}$/),Ll=P.strictObject({version:P.literal(1),runId:P.uuid(),file:P.string().refine(ve),cwd:P.string().refine(ve),sourceDigest:Il,source:P.string().optional(),graphDigest:Il,params:P.record(P.string(),P.unknown()),trigger:P.record(P.string(),P.unknown()).optional(),gateChoices:P.record(P.string(),P.string()).optional(),startedAt:P.iso.datetime(),seat:P.string().optional(),mcpPolicy:Ae.optional(),taskWorkspace:Dl.optional()});async function Rl(e){let t=await bl(),n=t.graphRegistry(M(N(),`.tangle`,`graph-registry`)),r=await t.loadGraph(n,e.graphDigest);if(!r)throw Error(`Retained execution graph is unavailable; configuration is unknown`);let i=t.validateStoredGraph(r);if(i.digest!==e.graphDigest)throw Error(`Retained execution graph changed its identity`);return A({mcpPolicy:Ae.parse(e.mcpPolicy??{}),nodes:i.nodes.map(({id:e,profile:t})=>({id:e,harness:t.harness??null,model:t.model??null,seats:t.seats??null,connections:t.connections??null}))})}function Z(e){throw new W(`GRAPH_RESUME_REFUSED`,`The graph run cannot be resumed`,e,`tangle graph run --help`)}async function zl(e){P.uuid().safeParse(e).success||Z(`Use a recorded graph run ID`);let t;try{let n=M(await I(M(N(),`.tangle`)),`runs`,e);await I(n)!==n&&Z(`The run directory redirects elsewhere`),t=await $e(M(n,`input.json`),le.O_RDONLY|le.O_NOFOLLOW),(await t.stat()).isFile()||Z(`The run input is not a regular file`);let r=Ll.parse(JSON.parse(await t.readFile(`utf8`)));return r.runId!==e&&Z(`The recorded run identity changed`),r.source!==void 0&&Vl(r,r.source),r}catch(e){if(e instanceof W)throw e;return Z(`The private recorded run input is missing or invalid`)}finally{await t?.close()}}async function Bl(e,t){let n=t.source??await F(t.file,`utf8`);Vl(t,n),await L(M(e,`input.json`),JSON.stringify({...t,source:n}),{flag:`wx`,mode:384,flush:!0})}function Vl(e,t){return w(`sha256`).update(t).digest(`hex`)!==e.sourceDigest&&Z(`The retained graph source does not match this run`),t}async function Hl(e){return Vl(e,e.source??await F(e.file,`utf8`))}function Ul(e,t,n,r,i={}){e.sourceDigest!==n&&Z(`The authored graph source changed`),t.cloud&&Z(`A local run cannot move to cloud execution`),Object.entries(r).some(([t,n])=>!Object.hasOwn(e.params,t)||A(n)!==A(e.params[t]))&&Z(`A recorded graph parameter changed`),Object.entries(i).some(([t,n])=>e.gateChoices?.[t]!==n)&&Z(`A recorded gate choice changed`),t.seat!==void 0&&t.seat!==e.seat&&Z(`The recorded graph seat override changed`),t.mcpPolicy!==void 0&&(e.mcpPolicy===void 0||A(t.mcpPolicy)!==A(e.mcpPolicy))&&Z(`The recorded graph MCP policy changed`)}const Wl=e=>Object.entries(e).map(([e,t])=>`${e}=${typeof t==`string`?t:JSON.stringify(t)}`),Gl=`claude,codex,kimi,opencode,gemini,pi`;function Kl(e,t){let n;return async(r,{node:i,lastCandidate:a})=>{t.throwIfAborted();let o;try{o=r===void 0?void 0:ae(r)}catch(e){throw e instanceof Error&&Object.assign(e,{node:i,seat:r,fixCommand:`tangle graph run --help`}),e}n??=Et({cwd:e,signal:t,config:Dt({...process.env,BRIDGE_BACKENDS:Gl,BRIDGE_SUBSCRIPTIONS_ONLY:`1`})});let s=await n;t.throwIfAborted();let c=e=>e.authentication?.status===`authenticated`&&e.authentication.authMode===`subscription`,l=o?.harness??s.find(e=>e.provider&&c(e))?.backend,u=s.filter(e=>e.backend===l),d=u.filter(c),f=o?u.find(e=>e.id===`${o.harness}/${o.model}`)??d.find(e=>e.provider===o.provider):d.find(e=>e.default)??d.find(e=>e.recommended)??d[0];if(!f||!c(f)){if(a===!1)return;let e=f?.authentication??u[0]?.authentication??(o?void 0:s.find(e=>e.authentication?.fix)?.authentication);throw Object.assign(new W(o?`SEAT_NOT_LOGGED_IN`:`SEAT_NONE_DETECTED`,`Node '${i}' has no available subscription${o?` for ${o.harness}`:``}`,e?`Selected provider: ${e.status} (${e.authMode})`:`No authenticated subscription route was detected`,e?.fix??`tangle graph run --help`),{node:i,seat:r})}let p=o?.harness??ae(f.id).harness,m=o?.provider??f.provider,h=o?.model??f.id.slice(p.length+1);if(!m||!h)throw new W(`MODEL_PROVIDER_MISMATCH`,`Node '${i}' has an unresolved model provider`,`Bridge has no configured provider for ${r??p}`,`tangle graph run --help`);return{harness:p,provider:m,model:h,selector:{kind:`all-eligible`},...o?.reasoningEffort===void 0?{}:{reasoningEffort:o.reasoningEffort}}}}const ql=Ot(we);function Jl(e,t,n=`tangle graph run --help`){throw new W(`SEAT_NONE_DETECTED`,e,t,n)}function Yl(e){let t=[];for(let n of e.nodes)for(let e of n.check?.egress??[]){let n=e.trim().toLowerCase();if(n){if(/[\s*]|\/|:\/\//u.test(n))throw new W(`GRAPH_EGRESS_HOST`,`Graph egress host "${e.trim()}" is not a DNS hostname`,`A check egress entry has whitespace, a wildcard, or a URL`,`tangle graph run --help`);t.includes(n)||t.push(n)}}return t.length>0?t.join(`,`):void 0}function Xl(e){return e.some(e=>(e.profile?.seats?.length??0)>0)}function Zl(e){let t=e?.trim();if(t)return/\s/u.test(t)&&Jl(`A seat account, command, or credential must be a single token`,`The seat command is an executable path, not a shell line`),t}function Ql(e){let t=Zl(e.seatAccount),n=Zl(e.seatCommand),r=Zl(e.seatCredential);return r&&!n&&!t&&Jl(`A seat credential needs a seat command`,`The credential is an argument to the configured command`,`tangle graph run --seat-command <program>`),{...t?{account:t}:{},...n?{command:n}:{},...r?{credential:r}:{}}}async function $l(e,t,n){if(e.account)return e.account;e.command||Jl(`This graph needs a seat account or a seat command`,`No account was authored and no seat command is configured`,`tangle graph run --seat-account <account>`);let r=``;try{r=(await ql(e.command,[t,...e.credential?[e.credential]:[]],{timeout:3e4,maxBuffer:4096,signal:n,encoding:`utf8`})).stdout}catch(e){n.throwIfAborted();let t=e.code===`ENOENT`;Jl(t?`The seat command was not found`:`The seat command failed`,t?`The configured executable is not on PATH`:`The seat command exited without an account id`)}let i=r.trim();return(!i||/\s/u.test(i))&&Jl(`The seat command did not print an account id`,`The command must print one account id and nothing else`),i}function eu(e,t,n){let r=new Map;return async i=>{n.throwIfAborted();let a=i.stage.harness,o=i.stage.selector.kind===`seat`?i.stage.selector.id.trim():``,s=`${a}\0${t.credential??``}`,c=o||t.account||r.get(s)||await $l(t,a,n);return!o&&!t.account&&r.set(s,c),(!c||/\s/u.test(c)||i.resumeSeatId!==void 0&&i.resumeSeatId!==c)&&Jl(`Node '${i.nodeId}' has no seat account`,`The authored seat, account flag, or seat command did not yield one`),{seat:c,backend:{backend:`provider`,provider:At({baseUrl:e.bridgeUrl,bearerToken:e.bridgeBearer}),defaults:{workspace:{cwd:{base:`host`,path:e.cwd}}},runtime:`cli`,outputFormat:`json`,destroyOnSettle:!0,requireTerminalEvent:!0}}}}function Q(e){return Di({signal:e.signal,...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.baseUrl===void 0?{}:{baseUrl:e.baseUrl}})}const tu=P.object({version:P.literal(1),type:P.enum([`state`,`ack`,`error`,`event`]),requestId:P.string().optional(),operationId:P.string().optional(),command:P.string().optional(),code:P.string().optional(),message:P.string().optional(),result:P.unknown().optional()}).passthrough(),nu=P.object({state:P.object({runConfiguration:P.unknown()}),view:P.object({capabilities:P.record(P.string(),P.object({available:P.boolean(),reason:P.string().optional()}))})}),ru=P.object({status:P.enum([`completed`,`failed`,`cancelled`]),analysis:P.object({id:P.string().min(1)}).passthrough(),source:P.object({runtimeRun:P.unknown()}).passthrough()}).passthrough(),iu=`TANGLE_GRAPH_ANALYSIS_SOURCE`;async function au(e,t,n){if(!e.startsWith(`wfrun_`)){let t=M(await I(M(N(),`.tangle`)),`runs`,e);if(await I(t)!==t)throw new W(`RUN_NOT_FOUND`,`The run directory redirects elsewhere`,`Use the recorded local run directory`,`tangle graph inspect --help`);return{source:`runtime:${e}@${t}`,env:{},schema:P.object({runId:P.literal(e),runDir:P.literal(t)})}}let r={signal:n,...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.baseUrl===void 0?{}:{baseUrl:t.baseUrl}},i=await Q(r),a=P.object({id:P.literal(e),workflowId:P.string(),revUsed:P.number().int(),execution:P.object({kind:P.literal(`graph`),sourceSha:P.string(),authoredGraphDigest:P.string(),graphDigest:P.string()}),runtime:P.object({snapshot:P.object({supervisors:P.tuple([P.object({id:P.string()})])})})}).parse(await i.workflows.getRun(e,{signal:n})),o=a.runtime.snapshot.supervisors[0];if(!o)throw new W(`BRAID_RPC_FAILED`,`The cloud run has no retained Runtime root`,`Wait for execution evidence before analysis`,`tangle graph inspect ${e}`);let s=await Ci(r);if(new URL(s.baseUrl.replace(/\/+$/,``)).href!==new URL(i.baseUrl.replace(/\/+$/,``)).href)throw new W(`AUTH_REQUIRED`,`The analysis source origin changed`,`Use the same authenticated platform origin`,`tangle auth status --json`);return{source:`runtime:${e}@${iu}`,env:{[iu]:JSON.stringify({url:`${s.baseUrl.replace(/\/+$/,``)}/v1/workflows/runs/${encodeURIComponent(e)}`,headers:{Authorization:`Bearer ${s.token}`}})},schema:P.object({runId:P.literal(e),remoteEndpointEnv:P.literal(iu),checkpoint:P.object({workflowId:P.literal(a.workflowId),runtimeRunId:P.literal(o.id),revUsed:P.literal(a.revUsed),sourceSha:P.literal(a.execution.sourceSha),authoredGraphDigest:P.literal(a.execution.authoredGraphDigest),graphDigest:P.literal(a.execution.graphDigest)})})}}async function ou(e,t){if(!e.startsWith(`wfrun_`)&&!P.uuid().safeParse(e).success)throw new W(`RUN_NOT_FOUND`,`Use a recorded graph run ID`,`The run identifier is invalid`,`tangle graph inspect --help`);if(!Number.isSafeInteger(t.timeout)||t.timeout<1)throw new W(`INVALID_TIMEOUT`,`Use a positive analysis timeout`,`The timeout must be an integer number of milliseconds`,`tangle graph analyze --help`);let n=t.profile;if(!n?.trim())throw new W(`USAGE_INVALID`,`Select the canonical analysis profile`,`Graph analysis requires an existing canonical AgentProfile reference`,`tangle graph analyze `+e+` --profile <name|path>`);let r=/^(?:\.\.?)[/\\]/.test(n)?be(process.cwd(),n):n;return qc(t.signal,async n=>{let i=await au(e,t,n),a=i.source;return wf({signal:n,errorRunId:e},async n=>{let o=await n.bridge(),s=await Qe(M(n.runDir,`analysis-`)),c=M(s,`config.json`),l=M(s,`database.key`),u=M(s,`state.sqlite`),d=`connection-owned-graph-bridge`,f=new Date().toISOString();await L(l,T(32),{mode:384,flag:`wx`}),await L(c,JSON.stringify({format:`braid-startup-config`,schemaVersion:2,profile:r,connectionId:d,connections:[{id:d,name:`Graph analysis`,kind:`cli-bridge`,endpoint:o.bridgeUrl,providerOptions:{transport:`local`},createdAt:f,updatedAt:f,lastHealth:{status:`unknown`}}]}),{mode:384,flag:`wx`});let p=n.signal,m=`op-${E()}`,h=`op-${E()}`,g=`${m}:initialize`,_=`${m}:analyze`,v=`${m}:shutdown`,y={version:1,requestId:g,command:`initialize`,params:{workspace:n.cwd,subscribe:!1}},b={version:1,requestId:_,operationId:m,command:`analyze`,params:{source:a,recipe:`all`,totalTimeoutMs:t.timeout}},x={version:1,requestId:v,operationId:h,command:`shutdown`,params:{mode:`wait`}},S,C,w,D,O={transform:e=>{let t=tu.parse(e);return t.type===`error`||t.type===`state`&&t.requestId===g||t.type===`ack`&&[_,v].includes(t.requestId??``)?t:null},onError:e=>{D??=e},onEvent:e=>{e.type===`error`&&(D??=new W(e.code??`BRAID_RPC_FAILED`,`Braid refused graph analysis`,e.message??`The RPC response omitted its cause`,`tangle graph analyze --help`)),e.requestId===g&&e.type===`state`&&(S??=e),e.requestId===_&&e.type===`ack`&&(C??=e),e.requestId===v&&e.type===`ack`&&(w??=e)}},k=await Ke({command:process.env.BRAID_BIN??`braid`,args:[`rpc`,`--workspace`,n.cwd,`--config`,c,`--profile`,r,`--database-key-file`,l],cwd:n.cwd,env:{...i.env,BRAID_STATE_PATH:u,BRAID_CLI_BRIDGE_ENDPOINT:o.bridgeUrl,BRAID_CLI_BRIDGE_AUTH:o.bridgeBearer},timeoutMs:t.timeout,signal:p,ownProcessGroup:!0},O,{stdin:[y,...t.dryRun?[]:[b],x].map(e=>JSON.stringify(e)).join(`
+`)};e||(process.once(`SIGINT`,a),process.once(`SIGTERM`,a));try{return i.throwIfAborted(),await t(i)}catch(e){if(!i.aborted||e instanceof W&&e.code===`RUN_STOPPED`)throw e;let t=new W(`RUN_STOPPED`,`Command interrupted`,`A stop request ended this execution`,n);throw e instanceof Error&&`runId`in e&&typeof e.runId==`string`&&Object.assign(t,{runId:e.runId}),t}finally{e||(process.off(`SIGINT`,a),process.off(`SIGTERM`,a))}}function Jc(e,t){for(let[n,r]of Object.entries(t)){let t=e.gates?.find(e=>e.id===n);if(!t||!t.choices.includes(r))throw new W(`GATE_CHOICE_INVALID`,`Invalid choice for gate '${n}'`,t?`Choose one of: ${t.choices.join(`, `)}`:`The graph does not declare this gate`,`tangle graph run --help`)}}function Yc(e,t){let n=t.signal;return async r=>{let i=Object.hasOwn(e,r.gate)?e[r.gate]:void 0,a=`--param ${qe(`gate.${r.gate}=<choice>`)}`,o=`${r.question} Choose one of: ${r.choices.join(`, `)}`,s=()=>new W(`GATE_ANSWER_REQUIRED`,`Gate '${r.gate}' needs an answer. ${o}. Pass ${a}`,o,`tangle graph run <graph> ${a}`);if(i!==void 0)return{kind:`choose`,choice:i,by:`cli:param`};if(t.json||!process.stdin.isTTY)throw s();let c;try{c=await Vi(`${r.question} [${r.choices.join(` / `)}]`,void 0,n)}catch{if(n.aborted)return{kind:`stop`,reason:`Gate input interrupted or timed out`,by:`cli:terminal`};throw s()}if(!r.choices.includes(c))throw s();return{kind:`choose`,choice:c,by:`cli:terminal`}}}const Xc=P.strictObject({sourceId:P.string().min(1),generation:P.string().regex(/^kg_[a-f0-9]{64}$/)}),Zc=P.discriminatedUnion(`kind`,[P.strictObject({kind:P.literal(`local`),root:P.string().refine(ve),sourceDigest:P.string().regex(/^sha256:[a-f0-9]{64}$/)}),P.strictObject({kind:P.literal(`hub`),references:P.array(Xc).min(1)})]);async function Qc(e){let t=await I(e);return{kind:`local`,root:t,sourceDigest:`sha256:${await lt(t)}`}}function $c(e){throw Object.assign(Error(e),{code:`KNOWLEDGE_BACKEND_UNSUPPORTED`})}const el=P.strictObject({question:P.string().trim().min(1).max(16e3),limit:P.number().int().min(1).max(20).default(5)}),tl=P.object({results:P.array(P.object({sourceId:P.string().min(1),generation:P.string().regex(/^kg_[a-f0-9]{64}$/),hits:P.array(P.object({id:P.string(),snippet:P.string()}).passthrough()),evidence:P.object({receipt:P.unknown(),visibility:P.unknown(),sources:P.array(P.object({id:P.string(),uri:P.string(),contentHash:P.string()}))})}).passthrough()),failures:P.array(P.unknown()),partial:P.boolean()}).passthrough();let nl;function rl(){return nl??=(async()=>{let e=t(`@tangle-network/agent-knowledge`,import.meta.url);if(!e)throw Error(`Cannot identify the installed Knowledge retriever`);return JSON.parse(await F(e,`utf8`)).version})(),nl}async function il(e){let t=Zc.parse(e.binding),n=Object.freeze({...e.context});if(t.kind===`hub`){let r=e.queryHub;return r||$c(`This backend has no owner-authorized Hub knowledge query binding`),[{name:`knowledge_search`,description:`Search the graph's exact owner-authorized knowledge generations and retain retrieval evidence.`,inputSchema:el,inputSchemaJson:P.toJSONSchema(el),handler:async i=>{let a=el.parse(i),o=await r({query:a.question,limit:a.limit,expectedReferences:t.references,context:n},e.signal),s=tl.parse(o);if(!s.partial&&(s.results.length!==t.references.length||t.references.some(e=>s.results.filter(t=>t.sourceId===e.sourceId&&t.generation===e.generation).length!==1)))throw Error(`Hub knowledge omitted or duplicated a selected source generation`);let c=[],l=[];for(let r of s.results){let i=mt(r.evidence.receipt),o=r.evidence.visibility,s=ct(o);if(i.runId!==n.runId||i.actorId!==n.nodeId||i.profileDigest!==n.profileDigest||i.query!==a.question)throw Error(`Hub knowledge receipt does not match the trusted graph invocation`);if(i.attributes.sourceId!==r.sourceId||i.attributes.generation!==r.generation||!t.references.some(e=>e.sourceId===r.sourceId&&e.generation===r.generation))throw Error(`Hub knowledge receipt does not match an exact selected source generation`);if(r.hits.length!==i.results.length||r.hits.some((e,t)=>e.id!==i.results[t]?.pageId||e.snippet!==i.results[t]?.snippet))throw Error(`Hub knowledge hits do not match their retrieval receipt`);await it(i,()=>s),c.push(await e.record({context:n,binding:t,receipt:i,visibility:o,sources:r.evidence.sources})),l.push({sourceId:r.sourceId,generation:r.generation,hits:r.hits,retrievalReceiptDigest:i.receiptDigest})}return{partial:s.partial,failures:s.failures,results:l,retainedEvidence:c}}},{name:`knowledge_record`,description:`Retain an isolated knowledge proposal; it does not alter published source generations.`,inputSchema:P.strictObject({proposal:P.string().min(1)}),inputSchemaJson:{type:`object`,properties:{proposal:{type:`string`}},required:[`proposal`],additionalProperties:!1},handler:async r=>{let{proposal:i}=P.strictObject({proposal:P.string().min(1)}).parse(r);return dt(i),{isolated:!0,evaluated:!1,artifact:await e.recordProposal({context:n,binding:t,proposal:i,digest:A({context:n,binding:t,proposal:i})}),activation:`unsupported-for-hub-generations`}}}]}let r=async()=>{if(`sha256:${await lt(t.root)}`!==t.sourceDigest)throw Error(`The graph's pinned local knowledge changed`)};if(await r(),!e.storeRoot)throw Error(`Local graph Knowledge needs its private run-store root`);let i=await I(t.root),a=be(e.storeRoot),o=(e,t)=>{let n=ye(e,t);return n===``||!n.startsWith(`..`)&&!ve(n)};if(o(i,a)||o(a,i))throw Error(`Knowledge run stores must be separate from the curated corpus`);let s=ot({root:a,sharedRoot:i});await s.init(n.runId);let c=new Map;return at({stores:s,runId:n.runId,actorId:n.nodeId,retrieverVersion:await rl(),retainHistory:!0,recordRetrieval:async i=>{if(await r(),!i.visibility.artifact)throw Error(`Knowledge did not retain the visibility snapshot`);let a=await F(new URL(i.visibility.artifact.uri));await it(i,()=>a);let o=st(a),s=await ut(t.root),l=new Set(o.entries.flatMap(e=>e.sourceIds)),u=Object.values(s.sources).filter(e=>l.has(e.id)).map(({id:e,uri:t,contentHash:n})=>({id:e,uri:t,contentHash:n}));c.set(i.receiptDigest,await e.record({context:n,binding:t,receipt:i,visibility:o,sources:u}))}}).map(t=>({...t,handler:async(n,i)=>{e.signal?.throwIfAborted(),await r();let a=await t.handler(n,i);return await r(),a&&typeof a==`object`&&`retrievalReceiptDigest`in a?{...a,retainedEvidence:c.get(String(a.retrievalReceiptDigest))}:a}}))}function al(e){return async t=>{if(!Object.entries(t.profile.tools??{}).some(([e,t])=>t===!0&&/_knowledge_(search|read|record|resolve)$/.test(e)))return[];if(!t.identity.profileDigest)throw Error(`Knowledge tools require Runtime's exact profile identity`);return(await il({...e,...e.storeRoot?{storeRoot:M(e.storeRoot,t.nodeId)}:{},context:{runId:t.runId,nodeId:t.nodeId,profileDigest:t.identity.profileDigest}})).map(e=>{if(!e.inputSchemaJson)throw Error(`Knowledge tool lacks its wire input schema`);return{name:e.name,description:e.description,inputSchema:e.inputSchemaJson,handler:t=>e.handler(t,{})}})}}async function ol(e,t,n){let r=Zc.parse(e);r.kind!==`local`&&$c(`Measured file-backed Knowledge candidates cannot activate Hub generations; use the source generation owner's publication path`);let i=rt.parse(t);if(`sha256:${i.baseHash}`!==r.sourceDigest)throw Error(`Knowledge candidate does not match the graph's pinned baseline`);return n===`promote`?ft({root:r.root,candidate:i}):pt({root:r.root,candidate:i})}function sl(e,t,n,r){if(e==null)return;let i=Zc.parse(e);if(i.kind!==`local`)throw Error(`A local graph needs a pinned local Knowledge binding; Hub generations require the hosted workflow owner`);return al({binding:i,storeRoot:M(t,`knowledge`),signal:r,record:async e=>n.put({executionId:e.context.nodeId,purpose:`executor-native-evidence`,bytes:Buffer.from(JSON.stringify(e))}),recordProposal:async e=>n.put({executionId:e.context.nodeId,purpose:`task-output`,bytes:Buffer.from(JSON.stringify(e))})})}function cl(e){let t=e.command(`knowledge`).description(`Exact measured Knowledge candidate transitions`);t.command(`bind <root>`).description(`Identify exact bytes of an existing local Knowledge store`).action(async e=>z(await Qc(e)));for(let e of[`promote`,`restore`])t.command(`${e} <binding> <candidate>`).description(`${e} the exact measured local Knowledge candidate through its owner`).action(async(t,n)=>{let r=Zc.parse(JSON.parse(await F(t,`utf8`))),i=await ol(r,JSON.parse(await F(n,`utf8`)),e);z({...i,nextBinding:{...r,sourceDigest:`sha256:${i.mutation.afterHash}`}})})}const ll=()=>new C(`--mcp-secret <key=variable>`,`Private local MCP secret reference binding; repeatable, values are never recorded`).argParser((e,t)=>[...t,e]).default([]);function ul(e=[]){let t=new Map;for(let n of e){let e=n.indexOf(`=`),r=n.slice(0,e).trim(),i=n.slice(e+1).trim();if(e<1||!r||!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i)||t.has(r)&&t.get(r)!==i)throw new W(`GRAPH_MCP_SECRET_BINDING`,`Invalid private MCP credential binding`,`Use one unambiguous key=ENVIRONMENT_VARIABLE per declared secret reference`,`tangle graph run --help`);t.set(r,i)}return Object.fromEntries(t)}async function dl(e){try{return ke.parse(JSON.parse(await F(e,`utf8`)))}catch(e){throw new W(`GRAPH_MCP_POLICY_INVALID`,`The graph MCP policy is invalid`,e instanceof Error?e.message:String(e),`tangle graph run --help`)}}const fl=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],pl=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function ml(e){let t=ie(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function hl(e){let t=e.harness??`claude-code`;if(!fl.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${fl.join(`, `)}.`);let n=gl(e.maxTokens,2e5,`--max-tokens`),r=gl(e.maxIterations,50,`--max-iterations`),i=e.maxWorkers===void 0?void 0:gl(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:n,maxIterations:r,...i===void 0?{}:{maxWorkers:i}}}function gl(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function _l(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function vl(e){let t=e.spentTotal,n=e.kind===`no-winner`?``:e.out;return{text:typeof n==`string`?n:typeof n==`object`&&n&&`content`in n&&typeof n.content==`string`?n.content:JSON.stringify(n),tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd,status:e.kind===`no-winner`?`no-winner (${e.reason})`:`winner`}}let yl=null;function bl(){return yl??=import(`@tangle-network/agent-runtime/kernel`).catch(e=>{throw yl=null,e?.code===`ERR_MODULE_NOT_FOUND`?new W(`RUNTIME_UNAVAILABLE`,`Agent Runtime could not be loaded`,e.message,`npm install -g @tangle-network/sandbox-cli@latest`):e}),yl}async function xl(e,t,n){let r=K({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=q(r),{budget:a,perWorker:o}=_l(t),s=[],c={async create(e){let{TANGLE_API_KEY:t,...r}=e?.env??{},a=await i.create(e?.env?{...e,env:r}:e);return s.push({id:a.id,status:`spawned`}),n.json||V(`worker ${a.id} spawned`),a}},l=await bl(),u=l.workerFromBackend({backend:`sandbox`,sandboxClient:c,maxIterations:1}),d=(e,n)=>u({...e,harness:t.harness},n),f={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-3.5-flash-lite`,provider:t.model?ml(t.model):`google`},tools:{agent_runtime_coordination_spawn_worker:!0,agent_runtime_coordination_observe_agent:!0}},p={routerBaseUrl:pl,routerKey:r.apiKey},m=vl(await l.supervise(f,{goal:e},{budget:a,makeWorkerAgent:d,router:p,...o?{perWorker:o}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${E()}`})),h=m.status===`winner`?`settled`:`failed`;for(let e of s)e.status=h,n.json||V(`worker ${e.id} settled (${e.status})`);return{task:e,result:m.text,workers:s,tokenUsage:m.tokenUsage,costUsd:m.costUsd,status:m.status}}function Sl(){let e=new S(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${fl.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).action(async(e,t)=>{let n=hl({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,maxWorkers:t.maxWorkers});t.json||(V(`Supervising: ${e}`),V(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it`),console.log());let r=await xl(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){z(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.result&&(console.log(r.result),console.log()),U({"Input Tokens":r.tokenUsage.input??`Unavailable`,"Output Tokens":r.tokenUsage.output??`Unavailable`,Cost:r.costUsd===null?`Unavailable`:`$${r.costUsd.toFixed(4)}`}),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`)}),e}function Cl(e,t){let n=ye(e,t);return n!==`..`&&!n.startsWith(`..${xe}`)&&!ve(n)}const wl=`graph-task-workspaces`,Tl=P.number().int().positive().max(2**53-1),El=P.strictObject({maxArchiveBytes:Tl.optional(),maxEmbeddedArtifactBytes:Tl.optional(),maxFiles:Tl.optional(),maxFileBytes:Tl.optional(),maxTotalFileBytes:Tl.optional(),maxPathBytes:Tl.optional(),maxRepositoryBundleBytes:Tl.optional()}),Dl=ee.shape,Ol=P.strictObject({snapshot:P.strictObject({kind:Dl.kind,digest:Dl.digest,manifest:k,archive:k}).superRefine((e,t)=>{(e.digest!==e.manifest.sha256||!e.manifest.byteLength||!e.archive.byteLength)&&t.addIssue({code:`custom`,message:`The canonical workspace manifest, digest and archive must agree`})}),capture:P.strictObject({mode:P.literal(`git-working-tree`),runtimeVersion:P.string().min(1),limits:El}),gaps:P.tuple([P.literal(`environment-and-toolchain-not-snapshotted`),P.literal(`git-ignored-files-excluded`)])}),kl=e=>A(Ol.parse(e));function Al(e){for(let t of[e.snapshot.manifest,e.snapshot.archive])if(t.locator.kind!==`private-cas`||t.locator.namespace!==wl)throw Error(`Task workspace artifacts require their original local private CAS; cross-backend activation is unsupported`)}async function jl(){let e=M(N(),`.tangle`);return await Ze(e,{recursive:!0,mode:448}),I(e)}const Ml=e=>Ct(M(e,`artifacts`),wl);async function Nl(e){let t=await $e(be(e),le.O_RDONLY|le.O_NOFOLLOW);try{if(!(await t.stat()).isFile())throw Error(`Task workspace reference must be a regular file`);let e=Ol.parse(JSON.parse(await t.readFile(`utf8`)));return Al(e),e}finally{await t.close()}}async function Pl(e,n={}){n.signal?.throwIfAborted();let r=be(e),i=await Xe(r);if(!i.isDirectory()||i.isSymbolicLink())throw Error(`Task workspace must be one real repository root`);let a=await I(r),o=await I(N()),s=await jl();if(a===o||a===ge(a)||Cl(s,a)||Cl(a,s))throw Error(`Task workspace capture cannot include the home, filesystem or private evidence root`);let{release:c}=ht({lockPath:`${a}.graph-workspace.lock`});try{let e=El.parse(n.limits??{}),r=await bt(a,{includeRepository:!0,repositoryContents:`working-tree`,limits:e,artifactPersistence:{executionId:E(),outputArtifacts:Ml(s),signal:n.signal}}),i=t(`@tangle-network/agent-runtime`,import.meta.url);if(!i)throw Error(`Cannot identify the Runtime workspace archive owner`);let o=JSON.parse(await F(i,`utf8`));return Ol.parse({snapshot:r,capture:{mode:`git-working-tree`,runtimeVersion:o.version,limits:e},gaps:[`environment-and-toolchain-not-snapshotted`,`git-ignored-files-excluded`]})}finally{c()}}async function Fl(e,t){let n=P.uuid().parse(t.runId),r=Ol.parse(e);Al(r);let i=await jl(),a=M(i,`workspaces`);if(await Ze(a,{recursive:!0,mode:448}),await I(a)!==a)throw Error(`Task workspace allocation root redirects elsewhere`);let o=M(a,n),{release:s}=ht({lockPath:`${o}.lock`});try{t.signal?.throwIfAborted();let e=`${o}.task-workspace.json`,a;try{a=JSON.parse(await F(e,`utf8`))}catch(e){if(e.code!==`ENOENT`)throw e}let c=kl(r);if(a!==void 0){let e=P.strictObject({runId:P.uuid(),identity:P.string()}).parse(a);if(e.runId!==n||e.identity!==c||t.resumeCwd!==void 0&&be(t.resumeCwd)!==o||await I(o)!==o||!(await Xe(o)).isDirectory())throw Error(`The retained task workspace no longer names this exact native run allocation`)}else{if(t.resumeCwd!==void 0)throw Error(`The retained task workspace allocation receipt is missing`);await xt({snapshot:r.snapshot,artifacts:Ml(i),destination:o,limits:r.capture.limits,signal:t.signal}),await L(e,JSON.stringify({runId:n,identity:c}),{flag:`wx`,mode:384,flush:!0})}if(!t.validationOnly||a!==void 0)return{cwd:o,release:s};let l=await Promise.all([Xe(o,{bigint:!0}),Xe(e,{bigint:!0})]);return{cwd:o,release:async()=>{try{for(let[t,r]of[o,e].entries()){let e=await Xe(r,{bigint:!0});if(!(t===0?e.isDirectory():e.isFile())||e.dev!==l[t]?.dev||e.ino!==l[t]?.ino||await I(r)!==r)throw Error(`Validation allocation ${n} changed; retained`)}if(A(JSON.parse(await F(e,`utf8`)))!==A({runId:n,identity:c}))throw Error(`Validation allocation ${n} receipt changed; retained`);try{throw await Xe(M(i,`runs`,n)),Error(`Validation allocation ${n} has run state; retained`)}catch(e){if(e.code!==`ENOENT`)throw e}await nt(o,{recursive:!0}),await nt(e)}finally{s()}}}}catch(e){throw s(),e}}function Il(e){e.command(`workspace`).description(`Capture immutable local task files for graph replay`).command(`capture <repository>`).description(`Capture Git HEAD, index, tracked and unignored files into private local artifacts`).requiredOption(`--output <file>`,`New reference file outside the source repository`).option(`--limits <file>`,`JSON overrides for the maintained Runtime archive limits`).action(async(e,t)=>{let n=await I(be(e)),r=M(await I(ge(be(t.output))),he(be(t.output)));if(Cl(n,r))throw Error(`The task reference must be written outside the original workspace`);try{throw await Xe(r),Error(`Task workspace reference already exists; choose a new output file`)}catch(e){if(e.code!==`ENOENT`)throw e}let i=await Pl(n,{limits:t.limits?El.parse(JSON.parse(await F(t.limits,`utf8`))):void 0});await L(r,JSON.stringify(i),{flag:`wx`,mode:384,flush:!0}),z(i)})}const Ll=P.string().regex(/^[a-f0-9]{64}$/),Rl=P.strictObject({version:P.literal(1),runId:P.uuid(),file:P.string().refine(ve),cwd:P.string().refine(ve),sourceDigest:Ll,source:P.string().optional(),graphDigest:Ll,params:P.record(P.string(),P.unknown()),trigger:P.record(P.string(),P.unknown()).optional(),gateChoices:P.record(P.string(),P.string()).optional(),startedAt:P.iso.datetime(),seat:P.string().optional(),mcpPolicy:Ae.optional(),taskWorkspace:Ol.optional()});async function zl(e){let t=await bl(),n=t.graphRegistry(M(N(),`.tangle`,`graph-registry`)),r=await t.loadGraph(n,e.graphDigest);if(!r)throw Error(`Retained execution graph is unavailable; configuration is unknown`);let i=t.validateStoredGraph(r);if(i.digest!==e.graphDigest)throw Error(`Retained execution graph changed its identity`);return A({mcpPolicy:Ae.parse(e.mcpPolicy??{}),nodes:i.nodes.map(({id:e,profile:t})=>({id:e,harness:t.harness??null,model:t.model??null,seats:t.seats??null,connections:t.connections??null}))})}function Z(e){throw new W(`GRAPH_RESUME_REFUSED`,`The graph run cannot be resumed`,e,`tangle graph run --help`)}async function Bl(e){P.uuid().safeParse(e).success||Z(`Use a recorded graph run ID`);let t;try{let n=M(await I(M(N(),`.tangle`)),`runs`,e);await I(n)!==n&&Z(`The run directory redirects elsewhere`),t=await $e(M(n,`input.json`),le.O_RDONLY|le.O_NOFOLLOW),(await t.stat()).isFile()||Z(`The run input is not a regular file`);let r=Rl.parse(JSON.parse(await t.readFile(`utf8`)));return r.runId!==e&&Z(`The recorded run identity changed`),r.source!==void 0&&Hl(r,r.source),r}catch(e){if(e instanceof W)throw e;return Z(`The private recorded run input is missing or invalid`)}finally{await t?.close()}}async function Vl(e,t){let n=t.source??await F(t.file,`utf8`);Hl(t,n),await L(M(e,`input.json`),JSON.stringify({...t,source:n}),{flag:`wx`,mode:384,flush:!0})}function Hl(e,t){return w(`sha256`).update(t).digest(`hex`)!==e.sourceDigest&&Z(`The retained graph source does not match this run`),t}async function Ul(e){return Hl(e,e.source??await F(e.file,`utf8`))}function Wl(e,t,n,r,i={}){e.sourceDigest!==n&&Z(`The authored graph source changed`),t.cloud&&Z(`A local run cannot move to cloud execution`),Object.entries(r).some(([t,n])=>!Object.hasOwn(e.params,t)||A(n)!==A(e.params[t]))&&Z(`A recorded graph parameter changed`),Object.entries(i).some(([t,n])=>e.gateChoices?.[t]!==n)&&Z(`A recorded gate choice changed`),t.seat!==void 0&&t.seat!==e.seat&&Z(`The recorded graph seat override changed`),t.mcpPolicy!==void 0&&(e.mcpPolicy===void 0||A(t.mcpPolicy)!==A(e.mcpPolicy))&&Z(`The recorded graph MCP policy changed`)}const Gl=e=>Object.entries(e).map(([e,t])=>`${e}=${typeof t==`string`?t:JSON.stringify(t)}`),Kl=`claude,codex,kimi,opencode,gemini,pi`;function ql(e,t){let n;return async(r,{node:i,lastCandidate:a})=>{t.throwIfAborted();let o;try{o=r===void 0?void 0:ae(r)}catch(e){throw e instanceof Error&&Object.assign(e,{node:i,seat:r,fixCommand:`tangle graph run --help`}),e}n??=Et({cwd:e,signal:t,config:Dt({...process.env,BRIDGE_BACKENDS:Kl,BRIDGE_SUBSCRIPTIONS_ONLY:`1`})});let s=await n;t.throwIfAborted();let c=e=>e.authentication?.status===`authenticated`&&e.authentication.authMode===`subscription`,l=o?.harness??s.find(e=>e.provider&&c(e))?.backend,u=s.filter(e=>e.backend===l),d=u.filter(c),f=o?u.find(e=>e.id===`${o.harness}/${o.model}`)??d.find(e=>e.provider===o.provider):d.find(e=>e.default)??d.find(e=>e.recommended)??d[0];if(!f||!c(f)){if(a===!1)return;let e=f?.authentication??u[0]?.authentication??(o?void 0:s.find(e=>e.authentication?.fix)?.authentication);throw Object.assign(new W(o?`SEAT_NOT_LOGGED_IN`:`SEAT_NONE_DETECTED`,`Node '${i}' has no available subscription${o?` for ${o.harness}`:``}`,e?`Selected provider: ${e.status} (${e.authMode})`:`No authenticated subscription route was detected`,e?.fix??`tangle graph run --help`),{node:i,seat:r})}let p=o?.harness??ae(f.id).harness,m=o?.provider??f.provider,h=o?.model??f.id.slice(p.length+1);if(!m||!h)throw new W(`MODEL_PROVIDER_MISMATCH`,`Node '${i}' has an unresolved model provider`,`Bridge has no configured provider for ${r??p}`,`tangle graph run --help`);return{harness:p,provider:m,model:h,selector:{kind:`all-eligible`},...o?.reasoningEffort===void 0?{}:{reasoningEffort:o.reasoningEffort}}}}const Jl=Ot(we);function Yl(e,t,n=`tangle graph run --help`){throw new W(`SEAT_NONE_DETECTED`,e,t,n)}function Xl(e){let t=[];for(let n of e.nodes)for(let e of n.check?.egress??[]){let n=e.trim().toLowerCase();if(n){if(/[\s*]|\/|:\/\//u.test(n))throw new W(`GRAPH_EGRESS_HOST`,`Graph egress host "${e.trim()}" is not a DNS hostname`,`A check egress entry has whitespace, a wildcard, or a URL`,`tangle graph run --help`);t.includes(n)||t.push(n)}}return t.length>0?t.join(`,`):void 0}function Zl(e){return e.some(e=>(e.profile?.seats?.length??0)>0)}function Ql(e){let t=e?.trim();if(t)return/\s/u.test(t)&&Yl(`A seat account, command, or credential must be a single token`,`The seat command is an executable path, not a shell line`),t}function $l(e){let t=Ql(e.seatAccount),n=Ql(e.seatCommand),r=Ql(e.seatCredential);return r&&!n&&!t&&Yl(`A seat credential needs a seat command`,`The credential is an argument to the configured command`,`tangle graph run --seat-command <program>`),{...t?{account:t}:{},...n?{command:n}:{},...r?{credential:r}:{}}}async function eu(e,t,n){if(e.account)return e.account;e.command||Yl(`This graph needs a seat account or a seat command`,`No account was authored and no seat command is configured`,`tangle graph run --seat-account <account>`);let r=``;try{r=(await Jl(e.command,[t,...e.credential?[e.credential]:[]],{timeout:3e4,maxBuffer:4096,signal:n,encoding:`utf8`})).stdout}catch(e){n.throwIfAborted();let t=e.code===`ENOENT`;Yl(t?`The seat command was not found`:`The seat command failed`,t?`The configured executable is not on PATH`:`The seat command exited without an account id`)}let i=r.trim();return(!i||/\s/u.test(i))&&Yl(`The seat command did not print an account id`,`The command must print one account id and nothing else`),i}function tu(e,t,n){let r=new Map;return async i=>{n.throwIfAborted();let a=i.stage.harness,o=i.stage.selector.kind===`seat`?i.stage.selector.id.trim():``,s=`${a}\0${t.credential??``}`,c=o||t.account||r.get(s)||await eu(t,a,n);return!o&&!t.account&&r.set(s,c),(!c||/\s/u.test(c)||i.resumeSeatId!==void 0&&i.resumeSeatId!==c)&&Yl(`Node '${i.nodeId}' has no seat account`,`The authored seat, account flag, or seat command did not yield one`),{seat:c,backend:{backend:`provider`,provider:At({baseUrl:e.bridgeUrl,bearerToken:e.bridgeBearer}),defaults:{workspace:{cwd:{base:`host`,path:e.cwd}}},runtime:`cli`,outputFormat:`json`,destroyOnSettle:!0,requireTerminalEvent:!0}}}}function Q(e){return Di({signal:e.signal,...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.baseUrl===void 0?{}:{baseUrl:e.baseUrl}})}const nu=P.object({version:P.literal(1),type:P.enum([`state`,`ack`,`error`,`event`]),requestId:P.string().optional(),operationId:P.string().optional(),command:P.string().optional(),code:P.string().optional(),message:P.string().optional(),result:P.unknown().optional()}).passthrough(),ru=P.object({state:P.object({runConfiguration:P.unknown()}),view:P.object({capabilities:P.record(P.string(),P.object({available:P.boolean(),reason:P.string().optional()}))})}),iu=P.object({status:P.enum([`completed`,`failed`,`cancelled`]),analysis:P.object({id:P.string().min(1)}).passthrough(),source:P.object({runtimeRun:P.unknown()}).passthrough()}).passthrough(),au=`TANGLE_GRAPH_ANALYSIS_SOURCE`;async function ou(e,t,n){if(!e.startsWith(`wfrun_`)){let t=M(await I(M(N(),`.tangle`)),`runs`,e);if(await I(t)!==t)throw new W(`RUN_NOT_FOUND`,`The run directory redirects elsewhere`,`Use the recorded local run directory`,`tangle graph inspect --help`);return{source:`runtime:${e}@${t}`,env:{},schema:P.object({runId:P.literal(e),runDir:P.literal(t)})}}let r={signal:n,...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.baseUrl===void 0?{}:{baseUrl:t.baseUrl}},i=await Q(r),a=P.object({id:P.literal(e),workflowId:P.string(),revUsed:P.number().int(),execution:P.object({kind:P.literal(`graph`),sourceSha:P.string(),authoredGraphDigest:P.string(),graphDigest:P.string()}),runtime:P.object({snapshot:P.object({supervisors:P.tuple([P.object({id:P.string()})])})})}).parse(await i.workflows.getRun(e,{signal:n})),o=a.runtime.snapshot.supervisors[0];if(!o)throw new W(`BRAID_RPC_FAILED`,`The cloud run has no retained Runtime root`,`Wait for execution evidence before analysis`,`tangle graph inspect ${e}`);let s=await Ci(r);if(new URL(s.baseUrl.replace(/\/+$/,``)).href!==new URL(i.baseUrl.replace(/\/+$/,``)).href)throw new W(`AUTH_REQUIRED`,`The analysis source origin changed`,`Use the same authenticated platform origin`,`tangle auth status --json`);return{source:`runtime:${e}@${au}`,env:{[au]:JSON.stringify({url:`${s.baseUrl.replace(/\/+$/,``)}/v1/workflows/runs/${encodeURIComponent(e)}`,headers:{Authorization:`Bearer ${s.token}`}})},schema:P.object({runId:P.literal(e),remoteEndpointEnv:P.literal(au),checkpoint:P.object({workflowId:P.literal(a.workflowId),runtimeRunId:P.literal(o.id),revUsed:P.literal(a.revUsed),sourceSha:P.literal(a.execution.sourceSha),authoredGraphDigest:P.literal(a.execution.authoredGraphDigest),graphDigest:P.literal(a.execution.graphDigest)})})}}async function su(e,t){if(!e.startsWith(`wfrun_`)&&!P.uuid().safeParse(e).success)throw new W(`RUN_NOT_FOUND`,`Use a recorded graph run ID`,`The run identifier is invalid`,`tangle graph inspect --help`);if(!Number.isSafeInteger(t.timeout)||t.timeout<1)throw new W(`INVALID_TIMEOUT`,`Use a positive analysis timeout`,`The timeout must be an integer number of milliseconds`,`tangle graph analyze --help`);let n=t.profile;if(!n?.trim())throw new W(`USAGE_INVALID`,`Select the canonical analysis profile`,`Graph analysis requires an existing canonical AgentProfile reference`,`tangle graph analyze `+e+` --profile <name|path>`);let r=/^(?:\.\.?)[/\\]/.test(n)?be(process.cwd(),n):n;return qc(t.signal,async n=>{let i=await ou(e,t,n),a=i.source;return wf({signal:n,errorRunId:e},async n=>{let o=await n.bridge(),s=await Qe(M(n.runDir,`analysis-`)),c=M(s,`config.json`),l=M(s,`database.key`),u=M(s,`state.sqlite`),d=`connection-owned-graph-bridge`,f=new Date().toISOString();await L(l,T(32),{mode:384,flag:`wx`}),await L(c,JSON.stringify({format:`braid-startup-config`,schemaVersion:2,profile:r,connectionId:d,connections:[{id:d,name:`Graph analysis`,kind:`cli-bridge`,endpoint:o.bridgeUrl,providerOptions:{transport:`local`},createdAt:f,updatedAt:f,lastHealth:{status:`unknown`}}]}),{mode:384,flag:`wx`});let p=n.signal,m=`op-${E()}`,h=`op-${E()}`,g=`${m}:initialize`,_=`${m}:analyze`,v=`${m}:shutdown`,y={version:1,requestId:g,command:`initialize`,params:{workspace:n.cwd,subscribe:!1}},b={version:1,requestId:_,operationId:m,command:`analyze`,params:{source:a,recipe:`all`,totalTimeoutMs:t.timeout}},x={version:1,requestId:v,operationId:h,command:`shutdown`,params:{mode:`wait`}},S,C,w,D,O={transform:e=>{let t=nu.parse(e);return t.type===`error`||t.type===`state`&&t.requestId===g||t.type===`ack`&&[_,v].includes(t.requestId??``)?t:null},onError:e=>{D??=e},onEvent:e=>{e.type===`error`&&(D??=new W(e.code??`BRAID_RPC_FAILED`,`Braid refused graph analysis`,e.message??`The RPC response omitted its cause`,`tangle graph analyze --help`)),e.requestId===g&&e.type===`state`&&(S??=e),e.requestId===_&&e.type===`ack`&&(C??=e),e.requestId===v&&e.type===`ack`&&(w??=e)}},k=await Ke({command:process.env.BRAID_BIN??`braid`,args:[`rpc`,`--workspace`,n.cwd,`--config`,c,`--profile`,r,`--database-key-file`,l],cwd:n.cwd,env:{...i.env,BRAID_STATE_PATH:u,BRAID_CLI_BRIDGE_ENDPOINT:o.bridgeUrl,BRAID_CLI_BRIDGE_AUTH:o.bridgeBearer},timeoutMs:t.timeout,signal:p,ownProcessGroup:!0},O,{stdin:[y,...t.dryRun?[]:[b],x].map(e=>JSON.stringify(e)).join(`
 `)+`
-`});if(D)throw D;let ee=k.exit;if(!ee.success||!S||!w||w.operationId!==h||w.command!==`shutdown`)throw new W(`BRAID_RPC_FAILED`,`Braid graph analysis did not finish`,ee.spawnError??ee.timeoutDiagnostic??ee.stdinError??ee.processGroupError??ee.captureError??ee.terminateError??(k.stderr||`Exit ${ee.code}, signal ${ee.signal}; complete shutdown acknowledgement: ${!!w}`),`npm install --global @tangle-network/braid`);let te=nu.parse(S),ne=te.view.capabilities[`analysis.recipe`];if(t.dryRun)return{source:a,statePath:u,configuration:te.state.runConfiguration,capability:ne};if(!C||C.operationId!==m||C.command!==`analyze`)throw Error(`Braid did not acknowledge this analysis operation`);let re=ru.parse(C.result);if(!i.schema.safeParse(re.source.runtimeRun).success)throw new W(`BRAID_RPC_FAILED`,`Braid returned analysis of another source`,`Its saved run or immutable checkpoint identity does not match this request`,`tangle graph inspect ${e}`);return{...re,statePath:u}})},`tangle graph analyze ${e}`)}function su(e){e.command(`analyze <run>`).description(`Analyze retained graph evidence through Braid`).addHelpText(`after`,`
+`});if(D)throw D;let ee=k.exit;if(!ee.success||!S||!w||w.operationId!==h||w.command!==`shutdown`)throw new W(`BRAID_RPC_FAILED`,`Braid graph analysis did not finish`,ee.spawnError??ee.timeoutDiagnostic??ee.stdinError??ee.processGroupError??ee.captureError??ee.terminateError??(k.stderr||`Exit ${ee.code}, signal ${ee.signal}; complete shutdown acknowledgement: ${!!w}`),`npm install --global @tangle-network/braid`);let te=ru.parse(S),ne=te.view.capabilities[`analysis.recipe`];if(t.dryRun)return{source:a,statePath:u,configuration:te.state.runConfiguration,capability:ne};if(!C||C.operationId!==m||C.command!==`analyze`)throw Error(`Braid did not acknowledge this analysis operation`);let re=iu.parse(C.result);if(!i.schema.safeParse(re.source.runtimeRun).success)throw new W(`BRAID_RPC_FAILED`,`Braid returned analysis of another source`,`Its saved run or immutable checkpoint identity does not match this request`,`tangle graph inspect ${e}`);return{...re,statePath:u}})},`tangle graph analyze ${e}`)}function cu(e){e.command(`analyze <run>`).description(`Analyze retained graph evidence through Braid`).addHelpText(`after`,`
 Requires the Braid companion CLI: npm install --global @tangle-network/braid.
 BRAID_BIN may select its installed executable. Select an existing canonical AgentProfile with --profile. Analysis uses the owned subscription-only Bridge.
-`).requiredOption(`--profile <name|path>`,`Use a canonical analysis AgentProfile, distinct from the Tangle account profile`).option(`--dry-run`,`Inspect Braid's selected analysis configuration without dispatch`).option(`--timeout <ms>`,`Bound the analysis process in milliseconds`,Number,3e5).action(async(e,t)=>{let n=await ou(e,t);z(n),`status`in n&&n.status!==`completed`&&(process.exitCode=1)})}async function cu(e,t){let n=[],r=[],i=(e,t)=>{if(!t||typeof t!=`object`)return;let i=P.object({status:P.string(),files:P.array(P.object({path:P.string(),artifact:k})),missing:P.unknown()}).parse(t);r.push({node:e,status:i.status,missing:i.missing}),n.push(...i.files.map(t=>({node:e,...t})))},a;if(e.startsWith(`wfrun_`)){let n=await Q(t),r=await n.workflows.getRun(e);for(let e of r.runtime?.checks??[])i(e.nodeId,e.outputs);a=async({artifact:t})=>{let i=(await n.workflows.listArtifacts(r.workflowId,e)).artifacts.find(e=>e.name===`runtime/${t.sha256}`&&e.byteSize===t.byteLength);if(!i)throw Error(`The workflow owner has no retained bytes for this artifact`);return(await n.workflows.downloadArtifact(r.workflowId,e,i.id)).bytes}}else{if(!P.uuid().safeParse(e).success)throw Error(`Use a recorded graph run ID`);let t=M(await I(M(N(),`.tangle`,`runs`)),e);if(await I(t)!==t)throw Error(`The graph run directory redirects elsewhere`);let{FileSpawnJournal:n,FileResultBlobStore:r,loadSpawnForest:o,createPrivateCasArtifactPort:s}=await import(`@tangle-network/agent-runtime/kernel`),c=new r(M(t,`blobs`)),l=await o(new n(M(t,`spawn-journal.jsonl`)),e);for(let e of l.nodes){if(e.runtime!==`graph-check`||!e.outRef)continue;let t=await c.get(e.outRef);i(e.id,t?.outputs)}let u=s(M(t,`artifacts`),e);a=e=>u.read(e.artifact)}if(!t.artifact)return z({runId:e,capture:r,files:n});if(!t.out)throw new W(`USAGE_INVALID`,`Select an output file`,`Artifact downloads require --out`,`tangle graph inspect ${e} --artifact <node/path> --out <file>`);let o=n.filter(e=>`${e.node}/${e.path}`===t.artifact||e.artifact.sha256===t.artifact);if(o.length!==1)throw Error(`Select one exact node/path from graph inspect --artifacts`);let s=o[0],c=await a(s);if(c.byteLength!==s.artifact.byteLength||`sha256:${$(Buffer.from(c))}`!==s.artifact.sha256)throw Error(`Retained artifact bytes do not match their recorded identity`);let l=be(t.out);await Ze(ge(l),{recursive:!0}),await L(l,c,{mode:384,flag:`wx`});let u={runId:e,node:s.node,path:s.path,artifact:s.artifact,destination:l};t.json?z(u):V(`Saved ${s.path} to ${l}`)}const lu=1e3;function uu(e,t){return[...t,e]}function du(e,t=`input`,n){if(n===void 0&&!e?.length)return;let r={};if(n!==void 0)try{if(r=JSON.parse(fe(n,`utf8`)),!r||typeof r!=`object`||Array.isArray(r)||Object.entries(r).some(([e,t])=>!e.length||typeof t!=`string`))throw Error(`Invalid input map`)}catch{throw new W(`WORKFLOW_INPUT_FILE_INVALID`,`Could not load --input-file '${n}'`,`Expected a readable JSON object with nonempty keys and string values`,`tangle workflows run --help`)}let i=Object.entries(r);for(let n of e??[]){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${n}": expected key=value (e.g. pull_request.number=123)`);i.push([n.slice(0,e),n.slice(e+1)])}return Object.fromEntries(i)}function fu(e){R(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function pu(e){if(U({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){V(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);R(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(V(`Graph`),U({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),R(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(V(`Edge verdicts`),R(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function mu(e){if(e.status===`cancelled`){V(`Cancelled run ${e.runId}.`);return}if(e.signalled){V(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}V(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function hu(e){switch(e.type){case`snapshot`:V(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function gu(e){e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input-file <file>`,`Trigger inputs from a flat JSON string map; --input overrides its keys`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,uu,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t)=>{let n=du(t.input,`input`,t.inputFile),r=t.timeout===void 0?void 0:Go(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:Go(t.pollInterval,`--poll-interval`),a=await Q(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return z({runId:o});V(`Started run ${o} for workflow ${e}.`),V(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:H(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return z(c);pu(c)}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).action(async(e,t)=>{let n=await Q(t),r=t.limit===void 0?void 0:Go(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=lu){s=c.nextCursor,t.json||V(`Stopped after ${lu} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return z({runs:i,nextCursor:s});fu(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return z(i);fu(i.runs),i.nextCursor&&V(`More runs available — next page: --cursor ${i.nextCursor}`)}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.getRun(e,t);if(n.json)return z(r);pu(r)}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.cancel(e,t);if(n.json)return z(r);mu(r)}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t,n)=>{let r=n.timeout===void 0?void 0:Go(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:Go(n.pollInterval,`--poll-interval`),a=await Q(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return z(o);V(`Started run ${o.runId} (retry of ${t}).`),V(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:H(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return z(c);pu(c)}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await Q(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):hu(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)})}async function _u(e,t){let n;try{if(n=t.deploy?jt(await F(t.deploy,`utf8`)):{name:he(e).replace(/(\.graph)?\.(yaml|yml|json)$/i,``)},!n||typeof n!=`object`||Array.isArray(n)||typeof n.name!=`string`||!n.name.trim())throw Error(`Invalid deployment`)}catch{throw new W(`GRAPH_DEPLOY_INVALID`,`Cannot read graph deployment settings`,`Use a YAML or JSON object containing name and the platform's graph deployment fields`,`tangle graph apply --help`)}let r=du(t.param,`param`),i=t.mcpPolicy??n.mcpPolicy;return{...n,...r?{params:{...n.params,...r}}:{},...t.seat?{seat:t.seat}:{},...i===void 0?{}:{mcpPolicy:ke.parse(i)}}}function vu(e){if(e.execution?.kind!==`graph`||!e.headRev)throw new W(`GRAPH_DEPLOY_CONFLICT`,`The deployment is not a versioned native graph`,`Choose a graph workflow or a new deployment name`,`tangle workflows list`)}async function yu(e,t){let n=await e.workflows.list({name:t});if(n.length>1)throw new W(`GRAPH_DEPLOY_CONFLICT`,`More than one workflow has this name`,`Select the intended deployment with --workflow <id>`,`tangle workflows list`);return n[0]?e.workflows.get(n[0].id):void 0}async function bu(e,t,n,r){let i={on:[],...n,...n.mcpPolicy===void 0?{}:{mcpPolicy:ke.parse(n.mcpPolicy)}},a;a=r?await e.workflows.get(r):await yu(e,n.name);let o=await e.workflows.validate(t,{format:`graph`,deploy:i});if(!o.valid)throw new W(`GRAPH_DEPLOY_INVALID`,`Graph deployment validation failed`,o.errors.map(e=>`${e.path}: ${e.message}`).join(`
-`),`tangle graph apply --help`);a||=await e.workflows.create(t,{format:`graph`,deploy:{...i,on:[],enabled:!1},dedupeKey:`graph-cli:${n.name}`}),vu(a);let s=e=>!e.triggers?.some(e=>e.kind===`provider_event`)&&e.enabled===(i.enabled??!0)&&e.execution.sourceSha===$(t)&&o.graphDigest!==void 0&&e.execution.graphDigest===o.graphDigest&&A(e.execution.deploy)===A(i);if(s(a))return{action:`unchanged`,workflow:a};try{return{action:`applied`,workflow:await e.workflows.update(a.id,t,{format:`graph`,deploy:i,expectedRev:a.headRev})}}catch(t){if(!(t&&typeof t==`object`&&`status`in t&&t.status===409))throw t;let n=await e.workflows.get(a.id);if(vu(n),!s(n))throw t;return{action:`unchanged`,workflow:n}}}function xu(e,t){e.command(`webhook <workflow>`).description(`Reveal a new webhook bearer for a deployed graph; retire its previous bearer`).requiredOption(`--rotate`,`Explicitly authorize minting and revealing a new webhook token`).action(async(e,t)=>{let n=await Q(t);vu(await n.workflows.get(e)),z(await n.workflows.rotateHookToken(e))}),e.command(`apply <name-or-file>`).description(`Publish a native graph without running it; update its stable cloud deployment`).option(`--deploy <file>`,`YAML/JSON deployment settings: name, on, params, seat, enabled and maxRunCostUsd`).option(`--workflow <id>`,`Update this workflow instead of matching its name`).option(`--seat <seat>`,`Override the deployment's harness/model@effort`).option(`--param <key=value>`,`Override a deployment parameter; repeatable`,(e,t)=>[...t,e],[]).option(`--dry-run`,`Validate graph and bindings without publishing`).action(async(e,n)=>qc(void 0,async r=>{let i=t(e,process.cwd()),a=await F(i,`utf8`),o=await _u(i,n),s=await Q({...n,signal:r}),c=n.dryRun?await s.workflows.validate(a,{format:`graph`,deploy:o}):await bu(s,a,o,n.workflow);`valid`in c&&!c.valid&&(process.exitCode=1),n.json||`valid`in c?z(c):V(`${c.action} · ${c.workflow.id} · revision ${c.workflow.headRev}`)},`tangle graph apply --help`))}async function Su(e,t,n,r){if(n.mcpSecret?.length)throw new W(`GRAPH_CLOUD_SECRET_BINDING`,`Local MCP credentials cannot be uploaded`,`Cloud secret references must bind through the cloud owner's credential environment`,`tangle graph run --help`);let i=await Q({...n,signal:r}),a=$(t),o=du(n.param,`param`),s=await _u(e,n),c,l;if(n.resume){let e=await i.workflows.getRun(n.resume,{signal:r});e.id!==n.resume&&Z(`The cloud owner returned another run identity`),n.workflow&&e.workflowId!==n.workflow&&Z(`The recorded cloud deployment changed`);let t=e.execution;if((t?.kind!==`graph`||t.sourceSha!==a)&&Z(`The authored cloud graph source changed`),n.deploy&&A(t.deploy)!==A({on:[],...s})&&Z(`The recorded cloud deployment settings changed`),Object.entries(o??{}).some(([e,n])=>!Object.hasOwn(t.params,e)||A(t.params[e])!==A(n))&&Z(`A recorded cloud graph parameter changed`),n.seat!==void 0&&n.seat!==t.deploy.seat&&Z(`The recorded cloud seat override changed`),n.mcpPolicy!==void 0&&A(n.mcpPolicy)!==A(t.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]})&&Z(`The recorded cloud MCP policy changed`),n.dryRun)return{run:e};if((e.status===`cancelled`||e.status===`failed`)&&Z(`The cloud run is terminal: ${e.status}`),e.status===`succeeded`)return e.graphResult||Z(`The settled cloud run has no retained Runtime result`),{workflowId:e.workflowId,runId:e.id,sourceDigest:a,result:e.graphResult,replayed:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};if(e.recovery?.state===`running`)return{workflowId:e.workflowId,runId:e.id,sourceDigest:a,run:e,attached:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};e.recovery?.state!==`queued`&&e.recovery?.state!==`recoverable`&&Z(`The owner has not confirmed recovery eligibility`),c=e.workflowId,l=e.revUsed??Z(`The captured cloud revision is unavailable`)}else{let e=n.workflow?await i.workflows.get(n.workflow):!n.deploy&&!n.dryRun?await yu(i,s.name):void 0;if(e){if((e.execution?.kind!==`graph`||e.execution.sourceSha!==a)&&Z(`The selected deployment does not contain this graph source; use graph apply first`),(n.deploy&&A(e.execution.deploy)!==A({on:[],...s})||Object.entries(o??{}).some(([t,n])=>!Object.hasOwn(e.execution?.kind===`graph`?e.execution.params:{},t)||A(e.execution?.kind===`graph`?e.execution.params[t]:null)!==A(n))||n.seat!==void 0&&n.seat!==e.execution.deploy.seat||n.mcpPolicy!==void 0&&A(n.mcpPolicy)!==A(e.execution.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]}))&&Z(`The selected deployment bindings changed; use graph apply first`),n.dryRun)return{workflow:e};c=e.id,l=e.headRev??Z(`The selected deployment has no retained revision`)}else{if(n.dryRun)return i.workflows.validate(t,{format:`graph`,deploy:s});let{workflow:e}=await bu(i,t,s);c=e.id,l=e.headRev??Z(`The cloud workflow has no retained revision`)}}r.throwIfAborted();let u=await i.workflows.run(c,void 0,{signal:r,sourceSha:a,expectedRev:l,...n.resume?{resumeRunId:n.resume}:{}});return n.resume&&u.runId!==n.resume&&Z(`The cloud owner recovered another run identity`),{...u,workflowId:c,sourceDigest:a,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(c)}/runs/${encodeURIComponent(u.runId)}`}}const Cu=P.strictObject({runId:P.uuid(),identity:P.string(),request:P.string()});function wu(e,t){e.command(`dispatch <name-or-file>`).description(`Admit a local scheduler/webhook delivery once, retaining its event and run for retries`).requiredOption(`--event <file>`,`JSON object supplied as trigger data`).requiredOption(`--delivery <id>`,`Stable provider delivery id or nominal cron occurrence, reused on retries`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ll()).option(`--mcp-policy <file>`,`Use the same explicit local MCP policy as graph run`).option(`--param <key=value>`,`Graph parameter; repeatable`,(e,t)=>[...t,e],[]).action(async(e,n)=>{let r={...n,mcpPolicy:n.mcpPolicy===void 0?void 0:await dl(n.mcpPolicy)},i=e=>{throw new W(`GRAPH_DELIVERY_REFUSED`,`Local graph delivery was not admitted`,e,`tangle graph dispatch --help`)};r.delivery.trim()||i(`A stable nonempty delivery id is required`);let a;try{a=P.record(P.string(),P.unknown()).parse(JSON.parse(await F(r.event,`utf8`)))}catch{return i(`The event file must contain a JSON object`)}let o=await I(t(e,process.cwd())),s=await I(process.cwd()),c=await F(o,`utf8`),l=A({file:o,cwd:s,delivery:r.delivery}),u=A({source:$(c),trigger:a,mcpPolicy:Ae.parse(r.mcpPolicy??{}),params:du(r.param,`param`)??{},...r.seat===void 0?{}:{seat:r.seat}}),d=M(N(),`.tangle`,`deliveries`,$(l));await Ze(d,{recursive:!0,mode:448}),await I(d)!==d&&i(`The delivery store redirects elsewhere`);let f=M(d,`delivery.json`),p;try{let e=await $e(f,le.O_WRONLY|le.O_CREAT|le.O_EXCL|le.O_NOFOLLOW,384);try{p={runId:E(),identity:l,request:u},await e.writeFile(JSON.stringify(p)),await e.sync()}finally{await e.close()}}catch(e){if(e.code!==`EEXIST`)throw e;let t=await $e(f,le.O_RDONLY|le.O_NOFOLLOW);try{p=Cu.parse(JSON.parse(await t.readFile(`utf8`)))}catch{return i(`The durable delivery record is incomplete; inspect it before retrying`)}finally{await t.close()}}(p.identity!==l||p.request!==u)&&i(`This delivery id already belongs to different graph bytes, event data or parameters`);let m;try{m=ht({lockPath:`${f}.lock`}).release}catch(e){return i(`Delivery ${r.delivery} cannot acquire its owner lock; inspect run ${p.runId}: ${e instanceof Error?e.message:`lock unavailable`}`)}try{let e=M(N(),`.tangle`,`runs`,p.runId,`input.json`),t=!1;try{await F(e),t=!0}catch(e){if(e.code!==`ENOENT`)throw e}let n=await Ef(o,{...r,...t?{resume:p.runId}:{}},{cwd:s,source:c,trigger:a,runId:p.runId});r.json?z({delivery:r.delivery,...n}):V(`Delivery ${r.delivery} · run ${p.runId}`)}finally{await m()}})}const Tu=e=>`${e}.tmp-${T(6).toString(`hex`)}`,Eu=new Map;function Du(e){let t=be(e),n=Eu.get(t)??{};if(Eu.set(t,n),n.queued)return n.queued;let r=(n.running??Promise.resolve()).catch(()=>void 0).then(async()=>{n.running=r,n.queued=void 0;try{let e=await Ye.open(t,`r`);await e.sync().finally(()=>e.close())}finally{n.queued||Eu.delete(t)}});return n.queued=r,r}async function Ou(e,t,{mode:n=384,owner:r,directory:i}={}){if(i&&!/^(?!\.\.?$)[^/]+$/.test(e))throw Error(`Not an entry name in the open directory: ${e}`);let a=i?`/proc/self/fd/${i.fd}/${e}`:e,o=Tu(a);try{let e=await Ye.open(o,`wx`,n);try{r&&await e.chown(r.uid,r.gid),await e.chmod(n),await e.writeFile(t,`utf-8`),await e.sync()}finally{await e.close()}await Ye.rename(o,a)}catch(e){throw await Ye.rm(o,{force:!0}).catch(()=>void 0),e}await(i?i.sync():Du(ge(a)))}const ku=P.number().int().positive(),Au=async e=>JSON.parse(await F(e,`utf8`)),ju=(e,t)=>Ou(e,JSON.stringify(t));function Mu(e,t){let n=e.readout(),r=n.tokensKnown?n.deadlineMs>0&&Date.now()>=n.deadlineMs?`Campaign deadline exhausted`:t.maxTokens!==void 0&&n.tokensCapped&&t.maxTokens>n.tokensLeft?`Campaign token ceiling cannot fund the next graph`:t.maxIterations!==void 0&&n.iterationsCapped&&t.maxIterations>n.iterationsLeft?`Campaign iteration ceiling cannot fund the next graph`:void 0:`Campaign token accounting is incomplete`;if(r)throw Object.assign(new Nt(r),{code:`GRAPH_CAMPAIGN_BUDGET_EXHAUSTED`})}const Nu=P.strictObject({runId:P.uuid(),budget:P.object({maxTokens:ku,maxIterations:ku,deadlineMs:ku}).passthrough(),sourceDigest:P.string(),graphDigest:P.string()});async function Pu(e,t,n,r){let i=M(e,`budget.json`),a;try{a=await Au(i)}catch(e){if(e.code!==`ENOENT`)throw e;a={identity:n,startedAt:Date.now()}}if(a.identity!==n)throw Error(`Campaign configuration changed; use a new campaign directory`);let o=a.readout;if(o?.reservedTokens)throw Error(`Campaign backing has unresolved historical reservations`);let s=async e=>{let t=await zt(M(N(),`.tangle`,`runs`,e.runId));if(!t)return;let n=await zl(e.runId);if(t.tree.root!==e.runId||e.sourceDigest!==void 0&&n.sourceDigest!==e.sourceDigest||e.graphDigest!==void 0&&n.graphDigest!==e.graphDigest)throw Error(`Campaign settlement does not match its exact admitted graph`);return{settled:t,digest:A({runId:e.runId,sourceDigest:n.sourceDigest,graphDigest:n.graphDigest,spend:t.spentTotal})}},c=St(t,a.startedAt),l=P.record(P.uuid(),P.string()).parse(a.settlements??{});for(let[e,t]of Object.entries(l)){let n=await s({runId:e});if(!n||n.digest!==t)throw Error(`Historical campaign settlement is missing or changed; accounting cannot resume`);c.observe(n.settled.spentTotal,{alreadySpent:!0}),r?.(e,n.settled.spentTotal)}if(o&&A(o)!==A(JSON.parse(JSON.stringify(c.readout()))))throw Error(`Historical campaign backing cannot be reconstructed from its retained settlements`);let u=a.pending===void 0?void 0:Nu.parse(a.pending),d=o??c.readout(),f,p=()=>ju(i,{identity:n,startedAt:a.startedAt,readout:u?d:c.readout(),settlements:l,...u?{pending:u}:{}}),m=(e,t=!1)=>{t||Mu(c,e.budget),d=c.readout();let n=c.reserve(e.budget,{assignment:e.runId,stage:`executing`});if(!n.ok)throw new Nt(`Campaign cannot reserve the next graph's complete ceiling`);f=n.ticket,u=e},h=async()=>{if(!u||!f)return;let e=await s(u);if(!e)return;let t=f,n;try{c.reconcile(t,e.settled.spentTotal)}catch(e){if(c.openReservations().some(({ticketId:e})=>e===t.id))throw await p(),e;n=e}let i=u.runId;if(l[i]=e.digest,u=void 0,f=void 0,await p(),r?.(i,e.settled.spentTotal),n)throw n};if(u){let e=u;u=void 0,m(e,!0),await h()}return await p(),{pool:c,checkpoint:async e=>{if(e){if(l[e.runId]){let t=await s(e);if(!t||t.digest!==l[e.runId])throw Error(`An accounted campaign settlement changed`);r?.(e.runId,t.settled.spentTotal);return}if(u&&A(u)!==A(e))throw new Nt(`Campaign must reconcile its exact pending run ${u.runId} before admitting another graph`);u||m(e)}else{if(await h(),u)throw new Nt(`Campaign run ${u.runId} has no retained settlement; its reservation remains pending`);c.assertNoOpenTickets()}await p()},startedAt:a.startedAt,pendingAttempt:()=>u&&structuredClone(u)}}const Fu=P.strictObject({id:P.string(),kind:P.literal(`retained-graph`),domain:P.string().min(1),unit:P.string().min(1),split:P.enum([`train`,`dev`,`test`]),run:P.string().min(1),origin:P.string(),sourceDigest:P.string().nullable(),graphDigest:P.string().nullable(),params:P.record(P.string(),P.unknown()),trigger:P.record(P.string(),P.unknown()).nullable().optional(),mcpPolicy:Ae.optional(),taskWorkspace:Dl.optional(),outcome:P.string(),gaps:P.array(P.string()),evidence:P.string(),quality:P.null()}),Iu=async e=>JSON.parse(await F(e,`utf8`)),Lu=e=>e.code===`ENOENT`;function Ru(e,{name:t,provenance:n}){let r={train:0,dev:0,test:0,holdout:0};for(let t of e)r[t.split]++;return{name:t,provenance:n,contentHash:A(e.map(e=>({id:e.id,split:e.split,payload:e})).sort((e,t)=>e.id<t.id?-1:+(e.id>t.id))).slice(7),scenarioCount:e.length,splitCounts:r}}async function zu(e,t){let n=A(t),r=M(e,`objects`,`${n.slice(7)}.json`);await Ze(M(e,`objects`),{recursive:!0,mode:448});let i=JSON.stringify(t);try{await L(r,i,{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e;if(A(await Iu(r))!==n)throw Error(`Dataset evidence object changed`)}return n}async function Bu(e,t){if(!/^sha256:[a-f0-9]{64}$/.test(t))throw Error(`Invalid dataset object digest`);let n=await Iu(M(e,`objects`,`${t.slice(7)}.json`));if(A(n)!==t)throw Error(`Dataset evidence object changed`);return n}async function Vu(e,t){if(e.startsWith(`wfrun_`)){let n=await Q(t),[r,i]=await Promise.all([n.workflows.getRun(e,{signal:t.signal}),n.workflows.getRunInput(e,{signal:t.signal})]),a=i.completeness===`complete`&&i.id===r.id&&i.workflowId===r.workflowId&&i.revUsed===r.revUsed&&A({definitionSnapshot:i.definitionSnapshot,execution:i.execution,triggerContext:i.triggerContext,revUsed:i.revUsed})===i.inputDigest?i:void 0,o=a?.execution,s=a?.triggerContext;return{origin:new URL(n.baseUrl).origin,sourceDigest:i.sourceSha,graphDigest:i.graphDigest,params:o?.params??{},...a?{trigger:s}:{},mcpPolicy:o?.deploy?.mcpPolicy,outcome:r.status,source:a?.definitionSnapshot??null,gaps:[`task-workspace-not-snapshotted`,`environment-and-toolchain-not-snapshotted`,...a?[]:[`retained-input-unavailable`,...i.gaps],...o?[]:[`graph-execution-missing`],...a?.definitionSnapshot?[]:[`source-snapshot-missing`],...r.runtime?[]:[`runtime-evidence-missing`],...r.runtime?.trace?.gaps.map(e=>e.reason)??[],...r.runtime?.blobs.filter(e=>!e.found).map(e=>`blob-missing:${e.ref}`)??[]],record:{run:r.id,workflowId:r.workflowId,revUsed:r.revUsed,execution:o??null,trigger:a?.triggerContext??null,retainedInput:{completeness:a?`complete`:i.completeness===`complete`?`invalid`:i.completeness,inputDigest:a?.inputDigest??null,gaps:a?[]:[...i.gaps,`retained-input-unavailable`]},...o?.deploy?.mcpPolicy&&{mcpPolicy:o.deploy?.mcpPolicy},status:r.status,error:r.error,graphResult:r.graphResult??null,runtime:r.runtime?{namespace:r.runtime.namespace??null,journal:r.runtime.journal,blobs:r.runtime.blobs,trace:r.runtime.trace??null}:null}}}if(!P.uuid().safeParse(e).success)throw Error(`Use a retained local UUID or cloud wfrun_ ID`);let n=M(N(),`.tangle`,`runs`,e),r=await zl(e),[i,a,o,s]=await Promise.all([Hl(r),zt(n),Vt(n,{capturedAt:r.startedAt,verdict:null}),Bt(n,{totalChars:48e3})]);return{origin:`local`,sourceDigest:r.sourceDigest,graphDigest:r.graphDigest,params:r.params,trigger:r.trigger??null,mcpPolicy:r.mcpPolicy,taskWorkspace:r.taskWorkspace,source:i,outcome:a?.kind??`interrupted`,gaps:[...r.taskWorkspace?.gaps??[`task-workspace-not-snapshotted`,`environment-and-toolchain-not-snapshotted`],...o.gaps.map(e=>e.code),...s.truncated?[`summary-truncated`]:[]],record:{run:e,sourceDigest:r.sourceDigest,graphDigest:r.graphDigest,params:r.params,trigger:r.trigger??null,...r.mcpPolicy&&{mcpPolicy:r.mcpPolicy},...r.taskWorkspace&&{taskWorkspace:r.taskWorkspace},settled:a??null,rollouts:o.lines,summary:s}}}async function Hu(e,t){let n=be(e),r=t??(await Iu(M(n,`latest.json`))).version;if(!/^[a-f0-9]{64}$/.test(r))throw Error(`Invalid graph dataset version`);let i=await Iu(M(n,`versions`,`${r}.json`)),a=P.array(Fu).parse(i.cases),o=Ru(a,i.manifest);if(o.contentHash!==r||A(o)!==A(i.manifest))throw Error(`Graph dataset manifest changed`);for(let e of a)if(a.some(t=>t.domain===e.domain&&t.unit===e.unit&&t.split!==e.split))throw Error(`An independent unit crosses dataset splits`);return{root:n,version:r,manifest:o,cases:a}}async function Uu(e,t,n){let r=n;if(t.some(e=>e.startsWith(`wfrun_`))){let e=await Q(r);r={...r,baseUrl:e.baseUrl}}let i=be(e);await Ze(i,{recursive:!0,mode:448});let{release:a}=ht({lockPath:`${await I(i)}.lock`});try{let e;try{e=await Hu(i)}catch(e){if(!Lu(e))throw e}let n=new Map((e?.cases??[]).map(e=>[e.id,e]));for(let e of t){r.signal?.throwIfAborted();let t;try{t=await Vu(e,r)}catch(n){r.signal?.throwIfAborted(),t={origin:e.startsWith(`wfrun_`)?new URL(r.baseUrl).origin:`local`,sourceDigest:null,graphDigest:null,params:{},source:null,outcome:`unavailable`,gaps:[`retained-attempt-unavailable`],record:{run:e,error:n.name}}}let a=A({origin:t.origin,run:e}),o=n.get(a);if(o&&[`domain`,`unit`,`split`].some(e=>o[e]!==r[e]))throw Error(`A retained attempt cannot change domain, unit or split; fork the dataset`);let s=await zu(i,{...t.record,source:t.source});n.set(a,Fu.parse({id:a,kind:`retained-graph`,domain:r.domain,unit:r.unit,split:r.split,run:e,origin:t.origin,sourceDigest:t.sourceDigest,graphDigest:t.graphDigest,params:t.params,...t.trigger===void 0?{}:{trigger:t.trigger},...t.mcpPolicy===void 0?{}:{mcpPolicy:t.mcpPolicy},...`taskWorkspace`in t&&t.taskWorkspace?{taskWorkspace:t.taskWorkspace}:{},outcome:t.outcome,gaps:t.gaps,evidence:s,quality:null}))}let a=[...n.values()].sort((e,t)=>e.id.localeCompare(t.id));if(a.some(e=>a.some(t=>e.domain===t.domain&&e.unit===t.unit&&e.split!==t.split)))throw Error(`An independent unit crosses dataset splits`);let o=Ru(a,{name:e?.manifest.name??`graph-runs`,provenance:e?.manifest.provenance??{createdAt:new Date().toISOString(),version:`1`}});await Ze(M(i,`versions`),{recursive:!0});let s=M(i,`versions`,`${o.contentHash}.json`);try{await L(s,JSON.stringify({manifest:o,cases:a}),{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e}let c=M(i,`latest-${E()}.json`);return await L(c,JSON.stringify({version:o.contentHash}),{mode:384,flush:!0}),await tt(c,M(i,`latest.json`)),Hu(i)}finally{await a()}}const Wu=P.number().int().positive().max(2**53-1),Gu=P.strictObject({maxEvaluations:Wu,maxConcurrency:Wu.max(1,`Retained graph campaigns admit one pending graph`).default(1)}),Ku=P.discriminatedUnion(`kind`,[P.strictObject({kind:P.literal(`native`)}),P.strictObject({kind:P.literal(`gepa`),recipe:P.discriminatedUnion(`kind`,[P.strictObject({kind:P.literal(`engine`),run:Gu}),P.strictObject({kind:P.literal(`omni`),explore:P.array(Gu).min(1),continueWith:Gu,maxWorkers:Wu.max(1,`Retained graph campaigns admit one pending graph`).default(1)})]),maxModelRequests:Wu,maxRequestBytes:Wu,maxResponseBytes:Wu,maxCandidateChars:Wu,maxEvidenceChars:Wu,resume:P.enum([`never`,`if-compatible`,`required`]).default(`never`),trustLocalState:P.boolean().default(!1)})]);function qu(e,t,n=`prompt`){if(n!==`prompt`)throw Error(`Graph learning currently materializes only the prompt surface`);let r=Ku.parse(e??{kind:`native`});if(r.kind===`native`)return{kind:`native`,identity:A(r)};if(!t)throw Error(`Official GEPA requires caller-owned subscription execution`);if(r.recipe.kind===`omni`&&r.resume!==`never`)throw Error(`Official Omni does not support resumable state; use resume=never`);if(r.resume!==`never`&&!r.trustLocalState)throw Error(`Resumable GEPA requires explicit trust in local pickle state`);Wu.parse(t.maxOutputTokens),P.number().int().positive().max(2147483647).parse(t.timeoutMs);let i=e=>({engine:`gepa`,...e,engineConfig:{engine:{capture_stdio:!1,max_workers:e.maxConcurrency,parallel:e.maxConcurrency>1,raise_on_exception:!0},reflection:{reflection_minibatch_size:1,skip_perfect_score:!1}}}),a=r.recipe.kind===`engine`?{kind:`engine`,run:i(r.recipe.run)}:{kind:`omni`,explore:r.recipe.explore.map(i),continueWith:i(r.recipe.continueWith),maxWorkers:r.recipe.maxWorkers},o=t.subscriptionOnlyModel,s={maxRequests:r.maxModelRequests,maxRequestBytes:r.maxRequestBytes,maxResponseBytes:r.maxResponseBytes,maxOutputTokensPerRequest:t.maxOutputTokens,requestTimeoutMs:t.timeoutMs,pricing:{inputUsdPerMillion:0,outputUsdPerMillion:0}};return{kind:`official`,identity:A({config:r,model:o.model,callRef:o.callRef,budget:s,objective:t.objective}),method:Ft({objective:t.objective,recipe:a,optimizer:{...o,budget:s,servedModelPolicy:`exact`},runner:t.runner,timeoutMs:t.timeoutMs,maxCandidateChars:r.maxCandidateChars,maxEvidenceChars:r.maxEvidenceChars,resume:r.resume,trustResumeState:r.trustLocalState,describeScenario:t.describeScenario,describeArtifact:t.describeArtifact})}}const Ju=`tangle-native-reflection-json-content-v1`,Yu=`You are a native-agent reflection adapter. The task contains the original ordered role/content messages as JSON. Follow those messages as the reflection request. Return exactly one JSON object {"content":string}; content is the complete text response to that request. Do not add usage, model, or other fields.`;function Xu(e){let{profile:t,budget:n}=structuredClone({profile:e.profile,budget:e.budget});for(let e of Object.values(n))Wu.parse(e);let r=t.model?.default;if(!r||!t.harness)throw Error(`Native reflection requires an exact admitted harness and model profile`);let i=`${Ju}:${A({profile:t,budget:n,reflectionInstruction:Yu,binding:`params.reflection:whole-json-value`})}`;return{model:r,call:async({request:a,callId:o,signal:s})=>{let c=P.strictObject({model:P.literal(r),messages:P.array(P.strictObject({role:P.enum([`system`,`user`,`assistant`]),content:P.union([P.string(),P.array(P.strictObject({type:P.literal(`text`),text:P.string()}))])})).min(1),maxTokens:P.literal(n.maxTokens).optional(),timeoutMs:Wu.max(n.deadlineMs).optional()}).parse(a),l=JSON.stringify({graph:Ju,workspace:`fresh`,params:{reflection:{type:`object`,default:{protocol:Ju,messages:c.messages}}},nodes:[{id:`proposal`,profile:{...t,connections:void 0,mcp:void 0,hooks:void 0,resources:void 0,subagents:void 0,tools:{websearch:!1,webfetch:!1},prompt:{systemPrompt:Yu}}}],entry:[{node:`proposal`,task:"${params.reflection}"}],edges:[],budget:{...n,...c.timeoutMs&&{deadlineMs:c.timeoutMs}},check:{node:`proposal`,pointer:`/content`,exists:!0}}),u=await e.run(l,o,s),d=u.settlement,f=d.spentTotal,p=u.sourceDigest===w(`sha256`).update(l).digest(`hex`)&&d.tree.root===u.runId,m=f.tokensKnown!==!1&&f.tokens.tokensKnown!==!1,h={model:r,inputTokens:f.tokens.input,outputTokens:f.tokens.output,usageUnknown:!p||!m,...!p||f.usdKnown===!1?{costUnknown:!0}:{actualCostUsd:f.usd}},g={kind:Ju,callRef:i,callId:o,runId:u.runId,sourceDigest:u.sourceDigest,graphDigest:u.graphDigest,providerModel:d.providerModel??null};if(!p)return{succeeded:!1,error:`Reflection source or settlement run identity mismatched`,receipt:h,execution:g};if(d.kind!==`winner`||d.providerModel?.status!==`known`||d.providerModel.models.length!==1||d.providerModel.models[0]!==r)return{succeeded:!1,error:`Reflection failed or served model identity is unavailable/mismatched`,receipt:h,execution:g};let _=d.out?.proposal,v=_&&typeof _==`object`&&`json`in _?_.json:_,y=P.strictObject({content:P.string()}).safeParse(v);return y.success?{succeeded:!0,receipt:h,execution:g,response:{content:y.data.content,model:r,servedModel:d.providerModel.models[0],usage:{promptTokens:f.tokens.input,completionTokens:f.tokens.output,totalTokens:f.tokens.input+f.tokens.output,captured:m},costUsd:f.usdKnown===!1?null:f.usd,durationMs:u.durationMs,raw:{runId:u.runId,sourceDigest:u.sourceDigest}}}:{succeeded:!1,error:`Reflection omitted its exact content envelope`,receipt:h,execution:g}},callRef:i}}const Zu=P.number().int().positive(),Qu=P.strictObject({quality:P.number().min(0).max(1),notes:P.string()}),$u=P.strictObject({version:P.literal(1),optimizer:Ku.default({kind:`native`}),domain:P.string().min(1),node:P.string().min(1),objective:P.string().min(1),evaluator:P.strictObject({command:P.string().min(1).refine(ve,`Use an absolute evaluator executable path`),args:P.array(P.string()),files:P.array(P.string().min(1)).min(1),timeoutMs:Zu}),calibration:P.array(P.strictObject({request:P.unknown(),quality:P.union([P.literal(0),P.literal(1)])})).min(2),budget:P.strictObject({maxTokens:Zu,maxIterations:Zu,deadlineMs:Zu,maxExpansions:Zu,proposalTokens:Zu,proposalIterations:Zu,proposalDeadlineMs:Zu}),minimumEffect:P.number().positive().max(1),reps:Zu,operatingConstraints:P.strictObject({maxMeanTokens:Zu,maxMeanDurationMs:Zu,requireKnownOperatingCost:P.boolean().default(!1)})});async function ed(e,t,n,r,i){await i?.();let a=await Ke({command:e.evaluator.command,args:e.evaluator.args,cwd:t,timeoutMs:e.evaluator.timeoutMs,signal:r,ownProcessGroup:!0},void 0,{stdin:`${JSON.stringify(n)}\n`,maxOutputBytes:1024*1024});if(await i?.(),!a.exit.success)throw new Nt(`Independent evaluator failed (exit ${a.exit.code??`unknown`})`);return Qu.parse(JSON.parse(a.stdout??``))}async function td(e,t){let n=await I(e),r=$u.parse(await Au(n)),i=async()=>A({suite:await Au(n),files:await Promise.all([r.evaluator.command,...r.evaluator.files].map(async t=>{let n=await I(be(ge(e),t));return{path:n,digest:$(await F(n))}}))}),a=await i(),o=async()=>{if(await i()!==a)throw Error(`Independent evaluator dependencies changed during use`)};if(!r.calibration.some(e=>e.quality===0)||!r.calibration.some(e=>e.quality===1))throw Error(`Evaluator calibration needs both accepted and rejected examples`);let s=[];for(let e of r.calibration){let i=await ed(r,ge(n),e.request,t,o);if(i.quality!==e.quality)throw Error(`Independent evaluator failed its accepted/rejected calibration; no inference started`);s.push(i)}return{suite:r,cwd:ge(n),identity:a,calibration:s,assertUnchanged:o}}const nd=P.strictObject({evidence:P.string(),sourceDigest:P.string(),scenario:P.string(),unit:P.string(),split:P.enum([`train`,`dev`,`test`]),quality:P.number().min(0).max(1),tokens:P.number().nonnegative().nullable(),durationMs:P.number().nonnegative(),latencyKnown:P.boolean().default(!1),operatingCostUsd:P.null()});async function rd(e,t,n,r,i,a){let o=await F(new URL(a.ledger.uri),`utf8`);if(`sha256:${$(o)}`!==a.ledger.sha256||Buffer.byteLength(o)!==a.ledger.byteLength)throw Error(`Closed search ledger bytes changed`);vt(o,a.runId,a.ledger.uri);let s=new Map;for(let[t,n]of o.trim().split(`
-`).entries()){let{event:r}=_t(n,a.runId,{path:a.ledger.uri,line:t+1});if(r.kind===`cell-settled`)try{let t=await Au(M(e,`attempts`,`${$(r.runId)}.json`));s.set(t.runId,r.wallMs===null||r.queueMs===null?null:r.wallMs+r.queueMs)}catch(e){if(e.code!==`ENOENT`)throw e}}let c=M(e,`judgments`),l=await et(c).catch(e=>{if(e.code!==`ENOENT`)throw e;return[]}),u=await Promise.all(l.filter(e=>e.endsWith(`.json`)).map(async e=>({...nd.parse(await Au(M(c,e))),durationMs:s.get(e.slice(0,-5))??null}))),d=e=>e.reduce((e,t)=>e+t,0)/e.length,f=[...new Set(u.map(e=>e.sourceDigest))].sort().map(e=>{let r=u.filter(t=>t.sourceDigest===e&&t.split===`test`),i=r.length===t.length*n.reps&&t.every(e=>r.filter(t=>t.scenario===e.id).length===n.reps),a=[...new Set(t.map(e=>e.unit))],o=e=>d(a.map(t=>d(r.filter(e=>e.unit===t).map(e))));return{sourceDigest:e,complete:i,observations:r.length,independentUnits:a.length,quality:i?o(e=>e.quality):null,meanTokens:i&&r.every(e=>e.tokens!==null)?o(e=>e.tokens):null,meanDurationMs:i&&r.every(e=>e.durationMs!==null&&e.latencyKnown)?o(e=>e.durationMs):null,operatingCostUsd:null}}),p=Ht(f,[{name:`independent quality`,direction:`maximize`,value:e=>e.quality??NaN},{name:`reported input plus output tokens`,direction:`minimize`,value:e=>e.meanTokens??NaN},{name:`end-to-end graph milliseconds`,direction:`minimize`,value:e=>e.meanDurationMs??NaN}]),m=f.find(e=>e.sourceDigest===r),h=f.find(e=>e.sourceDigest===i),g=[...!h?.complete||h.meanTokens===null||h.meanDurationMs===null?[`baseline operational evidence is incomplete`]:[],...m?.complete?[]:[`candidate final-test cohort is incomplete`],...m?.meanTokens==null?[`candidate token usage is unknown`]:m.meanTokens>n.operatingConstraints.maxMeanTokens?[`candidate exceeds mean token ceiling`]:[],...m?.meanDurationMs==null?[`candidate latency is unknown`]:m.meanDurationMs>n.operatingConstraints.maxMeanDurationMs?[`candidate exceeds mean latency ceiling`]:[],...p.frontier.some(e=>e.sourceDigest===r)?[]:[`candidate is absent from the matched quality/token/latency frontier`],...n.operatingConstraints.requireKnownOperatingCost?[`operating dollar cost is unknown`]:[]];return{admissible:g.length===0,reasons:g,constraints:n.operatingConstraints,reports:f,frontier:p.frontier.map(e=>e.sourceDigest),dollarFrontierEstablished:!1}}async function id(e,t){let n=be(e),{release:r}=ht({lockPath:`${await I(n)}.lock`}),i,a;try{let{record:e}=await Au(M(n,`result.json`)),r=await Bu(n,e);if(r.decision!==`promote`)throw Error(`The independent comparison held this candidate`);let o=await I(t);if(o!==r.sourcePath)throw Error(`Activation target differs from the measured source path`);i=ht({lockPath:`${o}.lock`}).release;let s=await F(r.candidate,`utf8`);if($(s)!==r.candidateDigest)throw Error(`Measured candidate bytes changed`);let c=$(await F(o));if(c!==r.baselineDigest&&c!==r.candidateDigest)throw Error(`Activation baseline changed; evaluate the new baseline`);let l=async()=>{if($(await F(o))!==c)throw Error(`Activation target changed while evidence was checked; the edit was preserved`)},{identity:u,assertUnchanged:d}=await td(r.suite);if(await l(),u!==r.evaluatorIdentity)throw Error(`Independent evaluator changed since measurement`);if(!r.operational.admissible)throw Error(`Measured operational constraints held this candidate`);let f=P.array(P.strictObject({runId:P.uuid(),scenario:P.string(),graphDigest:P.string()})).min(1).parse(r.executionIdentities),p=await Hu(r.dataset.root,r.dataset.version),m=new Set;for(let e of f){let t=p.cases.find(t=>t.id===e.scenario);if(!t||t.trigger===void 0)throw Error(`Measured execution inputs are unavailable`);let n=await zl(e.runId);if(n.sourceDigest!==r.candidateDigest||n.graphDigest!==e.graphDigest||A(Ae.parse(n.mcpPolicy??{}))!==A(Ae.parse(r.mcpPolicy??{})))throw Error(`Measured execution configuration changed`);m.add(await Rl(n));let i=await Ef(o,{param:Wl(t.params),dryRun:!0,mcpPolicy:Ae.parse(r.mcpPolicy??{})},{source:s,...t.trigger&&{trigger:t.trigger}});if(!(`graph`in i)||i.graph.digest!==e.graphDigest)throw Error(`Ordinary execution differs from the measured configuration; express its seat through the maintained graph contract and reevaluate under the intended host policy`)}await d(),await l();let h=await Au(M(n,`activation.json`)).catch(e=>{if(e.code!==`ENOENT`)throw e}),g={record:e,baselineDigest:r.baselineDigest,candidateDigest:r.candidateDigest,executionConfigurations:[...m].sort(),target:o,activatedAt:h?.record===e&&c===r.candidateDigest?h.activatedAt:new Date().toISOString()};return await ju(M(n,`activation.pending.json`),g),c!==r.candidateDigest&&(a=M(ge(o),`.${E()}.graph.yaml`),await L(a,s,{mode:384,flush:!0}),await l(),await tt(a,o),a=void 0,await Du(ge(o))),await ju(M(n,`activation.json`),g),g}finally{a&&await nt(a,{force:!0}),await i?.(),await r()}}async function ad(e,t,n){let r=be(e),{release:i}=ht({lockPath:`${await I(r)}.lock`});try{let e=await Au(M(r,`activation.json`)),i=await Bu(r,e.record),a=await zl(t);if($(await Hl(a))!==i.candidateDigest)throw Error(`Observation did not execute the activated candidate`);if(!P.array(P.string().regex(/^sha256:[a-f0-9]{64}$/)).min(1).parse(e.executionConfigurations).includes(await Rl(a)))throw Error(`Observation execution configuration differs from the activated measurement`);if(!n.trim())throw Error(`Observation needs an independent task unit`);if(Date.parse(a.startedAt)<=Date.parse(P.iso.datetime().parse(e.activatedAt)))throw Error(`Observation must have started after this candidate was activated`);let o=await Hu(i.dataset.root,i.dataset.version),s=A({params:a.params,trigger:a.trigger??null,taskWorkspace:a.taskWorkspace?Ol(a.taskWorkspace):null});if((await Promise.all((await et(M(r,`attempts`))).filter(e=>e.endsWith(`.json`)).map(e=>Au(M(r,`attempts`,e))))).some(e=>e.runId===t)||o.cases.some(e=>e.run===t||e.unit===n||A({params:e.params,trigger:e.trigger??null,taskWorkspace:e.taskWorkspace?Ol(e.taskWorkspace):null})===s))throw Error(`A learning execution or task is not a subsequent independent production observation`);let c=M(r,`observations`);await Ze(c,{recursive:!0,mode:448});for(let i of(await et(c)).filter(e=>e.endsWith(`.json`))){let a=await Au(M(c,i)),o=await Bu(r,a.record);if(o.runId===t){if(o.unit!==n||o.taskDigest!==s||o.activation.record!==e.record)throw Error(`The retained observation identity changed`);return{record:a.record,runId:t,verdict:o.verdict}}if(o.unit===n||o.taskDigest===s)throw Error(`An independent observation unit or task cannot be counted twice`)}let{suite:l,cwd:u,identity:d,assertUnchanged:f}=await td(i.suite);if(d!==i.evaluatorIdentity)throw Error(`Observation evaluator changed`);let p=await zt(M(N(),`.tangle`,`runs`,t));if(!p)throw Error(`Observation has not settled`);if(p.tree.root!==t)throw Error(`Observation settlement names another native run`);let m={...vl(p),runId:t,sourceDigest:a.sourceDigest,graphDigest:a.graphDigest},h=await ed(l,u,{scenario:{params:a.params,trigger:a.trigger??null,unit:n,taskDigest:s},artifact:m},void 0,f),g=await zu(r,{activation:e,runId:t,unit:n,taskDigest:s,activatedAt:e.activatedAt,artifact:m,verdict:h});return await ju(M(r,`observations`,`${t}.json`),{record:g}),{record:g,runId:t,verdict:h}}finally{i()}}async function od(e,t,n,r,i,a={}){let o=i===void 0?Ar().seat??null:null,s=be(r);await Ze(s,{recursive:!0,mode:448});let{release:c}=ht({lockPath:`${await I(s)}.lock`});try{let r=await pd(e,t,n,s,i,o,a),{suite:c,dataset:l,profile:u,sourceForProfile:d,assertUnchanged:f,baselineDigest:p,optimizedCoordinate:m,evaluatorIdentity:h,calibration:g,hostBindings:_}=r,v=Xu({profile:u,budget:{maxTokens:c.budget.proposalTokens,maxIterations:c.budget.proposalIterations,deadlineMs:c.budget.proposalDeadlineMs},run:async(e,t,n)=>{let r=await C(e,t,{},n),i=await zt(M(N(),`.tangle`,`runs`,r.runId));if(!i)throw Error(`Reflection has no retained settlement`);return{...r,settlement:i}}}),y=await sd(r,v);try{let e=await Au(M(s,`result.json`)),t=await Bu(s,e.record);if(t.identity!==y)throw Error(`Completed campaign configuration changed; use a new directory`);if($(await F(t.candidate))!==t.candidateDigest)throw Error(`Measured candidate bytes changed`);return{...t,record:e.record}}catch(e){if(e.code!==`ENOENT`)throw e}let b=await cd(r,y),x=new Map;for(let e of l.cases)x.set(e.id,await Bu(l.root,e.evidence));let S=E(),C=ld(r,b,S),w=ud(r,x,S),T=await fd(r,v,y,{...b,run:C,judge:w});if(!T.searchHistory?.complete)throw await T.dispose(),new Nt(`Optimizer did not retain complete verified search history`);let D=d(T.candidate.profile),O=$(D);await f();let k=await rd(s,l.cases.filter(e=>e.split===`test`),c,O,p,T.searchHistory),ee=M(s,`${O}.graph.yaml`);await L(ee,D,{mode:384,flush:!0});let te=await Promise.all((await et(M(s,`judgments`)).catch(e=>{if(e.code!==`ENOENT`)throw e;return[]})).filter(e=>e.endsWith(`.json`)).map(async e=>{let t=nd.parse(await Au(M(s,`judgments`,e)));if(t.sourceDigest!==O)return null;let n=await Bu(s,t.evidence);if(n.artifact.sourceDigest!==O||typeof n.artifact.graphDigest!=`string`)throw Error(`Candidate judgment has no exact measured execution identity`);return{runId:n.artifact.runId,scenario:t.scenario,graphDigest:n.artifact.graphDigest}})),{dispose:ne,...re}=T,A={version:1,identity:y,optimizedCoordinate:m,baselineDigest:p,candidateDigest:O,candidate:ee,sourcePath:await I(e),dataset:{root:l.root,version:l.version},workspaceGaps:[...new Set(l.cases.flatMap(e=>e.taskWorkspace?.gaps??[`task-workspace-not-snapshotted`,`environment-and-toolchain-not-snapshotted`]))],suite:await I(n),evaluatorIdentity:h,calibration:g,executionIdentities:te.filter(e=>e!==null),mcpPolicy:_.mcpPolicy,decision:T.decision===`ship`&&k.admissible?`promote`:`hold`,operational:k,measurement:re,operatingCost:{known:!1,reason:`subscription and environment allocation are not metered as incremental provider charges`},campaignBudget:{limits:c.budget,readout:b.pool.readout()}};await f();let ie=await zu(s,A);return await ju(M(s,`result.json`),{record:ie}),await T.dispose(),{...A,record:ie}}finally{await c()}}async function sd(e,n){let{seat:r,defaultSeat:i,optimizedCoordinate:a,suite:o,baselineDigest:s,dataset:c,evaluatorIdentity:l,hostBindings:u,loaded:d}=e,f=t(import.meta.url);if(!f)throw Error(`Cannot identify the CLI dependency manifest`);return A({consumer:`graph-learning-v1`,optimizedCoordinate:a,optimizer:Ku.parse(o.optimizer),reflection:n.callRef,consumerBytes:$(await F(new URL(import.meta.url))),consumerManifest:$(await F(f)),environment:{node:process.version,platform:process.platform,architecture:process.arch,packages:await Promise.all([`@tangle-network/agent-runtime`,`@tangle-network/agent-eval`,`cli-bridge`].map(async e=>{let n=t(e,import.meta.url);if(!n)throw Error(`Cannot identify ${e} for reproducible learning`);return{name:e,version:(await Au(n)).version,entryDigest:$(await F(new URL(import.meta.resolve(e))))}}))},baselineDigest:s,dataset:c.version,evaluatorIdentity:l,seat:r??null,defaultSeat:i,mcpPolicy:u.mcpPolicy,graph:d.graph,budget:o.budget,reps:o.reps})}async function cd(e,t){let{root:n,suite:r,defaultSeat:i,bindings:a}=e,o=new AbortController,{pool:s,checkpoint:c,startedAt:l,pendingAttempt:u}=await Pu(n,r.budget,t,(e,t)=>{if(t.usd-(t.usdEstimated??0)>0){let t=new Nt(`Native subscription run ${e} reported positive provider billing; no further campaign work is admitted`);throw o.abort(t),t}}),d=AbortSignal.any([AbortSignal.timeout(Math.max(1,l+r.budget.deadlineMs-Date.now())),o.signal]);d.throwIfAborted();let f=u();if(f){let e=await zl(f.runId);if(e.sourceDigest!==f.sourceDigest||e.graphDigest!==f.graphDigest)throw Error(`Pending native input changed its admitted execution identity`);try{await Ef(e.file,{param:[],resume:e.runId,json:!0,mcpPolicy:e.mcpPolicy,mcpSecret:a.mcpSecret},{defaultSeat:i,cwd:e.cwd,source:await Hl(e),runId:e.runId,graphDigest:e.graphDigest,signal:d,...e.trigger&&{trigger:e.trigger}})}catch(e){if(e.code!==`GRAPH_RUN_FAILED`)throw e}finally{await c()}}return{pool:s,checkpoint:c,startedAt:l,signal:d}}function ld(e,t,n){let{root:r,hostBindings:i,seat:a,defaultSeat:o}=e,{signal:s,checkpoint:c}=t;return async(e,t,l,u,d=null,f)=>{await Ze(M(r,`attempts`),{recursive:!0,mode:448});let p=M(r,`attempts`,`${$(t)}.json`),m=!1;try{await L(p,JSON.stringify({runId:E(),startedAt:Date.now()}),{flag:`wx`,mode:384,flush:!0}),m=!0}catch(e){if(e.code!==`EEXIST`)throw e}let{runId:h,startedAt:g}=P.strictObject({runId:P.uuid(),startedAt:P.number().int().nonnegative()}).parse(await Au(p)),_=M(r,`executions`,h);await Ze(_,{recursive:!0,mode:448});let v=M(_,`graph.yaml`);try{await L(v,e,{flag:`wx`,mode:384,flush:!0})}catch(t){if(t.code!==`EEXIST`)throw t;if($(await F(v))!==$(e))throw Error(`Attempt source identity changed`)}let y;try{await F(M(N(),`.tangle`,`runs`,h,`input.json`)),y=await zl(h)}catch(e){if(e.code!==`ENOENT`)throw e}if(y&&$(await Hl(y))!==$(e))throw Error(`Attempt snapshot changed`);if(y&&(f?Ol(f):null)!==(y.taskWorkspace?Ol(y.taskWorkspace):null))throw Error(`Attempt task workspace identity changed`);let b=f?await Pl(f,{runId:h,resumeCwd:y?.cwd,signal:AbortSignal.any([s,u])}):void 0;try{let t=await Ef(v,{...i,param:Wl(l),dryRun:!0,...y&&{resume:h},...a&&{seat:a}},{defaultSeat:o,cwd:b?.cwd??_,signal:s,...d&&{trigger:d},...f&&{taskWorkspace:f}});if(!(`graph`in t))throw Error(`Attempt did not load locally`);if(!t.graph.budget?.maxTokens||!t.graph.budget.maxIterations||!t.graph.budget.deadlineMs)throw Error(`Every materialized case needs finite token, iteration and deadline budgets`);await c({runId:h,budget:t.graph.budget,sourceDigest:$(e),graphDigest:t.graph.digest});let r;try{await Ef(v,{...i,param:Wl(l),json:!0,...a&&{seat:a},...y&&{resume:h}},{defaultSeat:o,runId:h,cwd:b?.cwd??_,...f&&{taskWorkspace:f},graphDigest:t.graph.digest,signal:AbortSignal.any([s,u]),...d&&{trigger:d}})}catch(e){r=e}finally{await c()}let p=await zt(M(N(),`.tangle`,`runs`,h));if(!p)throw new Nt(`Native graph attempt has no retained settlement`,{cause:r});return{...vl(p),runId:h,sourceDigest:$(e),graphDigest:t.graph.digest,durationMs:Math.max(Date.now()-g,p.spentTotal.ms),latencyKnown:m,invocation:n,taskWorkspaceDigest:f?Ol(f):null}}finally{b?.release()}}}function ud(e,t,n){let{root:r,suite:i,evaluatorCwd:a,evaluatorIdentity:o,assertUnchanged:s}=e;return{name:`independent-domain-evaluator`,judgeVersion:o,dimensions:[{key:`quality`,description:i.objective}],score:async({artifact:e,scenario:c,signal:l})=>{let u=await ed(i,a,{scenario:c,evidence:t.get(c.id),artifact:e},l,s),d=await zu(r,{evaluatorIdentity:o,scenario:c.id,artifact:e,verdict:u});return await Ze(M(r,`judgments`),{recursive:!0,mode:448}),await ju(M(r,`judgments`,`${e.runId}.json`),{evidence:d,sourceDigest:e.sourceDigest,scenario:c.id,unit:c.unit,split:c.split,quality:u.quality,tokens:e.tokenUsage.input===null||e.tokenUsage.output===null?null:e.tokenUsage.input+e.tokenUsage.output,durationMs:e.durationMs,latencyKnown:e.latencyKnown&&e.invocation===n,operatingCostUsd:null}),{dimensions:{quality:u.quality},composite:u.quality,notes:u.notes}}}}function dd(e,t){let{root:n,profile:r,suite:i,dataset:a}=e;return It({model:r.model?.default??`subscription-native`,pricing:{inputUsdPerMillion:0,outputUsdPerMillion:0},maxOutputTokens:i.budget.proposalTokens,frame:`Improve only the ${i.node} node's inline prompt. Domain: ${i.domain}. Objective: ${i.objective}. Preserve independent checks.`,evidence:async({trainCells:e})=>Promise.all(e.map(async e=>{let t=await Au(M(n,`attempts`,`${$(`${e.cellId}:${e.attempt}`)}.json`)),r=await Bt(M(N(),`.tangle`,`runs`,t.runId),{totalChars:48e3});return JSON.stringify({cell:e,tasks:a.cases.filter(t=>t.split===`train`&&t.unit===e.unitId).map(e=>({id:e.id,params:e.params,trigger:e.trigger,taskWorkspace:e.taskWorkspace?Ol(e.taskWorkspace):null})),records:r})})),chat:async({messages:e,callId:n,signal:r})=>{let a=await t.call({callId:n,signal:r,request:{model:t.model,messages:e,maxTokens:i.budget.proposalTokens}});if(!a.succeeded)throw Error(a.error);return{content:a.response.content,usage:a.response.usage.captured===!1?null:{inputTokens:a.response.usage.promptTokens,outputTokens:a.response.usage.completionTokens}}}})}async function fd(e,t,n,r){let{root:i,suite:a,dataset:o,profile:s,profileComponents:c,sourceForProfile:l}=e,{signal:u,startedAt:d,run:f,judge:p}=r,m=dd(e,t),h=qu(a.optimizer,{subscriptionOnlyModel:t,runner:{},maxOutputTokens:a.budget.proposalTokens,timeoutMs:a.budget.proposalDeadlineMs,objective:a.objective,describeScenario:e=>({id:e.id,params:e.params,trigger:e.trigger}),describeArtifact:e=>({text:e.text,status:e.status})}),g={surface:`agent-profile`,profileComponents:c,executionRef:n,trainScenarios:o.cases.filter(e=>e.split===`train`),selectionScenarios:o.cases.filter(e=>e.split===`dev`),testScenarios:o.cases.filter(e=>e.split===`test`),judges:[p],costCeiling:0,runDir:M(i,`search`),signal:u,agent:async(e,t,n)=>{let r=l(e),i=await n.cost.runPaidCall({actor:`native-graph`,model:s.model?.default??`subscription-native`,maximumCharge:{externallyEnforcedMaximumUsd:0},signal:n.signal,execute:()=>f(r,`search`in n?n.search.runId:`${n.cellId}:${n.runAttemptId}`,t.params,n.signal,t.trigger??null,t.taskWorkspace),receipt:e=>({model:s.model?.default??`subscription-native`,...e.costUsd===null?{costUnknown:!0}:{actualCostUsd:e.costUsd},inputTokens:e.tokenUsage.input??0,outputTokens:e.tokenUsage.output??0,usageUnknown:e.tokenUsage.input===null||e.tokenUsage.output===null})});if(!i.succeeded)throw i.error;return i.value}};return h.kind===`official`?await Pt(s,{...g,method:h.method,minimumLift:a.minimumEffect,reps:a.reps,maxConcurrency:1,optimizationRunOptions:{reps:a.reps,maxConcurrency:1}}):await Pt(s,{...g,method:Lt({proposer:m,maxExpansions:a.budget.maxExpansions,policy:gt(),allocation:yt({reps:a.reps}),lanes:[Rt({seats:1,cellUsd:0})],deadline:new Date(d+a.budget.deadlineMs).toISOString(),maxAttempts:1}),claim:{use:`comparison`,population:{id:a.domain,description:a.objective},samplingFrame:`retained graph dataset ${o.version}`,independentUnit:`unit`,generalization:`new-units`,minimumEffect:a.minimumEffect},executionRunId:e=>e.runId})}async function pd(e,t,n,r,i,a,o){let{suite:s,cwd:c,identity:l,calibration:u,assertUnchanged:d}=await td(n),f=await F(e,`utf8`),p=wt(f)[s.node];if(typeof p!=`string`)throw Error(`The selected node needs an unshared inline prompt`);let m=await Hu(t);if(m.cases.some(e=>e.domain!==s.domain))throw Error(`Dataset contains a different domain`);if(m.cases.some(e=>e.outcome===`unavailable`||!e.sourceDigest))throw Error(`Dataset retains unavailable attempts; reconcile them before freezing a learning cohort`);for(let e of[`train`,`dev`,`test`])if(!m.cases.some(t=>t.split===e))throw Error(`Dataset needs an independent ${e} partition`);if(m.cases.some(e=>e.trigger===void 0))throw Error(`Dataset lacks retained trigger context; reingest legacy runs before replay`);let h=[...new Set(m.cases.map(e=>JSON.stringify(Ae.parse(e.mcpPolicy??{}))))];if(!o.mcpPolicy&&h.length!==1)throw Error(`Retained MCP host policies differ; select an explicit --mcp-policy`);let g={...o,mcpPolicy:o.mcpPolicy??Ae.parse(JSON.parse(h[0]??`{}`))},_=m.cases.find(e=>e.split===`train`);if(!_)throw Error(`Dataset needs a train case`);let v=M(r,`baseline.graph.yaml`),y=$(f);try{await L(v,f,{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e;if($(await F(v))!==y)throw Error(`Frozen baseline changed`)}let b;if(_.taskWorkspace){let e=M(r,`task-workspace-admission.json`);try{await L(e,JSON.stringify({runId:E()}),{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e}let t=P.strictObject({runId:P.uuid()}).parse(await Au(e));b=await Pl(_.taskWorkspace,{...t,validationOnly:!0})}let x;try{x=await Ef(v,{...g,param:Wl(_.params),dryRun:!0,...i&&{seat:i}},{defaultSeat:a,..._.trigger&&{trigger:_.trigger},...b&&{cwd:b.cwd,taskWorkspace:_.taskWorkspace}})}finally{await b?.release()}if(!(`graph`in x))throw Error(`Baseline did not load locally`);if(!x.graph.budget?.maxTokens||!x.graph.budget.maxIterations||!x.graph.budget.deadlineMs)throw Error(`Graph needs finite token, iteration and deadline budgets for bounded improvement`);let S=x.graph.nodes.find(e=>e.id===s.node)?.profile;if(!S)throw Error(`Selected node was not materialized`);let C=typeof S.prompt?.systemPrompt==`string`?`systemPrompt`:`appendSystemPrompt`;if(typeof S.prompt?.[C]!=`string`)throw Error(`The selected source coordinate was not materialized`);let w=`prompt.${C}`,T={...S,prompt:{...S.prompt,[C]:p}},D=e=>{let t=e.prompt?.[C];if(typeof t!=`string`)throw Error(`Candidate lost its selected prompt coordinate`);return t},O={read:e=>({[w]:D(e)}),apply(e,t){if(Object.keys(t).length!==1||Object.keys(t)[0]!==w||typeof t[w]!=`string`)throw Error(`Candidate changed the selected prompt coordinate`);return{...e,prompt:{...e.prompt,[C]:t[w]}}}},k=e=>{let t=D(e);return t===p?f:Tt(f,{[s.node]:t})},ee={node:s.node,profileField:w,binding:`authored-source-compiled-per-case`};return{root:r,seat:i,defaultSeat:a,bindings:o,suite:s,evaluatorCwd:c,evaluatorIdentity:l,calibration:u,assertUnchanged:d,baselineDigest:y,dataset:m,hostBindings:g,loaded:x,profile:T,profileComponents:O,sourceForProfile:k,optimizedCoordinate:ee}}async function md(e,t,n,r){let i={mcpPolicy:n.mcpPolicy?await dl(n.mcpPolicy):void 0,mcpSecret:n.mcpSecret},a=[e,...n.arm],o=n.split===`test`;if(o?a.length!==2||!n.unseal:n.split!==`train`)throw Error(`--split is train, or test with one --arm and --unseal`);let s=o?`holdout`:`search`,c=await F(M(t,`cases.jsonl.gz`)),l=Ut(c).toString().trim().split(`
-`).map(e=>JSON.parse(e)),u=new Map(l.map(e=>[e.id,e])),d=e=>u.get(e.split(`:`).pop()??e),f=e=>`graph-improve-js::${d(e).upstream}`,p=e=>r.deterministicSplit(f(e),`agent-eval-v1`,[.32,.38]),m=(e,t)=>[`issue=https://github.com/${e.upstream}/issues/${e.issue}`,`repo=${e.upstream}`,...[`deliver=branch`,`base=main`,`test=${e.test}`],`verify_image=${t}`,`agent_tools={"websearch":false,"webfetch":false}`],h=m(l[0],`none`),g=[];for(let e of a){let t=await F(e,`utf8`),n=await Ef(e,{...i,param:h,dryRun:!0},{source:t});if(!(`graph`in n))throw Error(`${e} did not load locally`);let r=n.graph.nodes.filter(({check:e,profile:{tools:t}})=>!e&&(t?.websearch!==!1||t?.webfetch!==!1));if(r.length)throw Error(`${r.map(e=>e.id)} can use web tools; refusing`);let a=n.graph.budget?.maxTokens;if(!a)throw Error(`${e} sets no budget.maxTokens to book at`);let{maxIterations:o,deadlineMs:s}=n.graph.budget??{};if(!o||!s)throw Error(`${e} needs finite iteration and deadline budgets`);g.push({file:e,source:t,sourceDigest:$(t),digest:n.graph.digest,cap:a,iterations:o,deadline:s})}return{bindings:i,files:a,sealed:s,manifest:c,cases:u,at:d,split:p,params:m,arms:g}}const hd=Ot(we),gd=async(e,...t)=>(await hd(`bash`,[`-ec`,e,`gi`,...t],{maxBuffer:3e8})).stdout,_d=M(N(),`.tangle`,`graph-improve`,`v5`),vd=M(N(),`.tangle`,`runs`),yd=e=>({inputTokens:0,outputTokens:e,usageUnknown:!0}),bd=e=>!!e&&e.owner!==`work`&&e.code!==`budget-exhausted`;async function xd(e){let[t,n]=[M(e,`bin`),M(e,`remotes`)];for(let e of[t,n])await Ze(e,{recursive:!0});let r=`#!/bin/sh
+`).requiredOption(`--profile <name|path>`,`Use a canonical analysis AgentProfile, distinct from the Tangle account profile`).option(`--dry-run`,`Inspect Braid's selected analysis configuration without dispatch`).option(`--timeout <ms>`,`Bound the analysis process in milliseconds`,Number,3e5).action(async(e,t)=>{let n=await su(e,t);z(n),`status`in n&&n.status!==`completed`&&(process.exitCode=1)})}async function lu(e,t){let n=[],r=[],i=(e,t)=>{if(!t||typeof t!=`object`)return;let i=P.object({status:P.string(),files:P.array(P.object({path:P.string(),artifact:k})),missing:P.unknown()}).parse(t);r.push({node:e,status:i.status,missing:i.missing}),n.push(...i.files.map(t=>({node:e,...t})))},a;if(e.startsWith(`wfrun_`)){let n=await Q(t),r=await n.workflows.getRun(e);for(let e of r.runtime?.checks??[])i(e.nodeId,e.outputs);a=async({artifact:t})=>{let i=(await n.workflows.listArtifacts(r.workflowId,e)).artifacts.find(e=>e.name===`runtime/${t.sha256}`&&e.byteSize===t.byteLength);if(!i)throw Error(`The workflow owner has no retained bytes for this artifact`);return(await n.workflows.downloadArtifact(r.workflowId,e,i.id)).bytes}}else{if(!P.uuid().safeParse(e).success)throw Error(`Use a recorded graph run ID`);let t=M(await I(M(N(),`.tangle`,`runs`)),e);if(await I(t)!==t)throw Error(`The graph run directory redirects elsewhere`);let{FileSpawnJournal:n,FileResultBlobStore:r,loadSpawnForest:o,createPrivateCasArtifactPort:s}=await import(`@tangle-network/agent-runtime/kernel`),c=new r(M(t,`blobs`)),l=await o(new n(M(t,`spawn-journal.jsonl`)),e);for(let e of l.nodes){if(e.runtime!==`graph-check`||!e.outRef)continue;let t=await c.get(e.outRef);i(e.id,t?.outputs)}let u=s(M(t,`artifacts`),e);a=e=>u.read(e.artifact)}if(!t.artifact)return z({runId:e,capture:r,files:n});if(!t.out)throw new W(`USAGE_INVALID`,`Select an output file`,`Artifact downloads require --out`,`tangle graph inspect ${e} --artifact <node/path> --out <file>`);let o=n.filter(e=>`${e.node}/${e.path}`===t.artifact||e.artifact.sha256===t.artifact);if(o.length!==1)throw Error(`Select one exact node/path from graph inspect --artifacts`);let s=o[0],c=await a(s);if(c.byteLength!==s.artifact.byteLength||`sha256:${$(Buffer.from(c))}`!==s.artifact.sha256)throw Error(`Retained artifact bytes do not match their recorded identity`);let l=be(t.out);await Ze(ge(l),{recursive:!0}),await L(l,c,{mode:384,flag:`wx`});let u={runId:e,node:s.node,path:s.path,artifact:s.artifact,destination:l};t.json?z(u):V(`Saved ${s.path} to ${l}`)}const uu=1e3;function du(e,t){return[...t,e]}function fu(e,t=`input`,n){if(n===void 0&&!e?.length)return;let r={};if(n!==void 0)try{if(r=JSON.parse(fe(n,`utf8`)),!r||typeof r!=`object`||Array.isArray(r)||Object.entries(r).some(([e,t])=>!e.length||typeof t!=`string`))throw Error(`Invalid input map`)}catch{throw new W(`WORKFLOW_INPUT_FILE_INVALID`,`Could not load --input-file '${n}'`,`Expected a readable JSON object with nonempty keys and string values`,`tangle workflows run --help`)}let i=Object.entries(r);for(let n of e??[]){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${n}": expected key=value (e.g. pull_request.number=123)`);i.push([n.slice(0,e),n.slice(e+1)])}return Object.fromEntries(i)}function pu(e){R(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function mu(e){if(U({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){V(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);R(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(V(`Graph`),U({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),R(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(V(`Edge verdicts`),R(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function hu(e){if(e.status===`cancelled`){V(`Cancelled run ${e.runId}.`);return}if(e.signalled){V(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}V(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function gu(e){switch(e.type){case`snapshot`:V(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function _u(e){e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input-file <file>`,`Trigger inputs from a flat JSON string map; --input overrides its keys`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,du,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t)=>{let n=fu(t.input,`input`,t.inputFile),r=t.timeout===void 0?void 0:Go(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:Go(t.pollInterval,`--poll-interval`),a=await Q(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return z({runId:o});V(`Started run ${o} for workflow ${e}.`),V(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:H(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return z(c);mu(c)}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).action(async(e,t)=>{let n=await Q(t),r=t.limit===void 0?void 0:Go(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=uu){s=c.nextCursor,t.json||V(`Stopped after ${uu} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return z({runs:i,nextCursor:s});pu(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return z(i);pu(i.runs),i.nextCursor&&V(`More runs available — next page: --cursor ${i.nextCursor}`)}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.getRun(e,t);if(n.json)return z(r);mu(r)}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.cancel(e,t);if(n.json)return z(r);hu(r)}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t,n)=>{let r=n.timeout===void 0?void 0:Go(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:Go(n.pollInterval,`--poll-interval`),a=await Q(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return z(o);V(`Started run ${o.runId} (retry of ${t}).`),V(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:H(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return z(c);mu(c)}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await Q(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):gu(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)})}async function vu(e,t){let n;try{if(n=t.deploy?jt(await F(t.deploy,`utf8`)):{name:he(e).replace(/(\.graph)?\.(yaml|yml|json)$/i,``)},!n||typeof n!=`object`||Array.isArray(n)||typeof n.name!=`string`||!n.name.trim())throw Error(`Invalid deployment`)}catch{throw new W(`GRAPH_DEPLOY_INVALID`,`Cannot read graph deployment settings`,`Use a YAML or JSON object containing name and the platform's graph deployment fields`,`tangle graph apply --help`)}let r=fu(t.param,`param`),i=t.mcpPolicy??n.mcpPolicy;return{...n,...r?{params:{...n.params,...r}}:{},...t.seat?{seat:t.seat}:{},...i===void 0?{}:{mcpPolicy:ke.parse(i)}}}function yu(e){if(e.execution?.kind!==`graph`||!e.headRev)throw new W(`GRAPH_DEPLOY_CONFLICT`,`The deployment is not a versioned native graph`,`Choose a graph workflow or a new deployment name`,`tangle workflows list`)}async function bu(e,t){let n=await e.workflows.list({name:t});if(n.length>1)throw new W(`GRAPH_DEPLOY_CONFLICT`,`More than one workflow has this name`,`Select the intended deployment with --workflow <id>`,`tangle workflows list`);return n[0]?e.workflows.get(n[0].id):void 0}async function xu(e,t,n,r){let i={on:[],...n,...n.mcpPolicy===void 0?{}:{mcpPolicy:ke.parse(n.mcpPolicy)}},a;a=r?await e.workflows.get(r):await bu(e,n.name);let o=await e.workflows.validate(t,{format:`graph`,deploy:i});if(!o.valid)throw new W(`GRAPH_DEPLOY_INVALID`,`Graph deployment validation failed`,o.errors.map(e=>`${e.path}: ${e.message}`).join(`
+`),`tangle graph apply --help`);a||=await e.workflows.create(t,{format:`graph`,deploy:{...i,on:[],enabled:!1},dedupeKey:`graph-cli:${n.name}`}),yu(a);let s=e=>!e.triggers?.some(e=>e.kind===`provider_event`)&&e.enabled===(i.enabled??!0)&&e.execution.sourceSha===$(t)&&o.graphDigest!==void 0&&e.execution.graphDigest===o.graphDigest&&A(e.execution.deploy)===A(i);if(s(a))return{action:`unchanged`,workflow:a};try{return{action:`applied`,workflow:await e.workflows.update(a.id,t,{format:`graph`,deploy:i,expectedRev:a.headRev})}}catch(t){if(!(t&&typeof t==`object`&&`status`in t&&t.status===409))throw t;let n=await e.workflows.get(a.id);if(yu(n),!s(n))throw t;return{action:`unchanged`,workflow:n}}}function Su(e,t){e.command(`webhook <workflow>`).description(`Reveal a new webhook bearer for a deployed graph; retire its previous bearer`).requiredOption(`--rotate`,`Explicitly authorize minting and revealing a new webhook token`).action(async(e,t)=>{let n=await Q(t);yu(await n.workflows.get(e)),z(await n.workflows.rotateHookToken(e))}),e.command(`apply <name-or-file>`).description(`Publish a native graph without running it; update its stable cloud deployment`).option(`--deploy <file>`,`YAML/JSON deployment settings: name, on, params, seat, enabled and maxRunCostUsd`).option(`--workflow <id>`,`Update this workflow instead of matching its name`).option(`--seat <seat>`,`Override the deployment's harness/model@effort`).option(`--param <key=value>`,`Override a deployment parameter; repeatable`,(e,t)=>[...t,e],[]).option(`--dry-run`,`Validate graph and bindings without publishing`).action(async(e,n)=>qc(void 0,async r=>{let i=t(e,process.cwd()),a=await F(i,`utf8`),o=await vu(i,n),s=await Q({...n,signal:r}),c=n.dryRun?await s.workflows.validate(a,{format:`graph`,deploy:o}):await xu(s,a,o,n.workflow);`valid`in c&&!c.valid&&(process.exitCode=1),n.json||`valid`in c?z(c):V(`${c.action} · ${c.workflow.id} · revision ${c.workflow.headRev}`)},`tangle graph apply --help`))}async function Cu(e,t,n,r){if(n.mcpSecret?.length)throw new W(`GRAPH_CLOUD_SECRET_BINDING`,`Local MCP credentials cannot be uploaded`,`Cloud secret references must bind through the cloud owner's credential environment`,`tangle graph run --help`);let i=await Q({...n,signal:r}),a=$(t),o=fu(n.param,`param`),s=await vu(e,n),c,l;if(n.resume){let e=await i.workflows.getRun(n.resume,{signal:r});e.id!==n.resume&&Z(`The cloud owner returned another run identity`),n.workflow&&e.workflowId!==n.workflow&&Z(`The recorded cloud deployment changed`);let t=e.execution;if((t?.kind!==`graph`||t.sourceSha!==a)&&Z(`The authored cloud graph source changed`),n.deploy&&A(t.deploy)!==A({on:[],...s})&&Z(`The recorded cloud deployment settings changed`),Object.entries(o??{}).some(([e,n])=>!Object.hasOwn(t.params,e)||A(t.params[e])!==A(n))&&Z(`A recorded cloud graph parameter changed`),n.seat!==void 0&&n.seat!==t.deploy.seat&&Z(`The recorded cloud seat override changed`),n.mcpPolicy!==void 0&&A(n.mcpPolicy)!==A(t.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]})&&Z(`The recorded cloud MCP policy changed`),n.dryRun)return{run:e};if((e.status===`cancelled`||e.status===`failed`)&&Z(`The cloud run is terminal: ${e.status}`),e.status===`succeeded`)return e.graphResult||Z(`The settled cloud run has no retained Runtime result`),{workflowId:e.workflowId,runId:e.id,sourceDigest:a,result:e.graphResult,replayed:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};if(e.recovery?.state===`running`)return{workflowId:e.workflowId,runId:e.id,sourceDigest:a,run:e,attached:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};e.recovery?.state!==`queued`&&e.recovery?.state!==`recoverable`&&Z(`The owner has not confirmed recovery eligibility`),c=e.workflowId,l=e.revUsed??Z(`The captured cloud revision is unavailable`)}else{let e=n.workflow?await i.workflows.get(n.workflow):!n.deploy&&!n.dryRun?await bu(i,s.name):void 0;if(e){if((e.execution?.kind!==`graph`||e.execution.sourceSha!==a)&&Z(`The selected deployment does not contain this graph source; use graph apply first`),(n.deploy&&A(e.execution.deploy)!==A({on:[],...s})||Object.entries(o??{}).some(([t,n])=>!Object.hasOwn(e.execution?.kind===`graph`?e.execution.params:{},t)||A(e.execution?.kind===`graph`?e.execution.params[t]:null)!==A(n))||n.seat!==void 0&&n.seat!==e.execution.deploy.seat||n.mcpPolicy!==void 0&&A(n.mcpPolicy)!==A(e.execution.deploy.mcpPolicy??{allowLocalMcp:!1,allowedMcpHosts:[]}))&&Z(`The selected deployment bindings changed; use graph apply first`),n.dryRun)return{workflow:e};c=e.id,l=e.headRev??Z(`The selected deployment has no retained revision`)}else{if(n.dryRun)return i.workflows.validate(t,{format:`graph`,deploy:s});let{workflow:e}=await xu(i,t,s);c=e.id,l=e.headRev??Z(`The cloud workflow has no retained revision`)}}r.throwIfAborted();let u=await i.workflows.run(c,void 0,{signal:r,sourceSha:a,expectedRev:l,...n.resume?{resumeRunId:n.resume}:{}});return n.resume&&u.runId!==n.resume&&Z(`The cloud owner recovered another run identity`),{...u,workflowId:c,sourceDigest:a,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(c)}/runs/${encodeURIComponent(u.runId)}`}}const wu=P.strictObject({runId:P.uuid(),identity:P.string(),request:P.string()});function Tu(e,t){e.command(`dispatch <name-or-file>`).description(`Admit a local scheduler/webhook delivery once, retaining its event and run for retries`).requiredOption(`--event <file>`,`JSON object supplied as trigger data`).requiredOption(`--delivery <id>`,`Stable provider delivery id or nominal cron occurrence, reused on retries`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ll()).option(`--mcp-policy <file>`,`Use the same explicit local MCP policy as graph run`).option(`--param <key=value>`,`Graph parameter; repeatable`,(e,t)=>[...t,e],[]).action(async(e,n)=>{let r={...n,mcpPolicy:n.mcpPolicy===void 0?void 0:await dl(n.mcpPolicy)},i=e=>{throw new W(`GRAPH_DELIVERY_REFUSED`,`Local graph delivery was not admitted`,e,`tangle graph dispatch --help`)};r.delivery.trim()||i(`A stable nonempty delivery id is required`);let a;try{a=P.record(P.string(),P.unknown()).parse(JSON.parse(await F(r.event,`utf8`)))}catch{return i(`The event file must contain a JSON object`)}let o=await I(t(e,process.cwd())),s=await I(process.cwd()),c=await F(o,`utf8`),l=A({file:o,cwd:s,delivery:r.delivery}),u=A({source:$(c),trigger:a,mcpPolicy:Ae.parse(r.mcpPolicy??{}),params:fu(r.param,`param`)??{},...r.seat===void 0?{}:{seat:r.seat}}),d=M(N(),`.tangle`,`deliveries`,$(l));await Ze(d,{recursive:!0,mode:448}),await I(d)!==d&&i(`The delivery store redirects elsewhere`);let f=M(d,`delivery.json`),p;try{let e=await $e(f,le.O_WRONLY|le.O_CREAT|le.O_EXCL|le.O_NOFOLLOW,384);try{p={runId:E(),identity:l,request:u},await e.writeFile(JSON.stringify(p)),await e.sync()}finally{await e.close()}}catch(e){if(e.code!==`EEXIST`)throw e;let t=await $e(f,le.O_RDONLY|le.O_NOFOLLOW);try{p=wu.parse(JSON.parse(await t.readFile(`utf8`)))}catch{return i(`The durable delivery record is incomplete; inspect it before retrying`)}finally{await t.close()}}(p.identity!==l||p.request!==u)&&i(`This delivery id already belongs to different graph bytes, event data or parameters`);let m;try{m=ht({lockPath:`${f}.lock`}).release}catch(e){return i(`Delivery ${r.delivery} cannot acquire its owner lock; inspect run ${p.runId}: ${e instanceof Error?e.message:`lock unavailable`}`)}try{let e=M(N(),`.tangle`,`runs`,p.runId,`input.json`),t=!1;try{await F(e),t=!0}catch(e){if(e.code!==`ENOENT`)throw e}let n=await Ef(o,{...r,...t?{resume:p.runId}:{}},{cwd:s,source:c,trigger:a,runId:p.runId});r.json?z({delivery:r.delivery,...n}):V(`Delivery ${r.delivery} · run ${p.runId}`)}finally{await m()}})}const Eu=e=>`${e}.tmp-${T(6).toString(`hex`)}`,Du=new Map;function Ou(e){let t=be(e),n=Du.get(t)??{};if(Du.set(t,n),n.queued)return n.queued;let r=(n.running??Promise.resolve()).catch(()=>void 0).then(async()=>{n.running=r,n.queued=void 0;try{let e=await Ye.open(t,`r`);await e.sync().finally(()=>e.close())}finally{n.queued||Du.delete(t)}});return n.queued=r,r}async function ku(e,t,{mode:n=384,owner:r,directory:i}={}){if(i&&!/^(?!\.\.?$)[^/]+$/.test(e))throw Error(`Not an entry name in the open directory: ${e}`);let a=i?`/proc/self/fd/${i.fd}/${e}`:e,o=Eu(a);try{let e=await Ye.open(o,`wx`,n);try{r&&await e.chown(r.uid,r.gid),await e.chmod(n),await e.writeFile(t,`utf-8`),await e.sync()}finally{await e.close()}await Ye.rename(o,a)}catch(e){throw await Ye.rm(o,{force:!0}).catch(()=>void 0),e}await(i?i.sync():Ou(ge(a)))}const Au=P.number().int().positive(),ju=async e=>JSON.parse(await F(e,`utf8`)),Mu=(e,t)=>ku(e,JSON.stringify(t));function Nu(e,t){let n=e.readout(),r=n.tokensKnown?n.deadlineMs>0&&Date.now()>=n.deadlineMs?`Campaign deadline exhausted`:t.maxTokens!==void 0&&n.tokensCapped&&t.maxTokens>n.tokensLeft?`Campaign token ceiling cannot fund the next graph`:t.maxIterations!==void 0&&n.iterationsCapped&&t.maxIterations>n.iterationsLeft?`Campaign iteration ceiling cannot fund the next graph`:void 0:`Campaign token accounting is incomplete`;if(r)throw Object.assign(new Nt(r),{code:`GRAPH_CAMPAIGN_BUDGET_EXHAUSTED`})}const Pu=P.strictObject({runId:P.uuid(),budget:P.object({maxTokens:Au,maxIterations:Au,deadlineMs:Au}).passthrough(),sourceDigest:P.string(),graphDigest:P.string()});async function Fu(e,t,n,r){let i=M(e,`budget.json`),a;try{a=await ju(i)}catch(e){if(e.code!==`ENOENT`)throw e;a={identity:n,startedAt:Date.now()}}if(a.identity!==n)throw Error(`Campaign configuration changed; use a new campaign directory`);let o=a.readout;if(o?.reservedTokens)throw Error(`Campaign backing has unresolved historical reservations`);let s=async e=>{let t=await zt(M(N(),`.tangle`,`runs`,e.runId));if(!t)return;let n=await Bl(e.runId);if(t.tree.root!==e.runId||e.sourceDigest!==void 0&&n.sourceDigest!==e.sourceDigest||e.graphDigest!==void 0&&n.graphDigest!==e.graphDigest)throw Error(`Campaign settlement does not match its exact admitted graph`);return{settled:t,digest:A({runId:e.runId,sourceDigest:n.sourceDigest,graphDigest:n.graphDigest,spend:t.spentTotal})}},c=St(t,a.startedAt),l=P.record(P.uuid(),P.string()).parse(a.settlements??{});for(let[e,t]of Object.entries(l)){let n=await s({runId:e});if(!n||n.digest!==t)throw Error(`Historical campaign settlement is missing or changed; accounting cannot resume`);c.observe(n.settled.spentTotal,{alreadySpent:!0}),r?.(e,n.settled.spentTotal)}if(o&&A(o)!==A(JSON.parse(JSON.stringify(c.readout()))))throw Error(`Historical campaign backing cannot be reconstructed from its retained settlements`);let u=a.pending===void 0?void 0:Pu.parse(a.pending),d=o??c.readout(),f,p=()=>Mu(i,{identity:n,startedAt:a.startedAt,readout:u?d:c.readout(),settlements:l,...u?{pending:u}:{}}),m=(e,t=!1)=>{t||Nu(c,e.budget),d=c.readout();let n=c.reserve(e.budget,{assignment:e.runId,stage:`executing`});if(!n.ok)throw new Nt(`Campaign cannot reserve the next graph's complete ceiling`);f=n.ticket,u=e},h=async()=>{if(!u||!f)return;let e=await s(u);if(!e)return;let t=f,n;try{c.reconcile(t,e.settled.spentTotal)}catch(e){if(c.openReservations().some(({ticketId:e})=>e===t.id))throw await p(),e;n=e}let i=u.runId;if(l[i]=e.digest,u=void 0,f=void 0,await p(),r?.(i,e.settled.spentTotal),n)throw n};if(u){let e=u;u=void 0,m(e,!0),await h()}return await p(),{pool:c,checkpoint:async e=>{if(e){if(l[e.runId]){let t=await s(e);if(!t||t.digest!==l[e.runId])throw Error(`An accounted campaign settlement changed`);r?.(e.runId,t.settled.spentTotal);return}if(u&&A(u)!==A(e))throw new Nt(`Campaign must reconcile its exact pending run ${u.runId} before admitting another graph`);u||m(e)}else{if(await h(),u)throw new Nt(`Campaign run ${u.runId} has no retained settlement; its reservation remains pending`);c.assertNoOpenTickets()}await p()},startedAt:a.startedAt,pendingAttempt:()=>u&&structuredClone(u)}}const Iu=P.strictObject({id:P.string(),kind:P.literal(`retained-graph`),domain:P.string().min(1),unit:P.string().min(1),split:P.enum([`train`,`dev`,`test`]),run:P.string().min(1),origin:P.string(),sourceDigest:P.string().nullable(),graphDigest:P.string().nullable(),params:P.record(P.string(),P.unknown()),trigger:P.record(P.string(),P.unknown()).nullable().optional(),mcpPolicy:Ae.optional(),taskWorkspace:Ol.optional(),outcome:P.string(),gaps:P.array(P.string()),evidence:P.string(),quality:P.null()}),Lu=async e=>JSON.parse(await F(e,`utf8`)),Ru=e=>e.code===`ENOENT`;function zu(e,{name:t,provenance:n}){let r={train:0,dev:0,test:0,holdout:0};for(let t of e)r[t.split]++;return{name:t,provenance:n,contentHash:A(e.map(e=>({id:e.id,split:e.split,payload:e})).sort((e,t)=>e.id<t.id?-1:+(e.id>t.id))).slice(7),scenarioCount:e.length,splitCounts:r}}async function Bu(e,t){let n=A(t),r=M(e,`objects`,`${n.slice(7)}.json`);await Ze(M(e,`objects`),{recursive:!0,mode:448});let i=JSON.stringify(t);try{await L(r,i,{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e;if(A(await Lu(r))!==n)throw Error(`Dataset evidence object changed`)}return n}async function Vu(e,t){if(!/^sha256:[a-f0-9]{64}$/.test(t))throw Error(`Invalid dataset object digest`);let n=await Lu(M(e,`objects`,`${t.slice(7)}.json`));if(A(n)!==t)throw Error(`Dataset evidence object changed`);return n}async function Hu(e,t){if(e.startsWith(`wfrun_`)){let n=await Q(t),[r,i]=await Promise.all([n.workflows.getRun(e,{signal:t.signal}),n.workflows.getRunInput(e,{signal:t.signal})]),a=i.completeness===`complete`&&i.id===r.id&&i.workflowId===r.workflowId&&i.revUsed===r.revUsed&&A({definitionSnapshot:i.definitionSnapshot,execution:i.execution,triggerContext:i.triggerContext,revUsed:i.revUsed})===i.inputDigest?i:void 0,o=a?.execution,s=a?.triggerContext;return{origin:new URL(n.baseUrl).origin,sourceDigest:i.sourceSha,graphDigest:i.graphDigest,params:o?.params??{},...a?{trigger:s}:{},mcpPolicy:o?.deploy?.mcpPolicy,outcome:r.status,source:a?.definitionSnapshot??null,gaps:[`task-workspace-not-snapshotted`,`environment-and-toolchain-not-snapshotted`,...a?[]:[`retained-input-unavailable`,...i.gaps],...o?[]:[`graph-execution-missing`],...a?.definitionSnapshot?[]:[`source-snapshot-missing`],...r.runtime?[]:[`runtime-evidence-missing`],...r.runtime?.trace?.gaps.map(e=>e.reason)??[],...r.runtime?.blobs.filter(e=>!e.found).map(e=>`blob-missing:${e.ref}`)??[]],record:{run:r.id,workflowId:r.workflowId,revUsed:r.revUsed,execution:o??null,trigger:a?.triggerContext??null,retainedInput:{completeness:a?`complete`:i.completeness===`complete`?`invalid`:i.completeness,inputDigest:a?.inputDigest??null,gaps:a?[]:[...i.gaps,`retained-input-unavailable`]},...o?.deploy?.mcpPolicy&&{mcpPolicy:o.deploy?.mcpPolicy},status:r.status,error:r.error,graphResult:r.graphResult??null,runtime:r.runtime?{namespace:r.runtime.namespace??null,journal:r.runtime.journal,blobs:r.runtime.blobs,trace:r.runtime.trace??null}:null}}}if(!P.uuid().safeParse(e).success)throw Error(`Use a retained local UUID or cloud wfrun_ ID`);let n=M(N(),`.tangle`,`runs`,e),r=await Bl(e),[i,a,o,s]=await Promise.all([Ul(r),zt(n),Vt(n,{capturedAt:r.startedAt,verdict:null}),Bt(n,{totalChars:48e3})]);return{origin:`local`,sourceDigest:r.sourceDigest,graphDigest:r.graphDigest,params:r.params,trigger:r.trigger??null,mcpPolicy:r.mcpPolicy,taskWorkspace:r.taskWorkspace,source:i,outcome:a?.kind??`interrupted`,gaps:[...r.taskWorkspace?.gaps??[`task-workspace-not-snapshotted`,`environment-and-toolchain-not-snapshotted`],...o.gaps.map(e=>e.code),...s.truncated?[`summary-truncated`]:[]],record:{run:e,sourceDigest:r.sourceDigest,graphDigest:r.graphDigest,params:r.params,trigger:r.trigger??null,...r.mcpPolicy&&{mcpPolicy:r.mcpPolicy},...r.taskWorkspace&&{taskWorkspace:r.taskWorkspace},settled:a??null,rollouts:o.lines,summary:s}}}async function Uu(e,t){let n=be(e),r=t??(await Lu(M(n,`latest.json`))).version;if(!/^[a-f0-9]{64}$/.test(r))throw Error(`Invalid graph dataset version`);let i=await Lu(M(n,`versions`,`${r}.json`)),a=P.array(Iu).parse(i.cases),o=zu(a,i.manifest);if(o.contentHash!==r||A(o)!==A(i.manifest))throw Error(`Graph dataset manifest changed`);for(let e of a)if(a.some(t=>t.domain===e.domain&&t.unit===e.unit&&t.split!==e.split))throw Error(`An independent unit crosses dataset splits`);return{root:n,version:r,manifest:o,cases:a}}async function Wu(e,t,n){let r=n;if(t.some(e=>e.startsWith(`wfrun_`))){let e=await Q(r);r={...r,baseUrl:e.baseUrl}}let i=be(e);await Ze(i,{recursive:!0,mode:448});let{release:a}=ht({lockPath:`${await I(i)}.lock`});try{let e;try{e=await Uu(i)}catch(e){if(!Ru(e))throw e}let n=new Map((e?.cases??[]).map(e=>[e.id,e]));for(let e of t){r.signal?.throwIfAborted();let t;try{t=await Hu(e,r)}catch(n){r.signal?.throwIfAborted(),t={origin:e.startsWith(`wfrun_`)?new URL(r.baseUrl).origin:`local`,sourceDigest:null,graphDigest:null,params:{},source:null,outcome:`unavailable`,gaps:[`retained-attempt-unavailable`],record:{run:e,error:n.name}}}let a=A({origin:t.origin,run:e}),o=n.get(a);if(o&&[`domain`,`unit`,`split`].some(e=>o[e]!==r[e]))throw Error(`A retained attempt cannot change domain, unit or split; fork the dataset`);let s=await Bu(i,{...t.record,source:t.source});n.set(a,Iu.parse({id:a,kind:`retained-graph`,domain:r.domain,unit:r.unit,split:r.split,run:e,origin:t.origin,sourceDigest:t.sourceDigest,graphDigest:t.graphDigest,params:t.params,...t.trigger===void 0?{}:{trigger:t.trigger},...t.mcpPolicy===void 0?{}:{mcpPolicy:t.mcpPolicy},...`taskWorkspace`in t&&t.taskWorkspace?{taskWorkspace:t.taskWorkspace}:{},outcome:t.outcome,gaps:t.gaps,evidence:s,quality:null}))}let a=[...n.values()].sort((e,t)=>e.id.localeCompare(t.id));if(a.some(e=>a.some(t=>e.domain===t.domain&&e.unit===t.unit&&e.split!==t.split)))throw Error(`An independent unit crosses dataset splits`);let o=zu(a,{name:e?.manifest.name??`graph-runs`,provenance:e?.manifest.provenance??{createdAt:new Date().toISOString(),version:`1`}});await Ze(M(i,`versions`),{recursive:!0});let s=M(i,`versions`,`${o.contentHash}.json`);try{await L(s,JSON.stringify({manifest:o,cases:a}),{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e}let c=M(i,`latest-${E()}.json`);return await L(c,JSON.stringify({version:o.contentHash}),{mode:384,flush:!0}),await tt(c,M(i,`latest.json`)),Uu(i)}finally{await a()}}const Gu=P.number().int().positive().max(2**53-1),Ku=P.strictObject({maxEvaluations:Gu,maxConcurrency:Gu.max(1,`Retained graph campaigns admit one pending graph`).default(1)}),qu=P.discriminatedUnion(`kind`,[P.strictObject({kind:P.literal(`native`)}),P.strictObject({kind:P.literal(`gepa`),recipe:P.discriminatedUnion(`kind`,[P.strictObject({kind:P.literal(`engine`),run:Ku}),P.strictObject({kind:P.literal(`omni`),explore:P.array(Ku).min(1),continueWith:Ku,maxWorkers:Gu.max(1,`Retained graph campaigns admit one pending graph`).default(1)})]),maxModelRequests:Gu,maxRequestBytes:Gu,maxResponseBytes:Gu,maxCandidateChars:Gu,maxEvidenceChars:Gu,resume:P.enum([`never`,`if-compatible`,`required`]).default(`never`),trustLocalState:P.boolean().default(!1)})]);function Ju(e,t,n=`prompt`){if(n!==`prompt`)throw Error(`Graph learning currently materializes only the prompt surface`);let r=qu.parse(e??{kind:`native`});if(r.kind===`native`)return{kind:`native`,identity:A(r)};if(!t)throw Error(`Official GEPA requires caller-owned subscription execution`);if(r.recipe.kind===`omni`&&r.resume!==`never`)throw Error(`Official Omni does not support resumable state; use resume=never`);if(r.resume!==`never`&&!r.trustLocalState)throw Error(`Resumable GEPA requires explicit trust in local pickle state`);Gu.parse(t.maxOutputTokens),P.number().int().positive().max(2147483647).parse(t.timeoutMs);let i=e=>({engine:`gepa`,...e,engineConfig:{engine:{capture_stdio:!1,max_workers:e.maxConcurrency,parallel:e.maxConcurrency>1,raise_on_exception:!0},reflection:{reflection_minibatch_size:1,skip_perfect_score:!1}}}),a=r.recipe.kind===`engine`?{kind:`engine`,run:i(r.recipe.run)}:{kind:`omni`,explore:r.recipe.explore.map(i),continueWith:i(r.recipe.continueWith),maxWorkers:r.recipe.maxWorkers},o=t.subscriptionOnlyModel,s={maxRequests:r.maxModelRequests,maxRequestBytes:r.maxRequestBytes,maxResponseBytes:r.maxResponseBytes,maxOutputTokensPerRequest:t.maxOutputTokens,requestTimeoutMs:t.timeoutMs,pricing:{inputUsdPerMillion:0,outputUsdPerMillion:0}};return{kind:`official`,identity:A({config:r,model:o.model,callRef:o.callRef,budget:s,objective:t.objective}),method:Ft({objective:t.objective,recipe:a,optimizer:{...o,budget:s,servedModelPolicy:`exact`},runner:t.runner,timeoutMs:t.timeoutMs,maxCandidateChars:r.maxCandidateChars,maxEvidenceChars:r.maxEvidenceChars,resume:r.resume,trustResumeState:r.trustLocalState,describeScenario:t.describeScenario,describeArtifact:t.describeArtifact})}}const Yu=`tangle-native-reflection-json-content-v1`,Xu=`You are a native-agent reflection adapter. The task contains the original ordered role/content messages as JSON. Follow those messages as the reflection request. Return exactly one JSON object {"content":string}; content is the complete text response to that request. Do not add usage, model, or other fields.`;function Zu(e){let{profile:t,budget:n}=structuredClone({profile:e.profile,budget:e.budget});for(let e of Object.values(n))Gu.parse(e);let r=t.model?.default;if(!r||!t.harness)throw Error(`Native reflection requires an exact admitted harness and model profile`);let i=`${Yu}:${A({profile:t,budget:n,reflectionInstruction:Xu,binding:`params.reflection:whole-json-value`})}`;return{model:r,call:async({request:a,callId:o,signal:s})=>{let c=P.strictObject({model:P.literal(r),messages:P.array(P.strictObject({role:P.enum([`system`,`user`,`assistant`]),content:P.union([P.string(),P.array(P.strictObject({type:P.literal(`text`),text:P.string()}))])})).min(1),maxTokens:P.literal(n.maxTokens).optional(),timeoutMs:Gu.max(n.deadlineMs).optional()}).parse(a),l=JSON.stringify({graph:Yu,workspace:`fresh`,params:{reflection:{type:`object`,default:{protocol:Yu,messages:c.messages}}},nodes:[{id:`proposal`,profile:{...t,connections:void 0,mcp:void 0,hooks:void 0,resources:void 0,subagents:void 0,tools:{websearch:!1,webfetch:!1},prompt:{systemPrompt:Xu}}}],entry:[{node:`proposal`,task:"${params.reflection}"}],edges:[],budget:{...n,...c.timeoutMs&&{deadlineMs:c.timeoutMs}},check:{node:`proposal`,pointer:`/content`,exists:!0}}),u=await e.run(l,o,s),d=u.settlement,f=d.spentTotal,p=u.sourceDigest===w(`sha256`).update(l).digest(`hex`)&&d.tree.root===u.runId,m=f.tokensKnown!==!1&&f.tokens.tokensKnown!==!1,h={model:r,inputTokens:f.tokens.input,outputTokens:f.tokens.output,usageUnknown:!p||!m,...!p||f.usdKnown===!1?{costUnknown:!0}:{actualCostUsd:f.usd}},g={kind:Yu,callRef:i,callId:o,runId:u.runId,sourceDigest:u.sourceDigest,graphDigest:u.graphDigest,providerModel:d.providerModel??null};if(!p)return{succeeded:!1,error:`Reflection source or settlement run identity mismatched`,receipt:h,execution:g};if(d.kind!==`winner`||d.providerModel?.status!==`known`||d.providerModel.models.length!==1||d.providerModel.models[0]!==r)return{succeeded:!1,error:`Reflection failed or served model identity is unavailable/mismatched`,receipt:h,execution:g};let _=d.out?.proposal,v=_&&typeof _==`object`&&`json`in _?_.json:_,y=P.strictObject({content:P.string()}).safeParse(v);return y.success?{succeeded:!0,receipt:h,execution:g,response:{content:y.data.content,model:r,servedModel:d.providerModel.models[0],usage:{promptTokens:f.tokens.input,completionTokens:f.tokens.output,totalTokens:f.tokens.input+f.tokens.output,captured:m},costUsd:f.usdKnown===!1?null:f.usd,durationMs:u.durationMs,raw:{runId:u.runId,sourceDigest:u.sourceDigest}}}:{succeeded:!1,error:`Reflection omitted its exact content envelope`,receipt:h,execution:g}},callRef:i}}const Qu=P.number().int().positive(),$u=P.strictObject({quality:P.number().min(0).max(1),notes:P.string()}),ed=P.strictObject({version:P.literal(1),optimizer:qu.default({kind:`native`}),domain:P.string().min(1),node:P.string().min(1),objective:P.string().min(1),evaluator:P.strictObject({command:P.string().min(1).refine(ve,`Use an absolute evaluator executable path`),args:P.array(P.string()),files:P.array(P.string().min(1)).min(1),timeoutMs:Qu}),calibration:P.array(P.strictObject({request:P.unknown(),quality:P.union([P.literal(0),P.literal(1)])})).min(2),budget:P.strictObject({maxTokens:Qu,maxIterations:Qu,deadlineMs:Qu,maxExpansions:Qu,proposalTokens:Qu,proposalIterations:Qu,proposalDeadlineMs:Qu}),minimumEffect:P.number().positive().max(1),reps:Qu,operatingConstraints:P.strictObject({maxMeanTokens:Qu,maxMeanDurationMs:Qu,requireKnownOperatingCost:P.boolean().default(!1)})});async function td(e,t,n,r,i){await i?.();let a=await Ke({command:e.evaluator.command,args:e.evaluator.args,cwd:t,timeoutMs:e.evaluator.timeoutMs,signal:r,ownProcessGroup:!0},void 0,{stdin:`${JSON.stringify(n)}\n`,maxOutputBytes:1024*1024});if(await i?.(),!a.exit.success)throw new Nt(`Independent evaluator failed (exit ${a.exit.code??`unknown`})`);return $u.parse(JSON.parse(a.stdout??``))}async function nd(e,t){let n=await I(e),r=ed.parse(await ju(n)),i=async()=>A({suite:await ju(n),files:await Promise.all([r.evaluator.command,...r.evaluator.files].map(async t=>{let n=await I(be(ge(e),t));return{path:n,digest:$(await F(n))}}))}),a=await i(),o=async()=>{if(await i()!==a)throw Error(`Independent evaluator dependencies changed during use`)};if(!r.calibration.some(e=>e.quality===0)||!r.calibration.some(e=>e.quality===1))throw Error(`Evaluator calibration needs both accepted and rejected examples`);let s=[];for(let e of r.calibration){let i=await td(r,ge(n),e.request,t,o);if(i.quality!==e.quality)throw Error(`Independent evaluator failed its accepted/rejected calibration; no inference started`);s.push(i)}return{suite:r,cwd:ge(n),identity:a,calibration:s,assertUnchanged:o}}const rd=P.strictObject({evidence:P.string(),sourceDigest:P.string(),scenario:P.string(),unit:P.string(),split:P.enum([`train`,`dev`,`test`]),quality:P.number().min(0).max(1),tokens:P.number().nonnegative().nullable(),durationMs:P.number().nonnegative(),latencyKnown:P.boolean().default(!1),operatingCostUsd:P.null()});async function id(e,t,n,r,i,a){let o=await F(new URL(a.ledger.uri),`utf8`);if(`sha256:${$(o)}`!==a.ledger.sha256||Buffer.byteLength(o)!==a.ledger.byteLength)throw Error(`Closed search ledger bytes changed`);vt(o,a.runId,a.ledger.uri);let s=new Map;for(let[t,n]of o.trim().split(`
+`).entries()){let{event:r}=_t(n,a.runId,{path:a.ledger.uri,line:t+1});if(r.kind===`cell-settled`)try{let t=await ju(M(e,`attempts`,`${$(r.runId)}.json`));s.set(t.runId,r.wallMs===null||r.queueMs===null?null:r.wallMs+r.queueMs)}catch(e){if(e.code!==`ENOENT`)throw e}}let c=M(e,`judgments`),l=await et(c).catch(e=>{if(e.code!==`ENOENT`)throw e;return[]}),u=await Promise.all(l.filter(e=>e.endsWith(`.json`)).map(async e=>({...rd.parse(await ju(M(c,e))),durationMs:s.get(e.slice(0,-5))??null}))),d=e=>e.reduce((e,t)=>e+t,0)/e.length,f=[...new Set(u.map(e=>e.sourceDigest))].sort().map(e=>{let r=u.filter(t=>t.sourceDigest===e&&t.split===`test`),i=r.length===t.length*n.reps&&t.every(e=>r.filter(t=>t.scenario===e.id).length===n.reps),a=[...new Set(t.map(e=>e.unit))],o=e=>d(a.map(t=>d(r.filter(e=>e.unit===t).map(e))));return{sourceDigest:e,complete:i,observations:r.length,independentUnits:a.length,quality:i?o(e=>e.quality):null,meanTokens:i&&r.every(e=>e.tokens!==null)?o(e=>e.tokens):null,meanDurationMs:i&&r.every(e=>e.durationMs!==null&&e.latencyKnown)?o(e=>e.durationMs):null,operatingCostUsd:null}}),p=Ht(f,[{name:`independent quality`,direction:`maximize`,value:e=>e.quality??NaN},{name:`reported input plus output tokens`,direction:`minimize`,value:e=>e.meanTokens??NaN},{name:`end-to-end graph milliseconds`,direction:`minimize`,value:e=>e.meanDurationMs??NaN}]),m=f.find(e=>e.sourceDigest===r),h=f.find(e=>e.sourceDigest===i),g=[...!h?.complete||h.meanTokens===null||h.meanDurationMs===null?[`baseline operational evidence is incomplete`]:[],...m?.complete?[]:[`candidate final-test cohort is incomplete`],...m?.meanTokens==null?[`candidate token usage is unknown`]:m.meanTokens>n.operatingConstraints.maxMeanTokens?[`candidate exceeds mean token ceiling`]:[],...m?.meanDurationMs==null?[`candidate latency is unknown`]:m.meanDurationMs>n.operatingConstraints.maxMeanDurationMs?[`candidate exceeds mean latency ceiling`]:[],...p.frontier.some(e=>e.sourceDigest===r)?[]:[`candidate is absent from the matched quality/token/latency frontier`],...n.operatingConstraints.requireKnownOperatingCost?[`operating dollar cost is unknown`]:[]];return{admissible:g.length===0,reasons:g,constraints:n.operatingConstraints,reports:f,frontier:p.frontier.map(e=>e.sourceDigest),dollarFrontierEstablished:!1}}async function ad(e,t){let n=be(e),{release:r}=ht({lockPath:`${await I(n)}.lock`}),i,a;try{let{record:e}=await ju(M(n,`result.json`)),r=await Vu(n,e);if(r.decision!==`promote`)throw Error(`The independent comparison held this candidate`);let o=await I(t);if(o!==r.sourcePath)throw Error(`Activation target differs from the measured source path`);i=ht({lockPath:`${o}.lock`}).release;let s=await F(r.candidate,`utf8`);if($(s)!==r.candidateDigest)throw Error(`Measured candidate bytes changed`);let c=$(await F(o));if(c!==r.baselineDigest&&c!==r.candidateDigest)throw Error(`Activation baseline changed; evaluate the new baseline`);let l=async()=>{if($(await F(o))!==c)throw Error(`Activation target changed while evidence was checked; the edit was preserved`)},{identity:u,assertUnchanged:d}=await nd(r.suite);if(await l(),u!==r.evaluatorIdentity)throw Error(`Independent evaluator changed since measurement`);if(!r.operational.admissible)throw Error(`Measured operational constraints held this candidate`);let f=P.array(P.strictObject({runId:P.uuid(),scenario:P.string(),graphDigest:P.string()})).min(1).parse(r.executionIdentities),p=await Uu(r.dataset.root,r.dataset.version),m=new Set;for(let e of f){let t=p.cases.find(t=>t.id===e.scenario);if(!t||t.trigger===void 0)throw Error(`Measured execution inputs are unavailable`);let n=await Bl(e.runId);if(n.sourceDigest!==r.candidateDigest||n.graphDigest!==e.graphDigest||A(Ae.parse(n.mcpPolicy??{}))!==A(Ae.parse(r.mcpPolicy??{})))throw Error(`Measured execution configuration changed`);m.add(await zl(n));let i=await Ef(o,{param:Gl(t.params),dryRun:!0,mcpPolicy:Ae.parse(r.mcpPolicy??{})},{source:s,...t.trigger&&{trigger:t.trigger}});if(!(`graph`in i)||i.graph.digest!==e.graphDigest)throw Error(`Ordinary execution differs from the measured configuration; express its seat through the maintained graph contract and reevaluate under the intended host policy`)}await d(),await l();let h=await ju(M(n,`activation.json`)).catch(e=>{if(e.code!==`ENOENT`)throw e}),g={record:e,baselineDigest:r.baselineDigest,candidateDigest:r.candidateDigest,executionConfigurations:[...m].sort(),target:o,activatedAt:h?.record===e&&c===r.candidateDigest?h.activatedAt:new Date().toISOString()};return await Mu(M(n,`activation.pending.json`),g),c!==r.candidateDigest&&(a=M(ge(o),`.${E()}.graph.yaml`),await L(a,s,{mode:384,flush:!0}),await l(),await tt(a,o),a=void 0,await Ou(ge(o))),await Mu(M(n,`activation.json`),g),g}finally{a&&await nt(a,{force:!0}),await i?.(),await r()}}async function od(e,t,n){let r=be(e),{release:i}=ht({lockPath:`${await I(r)}.lock`});try{let e=await ju(M(r,`activation.json`)),i=await Vu(r,e.record),a=await Bl(t);if($(await Ul(a))!==i.candidateDigest)throw Error(`Observation did not execute the activated candidate`);if(!P.array(P.string().regex(/^sha256:[a-f0-9]{64}$/)).min(1).parse(e.executionConfigurations).includes(await zl(a)))throw Error(`Observation execution configuration differs from the activated measurement`);if(!n.trim())throw Error(`Observation needs an independent task unit`);if(Date.parse(a.startedAt)<=Date.parse(P.iso.datetime().parse(e.activatedAt)))throw Error(`Observation must have started after this candidate was activated`);let o=await Uu(i.dataset.root,i.dataset.version),s=A({params:a.params,trigger:a.trigger??null,taskWorkspace:a.taskWorkspace?kl(a.taskWorkspace):null});if((await Promise.all((await et(M(r,`attempts`))).filter(e=>e.endsWith(`.json`)).map(e=>ju(M(r,`attempts`,e))))).some(e=>e.runId===t)||o.cases.some(e=>e.run===t||e.unit===n||A({params:e.params,trigger:e.trigger??null,taskWorkspace:e.taskWorkspace?kl(e.taskWorkspace):null})===s))throw Error(`A learning execution or task is not a subsequent independent production observation`);let c=M(r,`observations`);await Ze(c,{recursive:!0,mode:448});for(let i of(await et(c)).filter(e=>e.endsWith(`.json`))){let a=await ju(M(c,i)),o=await Vu(r,a.record);if(o.runId===t){if(o.unit!==n||o.taskDigest!==s||o.activation.record!==e.record)throw Error(`The retained observation identity changed`);return{record:a.record,runId:t,verdict:o.verdict}}if(o.unit===n||o.taskDigest===s)throw Error(`An independent observation unit or task cannot be counted twice`)}let{suite:l,cwd:u,identity:d,assertUnchanged:f}=await nd(i.suite);if(d!==i.evaluatorIdentity)throw Error(`Observation evaluator changed`);let p=await zt(M(N(),`.tangle`,`runs`,t));if(!p)throw Error(`Observation has not settled`);if(p.tree.root!==t)throw Error(`Observation settlement names another native run`);let m={...vl(p),runId:t,sourceDigest:a.sourceDigest,graphDigest:a.graphDigest},h=await td(l,u,{scenario:{params:a.params,trigger:a.trigger??null,unit:n,taskDigest:s},artifact:m},void 0,f),g=await Bu(r,{activation:e,runId:t,unit:n,taskDigest:s,activatedAt:e.activatedAt,artifact:m,verdict:h});return await Mu(M(r,`observations`,`${t}.json`),{record:g}),{record:g,runId:t,verdict:h}}finally{i()}}async function sd(e,t,n,r,i,a={}){let o=i===void 0?Ar().seat??null:null,s=be(r);await Ze(s,{recursive:!0,mode:448});let{release:c}=ht({lockPath:`${await I(s)}.lock`});try{let r=await md(e,t,n,s,i,o,a),{suite:c,dataset:l,profile:u,sourceForProfile:d,assertUnchanged:f,baselineDigest:p,optimizedCoordinate:m,evaluatorIdentity:h,calibration:g,hostBindings:_}=r,v=Zu({profile:u,budget:{maxTokens:c.budget.proposalTokens,maxIterations:c.budget.proposalIterations,deadlineMs:c.budget.proposalDeadlineMs},run:async(e,t,n)=>{let r=await C(e,t,{},n),i=await zt(M(N(),`.tangle`,`runs`,r.runId));if(!i)throw Error(`Reflection has no retained settlement`);return{...r,settlement:i}}}),y=await cd(r,v);try{let e=await ju(M(s,`result.json`)),t=await Vu(s,e.record);if(t.identity!==y)throw Error(`Completed campaign configuration changed; use a new directory`);if($(await F(t.candidate))!==t.candidateDigest)throw Error(`Measured candidate bytes changed`);return{...t,record:e.record}}catch(e){if(e.code!==`ENOENT`)throw e}let b=await ld(r,y),x=new Map;for(let e of l.cases)x.set(e.id,await Vu(l.root,e.evidence));let S=E(),C=ud(r,b,S),w=dd(r,x,S),T=await pd(r,v,y,{...b,run:C,judge:w});if(!T.searchHistory?.complete)throw await T.dispose(),new Nt(`Optimizer did not retain complete verified search history`);let D=d(T.candidate.profile),O=$(D);await f();let k=await id(s,l.cases.filter(e=>e.split===`test`),c,O,p,T.searchHistory),ee=M(s,`${O}.graph.yaml`);await L(ee,D,{mode:384,flush:!0});let te=await Promise.all((await et(M(s,`judgments`)).catch(e=>{if(e.code!==`ENOENT`)throw e;return[]})).filter(e=>e.endsWith(`.json`)).map(async e=>{let t=rd.parse(await ju(M(s,`judgments`,e)));if(t.sourceDigest!==O)return null;let n=await Vu(s,t.evidence);if(n.artifact.sourceDigest!==O||typeof n.artifact.graphDigest!=`string`)throw Error(`Candidate judgment has no exact measured execution identity`);return{runId:n.artifact.runId,scenario:t.scenario,graphDigest:n.artifact.graphDigest}})),{dispose:ne,...re}=T,A={version:1,identity:y,optimizedCoordinate:m,baselineDigest:p,candidateDigest:O,candidate:ee,sourcePath:await I(e),dataset:{root:l.root,version:l.version},workspaceGaps:[...new Set(l.cases.flatMap(e=>e.taskWorkspace?.gaps??[`task-workspace-not-snapshotted`,`environment-and-toolchain-not-snapshotted`]))],suite:await I(n),evaluatorIdentity:h,calibration:g,executionIdentities:te.filter(e=>e!==null),mcpPolicy:_.mcpPolicy,decision:T.decision===`ship`&&k.admissible?`promote`:`hold`,operational:k,measurement:re,operatingCost:{known:!1,reason:`subscription and environment allocation are not metered as incremental provider charges`},campaignBudget:{limits:c.budget,readout:b.pool.readout()}};await f();let ie=await Bu(s,A);return await Mu(M(s,`result.json`),{record:ie}),await T.dispose(),{...A,record:ie}}finally{await c()}}async function cd(e,n){let{seat:r,defaultSeat:i,optimizedCoordinate:a,suite:o,baselineDigest:s,dataset:c,evaluatorIdentity:l,hostBindings:u,loaded:d}=e,f=t(import.meta.url);if(!f)throw Error(`Cannot identify the CLI dependency manifest`);return A({consumer:`graph-learning-v1`,optimizedCoordinate:a,optimizer:qu.parse(o.optimizer),reflection:n.callRef,consumerBytes:$(await F(new URL(import.meta.url))),consumerManifest:$(await F(f)),environment:{node:process.version,platform:process.platform,architecture:process.arch,packages:await Promise.all([`@tangle-network/agent-runtime`,`@tangle-network/agent-eval`,`cli-bridge`].map(async e=>{let n=t(e,import.meta.url);if(!n)throw Error(`Cannot identify ${e} for reproducible learning`);return{name:e,version:(await ju(n)).version,entryDigest:$(await F(new URL(import.meta.resolve(e))))}}))},baselineDigest:s,dataset:c.version,evaluatorIdentity:l,seat:r??null,defaultSeat:i,mcpPolicy:u.mcpPolicy,graph:d.graph,budget:o.budget,reps:o.reps})}async function ld(e,t){let{root:n,suite:r,defaultSeat:i,bindings:a}=e,o=new AbortController,{pool:s,checkpoint:c,startedAt:l,pendingAttempt:u}=await Fu(n,r.budget,t,(e,t)=>{if(t.usd-(t.usdEstimated??0)>0){let t=new Nt(`Native subscription run ${e} reported positive provider billing; no further campaign work is admitted`);throw o.abort(t),t}}),d=AbortSignal.any([AbortSignal.timeout(Math.max(1,l+r.budget.deadlineMs-Date.now())),o.signal]);d.throwIfAborted();let f=u();if(f){let e=await Bl(f.runId);if(e.sourceDigest!==f.sourceDigest||e.graphDigest!==f.graphDigest)throw Error(`Pending native input changed its admitted execution identity`);try{await Ef(e.file,{param:[],resume:e.runId,json:!0,mcpPolicy:e.mcpPolicy,mcpSecret:a.mcpSecret},{defaultSeat:i,cwd:e.cwd,source:await Ul(e),runId:e.runId,graphDigest:e.graphDigest,signal:d,...e.trigger&&{trigger:e.trigger}})}catch(e){if(e.code!==`GRAPH_RUN_FAILED`)throw e}finally{await c()}}return{pool:s,checkpoint:c,startedAt:l,signal:d}}function ud(e,t,n){let{root:r,hostBindings:i,seat:a,defaultSeat:o}=e,{signal:s,checkpoint:c}=t;return async(e,t,l,u,d=null,f)=>{await Ze(M(r,`attempts`),{recursive:!0,mode:448});let p=M(r,`attempts`,`${$(t)}.json`),m=!1;try{await L(p,JSON.stringify({runId:E(),startedAt:Date.now()}),{flag:`wx`,mode:384,flush:!0}),m=!0}catch(e){if(e.code!==`EEXIST`)throw e}let{runId:h,startedAt:g}=P.strictObject({runId:P.uuid(),startedAt:P.number().int().nonnegative()}).parse(await ju(p)),_=M(r,`executions`,h);await Ze(_,{recursive:!0,mode:448});let v=M(_,`graph.yaml`);try{await L(v,e,{flag:`wx`,mode:384,flush:!0})}catch(t){if(t.code!==`EEXIST`)throw t;if($(await F(v))!==$(e))throw Error(`Attempt source identity changed`)}let y;try{await F(M(N(),`.tangle`,`runs`,h,`input.json`)),y=await Bl(h)}catch(e){if(e.code!==`ENOENT`)throw e}if(y&&$(await Ul(y))!==$(e))throw Error(`Attempt snapshot changed`);if(y&&(f?kl(f):null)!==(y.taskWorkspace?kl(y.taskWorkspace):null))throw Error(`Attempt task workspace identity changed`);let b=f?await Fl(f,{runId:h,resumeCwd:y?.cwd,signal:AbortSignal.any([s,u])}):void 0;try{let t=await Ef(v,{...i,param:Gl(l),dryRun:!0,...y&&{resume:h},...a&&{seat:a}},{defaultSeat:o,cwd:b?.cwd??_,signal:s,...d&&{trigger:d},...f&&{taskWorkspace:f}});if(!(`graph`in t))throw Error(`Attempt did not load locally`);if(!t.graph.budget?.maxTokens||!t.graph.budget.maxIterations||!t.graph.budget.deadlineMs)throw Error(`Every materialized case needs finite token, iteration and deadline budgets`);await c({runId:h,budget:t.graph.budget,sourceDigest:$(e),graphDigest:t.graph.digest});let r;try{await Ef(v,{...i,param:Gl(l),json:!0,...a&&{seat:a},...y&&{resume:h}},{defaultSeat:o,runId:h,cwd:b?.cwd??_,...f&&{taskWorkspace:f},graphDigest:t.graph.digest,signal:AbortSignal.any([s,u]),...d&&{trigger:d}})}catch(e){r=e}finally{await c()}let p=await zt(M(N(),`.tangle`,`runs`,h));if(!p)throw new Nt(`Native graph attempt has no retained settlement`,{cause:r});return{...vl(p),runId:h,sourceDigest:$(e),graphDigest:t.graph.digest,durationMs:Math.max(Date.now()-g,p.spentTotal.ms),latencyKnown:m,invocation:n,taskWorkspaceDigest:f?kl(f):null}}finally{b?.release()}}}function dd(e,t,n){let{root:r,suite:i,evaluatorCwd:a,evaluatorIdentity:o,assertUnchanged:s}=e;return{name:`independent-domain-evaluator`,judgeVersion:o,dimensions:[{key:`quality`,description:i.objective}],score:async({artifact:e,scenario:c,signal:l})=>{let u=await td(i,a,{scenario:c,evidence:t.get(c.id),artifact:e},l,s),d=await Bu(r,{evaluatorIdentity:o,scenario:c.id,artifact:e,verdict:u});return await Ze(M(r,`judgments`),{recursive:!0,mode:448}),await Mu(M(r,`judgments`,`${e.runId}.json`),{evidence:d,sourceDigest:e.sourceDigest,scenario:c.id,unit:c.unit,split:c.split,quality:u.quality,tokens:e.tokenUsage.input===null||e.tokenUsage.output===null?null:e.tokenUsage.input+e.tokenUsage.output,durationMs:e.durationMs,latencyKnown:e.latencyKnown&&e.invocation===n,operatingCostUsd:null}),{dimensions:{quality:u.quality},composite:u.quality,notes:u.notes}}}}function fd(e,t){let{root:n,profile:r,suite:i,dataset:a}=e;return It({model:r.model?.default??`subscription-native`,pricing:{inputUsdPerMillion:0,outputUsdPerMillion:0},maxOutputTokens:i.budget.proposalTokens,frame:`Improve only the ${i.node} node's inline prompt. Domain: ${i.domain}. Objective: ${i.objective}. Preserve independent checks.`,evidence:async({trainCells:e})=>Promise.all(e.map(async e=>{let t=await ju(M(n,`attempts`,`${$(`${e.cellId}:${e.attempt}`)}.json`)),r=await Bt(M(N(),`.tangle`,`runs`,t.runId),{totalChars:48e3});return JSON.stringify({cell:e,tasks:a.cases.filter(t=>t.split===`train`&&t.unit===e.unitId).map(e=>({id:e.id,params:e.params,trigger:e.trigger,taskWorkspace:e.taskWorkspace?kl(e.taskWorkspace):null})),records:r})})),chat:async({messages:e,callId:n,signal:r})=>{let a=await t.call({callId:n,signal:r,request:{model:t.model,messages:e,maxTokens:i.budget.proposalTokens}});if(!a.succeeded)throw Error(a.error);return{content:a.response.content,usage:a.response.usage.captured===!1?null:{inputTokens:a.response.usage.promptTokens,outputTokens:a.response.usage.completionTokens}}}})}async function pd(e,t,n,r){let{root:i,suite:a,dataset:o,profile:s,profileComponents:c,sourceForProfile:l}=e,{signal:u,startedAt:d,run:f,judge:p}=r,m=fd(e,t),h=Ju(a.optimizer,{subscriptionOnlyModel:t,runner:{},maxOutputTokens:a.budget.proposalTokens,timeoutMs:a.budget.proposalDeadlineMs,objective:a.objective,describeScenario:e=>({id:e.id,params:e.params,trigger:e.trigger}),describeArtifact:e=>({text:e.text,status:e.status})}),g={surface:`agent-profile`,profileComponents:c,executionRef:n,trainScenarios:o.cases.filter(e=>e.split===`train`),selectionScenarios:o.cases.filter(e=>e.split===`dev`),testScenarios:o.cases.filter(e=>e.split===`test`),judges:[p],costCeiling:0,runDir:M(i,`search`),signal:u,agent:async(e,t,n)=>{let r=l(e),i=await n.cost.runPaidCall({actor:`native-graph`,model:s.model?.default??`subscription-native`,maximumCharge:{externallyEnforcedMaximumUsd:0},signal:n.signal,execute:()=>f(r,`search`in n?n.search.runId:`${n.cellId}:${n.runAttemptId}`,t.params,n.signal,t.trigger??null,t.taskWorkspace),receipt:e=>({model:s.model?.default??`subscription-native`,...e.costUsd===null?{costUnknown:!0}:{actualCostUsd:e.costUsd},inputTokens:e.tokenUsage.input??0,outputTokens:e.tokenUsage.output??0,usageUnknown:e.tokenUsage.input===null||e.tokenUsage.output===null})});if(!i.succeeded)throw i.error;return i.value}};return h.kind===`official`?await Pt(s,{...g,method:h.method,minimumLift:a.minimumEffect,reps:a.reps,maxConcurrency:1,optimizationRunOptions:{reps:a.reps,maxConcurrency:1}}):await Pt(s,{...g,method:Lt({proposer:m,maxExpansions:a.budget.maxExpansions,policy:gt(),allocation:yt({reps:a.reps}),lanes:[Rt({seats:1,cellUsd:0})],deadline:new Date(d+a.budget.deadlineMs).toISOString(),maxAttempts:1}),claim:{use:`comparison`,population:{id:a.domain,description:a.objective},samplingFrame:`retained graph dataset ${o.version}`,independentUnit:`unit`,generalization:`new-units`,minimumEffect:a.minimumEffect},executionRunId:e=>e.runId})}async function md(e,t,n,r,i,a,o){let{suite:s,cwd:c,identity:l,calibration:u,assertUnchanged:d}=await nd(n),f=await F(e,`utf8`),p=wt(f)[s.node];if(typeof p!=`string`)throw Error(`The selected node needs an unshared inline prompt`);let m=await Uu(t);if(m.cases.some(e=>e.domain!==s.domain))throw Error(`Dataset contains a different domain`);if(m.cases.some(e=>e.outcome===`unavailable`||!e.sourceDigest))throw Error(`Dataset retains unavailable attempts; reconcile them before freezing a learning cohort`);for(let e of[`train`,`dev`,`test`])if(!m.cases.some(t=>t.split===e))throw Error(`Dataset needs an independent ${e} partition`);if(m.cases.some(e=>e.trigger===void 0))throw Error(`Dataset lacks retained trigger context; reingest legacy runs before replay`);let h=[...new Set(m.cases.map(e=>JSON.stringify(Ae.parse(e.mcpPolicy??{}))))];if(!o.mcpPolicy&&h.length!==1)throw Error(`Retained MCP host policies differ; select an explicit --mcp-policy`);let g={...o,mcpPolicy:o.mcpPolicy??Ae.parse(JSON.parse(h[0]??`{}`))},_=m.cases.find(e=>e.split===`train`);if(!_)throw Error(`Dataset needs a train case`);let v=M(r,`baseline.graph.yaml`),y=$(f);try{await L(v,f,{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e;if($(await F(v))!==y)throw Error(`Frozen baseline changed`)}let b;if(_.taskWorkspace){let e=M(r,`task-workspace-admission.json`);try{await L(e,JSON.stringify({runId:E()}),{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e}let t=P.strictObject({runId:P.uuid()}).parse(await ju(e));b=await Fl(_.taskWorkspace,{...t,validationOnly:!0})}let x;try{x=await Ef(v,{...g,param:Gl(_.params),dryRun:!0,...i&&{seat:i}},{defaultSeat:a,..._.trigger&&{trigger:_.trigger},...b&&{cwd:b.cwd,taskWorkspace:_.taskWorkspace}})}finally{await b?.release()}if(!(`graph`in x))throw Error(`Baseline did not load locally`);if(!x.graph.budget?.maxTokens||!x.graph.budget.maxIterations||!x.graph.budget.deadlineMs)throw Error(`Graph needs finite token, iteration and deadline budgets for bounded improvement`);let S=x.graph.nodes.find(e=>e.id===s.node)?.profile;if(!S)throw Error(`Selected node was not materialized`);let C=typeof S.prompt?.systemPrompt==`string`?`systemPrompt`:`appendSystemPrompt`;if(typeof S.prompt?.[C]!=`string`)throw Error(`The selected source coordinate was not materialized`);let w=`prompt.${C}`,T={...S,prompt:{...S.prompt,[C]:p}},D=e=>{let t=e.prompt?.[C];if(typeof t!=`string`)throw Error(`Candidate lost its selected prompt coordinate`);return t},O={read:e=>({[w]:D(e)}),apply(e,t){if(Object.keys(t).length!==1||Object.keys(t)[0]!==w||typeof t[w]!=`string`)throw Error(`Candidate changed the selected prompt coordinate`);return{...e,prompt:{...e.prompt,[C]:t[w]}}}},k=e=>{let t=D(e);return t===p?f:Tt(f,{[s.node]:t})},ee={node:s.node,profileField:w,binding:`authored-source-compiled-per-case`};return{root:r,seat:i,defaultSeat:a,bindings:o,suite:s,evaluatorCwd:c,evaluatorIdentity:l,calibration:u,assertUnchanged:d,baselineDigest:y,dataset:m,hostBindings:g,loaded:x,profile:T,profileComponents:O,sourceForProfile:k,optimizedCoordinate:ee}}async function hd(e,t,n,r){let i={mcpPolicy:n.mcpPolicy?await dl(n.mcpPolicy):void 0,mcpSecret:n.mcpSecret},a=[e,...n.arm],o=n.split===`test`;if(o?a.length!==2||!n.unseal:n.split!==`train`)throw Error(`--split is train, or test with one --arm and --unseal`);let s=o?`holdout`:`search`,c=await F(M(t,`cases.jsonl.gz`)),l=Ut(c).toString().trim().split(`
+`).map(e=>JSON.parse(e)),u=new Map(l.map(e=>[e.id,e])),d=e=>u.get(e.split(`:`).pop()??e),f=e=>`graph-improve-js::${d(e).upstream}`,p=e=>r.deterministicSplit(f(e),`agent-eval-v1`,[.32,.38]),m=(e,t)=>[`issue=https://github.com/${e.upstream}/issues/${e.issue}`,`repo=${e.upstream}`,...[`deliver=branch`,`base=main`,`test=${e.test}`],`verify_image=${t}`,`agent_tools={"websearch":false,"webfetch":false}`],h=m(l[0],`none`),g=[];for(let e of a){let t=await F(e,`utf8`),n=await Ef(e,{...i,param:h,dryRun:!0},{source:t});if(!(`graph`in n))throw Error(`${e} did not load locally`);let r=n.graph.nodes.filter(({check:e,profile:{tools:t}})=>!e&&(t?.websearch!==!1||t?.webfetch!==!1));if(r.length)throw Error(`${r.map(e=>e.id)} can use web tools; refusing`);let a=n.graph.budget?.maxTokens;if(!a)throw Error(`${e} sets no budget.maxTokens to book at`);let{maxIterations:o,deadlineMs:s}=n.graph.budget??{};if(!o||!s)throw Error(`${e} needs finite iteration and deadline budgets`);g.push({file:e,source:t,sourceDigest:$(t),digest:n.graph.digest,cap:a,iterations:o,deadline:s})}return{bindings:i,files:a,sealed:s,manifest:c,cases:u,at:d,split:p,params:m,arms:g}}const gd=Ot(we),_d=async(e,...t)=>(await gd(`bash`,[`-ec`,e,`gi`,...t],{maxBuffer:3e8})).stdout,vd=M(N(),`.tangle`,`graph-improve`,`v5`),yd=M(N(),`.tangle`,`runs`),bd=e=>({inputTokens:0,outputTokens:e,usageUnknown:!0}),xd=e=>!!e&&e.owner!==`work`&&e.code!==`budget-exhausted`;async function Sd(e){let[t,n]=[M(e,`bin`),M(e,`remotes`)];for(let e of[t,n])await Ze(e,{recursive:!0});let r=`#!/bin/sh
 [ "$1 $2" = "issue view" ] || { echo "gh: offline replay; only 'gh issue view <n>' answers" >&2; exit 1; }
 shift 2; n=; repo=; prev=
 for a; do
@@ -161,19 +161,19 @@ for a; do
   prev=$a
 done
 exec cat "${e}/remotes/$repo.git/tangle-issue-$n.json"
-`;for(let t of[`gh`,`gh-drew`])await L(M(e,`bin`,t),r,{mode:493});let i=`[url "${e}/remotes/"]\n\tinsteadOf = https://github.com/\n[user]\n\tname = graph-improve\n\temail = gi@local\n`;await L(M(e,`bin`,`gitconfig`),i);for(let e of Object.keys(process.env))/(^|_)(GH|GITHUB)\w*_(TOKEN|PAT)$|_PAT$/i.test(e)&&delete process.env[e];Object.assign(process.env,{GITHUB_TOKEN:`replay-placeholder`,GIT_CONFIG_NOSYSTEM:`1`,PATH:`${t}:${process.env.PATH}`,BRIDGE_JAIL_RO_PATHS:t,GIT_CONFIG_GLOBAL:M(t,`gitconfig`),BRIDGE_JAIL_RW_PATHS:n})}async function Sd(e,t,n){let{CostLedger:r,decidePairedPromotion:i,runCampaign:a,wilson:o}=await import(`@tangle-network/agent-eval`),s=await import(`@tangle-network/agent-eval/benchmarks`),{durableRunToolSpans:c,readSettleRecord:l}=await import(`@tangle-network/agent-runtime/durable`),u=await md(e,t,n,s),{bindings:d,files:f,sealed:p,manifest:m,cases:h,at:g,split:_,arms:v}=u,y={},b,x=n.dockerHost;x&&(process.env.DOCKER_HOST=`ssh://${x}`);let S=s.createHarborBenchmarkAdapter({id:`graph-improve-js`,datasetDir:t,assignSplit:_,tasks:[...h.keys()].filter(e=>_(e)===p).sort(),source:{name:`js-issues`,revision:$(m).slice(0,12)},grade:s.gradeHarborPatch({jobsDir:M(_d,`jobs`)})}),C=new AbortController,w=await s.benchmarkScenarios(S,[p]),T=new Set(w.slice(0,n.probe).map(e=>e.id)),E=n.reps??1;if(!Number.isSafeInteger(E)||E<1||n.probe!==void 0&&(!Number.isSafeInteger(n.probe)||n.probe<1))throw Error(`--reps and --probe must be positive integers`);let D={maxTokens:n.maxTokens??v.reduce((e,t)=>e+t.cap,0)*w.length*E,maxIterations:n.maxIterations??v.reduce((e,t)=>e+t.iterations,0)*w.length*E,deadlineMs:n.deadlineMs??v.reduce((e,t)=>e+t.deadline,0)*w.length*E},O=$(JSON.stringify({dataset:$(m),sealed:p,arms:v.map(e=>({graph:e.digest,source:e.sourceDigest})),mcpPolicy:d.mcpPolicy??null,seats:n.seat,reps:E})),k=be(n.campaign??M(_d,`campaigns`,O));await Ze(k,{recursive:!0,mode:448}),b=M(k,`environment`);let{release:ee}=ht({lockPath:`${await I(k)}.lock`});try{await xd(b);for(let[e,t]of v.entries()){t.evidence=await zu(k,{kind:`graph-arm-source`,source:t.source,sourceDigest:t.sourceDigest});let n=M(k,`arm-${e}.json`),r=JSON.stringify({evidence:t.evidence});try{await L(n,r,{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e;if(await F(n,`utf8`)!==r)throw Error(`Benchmark arm source changed; use a new campaign`)}}let e=await Pu(k,D,$(JSON.stringify({identity:O,ceilings:D}))),{pool:t}=e,d=Dd({prepared:u,bench:s,conserved:e,campaign:k,live:b,host:x,stop:C,state:y,durableRunToolSpans:c,readSettleRecord:l}),m=AbortSignal.any([C.signal,AbortSignal.timeout(Math.max(1,e.startedAt+D.deadlineMs-Date.now()))]),h=new r({costCeilingUsd:0}),_=[...Array(E).keys()],ee=[...T].flatMap(e=>_.flatMap(t=>v.map((n,r)=>`${r}|${e}:${t}`))),te=new Map,ne=new Map(ee.map(e=>[e,new Promise(t=>te.set(e,t))])),re=new Map([...T].map(e=>[e,E*v.length]));m.addEventListener(`abort`,()=>{y.incomplete??=`Campaign deadline or cancellation interrupted matched comparison`;for(let e of te.values())e()},{once:!0});let A=v.map(async(t,r)=>{let i=`${t.digest}:${n.seat.join(`,`)}`,o=M(k,`arms`,`${r}`);if(p===`holdout`){await Ze(o,{recursive:!0});let e={at:new Date,reason:n.unseal,arms:f};await L(M(o,`holdout-access.jsonl`),`${JSON.stringify(e)}\n`,{flag:`a`})}return a({scenarios:w,reps:E,runDir:o,resumable:!0,dispatchRef:i,costLedger:h,costCeiling:0,cellFilter:e=>T.has(e.scenario.id),judges:[s.benchmarkJudge(S)],maxConcurrency:3,signal:m,dispatchTimeoutMs:Math.max(1,e.startedAt+D.deadlineMs-Date.now()),onCellSettled:async(e,{id:t,item:n})=>{e.cached&&te.get(`${r}|${e.cellId}`)?.(),re.set(t,(re.get(t)??1)-1),re.get(t)||await s.releaseCaseEnvironment(n,{host:x})},dispatch:async(e,i)=>{let a=ee.indexOf(`${r}|${i.cellId}`),o=n.seat[Math.floor(a/v.length)%n.seat.length],s=o??`graph-default`;try{await Promise.all(ee.slice(0,a).map(e=>ne.get(e)));let n=await i.cost.runPaidCall({actor:t.file,model:s,signal:i.signal,maximumCharge:{externallyEnforcedMaximumUsd:0},execute:n=>d(t,e.item,{seat:o,signal:n,attempt:i.cellId}),receipt:({tokens:e})=>({model:s,...e,actualCostUsd:0}),receiptFromError:()=>({model:s,...yd(t.cap),actualCostUsd:0})});if(!n.succeeded)throw n.error;return n.value}finally{te.get(`${r}|${i.cellId}`)?.()}}})}),ie=await Promise.allSettled(A.map(e=>e.catch(e=>{throw C.abort(e),e})));if(C.signal.aborted)throw C.signal.reason;let{reports:ae,paired:oe}=Od({campaigns:ie.map(e=>{if(e.status===`rejected`)throw e.reason;return e.value}),files:f,probe:T,reps:E,repList:_,at:g,state:y,wilson:o,decidePairedPromotion:i}),se={split:n.split,arms:ae,paired:oe,incomplete:y.incomplete??(ae.some(e=>!e.usageComplete||e.unmeasured.length)?`Campaign evidence is incomplete`:null),campaign:k,campaignBudget:{limits:D,readout:t.readout()},operatingCost:{known:!1,reason:`subscription and environment allocation are not incrementally metered`}};await L(M(k,`result.json`),JSON.stringify(se),{mode:384,flush:!0}),z(se)}finally{await ee()}}async function Cd(e,t,n){try{let{trigger:r,...i}=n,a=await Ef(e,{param:t,json:!0,...i},{...r&&{trigger:r}});return`runId`in a?a.runId:void 0}catch(e){if(e.code!==`GRAPH_RUN_FAILED`)throw e;return e.runId}}const wd=async(e,t,n=!0)=>{if(!e)throw Error(`The diagnosis has no retained run identity`);let{readSettleRecord:r}=await import(`@tangle-network/agent-runtime/durable`),{FileResultBlobStore:i}=await import(`@tangle-network/agent-runtime/kernel`),a=M(vd,e),o=(await r(a))?.tree.nodes.filter(e=>e.label===t&&e.outRef).at(-1);if(!o?.outRef&&!n)return{};if(!o?.outRef)throw Error(`The retained ${t} result is unavailable`);let s=await new i(M(a,`blobs`)).get(o.outRef);if(!s||typeof s!=`object`||Array.isArray(s))throw Error(`The retained ${t} result is not an object`);let c=`json`in s?s.json:s;if(!c||typeof c!=`object`||Array.isArray(c))throw Error(`The retained ${t} structured result is unavailable`);return c};async function Td(e,t){let n=await zl(e),r={...t,seat:t.seat??n.seat,mcpPolicy:t.mcpPolicy??n.mcpPolicy,trigger:n.trigger},i=await Hl(n),a=M(_d,`repairs`,e);await Ze(a,{recursive:!0});let o=M(a,`original.graph.yaml`);await L(o,i);let{runEvidence:s}=await import(`@tangle-network/agent-runtime/durable`),c=await s(M(vd,e),{settledChars:4e3,totalChars:48e3}),l=[`from`,`branch`,`failure`,`approved_head`],u=Object.entries(n.params).filter(([e])=>!l.includes(e)).map(([e,t])=>`${e}=${typeof t==`string`?t:JSON.stringify(t)}`),d=JSON.stringify({records:c,graph:i}),f=await Cd(o,[...u,`from=diagnose`,`failure=${d}`],r),p=await wd(f,`diagnose`),m={run:e,diagnoseRun:f,verdict:p};if(p.owner!==`graph`||!p.patch)return z(m);let h=M(a,`graph.yaml`);await L(h,i),await L(M(a,`patch.diff`),p.patch),await gd(`patch -s -p1 -d "$1" -i "$1/patch.diff"`,a);let g=async e=>{let t=await Ef(e,{...r,param:u,dryRun:!0},{...n.trigger&&{trigger:n.trigger}});if(!(`graph`in t))throw Error(`${e} did not load locally`);let{nodes:i,deliverable:a,edges:o}=t.graph,s=e=>o.filter(t=>[`from`in t&&t.from,t.to].flat().includes(e)),c=i.filter(e=>e.check).map(e=>[e.id,e.check,s(e.id)]);return JSON.stringify([a,c])};if(await g(o)!==await g(h))return z({...m,refused:`patch touches a check; not resumed`});let[_,v,y]=await Promise.all([wd(e,`verify`,!1),wd(e,`plan`,!1),wd(e,`intake`)]),{from:b=`intake`,failure:x,approved_head:S}=p.resume??{},C=(...e)=>e.find(e=>typeof e==`string`&&e.trim().length>0),w=C(y.branch,n.params.branch),T=C(_.test,v.test,n.params.test,y.test),E=C(_.setup,n.params.setup,v.setup,y.setup);if(b!==`intake`&&(!w||!T))throw Error(`Repair from=${b} requires a retained branch and resolved test command`);let D=[`from=${b}`];b!==`intake`&&D.push(`branch=${w}`),b!==`intake`&&D.push(`test=${T}`),E&&`setup`in n.params&&D.push(`setup=${E}`),x&&D.push(`failure=${x}`),S&&D.push(`approved_head=${S}`);let O=await Cd(h,[...u,...D],r),k={parentRunId:e,sourceDigest:n.sourceDigest,candidateDigest:$(await F(h)),diagnoseRun:f,resumed:O};await L(M(a,`parent.json`),JSON.stringify(k)),z({...m,patched:h,resumed:O,lineage:k})}function Ed(e){cl(e),e.command(`dataset <directory> [runs...]`).description(`Idempotently retain local/cloud attempts in a versioned learning dataset`).option(`--domain <domain>`,`Domain being measured`).option(`--unit <unit>`,`Independent task group; related tasks stay in one split`).option(`--split <split>`,`train, dev or test`).option(`--api-key <key>`,`Platform credential for cloud runs`).option(`--base-url <url>`,`Platform origin for cloud runs`).action(async(e,t,n)=>{if(t.length&&(!n.domain||!n.unit||![`train`,`dev`,`test`].includes(n.split)))throw Error(`Ingestion requires --domain, --unit and --split train|dev|test`);z(t.length?await Uu(e,t,n):await Hu(e))}),e.command(`activate <campaign> <graph>`).description(`Activate the exact promoted graph under a target lock and fresh evidence checks`).action(async(e,t)=>z(await id(e,t))),e.command(`observe <campaign> <run>`).description(`Independently grade a subsequent run of an activated graph`).requiredOption(`--unit <unit>`,`Independent production task group, separate from learning cases`).action(async(e,t,n)=>z(await ad(e,t,n.unit))),e.command(`repair <run>`).description(`Diagnose a failed local graph run; patch and resume it when the graph owns the fix`).option(`--seat-command <program>`,`Executable that prints the account id`).option(`--seat <seat>`,`Repair seat; defaults to the failed run's captured override`).option(`--mcp-policy <file>`,`Trusted host MCP policy; defaults to the failed run's captured policy`).addOption(ll()).action(async(e,t)=>Td(e,{...t,mcpPolicy:t.mcpPolicy?await dl(t.mcpPolicy):void 0}));let t=(e,t)=>[...t,e];e.command(`improve <graph> [dataset]`).description(`Generate and independently compare graph prompt candidates, or replay js-issues arms`).option(`--suite <file>`,`Independent domain evaluator and bounded learning policy`).option(`--campaign <directory>`,`Durable learning campaign (required with --suite)`).option(`--max-tokens <n>`,`Total replay campaign token ceiling across all arms`,Number).option(`--max-iterations <n>`,`Total replay campaign iteration ceiling`,Number).option(`--deadline-ms <n>`,`Total replay campaign wall-clock ceiling in milliseconds`,Number).option(`--arm <graph>`,`Another arm, interleaved; repeatable`,t,[]).option(`--split <split>`,`train, or test (needs --unseal)`,`train`).option(`--unseal <reason>`,`Read the sealed test split, logging why`).option(`--probe <n>`,`Stop after the first n cases`,Number).option(`--reps <n>`,`Reps of every case per arm (default 1)`,Number).option(`--seat <seat>`,`Replay seat; repeatable, one per replay`,t,[]).option(`--docker-host <ssh>`,`Build, verify and grade on this ssh host`).option(`--mcp-policy <file>`,`Trusted host MCP policy; defaults to the retained cohort's matching policy`).addOption(ll()).action(async(e,t,n)=>{if(!n.suite)return Sd(e,t??M(_d,`js-issues`),n);if(!t||!n.campaign)throw Error(`Learning requires a retained dataset and --campaign directory`);if(n.arm.length||n.seat.length>1)throw Error(`Learning generates its candidate; use one matched --seat`);z(await od(e,t,n.suite,n.campaign,n.seat[0],{mcpPolicy:n.mcpPolicy?await dl(n.mcpPolicy):void 0,mcpSecret:n.mcpSecret}))})}function Dd(e){let{prepared:t,conserved:n,campaign:r,live:i,host:a,state:o}=e,{bindings:s,at:c,params:l}=t,{pool:u,checkpoint:d}=n;return async(t,n,{seat:f,signal:p,attempt:m})=>{if(o.incomplete)throw new Nt(o.incomplete);if(!t.evidence)throw Error(`Benchmark arm has no retained source`);let h=await Bu(r,t.evidence);if($(h.source)!==t.sourceDigest)throw Error(`Frozen benchmark arm changed`);let g=M(r,`attempts`,`${$(`${t.digest}:${f??`default`}:${m}`)}.json`);await Ze(M(r,`attempts`),{recursive:!0,mode:448});try{await L(g,JSON.stringify({runId:E()}),{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e}let _=P.strictObject({runId:P.uuid()}).parse(JSON.parse(await F(g,`utf8`))),v;try{v=await zl(_.runId)}catch(e){try{throw await F(M(vd,_.runId,`input.json`)),e}catch(e){if(e.code!==`ENOENT`)throw e}}let y=await e.bench.prepareCaseEnvironment(n,{host:a,signal:p}),b=M(_d,`remotes`,`${n.id}.git`);await gd(`[ -d "$2/refs" ] && exit; g=$(mktemp -d); trap 'rm -rf "$g"' EXIT
+`;for(let t of[`gh`,`gh-drew`])await L(M(e,`bin`,t),r,{mode:493});let i=`[url "${e}/remotes/"]\n\tinsteadOf = https://github.com/\n[user]\n\tname = graph-improve\n\temail = gi@local\n`;await L(M(e,`bin`,`gitconfig`),i);for(let e of Object.keys(process.env))/(^|_)(GH|GITHUB)\w*_(TOKEN|PAT)$|_PAT$/i.test(e)&&delete process.env[e];Object.assign(process.env,{GITHUB_TOKEN:`replay-placeholder`,GIT_CONFIG_NOSYSTEM:`1`,PATH:`${t}:${process.env.PATH}`,BRIDGE_JAIL_RO_PATHS:t,GIT_CONFIG_GLOBAL:M(t,`gitconfig`),BRIDGE_JAIL_RW_PATHS:n})}async function Cd(e,t,n){let{CostLedger:r,decidePairedPromotion:i,runCampaign:a,wilson:o}=await import(`@tangle-network/agent-eval`),s=await import(`@tangle-network/agent-eval/benchmarks`),{durableRunToolSpans:c,readSettleRecord:l}=await import(`@tangle-network/agent-runtime/durable`),u=await hd(e,t,n,s),{bindings:d,files:f,sealed:p,manifest:m,cases:h,at:g,split:_,arms:v}=u,y={},b,x=n.dockerHost;x&&(process.env.DOCKER_HOST=`ssh://${x}`);let S=s.createHarborBenchmarkAdapter({id:`graph-improve-js`,datasetDir:t,assignSplit:_,tasks:[...h.keys()].filter(e=>_(e)===p).sort(),source:{name:`js-issues`,revision:$(m).slice(0,12)},grade:s.gradeHarborPatch({jobsDir:M(vd,`jobs`)})}),C=new AbortController,w=await s.benchmarkScenarios(S,[p]),T=new Set(w.slice(0,n.probe).map(e=>e.id)),E=n.reps??1;if(!Number.isSafeInteger(E)||E<1||n.probe!==void 0&&(!Number.isSafeInteger(n.probe)||n.probe<1))throw Error(`--reps and --probe must be positive integers`);let D={maxTokens:n.maxTokens??v.reduce((e,t)=>e+t.cap,0)*w.length*E,maxIterations:n.maxIterations??v.reduce((e,t)=>e+t.iterations,0)*w.length*E,deadlineMs:n.deadlineMs??v.reduce((e,t)=>e+t.deadline,0)*w.length*E},O=$(JSON.stringify({dataset:$(m),sealed:p,arms:v.map(e=>({graph:e.digest,source:e.sourceDigest})),mcpPolicy:d.mcpPolicy??null,seats:n.seat,reps:E})),k=be(n.campaign??M(vd,`campaigns`,O));await Ze(k,{recursive:!0,mode:448}),b=M(k,`environment`);let{release:ee}=ht({lockPath:`${await I(k)}.lock`});try{await Sd(b);for(let[e,t]of v.entries()){t.evidence=await Bu(k,{kind:`graph-arm-source`,source:t.source,sourceDigest:t.sourceDigest});let n=M(k,`arm-${e}.json`),r=JSON.stringify({evidence:t.evidence});try{await L(n,r,{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e;if(await F(n,`utf8`)!==r)throw Error(`Benchmark arm source changed; use a new campaign`)}}let e=await Fu(k,D,$(JSON.stringify({identity:O,ceilings:D}))),{pool:t}=e,d=Od({prepared:u,bench:s,conserved:e,campaign:k,live:b,host:x,stop:C,state:y,durableRunToolSpans:c,readSettleRecord:l}),m=AbortSignal.any([C.signal,AbortSignal.timeout(Math.max(1,e.startedAt+D.deadlineMs-Date.now()))]),h=new r({costCeilingUsd:0}),_=[...Array(E).keys()],ee=[...T].flatMap(e=>_.flatMap(t=>v.map((n,r)=>`${r}|${e}:${t}`))),te=new Map,ne=new Map(ee.map(e=>[e,new Promise(t=>te.set(e,t))])),re=new Map([...T].map(e=>[e,E*v.length]));m.addEventListener(`abort`,()=>{y.incomplete??=`Campaign deadline or cancellation interrupted matched comparison`;for(let e of te.values())e()},{once:!0});let A=v.map(async(t,r)=>{let i=`${t.digest}:${n.seat.join(`,`)}`,o=M(k,`arms`,`${r}`);if(p===`holdout`){await Ze(o,{recursive:!0});let e={at:new Date,reason:n.unseal,arms:f};await L(M(o,`holdout-access.jsonl`),`${JSON.stringify(e)}\n`,{flag:`a`})}return a({scenarios:w,reps:E,runDir:o,resumable:!0,dispatchRef:i,costLedger:h,costCeiling:0,cellFilter:e=>T.has(e.scenario.id),judges:[s.benchmarkJudge(S)],maxConcurrency:3,signal:m,dispatchTimeoutMs:Math.max(1,e.startedAt+D.deadlineMs-Date.now()),onCellSettled:async(e,{id:t,item:n})=>{e.cached&&te.get(`${r}|${e.cellId}`)?.(),re.set(t,(re.get(t)??1)-1),re.get(t)||await s.releaseCaseEnvironment(n,{host:x})},dispatch:async(e,i)=>{let a=ee.indexOf(`${r}|${i.cellId}`),o=n.seat[Math.floor(a/v.length)%n.seat.length],s=o??`graph-default`;try{await Promise.all(ee.slice(0,a).map(e=>ne.get(e)));let n=await i.cost.runPaidCall({actor:t.file,model:s,signal:i.signal,maximumCharge:{externallyEnforcedMaximumUsd:0},execute:n=>d(t,e.item,{seat:o,signal:n,attempt:i.cellId}),receipt:({tokens:e})=>({model:s,...e,actualCostUsd:0}),receiptFromError:()=>({model:s,...bd(t.cap),actualCostUsd:0})});if(!n.succeeded)throw n.error;return n.value}finally{te.get(`${r}|${i.cellId}`)?.()}}})}),ie=await Promise.allSettled(A.map(e=>e.catch(e=>{throw C.abort(e),e})));if(C.signal.aborted)throw C.signal.reason;let{reports:ae,paired:oe}=kd({campaigns:ie.map(e=>{if(e.status===`rejected`)throw e.reason;return e.value}),files:f,probe:T,reps:E,repList:_,at:g,state:y,wilson:o,decidePairedPromotion:i}),se={split:n.split,arms:ae,paired:oe,incomplete:y.incomplete??(ae.some(e=>!e.usageComplete||e.unmeasured.length)?`Campaign evidence is incomplete`:null),campaign:k,campaignBudget:{limits:D,readout:t.readout()},operatingCost:{known:!1,reason:`subscription and environment allocation are not incrementally metered`}};await L(M(k,`result.json`),JSON.stringify(se),{mode:384,flush:!0}),z(se)}finally{await ee()}}async function wd(e,t,n){try{let{trigger:r,...i}=n,a=await Ef(e,{param:t,json:!0,...i},{...r&&{trigger:r}});return`runId`in a?a.runId:void 0}catch(e){if(e.code!==`GRAPH_RUN_FAILED`)throw e;return e.runId}}const Td=async(e,t,n=!0)=>{if(!e)throw Error(`The diagnosis has no retained run identity`);let{readSettleRecord:r}=await import(`@tangle-network/agent-runtime/durable`),{FileResultBlobStore:i}=await import(`@tangle-network/agent-runtime/kernel`),a=M(yd,e),o=(await r(a))?.tree.nodes.filter(e=>e.label===t&&e.outRef).at(-1);if(!o?.outRef&&!n)return{};if(!o?.outRef)throw Error(`The retained ${t} result is unavailable`);let s=await new i(M(a,`blobs`)).get(o.outRef);if(!s||typeof s!=`object`||Array.isArray(s))throw Error(`The retained ${t} result is not an object`);let c=`json`in s?s.json:s;if(!c||typeof c!=`object`||Array.isArray(c))throw Error(`The retained ${t} structured result is unavailable`);return c};async function Ed(e,t){let n=await Bl(e),r={...t,seat:t.seat??n.seat,mcpPolicy:t.mcpPolicy??n.mcpPolicy,trigger:n.trigger},i=await Ul(n),a=M(vd,`repairs`,e);await Ze(a,{recursive:!0});let o=M(a,`original.graph.yaml`);await L(o,i);let{runEvidence:s}=await import(`@tangle-network/agent-runtime/durable`),c=await s(M(yd,e),{settledChars:4e3,totalChars:48e3}),l=[`from`,`branch`,`failure`,`approved_head`],u=Object.entries(n.params).filter(([e])=>!l.includes(e)).map(([e,t])=>`${e}=${typeof t==`string`?t:JSON.stringify(t)}`),d=JSON.stringify({records:c,graph:i}),f=await wd(o,[...u,`from=diagnose`,`failure=${d}`],r),p=await Td(f,`diagnose`),m={run:e,diagnoseRun:f,verdict:p};if(p.owner!==`graph`||!p.patch)return z(m);let h=M(a,`graph.yaml`);await L(h,i),await L(M(a,`patch.diff`),p.patch),await _d(`patch -s -p1 -d "$1" -i "$1/patch.diff"`,a);let g=async e=>{let t=await Ef(e,{...r,param:u,dryRun:!0},{...n.trigger&&{trigger:n.trigger}});if(!(`graph`in t))throw Error(`${e} did not load locally`);let{nodes:i,deliverable:a,edges:o}=t.graph,s=e=>o.filter(t=>[`from`in t&&t.from,t.to].flat().includes(e)),c=i.filter(e=>e.check).map(e=>[e.id,e.check,s(e.id)]);return JSON.stringify([a,c])};if(await g(o)!==await g(h))return z({...m,refused:`patch touches a check; not resumed`});let[_,v,y]=await Promise.all([Td(e,`verify`,!1),Td(e,`plan`,!1),Td(e,`intake`)]),{from:b=`intake`,failure:x,approved_head:S}=p.resume??{},C=(...e)=>e.find(e=>typeof e==`string`&&e.trim().length>0),w=C(y.branch,n.params.branch),T=C(_.test,v.test,n.params.test,y.test),E=C(_.setup,n.params.setup,v.setup,y.setup);if(b!==`intake`&&(!w||!T))throw Error(`Repair from=${b} requires a retained branch and resolved test command`);let D=[`from=${b}`];b!==`intake`&&D.push(`branch=${w}`),b!==`intake`&&D.push(`test=${T}`),E&&`setup`in n.params&&D.push(`setup=${E}`),x&&D.push(`failure=${x}`),S&&D.push(`approved_head=${S}`);let O=await wd(h,[...u,...D],r),k={parentRunId:e,sourceDigest:n.sourceDigest,candidateDigest:$(await F(h)),diagnoseRun:f,resumed:O};await L(M(a,`parent.json`),JSON.stringify(k)),z({...m,patched:h,resumed:O,lineage:k})}function Dd(e){cl(e),e.command(`dataset <directory> [runs...]`).description(`Idempotently retain local/cloud attempts in a versioned learning dataset`).option(`--domain <domain>`,`Domain being measured`).option(`--unit <unit>`,`Independent task group; related tasks stay in one split`).option(`--split <split>`,`train, dev or test`).option(`--api-key <key>`,`Platform credential for cloud runs`).option(`--base-url <url>`,`Platform origin for cloud runs`).action(async(e,t,n)=>{if(t.length&&(!n.domain||!n.unit||![`train`,`dev`,`test`].includes(n.split)))throw Error(`Ingestion requires --domain, --unit and --split train|dev|test`);z(t.length?await Wu(e,t,n):await Uu(e))}),e.command(`activate <campaign> <graph>`).description(`Activate the exact promoted graph under a target lock and fresh evidence checks`).action(async(e,t)=>z(await ad(e,t))),e.command(`observe <campaign> <run>`).description(`Independently grade a subsequent run of an activated graph`).requiredOption(`--unit <unit>`,`Independent production task group, separate from learning cases`).action(async(e,t,n)=>z(await od(e,t,n.unit))),e.command(`repair <run>`).description(`Diagnose a failed local graph run; patch and resume it when the graph owns the fix`).option(`--seat-command <program>`,`Executable that prints the account id`).option(`--seat <seat>`,`Repair seat; defaults to the failed run's captured override`).option(`--mcp-policy <file>`,`Trusted host MCP policy; defaults to the failed run's captured policy`).addOption(ll()).action(async(e,t)=>Ed(e,{...t,mcpPolicy:t.mcpPolicy?await dl(t.mcpPolicy):void 0}));let t=(e,t)=>[...t,e];e.command(`improve <graph> [dataset]`).description(`Generate and independently compare graph prompt candidates, or replay js-issues arms`).option(`--suite <file>`,`Independent domain evaluator and bounded learning policy`).option(`--campaign <directory>`,`Durable learning campaign (required with --suite)`).option(`--max-tokens <n>`,`Total replay campaign token ceiling across all arms`,Number).option(`--max-iterations <n>`,`Total replay campaign iteration ceiling`,Number).option(`--deadline-ms <n>`,`Total replay campaign wall-clock ceiling in milliseconds`,Number).option(`--arm <graph>`,`Another arm, interleaved; repeatable`,t,[]).option(`--split <split>`,`train, or test (needs --unseal)`,`train`).option(`--unseal <reason>`,`Read the sealed test split, logging why`).option(`--probe <n>`,`Stop after the first n cases`,Number).option(`--reps <n>`,`Reps of every case per arm (default 1)`,Number).option(`--seat <seat>`,`Replay seat; repeatable, one per replay`,t,[]).option(`--docker-host <ssh>`,`Build, verify and grade on this ssh host`).option(`--mcp-policy <file>`,`Trusted host MCP policy; defaults to the retained cohort's matching policy`).addOption(ll()).action(async(e,t,n)=>{if(!n.suite)return Cd(e,t??M(vd,`js-issues`),n);if(!t||!n.campaign)throw Error(`Learning requires a retained dataset and --campaign directory`);if(n.arm.length||n.seat.length>1)throw Error(`Learning generates its candidate; use one matched --seat`);z(await sd(e,t,n.suite,n.campaign,n.seat[0],{mcpPolicy:n.mcpPolicy?await dl(n.mcpPolicy):void 0,mcpSecret:n.mcpSecret}))})}function Od(e){let{prepared:t,conserved:n,campaign:r,live:i,host:a,state:o}=e,{bindings:s,at:c,params:l}=t,{pool:u,checkpoint:d}=n;return async(t,n,{seat:f,signal:p,attempt:m})=>{if(o.incomplete)throw new Nt(o.incomplete);if(!t.evidence)throw Error(`Benchmark arm has no retained source`);let h=await Vu(r,t.evidence);if($(h.source)!==t.sourceDigest)throw Error(`Frozen benchmark arm changed`);let g=M(r,`attempts`,`${$(`${t.digest}:${f??`default`}:${m}`)}.json`);await Ze(M(r,`attempts`),{recursive:!0,mode:448});try{await L(g,JSON.stringify({runId:E()}),{flag:`wx`,mode:384,flush:!0})}catch(e){if(e.code!==`EEXIST`)throw e}let _=P.strictObject({runId:P.uuid()}).parse(JSON.parse(await F(g,`utf8`))),v;try{v=await Bl(_.runId)}catch(e){try{throw await F(M(yd,_.runId,`input.json`)),e}catch(e){if(e.code!==`ENOENT`)throw e}}let y=await e.bench.prepareCaseEnvironment(n,{host:a,signal:p}),b=M(vd,`remotes`,`${n.id}.git`);await _d(`[ -d "$2/refs" ] && exit; g=$(mktemp -d); trap 'rm -rf "$g"' EXIT
 docker run --rm --network none "$1" tar -C /app/.git -c . | tar -x -C "$g"
 c=$(git -c user.name=graph-improve -c user.email=gi@local --git-dir "$g" commit-tree 'HEAD^{tree}' -m Base)
 git init -q --bare -b main "$2.partial" && git --git-dir "$g" push -q "$2.partial" "$c:refs/heads/main"
-mv "$2.partial" "$2"`,y,b);let x=c(n.id),S=M(i,`remotes`,`${x.upstream}.git`),{issueTitle:C,issueBodyClean:w}=x,T=`https://github.com/${x.upstream}/issues/${x.issue}`,D=JSON.stringify({title:C,body:w,url:T,state:`OPEN`}),O=_.runId,k;{v||await gd(`rm -rf "$2" && git clone -q --bare "$1" "$2" && printf %s "$4" > "$2/tangle-issue-$3.json"`,b,S,`${x.issue}`,D);try{let e=l(x,y),n={...s,param:e,json:!0,...f&&{seat:f},...v&&{resume:_.runId}},r=await Ef(t.file,{...n,dryRun:!0},{signal:p,source:h.source,...v&&{cwd:v.cwd}});if(!(`graph`in r))throw Error(`Replay did not load locally`);if(!r.graph.budget)throw Error(`Replay has no runtime budget`);try{await d({runId:_.runId,budget:r.graph.budget,sourceDigest:t.sourceDigest,graphDigest:r.graph.digest})}catch(e){throw o.incomplete=e.message,e}let i;try{i=await Ef(t.file,n,{signal:p,source:h.source,runId:_.runId,graphDigest:r.graph.digest,...v&&{cwd:v.cwd}})}finally{await d()}O=`runId`in i?i.runId:void 0;let a=JSON.parse(`text`in i?i.text:`{}`);k=Object.values(a).find(e=>e?.json?.branch)?.json?.branch}catch(e){let t=e;if(t.code!==`GRAPH_RUN_FAILED`)throw e;O=t.runId;let r=u.readout();if(!r.tokensKnown||r.tokensLeft<0||r.iterationsLeft<0||r.deadlineMs>0&&Date.now()>=r.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new Nt(o.incomplete,{cause:e});if(e.runtimeFailures?.some(({failure:e})=>bd(e)))throw new Nt(n.id,{cause:e})}let r=M(N(),`.tangle`,`runs`,`${O}`),i=(await e.durableRunToolSpans(r)).map(e=>e.toolName).find(e=>/web.?(search|fetch)/i.test(e));i&&e.stop.abort(Error(`${O} called ${i}: not offline`)),e.stop.signal.throwIfAborted();let a=k?await gd(`b=$(git --git-dir "$1" rev-parse main); git --git-dir "$2" diff --binary "$b" "$3"`,b,S,k):``,c=await e.readSettleRecord(r),m=c&&vl(c).tokenUsage,g=u.readout();if(!g.tokensKnown||g.tokensLeft<0||g.iterationsLeft<0||g.deadlineMs>0&&Date.now()>=g.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new Nt(o.incomplete);return{patch:a,tokens:m?.input!=null&&m.output!=null?{inputTokens:m.input??0,outputTokens:m.output??0}:yd(t.cap),...O&&{runId:O}}}}}function Od(e){let{campaigns:t,files:n,probe:r,reps:i,repList:a,at:o,state:s,wilson:c,decidePairedPromotion:l}=e,u=e=>e.reduce((e,t)=>e+t,0)/e.length,d=t.map((e,t)=>{let r=e.cells.filter(e=>!e.error),i=e=>Object.values(e.judgeScores)[0]?.composite??0,a=r.filter(e=>e.rep===0),o=a.filter(e=>i(e)>=1).length,s=e.cells.filter(e=>e.error),{inputTokens:l,outputTokens:u,usageComplete:d}=e.aggregates.cost;return{graph:n[t],resolved:o,n:a.length,runDir:e.runDir,wilson95:c(o,a.length),unmeasured:s.map(e=>`${e.cellId}: ${e.error}`),tokens:l+u,usageComplete:d,rewards:Object.fromEntries(r.map(e=>[e.cellId,i(e)]))}}),f=({rewards:e},t)=>a.flatMap(n=>e[`${t}:${n}`]??[]),[p,...m]=d;return{reports:d,paired:m.map((e,t)=>{let a=[...r].filter(t=>f(p,t).length&&f(e,t).length),c=[...new Set(a.map(e=>o(e).upstream))],d=c.map(e=>a.filter(t=>o(t).upstream===e)),m=e=>d.map(t=>u(t.map(t=>u(f(e,t))))),[h,g]=[m(p),m(e)];if(!(!s.incomplete&&p.usageComplete&&e.usageComplete&&a.length===r.size&&a.every(t=>f(p,t).length===i&&f(e,t).length===i)))return{arm:n[t+1],cases:a.length,repos:c.length,decision:`hold`,why:s.incomplete??`Campaign evidence is incomplete`,sufficient:!1,rates:[h.length?u(h):null,g.length?u(g):null],delta:null,interval95:null,method:null};let _=l(h,g,{continuous:!0}),{n:v,minimumPairs:y,low:b,threshold:x}=_,S=_.promote?void 0:!_.sufficient&&`insufficient pairs: n ${v} < minimumPairs ${y}`||b<=x&&`interval low ${b} ≤ threshold ${x}`||_.exactTestVetoes&&`McNemar exact test vetoes`||`indeterminate interval`;return{arm:n[t+1],cases:a.length,repos:c.length,rates:[u(h),u(g)],delta:_.delta,method:_.method,interval95:[_.low,_.high],sufficient:_.sufficient,decision:_.promote?`promote`:`hold`,why:S}})}}const kd=1e5;function Ad(e){throw new W(`GRAPH_INVALID`,`Graph creation failed`,e,`tangle graph new --help`)}function jd(e){return typeof e==`string`&&/^[a-z0-9][a-z0-9-]{0,62}$/i.test(e)}const Md={maxBarren:2,failures:`verbatim`,panel:`off`,bar:`on`,profile:{id:`graph-new-v1`,opening:`The graph has not passed its outside check.`,plan:`Repair the concrete diagnostics with write_graph, run the saved file and submit the actual evidence.`,rules:`Completion requires a successful host run and unchanged YAML. Retain working graph content when blocked.`,headings:{failures:`Failures`,protected:`Passing checks`,changed:`Changes`,findings:`Findings`,bar:`Acceptance`,plan:`Next`,rules:`Rules`}}};var Nd=class{owned;lastFailure;pending=Promise.resolve();revision=0;sealed=!1;constructor(e,t,n){this.directory=e,this.options=t,this.cwd=n}async digest(e=this.owned){e||Ad(`No graph file was saved`);let t=await $e(e.file,le.O_RDONLY|le.O_NOFOLLOW);try{let[n,r]=await Promise.all([t.stat(),e.handle.stat()]);return(!n.isFile()||n.dev!==r.dev||n.ino!==r.ino)&&Ad(`The owned graph file was replaced`),$(await t.readFile())}finally{await t.close()}}enqueue(e){let t=++this.revision,n=this.pending.then(()=>e(t));return this.pending=n.then(()=>void 0,()=>void 0),n}check=()=>this.enqueue(async e=>{let t=this.owned;if(!t?.result)return!1;let{digest:n,result:r}=t,i=await this.digest(t),a=this.revision===e&&this.owned===t&&t.digest===n&&t.result===r&&i===n;return a&&(this.sealed=!0),a});receipt(){this.owned?.result||Ad(`No successful graph run was recorded`);let{file:e,digest:t,result:n}=this.owned;return{file:e,digest:t,result:n}}invoke(e,t){return this.sealed&&Ad(`The graph is accepted; submit its recorded successful run`),this.enqueue(()=>this.write(e,t)).catch(e=>(this.lastFailure=e,{ok:!1,diagnostic:Un(e)}))}async write(e,t){t.throwIfAborted(),this.lastFailure=void 0;let n=e;(!n||!jd(n.name)||typeof n.source!=`string`||typeof n.run!=`boolean`||Object.keys(n).some(e=>![`name`,`source`,`run`].includes(e)))&&Ad(`Expected only name, source and boolean run`),this.options.name!==void 0&&n.name!==this.options.name&&Ad(`The graph name must match --name`),this.owned&&(this.owned.result=void 0);let r=M(this.directory,`${n.name}.yaml`);if(this.owned&&this.owned.file!==r&&Ad(`This invocation owns one named graph file`),!this.owned)try{this.owned={file:r,handle:await $e(r,le.O_RDWR|le.O_CREAT|le.O_EXCL|le.O_NOFOLLOW,384),digest:$(``)}}catch(e){throw e.code===`EEXIST`&&Ad(`Graph already exists: ${r}; choose another --name`),e}let i=this.owned;await this.digest()!==i.digest&&Ad(`The owned graph was changed`);let a=Buffer.from(n.source);for(let e=0;e<a.length;){let{bytesWritten:t}=await i.handle.write(a,e,a.length-e,e);if(!t)throw Error(`Graph file write made no progress`);e+=t}await i.handle.truncate(a.length),await i.handle.sync(),i.digest=$(a);let o={...this.options,param:[]},s={cwd:this.cwd,signal:t,source:n.source},c=await Ef(r,{...o,dryRun:!0},{...s,connectNeeds:!0});`graph`in c||Ad(`No canonical graph was returned`),c.graph.deliverable.checkRef===`command`&&Ad(`Host command checks need a jailed verifier node`);let{nodes:l,edges:u,budget:d}=c.graph,f=u.reduce((e,t)=>e+(`maxTraversals`in t?(t.maxTraversals??1)-1:0),l.length),p=(f+1)*kd;if(d?.maxTokens!==void 0&&d.maxTokens<p&&Ad(`budget.maxTokens ${d.maxTokens} is below ${p}: ${f} agent spawns plus one reservation at ${kd} tokens per native turn`),await this.digest()!==i.digest&&Ad(`Graph changed during validation`),!n.run)return{file:r,graphDigest:c.graph.digest,validated:!0};let m=await Ef(r,o,{...s,graphDigest:c.graph.digest});return(!(`status`in m)||m.status!==`winner`||m.graphDigest!==c.graph.digest||await this.digest()!==i.digest)&&Ad(`The graph must succeed with unchanged YAML`),i.result=m,this.receipt()}async close(){await this.pending,await this.owned?.handle.close()}};async function Pd(e,t,n){let{runId:r,runDir:i,cwd:a,bridge:o,signal:s}=e,c=await o(),l=M(await I(M(N(),`.tangle`)),`graphs`);(Sf(a,l)||Sf(l,a))&&Ad(`The graph store must be outside the agent workspace; choose another working directory`);try{await Ze(l,{mode:448})}catch(e){if(e.code!==`EEXIST`)throw e}await I(l)!==l&&Ad(`The graph store redirects outside its canonical location`);let u=n.seat??Ar().seat,d=await Kl(a,s)(u,{node:`graph-designer`,cwd:a,signal:s,lastCandidate:!0});d||Ad(`No authenticated native subscription is available`);let{graphDesignerProfile:f}=await import(`@tangle-network/agent-runtime/profiles`),{supervisePursuit:p}=await import(`@tangle-network/agent-runtime/durable`),m=f({profile:{name:`graph-designer`,harness:d.harness,model:{provider:d.provider,default:d.model,...d.reasoningEffort===void 0?{}:{reasoningEffort:d.reasoningEffort}},prompt:{instructions:[`You are the sole graph designer. Author a canonical YAML graph for the requested intent, then qualify and run it using write_graph. Its nodes are complete AgentProfiles with a real independent verifier and declarative route/data outside check. Command checks execute on the host and are refused here; put executable verification in the verifier node's normal native tools. Read the supplied skills and preserve the user's task and authority.`,`Call write_graph with name, complete YAML source and run:false to validate; repair its concrete diagnostics, then call it with the identical source and run:true. The graph schema and executor are owned by the installed loader. Supply defaults for parameters needed by the first run. Only a real successful host run of the unchanged saved file passes. Submit that evidence using submit_result; explain concrete blockers using report_blocked.`]},tools:{agent_runtime_coordination_write_graph:!0,agent_runtime_coordination_submit_result:!0,agent_runtime_coordination_read_continuation:!0,agent_runtime_coordination_report_blocked:!0}}}),h=re(m),g=new Nd(l,{...n,seat:u},a),_={maxIterations:6,maxTokens:2e6,deadlineMs:9e5};try{let e=await p(m,{intent:t,name:n.name},{pursuitId:r,runId:r,runDir:i,signal:s,backend:{...c,timeoutMs:_.deadlineMs},budget:_,maxDepth:0,coordination:{authentication:!0,requestTimeoutMs:_.deadlineMs},deliverable:{describe:`The saved graph succeeds with unchanged YAML`,check:g.check,checkState:g.check},continuation:Md,resolveSupervisorTools:e=>e.runId!==r||e.nodeId!==r||e.depth!==0||e.identity.profileDigest!==h?[]:[{name:`write_graph`,description:`Save, validate and run this graph.`,inputSchema:{type:`object`,properties:{name:{type:`string`},source:{type:`string`},run:{type:`boolean`}},required:[`name`,`source`,`run`],additionalProperties:!1},handler:(t,n)=>((n.nodeId!==e.nodeId||n.ownerId!==e.ownerId||n.runId!==e.runId)&&Ad(`Wrong graph tool owner`),g.invoke(t,n.signal))}]});if(e.result.kind===`no-winner`||!await g.check()){if(g.lastFailure)throw g.lastFailure;let t=e.result.kind===`no-winner`?e.result.error?.message??e.result.reason:`The graph file changed after its successful run`;throw Object.assign(new W(`GRAPH_DESIGN_FAILED`,`Graph design did not finish`,t,`tangle graph new --help`),{runId:r,node:`graph-designer`})}return g.receipt()}finally{await g.close()}}function Fd(e){e.command(`new <intent>`).description(`Design, validate and run one portable graph`).option(`--seat <seat>`,`Use harness/model@effort for the designer and graph`).option(`--name <name>`,`Save this graph name`).action(async(e,t)=>{process.env.BRIDGE_JAIL_RW_PATHS?.trim()&&Ad(`Remove BRIDGE_JAIL_RW_PATHS before graph new; extra native write roots cannot contain its host store`),t.name!==void 0&&!jd(t.name)&&Ad(`Use letters, numbers and hyphens in --name`);let n=await wf({},n=>Pd(n,e,t));t.json?z(n):V(`Created ${n.file} · run ${n.result.runId}`)})}const Id=e=>e===void 0?[]:(Array.isArray(e)?e:[e]).map(String),Ld=(e=``)=>{let t=e.replace(/\s+/g,` `).trim(),n=t.match(/^.+?[.!?](?=\s|$)/)?.[0]??t;return n.length>90?`${n.slice(0,89)}…`:n},Rd=e=>e&&(e.all??[e]).map(e=>{let t=`equals`in e?`= ${JSON.stringify(e.equals)}`:`in`in e?`∈ ${JSON.stringify(e.in)}`:e.exists===!1?`absent`:`exists`;return`${e.node??``}${e.pointer||`/`} ${t}`}).join(` and `);function zd(e,t){try{let n=Mt(t,{uniqueKeys:!0,strict:!0}),r=[...n.errors,...n.warnings][0];if(r)throw r;let i=_e(e)===`.json`?JSON.parse(t):n.toJS();if(Array.isArray(i?.nodes)&&Array.isArray(i.edges))return i;throw Error(`A graph needs nodes and edges lists`)}catch(t){throw new W(`GRAPH_INVALID`,`Graph file ${e} cannot be read`,t.message,`tangle graph show --help`)}}function Bd(e,t){let n=zd(e,t),r=e=>{let t=String(e).match(/^\$\{params\.([\w-]+)\}$/)?.[1];return t?`${n.params?.[t]?.default??`?`} (params.${t})`:e},i=n.nodes.map(e=>{if(e.check){let t=String(e.check.command??``),n=t.match(RegExp(`#\\s*${e.id}:\\s*(.+)`))?.[1],r=t.split(`
-`).find(e=>e.trim()&&!/^\s*#/.test(e)),i=Ld(n??`$ ${r}`);return{id:e.id,kind:`check`,detail:i,body:t.trim()}}let t=[e.profile?.harness,e.profile?.model?.default],n=Id(e.seat).join(` › `)||t.filter(Boolean).join(` · `),r=e.profile?.prompt?.systemPrompt?.trim(),i=Ld(r),a=[n||`default seat`,i].filter(Boolean).join(`
-`);return{id:e.id,kind:`agent`,detail:a,body:r}});for(let e of n.gates??[]){let t=Id(e.choices).join(` | `);i.push({id:e.id,kind:`gate`,detail:`${t}\n${e.question}`})}let a=Id(n.entry?.map(e=>e.node??e)),o=[];if(a.length){i.unshift({id:`start`,kind:`start`,detail:``});let e=a.length>1?`fork`:``;o.push({from:[`start`],to:a,label:e,loop:!1})}for(let e of n.edges){let t=e.to?.finish===void 0?`stop`:`finish`,a=e.to?.[t]===void 0?void 0:`${t}:${e.to[t]}`,s=a===void 0?Id(e.to??e.join):[a];a&&!i.some(e=>e.id===a)&&i.push({id:a,kind:t,detail:``});let c=Id(e.kind===`analyzes`?e.over:e.from),l=n.edges.some(t=>!e.when&&t.when&&Id(t.from).join()===c.join()),u=e.maxTraversals!==void 0,d=[Rd(e.when)??(l?`otherwise`:e.kind?.replace(`routes`,``)),c.length>1&&`join`,s.length>1&&`fork`,u&&`↺ loop ≤${r(e.maxTraversals)}`];o.push({from:c,to:s,label:d.filter(Boolean).join(` · `),loop:u})}let s=n.check??{},c=[[`params`,Object.entries(n.params??{}).map(([e,t])=>`${e}${`default`in t?`=${JSON.stringify(t.default)}`:` (required)`}`).join(`, `)],[`workspace`,n.workspace],[`done when`,s.command?.command??s.command??Rd(s.all||s.pointer?s:void 0)],[``,s.describe]];return{name:n.graph??e.replace(/^.*\/|(\.graph)?\.(ya?ml|json)$/g,``),describe:n.describe?.trim(),facts:c.filter(e=>e[1]),nodes:i,edges:o}}const Vd={start:[`▶`,b.green],agent:[`●`,b.cyan.bold],check:[`▣`,b.yellow.bold],gate:[`◇`,b.magenta.bold],finish:[`✓`,b.green.bold],stop:[`■`,b.red.bold]};function Hd(e){let t=t=>e.nodes.find(e=>e.id===t)?.kind??`agent`,n=e=>{let[n,r]=Vd[t(e)];return r(`${n} ${e.replace(/^(finish|stop):/,``)}`)},r=Math.max(...e.nodes.map(e=>e.id.length))+4,i=[`${b.bold(`◆ ${e.name}`)}`,...e.describe?[`  ${e.describe}`]:[],``];for(let[t,n]of e.facts)i.push(`  ${b.dim(t.padEnd(10))} ${n}`);i.push(``,b.bold(`NODES`));for(let t of e.nodes.filter(e=>[`agent`,`check`,`gate`].includes(e.kind))){let[e,...a]=t.detail.split(`
+mv "$2.partial" "$2"`,y,b);let x=c(n.id),S=M(i,`remotes`,`${x.upstream}.git`),{issueTitle:C,issueBodyClean:w}=x,T=`https://github.com/${x.upstream}/issues/${x.issue}`,D=JSON.stringify({title:C,body:w,url:T,state:`OPEN`}),O=_.runId,k;{v||await _d(`rm -rf "$2" && git clone -q --bare "$1" "$2" && printf %s "$4" > "$2/tangle-issue-$3.json"`,b,S,`${x.issue}`,D);try{let e=l(x,y),n={...s,param:e,json:!0,...f&&{seat:f},...v&&{resume:_.runId}},r=await Ef(t.file,{...n,dryRun:!0},{signal:p,source:h.source,...v&&{cwd:v.cwd}});if(!(`graph`in r))throw Error(`Replay did not load locally`);if(!r.graph.budget)throw Error(`Replay has no runtime budget`);try{await d({runId:_.runId,budget:r.graph.budget,sourceDigest:t.sourceDigest,graphDigest:r.graph.digest})}catch(e){throw o.incomplete=e.message,e}let i;try{i=await Ef(t.file,n,{signal:p,source:h.source,runId:_.runId,graphDigest:r.graph.digest,...v&&{cwd:v.cwd}})}finally{await d()}O=`runId`in i?i.runId:void 0;let a=JSON.parse(`text`in i?i.text:`{}`);k=Object.values(a).find(e=>e?.json?.branch)?.json?.branch}catch(e){let t=e;if(t.code!==`GRAPH_RUN_FAILED`)throw e;O=t.runId;let r=u.readout();if(!r.tokensKnown||r.tokensLeft<0||r.iterationsLeft<0||r.deadlineMs>0&&Date.now()>=r.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new Nt(o.incomplete,{cause:e});if(e.runtimeFailures?.some(({failure:e})=>xd(e)))throw new Nt(n.id,{cause:e})}let r=M(N(),`.tangle`,`runs`,`${O}`),i=(await e.durableRunToolSpans(r)).map(e=>e.toolName).find(e=>/web.?(search|fetch)/i.test(e));i&&e.stop.abort(Error(`${O} called ${i}: not offline`)),e.stop.signal.throwIfAborted();let a=k?await _d(`b=$(git --git-dir "$1" rev-parse main); git --git-dir "$2" diff --binary "$b" "$3"`,b,S,k):``,c=await e.readSettleRecord(r),m=c&&vl(c).tokenUsage,g=u.readout();if(!g.tokensKnown||g.tokensLeft<0||g.iterationsLeft<0||g.deadlineMs>0&&Date.now()>=g.deadlineMs)throw o.incomplete=`Shared campaign budget exhausted or its accounting is incomplete`,new Nt(o.incomplete);return{patch:a,tokens:m?.input!=null&&m.output!=null?{inputTokens:m.input??0,outputTokens:m.output??0}:bd(t.cap),...O&&{runId:O}}}}}function kd(e){let{campaigns:t,files:n,probe:r,reps:i,repList:a,at:o,state:s,wilson:c,decidePairedPromotion:l}=e,u=e=>e.reduce((e,t)=>e+t,0)/e.length,d=t.map((e,t)=>{let r=e.cells.filter(e=>!e.error),i=e=>Object.values(e.judgeScores)[0]?.composite??0,a=r.filter(e=>e.rep===0),o=a.filter(e=>i(e)>=1).length,s=e.cells.filter(e=>e.error),{inputTokens:l,outputTokens:u,usageComplete:d}=e.aggregates.cost;return{graph:n[t],resolved:o,n:a.length,runDir:e.runDir,wilson95:c(o,a.length),unmeasured:s.map(e=>`${e.cellId}: ${e.error}`),tokens:l+u,usageComplete:d,rewards:Object.fromEntries(r.map(e=>[e.cellId,i(e)]))}}),f=({rewards:e},t)=>a.flatMap(n=>e[`${t}:${n}`]??[]),[p,...m]=d;return{reports:d,paired:m.map((e,t)=>{let a=[...r].filter(t=>f(p,t).length&&f(e,t).length),c=[...new Set(a.map(e=>o(e).upstream))],d=c.map(e=>a.filter(t=>o(t).upstream===e)),m=e=>d.map(t=>u(t.map(t=>u(f(e,t))))),[h,g]=[m(p),m(e)];if(!(!s.incomplete&&p.usageComplete&&e.usageComplete&&a.length===r.size&&a.every(t=>f(p,t).length===i&&f(e,t).length===i)))return{arm:n[t+1],cases:a.length,repos:c.length,decision:`hold`,why:s.incomplete??`Campaign evidence is incomplete`,sufficient:!1,rates:[h.length?u(h):null,g.length?u(g):null],delta:null,interval95:null,method:null};let _=l(h,g,{continuous:!0}),{n:v,minimumPairs:y,low:b,threshold:x}=_,S=_.promote?void 0:!_.sufficient&&`insufficient pairs: n ${v} < minimumPairs ${y}`||b<=x&&`interval low ${b} ≤ threshold ${x}`||_.exactTestVetoes&&`McNemar exact test vetoes`||`indeterminate interval`;return{arm:n[t+1],cases:a.length,repos:c.length,rates:[u(h),u(g)],delta:_.delta,method:_.method,interval95:[_.low,_.high],sufficient:_.sufficient,decision:_.promote?`promote`:`hold`,why:S}})}}const Ad=1e5;function jd(e){throw new W(`GRAPH_INVALID`,`Graph creation failed`,e,`tangle graph new --help`)}function Md(e){return typeof e==`string`&&/^[a-z0-9][a-z0-9-]{0,62}$/i.test(e)}const Nd={maxBarren:2,failures:`verbatim`,panel:`off`,bar:`on`,profile:{id:`graph-new-v1`,opening:`The graph has not passed its outside check.`,plan:`Repair the concrete diagnostics with write_graph, run the saved file and submit the actual evidence.`,rules:`Completion requires a successful host run and unchanged YAML. Retain working graph content when blocked.`,headings:{failures:`Failures`,protected:`Passing checks`,changed:`Changes`,findings:`Findings`,bar:`Acceptance`,plan:`Next`,rules:`Rules`}}};var Pd=class{owned;lastFailure;pending=Promise.resolve();revision=0;sealed=!1;constructor(e,t,n){this.directory=e,this.options=t,this.cwd=n}async digest(e=this.owned){e||jd(`No graph file was saved`);let t=await $e(e.file,le.O_RDONLY|le.O_NOFOLLOW);try{let[n,r]=await Promise.all([t.stat(),e.handle.stat()]);return(!n.isFile()||n.dev!==r.dev||n.ino!==r.ino)&&jd(`The owned graph file was replaced`),$(await t.readFile())}finally{await t.close()}}enqueue(e){let t=++this.revision,n=this.pending.then(()=>e(t));return this.pending=n.then(()=>void 0,()=>void 0),n}check=()=>this.enqueue(async e=>{let t=this.owned;if(!t?.result)return!1;let{digest:n,result:r}=t,i=await this.digest(t),a=this.revision===e&&this.owned===t&&t.digest===n&&t.result===r&&i===n;return a&&(this.sealed=!0),a});receipt(){this.owned?.result||jd(`No successful graph run was recorded`);let{file:e,digest:t,result:n}=this.owned;return{file:e,digest:t,result:n}}invoke(e,t){return this.sealed&&jd(`The graph is accepted; submit its recorded successful run`),this.enqueue(()=>this.write(e,t)).catch(e=>(this.lastFailure=e,{ok:!1,diagnostic:Un(e)}))}async write(e,t){t.throwIfAborted(),this.lastFailure=void 0;let n=e;(!n||!Md(n.name)||typeof n.source!=`string`||typeof n.run!=`boolean`||Object.keys(n).some(e=>![`name`,`source`,`run`].includes(e)))&&jd(`Expected only name, source and boolean run`),this.options.name!==void 0&&n.name!==this.options.name&&jd(`The graph name must match --name`),this.owned&&(this.owned.result=void 0);let r=M(this.directory,`${n.name}.yaml`);if(this.owned&&this.owned.file!==r&&jd(`This invocation owns one named graph file`),!this.owned)try{this.owned={file:r,handle:await $e(r,le.O_RDWR|le.O_CREAT|le.O_EXCL|le.O_NOFOLLOW,384),digest:$(``)}}catch(e){throw e.code===`EEXIST`&&jd(`Graph already exists: ${r}; choose another --name`),e}let i=this.owned;await this.digest()!==i.digest&&jd(`The owned graph was changed`);let a=Buffer.from(n.source);for(let e=0;e<a.length;){let{bytesWritten:t}=await i.handle.write(a,e,a.length-e,e);if(!t)throw Error(`Graph file write made no progress`);e+=t}await i.handle.truncate(a.length),await i.handle.sync(),i.digest=$(a);let o={...this.options,param:[]},s={cwd:this.cwd,signal:t,source:n.source},c=await Ef(r,{...o,dryRun:!0},{...s,connectNeeds:!0});`graph`in c||jd(`No canonical graph was returned`),c.graph.deliverable.checkRef===`command`&&jd(`Host command checks need a jailed verifier node`);let{nodes:l,edges:u,budget:d}=c.graph,f=u.reduce((e,t)=>e+(`maxTraversals`in t?(t.maxTraversals??1)-1:0),l.length),p=(f+1)*Ad;if(d?.maxTokens!==void 0&&d.maxTokens<p&&jd(`budget.maxTokens ${d.maxTokens} is below ${p}: ${f} agent spawns plus one reservation at ${Ad} tokens per native turn`),await this.digest()!==i.digest&&jd(`Graph changed during validation`),!n.run)return{file:r,graphDigest:c.graph.digest,validated:!0};let m=await Ef(r,o,{...s,graphDigest:c.graph.digest});return(!(`status`in m)||m.status!==`winner`||m.graphDigest!==c.graph.digest||await this.digest()!==i.digest)&&jd(`The graph must succeed with unchanged YAML`),i.result=m,this.receipt()}async close(){await this.pending,await this.owned?.handle.close()}};async function Fd(e,t,n){let{runId:r,runDir:i,cwd:a,bridge:o,signal:s}=e,c=await o(),l=M(await I(M(N(),`.tangle`)),`graphs`);(Cl(a,l)||Cl(l,a))&&jd(`The graph store must be outside the agent workspace; choose another working directory`);try{await Ze(l,{mode:448})}catch(e){if(e.code!==`EEXIST`)throw e}await I(l)!==l&&jd(`The graph store redirects outside its canonical location`);let u=n.seat??Ar().seat,d=await ql(a,s)(u,{node:`graph-designer`,cwd:a,signal:s,lastCandidate:!0});d||jd(`No authenticated native subscription is available`);let{graphDesignerProfile:f}=await import(`@tangle-network/agent-runtime/profiles`),{supervisePursuit:p}=await import(`@tangle-network/agent-runtime/durable`),m=f({profile:{name:`graph-designer`,harness:d.harness,model:{provider:d.provider,default:d.model,...d.reasoningEffort===void 0?{}:{reasoningEffort:d.reasoningEffort}},prompt:{instructions:[`You are the sole graph designer. Author a canonical YAML graph for the requested intent, then qualify and run it using write_graph. Its nodes are complete AgentProfiles with a real independent verifier and declarative route/data outside check. Command checks execute on the host and are refused here; put executable verification in the verifier node's normal native tools. Read the supplied skills and preserve the user's task and authority.`,`Call write_graph with name, complete YAML source and run:false to validate; repair its concrete diagnostics, then call it with the identical source and run:true. The graph schema and executor are owned by the installed loader. Supply defaults for parameters needed by the first run. Only a real successful host run of the unchanged saved file passes. Submit that evidence using submit_result; explain concrete blockers using report_blocked.`]},tools:{agent_runtime_coordination_write_graph:!0,agent_runtime_coordination_submit_result:!0,agent_runtime_coordination_read_continuation:!0,agent_runtime_coordination_report_blocked:!0}}}),h=re(m),g=new Pd(l,{...n,seat:u},a),_={maxIterations:6,maxTokens:2e6,deadlineMs:9e5};try{let e=await p(m,{intent:t,name:n.name},{pursuitId:r,runId:r,runDir:i,signal:s,backend:{...c,timeoutMs:_.deadlineMs},budget:_,maxDepth:0,coordination:{authentication:!0,requestTimeoutMs:_.deadlineMs},deliverable:{describe:`The saved graph succeeds with unchanged YAML`,check:g.check,checkState:g.check},continuation:Nd,resolveSupervisorTools:e=>e.runId!==r||e.nodeId!==r||e.depth!==0||e.identity.profileDigest!==h?[]:[{name:`write_graph`,description:`Save, validate and run this graph.`,inputSchema:{type:`object`,properties:{name:{type:`string`},source:{type:`string`},run:{type:`boolean`}},required:[`name`,`source`,`run`],additionalProperties:!1},handler:(t,n)=>((n.nodeId!==e.nodeId||n.ownerId!==e.ownerId||n.runId!==e.runId)&&jd(`Wrong graph tool owner`),g.invoke(t,n.signal))}]});if(e.result.kind===`no-winner`||!await g.check()){if(g.lastFailure)throw g.lastFailure;let t=e.result.kind===`no-winner`?e.result.error?.message??e.result.reason:`The graph file changed after its successful run`;throw Object.assign(new W(`GRAPH_DESIGN_FAILED`,`Graph design did not finish`,t,`tangle graph new --help`),{runId:r,node:`graph-designer`})}return g.receipt()}finally{await g.close()}}function Id(e){e.command(`new <intent>`).description(`Design, validate and run one portable graph`).option(`--seat <seat>`,`Use harness/model@effort for the designer and graph`).option(`--name <name>`,`Save this graph name`).action(async(e,t)=>{process.env.BRIDGE_JAIL_RW_PATHS?.trim()&&jd(`Remove BRIDGE_JAIL_RW_PATHS before graph new; extra native write roots cannot contain its host store`),t.name!==void 0&&!Md(t.name)&&jd(`Use letters, numbers and hyphens in --name`);let n=await wf({},n=>Fd(n,e,t));t.json?z(n):V(`Created ${n.file} · run ${n.result.runId}`)})}const Ld=e=>e===void 0?[]:(Array.isArray(e)?e:[e]).map(String),Rd=(e=``)=>{let t=e.replace(/\s+/g,` `).trim(),n=t.match(/^.+?[.!?](?=\s|$)/)?.[0]??t;return n.length>90?`${n.slice(0,89)}…`:n},zd=e=>e&&(e.all??[e]).map(e=>{let t=`equals`in e?`= ${JSON.stringify(e.equals)}`:`in`in e?`∈ ${JSON.stringify(e.in)}`:e.exists===!1?`absent`:`exists`;return`${e.node??``}${e.pointer||`/`} ${t}`}).join(` and `);function Bd(e,t){try{let n=Mt(t,{uniqueKeys:!0,strict:!0}),r=[...n.errors,...n.warnings][0];if(r)throw r;let i=_e(e)===`.json`?JSON.parse(t):n.toJS();if(Array.isArray(i?.nodes)&&Array.isArray(i.edges))return i;throw Error(`A graph needs nodes and edges lists`)}catch(t){throw new W(`GRAPH_INVALID`,`Graph file ${e} cannot be read`,t.message,`tangle graph show --help`)}}function Vd(e,t){let n=Bd(e,t),r=e=>{let t=String(e).match(/^\$\{params\.([\w-]+)\}$/)?.[1];return t?`${n.params?.[t]?.default??`?`} (params.${t})`:e},i=n.nodes.map(e=>{if(e.check){let t=String(e.check.command??``),n=t.match(RegExp(`#\\s*${e.id}:\\s*(.+)`))?.[1],r=t.split(`
+`).find(e=>e.trim()&&!/^\s*#/.test(e)),i=Rd(n??`$ ${r}`);return{id:e.id,kind:`check`,detail:i,body:t.trim()}}let t=[e.profile?.harness,e.profile?.model?.default],n=Ld(e.seat).join(` › `)||t.filter(Boolean).join(` · `),r=e.profile?.prompt?.systemPrompt?.trim(),i=Rd(r),a=[n||`default seat`,i].filter(Boolean).join(`
+`);return{id:e.id,kind:`agent`,detail:a,body:r}});for(let e of n.gates??[]){let t=Ld(e.choices).join(` | `);i.push({id:e.id,kind:`gate`,detail:`${t}\n${e.question}`})}let a=Ld(n.entry?.map(e=>e.node??e)),o=[];if(a.length){i.unshift({id:`start`,kind:`start`,detail:``});let e=a.length>1?`fork`:``;o.push({from:[`start`],to:a,label:e,loop:!1})}for(let e of n.edges){let t=e.to?.finish===void 0?`stop`:`finish`,a=e.to?.[t]===void 0?void 0:`${t}:${e.to[t]}`,s=a===void 0?Ld(e.to??e.join):[a];a&&!i.some(e=>e.id===a)&&i.push({id:a,kind:t,detail:``});let c=Ld(e.kind===`analyzes`?e.over:e.from),l=n.edges.some(t=>!e.when&&t.when&&Ld(t.from).join()===c.join()),u=e.maxTraversals!==void 0,d=[zd(e.when)??(l?`otherwise`:e.kind?.replace(`routes`,``)),c.length>1&&`join`,s.length>1&&`fork`,u&&`↺ loop ≤${r(e.maxTraversals)}`];o.push({from:c,to:s,label:d.filter(Boolean).join(` · `),loop:u})}let s=n.check??{},c=[[`params`,Object.entries(n.params??{}).map(([e,t])=>`${e}${`default`in t?`=${JSON.stringify(t.default)}`:` (required)`}`).join(`, `)],[`workspace`,n.workspace],[`done when`,s.command?.command??s.command??zd(s.all||s.pointer?s:void 0)],[``,s.describe]];return{name:n.graph??e.replace(/^.*\/|(\.graph)?\.(ya?ml|json)$/g,``),describe:n.describe?.trim(),facts:c.filter(e=>e[1]),nodes:i,edges:o}}const Hd={start:[`▶`,b.green],agent:[`●`,b.cyan.bold],check:[`▣`,b.yellow.bold],gate:[`◇`,b.magenta.bold],finish:[`✓`,b.green.bold],stop:[`■`,b.red.bold]};function Ud(e){let t=t=>e.nodes.find(e=>e.id===t)?.kind??`agent`,n=e=>{let[n,r]=Hd[t(e)];return r(`${n} ${e.replace(/^(finish|stop):/,``)}`)},r=Math.max(...e.nodes.map(e=>e.id.length))+4,i=[`${b.bold(`◆ ${e.name}`)}`,...e.describe?[`  ${e.describe}`]:[],``];for(let[t,n]of e.facts)i.push(`  ${b.dim(t.padEnd(10))} ${n}`);i.push(``,b.bold(`NODES`));for(let t of e.nodes.filter(e=>[`agent`,`check`,`gate`].includes(e.kind))){let[e,...a]=t.detail.split(`
 `);i.push(`  ${n(t.id)}${` `.repeat(Math.max(1,r-t.id.length))}${e}`);for(let e of a)i.push(`${` `.repeat(r+4)}${b.dim(e)}`)}i.push(``,b.bold(`FLOW`));for(let t of e.edges){let e=`  ${t.from.map(n).join(b.dim(` + `))} ${b.dim(`─▶`)} ${t.to.map(n).join(b.dim(` ∥ `))}`,r=t.loop?b.magenta(t.label):b.blue(t.label);i.push(...t.label.length+kt(e).length>100?[e,`      ${r}`]:[`${e}  ${r}`])}return i.join(`
-`)}async function Ud(e,t){let n=M(t,`dist`,`graph-show`),[r,i]=await Promise.all([`viewer.iife.js`,`styles.css`].map(e=>F(M(n,e),`utf8`))),a=(e=``)=>e.replace(/<\/(script)/gi,`<\\/$1`).replace(/<!--/g,`<\\!--`),o=e.name.replace(/[^\w.-]+/g,`-`),s=`<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${o} · tangle graph</title>
+`)}async function Wd(e,t){let n=M(t,`dist`,`graph-show`),[r,i]=await Promise.all([`viewer.iife.js`,`styles.css`].map(e=>F(M(n,e),`utf8`))),a=(e=``)=>e.replace(/<\/(script)/gi,`<\\/$1`).replace(/<!--/g,`<\\!--`),o=e.name.replace(/[^\w.-]+/g,`-`),s=`<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${o} · tangle graph</title>
 <meta name="description" content="${(e.describe??o).replace(/[&<>"]/g,``)}">
 <style>${i}html,body,#root{margin:0;height:100%;font-family:ui-sans-serif,system-ui,sans-serif}</style></head>
 <body><div id="root"></div><script id="graph" type="application/json">${JSON.stringify(e).replace(/</g,`\\u003c`)}<\/script>
-<script>${a(r)}<\/script></body></html>`,c=M(await Qe(M(Ce(),`tangle-graph-`)),`${o}.html`);return await L(c,s,{mode:384}),c}function Wd(e,t,n){e.command(`show <name-or-file>`).description(`Draw a graph file: labelled nodes, routes, loops and stops`).option(`--open`,`Write one offline page and open it in the browser`).action(async(e,r)=>{let i=await I(t(e,process.cwd())),a=Bd(i,await F(i,`utf8`));if(r.json)return z(a);if(!r.open)return console.log(Hd(a));let o=await Ud(a,n);V(await fa(Gt(o).href)?`Opened ${o}`:`Open ${o}`)})}async function Gd(e){if(!Gr(e.apiKey)){if(e.json||e.dryRun||!process.stdin.isTTY)return;await xa({baseUrl:e.sandboxBaseUrl,signal:e.signal})}return Oi(e)}async function Kd(e,t,n){let r=gf(t.parameter),i=n??await Gd(t);if(!i)throw new W(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let a=await i.connections.start(e,{cli:!0,connectionParameters:r,...t.scope?.length?{requestedScopes:t.scope}:{}});return t.json?(z(vf(a)),a):(_f(a,t.browser===!1?!1:await fa(a.redirectUrl),t.wait),a)}async function qd(e,t,n,r){let i=async()=>{n.signal?.throwIfAborted();let{connections:i}=await e.connections.list(),a=i.filter(e=>e.status===`active`&&e.providerId.toLowerCase()===t.trim().toLowerCase());return a.length?Ne(a,r===void 0?t:`${t}:${r}`):void 0},a=await i();if(a||n.json||n.dryRun||!process.stdin.isTTY)return a;let o=await Kd(t,{...n,wait:!0},e);for(;!a&&Date.now()<Date.parse(o.expiresAt);)await Le(1e3,void 0,{signal:n.signal}),a=await i();return a}function Jd(){let e=new S(`hub`).description(`Discover and run Tangle Hub tools`);return Yd(e),Xd(e),Zd(e),Qd(e),$d(e),e}function Yd(e){e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--key-env <name>`,`Connect an API-key provider using this environment variable; never prints the key`).option(`--metadata <json>`,`Provider setup metadata for API-key connections`).option(`--scope <scope>`,`Request an OAuth scope; repeatable, must stay within the host's grant`,(e,t)=>[...t,e],[]).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,(e,t)=>[...t,e],[]).action(async(e,t)=>{if(t.keyEnv){if(t.scope?.length)throw Error(`--scope applies to OAuth connections, not --key-env.`);let n=process.env[t.keyEnv];if(!n?.trim())throw Error(`Environment variable '${t.keyEnv}' is empty or unavailable.`);let r=await Gd(t);if(!r)throw new W(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let i;if(t.metadata!==void 0)try{i=JSON.parse(t.metadata)}catch{throw Error(`--metadata must be valid JSON.`)}let a=await r.connections.connectApiKey(e,n,i);t.json?z(a):V(`Connected ${a.connection.providerId} as ${a.connection.id}.`);return}if(t.metadata!==void 0)throw Error(`--metadata requires --key-env.`);await Kd(e,t)});let t=new S(`connections`).description(`List Hub provider connections`).action(async e=>{let t=await(await Oi(e)).connections.list();e.json?z(t):hf(t.connections)});t.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=await Oi(t),r=await ui(n,e);if(!t.force&&!await Bi(`Revoke Hub connection ${r}? `,`--force`)){V(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){z(i);return}V(`Revoked Hub connection ${i.connection.id}.`)}),e.addCommand(t)}function Xd(e){e.command(`providers [provider]`).description(`Show provider setup and action catalog; use hub events for trigger readiness`).action(async(e,t)=>{let n=await(await Oi(t)).connections.providers(),r=n.providers.filter(t=>!e||t.providerId===e.toLowerCase());if(e&&!r.length)throw Error(`Provider '${e}' is absent from this deployment's catalog.`);if(t.json)return z({...n,providers:r});R(r,[{key:`providerId`,header:`Provider`},{key:`authKind`,header:`Auth`},{key:`configured`,header:`Connect configured`},{key:`actionCount`,header:`Catalog actions`}])}),e.command(`events [provider]`).description(`Discover deployed trigger events and ingress readiness separately from callable tools`).action(async(e,t)=>{let n=await Oi(t),[r,i]=await Promise.all([n.connections.providers(),n.workflows.catalogs()]),a=[...new Set([...r.providers.map(e=>e.providerId),...i.providerEventProviders])];if(e&&!a.includes(e.toLowerCase()))throw Error(`Provider '${e}' is absent from this deployment's catalog.`);let o=a.filter(t=>!e||t===e.toLowerCase()).map(e=>({provider:e,supported:i.providerEventProviders.includes(e),ingressConfigured:r.providers.find(t=>t.providerId===e)?.eventIngressConfigured??null,catalog:i.triggerEvents[e]??null}));if(t.json)return z({providers:o});R(o.map(e=>({...e,ingress:e.ingressConfigured===null?`unknown`:e.ingressConfigured?`ready`:`setup required`,events:e.catalog?.events.map(e=>e.id).join(`, `)??`no published vocabulary`})),[{key:`provider`,header:`Provider`},{key:`supported`,header:`Event source supported`},{key:`ingress`,header:`Ingress`},{key:`events`,header:`Events`}])})}function Zd(e){let t=new S(`permissions`).description(`Manage Hub action permissions`);t.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await Oi(e),n=await ui(t,e.connection),r=await t.permissions.list(n);e.json?z(r):uf(r.policies)}),t.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=df(e.decision),n=await Oi(e),r=await ui(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});e.json?z(i):uf([i.policy])}),t.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await Oi(e),n=await ui(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){z(r);return}V(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}),e.addCommand(t),e.addCommand(tf())}function Qd(e){let t=new S(`tools`).description(`Discover Hub tools`);t.command(`sources`).description(`List Hub tool sources`).action(async e=>{let t=await(await Oi(e)).tools.sources();e.json?z(t):ff(t.sources)}),t.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).action(async(e,t)=>{let n=await(await Oi(t)).tools.describe(e);t.json?z(n):pf(n.tool)}),t.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).action(async(e,t)=>{let n=await(await Oi(t)).tools.search(e.join(` `),{provider:t.provider});t.json?z(n):lf(n.tools)}),e.addCommand(t),e.addCommand(ef(`call`)),e.addCommand(ef(`exec`))}function $d(e){e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).action(async(e,t)=>{if(rf(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await Oi(t);of(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}),e.command(`status`).description(`Show Hub auth and connection status`).action(async e=>{let t=await(await Oi(e)).status();e.json?z(t):yf(t)})}function ef(e){return new S(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).action(async(e,t)=>{let{args:n,approve:r}=nf(e,t),{path:i,input:a}=cf(n),o=await Oi(t),s=t.connection?await ui(o,t.connection):void 0;z((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)})}function tf(){let e=new S(`approvals`).description(`List and resolve Hub execution approvals`);e.command(`list`).description(`List pending Hub execution approvals`).action(async e=>{let t=await(await Oi(e)).approvals.list();e.json?z(t):af(t.approvals)});for(let t of[`approve`,`deny`])e.command(t).description(`${t===`approve`?`Approve`:`Deny`} a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).action(async(e,n)=>{rf(e),of(await(await Oi(n)).approvals[t](e),n.json===!0)});return e}function nf(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function rf(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function af(e){R(e,[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`connectionId`,header:`Connection`},{key:`status`,header:`Status`},{key:`expiresAt`,header:`Expires`}])}function of(e,t){if(t){z(sf(e));return}V(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&V("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function sf(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function cf(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e[e.length-1];try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function lf(e){R(e.map(e=>({...e,provider:e.providerId??e.requiredConnectionProviderId,connection:mf(e)})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policyState`,header:`Policy`}])}function uf(e){R(e,[{key:`connectionId`,header:`Connection`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updatedAt`,header:`Updated`}])}function df(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function ff(e){R(e,[{key:`sourceId`,header:`Source`},{key:`displayName`,header:`Provider`},{key:`toolCount`,header:`Tools`},{key:`connectionStatus`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function pf(e){U({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:mf(e),Policy:e.policyState}),e.inputSchema!==void 0&&(V(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(V(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function mf(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function hf(e){R(e.map(e=>({...e,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `)})),[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsedAt`,header:`Last Used`}])}function gf(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function _f(e,t,n=!1){t?V(`Opened browser to connect ${e.provider}.`):(V(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),V(n?`Finish authorization in the browser; this run resumes when connected.`:"Finish authorization in the browser, then rerun `tangle hub status`.")}function vf(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function yf(e){let{principal:t,connections:n}=e;V(`Hub status`),U({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&V(`Some providers require reconnect.`)}const bf=t(import.meta.url);if(!bf)throw Error(`Tangle CLI package metadata was not found`);const xf=ge(bf),$=e=>w(`sha256`).update(e).digest(`hex`);function Sf(e,t){let n=ye(e,t);return n!==`..`&&!n.startsWith(`..${xe}`)&&!ve(n)}function Cf(e,t){if(/[\\/]/.test(e)||/\.(yaml|yml|json)$/.test(e))return be(t,e);let n=t;for(;!ue(M(n,`.git`))&&ge(n)!==n;)n=ge(n);ue(M(n,`.git`))||(n=t);let r=[`yaml`,`yml`,`json`].flatMap(e=>[`graph.${e}`,e]),i=[n,N()].flatMap(t=>r.map(n=>M(t,`.tangle/graphs/${e}.${n}`))),a=i.find(ue);if(a)return a;throw new W(`GRAPH_NOT_FOUND`,`Graph '${e}' was not found`,`Looked in ${i.join(`, `)}`,`tangle graph --help`)}async function wf(e,t){return qc(e.signal,async n=>{let r=e.runId??E(),i,a=new Set,{graphNativeRedaction:o}=await import(`./graph-native-Cl6SphYB.mjs`),s=o();try{let o=M(N(),`.tangle`,`runs`,r);await Ze(o,{recursive:!0,mode:448});let c=await I(M(N(),`.tangle`)),l=await I(e.cwd??process.cwd()),u=[`runs`,`graph-registry`,`graphs`].some(e=>Sf(l,M(c,e))||Sf(M(c,e),l))?M(N(),`.tangle`,`workspaces`,r):l;await Ze(u,{recursive:!0,mode:448});let d;return await t({runId:r,runDir:o,cwd:u,bridge:t=>d??=(async()=>{n.throwIfAborted();let r=T(32).toString(`hex`),{loadConfig:c,startServer:l}=await import(`cli-bridge`),d=M(xf,`dist`,`stdio.mjs`),f={...process.env,BRIDGE_HOST:`127.0.0.1`,BRIDGE_BEARER:r,BRIDGE_DATA_DIR:M(o,`bridge`),BRIDGE_BACKENDS:Gl,BRIDGE_JAIL_MODE:`fs-jail`,BRIDGE_JAIL_FALLBACK:`deny`,BRIDGE_JAIL_NETWORK:`relay`,BRIDGE_SUBSCRIPTIONS_ONLY:`1`};e.relayAllow?f.BRIDGE_JAIL_RELAY_ALLOW=e.relayAllow:delete f.BRIDGE_JAIL_RELAY_ALLOW;let p=c(f);t&&p.jailReadablePaths.push(d),i=await l({cwd:u,config:{...p,port:0},handleSignals:!1,quiet:!0,onRunRedaction:s.observe,mcpSecrets:{async get(t){let n=e.mcpSecretEnv,r=n&&Object.hasOwn(n,t)?n[t]:void 0,i=r===void 0?void 0:process.env[r];return i&&a.add(i),i}},hub:t?{client:t,hash:Kc,serverForGrant:e=>{if(a.add(e),!i)throw Error(`Hub host is not ready`);return{transport:`stdio`,command:process.execPath,args:[{kind:`public`,value:d}],env:{TANGLE_HUB_MCP_ENDPOINT:{kind:`public`,value:`${i.url}/hub/mcp/grants/${e}`}}}}}:void 0});let{graphNativeCapture:m}=await import(`./graph-native-Cl6SphYB.mjs`);return{harnessTranscript:m({bridgeUrl:i.url,bridgeBearer:r,cwd:u,privateMcpSecrets:()=>[...a],redact:s.redact}),backend:`bridge`,bridgeUrl:i.url,bridgeBearer:r,cwd:u}})(),signal:n})}catch(t){throw t instanceof Error&&Object.assign(t,{runId:e.errorRunId??r}),t}finally{try{await i?.close()}finally{s.close(),a.clear()}}},e.fix??`tangle graph --help`)}function Tf(e,t){return[`tangle graph run`,qe(e),...t.dryRun?[`--dry-run`]:[],...t.cloud?[`--cloud`]:[],...t.deploy?[`--deploy`,qe(t.deploy)]:[],...t.workflow?[`--workflow`,qe(t.workflow)]:[],...t.resume?[`--resume`,qe(t.resume)]:[],...t.seat?[`--seat`,qe(t.seat)]:[],...t.seatAccount?[`--seat-account`,qe(t.seatAccount)]:[],...t.seatCommand?[`--seat-command`,qe(t.seatCommand)]:[],...t.param.flatMap(e=>[`--param`,qe(e)])].join(` `)}async function Ef(e,t,n={}){let r=n,i=Tf(e,t);return await qc(r.signal,async n=>{n.throwIfAborted();let a=ul(t.mcpSecret);if(t.resume&&!t.resume.startsWith(`wfrun_`)&&(t.workflow||t.deploy)&&Z(`A local run cannot move to a cloud deployment`),t.deploy&&!t.cloud&&!t.workflow&&!t.resume?.startsWith(`wfrun_`))throw new W(`GRAPH_DEPLOY_INVALID`,`Deployment settings require cloud placement`,`Use --cloud to bind cloud triggers and settings`,`tangle graph run --help`);let o=await I(Cf(e,r.cwd??process.cwd())),s=r.source??await F(o,`utf8`),c=t.resume&&!t.resume.startsWith(`wfrun_`)?await zl(t.resume):void 0,l=r.taskWorkspace??(t.taskWorkspace?await Ml(t.taskWorkspace):void 0)??c?.taskWorkspace;if(c&&(l?Ol(l):null)!==(c.taskWorkspace?Ol(c.taskWorkspace):null)&&Z(`The recorded task workspace snapshot changed`),l&&(t.cloud||t.workflow||t.resume?.startsWith(`wfrun_`)))throw Error(`Local private task workspace artifacts cannot be dispatched to a cloud backend`);let u=c?.runId??r.runId??E(),d=l&&!r.taskWorkspace?await Pl(l,{runId:u,resumeCwd:c?.cwd,signal:n,validationOnly:t.dryRun===!0&&!c&&!r.runId}):void 0;d&&(r={...r,runId:u,cwd:d.cwd,taskWorkspace:l});try{if(!t.resume&&(t.cloud||t.workflow)||t.resume?.startsWith(`wfrun_`))return Su(o,s,t,n);let e=await bl(),l=$(s),u=Object.entries(du(t.param,`param`)??{}),d=Object.fromEntries(u.filter(([e])=>!e.startsWith(`gate.`))),f=Object.fromEntries(u.filter(([e])=>e.startsWith(`gate.`)).map(([e,t])=>[e.slice(5),t])),p=Ae.parse(t.mcpPolicy??c?.mcpPolicy??{}),m=e.graphRegistry(M(N(),`.tangle`,`graph-registry`)),h;if(c){await I(c.cwd)!==c.cwd&&Z(`The recorded workspace identity changed`),c.file!==o&&Z(`The recorded graph source path changed`);let n=await e.loadGraph(m,c.graphDigest);n||Z(`The recorded executable graph is unavailable`),h=e.validateStoredGraph(n),Ul(c,t,l,d,f)}let g={apiKey:t.apiKey,sandboxBaseUrl:t.baseUrl,signal:n,json:t.json,dryRun:t.dryRun&&!r.connectNeeds},_,v=()=>_??=Gd(g),y=new Map,b=(e,{account:t})=>{let n=JSON.stringify([e.trim().toLowerCase(),t?.toLowerCase()]),r=y.get(n)??(async()=>{let n=await v(),r=n&&await qd(n,e,g,t);return r?{connectionId:r,capabilities:[`*`]}:void 0})();return y.set(n,r),r},x=async i=>{if(n.throwIfAborted(),c&&h)return Jc(h,c.gateChoices??{}),{graph:h,params:c.params};let a=await e.loadGraphFile(o,{source:s,seat:t.seat??(r.defaultSeat===void 0?Ar().seat:r.defaultSeat??void 0),resolveSeat:Kl(i,n),resolveNeed:b,params:d,...r.trigger?{trigger:r.trigger}:{},cwd:i,signal:n});if(n.throwIfAborted(),Jc(a.graph,f),r.graphDigest&&a.graph.digest!==r.graphDigest)throw new W(`GRAPH_CHANGED`,`The validated graph changed before execution`,`Its compiled graph digest no longer matches validation`,`tangle graph run --help`);return a},S=r.cwd??process.cwd(),C=await x(c?.cwd??S),w=je(p,!0),T=[];for(let e of C.graph.nodes){let t=oe(e.profile,w);if(!t.ok)throw new W(`GRAPH_MCP_POLICY_REQUIRED`,`A graph profile exceeds its host policy`,`${e.id}: ${t.issues.filter(e=>e.level===`error`).map(e=>e.message).join(`; `)}`,`tangle graph run --mcp-policy <policy.json> --help`);for(let t of Object.values(e.profile.mcp??{}))t.enabled!==!1&&t.url&&T.push(new URL(t.url).hostname)}let D=[Yl(C.graph),...T].filter(Boolean).join(`,`)||void 0;if(t.dryRun)return C;let O=Xl(C.graph.nodes)?Ql(t):void 0,k=c?.runId??r.runId??E(),ee=c?.cwd??(r.taskWorkspace?S:await e.graphWorkspace(C.graph,{cwd:S,runId:k}));return await wf({...r,runId:k,cwd:ee,signal:n,fix:i,relayAllow:D,mcpSecretEnv:a},i=>Df(i,{kernel:e,registry:m,loaded:C,gateChoices:f,file:o,source:s,sourceDigest:l,context:r,options:t,prior:c,mcpPolicy:p,getHub:v,seatSource:O,signal:n}))}finally{await d?.release()}},i)}async function Df({runId:e,runDir:t,cwd:n,bridge:r},{kernel:i,registry:a,loaded:o,gateChoices:s,file:c,source:l,sourceDigest:u,context:d,options:f,prior:p,mcpPolicy:m,getHub:h,seatSource:g,signal:_}){let{superviseGraphPursuit:v,readSettleRecord:y}=await import(`@tangle-network/agent-runtime/durable`),b=await i.recordStoredGraphRun(a,o.graph),x=p??{version:1,runId:e,cwd:n,file:c,graphDigest:b.digest,sourceDigest:u,source:l,params:o.params,...d.trigger?{trigger:d.trigger}:{},...Object.keys(s).length?{gateChoices:s}:{},startedAt:new Date().toISOString(),...f.seat===void 0?{}:{seat:f.seat},mcpPolicy:m,...d.taskWorkspace&&{taskWorkspace:d.taskWorkspace}};p||await Bl(t,x);let S=p?await y(t):void 0;if(S&&S.tree.root!==e&&Z(`The settlement names another run`),S?.kind===`no-winner`&&Z(`The local run is terminal: ${S.reason}`),S)return{runId:e,graphDigest:b.digest,sourceDigest:u,...vl(S),replayed:!0};let C=i.graphFromStored(b,{trigger:x.trigger}),w=b.nodes.some(e=>e.profile.connections?.length),T=w?await h():void 0;if(w&&!T)throw new W(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured for this local graph`,`tangle auth login`);let E=await r(T),D=i.createPrivateCasArtifactPort(M(t,`artifacts`),e),O=sl(o.params.knowledge,t,D,_),k=g?eu(E,g,_):void 0,ee=x.startedAt;V(`Run ${e} · ${he(c)} · ${n}`);let te=await Of(t);V(`Viewer ${te.url}`);let ne=new AbortController,re=await v(C,{pursuitId:b.digest,runDir:t,runId:e,backend:E,checkArtifacts:D,...O?{resolveSupervisorTools:O}:{},...C.entry===void 0?{driverBackend:E}:{},...b.gates?.length?{decideGate:Yc(x.gateChoices??{},{json:f.json,signal:AbortSignal.any([_,ne.signal])})}:{},resume:!!p,signal:_,...x.trigger?{trigger:x.trigger}:{},...k?{selectSeat:k,coordination:{authentication:!0}}:{},profileSecurity:je(x.mcpPolicy,w)}).finally(async()=>{ne.abort(),await te.close()}),A={runId:e,graphDigest:b.digest,sourceDigest:u,...vl(re.result.result)},ie=re.result.result,{tokens:ae,tokensKnown:oe,iterations:se,ms:ce}=ie.spentTotal;if(await i.recordStoredGraphRun(a,b,{graphDigest:b.digest,evidence:[{kind:`authored-graph`,url:`urn:sha256:${b.digest}`},{kind:`authored-yaml`,url:`urn:sha256:${u}`}],taskDigest:i.taskShapeDigest({graph:he(c),params:o.params,trigger:x.trigger??null,taskWorkspace:x.taskWorkspace?Ol(x.taskWorkspace):null}),startedAt:ee,finishedAt:new Date().toISOString(),outcome:ie.kind===`no-winner`?{kind:`no-winner`,reason:ie.reason}:{kind:`delivered`,summary:A.text},cost:{iterations:se,ms:ce,...oe===!1?{}:{tokens:ae.input+ae.output},...A.costUsd===null?{}:{usd:A.costUsd}},traversals:re.result.ledger.length,exhaustedEdges:re.result.exhaustedEdges,source:{kind:`tangle-cli-graph`,id:e}}),ie.kind===`no-winner`)throw Object.assign(new W(`GRAPH_RUN_FAILED`,`Graph '${he(c)}' finished without a result`,re.result.stopped?.reason||re.result.ledger.filter(e=>e.outcome===`unpropagated`&&e.reason).pop()?.reason||ie.reason,`tangle graph inspect ${e}`),{runId:e,runtimeFailures:[...ie.tree.nodes.filter(e=>e.failure).map(e=>({node:e.label,failure:e.failure})),...ie.reason===`driver-failed`&&ie.error.failure?[{node:`root`,failure:ie.error.failure}]:[]]});return A}async function Of(e){let{serveTopWeb:t}=await import(`@tangle-network/agent-runtime/tui`),{readGraphSessions:n}=await import(`./graph-native-Cl6SphYB.mjs`);return t({roots:[e],assets:M(xf,`dist`,`graph-viewer`),readSessions:n})}async function kf(e,t){if(t.artifacts||t.artifact)return cu(e,t);if(e.startsWith(`wfrun_`)){let n=await Q(t),r=await n.workflows.getRun(e);if(t.json)return z(r);for(let e of r.runtime?.checks??[])V(`${e.node} ${e.status} · exit ${e.exitCode??`none`} · pass ${e.pass??`none`}\n${e.reason??e.tail}`);return V(`Run ${e} · ${n.baseUrl}/app/workflows/${encodeURIComponent(r.workflowId)}/runs/${encodeURIComponent(e)}`)}let n=M(N(),`.tangle`,`runs`,e);if(!/^[a-f0-9-]{36}$/i.test(e)||!ue(n))throw new W(`RUN_NOT_FOUND`,`Run '${e}' was not found`,`Use a run ID printed by tangle graph run`,`tangle graph inspect --help`);let{loadTopSnapshot:r}=await import(`@tangle-network/agent-runtime/tui`);if(t.json)return z(await r(process.cwd(),{runDir:n}));V(`Run ${e} · ${(await Of(n)).url}`)}function Af(){let e=new S(`graph`).description(`Build and run portable agent graphs`);return Fd(e),Fl(e),xu(e,Cf),wu(e,Cf),su(e),Ed(e),Wd(e,Cf,xf),e.command(`inspect <run>`).description(`Inspect a live or retained graph run`).option(`--artifacts`,`List complete retained check files and capture gaps`).option(`--artifact <node/path>`,`Download one retained check file by node/path or digest`).option(`--out <file>`,`Save artifact bytes to a new private file`).action(kf),e.command(`run <name-or-file>`).description(`Run a saved graph over native subscriptions`).option(`--cloud`,`Run through Tangle's durable cloud workflow owner`).option(`--deploy <file>`,`Cloud deployment settings, including triggers and parameter defaults`).option(`--workflow <id>`,`Run this existing cloud deployment at its exact source and revision`).option(`--resume <run>`,`Resume this run's saved graph and durable execution`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ll()).option(`--mcp-policy <file>`,`Host-owned JSON policy: allowLocalMcp and allowedMcpHosts; captured for resume`).option(`--seat-account <account>`,`Account id for an all-eligible authored seat`).option(`--seat-command <program>`,`Executable that prints the account id; the harness is its first argument`).option(`--seat-credential <credential>`,`Credential name passed to the seat command after the harness`).option(`--param <key=value>`,`Graph parameter or gate.<id>=<choice>; repeatable`,(e,t)=>[...t,e],[]).option(`--task-workspace <file>`,`Seed a private run copy from an exact local workspace capture`).option(`--dry-run`,`Validate and print the graph without starting agents`).action(async(e,t)=>{let n={...t,mcpPolicy:t.mcpPolicy===void 0?void 0:await dl(t.mcpPolicy)},r=await Ef(e,n);n.json||n.dryRun?z(r):`status`in r?(V(`${r.status} · ${r.runId}`),r.text&&console.log(r.text)):`viewerUrl`in r&&V(`Run ${r.runId} · ${r.viewerUrl}`)}),e}function jf(){let e=new S(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--endpoint <url>`,`OTLP endpoint base`,Ga).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).action(async(e,t)=>{let n=e??`local`;Xa(n);let r=Nf(t.apiKey),i=await to({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??Qa(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){z(a);return}U({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--endpoint <url>`,`OTLP endpoint base`,Ga).action(async e=>{let t=eo(),n=await oo({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:Nf(e.apiKey??t?.apiKey)});e.json?z(n):Mf(n),n.contentSeen||(process.exitCode=1)}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).action(async e=>{try{let t=Pf(e.agent),n=eo(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:Nf(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??Qa(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await If():Ff(e.payload)};if(e.dryRun){let n=ro(r);if(e.json){z(n);return}U({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await io(r);if(e.json){z({traceId:i});return}U({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?z({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}G(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Lf({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Lf({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async e=>{await Lf({type:zf(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).action(async(e,t)=>{let{client:n}=J(t),r=t.json?null:H(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){z(i);return}Rf(i)}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).action(async e=>{let{client:t}=J(e),n=e.json?null:H(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:zf(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Hf(e.limit)});if(n?.stop(),e.json){z(r);return}R(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}),e}function Mf(e){U({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),R(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function Nf(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function Pf(e){if(Za(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function Ff(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function If(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function Lf(e,t){let n=Bf(t.mode),r=Uf(t.metadata),i=t.maxUsd===void 0?void 0:Vf(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let{client:a}=J(t),o=t.json?null:H(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){z(s);return}Rf(s)}function Rf(e){U({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),z(e.result))}function zf(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function Bf(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function Vf(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Hf(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Uf(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const Wf=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function Gf(e,t){let n=await Ci({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}});if(!t||!n.minted)return n;throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function Kf(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await wi(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await qf(i,t));return i}async function qf(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const Jf=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function Yf(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Xf(){let e=new S(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{let t=await Gf(e,!1),n=t.baseUrl,r=await(await Kf(t,`${n}/v1/keys`,{expected:200})).json();if(e.json){z(r);return}jn(Jf,r.data.map(Yf))}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${Wf.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{if(t.product!==void 0&&!Wf.includes(t.product))throw Error(`Invalid --product. Expected one of ${Wf.join(`, `)}`);let n=await Gf(t,!0),r=n.baseUrl,i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=H(`Creating API key...`);a.start();let o=await Kf(n,`${r}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){z(s);return}B(`API key created: ${s.data.prefix}…`),V(`Copy this key now — it will never be shown again:\n${s.data.key}`)}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{let n=await Gf(t,!0),r=n.baseUrl;if(!t.yes&&!await Bi(`Revoke key ${e}? Any service still using it will start to fail.`,`--yes`)){V(`Aborted.`);return}let i=await(await Kf(n,`${r}/v1/keys/${encodeURIComponent(e)}`,{method:`DELETE`,expected:200})).json();if(t.json){z(i);return}B(`Revoked ${e}`)}),e}function Zf(e){if(Pr().token)throw Error(`A line relay cannot manage numbers or attachments. Use your owner CLI outside the agent box.`);return q(K(e))}function Qf(e){if(!e.yes)throw Error(`Review the selected line and use --yes to authorize this change. Attaching enables metered agent work.`)}function $f(e){if(e===`imessage`||e===`whatsapp`||e===`email`||e===`sms`||e===`voice`||e===`telegram`)return e;throw Error(`--transport must be imessage, whatsapp, email, sms, voice, or telegram`)}function ep(e){return e().catch(G)}async function tp(e){let t=await $e(e,`r`);try{if(!(await t.stat()).isFile())throw Error(`Attachment input must be a regular JSON file`);let e=Buffer.alloc(131073),n=0;for(;n<e.length;){let{bytesRead:r}=await t.read(e,n,e.length-n,null);if(r===0)break;n+=r}if(n===e.length)throw Error(`Attachment JSON exceeds 128 KiB`);let r;try{r=JSON.parse(e.subarray(0,n).toString(`utf8`))}catch{throw Error(`Attachment file is not valid JSON`)}if(!r||typeof r!=`object`||Array.isArray(r))throw Error(`Attachment JSON must be an object`);if(Object.hasOwn(r,`number`))throw Error(`Use the line ID argument, not a number field in the attachment file`);return r}finally{await t.close()}}function np(e){e.command(`providers`).description(`List provider transports supported by this Hub deployment`).action(e=>ep(async()=>{z(await Zf(e).lines.providers())})),e.command(`list`).description(`List owned lines, optionally for a saved agent profile or sandbox`).option(`--profile-id <id>`,`Stored profile ID`).option(`--sandbox <id>`,`Existing sandbox ID`).action(e=>ep(async()=>{z(await Zf(e).lines.list({profileId:e.profileId,sandboxId:e.sandbox}))})),e.command(`get`).argument(`<line-id>`).description(`Inspect a line and its current attachment`).action((e,t)=>ep(async()=>{z(await Zf(t).lines.get(e))})),e.command(`numbers`).argument(`<connection-id>`).description(`Discover owned provider numbers; this does not purchase or reserve a number`).option(`--transport <transport>`,`imessage, whatsapp, or sms`,`imessage`).action((e,t)=>ep(async()=>{let n=$f(t.transport);if(n===`email`)throw Error(`Email uses an owned mailbox, not phone inventory`);if(n===`voice`)throw Error(`Voice numbers are listed by ph0ny; provide the owned number ID to lines connect`);if(n===`telegram`)throw Error(`Telegram uses an owned bot, not phone inventory`);z(await Zf(t).lines.numbers(e,n))})),e.command(`connect`).argument(`<connection-id>`).description(`Bind an owned number or identity through Hub; no provider rental is purchased`).option(`--transport <transport>`,`imessage, whatsapp, sms, email, voice, or telegram`,`imessage`).option(`--number-id <id>`,`Exact owned provider number ID; required for voice, SMS, WhatsApp and Linq iMessage`).option(`--address <email>`,`Owned mailbox on a verified email domain`).requiredOption(`--reference <reference>`,`Stable client reference; keep it unchanged on retry`).option(`--label <label>`,`Line display name`).option(`--yes`,`Authorize provider webhook configuration and line binding`).action((e,t)=>ep(async()=>{Qf(t);let n=$f(t.transport);if(n!==`email`&&t.address)throw Error(`--address is email-only`);if((n===`email`||n===`telegram`)&&t.numberId)throw Error(`${n} does not take --number-id`);let r={connectionId:e,label:t.label,clientReference:t.reference},i;if(n===`email`)i={...r,transport:n,address:t.address};else if(n===`telegram`)i={...r,transport:n};else if(n===`imessage`)i={...r,transport:n,phoneNumberId:t.numberId};else{if(!t.numberId)throw Error(`${n} requires --number-id`);i={...r,transport:n,phoneNumberId:t.numberId}}z(await Zf(t).lines.fromConnection(i))})),e.command(`attach`).argument(`<line-id>`).description(`Attach a saved agent to any sandbox, or use an isolated on-demand member instance`).option(`--file <path>`,`Reviewed native attachment JSON (exclusive with quick-setup flags)`).option(`--profile-id <id>`,`Owner-scoped saved profile; each turn pins its source revision`).option(`--member <address>`,`The one allowed sender: E.164 phone or email`).option(`--sandbox <id>`,`Use an existing sandbox instead of an on-demand instance`).option(`--instance-prefix <prefix>`,`Stable instance namespace; defaults to profile:<profile-id>:`).option(`--tools <mode>`,`chat denies tools; act applies the profile's tools and permissions`).option(`--turns-per-day <count>`,`Per-member daily turn ceiling (default 30)`).option(`--yes`,`Authorize agent execution and spend against your key limits`).action((e,t)=>ep(async()=>{Qf(t);let n=Zf(t),r;if(t.file){if(t.profileId||t.member||t.sandbox||t.instancePrefix||t.tools||t.turnsPerDay)throw Error(`Choose --file or quick-setup flags, not both`);r=await tp(t.file)}else{if(!t.profileId||!t.member)throw Error(`Provide --profile-id and --member, or --file`);if(t.sandbox&&t.instancePrefix)throw Error(`Choose --sandbox or --instance-prefix`);let e=t.tools??`chat`,n=Number(t.turnsPerDay??`30`);if(e!==`chat`&&e!==`act`)throw Error(`--tools must be chat or act`);if(!Number.isSafeInteger(n)||n<1||n>1e4)throw Error(`--turns-per-day must be 1–10000`);if(e===`act`&&t.sandbox)throw Error(`Acting tools require an isolated on-demand instance; omit --sandbox`);r={mode:`personal`,members:[{address:t.member,role:`owner`}],unknownSenders:`reject`,roles:{owner:{context:`own`,tools:e}},respond:{kind:`agent`,profileId:t.profileId,...e===`act`?{rolePolicy:{version:1,roles:{owner:{kind:`general`}},members:{}}}:{}},limits:{turnsPerMemberPerDay:n},...t.sandbox?{sandboxId:t.sandbox}:{instance:{keyPrefix:t.instancePrefix??`profile:${t.profileId}:`,create:{ownerContext:`isolated`,...e===`act`?{egressPolicy:{mode:`strict`,allowDomains:[new URL(Qr()).hostname],includeImplicitDomains:!1}}:{}}}}}}if(typeof r.sandboxId==`string`==(r.instance!==void 0))throw Error(`Attachment requires exactly one of sandboxId and instance`);let{sandboxId:i,instance:a,...o}=r,s;if(i){let t=await n.get(i);if(!t)throw Error(`Sandbox not found`);s=await t.lines.attach({...o,number:e})}else{if(!a)throw Error(`Attachment requires an instance`);s=await n.lines.attach({...o,number:e,instance:a})}z(s)}));for(let t of[`detach`,`release`])e.command(t).argument(`<line-id>`).description(t===`detach`?`Stop dispatch; preserve history and provider rental`:`Retire a detached Hub line; does not cancel provider rental`).option(`--yes`,`Authorize this change`).action((e,n)=>ep(async()=>{Qf(n),z({[t]:await Zf(n).lines[t](e)})}));e.command(`threads`).argument(`<line-id>`).description(`List this line's separate participant threads`).action((e,t)=>ep(async()=>{z(await Zf(t).lines.threads(e).list())})),e.command(`messages`).argument(`<line-id>`).argument(`<thread-id>`).description(`Read one authorized participant thread`).action((e,t,n)=>ep(async()=>{z(await Zf(n).lines.threads(e).messages(t))}))}async function rp(e){let{token:t,baseUrl:n}=Pr();if(t===void 0)return Oi(e);if(!t.startsWith(`lrc_`)||!n)throw Error(`The line box needs TANGLE_LINE_TOKEN and TANGLE_HUB_URL`);if(e.apiKey||e.baseUrl&&new URL(e.baseUrl).origin!==new URL(n).origin)throw Error(`A line token cannot be sent to another Hub or combined with an API key`);return new Oe({baseUrl:n,authHeaders:()=>({Authorization:`Bearer ${t}`})})}async function ip(e,t){if(t)return t;if(!Pr().token)throw Error(`Provide --line <line-id>`);return(await e.lines.context()).line.id}function ap(e){return e().catch(G)}function op(){return new S(`context`).description(`Show live line identity, members, consent, reminders and quotas`).action(e=>ap(async()=>{z(await(await rp(e)).lines.context())}))}function sp(){let e=new S(`lines`).description(`Connect, manage, message and schedule on a Hub line`);return e.command(`members`).description(`List names, roles and consent on this line`).option(`--line <line-id>`,`Line ID; inferred in a line box`).action(e=>ap(async()=>{let t=await rp(e);z(await t.lines.members.list(await ip(t,e.line)))})),e.command(`send`).description(`Send to a consenting member through Hub`).argument(`<to-member>`,`Exact member ID for an owner; name, ID, or self in a line box`).argument(`<text>`,`Message text`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--on-behalf-of <member>`,`Verified sender for a member relay`).option(`--not-before <iso-time>`,`Delay delivery until this ISO time`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t,n)=>ap(async()=>{let r=await rp(n),i=await ip(r,n.line);if(!Pr().token){if(n.onBehalfOf)throw Error(`--on-behalf-of is only available inside a line box`);if(!n.idempotencyKey)throw Error(`Owner sends require --idempotency-key so a retry keeps the same message`);if(!(await r.lines.members.list(i)).some(t=>t.id===e))throw Error(`Owner sends require an exact member ID from tangle lines members`);z(await r.lines.send(i,{memberId:e,text:t,idempotencyKey:n.idempotencyKey,...n.notBefore?{notBefore:n.notBefore}:{}}));return}z(await r.lines.send(i,{toMember:e,text:t,...n.onBehalfOf?{onBehalfOf:n.onBehalfOf}:{},...n.notBefore?{notBefore:n.notBefore}:{},...n.idempotencyKey?{idempotencyKey:n.idempotencyKey}:{}}))})),e.command(`remind`).description(`Wake the agent at a future time to write your reminder`).argument(`<text>`,`What to remember`).requiredOption(`--at <iso-time>`,`Future ISO time`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t)=>ap(async()=>{if(!t.at)throw Error(`--at is required`);let n=await rp(t),r=t.idempotencyKey??w(`sha256`).update(JSON.stringify([e,t.at])).digest(`hex`).slice(0,32);z(await n.lines.remind(await ip(n,t.line),{text:e,notBefore:t.at,idempotencyKey:r}))})),np(e),e}function cp(){let e=new S(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{let n=K({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await Y(q(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await Kt(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}),e}async function lp(e,t){if(t.self&&e)throw Error(`Use --self or an explicit sandbox, not both`);if(!t.self&&!e)throw Error(`Specify a sandbox id/name or --self`);let n=Tr(),r=t.baseUrl||n.tangleBaseUrl||n.sandboxBaseUrl,i=n.hubUrl;if(t.self&&!r&&i&&new URL(i).origin!==`https://id.tangle.tools`)throw Error(`This deployment must set SANDBOX_BASE_URL or pass --base-url for self preview access`);let a=t.self?t.apiKey??Wr():t.apiKey;if(t.self&&!a)throw Error(`Self preview access requires the injected sandbox runtime credential; it never reads saved owner credentials`);let o=K({apiKey:a,baseUrl:r}),s=q(o);return t.self?Yt(s):Y(s,o,e)}async function up(e,t,n){let r=H(e);t||r.start();try{return await n()}finally{r.stop()}}function dp(e){return e}function fp(){let e=new S(`preview`).description(`Manage sandbox preview links`);return dp(e.command(`start`).description(`Start/reuse a managed development server and publish its ready preview`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).option(`--cwd <directory>`,`Project directory in the selected workspace`).option(`--session <session-id>`,`Select the agent's session workspace`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{let n=await lp(e,t),r=await up(`Starting managed preview...`,t.json,()=>qt(n,{cwd:t.cwd,sessionId:t.session,name:t.name}));t.json?z(r):(B(`Preview ready: ${r.url}`),console.log(`Preview ID: ${r.previewId}`))}),dp(e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`)).action(async(e,t)=>{let n=await lp(e,t),r=await up(`Fetching preview links...`,t.json,()=>n.previewLinks.list());t.json?z(r):r.length===0?console.log(`No preview links found`):jn([`App`,`Preview ID`,`Port`,`URL`,`Status`],r.map(e=>[pp(e.metadata),e.previewId.slice(0,12),String(e.port),e.url,e.status]))}),dp(e.command(`publish`).description(`Publish one existing HTTP service; never starts or replaces a process`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).requiredOption(`--port <port>`,`Existing service port`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{if(!t.port||!/^\d+$/.test(t.port))throw Error(`An integer service port is required`);let n=await lp(e,t),r=await up(`Publishing service...`,t.json,()=>Jt(n,{port:Number(t.port),name:t.name}));t.json?z(r):B(`Preview ready: ${r.url}`)}),dp(e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`)).action(async(e,t,n)=>{if(!/^\d+$/.test(t)||Number(t)<1||Number(t)>65535)throw Error(`Port must be an integer between 1 and 65535`);let r=await lp(e,n),i=await up(`Creating preview for port ${t}...`,n.json,()=>r.previewLinks.create(Number(t)));n.json?z(i):(B(`Preview created: ${i.url}`),console.log(`Preview ID: ${i.previewId}`))}),dp(e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`)).action(async(e,t,n)=>{let r=await lp(e,n);await up(`Removing preview...`,n.json,()=>r.previewLinks.remove(t)),n.json?z({success:!0,previewId:t}):B(`Preview removed: ${t}`)}),e}function pp(e){let t=e?.app;if(!t||typeof t!=`object`)return``;let n=`name`in t?t.name:void 0,r=`cwd`in t?t.cwd:void 0;return typeof n==`string`?n:typeof r==`string`?r:``}function mp(){let e=new S(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=Us(n.env??[],`--env`,`env`),o=H(`Spawning: ${t}`);n.json||o.start();let s=await Y(i,r,e);if(s=await X(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?z(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?z({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching processes...`);t.json||i.start();let a=await Y(r,n,e);a=await X(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?z(o):o.length===0?console.log(`No processes found`):jn([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Fetching process info...`);n.json||a.start();let o=await Y(i,r,e);o=await X(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?z(c):(console.log(`PID:        ${c.pid}`),console.log(`Command:    ${c.command}`),console.log(`CWD:        ${c.cwd||`(default)`}`),console.log(`Status:     ${c.running?`running`:`exited`}`),console.log(`Exit Code:  ${c.exitCode}`),c.exitSignal&&console.log(`Signal:     ${c.exitSignal}`),console.log(`Started:    ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited:     ${c.exitedAt.toLocaleString()}`))}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await Y(i,r,e);o=await X(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?z({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a);let o=await a.process.get(Number.parseInt(t,10));if(!o){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of o.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}),e}const hp=[`python`,`node`,`typescript`,`bash`];function gp(e){switch(_e(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function _p(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await F(be(e),`utf8`)}async function vp(e,t,n=_p){let r=t?hp.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${hp.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=gp(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function yp(e){return M(Ce(),`tangle-run-images`,e)}function bp(){return new S(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${hp.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).action(async(e,t,n)=>{let{language:r,source:i}=await vp(t,n.lang),{context:a,client:o}=J(n),s=await Y(o,a,e);s=await X(s);let c=H(`Running ${r} (${i.length}b)…`);n.json||c.start();let l=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){z(l),l.exitCode!==0&&process.exit(l.exitCode);return}l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr);let u=0;for(let t of l.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:yp(e);de(r,{recursive:!0});let i=`${r}/${Date.now()}-${u}.${t.format}`;me(i,Buffer.from(t.data,`base64`)),process.stderr.write(b.green(`✓ image → ${i}\n`)),u++}else process.stderr.write(b.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(b.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(b.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(b.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(b.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(b.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);l.error&&(process.stderr.write(b.red(`\n✗ ${l.error.name}: ${l.error.message}\n`)),l.error.traceback&&process.stderr.write(`${l.error.traceback}\n`)),l.exitCode!==0&&process.exit(l.exitCode)})}function xp(e){e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is the sandbox's egress policy.`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Updating network configuration...`);i.start();let a=await Y(r,n,e);i.stop();let o=await a.network.getConfig();t.json?z(o):(V(`Network Configuration:`),o.ports&&o.ports.length>0?V(`  Exposed Ports: ${o.ports.join(`, `)}`):V(`  No exposed ports`))}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=H(`Exposing port ${i}...`);a.start();let o=await(await Y(r,n,e)).network.exposePort(i);a.stop(),t.json?z({port:i,url:o}):(B(`Port ${i} exposed.`),V(`  URL: ${o}`))}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching exposed URLs...`);i.start();let a=await(await Y(r,n,e)).network.listUrls();if(i.stop(),t.json)z(a);else{let e=Object.entries(a);if(e.length===0)V(`No ports exposed.`);else{V(`Exposed Ports:`);for(let[t,n]of e)V(`  ${t}: ${n}`)}}})}function Sp(){let e=new S(`sandbox`).description(`Manage sandboxes`);return Cc(e),Sc(e),fc(e),xp(e),e}function Cp(){return new S(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Searching...`);n.json||a.start();let o=await Y(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)})}function wp(){let e=new S(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=await J(n).client.secrets.create(e,await Tp({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}));n.json?z(r):(B(`Secret created: ${r.name}`),V(`Use --secret ${r.name} when creating a sandbox to select it for delivery.`))}),e.command(`list`).description(`List all secrets`).action(async e=>{let t=await J(e).client.secrets.list();e.json?z(t):t.length===0?(V(`No secrets found.`),V(`Use 'tangle secret create <name> [value]' to create one.`)):jn([`Name`,`Created At`,`Updated At`],t.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=J(t).client;if(!t.force&&!await Bi(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `,`--force`)){V(`Cancelled.`);return}await n.secrets.delete(e),t.json?z({success:!0,deleted:e}):B(`Secret deleted: ${e}`)}),e}async function Tp(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);let t=e.value??(e.valueStdin?await Hi():await zi(e.prompt));if(!t.length)throw Error(e.valueStdin?`Secret value from stdin cannot be empty`:`Secret value cannot be empty`);return t}function Ep(){let e=new S(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=j.dirname(Wt(import.meta.url)),t=j.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function Dp(){let e=new S(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--no-wait`,`Return once the snapshot is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Creating snapshot...`);i.start();let a=await Y(r,n,e);if(t.wait===!1){let e=await a.snapshot({tags:t.tags,wait:!1});i.stop(),pc(e.info,!!t.json);return}let o=await a.snapshot({tags:t.tags});i.stop(),t.json?z(o):(B(`Snapshot created: ${o.snapshotId}`),console.log(`Size: ${Op(o.sizeBytes??0)}`))}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching snapshots...`);i.start();let a=await(await Y(r,n,e)).listSnapshots();i.stop(),t.json?z(a):R(a.map(e=>({...e,size:Op(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).action(async(e,t,n)=>{let{client:r}=J(n),i=H(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?z({sandboxId:a.id,restoredFrom:t,status:a.status}):(B(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Reverting sandbox to snapshot...`);a.start();let o=await Y(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?z({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(B(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Deleting snapshot...`);a.start();let o=await(await Y(i,r,e)).deleteSnapshot(t);a.stop(),n.json?z({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?B(`Snapshot already gone: ${t}`):B(`Snapshot deleted: ${t}`)}),e}function Op(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const kp=`solve:device:secp256k1`,Ap=/^0x[0-9a-f]{64}$/i;function jp(e){return e&&Ap.test(e)?e:void 0}function Mp(){let e=rr(kp),t=jp(e.value);if(!(!t||e.source===`none`))return{account:Zt(t),source:e.source}}function Np(){let e=Mp();if(e)return e;let t=Xt(),n=ir(kp,t);return{account:Zt(t),source:n}}function Pp(e){let t=jp(rr(kp).value);if(!t||Zt(t).address!==e.account.address)throw Error(`The local Solve device key changed; it was not retired`);let n=`${kp}:retired:${e.account.address.toLowerCase()}`;if(ir(n,t),rr(n).value!==t)throw Error(`The revoked device key could not be retired safely`);return or(kp),n}function Fp(e){let t=e.create?Np():Mp();if(!t)throw Error("No Solve device signer found. Run `tangle solve account --create`");e.json?z({address:t.account.address,source:t.source}):U({Address:t.account.address,Source:t.source})}const Ip=/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;function Lp(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function Rp(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function zp(e,t,n=2048){if(typeof e!=`string`||!e.trim()||e.length>n)throw Error(`${t} is missing or invalid`);if(Lp(e))throw Error(`${t} contains control characters`);return e.trim()}function Bp(e,t){let n=zp(e,t,64).toLowerCase();if(!Ip.test(n))throw Error(`${t} must be a 40 or 64 character Git revision`);return n}function Vp(e,t,n=!1){let r=typeof e==`number`&&Number.isSafeInteger(e)?String(e):zp(e,t,80);if(!/^\d+$/.test(r)||!n&&r===`0`)throw Error(`${t} must be an unsigned integer`);return BigInt(r).toString()}function Hp(e,t){let n=zp(e,t,2048),r=new URL(n);if(r.protocol!==`https:`&&!(r.protocol===`http:`&&(r.hostname===`localhost`||r.hostname===`127.0.0.1`)))throw Error(`${t} must use HTTPS outside local development`);return n.replace(/\/$/,``)}function Up(e,t){let n=Hp(e,t).replace(/\.git$/,``),r=new URL(n),i=r.pathname.split(`/`).filter(Boolean);if(r.hostname!==`github.com`||r.username||r.password||r.search||r.hash||i.length!==2)throw Error(`${t} must be an HTTPS GitHub repository URL`);return`https://github.com/${i.join(`/`)}`}function Wp(e,t){let n=zp(e,t,42);if(!on(n,{strict:!1}))throw Error(`${t} must be an EVM address`);return rn(n)}function Gp(e,t){let n=Vp(e,t),r=Number(n);if(!Number.isSafeInteger(r)||r<=0)throw Error(`${t} is out of range`);return r}function Kp(...e){for(let t of e)if(typeof t==`string`&&t.trim())return t.trim()}function qp(e){let t=e.trim().replace(/\.git$/,``);return t.startsWith(`git@github.com:`)?`https://github.com/${t.slice(15)}`:t.startsWith(`ssh://git@github.com/`)?`https://github.com/${t.slice(21)}`:t}function Jp(e){if(e===void 0)return;let t=zp(e,`pull request URL`,2048);if(!/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+(?:\/[^\s]*)?$/i.test(t))throw Error(`pull request URL must point to a GitHub pull request`);return t}function Yp(e,t){if(!/^https:\/\/[^\s]+$/i.test(e)&&!/^\/(?!\/).*$/.test(e)&&!/^[a-z][a-z0-9+.-]*:[^\s]+$/i.test(e))throw Error(`${t} must be an HTTPS URL or an absolute repository path`);if(e.split(/[?#]/,1)[0].split(`/`).includes(`..`))throw Error(`${t} cannot contain parent-directory segments`);return e}function Xp(e){return Er(`solve`,e.profile)}function Zp(e){let t=Xp(e),n=Kr(void 0,t);if(!n)throw Error(`No Solve credential found for profile '${t}'. Run: tangle auth login --provider github --app solve`);return n}async function Qp(e){let t=$r(e.apiUrl),n=await fetch(`${t}${e.path}`,{method:e.method??`GET`,headers:{Accept:`application/json`,...e.body===void 0?{}:{"Content-Type":`application/json`},Authorization:`Bearer ${Zp(e)}`},...e.body===void 0?{}:{body:JSON.stringify(e.body)},signal:AbortSignal.timeout(3e4)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||r.data===void 0){let e=r?.error?.message??`Solve API request failed with HTTP ${n.status}`;throw Error(r?.error?.code?`${r.error.code}: ${e}`:e)}return r.data}function $p(e){return Qp({path:`/v1/wallet/challenges`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.purpose?{purpose:e.purpose}:{}}})}function em(e){return Qp({path:`/v1/devices`,apiUrl:e.apiUrl,profile:e.profile})}function tm(e){return Qp({path:`/v1/devices/revoke`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.reason?{reason:e.reason}:{},...e.challengeId&&e.signature?{challengeId:e.challengeId,signature:e.signature}:{}}})}const nm={chainId:42431,rpcUrl:`https://rpc.moderato.tempo.xyz`,sponsorUrl:`https://drew-gtr-pro.taild10bfc.ts.net/solve-sponsor`,tangleAddress:`0xff137B9C879c47C28ce389e84501925438AB4cdA`,managerAddress:`0x5271732F893B622ac6793d6DBA5B2626CCa4EA14`,paymentAsset:`0x20C0000000000000000000000000000000000000`,blueprintId:15n,serviceId:9n,competitionId:1n,minStakeWei:0n};function rm(e,t){return e.toLowerCase()===t.toLowerCase()}function im(e){if(e.chainId!==nm.chainId)throw Error(`Solve submissions require Tempo Moderato (chain ${nm.chainId}); received ${e.chainId}`);if(e.rpcUrl!==nm.rpcUrl)throw Error(`Solve metadata RPC does not match the trusted deployment`);if(e.sponsorUrl!==nm.sponsorUrl)throw Error(`Solve metadata sponsor does not match the trusted deployment`);if(!rm(e.tangleAddress,nm.tangleAddress))throw Error(`Solve metadata Tangle contract does not match the trusted deployment`);if(!rm(e.managerAddress,nm.managerAddress))throw Error(`Solve metadata competition manager does not match the trusted deployment`);if(!rm(e.paymentAsset,nm.paymentAsset))throw Error(`Solve metadata payment asset does not match the trusted deployment`);if(e.blueprintId!==nm.blueprintId)throw Error(`Solve submissions require blueprint ${nm.blueprintId}; received ${e.blueprintId}`);if(e.serviceId!==nm.serviceId)throw Error(`Solve submissions require service ${nm.serviceId}; received ${e.serviceId}`);if(e.competitionId!==nm.competitionId)throw Error(`Solve submissions require competition ${nm.competitionId}; received ${e.competitionId}`);if(e.minStakeWei!==nm.minStakeWei)throw Error(`Solve submissions require zero stake for the trusted deployment`)}function am(e,t){let n=Rp(t.check??e.check,`competition.participation.check`),r=zp(n.command,`competition.participation.check.command`,512);if(!Array.isArray(n.args)||n.args.some(e=>typeof e!=`string`))throw Error(`competition.participation.check.args must be an array of strings`);let i=n.args.map(e=>zp(e,`competition checker argument`,2048)),a=Kp(n.result_file,n.resultFile),o=n.timeout_ms??n.timeoutMs,s=o===void 0?void 0:Gp(o,`competition checker timeout`);return{command:r,args:i,...a?{result_file:a}:{},...s?{timeout_ms:s}:{}}}function om(e){if(e.provenance===void 0)return;let t=Rp(e.provenance,`competition.participation.provenance`);if(t.mode!==`github_pull_request`)throw Error(`competition.participation.provenance.mode is unsupported`);if(t.required!==void 0&&typeof t.required!=`boolean`)throw Error(`competition.participation.provenance.required must be a boolean`);return{mode:`github_pull_request`,required:t.required===!0}}function sm(e){let t=Rp(e.chain??e.network??{},`competition.chain`),n=e.rewards&&typeof e.rewards==`object`&&!Array.isArray(e.rewards)?Rp(e.rewards,`competition.rewards`):{},r=n.minStake&&typeof n.minStake==`object`&&!Array.isArray(n.minStake)?Rp(n.minStake,`competition.rewards.minStake`).raw:void 0,i=Kp(t.minStakeWei,t.min_stake_wei,e.minStakeWei,e.min_stake_wei,r),a=t.chainId??t.chain_id??e.chainId??e.chain_id,o=Kp(t.chainName,t.chain_name,e.chainName,e.chain_name)??`Tempo`,s=Kp(t.nativeSymbol,t.native_symbol,e.nativeSymbol,e.native_symbol)??`TNT`,c=Kp(t.rpcUrl,t.rpc_url,e.rpcUrl,e.rpc_url,process.env.TANGLE_SOLVE_RPC_URL),l=Kp(t.sponsorUrl,t.sponsor_url,e.sponsorUrl,e.sponsor_url,process.env.TANGLE_SOLVE_SPONSOR_URL),u=Kp(t.tangleAddress,t.tangle_address,t.coreAddress,t.core_address,e.tangleAddress,e.tangle_address,e.coreAddress,e.core_address),d=Kp(t.managerAddress,t.manager_address,e.managerAddress,e.manager_address),f=Kp(t.paymentAsset,t.payment_asset,t.servicePaymentAsset,t.service_payment_asset,e.paymentAsset,e.payment_asset,e.servicePaymentAsset,e.service_payment_asset),p=Kp(t.blueprintId,t.blueprint_id,e.blueprintId,e.blueprint_id),m=Kp(t.serviceId,t.service_id,e.serviceId,e.service_id),h=Kp(t.competitionId,t.competition_id,e.competitionId,e.competition_id,e.id);if(!c||!l||!u||!d||!p||!m||!h||!i||a===void 0)throw Error(`Solve competition metadata must include complete Tempo chain configuration`);return{chainId:Gp(a,`chain.chainId`),chainName:o,nativeSymbol:s,rpcUrl:Hp(c,`chain.rpcUrl`),sponsorUrl:Hp(l,`chain.sponsorUrl`),tangleAddress:Wp(u,`chain.tangleAddress`),managerAddress:Wp(d,`chain.managerAddress`),paymentAsset:Wp(f??nm.paymentAsset,`chain.paymentAsset`),blueprintId:Vp(p,`chain.blueprintId`),serviceId:Vp(m,`chain.serviceId`),competitionId:Vp(h,`chain.competitionId`,!0),minStakeWei:Vp(i,`chain.minStakeWei`,!0)}}function cm(e){let t=Rp(e,`competition`),n=Rp(t.participation??t.task,`competition.task`),r={...t,participation:{...n,...n.repositoryRevision===void 0&&n.revision!==void 0?{repositoryRevision:n.revision}:{}}},i=r.participation,a=Up(Kp(r.repository,r.repo_url,i.repository)??``,`competition.repository`),o=Bp(Kp(r.repositoryRevision,r.repository_revision,i.revision,i.repositoryRevision,i.repository_revision),`competition.repositoryRevision`),s=zp(r.slug??r.id,`competition.slug`,128),c=zp(r.name??r.title??s,`competition.name`,256),l=am(r,i),u=om(i);return{version:1,slug:s,title:c,repository:a,taskRevision:o,checker:l,chain:sm(r),...u?{provenance:u}:{}}}function lm(e){return{chainId:e.chain.chainId,chainName:e.chain.chainName,nativeSymbol:e.chain.nativeSymbol,rpcUrl:e.chain.rpcUrl,sponsorUrl:e.chain.sponsorUrl,tangleAddress:e.chain.tangleAddress,managerAddress:e.chain.managerAddress,paymentAsset:e.chain.paymentAsset,blueprintId:BigInt(e.chain.blueprintId),serviceId:BigInt(e.chain.serviceId),competitionId:BigInt(e.chain.competitionId),minStakeWei:BigInt(e.chain.minStakeWei)}}async function um(e){let t=Rp(JSON.parse(await Je.readFile(j.join(e,`.tangle-solve.json`),`utf8`)),`.tangle-solve.json`);if(t.version!==1)throw Error(`.tangle-solve.json has an unsupported version`);let n=Rp(t.checker,`.tangle-solve.json.checker`),r=Rp(t.chain,`.tangle-solve.json.chain`);return cm({slug:t.slug,name:t.title,repository:t.repository,repositoryRevision:t.taskRevision,participation:{check:n,provenance:t.provenance},chain:r,competitionId:r.competitionId})}const dm=Ot(we),fm=`.tangle-solve-run.json`,pm=`.tangle-solve.json`,mm=`tangle.solve.manifestSha256`,hm=new Set([pm,fm]),gm=`upstream`;async function _m(e,t){let n=await dm(`git`,[`-C`,e,...t],{encoding:`utf8`,maxBuffer:1e6});return String(n.stdout).trim()}async function vm(e,t){let n=j.resolve(t??process.cwd()),r=await um(n);if(e&&e!==r.slug&&e!==r.chain.competitionId)throw Error(`This directory contains '${r.slug}', not '${e}'`);return{root:n,manifest:r}}async function ym(e){let t=j.join(e,pm),n;try{n=await Je.lstat(t)}catch{throw Error(`${pm} is missing`)}if(n.isSymbolicLink()||!n.isFile())throw Error(`${pm} must be a regular file`);return w(`sha256`).update(await Je.readFile(t)).digest(`hex`)}async function bm(e){let t=await ym(e);return await _m(e,[`config`,`--local`,`--replace-all`,mm,t]),t}async function xm(e){let t;try{t=await _m(e,[`config`,`--local`,`--get`,mm])}catch{throw Error(`The local Git metadata has no ${mm} pin; run tangle solve clone again`)}if(!/^[0-9a-f]{64}$/i.test(t))throw Error(`The local ${mm} pin is invalid`);if(await ym(e)!==t.toLowerCase())throw Error(`${pm} changed after clone; run tangle solve clone again`)}async function Sm(e,t){try{return await _m(e,[`ls-files`,`--error-unmatch`,`--`,t]),!0}catch{return!1}}async function Cm(e){await xm(e);for(let t of hm)if(await Sm(e,t))throw Error(`${t} must remain untracked and local to this Solve workspace`);let t=await dm(`git`,[`-C`,e,`status`,`--porcelain=v1`,`--untracked-files=all`,`--ignored=matching`],{encoding:`utf8`,maxBuffer:1e6});if(String(t.stdout).split(/\r?\n/).filter(Boolean).filter(e=>{let t=e.slice(0,2),n=e.slice(3);return!((t===`??`||t===`!!`)&&hm.has(n))}).length>0)throw Error(`Commit the candidate before running Solve. Only the local manifest and run record may remain uncommitted.`);return Bp(await _m(e,[`rev-parse`,`HEAD`]),`submission revision`)}async function wm(e,t,n,r={}){let i=await Tm(e,t,r);if(i)return{taskRepository:t.repository,taskRevision:t.taskRevision,submissionRepository:i,submissionRevision:n}}async function Tm(e,t,n={}){let r;try{r=qp(await _m(e,[`config`,`--get`,`remote.origin.pushurl`]))}catch{try{r=qp(await _m(e,[`config`,`--get`,`remote.origin.url`]))}catch{if(n.allowMissing)return;throw Error(`Add your GitHub fork as the 'origin' remote before submitting. The task repository is available as '${gm}'.`)}}let i=Up(r,`git remote.origin.url`);if(i.toLowerCase()===t.repository.toLowerCase()){if(n.allowMissing)return;throw Error(`The 'origin' remote is the task repository. Add your GitHub fork as 'origin'; keep the task repository as '${gm}' before submitting.`)}return i}function Em(e,t){return!e||!t?!1:e.taskRepository.toLowerCase()===t.taskRepository.toLowerCase()&&e.taskRevision.toLowerCase()===t.taskRevision.toLowerCase()&&e.submissionRepository.toLowerCase()===t.submissionRepository.toLowerCase()&&e.submissionRevision.toLowerCase()===t.submissionRevision.toLowerCase()}function Dm(e,t){return`${e}/commit/${t}`}function Om(e,t,n,r,i={}){let a=e.evidenceRefs.map(e=>Yp(e.trim(),`checker evidence reference`));if(n){if(!t){if(i.allowMissingSource)return{evidence:e.evidence,evidenceRefs:a};throw Error(`Provenance policy requires a submission source`)}let o=Jp(r);if(n.required&&(i.requirePullRequest??!0)&&!o)throw Error(`This competition requires a GitHub pull request`);a.push(Dm(t.taskRepository,t.taskRevision),Dm(t.submissionRepository,t.submissionRevision),...o?[o]:[])}return{evidence:e.evidence,evidenceRefs:[...new Set(a)]}}async function km(e,t){let n=`${e}.${process.pid}.tmp`;await Je.writeFile(n,`${JSON.stringify(t,null,2)}\n`,{mode:384}),await Je.rename(n,e)}async function Am(e){let t=JSON.parse(await Je.readFile(j.join(e,fm),`utf8`));if(t.version!==1||typeof t.competition!=`string`)throw Error(`${fm} has an unsupported format`);return t}async function jm(e){let t=Jp(e.pullRequest);if(!t)throw Error(`A pull request URL is required`);let n=new URL(t).pathname.split(`/`).filter(Boolean),r=await fetch(`https://api.github.com/repos/${n[0]}/${n[1]}/pulls/${n[3]}`,{headers:{Accept:`application/vnd.github+json`,"User-Agent":`tangle-solve-cli`},signal:AbortSignal.timeout(15e3)}),i=await r.json().catch(()=>null),a=e=>e.replace(/\/$/,``).toLowerCase();if(!r.ok||a(i?.base?.repo?.html_url??``)!==a(e.taskRepository)||i?.head?.sha?.toLowerCase()!==e.submissionRevision.toLowerCase()||a(i?.head?.repo?.html_url??``)!==a(e.submissionRepository))throw Error(`GitHub pull request must target the pinned task repository and contain the current committed submission`)}function Mm(e){return{...e.authorization?{authorization:e.authorization}:{},...e.stake?{stake:e.stake}:{},join:e.join,commit:e.commit,reveal:e.reveal,report:e.report,evaluation:e.evaluation}}const Nm=Ot(we);function Pm(){return`Task source is '${gm}'. Add your fork as 'origin', commit your candidate, push it, and open a pull request before submitting.`}async function Fm(e,t,n){try{let r=Rp(await Qp({path:`/v1/competitions/${encodeURIComponent(e)}`,apiUrl:n.apiUrl,profile:n.profile}),`competition response`),i=cm(r.competition??r),a=j.resolve(t??i.slug),o=H(`Cloning ${i.slug}…`);n.json||o.start();try{await Nm(`git`,[`clone`,`--no-tags`,`--origin`,gm,i.repository,a],{encoding:`utf8`,maxBuffer:1e6}),await _m(a,[`checkout`,`--detach`,i.taskRevision]);let e=await _m(a,[`rev-parse`,`HEAD`]);if(e.toLowerCase()!==i.taskRevision.toLowerCase())throw Error(`Pinned checkout resolved to ${e}, expected ${i.taskRevision}`);await km(j.join(a,`.tangle-solve.json`),i),await bm(a)}finally{o.stop()}n.json?z({competition:i,directory:a}):(B(`Cloned ${i.slug} at ${i.taskRevision.slice(0,12)}`),i.provenance&&V(Pm()),V(`Run the pinned checker with: cd ${a} && tangle solve run`))}catch(e){G(e)}}const Im=12e4,Lm=ln(`event JobSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint8 jobIndex, address caller, bytes inputs)`),Rm=ln(`event JobCompleted(uint64 indexed serviceId, uint64 indexed callId)`),zm=ln(`event JobResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, address indexed operator, bytes result)`),Bm=ln(`event AggregatedResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint256 signerBitmap, bytes output)`),Vm=ln(`event EvaluationAccepted(uint64 indexed serviceId, uint64 indexed competitionId, address indexed researcher, bytes32 candidateId, bytes32 submissionRefHash, bytes32 evaluationDigest, bytes32 metricsHash, bytes32 evidenceRefsHash)`),Hm=[...cn([`function submitJob(uint64 serviceId, uint8 jobIndex, bytes inputs) payable returns (uint64 callId)`,`function getJobEventRate(uint64 blueprintId, uint8 jobIndex) view returns (uint256 rate)`,`function getServicePaymentAsset(uint64 serviceId) view returns (address)`,`function isPermittedCaller(uint64 serviceId, address caller) view returns (bool)`]),Lm,Rm,zm,Bm],Um=cn([`function authorizeSelf(uint64 serviceId)`,`function revokeSelf(uint64 serviceId)`,`function isDeviceRevoked(address device) view returns (bool)`,`function postStake(uint64 serviceId, uint64 competitionId) payable`,`function stakes(uint64 serviceId, uint64 competitionId, address researcher) view returns (uint256)`,`function pendingResults(uint64 serviceId, uint64 jobCallId) view returns (uint8 job, bytes32 outputHash, uint256 signerBitmap, bool exists, bool executed)`,`function executePendingResult(uint64 serviceId, uint64 jobCallId, bytes output)`,`function acceptedCandidates(uint64 serviceId, uint64 competitionId, address researcher, bytes32 candidateId) view returns (bool)`]),Wm=cn([`function allowance(address owner, address spender) view returns (uint256)`,`function approve(address spender, uint256 amount) returns (bool)`]),Gm=un(`uint64 competitionId, uint256 stakeWei`),Km=un(`uint64 competitionId, bytes32 commitment`),qm=un(`uint64 competitionId, bytes32 commitment, string artifactRef, bytes32 salt`),Jm=un(`string artifactRef, bytes32 salt`),Ym=un(`uint64 competitionId, bytes32 candidateId, string submissionRef, string evidenceJson, string evidenceRefsJson`),Xm=un(`string status, string detail`),Zm=/^0x[0-9a-f]{64}$/i;function Qm(e,t){if(e!==t)throw Error(`Tempo RPC returned chain ${e}; expected ${t}`)}function $m(e,t,n){return{...e,feePayer:!0,nonceKey:t,nonce:n}}function eh(e,t){if(e!==`success`)throw Error(`${t} transaction reverted`)}function th(e,t,n,r){if(!Zm.test(t))throw Error(`${n} transaction hash is invalid`);if(typeof e.transactionHash!=`string`||e.transactionHash.toLowerCase()!==t.toLowerCase())throw Error(`${n} receipt hash does not match the saved transaction`);if(eh(e.status??``,n),typeof e.from!=`string`||e.from.toLowerCase()!==r.from.toLowerCase())throw Error(`${n} receipt sender does not match the Solve device`);if(typeof e.to!=`string`||e.to.toLowerCase()!==r.to.toLowerCase())throw Error(`${n} receipt destination does not match the expected contract`)}function nh(e,t){return e>=t?[]:e>0n?[0n,t]:[t]}function rh(e,t,n=Date.now()){return n>=e+t}function ih(e,t){return e.filter(e=>e.args?.candidateId?.toLowerCase()===t.toLowerCase()).at(-1)?.transactionHash}function ah(e,t,n,r,i){for(let a of e.logs)if(a.address.toLowerCase()===t.tangleAddress.toLowerCase())try{let e=tn({abi:[Lm],eventName:`JobSubmitted`,data:a.data,topics:a.topics});if(e.args.serviceId===t.serviceId&&e.args.jobIndex===n&&e.args.caller.toLowerCase()===r.toLowerCase()&&(!i||e.args.inputs.toLowerCase()===i.toLowerCase()))return e.args.callId}catch{}throw Error(`Tangle did not emit job ${n} for ${r}`)}function oh(e,t,n,r){for(let i of e.logs)if(i.address.toLowerCase()===t.managerAddress.toLowerCase())try{let e=tn({abi:[Vm],eventName:`EvaluationAccepted`,data:i.data,topics:i.topics}).args;if(e.serviceId===t.serviceId&&e.competitionId===t.competitionId&&e.researcher.toLowerCase()===n.address.toLowerCase()&&e.candidateId.toLowerCase()===r.toLowerCase())return!0}catch{}return!1}function sh(e){if(e.chainId!==pn.id)throw Error(`Solve submissions require Tempo Moderato (chain ${pn.id}); received ${e.chainId}`);if(!e.sponsorUrl)throw Error(`Solve submissions require a Tempo sponsor relay URL; unsponsored writes are disabled`);return{...pn,name:e.chainName,nativeCurrency:{name:e.nativeSymbol,symbol:e.nativeSymbol,decimals:18},rpcUrls:{default:{http:[e.rpcUrl]}}}}async function ch(e,t){im(e);let n=sh(e),r=Qt({chain:n,transport:an(e.rpcUrl)});return Qm(await r.getChainId(),e.chainId),await lh({publicClient:r},e),{publicClient:r,walletClient:$t({account:t,chain:n,transport:hn(an(e.rpcUrl),an(e.sponsorUrl))}),account:t}}async function lh(e,t){let n=await e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`getServicePaymentAsset`,args:[t.serviceId]});if(n.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo service payment asset ${n} does not match the trusted Solve asset ${t.paymentAsset}`)}async function uh(e,t,n){let[r,i]=await Promise.all([e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`getJobEventRate`,args:[t.blueprintId,n]}),e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`getServicePaymentAsset`,args:[t.serviceId]})]);if(i.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo job payment asset ${i} does not match the trusted Solve asset ${t.paymentAsset}`);return{asset:i,amount:r,value:i===`0x0000000000000000000000000000000000000000`?r:0n}}async function dh(e,t,n){return await e.publicClient.readContract({address:t,abi:Wm,functionName:`allowance`,args:[e.account.address,n.tangleAddress]})}async function fh(e,t,n,r,i,a){let o=Date.now();for(;!rh(o,a);){if((await e.publicClient.getLogs({address:t.tangleAddress,event:Rm,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`})).length>0){let a=(await e.publicClient.getLogs({address:t.tangleAddress,event:zm,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.result;if(!a)throw Error(`Tangle job ${n} completed without a result`);let[o,s]=en(Xm,a);if(o!==i)throw Error(`Tangle job ${n} ${o}: ${s}`);return{status:o,detail:s}}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not complete within 120 seconds`)}async function ph(e,t,n,r,i){let a=Date.now();for(;!rh(a,i);){let i=(await e.publicClient.getLogs({address:t.tangleAddress,event:Bm,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.output;if(i)return i;await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not produce an aggregate within 120 seconds`)}async function mh(e,t,n){return!!await e.publicClient.readContract({address:t.managerAddress,abi:Um,functionName:`acceptedCandidates`,args:[t.serviceId,t.competitionId,e.account.address,n]})}const hh=BigInt(sn(dn(`tangle.solve.v1`)));async function gh(e,t){let n=await mn.nonce.getNonce(e.publicClient,{account:e.account.address,nonceKey:hh});if(n>BigInt(2**53-1))throw Error(`The Solve transaction nonce exceeds the safe range`);return e.walletClient.writeContract($m(t,hh,Number(n)))}async function _h(e,t,n,r){if(!await e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))try{let i=r??await gh(e,{address:t.managerAddress,abi:Um,functionName:`authorizeSelf`,args:[t.serviceId]});if(r||await n?.(`authorization`,i),th(await e.publicClient.waitForTransactionReceipt({hash:i}),i,`Authorization`,{from:e.account.address,to:t.managerAddress}),!await e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))throw Error(`authorization transaction did not add the device`);return i}catch(e){let t=e instanceof Error?e.message:`unknown chain error`;throw Error(`The competition manager did not authorize this device. The deployed manager must expose authorizeSelf(uint64): ${t}`)}}async function vh(e,t){let n=await gh(e,{address:t.managerAddress,abi:Um,functionName:`revokeSelf`,args:[t.serviceId]});return th(await e.publicClient.waitForTransactionReceipt({hash:n}),n,`Revocation`,{from:e.account.address,to:t.managerAddress}),n}async function yh(e,t,n,r,i=`allowance`,a={}){if(t.amount===0n||t.asset===`0x0000000000000000000000000000000000000000`)return;let o=await dh(e,t.asset,n);for(let s of nh(o,t.amount)){let o=s===0n?`${i}:reset`:`${i}:approval`,c=a[o];if(c){if(th(await e.publicClient.waitForTransactionReceipt({hash:c}),c,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset}),await dh(e,t.asset,n)!==s)throw Error(`${s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`} did not set the expected allowance`);continue}let l=await gh(e,{address:t.asset,abi:Wm,functionName:`approve`,args:[n.tangleAddress,s]});await r?.(o,l),th(await e.publicClient.waitForTransactionReceipt({hash:l}),l,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset})}}async function bh(e,t,n,r,i,a=`job:${n}`,o={}){let s=await uh(e,t,n);await yh(e,s,t,i,`allowance:${a}`,o);let c=o[a],l=c??await gh(e,{address:t.tangleAddress,abi:Hm,functionName:`submitJob`,args:[t.serviceId,n,r],value:s.value});c||await i?.(a,l);let u=await e.publicClient.waitForTransactionReceipt({hash:l});return th(u,l,`Job ${n}`,{from:e.account.address,to:t.tangleAddress}),{hash:l,callId:ah(u,t,n,e.account.address,r),blockNumber:u.blockNumber}}async function xh(e,t,n,r,i,a,o=`job:${n}`,s={}){let c=await bh(e,t,n,r,a,o,s),l=await fh(e,t,c.callId,c.blockNumber,i,Im);return{...c,acknowledgement:l}}const Sh={...nm,chainName:`Tempo Moderato`,nativeSymbol:`TNT`},Ch={async read(e){let t=Qt({chain:pn,transport:an(Sh.rpcUrl,{timeout:15e3})}),n=e=>e.catch(()=>null),r=await Promise.all(e.map(async e=>{let[r,i]=await Promise.all([n(t.readContract({address:Sh.tangleAddress,abi:Hm,functionName:`isPermittedCaller`,args:[Sh.serviceId,e]})),n(t.readContract({address:Sh.managerAddress,abi:Um,functionName:`isDeviceRevoked`,args:[e]}))]);return[e.toLowerCase(),{permitted:r,revoked:i}]}));return new Map(r)},async revokeSelf(e){return vh(await ch(Sh,e),Sh)}},wh={permitted:null,revoked:null};function Th(e){return e.revoked?`revoked`:e.permitted===null?`unknown`:e.permitted?`permitted`:`not permitted`}async function Eh(e,t=Ch){try{let{devices:n}=await em({apiUrl:e.apiUrl,profile:e.profile}),r=Mp()?.account.address.toLowerCase(),i=n.map(e=>({...e,local:e.address===r,status:e.revokedAt?`revoked`:`active`}));r&&!i.some(e=>e.local)&&i.push({address:r,local:!0,status:`unbound`,boundAt:null,lastUsedAt:null,revokedAt:null,revocationMethod:null,revocationReason:null});let a=await t.read(i.map(e=>rn(e.address))),o=i.map(e=>({...e,onChain:a.get(e.address)??wh}));if(e.json){z({serviceId:Sh.serviceId.toString(),devices:o});return}jn([`Address`,`Status`,`Local`,`Service ${Sh.serviceId}`,`Last used`,`Revoked`],o.map(e=>[e.address,e.status,e.local?`yes`:``,Th(e.onChain),e.lastUsedAt??``,e.revokedAt?`${e.revokedAt} (${e.revocationMethod})`:``]))}catch(t){G(t,e.json)}}async function Dh(e,t,n=Ch){try{if(!on(e))throw Error(`${e} is not an EVM address`);let r=rn(e),i=Mp(),a=i?.account.address===r;if(!t.yes){if(!process.stdin.isTTY)throw Error(`Revoking a device is permanent. Re-run with --yes to confirm`);if(!await Bi(`Permanently revoke Solve device ${r}${a?` (this machine's device)`:``}? [y/N] `,`--yes`)){V(`Revocation cancelled`);return}}let o;if(i&&a){let e=await $p({deviceAddress:r,purpose:`revoke`,apiUrl:t.apiUrl,profile:t.profile});o={challengeId:e.challengeId,signature:await i.account.signMessage({message:e.message})}}let s=await tm({deviceAddress:r,reason:t.reason,...o,apiUrl:t.apiUrl,profile:t.profile}),c=r.toLowerCase(),l=(await n.read([r])).get(c)??wh,u;if(i&&a&&!l.revoked){try{u=await n.revokeSelf(i.account)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`The Solve API revoked ${r}, but the on-chain revocation failed and the local key was kept: ${t}. Run the command again to retry`)}l=(await n.read([r])).get(c)??wh}let d=i&&a&&l.revoked?Pp(i):void 0;if(t.json){z({...s,serviceId:Sh.serviceId.toString(),onChain:l,...u?{revocationTransaction:u}:{},localKeyRetired:!!d});return}B(s.alreadyRevoked?`${r} was already revoked in the Solve API`:`Revoked ${r}; the Solve API refuses its signatures`),u&&B(`Revoked on Tempo in ${u}; service ${Sh.serviceId} refuses its jobs`),d&&V("The local device key was moved aside because its address may still hold stake or rewards. Run `tangle solve account --create` for a new device"),!a&&l.permitted&&En(`The device can still submit jobs to service ${Sh.serviceId}. Only its key, or the Solve blueprint owner, can revoke it on chain`)}catch(e){G(e,t.json)}}function Oh(e,t){return sn(nn(Jm,[e.trim(),t]))}function kh(e){let t=/^submission=(\S+)/.exec(e);if(!t?.[1])throw Error(`COMMIT_CANDIDATE did not return a submission reference`);return t[1]}async function Ah(e,t,n,r,i){let a=i.resumeTransactions?.evaluation;if(a){let n=await e.publicClient.waitForTransactionReceipt({hash:a});if(th(n,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!oh(n,t,e.account,r))throw Error(`Saved evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}let o=Date.now();for(;!rh(o,Im);){if(await mh(e,t,r)){let i=ih(await e.publicClient.getLogs({address:t.managerAddress,event:Vm,args:{serviceId:t.serviceId,competitionId:t.competitionId,researcher:e.account.address},fromBlock:n.blockNumber,toBlock:`latest`}),r);if(i)return i;throw Error(`Candidate is already accepted, but its EvaluationAccepted transaction is unavailable`)}let[a,o,,s,c]=await e.publicClient.readContract({address:t.managerAddress,abi:Um,functionName:`pendingResults`,args:[t.serviceId,n.callId]});if(s&&a!==4)throw Error(`Manager pending result ${n.callId} has unexpected job ${a}`);if(s&&c)throw Error(`Manager executed the report without EvaluationAccepted`);if(s&&!c){if(o.toLowerCase()!==sn(n.output).toLowerCase())throw Error(`Manager pending report output does not match the aggregate`);let a=await gh(e,{address:t.managerAddress,abi:Um,functionName:`executePendingResult`,args:[t.serviceId,n.callId,n.output]});await i.onTransaction?.(`evaluation`,a);let s=await e.publicClient.waitForTransactionReceipt({hash:a});if(th(s,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!oh(s,t,e.account,r))throw Error(`Evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Manager did not emit EvaluationAccepted within 120 seconds`)}async function jh(e,t,n,r={}){if(im(e),!/^0x[0-9a-f]{64}$/i.test(n.salt))throw Error(`Reveal salt must be bytes32`);if(!n.artifactRef.trim())throw Error(`Candidate reference is required`);if(!n.evidenceJson.trim()||n.evidenceRefs.length===0)throw Error(`Checker evidence is required`);let i=await ch(e,t),a=await _h(i,e,r.onTransaction,r.resumeTransactions?.authorization),o,s=await i.publicClient.readContract({address:e.managerAddress,abi:Um,functionName:`stakes`,args:[e.serviceId,e.competitionId,i.account.address]});s<e.minStakeWei&&(o=await gh(i,{address:e.managerAddress,abi:Um,functionName:`postStake`,args:[e.serviceId,e.competitionId],value:e.minStakeWei-s}),await r.onTransaction?.(`stake`,o),th(await i.publicClient.waitForTransactionReceipt({hash:o}),o,`Stake`,{from:i.account.address,to:e.managerAddress}));let c=Oh(n.artifactRef,n.salt),l=nn(Gm,[e.competitionId,e.minStakeWei]),u=nn(Km,[e.competitionId,c]),d=nn(qm,[e.competitionId,c,n.artifactRef.trim(),n.salt]),f=await xh(i,e,1,l,`joined`,r.onTransaction,`join`,r.resumeTransactions),p=await xh(i,e,2,u,`committed`,r.onTransaction,`commit`,r.resumeTransactions),m=kh(p.acknowledgement.detail),h=await xh(i,e,3,d,`revealed`,r.onTransaction,`reveal`,r.resumeTransactions),g=await bh(i,e,4,nn(Ym,[e.competitionId,c,m,n.evidenceJson,JSON.stringify(n.evidenceRefs)]),r.onTransaction,`report`,r.resumeTransactions),_=await ph(i,e,g.callId,g.blockNumber,Im),v=await Ah(i,e,{callId:g.callId,output:_,blockNumber:g.blockNumber},c,r);return{address:i.account.address,...a?{authorization:a}:{},...o?{stake:o}:{},join:f.hash,commit:p.hash,reveal:h.hash,report:g.hash,evaluation:v,candidateId:c,submissionRef:m}}const Mh=Ot(we),Nh=`/usr/bin/bwrap`,Ph=[`/usr`,`/bin`,`/sbin`,`/lib`,`/lib64`];function Fh(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function Ih(e,t){if(!e||e.length>2048||Fh(e))throw Error(`${t} contains invalid control characters or is too long`)}function Lh(e,t){let n=t;for(;n<e.length&&/\s/.test(e[n]??``);)n+=1;return n}function Rh(e,t){if(e[t]!==`"`)throw Error(`Checker output must be valid JSON`);let n=t+1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`"`)return n+1;if((t?.charCodeAt(0)??0)<32)throw Error(`Checker output must be valid JSON`);n+=1}throw Error(`Checker output must be valid JSON`)}function zh(e,t,n){let r=new Set,i=Lh(e,t+1);if(e[i]===`}`)return i+1;for(;i<e.length;){let t=Rh(e,i),a=JSON.parse(e.slice(i,t));if(r.has(a))throw Error(`Checker output must not contain duplicate object keys`);if(r.add(a),i=Lh(e,t),e[i]!==`:`)throw Error(`Checker output must be valid JSON`);let o=Lh(e,i+1),s=Vh(e,o);if(n?.(a,o,s),i=Lh(e,s),e[i]===`}`)return i+1;if(e[i]!==`,`)throw Error(`Checker output must be valid JSON`);i=Lh(e,i+1)}throw Error(`Checker output must be valid JSON`)}function Bh(e,t){let n=Lh(e,t+1);if(e[n]===`]`)return n+1;for(;n<e.length;){if(n=Lh(e,Vh(e,n)),e[n]===`]`)return n+1;if(e[n]!==`,`)throw Error(`Checker output must be valid JSON`);n=Lh(e,n+1)}throw Error(`Checker output must be valid JSON`)}function Vh(e,t){if(e[t]===`"`)return Rh(e,t);if(e[t]===`{`)return zh(e,t);if(e[t]===`[`)return Bh(e,t);let n=t;for(;n<e.length&&!/[\s,\]}]/.test(e[n]??``);)n+=1;return n}function Hh(e){let t=e.trim();if(Lh(t,Vh(t,0))!==t.length)throw Error(`Checker output must be valid JSON`)}function Uh(e,t){let n=e.trim();if(n[0]!==`{`)return;let r;return zh(n,0,(e,i,a)=>{e===t&&(r=n.slice(i,a).trim())}),r}function Wh(e){let t;try{t=JSON.parse(e)}catch{throw Error(`Checker output must be one JSON object`)}if(Hh(e),!t||typeof t!=`object`||Array.isArray(t))throw Error(`Checker output must be a JSON object`);let n=t,r=n.candidate_ref;if(typeof r!=`string`||!r.trim())throw Error(`Checker output must include candidate_ref`);let i=r.trim(),a=n.evidence_refs;if(!Array.isArray(a)||a.length===0||a.some(e=>typeof e!=`string`||!e.trim()))throw Error(`Checker output must include a non-empty evidence_refs array`);Ih(i,`candidate_ref`);for(let e of a)Ih(e.trim(),`evidence_refs`);if(!n.evidence_json||typeof n.evidence_json!=`object`||Array.isArray(n.evidence_json))throw Error(`Checker output must include an evidence_json object`);let o={...n.evidence_json},s=Uh(e,`evidence_json`);if(!s)throw Error(`Checker evidence_json source text is missing`);if(o.candidate_ref!==i)throw Error(`Checker evidence_json candidate_ref must match candidate_ref`);return{candidateRef:i,evidenceRefs:a.map(e=>e.trim()),evidence:o,evidenceJson:s}}async function Gh(e,t,n){let r=n.trim();if(r.startsWith(`{`)&&r.endsWith(`}`)||!t.result_file)return r;let i=await Zh(e),a=j.resolve(i,t.result_file),o=j.relative(i,a);if(o.startsWith(`..`)||j.isAbsolute(o))throw Error(`Checker result_file must stay inside the competition repository`);let s;try{s=await Je.lstat(a)}catch{throw Error(`Checker result_file must be an existing regular file inside the competition repository`)}if(s.isSymbolicLink())throw Error(`Checker result_file must not be a symbolic link`);if(!s.isFile())throw Error(`Checker result_file must be an existing regular file inside the competition repository`);let c;try{c=await Je.realpath(a)}catch{throw Error(`Checker result_file must resolve to a regular file inside the competition repository`)}let l=j.relative(i,c);if(l.startsWith(`..`)||j.isAbsolute(l))throw Error(`Checker result_file must stay inside the competition repository`);return(await Je.readFile(c,`utf8`)).trim()}function Kh(e,t){let n=j.relative(e,t);return n===``||!n.startsWith(`..`)&&!j.isAbsolute(n)}function qh(e){return Ph.some(t=>Kh(t,e))}async function Jh(e,t,n){let r=e.includes(`/`)?[j.resolve(t,e)]:(process.env.PATH??``).split(j.delimiter).filter(Boolean).map(t=>j.join(t,e));for(let i of r){let r;try{r=await Je.realpath(i),await Je.access(r,Je.constants.X_OK)}catch{continue}if(!Kh(t,r)&&!qh(r)&&r!==n)throw Error(`Checker executable '${e}' must resolve inside the competition repository or a trusted runtime directory`);return r}throw Error(`Checker executable '${e}' was not found`)}async function Yh(e){let t=[];for(let n of e)try{(await Je.stat(n)).isDirectory()&&t.push(n)}catch{}return t}async function Xh(e){let t=await Je.realpath(Se.homedir());if(e===j.parse(e).root||e===t)throw Error(`Solve checker repository must be a dedicated directory, not the filesystem or home root`)}async function Zh(e){let t=await Je.realpath(e);return await Xh(t),t}async function Qh(e){let t=j.join(e,`.git`),n;try{n=await Je.lstat(t)}catch{return}if(n.isSymbolicLink())throw Error(`Solve checker repository .git must not be a symbolic link`);if(!n.isDirectory()&&!n.isFile())return;let r;try{let t={...process.env};for(let e of[`GIT_DIR`,`GIT_WORK_TREE`,`GIT_INDEX_FILE`,`GIT_OBJECT_DIRECTORY`,`GIT_ALTERNATE_OBJECT_DIRECTORIES`,`GIT_COMMON_DIR`,`GIT_CONFIG_COUNT`,`GIT_CONFIG_PARAMETERS`])delete t[e];let n=await Mh(`/usr/bin/git`,[`-C`,e,`rev-parse`,`--verify`,`HEAD^{commit}`],{encoding:`utf8`,maxBuffer:1e5,env:{...t,GIT_CONFIG_GLOBAL:`/dev/null`,GIT_CONFIG_SYSTEM:`/dev/null`,GIT_CONFIG_NOSYSTEM:`1`,GIT_TERMINAL_PROMPT:`0`}}),i=String(n.stdout).trim();/^[0-9a-f]{40}$/i.test(i)&&(r=i.toLowerCase())}catch{}return{kind:n.isDirectory()?`directory`:`file`,...r?{commit:r}:{}}}async function $h(e,t,n){let r=await Zh(e);if(process.platform!==`linux`)throw Error(`Solve checkers require the Linux sandbox runtime (bubblewrap) with network isolation`);try{await Je.access(Nh,Je.constants.X_OK)}catch{throw Error(`Solve checkers require /usr/bin/bwrap; install bubblewrap or run the checker in a Tangle sandbox`)}let i=await Jh(t,r,await Je.realpath(process.execPath)),a=await Qh(r),o=(await Yh(Ph)).flatMap(e=>[`--ro-bind`,e,e]),s=Kh(r,i)?`/work/${j.relative(r,i)}`:qh(i)?i:`/checker/node`;!Kh(r,i)&&!qh(i)&&o.push(`--ro-bind`,i,`/checker/node`);let c=a?.kind===`directory`?[`--tmpfs`,`/work/.git`]:a?.kind===`file`?[`--ro-bind`,`/dev/null`,`/work/.git`]:[];return{executable:Nh,args:[`--die-with-parent`,`--new-session`,`--unshare-all`,`--clearenv`,...o,`--proc`,`/proc`,`--dev`,`/dev`,`--tmpfs`,`/tmp`,`--dir`,`/tmp/home`,`--bind`,r,`/work`,...c,`--chdir`,`/work`,`--setenv`,`HOME`,`/tmp/home`,...a?.commit?[`--setenv`,`TANGLE_SOLVE_COMMIT`,a.commit]:[],`--setenv`,`TMPDIR`,`/tmp`,`--setenv`,`PATH`,`/checker:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,`--setenv`,`LANG`,`C.UTF-8`,`--setenv`,`PYTHONDONTWRITEBYTECODE`,`1`,`--setenv`,`XDG_CONFIG_HOME`,`/tmp/home/.config`,`--setenv`,`XDG_CACHE_HOME`,`/tmp/home/.cache`,`--setenv`,`XDG_DATA_HOME`,`/tmp/home/.local/share`,`--setenv`,`GIT_CONFIG_GLOBAL`,`/dev/null`,`--setenv`,`GIT_CONFIG_SYSTEM`,`/dev/null`,`--setenv`,`NPM_CONFIG_USERCONFIG`,`/dev/null`,s,...n]}}async function eg(e,t){if(!t.command||t.command.includes(`/../`)||Fh(t.command))throw Error(`The competition checker command is invalid`);if(!Array.isArray(t.args))throw Error(`The competition checker arguments must be an array`);for(let e of t.args)Ih(e,`Checker argument`);let n=t.timeout_ms??15*6e4;if(!Number.isSafeInteger(n)||n<1e3||n>60*6e4)throw Error(`Checker timeout must be between one second and one hour`);let r=await Zh(e),i;try{let e=await $h(r,t.command,t.args);i=await Mh(e.executable,e.args,{cwd:r,timeout:n,maxBuffer:4194304,encoding:`utf8`})}catch(e){let t=e,n=t.stderr?.trim()||t.stdout?.trim()||t.message||`checker failed`;throw Error(`Pinned checker failed: ${n}`)}let a=String(i.stdout),o=String(i.stderr);return{...Wh(await Gh(r,t,a)),stdout:a,stderr:o}}async function tg(e,t){try{let{root:n,manifest:r}=await vm(e,t.directory),i=await Cm(n),a=r.provenance?await wm(n,r,i,{allowMissing:!0}):void 0,o=Np(),s=H(`Running ${r.title} checker…`);t.json||s.start();let c;try{c=await eg(n,r.checker)}finally{s.stop()}let l=Om(c,a,r.provenance,void 0,{allowMissingSource:!0,requirePullRequest:!1}),u=fn(T(32)),d=Oh(c.candidateRef,u),f={version:1,competition:r.slug,candidateRef:c.candidateRef,evidence:l.evidence,evidenceJson:c.evidenceJson,evidenceRefs:l.evidenceRefs,salt:u,candidateId:d,...a?{source:a}:{},deviceAddress:o.account.address,clientSubmissionId:E(),createdAt:new Date().toISOString()};await km(j.join(n,`.tangle-solve-run.json`),f),t.json?z({localRun:f}):(B(`Checker output recorded locally for operator evaluation`),U({Competition:r.slug,Candidate:c.candidateRef,"Device address":o.account.address,"Evidence refs":l.evidenceRefs.length}),V("Commit any changes, then run `tangle solve submit` from this directory."),r.provenance&&!a&&V(`Add your GitHub fork as 'origin' before submitting. The task repository is available as '${gm}'.`))}catch(e){G(e)}}const ng=/^0x[0-9a-f]{64}$/i;async function rg(e){let t=await $p({deviceAddress:e.deviceAddress,apiUrl:e.apiUrl,profile:e.profile}),n=await e.signer.signMessage({message:t.message});return{walletChallengeId:t.challengeId,walletSignature:n}}async function ig(e,t){try{let{root:n,manifest:r}=await vm(e,t.directory);Xp({profile:t.profile});let i=await Cm(n),a=await Am(n);if(a.competition!==r.slug)throw Error(`.tangle-solve-run.json does not match this competition`);if(!ng.test(a.salt)||!ng.test(a.candidateId))throw Error("This run predates durable candidate identity. Run `tangle solve run` again");let o=r.provenance?await wm(n,r,i):void 0;if(r.provenance&&a.source&&!Em(a.source,o))throw Error("The saved run points to a different repository or revision. Keep your fork as 'origin' and run `tangle solve run` again before submitting");let s=Mp();if(!s)throw Error("No Solve device signer found. Run `tangle solve run` first");if(s.account.address.toLowerCase()!==a.deviceAddress.toLowerCase())throw Error("The local Solve device account changed after `tangle solve run`; run the checker again");let c=H(`Checking the committed candidate…`);t.json||c.start();let l;try{l=await eg(n,r.checker)}finally{c.stop()}if(l.candidateRef!==a.candidateRef||l.evidenceJson!==a.evidenceJson)throw Error("The committed checker output changed after `tangle solve run`; run the checker again");if(Oh(l.candidateRef,a.salt).toLowerCase()!==a.candidateId.toLowerCase())throw Error(`The saved candidate identity does not match the checker output; run the checker again`);let u=Jp(t.prUrl);if(!r.provenance&&u)throw Error(`This competition does not accept GitHub pull request provenance`);if(u){if(!o)throw Error(`A provenance policy is required for a pull request`);await jm({pullRequest:u,taskRepository:o.taskRepository,submissionRepository:o.submissionRepository,submissionRevision:i})}let d=Om(l,o,r.provenance,u,{requirePullRequest:!0}),f={...a,...o?{source:o}:{},chainState:{status:`submitting`,transactions:{...a.chainState?.transactions??{}}}},p=j.join(n,`.tangle-solve-run.json`);await km(p,f);let m=H(`Submitting candidate to Tempo…`);t.json||m.start();let h;try{h=await jh(lm(r),s.account,{artifactRef:l.candidateRef,salt:a.salt,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs},{resumeTransactions:f.chainState?.transactions,onTransaction:async(e,t)=>{f={...f,chainState:{status:`submitting`,transactions:{...f.chainState?.transactions??{},[e]:t}}},await km(p,f)}})}finally{m.stop()}f={...f,chainReceipt:h,chainState:{status:`accepted`,transactions:{...f.chainState?.transactions??{},...Mm(h)}}},await km(p,f);let g=await rg({deviceAddress:h.address,signer:s.account,apiUrl:t.apiUrl,profile:t.profile}),_=await Qp({path:`/v1/submissions`,method:`POST`,apiUrl:t.apiUrl,profile:t.profile,body:{competition:r.slug,candidateRef:l.candidateRef,candidateId:h.candidateId,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs,deviceAddress:h.address,reportTxHash:h.report,evaluationTxHash:h.evaluation,transactions:Mm(h),...r.provenance&&o?{source:{...o,...u?{pullRequest:u}:{}}}:{},clientSubmissionId:a.clientSubmissionId,...g,...t.model?{model:t.model}:{},...t.note?{note:t.note}:{}}});t.json?z({..._,transactions:Mm(h),candidateId:h.candidateId}):(B(`Submission accepted on Tempo`),U({Competition:r.slug,Candidate:h.candidateId,"Device address":h.address,"Report transaction":h.report,"Evaluation transaction":h.evaluation,"Submission ID":typeof _.id==`string`?_.id:_.submission?.id}))}catch(e){G(e)}}function ag(){let e=new S(`solve`).description(`Participate in Tangle Solve competitions`);e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(Fm),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).action(tg),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(ig),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).action(Fp);let t=e.command(`device`).description(`List and revoke the Solve devices bound to your account`);return t.command(`list`).description(`List your devices and whether each may submit jobs on Tempo`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(e=>Eh(e)),t.command(`revoke <address>`).description(`Permanently revoke a device; the local device is revoked with its own key`).option(`--reason <text>`,`Why the device is revoked (shown to the account)`).option(`--yes`,`Confirm the permanent revocation without a prompt`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action((e,t)=>Dh(e,t)),e}function og(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sandboxes/${t}/runtime/ssh`}function sg(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function cg(e){return`'${e.replace(/'/g,`''`)}'`}function lg(e){return e===`win32`?`NUL`:`/dev/null`}function ug(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${cg(`<token>`)}; ssh ${e.map(cg).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${sg(`<token>`)} ssh ${e.map(sg).join(` `)}`}function dg(e){return e.connection!==void 0&&!e.connection.ssh}function fg(){Tn(`SSH is not enabled for this sandbox.`),V(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function pg(e,t=[],n=process.platform){let r=lg(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function mg(){return new S(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).allowUnknownOption(!0).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Getting SSH credentials...`);a.start();let o=await Y(i,r,e);if(dg(o)){a.stop(),fg();return}o=await X(o);let s=await o.ssh();if(a.stop(),!s){fg();return}let c={...s,proxyCommand:og(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=pg(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(ug(l,process.platform));return}V(`Connecting via tunnel...`);let u=Ee(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(Tn(`SSH client not found. Please install OpenSSH.`),process.exit(1)),G(e)}),u.on(`exit`,e=>{process.exit(e??0)})})}function hg(){let e=new S(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).action(async e=>{let t=H(`Fetching SSH keys...`);try{t.start();let n=await q(K(e)).sshKeys.list();t.stop(),e.json?z({sshKeys:n}):n.length===0?V(`No SSH keys found.`):jn([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),G(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).action(async(e,t)=>{let n=H(`Adding SSH key...`);try{let r=fe(t.keyFile,`utf8`).trim();n.start();let i=await q(K(t)).sshKeys.create(e,r);n.stop(),t.json?z({sshKey:i}):B(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),G(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=H(`Deleting SSH key...`);try{n.start(),await q(K(t)).sshKeys.delete(e),n.stop(),B(`Deleted SSH key ${e}`)}catch(e){n.stop(),G(e)}}),e}function gg(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function _g(){return new S(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||gg(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new gn(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===gn.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===gn.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),gg(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}function vg(){let e=new S(`team`).description(`Manage teams`);return Sg(e,`list`).description(`List teams for the current account`).action(async e=>{let t=K(e),n=q(t),r=e.json?null:H(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){z({teams:i,activeTeamId:t.activeTeamId??null});return}R(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}),Sg(e,`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).action(async(e,t)=>{let n=K(t),r=q(n),i=t.json?null:H(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&_c(a,n.profile),i?.stop(),t.json){z({team:a,active:!!t.switch});return}B(`Team created: ${mc(a)}`),t.switch&&B(`Active team set to ${a.name}`)}),Sg(e,`switch <team>`).description(`Set the active team for the current profile`).action(async(e,t)=>{let n=K(t),r=await hc(q(n),e);if(_c(r,n.profile),t.json){z({team:r,activeTeamId:r.id});return}B(`Active team set to ${mc(r)}`)}),e.command(`current`).description(`Show the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{let t=ti(e.profile);if(e.json){z(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}U({ID:t.activeTeamId,Name:t.activeTeamName})}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{if(vc(e.profile),e.json){z({activeTeamId:null});return}B(`Active team cleared.`)}),Sg(e,`members [team]`).description(`List team members`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){z({team:i,members:a});return}R(a,[{key:`id`,header:`ID`,width:36},{key:`customerEmail`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}),Sg(e,`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile),a=yg(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){z({team:i,member:o});return}B(`Member updated: ${o.customerEmail}`),U({Team:i.name,Role:o.role,Status:o.status})}),Sg(e,`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile),a=yg(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){z({team:i,invitation:o});return}B(`Invitation created for ${o.email}`),U({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),B(`Re-run with --json to retrieve the invitation token for sharing.`)}),Sg(e,`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile);if(!(!t.force&&!t.json&&!await Bi(`Leave team '${i.name}'? (y/N) `,`--force`))){if(await r.teams.leave(i.id),n.activeTeamId===i.id&&vc(n.profile),t.json){z({success:!0,teamId:i.id});return}B(`Left team: ${i.name}`)}}),Sg(e,`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).action(async(e,t,n)=>{let r=K(n),i=q(r),a=await gc(i,t,r.profile);if(!(!n.force&&!n.json&&!await Bi(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `,`--force`))){if(await i.teams.transferOwnership(a.id,e),n.json){z({success:!0,teamId:a.id,newOwnerCustomerId:e});return}B(`Ownership transferred for ${a.name}`)}}),e.addCommand(bg()),e.addCommand(xg()),Sg(e,`invitations [team]`).description(`List pending and historical team invitations`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){z({team:i,invitations:a});return}R(a,[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}),Sg(e,`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).action(async(e,t)=>{let n=K(t),r=q(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&_c(a,n.profile),t.json){z({member:i,activeTeamId:a?.id??null});return}B(`Invitation accepted for team ${i.teamId}`),a&&B(`Active team set to ${a.name}`)}),Sg(e,`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).action(async(e,t)=>{if(await q(K(t)).teams.revokeInvitation(e),t.json){z({success:!0,invitationId:e});return}B(`Invitation revoked: ${e}`)}),Sg(e,`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){z({success:!0,teamId:i.id,memberId:e});return}B(`Member removed: ${e}`)}),e}function yg(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function bg(){let e=new S(`secret`).description(`Manage team secrets`);return Sg(e,`list [team]`).description(`List team secret names`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){z({team:i,secrets:a});return}R(a,[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}),Sg(e,`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=K(n),i=q(r),a=await gc(i,n.team,r.profile),o=await Tp({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){z({team:a,secret:s});return}B(`Team secret saved: ${s.name}`)}),Sg(e,`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Bi(`Delete team secret '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteSecret(i.id,e),t.json){z({success:!0,teamId:i.id,name:e});return}B(`Team secret deleted: ${e}`)}}),Sg(e,`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){z({teamId:i.id,...a});return}console.log(a.value)}),e}function xg(){let e=new S(`templates`).description(`Manage team golden-path templates`);return Sg(e,`list [team]`).description(`List a team's golden-path templates`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){z({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}R(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}),Sg(e,`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).action(async(e,t,n)=>{let r=K(n),i=q(r),a=await gc(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){z({team:a,template:s});return}B(`Team template created: ${s.name} (${s.id})`)}),Sg(e,`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Bi(`Delete template '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteTemplate(i.id,e),t.json){z({success:!0,teamId:i.id,templateId:e});return}B(`Team template deleted: ${e}`)}}),e}function Sg(e,t){return e.command(t).option(`--profile <profile>`,`Credential profile`)}async function Cg(e,t,n){let r=new AbortController,i=()=>r.abort();try{let n=q(K({...e,timeout:void 0}));process.once(`SIGINT`,i),process.once(`SIGTERM`,i);let a=await t(n,{...e.timeout===void 0?{}:{timeoutMs:Number(e.timeout)*1e3},resumeJobId:e.resumeJob,signal:r.signal,onProgress:e=>{process.stderr.write(`Publication ${e.id}: ${e.status}\n`)}}).finally(()=>{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)});e.json?z(a):B(`template`in a?`Published template: ${a.template.slug}`:`Published template version: ${a.version.id}`)}catch(t){if(t instanceof o&&t.status!==401&&t.job&&[`pending`,`scanning`,`ready`].includes(t.job.status)){let e=[`tangle`,`template`,...n,`--resume-job`,t.job.id].map(qe).join(` `);Object.assign(t,{fix:{command:e}})}G(t,e.json)}}function wg(){let e=new S(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).action(async e=>{let t=q(K(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){z({templates:n});return}R(n,[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forkCount`,header:`Forks`,width:8},{key:`sandboxCount`,header:`Sandboxes`,width:12},{key:`updatedAt`,header:`Updated`,width:24}])}),e.command(`get <id-or-slug>`).action(async(e,t)=>{let n=await q(K(t)).publicTemplates.get(e);if(t.json){z({template:n});return}z(n)}),e.command(`versions <id-or-slug>`).action(async(e,t)=>{let n=await q(K(t)).publicTemplates.versions(e);if(t.json){z({versions:n});return}R(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`createdAt`,header:`Created`,width:24}])}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).action((e,t,n,r)=>Cg(r,async(i,a)=>({template:await i.publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom},a)}),[`publish`,e,t,n])),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).action((e,t,n,r)=>Cg(r,async(i,a)=>({version:await i.publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes},a)}),[`publish-version`,e,t,n])),e}function Tg(){let e=new S(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:Ig(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:Vg(e.limit)},n=Dg(e),r=e.json?null:H(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return z(i);Ag(i.items),Pg(i.nextCursor)}catch(t){kg(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).action(async(e,t)=>{try{let n=Dg(t);if(t.ndjson){await Og(n,e);return}let r=t.json?null:H(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:Vg(t.limit)});if(r?.stop(),t.json)return z(i);jg(i.items),i.truncated&&U({Spans:`${i.items.length} of ${i.total} (truncated)`}),Pg(i.nextCursor)}catch(e){kg(e,t)}}),e.addCommand(Eg()),e}function Eg(){let e=new S(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).action(async e=>{try{let t={status:e.status===void 0?void 0:Rg(e.status),gate:e.gate===void 0?void 0:Bg(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:Vg(e.limit)},n=Dg(e),r=e.json?null:H(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return z(i);Mg(i.items),Pg(i.nextCursor)}catch(t){kg(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).action(async(e,t)=>{try{let n=Dg(t),r=t.json?null:H(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return z(i);Ng(i)}catch(e){kg(e,t)}}),e}function Dg(e){let t=Gr(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return _n({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function Og(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function kg(e,t){return G(e,t.json===!0)}function Ag(e){R(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:Fg(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function jg(e){R(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function Mg(e){R(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function Ng(e){U({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function Pg(e){e&&U({"Next page":`--cursor ${e}`})}function Fg(e){return e===null?`-`:`$${e.toFixed(4)}`}function Ig(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const Lg=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function Rg(e){let t=Lg.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${Lg.join(`, `)}`)}const zg=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function Bg(e){let t=zg.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${zg.join(`, `)}`)}function Vg(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Hg(){return new S(`usage`).description(`Show account usage and billing information`).action(async e=>{let{client:t}=J(e),n=e.json?null:H(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?z({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),U({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":Ug(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":Wg(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),U({Plan:i.plan,Status:i.status,"Credits Available":Wg(i.creditsAvailableUsd),"Credits Used":Wg(i.creditsUsedUsd),"Monthly Balance":Wg(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),U({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())})}function Ug(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Wg(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function Gg(){return new S(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{if(t.clear){Lr(),V(`Cleared the active sandbox.`);return}if(e){Ir(e),V(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=Fr();V(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")})}function Kg(e){R(e,[{key:`id`,header:`ID`},{key:`nodeId`,header:`Node`},{key:`name`,header:`Name`},{key:`contentType`,header:`Content Type`},{key:`byteSize`,header:`Bytes`},{key:`createdAt`,header:`Created`}])}function qg(e){e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.listArtifacts(e,t);if(n.json)return z(r);Kg(r.artifacts)}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).action(async(e,t,n,r)=>{let i=await(await Q(r)).workflows.downloadArtifact(e,t,n),a=r.out??n;try{me(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return z({file:a,contentType:i.contentType,bytes:i.bytes.length});V(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)})}function Jg(e){R(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function Yg(e){e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=(await(await Q(t)).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return z({decisions:n});Jg(n)}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).action(async(e,t,n)=>{let r=await Q(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return z(a);if(a.resumed){V(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}V(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)})}function Xg(e){try{return fe(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Zg(e){R(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function Qg(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;V(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),R(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function $g(e){if(U({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(V(`Triggers`),e_(e.triggers)),e.validationErrors.length>0){V(`Validation issues`);for(let t of e.validationErrors)console.log(`  ${t.path}: ${t.message}`)}}function e_(e){R(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function t_(e){e.command(`list`).description(`List your workflows`).action(async e=>{let t=await(await Q(e)).workflows.list();if(e.json)return z(t);Zg(t)}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).action(async e=>{let t=await(await Q(e)).workflows.fleetInsights({window:e.window});if(e.json)return z(t);Qg(t)}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).action(async(e,t)=>{let n=await(await Q(t)).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
-`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return z(n);$g(n)}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Xg(e),r=await(await Q(t)).workflows.create(n);if(t.json)return z(r);V(`Created workflow ${r.id} (${r.name}).`),$g(r)}),e.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Xg(e),r=await Q(t),i=await r.workflows.validate(n,{structural:!0});if(!i.valid){if(process.exitCode=1,t.json)return z(i);V(`Invalid workflow:`);for(let e of i.errors)console.log(`  ${e.path}: ${e.message}`);return}let a=(await r.workflows.list()).find(e=>e.name===i.name);if(a){let e=await r.workflows.update(a.id,n);if(t.json)return z({action:`updated`,workflow:e});V(`Updated workflow ${e.id} (${e.name}) — matched by name.`),$g(e);return}let o=await r.workflows.create(n);if(t.json)return z({action:`created`,workflow:o});V(`Created workflow ${o.id} (${o.name}).`),$g(o)}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).action(async(e,t,n)=>{let r=Xg(t),i=await(await Q(n)).workflows.update(e,r,{...n.note===void 0?{}:{note:n.note}});if(n.json)return z(i);V(`Updated workflow ${i.id} (${i.name}).`),$g(i)}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{if(!t.force&&!await Bi(`Delete workflow ${e}? `,`--force`)){V(`Delete cancelled.`);return}if(await(await Q(t)).workflows.delete(e),t.json)return z({deleted:!0,id:e});V(`Deleted workflow ${e}.`)}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).action(async(e,t)=>{let n=Xg(e),r=await(await Q(t)).workflows.validate(n,{...t.structural?{structural:!0}:{}});if(t.json)return z(r);if(r.valid)V(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{V(`Invalid workflow:`);for(let e of r.errors)console.log(`  ${e.path}: ${e.message}`);process.exitCode=1}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).action(async e=>{z(await(await Q(e)).workflows.schema())})}async function n_(e,t,n){let r=await(await Q(n)).workflows.setEnabled(e,t);if(n.json)return z(r);V(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),$g(r)}function r_(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function i_(e,t){try{me(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function a_(e){R(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function o_(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function s_(e){e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await n_(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await n_(e,!1,t)}),e.command(`templates`).description(`List the curated starter workflow templates`).action(async e=>{let t=await(await Q(e)).workflows.listTemplates();if(e.json)return z(t);a_(t)}),e.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,uu,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).action(async(e,t)=>{let n=du(t.param,`param`)??{},r=await(await Q(t)).workflows.instantiateTemplate(e,n);if(t.json)return z(r);if(!r.created){V(`Template ${e} needs provider connections before it can run:`);for(let e of r.connectionRequirements)console.log(`  ${e.connected?`✓`:`✗`} ${o_(e,r.connectionRequirements)}`);process.exitCode=1;return}let{workflow:i}=r;if(i.definitionYaml===null)throw Error(`Workflow ${i.id} was created but the server returned no definition YAML`);if(V(`Created workflow ${i.id} (${i.name}).`),t.file){i_(t.file,i.definitionYaml),V(`Wrote ${t.file}.`);return}process.stdout.write(i.definitionYaml.endsWith(`
+<script>${a(r)}<\/script></body></html>`,c=M(await Qe(M(Ce(),`tangle-graph-`)),`${o}.html`);return await L(c,s,{mode:384}),c}function Gd(e,t,n){e.command(`show <name-or-file>`).description(`Draw a graph file: labelled nodes, routes, loops and stops`).option(`--open`,`Write one offline page and open it in the browser`).action(async(e,r)=>{let i=await I(t(e,process.cwd())),a=Vd(i,await F(i,`utf8`));if(r.json)return z(a);if(!r.open)return console.log(Ud(a));let o=await Wd(a,n);V(await fa(Gt(o).href)?`Opened ${o}`:`Open ${o}`)})}async function Kd(e){if(!Gr(e.apiKey)){if(e.json||e.dryRun||!process.stdin.isTTY)return;await xa({baseUrl:e.sandboxBaseUrl,signal:e.signal})}return Oi(e)}async function qd(e,t,n){let r=_f(t.parameter),i=n??await Kd(t);if(!i)throw new W(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let a=await i.connections.start(e,{cli:!0,connectionParameters:r,...t.scope?.length?{requestedScopes:t.scope}:{}});return t.json?(z(yf(a)),a):(vf(a,t.browser===!1?!1:await fa(a.redirectUrl),t.wait),a)}async function Jd(e,t,n,r){let i=async()=>{n.signal?.throwIfAborted();let{connections:i}=await e.connections.list(),a=i.filter(e=>e.status===`active`&&e.providerId.toLowerCase()===t.trim().toLowerCase());return a.length?Ne(a,r===void 0?t:`${t}:${r}`):void 0},a=await i();if(a||n.json||n.dryRun||!process.stdin.isTTY)return a;let o=await qd(t,{...n,wait:!0},e);for(;!a&&Date.now()<Date.parse(o.expiresAt);)await Le(1e3,void 0,{signal:n.signal}),a=await i();return a}function Yd(){let e=new S(`hub`).description(`Discover and run Tangle Hub tools`);return Xd(e),Zd(e),Qd(e),$d(e),ef(e),e}function Xd(e){e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--key-env <name>`,`Connect an API-key provider using this environment variable; never prints the key`).option(`--metadata <json>`,`Provider setup metadata for API-key connections`).option(`--scope <scope>`,`Request an OAuth scope; repeatable, must stay within the host's grant`,(e,t)=>[...t,e],[]).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,(e,t)=>[...t,e],[]).action(async(e,t)=>{if(t.keyEnv){if(t.scope?.length)throw Error(`--scope applies to OAuth connections, not --key-env.`);let n=process.env[t.keyEnv];if(!n?.trim())throw Error(`Environment variable '${t.keyEnv}' is empty or unavailable.`);let r=await Kd(t);if(!r)throw new W(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let i;if(t.metadata!==void 0)try{i=JSON.parse(t.metadata)}catch{throw Error(`--metadata must be valid JSON.`)}let a=await r.connections.connectApiKey(e,n,i);t.json?z(a):V(`Connected ${a.connection.providerId} as ${a.connection.id}.`);return}if(t.metadata!==void 0)throw Error(`--metadata requires --key-env.`);await qd(e,t)});let t=new S(`connections`).description(`List Hub provider connections`).action(async e=>{let t=await(await Oi(e)).connections.list();e.json?z(t):gf(t.connections)});t.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=await Oi(t),r=await ui(n,e);if(!t.force&&!await Bi(`Revoke Hub connection ${r}? `,`--force`)){V(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){z(i);return}V(`Revoked Hub connection ${i.connection.id}.`)}),e.addCommand(t)}function Zd(e){e.command(`providers [provider]`).description(`Show provider setup and action catalog; use hub events for trigger readiness`).action(async(e,t)=>{let n=await(await Oi(t)).connections.providers(),r=n.providers.filter(t=>!e||t.providerId===e.toLowerCase());if(e&&!r.length)throw Error(`Provider '${e}' is absent from this deployment's catalog.`);if(t.json)return z({...n,providers:r});R(r,[{key:`providerId`,header:`Provider`},{key:`authKind`,header:`Auth`},{key:`configured`,header:`Connect configured`},{key:`actionCount`,header:`Catalog actions`}])}),e.command(`events [provider]`).description(`Discover deployed trigger events and ingress readiness separately from callable tools`).action(async(e,t)=>{let n=await Oi(t),[r,i]=await Promise.all([n.connections.providers(),n.workflows.catalogs()]),a=[...new Set([...r.providers.map(e=>e.providerId),...i.providerEventProviders])];if(e&&!a.includes(e.toLowerCase()))throw Error(`Provider '${e}' is absent from this deployment's catalog.`);let o=a.filter(t=>!e||t===e.toLowerCase()).map(e=>({provider:e,supported:i.providerEventProviders.includes(e),ingressConfigured:r.providers.find(t=>t.providerId===e)?.eventIngressConfigured??null,catalog:i.triggerEvents[e]??null}));if(t.json)return z({providers:o});R(o.map(e=>({...e,ingress:e.ingressConfigured===null?`unknown`:e.ingressConfigured?`ready`:`setup required`,events:e.catalog?.events.map(e=>e.id).join(`, `)??`no published vocabulary`})),[{key:`provider`,header:`Provider`},{key:`supported`,header:`Event source supported`},{key:`ingress`,header:`Ingress`},{key:`events`,header:`Events`}])})}function Qd(e){let t=new S(`permissions`).description(`Manage Hub action permissions`);t.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await Oi(e),n=await ui(t,e.connection),r=await t.permissions.list(n);e.json?z(r):df(r.policies)}),t.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=ff(e.decision),n=await Oi(e),r=await ui(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});e.json?z(i):df([i.policy])}),t.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await Oi(e),n=await ui(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){z(r);return}V(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}),e.addCommand(t),e.addCommand(nf())}function $d(e){let t=new S(`tools`).description(`Discover Hub tools`);t.command(`sources`).description(`List Hub tool sources`).action(async e=>{let t=await(await Oi(e)).tools.sources();e.json?z(t):pf(t.sources)}),t.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).action(async(e,t)=>{let n=await(await Oi(t)).tools.describe(e);t.json?z(n):mf(n.tool)}),t.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).action(async(e,t)=>{let n=await(await Oi(t)).tools.search(e.join(` `),{provider:t.provider});t.json?z(n):uf(n.tools)}),e.addCommand(t),e.addCommand(tf(`call`)),e.addCommand(tf(`exec`))}function ef(e){e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).action(async(e,t)=>{if(af(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await Oi(t);sf(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}),e.command(`status`).description(`Show Hub auth and connection status`).action(async e=>{let t=await(await Oi(e)).status();e.json?z(t):bf(t)})}function tf(e){return new S(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).action(async(e,t)=>{let{args:n,approve:r}=rf(e,t),{path:i,input:a}=lf(n),o=await Oi(t),s=t.connection?await ui(o,t.connection):void 0;z((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)})}function nf(){let e=new S(`approvals`).description(`List and resolve Hub execution approvals`);e.command(`list`).description(`List pending Hub execution approvals`).action(async e=>{let t=await(await Oi(e)).approvals.list();e.json?z(t):of(t.approvals)});for(let t of[`approve`,`deny`])e.command(t).description(`${t===`approve`?`Approve`:`Deny`} a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).action(async(e,n)=>{af(e),sf(await(await Oi(n)).approvals[t](e),n.json===!0)});return e}function rf(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function af(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function of(e){R(e,[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`connectionId`,header:`Connection`},{key:`status`,header:`Status`},{key:`expiresAt`,header:`Expires`}])}function sf(e,t){if(t){z(cf(e));return}V(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&V("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function cf(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function lf(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e[e.length-1];try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function uf(e){R(e.map(e=>({...e,provider:e.providerId??e.requiredConnectionProviderId,connection:hf(e)})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policyState`,header:`Policy`}])}function df(e){R(e,[{key:`connectionId`,header:`Connection`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updatedAt`,header:`Updated`}])}function ff(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function pf(e){R(e,[{key:`sourceId`,header:`Source`},{key:`displayName`,header:`Provider`},{key:`toolCount`,header:`Tools`},{key:`connectionStatus`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function mf(e){U({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:hf(e),Policy:e.policyState}),e.inputSchema!==void 0&&(V(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(V(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function hf(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function gf(e){R(e.map(e=>({...e,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `)})),[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsedAt`,header:`Last Used`}])}function _f(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function vf(e,t,n=!1){t?V(`Opened browser to connect ${e.provider}.`):(V(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),V(n?`Finish authorization in the browser; this run resumes when connected.`:"Finish authorization in the browser, then rerun `tangle hub status`.")}function yf(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function bf(e){let{principal:t,connections:n}=e;V(`Hub status`),U({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&V(`Some providers require reconnect.`)}const xf=t(import.meta.url);if(!xf)throw Error(`Tangle CLI package metadata was not found`);const Sf=ge(xf),$=e=>w(`sha256`).update(e).digest(`hex`);function Cf(e,t){if(/[\\/]/.test(e)||/\.(yaml|yml|json)$/.test(e))return be(t,e);let n=t;for(;!ue(M(n,`.git`))&&ge(n)!==n;)n=ge(n);ue(M(n,`.git`))||(n=t);let r=[`yaml`,`yml`,`json`].flatMap(e=>[`graph.${e}`,e]),i=[n,N()].flatMap(t=>r.map(n=>M(t,`.tangle/graphs/${e}.${n}`))),a=i.find(ue);if(a)return a;throw new W(`GRAPH_NOT_FOUND`,`Graph '${e}' was not found`,`Looked in ${i.join(`, `)}`,`tangle graph --help`)}async function wf(e,t){return qc(e.signal,async n=>{let r=e.runId??E(),i,a=new Set,{graphNativeRedaction:o}=await import(`./graph-native-Cl6SphYB.mjs`),s=o();try{let o=M(N(),`.tangle`,`runs`,r);await Ze(o,{recursive:!0,mode:448});let c=await I(M(N(),`.tangle`)),l=await I(e.cwd??process.cwd()),u=[`runs`,`graph-registry`,`graphs`].some(e=>Cl(l,M(c,e))||Cl(M(c,e),l))?M(N(),`.tangle`,`workspaces`,r):l;await Ze(u,{recursive:!0,mode:448});let d;return await t({runId:r,runDir:o,cwd:u,bridge:t=>d??=(async()=>{n.throwIfAborted();let r=T(32).toString(`hex`),{loadConfig:c,startServer:l}=await import(`cli-bridge`),d=M(Sf,`dist`,`stdio.mjs`),f={...process.env,BRIDGE_HOST:`127.0.0.1`,BRIDGE_BEARER:r,BRIDGE_DATA_DIR:M(o,`bridge`),BRIDGE_BACKENDS:Kl,BRIDGE_JAIL_MODE:`fs-jail`,BRIDGE_JAIL_FALLBACK:`deny`,BRIDGE_JAIL_NETWORK:`relay`,BRIDGE_SUBSCRIPTIONS_ONLY:`1`};e.relayAllow?f.BRIDGE_JAIL_RELAY_ALLOW=e.relayAllow:delete f.BRIDGE_JAIL_RELAY_ALLOW;let p=c(f);t&&p.jailReadablePaths.push(d),i=await l({cwd:u,config:{...p,port:0},handleSignals:!1,quiet:!0,onRunRedaction:s.observe,mcpSecrets:{async get(t){let n=e.mcpSecretEnv,r=n&&Object.hasOwn(n,t)?n[t]:void 0,i=r===void 0?void 0:process.env[r];return i&&a.add(i),i}},hub:t?{client:t,hash:Kc,serverForGrant:e=>{if(a.add(e),!i)throw Error(`Hub host is not ready`);return{transport:`stdio`,command:process.execPath,args:[{kind:`public`,value:d}],env:{TANGLE_HUB_MCP_ENDPOINT:{kind:`public`,value:`${i.url}/hub/mcp/grants/${e}`}}}}}:void 0});let{graphNativeCapture:m}=await import(`./graph-native-Cl6SphYB.mjs`);return{harnessTranscript:m({bridgeUrl:i.url,bridgeBearer:r,cwd:u,privateMcpSecrets:()=>[...a],redact:s.redact}),backend:`bridge`,bridgeUrl:i.url,bridgeBearer:r,cwd:u}})(),signal:n})}catch(t){throw t instanceof Error&&Object.assign(t,{runId:e.errorRunId??r}),t}finally{try{await i?.close()}finally{s.close(),a.clear()}}},e.fix??`tangle graph --help`)}function Tf(e,t){return[`tangle graph run`,qe(e),...t.dryRun?[`--dry-run`]:[],...t.cloud?[`--cloud`]:[],...t.deploy?[`--deploy`,qe(t.deploy)]:[],...t.workflow?[`--workflow`,qe(t.workflow)]:[],...t.resume?[`--resume`,qe(t.resume)]:[],...t.seat?[`--seat`,qe(t.seat)]:[],...t.seatAccount?[`--seat-account`,qe(t.seatAccount)]:[],...t.seatCommand?[`--seat-command`,qe(t.seatCommand)]:[],...t.param.flatMap(e=>[`--param`,qe(e)])].join(` `)}async function Ef(e,t,n={}){let r=n,i=Tf(e,t);return await qc(r.signal,async n=>{n.throwIfAborted();let a=ul(t.mcpSecret);if(t.resume&&!t.resume.startsWith(`wfrun_`)&&(t.workflow||t.deploy)&&Z(`A local run cannot move to a cloud deployment`),t.deploy&&!t.cloud&&!t.workflow&&!t.resume?.startsWith(`wfrun_`))throw new W(`GRAPH_DEPLOY_INVALID`,`Deployment settings require cloud placement`,`Use --cloud to bind cloud triggers and settings`,`tangle graph run --help`);let o=await I(Cf(e,r.cwd??process.cwd())),s=r.source??await F(o,`utf8`),c=t.resume&&!t.resume.startsWith(`wfrun_`)?await Bl(t.resume):void 0,l=r.taskWorkspace??(t.taskWorkspace?await Nl(t.taskWorkspace):void 0)??c?.taskWorkspace;if(c&&(l?kl(l):null)!==(c.taskWorkspace?kl(c.taskWorkspace):null)&&Z(`The recorded task workspace snapshot changed`),l&&(t.cloud||t.workflow||t.resume?.startsWith(`wfrun_`)))throw Error(`Local private task workspace artifacts cannot be dispatched to a cloud backend`);let u=c?.runId??r.runId??E(),d=l&&!r.taskWorkspace?await Fl(l,{runId:u,resumeCwd:c?.cwd,signal:n,validationOnly:t.dryRun===!0&&!c&&!r.runId}):void 0;d&&(r={...r,runId:u,cwd:d.cwd,taskWorkspace:l});try{if(!t.resume&&(t.cloud||t.workflow)||t.resume?.startsWith(`wfrun_`))return Cu(o,s,t,n);let e=await bl(),l=$(s),u=Object.entries(fu(t.param,`param`)??{}),d=Object.fromEntries(u.filter(([e])=>!e.startsWith(`gate.`))),f=Object.fromEntries(u.filter(([e])=>e.startsWith(`gate.`)).map(([e,t])=>[e.slice(5),t])),p=Ae.parse(t.mcpPolicy??c?.mcpPolicy??{}),m=e.graphRegistry(M(N(),`.tangle`,`graph-registry`)),h;if(c){await I(c.cwd)!==c.cwd&&Z(`The recorded workspace identity changed`),c.file!==o&&Z(`The recorded graph source path changed`);let n=await e.loadGraph(m,c.graphDigest);n||Z(`The recorded executable graph is unavailable`),h=e.validateStoredGraph(n),Wl(c,t,l,d,f)}let g={apiKey:t.apiKey,sandboxBaseUrl:t.baseUrl,signal:n,json:t.json,dryRun:t.dryRun&&!r.connectNeeds},_,v=()=>_??=Kd(g),y=new Map,b=(e,{account:t})=>{let n=JSON.stringify([e.trim().toLowerCase(),t?.toLowerCase()]),r=y.get(n)??(async()=>{let n=await v(),r=n&&await Jd(n,e,g,t);return r?{connectionId:r,capabilities:[`*`]}:void 0})();return y.set(n,r),r},x=async i=>{if(n.throwIfAborted(),c&&h)return Jc(h,c.gateChoices??{}),{graph:h,params:c.params};let a=await e.loadGraphFile(o,{source:s,seat:t.seat??(r.defaultSeat===void 0?Ar().seat:r.defaultSeat??void 0),resolveSeat:ql(i,n),resolveNeed:b,params:d,...r.trigger?{trigger:r.trigger}:{},cwd:i,signal:n});if(n.throwIfAborted(),Jc(a.graph,f),r.graphDigest&&a.graph.digest!==r.graphDigest)throw new W(`GRAPH_CHANGED`,`The validated graph changed before execution`,`Its compiled graph digest no longer matches validation`,`tangle graph run --help`);return a},S=r.cwd??process.cwd(),C=await x(c?.cwd??S),w=je(p,!0),T=[];for(let e of C.graph.nodes){let t=oe(e.profile,w);if(!t.ok)throw new W(`GRAPH_MCP_POLICY_REQUIRED`,`A graph profile exceeds its host policy`,`${e.id}: ${t.issues.filter(e=>e.level===`error`).map(e=>e.message).join(`; `)}`,`tangle graph run --mcp-policy <policy.json> --help`);for(let t of Object.values(e.profile.mcp??{}))t.enabled!==!1&&t.url&&T.push(new URL(t.url).hostname)}let D=[Xl(C.graph),...T].filter(Boolean).join(`,`)||void 0;if(t.dryRun)return C;let O=Zl(C.graph.nodes)?$l(t):void 0,k=c?.runId??r.runId??E(),ee=c?.cwd??(r.taskWorkspace?S:await e.graphWorkspace(C.graph,{cwd:S,runId:k}));return await wf({...r,runId:k,cwd:ee,signal:n,fix:i,relayAllow:D,mcpSecretEnv:a},i=>Df(i,{kernel:e,registry:m,loaded:C,gateChoices:f,file:o,source:s,sourceDigest:l,context:r,options:t,prior:c,mcpPolicy:p,getHub:v,seatSource:O,signal:n}))}finally{await d?.release()}},i)}async function Df({runId:e,runDir:t,cwd:n,bridge:r},{kernel:i,registry:a,loaded:o,gateChoices:s,file:c,source:l,sourceDigest:u,context:d,options:f,prior:p,mcpPolicy:m,getHub:h,seatSource:g,signal:_}){let{superviseGraphPursuit:v,readSettleRecord:y}=await import(`@tangle-network/agent-runtime/durable`),b=await i.recordStoredGraphRun(a,o.graph),x=p??{version:1,runId:e,cwd:n,file:c,graphDigest:b.digest,sourceDigest:u,source:l,params:o.params,...d.trigger?{trigger:d.trigger}:{},...Object.keys(s).length?{gateChoices:s}:{},startedAt:new Date().toISOString(),...f.seat===void 0?{}:{seat:f.seat},mcpPolicy:m,...d.taskWorkspace&&{taskWorkspace:d.taskWorkspace}};p||await Vl(t,x);let S=p?await y(t):void 0;if(S&&S.tree.root!==e&&Z(`The settlement names another run`),S?.kind===`no-winner`&&Z(`The local run is terminal: ${S.reason}`),S)return{runId:e,graphDigest:b.digest,sourceDigest:u,...vl(S),replayed:!0};let C=i.graphFromStored(b,{trigger:x.trigger}),w=b.nodes.some(e=>e.profile.connections?.length),T=w?await h():void 0;if(w&&!T)throw new W(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured for this local graph`,`tangle auth login`);let E=await r(T),D=i.createPrivateCasArtifactPort(M(t,`artifacts`),e),O=sl(o.params.knowledge,t,D,_),k=g?tu(E,g,_):void 0,ee=x.startedAt;V(`Run ${e} · ${he(c)} · ${n}`);let te=await Of(t);V(`Viewer ${te.url}`);let ne=new AbortController,re=await v(C,{pursuitId:b.digest,runDir:t,runId:e,backend:E,checkArtifacts:D,...O?{resolveSupervisorTools:O}:{},...C.entry===void 0?{driverBackend:E}:{},...b.gates?.length?{decideGate:Yc(x.gateChoices??{},{json:f.json,signal:AbortSignal.any([_,ne.signal])})}:{},resume:!!p,signal:_,...x.trigger?{trigger:x.trigger}:{},...k?{selectSeat:k,coordination:{authentication:!0}}:{},profileSecurity:je(x.mcpPolicy,w)}).finally(async()=>{ne.abort(),await te.close()}),A={runId:e,graphDigest:b.digest,sourceDigest:u,...vl(re.result.result)},ie=re.result.result,{tokens:ae,tokensKnown:oe,iterations:se,ms:ce}=ie.spentTotal;if(await i.recordStoredGraphRun(a,b,{graphDigest:b.digest,evidence:[{kind:`authored-graph`,url:`urn:sha256:${b.digest}`},{kind:`authored-yaml`,url:`urn:sha256:${u}`}],taskDigest:i.taskShapeDigest({graph:he(c),params:o.params,trigger:x.trigger??null,taskWorkspace:x.taskWorkspace?kl(x.taskWorkspace):null}),startedAt:ee,finishedAt:new Date().toISOString(),outcome:ie.kind===`no-winner`?{kind:`no-winner`,reason:ie.reason}:{kind:`delivered`,summary:A.text},cost:{iterations:se,ms:ce,...oe===!1?{}:{tokens:ae.input+ae.output},...A.costUsd===null?{}:{usd:A.costUsd}},traversals:re.result.ledger.length,exhaustedEdges:re.result.exhaustedEdges,source:{kind:`tangle-cli-graph`,id:e}}),ie.kind===`no-winner`)throw Object.assign(new W(`GRAPH_RUN_FAILED`,`Graph '${he(c)}' finished without a result`,re.result.stopped?.reason||re.result.ledger.filter(e=>e.outcome===`unpropagated`&&e.reason).pop()?.reason||ie.reason,`tangle graph inspect ${e}`),{runId:e,runtimeFailures:[...ie.tree.nodes.filter(e=>e.failure).map(e=>({node:e.label,failure:e.failure})),...ie.reason===`driver-failed`&&ie.error.failure?[{node:`root`,failure:ie.error.failure}]:[]]});return A}async function Of(e){let{serveTopWeb:t}=await import(`@tangle-network/agent-runtime/tui`),{readGraphSessions:n}=await import(`./graph-native-Cl6SphYB.mjs`);return t({roots:[e],assets:M(Sf,`dist`,`graph-viewer`),readSessions:n})}async function kf(e,t){if(t.artifacts||t.artifact)return lu(e,t);if(e.startsWith(`wfrun_`)){let n=await Q(t),r=await n.workflows.getRun(e);if(t.json)return z(r);for(let e of r.runtime?.checks??[])V(`${e.node} ${e.status} · exit ${e.exitCode??`none`} · pass ${e.pass??`none`}\n${e.reason??e.tail}`);return V(`Run ${e} · ${n.baseUrl}/app/workflows/${encodeURIComponent(r.workflowId)}/runs/${encodeURIComponent(e)}`)}let n=M(N(),`.tangle`,`runs`,e);if(!/^[a-f0-9-]{36}$/i.test(e)||!ue(n))throw new W(`RUN_NOT_FOUND`,`Run '${e}' was not found`,`Use a run ID printed by tangle graph run`,`tangle graph inspect --help`);let{loadTopSnapshot:r}=await import(`@tangle-network/agent-runtime/tui`);if(t.json)return z(await r(process.cwd(),{runDir:n}));V(`Run ${e} · ${(await Of(n)).url}`)}function Af(){let e=new S(`graph`).description(`Build and run portable agent graphs`);return Id(e),Il(e),Su(e,Cf),Tu(e,Cf),cu(e),Dd(e),Gd(e,Cf,Sf),e.command(`inspect <run>`).description(`Inspect a live or retained graph run`).option(`--artifacts`,`List complete retained check files and capture gaps`).option(`--artifact <node/path>`,`Download one retained check file by node/path or digest`).option(`--out <file>`,`Save artifact bytes to a new private file`).action(kf),e.command(`run <name-or-file>`).description(`Run a saved graph over native subscriptions`).option(`--cloud`,`Run through Tangle's durable cloud workflow owner`).option(`--deploy <file>`,`Cloud deployment settings, including triggers and parameter defaults`).option(`--workflow <id>`,`Run this existing cloud deployment at its exact source and revision`).option(`--resume <run>`,`Resume this run's saved graph and durable execution`).option(`--seat <seat>`,`Use harness/model@effort for every node`).addOption(ll()).option(`--mcp-policy <file>`,`Host-owned JSON policy: allowLocalMcp and allowedMcpHosts; captured for resume`).option(`--seat-account <account>`,`Account id for an all-eligible authored seat`).option(`--seat-command <program>`,`Executable that prints the account id; the harness is its first argument`).option(`--seat-credential <credential>`,`Credential name passed to the seat command after the harness`).option(`--param <key=value>`,`Graph parameter or gate.<id>=<choice>; repeatable`,(e,t)=>[...t,e],[]).option(`--task-workspace <file>`,`Seed a private run copy from an exact local workspace capture`).option(`--dry-run`,`Validate and print the graph without starting agents`).action(async(e,t)=>{let n={...t,mcpPolicy:t.mcpPolicy===void 0?void 0:await dl(t.mcpPolicy)},r=await Ef(e,n);n.json||n.dryRun?z(r):`status`in r?(V(`${r.status} · ${r.runId}`),r.text&&console.log(r.text)):`viewerUrl`in r&&V(`Run ${r.runId} · ${r.viewerUrl}`)}),e}function jf(){let e=new S(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--endpoint <url>`,`OTLP endpoint base`,Ga).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).action(async(e,t)=>{let n=e??`local`;Xa(n);let r=Nf(t.apiKey),i=await to({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??Qa(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){z(a);return}U({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--endpoint <url>`,`OTLP endpoint base`,Ga).action(async e=>{let t=eo(),n=await oo({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:Nf(e.apiKey??t?.apiKey)});e.json?z(n):Mf(n),n.contentSeen||(process.exitCode=1)}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).action(async e=>{try{let t=Pf(e.agent),n=eo(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:Nf(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??Qa(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await If():Ff(e.payload)};if(e.dryRun){let n=ro(r);if(e.json){z(n);return}U({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await io(r);if(e.json){z({traceId:i});return}U({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?z({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}G(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Lf({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Lf({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async e=>{await Lf({type:zf(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).action(async(e,t)=>{let{client:n}=J(t),r=t.json?null:H(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){z(i);return}Rf(i)}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).action(async e=>{let{client:t}=J(e),n=e.json?null:H(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:zf(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Hf(e.limit)});if(n?.stop(),e.json){z(r);return}R(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}),e}function Mf(e){U({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),R(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function Nf(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function Pf(e){if(Za(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function Ff(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function If(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function Lf(e,t){let n=Bf(t.mode),r=Uf(t.metadata),i=t.maxUsd===void 0?void 0:Vf(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let{client:a}=J(t),o=t.json?null:H(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){z(s);return}Rf(s)}function Rf(e){U({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),z(e.result))}function zf(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function Bf(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function Vf(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Hf(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Uf(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const Wf=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function Gf(e,t){let n=await Ci({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}});if(!t||!n.minted)return n;throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function Kf(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await wi(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await qf(i,t));return i}async function qf(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const Jf=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function Yf(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Xf(){let e=new S(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{let t=await Gf(e,!1),n=t.baseUrl,r=await(await Kf(t,`${n}/v1/keys`,{expected:200})).json();if(e.json){z(r);return}jn(Jf,r.data.map(Yf))}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${Wf.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{if(t.product!==void 0&&!Wf.includes(t.product))throw Error(`Invalid --product. Expected one of ${Wf.join(`, `)}`);let n=await Gf(t,!0),r=n.baseUrl,i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=H(`Creating API key...`);a.start();let o=await Kf(n,`${r}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){z(s);return}B(`API key created: ${s.data.prefix}…`),V(`Copy this key now — it will never be shown again:\n${s.data.key}`)}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{let n=await Gf(t,!0),r=n.baseUrl;if(!t.yes&&!await Bi(`Revoke key ${e}? Any service still using it will start to fail.`,`--yes`)){V(`Aborted.`);return}let i=await(await Kf(n,`${r}/v1/keys/${encodeURIComponent(e)}`,{method:`DELETE`,expected:200})).json();if(t.json){z(i);return}B(`Revoked ${e}`)}),e}function Zf(e){if(Pr().token)throw Error(`A line relay cannot manage numbers or attachments. Use your owner CLI outside the agent box.`);return q(K(e))}function Qf(e){if(!e.yes)throw Error(`Review the selected line and use --yes to authorize this change. Attaching enables metered agent work.`)}function $f(e){if(e===`imessage`||e===`whatsapp`||e===`email`||e===`sms`||e===`voice`||e===`telegram`)return e;throw Error(`--transport must be imessage, whatsapp, email, sms, voice, or telegram`)}function ep(e){return e().catch(G)}async function tp(e){let t=await $e(e,`r`);try{if(!(await t.stat()).isFile())throw Error(`Attachment input must be a regular JSON file`);let e=Buffer.alloc(131073),n=0;for(;n<e.length;){let{bytesRead:r}=await t.read(e,n,e.length-n,null);if(r===0)break;n+=r}if(n===e.length)throw Error(`Attachment JSON exceeds 128 KiB`);let r;try{r=JSON.parse(e.subarray(0,n).toString(`utf8`))}catch{throw Error(`Attachment file is not valid JSON`)}if(!r||typeof r!=`object`||Array.isArray(r))throw Error(`Attachment JSON must be an object`);if(Object.hasOwn(r,`number`))throw Error(`Use the line ID argument, not a number field in the attachment file`);return r}finally{await t.close()}}function np(e){e.command(`providers`).description(`List provider transports supported by this Hub deployment`).action(e=>ep(async()=>{z(await Zf(e).lines.providers())})),e.command(`list`).description(`List owned lines, optionally for a saved agent profile or sandbox`).option(`--profile-id <id>`,`Stored profile ID`).option(`--sandbox <id>`,`Existing sandbox ID`).action(e=>ep(async()=>{z(await Zf(e).lines.list({profileId:e.profileId,sandboxId:e.sandbox}))})),e.command(`get`).argument(`<line-id>`).description(`Inspect a line and its current attachment`).action((e,t)=>ep(async()=>{z(await Zf(t).lines.get(e))})),e.command(`numbers`).argument(`<connection-id>`).description(`Discover owned provider numbers; this does not purchase or reserve a number`).option(`--transport <transport>`,`imessage, whatsapp, or sms`,`imessage`).action((e,t)=>ep(async()=>{let n=$f(t.transport);if(n===`email`)throw Error(`Email uses an owned mailbox, not phone inventory`);if(n===`voice`)throw Error(`Voice numbers are listed by ph0ny; provide the owned number ID to lines connect`);if(n===`telegram`)throw Error(`Telegram uses an owned bot, not phone inventory`);z(await Zf(t).lines.numbers(e,n))})),e.command(`connect`).argument(`<connection-id>`).description(`Bind an owned number or identity through Hub; no provider rental is purchased`).option(`--transport <transport>`,`imessage, whatsapp, sms, email, voice, or telegram`,`imessage`).option(`--number-id <id>`,`Exact owned provider number ID; required for voice, SMS, WhatsApp and Linq iMessage`).option(`--address <email>`,`Owned mailbox on a verified email domain`).requiredOption(`--reference <reference>`,`Stable client reference; keep it unchanged on retry`).option(`--label <label>`,`Line display name`).option(`--yes`,`Authorize provider webhook configuration and line binding`).action((e,t)=>ep(async()=>{Qf(t);let n=$f(t.transport);if(n!==`email`&&t.address)throw Error(`--address is email-only`);if((n===`email`||n===`telegram`)&&t.numberId)throw Error(`${n} does not take --number-id`);let r={connectionId:e,label:t.label,clientReference:t.reference},i;if(n===`email`)i={...r,transport:n,address:t.address};else if(n===`telegram`)i={...r,transport:n};else if(n===`imessage`)i={...r,transport:n,phoneNumberId:t.numberId};else{if(!t.numberId)throw Error(`${n} requires --number-id`);i={...r,transport:n,phoneNumberId:t.numberId}}z(await Zf(t).lines.fromConnection(i))})),e.command(`attach`).argument(`<line-id>`).description(`Attach a saved agent to any sandbox, or use an isolated on-demand member instance`).option(`--file <path>`,`Reviewed native attachment JSON (exclusive with quick-setup flags)`).option(`--profile-id <id>`,`Owner-scoped saved profile; each turn pins its source revision`).option(`--member <address>`,`The one allowed sender: E.164 phone or email`).option(`--sandbox <id>`,`Use an existing sandbox instead of an on-demand instance`).option(`--instance-prefix <prefix>`,`Stable instance namespace; defaults to profile:<profile-id>:`).option(`--tools <mode>`,`chat denies tools; act applies the profile's tools and permissions`).option(`--turns-per-day <count>`,`Per-member daily turn ceiling (default 30)`).option(`--yes`,`Authorize agent execution and spend against your key limits`).action((e,t)=>ep(async()=>{Qf(t);let n=Zf(t),r;if(t.file){if(t.profileId||t.member||t.sandbox||t.instancePrefix||t.tools||t.turnsPerDay)throw Error(`Choose --file or quick-setup flags, not both`);r=await tp(t.file)}else{if(!t.profileId||!t.member)throw Error(`Provide --profile-id and --member, or --file`);if(t.sandbox&&t.instancePrefix)throw Error(`Choose --sandbox or --instance-prefix`);let e=t.tools??`chat`,n=Number(t.turnsPerDay??`30`);if(e!==`chat`&&e!==`act`)throw Error(`--tools must be chat or act`);if(!Number.isSafeInteger(n)||n<1||n>1e4)throw Error(`--turns-per-day must be 1–10000`);if(e===`act`&&t.sandbox)throw Error(`Acting tools require an isolated on-demand instance; omit --sandbox`);r={mode:`personal`,members:[{address:t.member,role:`owner`}],unknownSenders:`reject`,roles:{owner:{context:`own`,tools:e}},respond:{kind:`agent`,profileId:t.profileId,...e===`act`?{rolePolicy:{version:1,roles:{owner:{kind:`general`}},members:{}}}:{}},limits:{turnsPerMemberPerDay:n},...t.sandbox?{sandboxId:t.sandbox}:{instance:{keyPrefix:t.instancePrefix??`profile:${t.profileId}:`,create:{ownerContext:`isolated`,...e===`act`?{egressPolicy:{mode:`strict`,allowDomains:[new URL(Qr()).hostname],includeImplicitDomains:!1}}:{}}}}}}if(typeof r.sandboxId==`string`==(r.instance!==void 0))throw Error(`Attachment requires exactly one of sandboxId and instance`);let{sandboxId:i,instance:a,...o}=r,s;if(i){let t=await n.get(i);if(!t)throw Error(`Sandbox not found`);s=await t.lines.attach({...o,number:e})}else{if(!a)throw Error(`Attachment requires an instance`);s=await n.lines.attach({...o,number:e,instance:a})}z(s)}));for(let t of[`detach`,`release`])e.command(t).argument(`<line-id>`).description(t===`detach`?`Stop dispatch; preserve history and provider rental`:`Retire a detached Hub line; does not cancel provider rental`).option(`--yes`,`Authorize this change`).action((e,n)=>ep(async()=>{Qf(n),z({[t]:await Zf(n).lines[t](e)})}));e.command(`threads`).argument(`<line-id>`).description(`List this line's separate participant threads`).action((e,t)=>ep(async()=>{z(await Zf(t).lines.threads(e).list())})),e.command(`messages`).argument(`<line-id>`).argument(`<thread-id>`).description(`Read one authorized participant thread`).action((e,t,n)=>ep(async()=>{z(await Zf(n).lines.threads(e).messages(t))}))}async function rp(e){let{token:t,baseUrl:n}=Pr();if(t===void 0)return Oi(e);if(!t.startsWith(`lrc_`)||!n)throw Error(`The line box needs TANGLE_LINE_TOKEN and TANGLE_HUB_URL`);if(e.apiKey||e.baseUrl&&new URL(e.baseUrl).origin!==new URL(n).origin)throw Error(`A line token cannot be sent to another Hub or combined with an API key`);return new Oe({baseUrl:n,authHeaders:()=>({Authorization:`Bearer ${t}`})})}async function ip(e,t){if(t)return t;if(!Pr().token)throw Error(`Provide --line <line-id>`);return(await e.lines.context()).line.id}function ap(e){return e().catch(G)}function op(){return new S(`context`).description(`Show live line identity, members, consent, reminders and quotas`).action(e=>ap(async()=>{z(await(await rp(e)).lines.context())}))}function sp(){let e=new S(`lines`).description(`Connect, manage, message and schedule on a Hub line`);return e.command(`members`).description(`List names, roles and consent on this line`).option(`--line <line-id>`,`Line ID; inferred in a line box`).action(e=>ap(async()=>{let t=await rp(e);z(await t.lines.members.list(await ip(t,e.line)))})),e.command(`send`).description(`Send to a consenting member through Hub`).argument(`<to-member>`,`Exact member ID for an owner; name, ID, or self in a line box`).argument(`<text>`,`Message text`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--on-behalf-of <member>`,`Verified sender for a member relay`).option(`--not-before <iso-time>`,`Delay delivery until this ISO time`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t,n)=>ap(async()=>{let r=await rp(n),i=await ip(r,n.line);if(!Pr().token){if(n.onBehalfOf)throw Error(`--on-behalf-of is only available inside a line box`);if(!n.idempotencyKey)throw Error(`Owner sends require --idempotency-key so a retry keeps the same message`);if(!(await r.lines.members.list(i)).some(t=>t.id===e))throw Error(`Owner sends require an exact member ID from tangle lines members`);z(await r.lines.send(i,{memberId:e,text:t,idempotencyKey:n.idempotencyKey,...n.notBefore?{notBefore:n.notBefore}:{}}));return}z(await r.lines.send(i,{toMember:e,text:t,...n.onBehalfOf?{onBehalfOf:n.onBehalfOf}:{},...n.notBefore?{notBefore:n.notBefore}:{},...n.idempotencyKey?{idempotencyKey:n.idempotencyKey}:{}}))})),e.command(`remind`).description(`Wake the agent at a future time to write your reminder`).argument(`<text>`,`What to remember`).requiredOption(`--at <iso-time>`,`Future ISO time`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t)=>ap(async()=>{if(!t.at)throw Error(`--at is required`);let n=await rp(t),r=t.idempotencyKey??w(`sha256`).update(JSON.stringify([e,t.at])).digest(`hex`).slice(0,32);z(await n.lines.remind(await ip(n,t.line),{text:e,notBefore:t.at,idempotencyKey:r}))})),np(e),e}function cp(){let e=new S(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{let n=K({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await Y(q(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await Kt(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}),e}async function lp(e,t){if(t.self&&e)throw Error(`Use --self or an explicit sandbox, not both`);if(!t.self&&!e)throw Error(`Specify a sandbox id/name or --self`);let n=Tr(),r=t.baseUrl||n.tangleBaseUrl||n.sandboxBaseUrl,i=n.hubUrl;if(t.self&&!r&&i&&new URL(i).origin!==`https://id.tangle.tools`)throw Error(`This deployment must set SANDBOX_BASE_URL or pass --base-url for self preview access`);let a=t.self?t.apiKey??Wr():t.apiKey;if(t.self&&!a)throw Error(`Self preview access requires the injected sandbox runtime credential; it never reads saved owner credentials`);let o=K({apiKey:a,baseUrl:r}),s=q(o);return t.self?Yt(s):Y(s,o,e)}async function up(e,t,n){let r=H(e);t||r.start();try{return await n()}finally{r.stop()}}function dp(e){return e}function fp(){let e=new S(`preview`).description(`Manage sandbox preview links`);return dp(e.command(`start`).description(`Start/reuse a managed development server and publish its ready preview`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).option(`--cwd <directory>`,`Project directory in the selected workspace`).option(`--session <session-id>`,`Select the agent's session workspace`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{let n=await lp(e,t),r=await up(`Starting managed preview...`,t.json,()=>qt(n,{cwd:t.cwd,sessionId:t.session,name:t.name}));t.json?z(r):(B(`Preview ready: ${r.url}`),console.log(`Preview ID: ${r.previewId}`))}),dp(e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`)).action(async(e,t)=>{let n=await lp(e,t),r=await up(`Fetching preview links...`,t.json,()=>n.previewLinks.list());t.json?z(r):r.length===0?console.log(`No preview links found`):jn([`App`,`Preview ID`,`Port`,`URL`,`Status`],r.map(e=>[pp(e.metadata),e.previewId.slice(0,12),String(e.port),e.url,e.status]))}),dp(e.command(`publish`).description(`Publish one existing HTTP service; never starts or replaces a process`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).requiredOption(`--port <port>`,`Existing service port`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{if(!t.port||!/^\d+$/.test(t.port))throw Error(`An integer service port is required`);let n=await lp(e,t),r=await up(`Publishing service...`,t.json,()=>Jt(n,{port:Number(t.port),name:t.name}));t.json?z(r):B(`Preview ready: ${r.url}`)}),dp(e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`)).action(async(e,t,n)=>{if(!/^\d+$/.test(t)||Number(t)<1||Number(t)>65535)throw Error(`Port must be an integer between 1 and 65535`);let r=await lp(e,n),i=await up(`Creating preview for port ${t}...`,n.json,()=>r.previewLinks.create(Number(t)));n.json?z(i):(B(`Preview created: ${i.url}`),console.log(`Preview ID: ${i.previewId}`))}),dp(e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`)).action(async(e,t,n)=>{let r=await lp(e,n);await up(`Removing preview...`,n.json,()=>r.previewLinks.remove(t)),n.json?z({success:!0,previewId:t}):B(`Preview removed: ${t}`)}),e}function pp(e){let t=e?.app;if(!t||typeof t!=`object`)return``;let n=`name`in t?t.name:void 0,r=`cwd`in t?t.cwd:void 0;return typeof n==`string`?n:typeof r==`string`?r:``}function mp(){let e=new S(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=Us(n.env??[],`--env`,`env`),o=H(`Spawning: ${t}`);n.json||o.start();let s=await Y(i,r,e);if(s=await X(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?z(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?z({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching processes...`);t.json||i.start();let a=await Y(r,n,e);a=await X(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?z(o):o.length===0?console.log(`No processes found`):jn([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Fetching process info...`);n.json||a.start();let o=await Y(i,r,e);o=await X(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?z(c):(console.log(`PID:        ${c.pid}`),console.log(`Command:    ${c.command}`),console.log(`CWD:        ${c.cwd||`(default)`}`),console.log(`Status:     ${c.running?`running`:`exited`}`),console.log(`Exit Code:  ${c.exitCode}`),c.exitSignal&&console.log(`Signal:     ${c.exitSignal}`),console.log(`Started:    ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited:     ${c.exitedAt.toLocaleString()}`))}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await Y(i,r,e);o=await X(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?z({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=await Y(i,r,e);a=await X(a);let o=await a.process.get(Number.parseInt(t,10));if(!o){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of o.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}),e}const hp=[`python`,`node`,`typescript`,`bash`];function gp(e){switch(_e(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function _p(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await F(be(e),`utf8`)}async function vp(e,t,n=_p){let r=t?hp.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${hp.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=gp(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function yp(e){return M(Ce(),`tangle-run-images`,e)}function bp(){return new S(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${hp.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).action(async(e,t,n)=>{let{language:r,source:i}=await vp(t,n.lang),{context:a,client:o}=J(n),s=await Y(o,a,e);s=await X(s);let c=H(`Running ${r} (${i.length}b)…`);n.json||c.start();let l=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){z(l),l.exitCode!==0&&process.exit(l.exitCode);return}l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr);let u=0;for(let t of l.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:yp(e);de(r,{recursive:!0});let i=`${r}/${Date.now()}-${u}.${t.format}`;me(i,Buffer.from(t.data,`base64`)),process.stderr.write(b.green(`✓ image → ${i}\n`)),u++}else process.stderr.write(b.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(b.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(b.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(b.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(b.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(b.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);l.error&&(process.stderr.write(b.red(`\n✗ ${l.error.name}: ${l.error.message}\n`)),l.error.traceback&&process.stderr.write(`${l.error.traceback}\n`)),l.exitCode!==0&&process.exit(l.exitCode)})}function xp(e){e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is the sandbox's egress policy.`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Updating network configuration...`);i.start();let a=await Y(r,n,e);i.stop();let o=await a.network.getConfig();t.json?z(o):(V(`Network Configuration:`),o.ports&&o.ports.length>0?V(`  Exposed Ports: ${o.ports.join(`, `)}`):V(`  No exposed ports`))}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=H(`Exposing port ${i}...`);a.start();let o=await(await Y(r,n,e)).network.exposePort(i);a.stop(),t.json?z({port:i,url:o}):(B(`Port ${i} exposed.`),V(`  URL: ${o}`))}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching exposed URLs...`);i.start();let a=await(await Y(r,n,e)).network.listUrls();if(i.stop(),t.json)z(a);else{let e=Object.entries(a);if(e.length===0)V(`No ports exposed.`);else{V(`Exposed Ports:`);for(let[t,n]of e)V(`  ${t}: ${n}`)}}})}function Sp(){let e=new S(`sandbox`).description(`Manage sandboxes`);return Cc(e),Sc(e),fc(e),xp(e),e}function Cp(){return new S(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Searching...`);n.json||a.start();let o=await Y(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)})}function wp(){let e=new S(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=await J(n).client.secrets.create(e,await Tp({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}));n.json?z(r):(B(`Secret created: ${r.name}`),V(`Use --secret ${r.name} when creating a sandbox to select it for delivery.`))}),e.command(`list`).description(`List all secrets`).action(async e=>{let t=await J(e).client.secrets.list();e.json?z(t):t.length===0?(V(`No secrets found.`),V(`Use 'tangle secret create <name> [value]' to create one.`)):jn([`Name`,`Created At`,`Updated At`],t.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=J(t).client;if(!t.force&&!await Bi(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `,`--force`)){V(`Cancelled.`);return}await n.secrets.delete(e),t.json?z({success:!0,deleted:e}):B(`Secret deleted: ${e}`)}),e}async function Tp(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);let t=e.value??(e.valueStdin?await Hi():await zi(e.prompt));if(!t.length)throw Error(e.valueStdin?`Secret value from stdin cannot be empty`:`Secret value cannot be empty`);return t}function Ep(){let e=new S(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=j.dirname(Wt(import.meta.url)),t=j.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function Dp(){let e=new S(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--no-wait`,`Return once the snapshot is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Creating snapshot...`);i.start();let a=await Y(r,n,e);if(t.wait===!1){let e=await a.snapshot({tags:t.tags,wait:!1});i.stop(),pc(e.info,!!t.json);return}let o=await a.snapshot({tags:t.tags});i.stop(),t.json?z(o):(B(`Snapshot created: ${o.snapshotId}`),console.log(`Size: ${Op(o.sizeBytes??0)}`))}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=J(t),i=H(`Fetching snapshots...`);i.start();let a=await(await Y(r,n,e)).listSnapshots();i.stop(),t.json?z(a):R(a.map(e=>({...e,size:Op(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).action(async(e,t,n)=>{let{client:r}=J(n),i=H(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?z({sandboxId:a.id,restoredFrom:t,status:a.status}):(B(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Reverting sandbox to snapshot...`);a.start();let o=await Y(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?z({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(B(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Deleting snapshot...`);a.start();let o=await(await Y(i,r,e)).deleteSnapshot(t);a.stop(),n.json?z({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?B(`Snapshot already gone: ${t}`):B(`Snapshot deleted: ${t}`)}),e}function Op(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const kp=`solve:device:secp256k1`,Ap=/^0x[0-9a-f]{64}$/i;function jp(e){return e&&Ap.test(e)?e:void 0}function Mp(){let e=rr(kp),t=jp(e.value);if(!(!t||e.source===`none`))return{account:Zt(t),source:e.source}}function Np(){let e=Mp();if(e)return e;let t=Xt(),n=ir(kp,t);return{account:Zt(t),source:n}}function Pp(e){let t=jp(rr(kp).value);if(!t||Zt(t).address!==e.account.address)throw Error(`The local Solve device key changed; it was not retired`);let n=`${kp}:retired:${e.account.address.toLowerCase()}`;if(ir(n,t),rr(n).value!==t)throw Error(`The revoked device key could not be retired safely`);return or(kp),n}function Fp(e){let t=e.create?Np():Mp();if(!t)throw Error("No Solve device signer found. Run `tangle solve account --create`");e.json?z({address:t.account.address,source:t.source}):U({Address:t.account.address,Source:t.source})}const Ip=/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;function Lp(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function Rp(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function zp(e,t,n=2048){if(typeof e!=`string`||!e.trim()||e.length>n)throw Error(`${t} is missing or invalid`);if(Lp(e))throw Error(`${t} contains control characters`);return e.trim()}function Bp(e,t){let n=zp(e,t,64).toLowerCase();if(!Ip.test(n))throw Error(`${t} must be a 40 or 64 character Git revision`);return n}function Vp(e,t,n=!1){let r=typeof e==`number`&&Number.isSafeInteger(e)?String(e):zp(e,t,80);if(!/^\d+$/.test(r)||!n&&r===`0`)throw Error(`${t} must be an unsigned integer`);return BigInt(r).toString()}function Hp(e,t){let n=zp(e,t,2048),r=new URL(n);if(r.protocol!==`https:`&&!(r.protocol===`http:`&&(r.hostname===`localhost`||r.hostname===`127.0.0.1`)))throw Error(`${t} must use HTTPS outside local development`);return n.replace(/\/$/,``)}function Up(e,t){let n=Hp(e,t).replace(/\.git$/,``),r=new URL(n),i=r.pathname.split(`/`).filter(Boolean);if(r.hostname!==`github.com`||r.username||r.password||r.search||r.hash||i.length!==2)throw Error(`${t} must be an HTTPS GitHub repository URL`);return`https://github.com/${i.join(`/`)}`}function Wp(e,t){let n=zp(e,t,42);if(!on(n,{strict:!1}))throw Error(`${t} must be an EVM address`);return rn(n)}function Gp(e,t){let n=Vp(e,t),r=Number(n);if(!Number.isSafeInteger(r)||r<=0)throw Error(`${t} is out of range`);return r}function Kp(...e){for(let t of e)if(typeof t==`string`&&t.trim())return t.trim()}function qp(e){let t=e.trim().replace(/\.git$/,``);return t.startsWith(`git@github.com:`)?`https://github.com/${t.slice(15)}`:t.startsWith(`ssh://git@github.com/`)?`https://github.com/${t.slice(21)}`:t}function Jp(e){if(e===void 0)return;let t=zp(e,`pull request URL`,2048);if(!/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+(?:\/[^\s]*)?$/i.test(t))throw Error(`pull request URL must point to a GitHub pull request`);return t}function Yp(e,t){if(!/^https:\/\/[^\s]+$/i.test(e)&&!/^\/(?!\/).*$/.test(e)&&!/^[a-z][a-z0-9+.-]*:[^\s]+$/i.test(e))throw Error(`${t} must be an HTTPS URL or an absolute repository path`);if(e.split(/[?#]/,1)[0].split(`/`).includes(`..`))throw Error(`${t} cannot contain parent-directory segments`);return e}function Xp(e){return Er(`solve`,e.profile)}function Zp(e){let t=Xp(e),n=Kr(void 0,t);if(!n)throw Error(`No Solve credential found for profile '${t}'. Run: tangle auth login --provider github --app solve`);return n}async function Qp(e){let t=$r(e.apiUrl),n=await fetch(`${t}${e.path}`,{method:e.method??`GET`,headers:{Accept:`application/json`,...e.body===void 0?{}:{"Content-Type":`application/json`},Authorization:`Bearer ${Zp(e)}`},...e.body===void 0?{}:{body:JSON.stringify(e.body)},signal:AbortSignal.timeout(3e4)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||r.data===void 0){let e=r?.error?.message??`Solve API request failed with HTTP ${n.status}`;throw Error(r?.error?.code?`${r.error.code}: ${e}`:e)}return r.data}function $p(e){return Qp({path:`/v1/wallet/challenges`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.purpose?{purpose:e.purpose}:{}}})}function em(e){return Qp({path:`/v1/devices`,apiUrl:e.apiUrl,profile:e.profile})}function tm(e){return Qp({path:`/v1/devices/revoke`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.reason?{reason:e.reason}:{},...e.challengeId&&e.signature?{challengeId:e.challengeId,signature:e.signature}:{}}})}const nm={chainId:42431,rpcUrl:`https://rpc.moderato.tempo.xyz`,sponsorUrl:`https://drew-gtr-pro.taild10bfc.ts.net/solve-sponsor`,tangleAddress:`0xff137B9C879c47C28ce389e84501925438AB4cdA`,managerAddress:`0x5271732F893B622ac6793d6DBA5B2626CCa4EA14`,paymentAsset:`0x20C0000000000000000000000000000000000000`,blueprintId:15n,serviceId:9n,competitionId:1n,minStakeWei:0n};function rm(e,t){return e.toLowerCase()===t.toLowerCase()}function im(e){if(e.chainId!==nm.chainId)throw Error(`Solve submissions require Tempo Moderato (chain ${nm.chainId}); received ${e.chainId}`);if(e.rpcUrl!==nm.rpcUrl)throw Error(`Solve metadata RPC does not match the trusted deployment`);if(e.sponsorUrl!==nm.sponsorUrl)throw Error(`Solve metadata sponsor does not match the trusted deployment`);if(!rm(e.tangleAddress,nm.tangleAddress))throw Error(`Solve metadata Tangle contract does not match the trusted deployment`);if(!rm(e.managerAddress,nm.managerAddress))throw Error(`Solve metadata competition manager does not match the trusted deployment`);if(!rm(e.paymentAsset,nm.paymentAsset))throw Error(`Solve metadata payment asset does not match the trusted deployment`);if(e.blueprintId!==nm.blueprintId)throw Error(`Solve submissions require blueprint ${nm.blueprintId}; received ${e.blueprintId}`);if(e.serviceId!==nm.serviceId)throw Error(`Solve submissions require service ${nm.serviceId}; received ${e.serviceId}`);if(e.competitionId!==nm.competitionId)throw Error(`Solve submissions require competition ${nm.competitionId}; received ${e.competitionId}`);if(e.minStakeWei!==nm.minStakeWei)throw Error(`Solve submissions require zero stake for the trusted deployment`)}function am(e,t){let n=Rp(t.check??e.check,`competition.participation.check`),r=zp(n.command,`competition.participation.check.command`,512);if(!Array.isArray(n.args)||n.args.some(e=>typeof e!=`string`))throw Error(`competition.participation.check.args must be an array of strings`);let i=n.args.map(e=>zp(e,`competition checker argument`,2048)),a=Kp(n.result_file,n.resultFile),o=n.timeout_ms??n.timeoutMs,s=o===void 0?void 0:Gp(o,`competition checker timeout`);return{command:r,args:i,...a?{result_file:a}:{},...s?{timeout_ms:s}:{}}}function om(e){if(e.provenance===void 0)return;let t=Rp(e.provenance,`competition.participation.provenance`);if(t.mode!==`github_pull_request`)throw Error(`competition.participation.provenance.mode is unsupported`);if(t.required!==void 0&&typeof t.required!=`boolean`)throw Error(`competition.participation.provenance.required must be a boolean`);return{mode:`github_pull_request`,required:t.required===!0}}function sm(e){let t=Rp(e.chain??e.network??{},`competition.chain`),n=e.rewards&&typeof e.rewards==`object`&&!Array.isArray(e.rewards)?Rp(e.rewards,`competition.rewards`):{},r=n.minStake&&typeof n.minStake==`object`&&!Array.isArray(n.minStake)?Rp(n.minStake,`competition.rewards.minStake`).raw:void 0,i=Kp(t.minStakeWei,t.min_stake_wei,e.minStakeWei,e.min_stake_wei,r),a=t.chainId??t.chain_id??e.chainId??e.chain_id,o=Kp(t.chainName,t.chain_name,e.chainName,e.chain_name)??`Tempo`,s=Kp(t.nativeSymbol,t.native_symbol,e.nativeSymbol,e.native_symbol)??`TNT`,c=Kp(t.rpcUrl,t.rpc_url,e.rpcUrl,e.rpc_url,process.env.TANGLE_SOLVE_RPC_URL),l=Kp(t.sponsorUrl,t.sponsor_url,e.sponsorUrl,e.sponsor_url,process.env.TANGLE_SOLVE_SPONSOR_URL),u=Kp(t.tangleAddress,t.tangle_address,t.coreAddress,t.core_address,e.tangleAddress,e.tangle_address,e.coreAddress,e.core_address),d=Kp(t.managerAddress,t.manager_address,e.managerAddress,e.manager_address),f=Kp(t.paymentAsset,t.payment_asset,t.servicePaymentAsset,t.service_payment_asset,e.paymentAsset,e.payment_asset,e.servicePaymentAsset,e.service_payment_asset),p=Kp(t.blueprintId,t.blueprint_id,e.blueprintId,e.blueprint_id),m=Kp(t.serviceId,t.service_id,e.serviceId,e.service_id),h=Kp(t.competitionId,t.competition_id,e.competitionId,e.competition_id,e.id);if(!c||!l||!u||!d||!p||!m||!h||!i||a===void 0)throw Error(`Solve competition metadata must include complete Tempo chain configuration`);return{chainId:Gp(a,`chain.chainId`),chainName:o,nativeSymbol:s,rpcUrl:Hp(c,`chain.rpcUrl`),sponsorUrl:Hp(l,`chain.sponsorUrl`),tangleAddress:Wp(u,`chain.tangleAddress`),managerAddress:Wp(d,`chain.managerAddress`),paymentAsset:Wp(f??nm.paymentAsset,`chain.paymentAsset`),blueprintId:Vp(p,`chain.blueprintId`),serviceId:Vp(m,`chain.serviceId`),competitionId:Vp(h,`chain.competitionId`,!0),minStakeWei:Vp(i,`chain.minStakeWei`,!0)}}function cm(e){let t=Rp(e,`competition`),n=Rp(t.participation??t.task,`competition.task`),r={...t,participation:{...n,...n.repositoryRevision===void 0&&n.revision!==void 0?{repositoryRevision:n.revision}:{}}},i=r.participation,a=Up(Kp(r.repository,r.repo_url,i.repository)??``,`competition.repository`),o=Bp(Kp(r.repositoryRevision,r.repository_revision,i.revision,i.repositoryRevision,i.repository_revision),`competition.repositoryRevision`),s=zp(r.slug??r.id,`competition.slug`,128),c=zp(r.name??r.title??s,`competition.name`,256),l=am(r,i),u=om(i);return{version:1,slug:s,title:c,repository:a,taskRevision:o,checker:l,chain:sm(r),...u?{provenance:u}:{}}}function lm(e){return{chainId:e.chain.chainId,chainName:e.chain.chainName,nativeSymbol:e.chain.nativeSymbol,rpcUrl:e.chain.rpcUrl,sponsorUrl:e.chain.sponsorUrl,tangleAddress:e.chain.tangleAddress,managerAddress:e.chain.managerAddress,paymentAsset:e.chain.paymentAsset,blueprintId:BigInt(e.chain.blueprintId),serviceId:BigInt(e.chain.serviceId),competitionId:BigInt(e.chain.competitionId),minStakeWei:BigInt(e.chain.minStakeWei)}}async function um(e){let t=Rp(JSON.parse(await Je.readFile(j.join(e,`.tangle-solve.json`),`utf8`)),`.tangle-solve.json`);if(t.version!==1)throw Error(`.tangle-solve.json has an unsupported version`);let n=Rp(t.checker,`.tangle-solve.json.checker`),r=Rp(t.chain,`.tangle-solve.json.chain`);return cm({slug:t.slug,name:t.title,repository:t.repository,repositoryRevision:t.taskRevision,participation:{check:n,provenance:t.provenance},chain:r,competitionId:r.competitionId})}const dm=Ot(we),fm=`.tangle-solve-run.json`,pm=`.tangle-solve.json`,mm=`tangle.solve.manifestSha256`,hm=new Set([pm,fm]),gm=`upstream`;async function _m(e,t){let n=await dm(`git`,[`-C`,e,...t],{encoding:`utf8`,maxBuffer:1e6});return String(n.stdout).trim()}async function vm(e,t){let n=j.resolve(t??process.cwd()),r=await um(n);if(e&&e!==r.slug&&e!==r.chain.competitionId)throw Error(`This directory contains '${r.slug}', not '${e}'`);return{root:n,manifest:r}}async function ym(e){let t=j.join(e,pm),n;try{n=await Je.lstat(t)}catch{throw Error(`${pm} is missing`)}if(n.isSymbolicLink()||!n.isFile())throw Error(`${pm} must be a regular file`);return w(`sha256`).update(await Je.readFile(t)).digest(`hex`)}async function bm(e){let t=await ym(e);return await _m(e,[`config`,`--local`,`--replace-all`,mm,t]),t}async function xm(e){let t;try{t=await _m(e,[`config`,`--local`,`--get`,mm])}catch{throw Error(`The local Git metadata has no ${mm} pin; run tangle solve clone again`)}if(!/^[0-9a-f]{64}$/i.test(t))throw Error(`The local ${mm} pin is invalid`);if(await ym(e)!==t.toLowerCase())throw Error(`${pm} changed after clone; run tangle solve clone again`)}async function Sm(e,t){try{return await _m(e,[`ls-files`,`--error-unmatch`,`--`,t]),!0}catch{return!1}}async function Cm(e){await xm(e);for(let t of hm)if(await Sm(e,t))throw Error(`${t} must remain untracked and local to this Solve workspace`);let t=await dm(`git`,[`-C`,e,`status`,`--porcelain=v1`,`--untracked-files=all`,`--ignored=matching`],{encoding:`utf8`,maxBuffer:1e6});if(String(t.stdout).split(/\r?\n/).filter(Boolean).filter(e=>{let t=e.slice(0,2),n=e.slice(3);return!((t===`??`||t===`!!`)&&hm.has(n))}).length>0)throw Error(`Commit the candidate before running Solve. Only the local manifest and run record may remain uncommitted.`);return Bp(await _m(e,[`rev-parse`,`HEAD`]),`submission revision`)}async function wm(e,t,n,r={}){let i=await Tm(e,t,r);if(i)return{taskRepository:t.repository,taskRevision:t.taskRevision,submissionRepository:i,submissionRevision:n}}async function Tm(e,t,n={}){let r;try{r=qp(await _m(e,[`config`,`--get`,`remote.origin.pushurl`]))}catch{try{r=qp(await _m(e,[`config`,`--get`,`remote.origin.url`]))}catch{if(n.allowMissing)return;throw Error(`Add your GitHub fork as the 'origin' remote before submitting. The task repository is available as '${gm}'.`)}}let i=Up(r,`git remote.origin.url`);if(i.toLowerCase()===t.repository.toLowerCase()){if(n.allowMissing)return;throw Error(`The 'origin' remote is the task repository. Add your GitHub fork as 'origin'; keep the task repository as '${gm}' before submitting.`)}return i}function Em(e,t){return!e||!t?!1:e.taskRepository.toLowerCase()===t.taskRepository.toLowerCase()&&e.taskRevision.toLowerCase()===t.taskRevision.toLowerCase()&&e.submissionRepository.toLowerCase()===t.submissionRepository.toLowerCase()&&e.submissionRevision.toLowerCase()===t.submissionRevision.toLowerCase()}function Dm(e,t){return`${e}/commit/${t}`}function Om(e,t,n,r,i={}){let a=e.evidenceRefs.map(e=>Yp(e.trim(),`checker evidence reference`));if(n){if(!t){if(i.allowMissingSource)return{evidence:e.evidence,evidenceRefs:a};throw Error(`Provenance policy requires a submission source`)}let o=Jp(r);if(n.required&&(i.requirePullRequest??!0)&&!o)throw Error(`This competition requires a GitHub pull request`);a.push(Dm(t.taskRepository,t.taskRevision),Dm(t.submissionRepository,t.submissionRevision),...o?[o]:[])}return{evidence:e.evidence,evidenceRefs:[...new Set(a)]}}async function km(e,t){let n=`${e}.${process.pid}.tmp`;await Je.writeFile(n,`${JSON.stringify(t,null,2)}\n`,{mode:384}),await Je.rename(n,e)}async function Am(e){let t=JSON.parse(await Je.readFile(j.join(e,fm),`utf8`));if(t.version!==1||typeof t.competition!=`string`)throw Error(`${fm} has an unsupported format`);return t}async function jm(e){let t=Jp(e.pullRequest);if(!t)throw Error(`A pull request URL is required`);let n=new URL(t).pathname.split(`/`).filter(Boolean),r=await fetch(`https://api.github.com/repos/${n[0]}/${n[1]}/pulls/${n[3]}`,{headers:{Accept:`application/vnd.github+json`,"User-Agent":`tangle-solve-cli`},signal:AbortSignal.timeout(15e3)}),i=await r.json().catch(()=>null),a=e=>e.replace(/\/$/,``).toLowerCase();if(!r.ok||a(i?.base?.repo?.html_url??``)!==a(e.taskRepository)||i?.head?.sha?.toLowerCase()!==e.submissionRevision.toLowerCase()||a(i?.head?.repo?.html_url??``)!==a(e.submissionRepository))throw Error(`GitHub pull request must target the pinned task repository and contain the current committed submission`)}function Mm(e){return{...e.authorization?{authorization:e.authorization}:{},...e.stake?{stake:e.stake}:{},join:e.join,commit:e.commit,reveal:e.reveal,report:e.report,evaluation:e.evaluation}}const Nm=Ot(we);function Pm(){return`Task source is '${gm}'. Add your fork as 'origin', commit your candidate, push it, and open a pull request before submitting.`}async function Fm(e,t,n){try{let r=Rp(await Qp({path:`/v1/competitions/${encodeURIComponent(e)}`,apiUrl:n.apiUrl,profile:n.profile}),`competition response`),i=cm(r.competition??r),a=j.resolve(t??i.slug),o=H(`Cloning ${i.slug}…`);n.json||o.start();try{await Nm(`git`,[`clone`,`--no-tags`,`--origin`,gm,i.repository,a],{encoding:`utf8`,maxBuffer:1e6}),await _m(a,[`checkout`,`--detach`,i.taskRevision]);let e=await _m(a,[`rev-parse`,`HEAD`]);if(e.toLowerCase()!==i.taskRevision.toLowerCase())throw Error(`Pinned checkout resolved to ${e}, expected ${i.taskRevision}`);await km(j.join(a,`.tangle-solve.json`),i),await bm(a)}finally{o.stop()}n.json?z({competition:i,directory:a}):(B(`Cloned ${i.slug} at ${i.taskRevision.slice(0,12)}`),i.provenance&&V(Pm()),V(`Run the pinned checker with: cd ${a} && tangle solve run`))}catch(e){G(e)}}const Im=12e4,Lm=ln(`event JobSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint8 jobIndex, address caller, bytes inputs)`),Rm=ln(`event JobCompleted(uint64 indexed serviceId, uint64 indexed callId)`),zm=ln(`event JobResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, address indexed operator, bytes result)`),Bm=ln(`event AggregatedResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint256 signerBitmap, bytes output)`),Vm=ln(`event EvaluationAccepted(uint64 indexed serviceId, uint64 indexed competitionId, address indexed researcher, bytes32 candidateId, bytes32 submissionRefHash, bytes32 evaluationDigest, bytes32 metricsHash, bytes32 evidenceRefsHash)`),Hm=[...cn([`function submitJob(uint64 serviceId, uint8 jobIndex, bytes inputs) payable returns (uint64 callId)`,`function getJobEventRate(uint64 blueprintId, uint8 jobIndex) view returns (uint256 rate)`,`function getServicePaymentAsset(uint64 serviceId) view returns (address)`,`function isPermittedCaller(uint64 serviceId, address caller) view returns (bool)`]),Lm,Rm,zm,Bm],Um=cn([`function authorizeSelf(uint64 serviceId)`,`function revokeSelf(uint64 serviceId)`,`function isDeviceRevoked(address device) view returns (bool)`,`function postStake(uint64 serviceId, uint64 competitionId) payable`,`function stakes(uint64 serviceId, uint64 competitionId, address researcher) view returns (uint256)`,`function pendingResults(uint64 serviceId, uint64 jobCallId) view returns (uint8 job, bytes32 outputHash, uint256 signerBitmap, bool exists, bool executed)`,`function executePendingResult(uint64 serviceId, uint64 jobCallId, bytes output)`,`function acceptedCandidates(uint64 serviceId, uint64 competitionId, address researcher, bytes32 candidateId) view returns (bool)`]),Wm=cn([`function allowance(address owner, address spender) view returns (uint256)`,`function approve(address spender, uint256 amount) returns (bool)`]),Gm=un(`uint64 competitionId, uint256 stakeWei`),Km=un(`uint64 competitionId, bytes32 commitment`),qm=un(`uint64 competitionId, bytes32 commitment, string artifactRef, bytes32 salt`),Jm=un(`string artifactRef, bytes32 salt`),Ym=un(`uint64 competitionId, bytes32 candidateId, string submissionRef, string evidenceJson, string evidenceRefsJson`),Xm=un(`string status, string detail`),Zm=/^0x[0-9a-f]{64}$/i;function Qm(e,t){if(e!==t)throw Error(`Tempo RPC returned chain ${e}; expected ${t}`)}function $m(e,t,n){return{...e,feePayer:!0,nonceKey:t,nonce:n}}function eh(e,t){if(e!==`success`)throw Error(`${t} transaction reverted`)}function th(e,t,n,r){if(!Zm.test(t))throw Error(`${n} transaction hash is invalid`);if(typeof e.transactionHash!=`string`||e.transactionHash.toLowerCase()!==t.toLowerCase())throw Error(`${n} receipt hash does not match the saved transaction`);if(eh(e.status??``,n),typeof e.from!=`string`||e.from.toLowerCase()!==r.from.toLowerCase())throw Error(`${n} receipt sender does not match the Solve device`);if(typeof e.to!=`string`||e.to.toLowerCase()!==r.to.toLowerCase())throw Error(`${n} receipt destination does not match the expected contract`)}function nh(e,t){return e>=t?[]:e>0n?[0n,t]:[t]}function rh(e,t,n=Date.now()){return n>=e+t}function ih(e,t){return e.filter(e=>e.args?.candidateId?.toLowerCase()===t.toLowerCase()).at(-1)?.transactionHash}function ah(e,t,n,r,i){for(let a of e.logs)if(a.address.toLowerCase()===t.tangleAddress.toLowerCase())try{let e=tn({abi:[Lm],eventName:`JobSubmitted`,data:a.data,topics:a.topics});if(e.args.serviceId===t.serviceId&&e.args.jobIndex===n&&e.args.caller.toLowerCase()===r.toLowerCase()&&(!i||e.args.inputs.toLowerCase()===i.toLowerCase()))return e.args.callId}catch{}throw Error(`Tangle did not emit job ${n} for ${r}`)}function oh(e,t,n,r){for(let i of e.logs)if(i.address.toLowerCase()===t.managerAddress.toLowerCase())try{let e=tn({abi:[Vm],eventName:`EvaluationAccepted`,data:i.data,topics:i.topics}).args;if(e.serviceId===t.serviceId&&e.competitionId===t.competitionId&&e.researcher.toLowerCase()===n.address.toLowerCase()&&e.candidateId.toLowerCase()===r.toLowerCase())return!0}catch{}return!1}function sh(e){if(e.chainId!==pn.id)throw Error(`Solve submissions require Tempo Moderato (chain ${pn.id}); received ${e.chainId}`);if(!e.sponsorUrl)throw Error(`Solve submissions require a Tempo sponsor relay URL; unsponsored writes are disabled`);return{...pn,name:e.chainName,nativeCurrency:{name:e.nativeSymbol,symbol:e.nativeSymbol,decimals:18},rpcUrls:{default:{http:[e.rpcUrl]}}}}async function ch(e,t){im(e);let n=sh(e),r=Qt({chain:n,transport:an(e.rpcUrl)});return Qm(await r.getChainId(),e.chainId),await lh({publicClient:r},e),{publicClient:r,walletClient:$t({account:t,chain:n,transport:hn(an(e.rpcUrl),an(e.sponsorUrl))}),account:t}}async function lh(e,t){let n=await e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`getServicePaymentAsset`,args:[t.serviceId]});if(n.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo service payment asset ${n} does not match the trusted Solve asset ${t.paymentAsset}`)}async function uh(e,t,n){let[r,i]=await Promise.all([e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`getJobEventRate`,args:[t.blueprintId,n]}),e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`getServicePaymentAsset`,args:[t.serviceId]})]);if(i.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo job payment asset ${i} does not match the trusted Solve asset ${t.paymentAsset}`);return{asset:i,amount:r,value:i===`0x0000000000000000000000000000000000000000`?r:0n}}async function dh(e,t,n){return await e.publicClient.readContract({address:t,abi:Wm,functionName:`allowance`,args:[e.account.address,n.tangleAddress]})}async function fh(e,t,n,r,i,a){let o=Date.now();for(;!rh(o,a);){if((await e.publicClient.getLogs({address:t.tangleAddress,event:Rm,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`})).length>0){let a=(await e.publicClient.getLogs({address:t.tangleAddress,event:zm,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.result;if(!a)throw Error(`Tangle job ${n} completed without a result`);let[o,s]=en(Xm,a);if(o!==i)throw Error(`Tangle job ${n} ${o}: ${s}`);return{status:o,detail:s}}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not complete within 120 seconds`)}async function ph(e,t,n,r,i){let a=Date.now();for(;!rh(a,i);){let i=(await e.publicClient.getLogs({address:t.tangleAddress,event:Bm,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.output;if(i)return i;await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not produce an aggregate within 120 seconds`)}async function mh(e,t,n){return!!await e.publicClient.readContract({address:t.managerAddress,abi:Um,functionName:`acceptedCandidates`,args:[t.serviceId,t.competitionId,e.account.address,n]})}const hh=BigInt(sn(dn(`tangle.solve.v1`)));async function gh(e,t){let n=await mn.nonce.getNonce(e.publicClient,{account:e.account.address,nonceKey:hh});if(n>BigInt(2**53-1))throw Error(`The Solve transaction nonce exceeds the safe range`);return e.walletClient.writeContract($m(t,hh,Number(n)))}async function _h(e,t,n,r){if(!await e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))try{let i=r??await gh(e,{address:t.managerAddress,abi:Um,functionName:`authorizeSelf`,args:[t.serviceId]});if(r||await n?.(`authorization`,i),th(await e.publicClient.waitForTransactionReceipt({hash:i}),i,`Authorization`,{from:e.account.address,to:t.managerAddress}),!await e.publicClient.readContract({address:t.tangleAddress,abi:Hm,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))throw Error(`authorization transaction did not add the device`);return i}catch(e){let t=e instanceof Error?e.message:`unknown chain error`;throw Error(`The competition manager did not authorize this device. The deployed manager must expose authorizeSelf(uint64): ${t}`)}}async function vh(e,t){let n=await gh(e,{address:t.managerAddress,abi:Um,functionName:`revokeSelf`,args:[t.serviceId]});return th(await e.publicClient.waitForTransactionReceipt({hash:n}),n,`Revocation`,{from:e.account.address,to:t.managerAddress}),n}async function yh(e,t,n,r,i=`allowance`,a={}){if(t.amount===0n||t.asset===`0x0000000000000000000000000000000000000000`)return;let o=await dh(e,t.asset,n);for(let s of nh(o,t.amount)){let o=s===0n?`${i}:reset`:`${i}:approval`,c=a[o];if(c){if(th(await e.publicClient.waitForTransactionReceipt({hash:c}),c,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset}),await dh(e,t.asset,n)!==s)throw Error(`${s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`} did not set the expected allowance`);continue}let l=await gh(e,{address:t.asset,abi:Wm,functionName:`approve`,args:[n.tangleAddress,s]});await r?.(o,l),th(await e.publicClient.waitForTransactionReceipt({hash:l}),l,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset})}}async function bh(e,t,n,r,i,a=`job:${n}`,o={}){let s=await uh(e,t,n);await yh(e,s,t,i,`allowance:${a}`,o);let c=o[a],l=c??await gh(e,{address:t.tangleAddress,abi:Hm,functionName:`submitJob`,args:[t.serviceId,n,r],value:s.value});c||await i?.(a,l);let u=await e.publicClient.waitForTransactionReceipt({hash:l});return th(u,l,`Job ${n}`,{from:e.account.address,to:t.tangleAddress}),{hash:l,callId:ah(u,t,n,e.account.address,r),blockNumber:u.blockNumber}}async function xh(e,t,n,r,i,a,o=`job:${n}`,s={}){let c=await bh(e,t,n,r,a,o,s),l=await fh(e,t,c.callId,c.blockNumber,i,Im);return{...c,acknowledgement:l}}const Sh={...nm,chainName:`Tempo Moderato`,nativeSymbol:`TNT`},Ch={async read(e){let t=Qt({chain:pn,transport:an(Sh.rpcUrl,{timeout:15e3})}),n=e=>e.catch(()=>null),r=await Promise.all(e.map(async e=>{let[r,i]=await Promise.all([n(t.readContract({address:Sh.tangleAddress,abi:Hm,functionName:`isPermittedCaller`,args:[Sh.serviceId,e]})),n(t.readContract({address:Sh.managerAddress,abi:Um,functionName:`isDeviceRevoked`,args:[e]}))]);return[e.toLowerCase(),{permitted:r,revoked:i}]}));return new Map(r)},async revokeSelf(e){return vh(await ch(Sh,e),Sh)}},wh={permitted:null,revoked:null};function Th(e){return e.revoked?`revoked`:e.permitted===null?`unknown`:e.permitted?`permitted`:`not permitted`}async function Eh(e,t=Ch){try{let{devices:n}=await em({apiUrl:e.apiUrl,profile:e.profile}),r=Mp()?.account.address.toLowerCase(),i=n.map(e=>({...e,local:e.address===r,status:e.revokedAt?`revoked`:`active`}));r&&!i.some(e=>e.local)&&i.push({address:r,local:!0,status:`unbound`,boundAt:null,lastUsedAt:null,revokedAt:null,revocationMethod:null,revocationReason:null});let a=await t.read(i.map(e=>rn(e.address))),o=i.map(e=>({...e,onChain:a.get(e.address)??wh}));if(e.json){z({serviceId:Sh.serviceId.toString(),devices:o});return}jn([`Address`,`Status`,`Local`,`Service ${Sh.serviceId}`,`Last used`,`Revoked`],o.map(e=>[e.address,e.status,e.local?`yes`:``,Th(e.onChain),e.lastUsedAt??``,e.revokedAt?`${e.revokedAt} (${e.revocationMethod})`:``]))}catch(t){G(t,e.json)}}async function Dh(e,t,n=Ch){try{if(!on(e))throw Error(`${e} is not an EVM address`);let r=rn(e),i=Mp(),a=i?.account.address===r;if(!t.yes){if(!process.stdin.isTTY)throw Error(`Revoking a device is permanent. Re-run with --yes to confirm`);if(!await Bi(`Permanently revoke Solve device ${r}${a?` (this machine's device)`:``}? [y/N] `,`--yes`)){V(`Revocation cancelled`);return}}let o;if(i&&a){let e=await $p({deviceAddress:r,purpose:`revoke`,apiUrl:t.apiUrl,profile:t.profile});o={challengeId:e.challengeId,signature:await i.account.signMessage({message:e.message})}}let s=await tm({deviceAddress:r,reason:t.reason,...o,apiUrl:t.apiUrl,profile:t.profile}),c=r.toLowerCase(),l=(await n.read([r])).get(c)??wh,u;if(i&&a&&!l.revoked){try{u=await n.revokeSelf(i.account)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`The Solve API revoked ${r}, but the on-chain revocation failed and the local key was kept: ${t}. Run the command again to retry`)}l=(await n.read([r])).get(c)??wh}let d=i&&a&&l.revoked?Pp(i):void 0;if(t.json){z({...s,serviceId:Sh.serviceId.toString(),onChain:l,...u?{revocationTransaction:u}:{},localKeyRetired:!!d});return}B(s.alreadyRevoked?`${r} was already revoked in the Solve API`:`Revoked ${r}; the Solve API refuses its signatures`),u&&B(`Revoked on Tempo in ${u}; service ${Sh.serviceId} refuses its jobs`),d&&V("The local device key was moved aside because its address may still hold stake or rewards. Run `tangle solve account --create` for a new device"),!a&&l.permitted&&En(`The device can still submit jobs to service ${Sh.serviceId}. Only its key, or the Solve blueprint owner, can revoke it on chain`)}catch(e){G(e,t.json)}}function Oh(e,t){return sn(nn(Jm,[e.trim(),t]))}function kh(e){let t=/^submission=(\S+)/.exec(e);if(!t?.[1])throw Error(`COMMIT_CANDIDATE did not return a submission reference`);return t[1]}async function Ah(e,t,n,r,i){let a=i.resumeTransactions?.evaluation;if(a){let n=await e.publicClient.waitForTransactionReceipt({hash:a});if(th(n,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!oh(n,t,e.account,r))throw Error(`Saved evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}let o=Date.now();for(;!rh(o,Im);){if(await mh(e,t,r)){let i=ih(await e.publicClient.getLogs({address:t.managerAddress,event:Vm,args:{serviceId:t.serviceId,competitionId:t.competitionId,researcher:e.account.address},fromBlock:n.blockNumber,toBlock:`latest`}),r);if(i)return i;throw Error(`Candidate is already accepted, but its EvaluationAccepted transaction is unavailable`)}let[a,o,,s,c]=await e.publicClient.readContract({address:t.managerAddress,abi:Um,functionName:`pendingResults`,args:[t.serviceId,n.callId]});if(s&&a!==4)throw Error(`Manager pending result ${n.callId} has unexpected job ${a}`);if(s&&c)throw Error(`Manager executed the report without EvaluationAccepted`);if(s&&!c){if(o.toLowerCase()!==sn(n.output).toLowerCase())throw Error(`Manager pending report output does not match the aggregate`);let a=await gh(e,{address:t.managerAddress,abi:Um,functionName:`executePendingResult`,args:[t.serviceId,n.callId,n.output]});await i.onTransaction?.(`evaluation`,a);let s=await e.publicClient.waitForTransactionReceipt({hash:a});if(th(s,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!oh(s,t,e.account,r))throw Error(`Evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Manager did not emit EvaluationAccepted within 120 seconds`)}async function jh(e,t,n,r={}){if(im(e),!/^0x[0-9a-f]{64}$/i.test(n.salt))throw Error(`Reveal salt must be bytes32`);if(!n.artifactRef.trim())throw Error(`Candidate reference is required`);if(!n.evidenceJson.trim()||n.evidenceRefs.length===0)throw Error(`Checker evidence is required`);let i=await ch(e,t),a=await _h(i,e,r.onTransaction,r.resumeTransactions?.authorization),o,s=await i.publicClient.readContract({address:e.managerAddress,abi:Um,functionName:`stakes`,args:[e.serviceId,e.competitionId,i.account.address]});s<e.minStakeWei&&(o=await gh(i,{address:e.managerAddress,abi:Um,functionName:`postStake`,args:[e.serviceId,e.competitionId],value:e.minStakeWei-s}),await r.onTransaction?.(`stake`,o),th(await i.publicClient.waitForTransactionReceipt({hash:o}),o,`Stake`,{from:i.account.address,to:e.managerAddress}));let c=Oh(n.artifactRef,n.salt),l=nn(Gm,[e.competitionId,e.minStakeWei]),u=nn(Km,[e.competitionId,c]),d=nn(qm,[e.competitionId,c,n.artifactRef.trim(),n.salt]),f=await xh(i,e,1,l,`joined`,r.onTransaction,`join`,r.resumeTransactions),p=await xh(i,e,2,u,`committed`,r.onTransaction,`commit`,r.resumeTransactions),m=kh(p.acknowledgement.detail),h=await xh(i,e,3,d,`revealed`,r.onTransaction,`reveal`,r.resumeTransactions),g=await bh(i,e,4,nn(Ym,[e.competitionId,c,m,n.evidenceJson,JSON.stringify(n.evidenceRefs)]),r.onTransaction,`report`,r.resumeTransactions),_=await ph(i,e,g.callId,g.blockNumber,Im),v=await Ah(i,e,{callId:g.callId,output:_,blockNumber:g.blockNumber},c,r);return{address:i.account.address,...a?{authorization:a}:{},...o?{stake:o}:{},join:f.hash,commit:p.hash,reveal:h.hash,report:g.hash,evaluation:v,candidateId:c,submissionRef:m}}const Mh=Ot(we),Nh=`/usr/bin/bwrap`,Ph=[`/usr`,`/bin`,`/sbin`,`/lib`,`/lib64`];function Fh(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function Ih(e,t){if(!e||e.length>2048||Fh(e))throw Error(`${t} contains invalid control characters or is too long`)}function Lh(e,t){let n=t;for(;n<e.length&&/\s/.test(e[n]??``);)n+=1;return n}function Rh(e,t){if(e[t]!==`"`)throw Error(`Checker output must be valid JSON`);let n=t+1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`"`)return n+1;if((t?.charCodeAt(0)??0)<32)throw Error(`Checker output must be valid JSON`);n+=1}throw Error(`Checker output must be valid JSON`)}function zh(e,t,n){let r=new Set,i=Lh(e,t+1);if(e[i]===`}`)return i+1;for(;i<e.length;){let t=Rh(e,i),a=JSON.parse(e.slice(i,t));if(r.has(a))throw Error(`Checker output must not contain duplicate object keys`);if(r.add(a),i=Lh(e,t),e[i]!==`:`)throw Error(`Checker output must be valid JSON`);let o=Lh(e,i+1),s=Vh(e,o);if(n?.(a,o,s),i=Lh(e,s),e[i]===`}`)return i+1;if(e[i]!==`,`)throw Error(`Checker output must be valid JSON`);i=Lh(e,i+1)}throw Error(`Checker output must be valid JSON`)}function Bh(e,t){let n=Lh(e,t+1);if(e[n]===`]`)return n+1;for(;n<e.length;){if(n=Lh(e,Vh(e,n)),e[n]===`]`)return n+1;if(e[n]!==`,`)throw Error(`Checker output must be valid JSON`);n=Lh(e,n+1)}throw Error(`Checker output must be valid JSON`)}function Vh(e,t){if(e[t]===`"`)return Rh(e,t);if(e[t]===`{`)return zh(e,t);if(e[t]===`[`)return Bh(e,t);let n=t;for(;n<e.length&&!/[\s,\]}]/.test(e[n]??``);)n+=1;return n}function Hh(e){let t=e.trim();if(Lh(t,Vh(t,0))!==t.length)throw Error(`Checker output must be valid JSON`)}function Uh(e,t){let n=e.trim();if(n[0]!==`{`)return;let r;return zh(n,0,(e,i,a)=>{e===t&&(r=n.slice(i,a).trim())}),r}function Wh(e){let t;try{t=JSON.parse(e)}catch{throw Error(`Checker output must be one JSON object`)}if(Hh(e),!t||typeof t!=`object`||Array.isArray(t))throw Error(`Checker output must be a JSON object`);let n=t,r=n.candidate_ref;if(typeof r!=`string`||!r.trim())throw Error(`Checker output must include candidate_ref`);let i=r.trim(),a=n.evidence_refs;if(!Array.isArray(a)||a.length===0||a.some(e=>typeof e!=`string`||!e.trim()))throw Error(`Checker output must include a non-empty evidence_refs array`);Ih(i,`candidate_ref`);for(let e of a)Ih(e.trim(),`evidence_refs`);if(!n.evidence_json||typeof n.evidence_json!=`object`||Array.isArray(n.evidence_json))throw Error(`Checker output must include an evidence_json object`);let o={...n.evidence_json},s=Uh(e,`evidence_json`);if(!s)throw Error(`Checker evidence_json source text is missing`);if(o.candidate_ref!==i)throw Error(`Checker evidence_json candidate_ref must match candidate_ref`);return{candidateRef:i,evidenceRefs:a.map(e=>e.trim()),evidence:o,evidenceJson:s}}async function Gh(e,t,n){let r=n.trim();if(r.startsWith(`{`)&&r.endsWith(`}`)||!t.result_file)return r;let i=await Zh(e),a=j.resolve(i,t.result_file),o=j.relative(i,a);if(o.startsWith(`..`)||j.isAbsolute(o))throw Error(`Checker result_file must stay inside the competition repository`);let s;try{s=await Je.lstat(a)}catch{throw Error(`Checker result_file must be an existing regular file inside the competition repository`)}if(s.isSymbolicLink())throw Error(`Checker result_file must not be a symbolic link`);if(!s.isFile())throw Error(`Checker result_file must be an existing regular file inside the competition repository`);let c;try{c=await Je.realpath(a)}catch{throw Error(`Checker result_file must resolve to a regular file inside the competition repository`)}let l=j.relative(i,c);if(l.startsWith(`..`)||j.isAbsolute(l))throw Error(`Checker result_file must stay inside the competition repository`);return(await Je.readFile(c,`utf8`)).trim()}function Kh(e,t){let n=j.relative(e,t);return n===``||!n.startsWith(`..`)&&!j.isAbsolute(n)}function qh(e){return Ph.some(t=>Kh(t,e))}async function Jh(e,t,n){let r=e.includes(`/`)?[j.resolve(t,e)]:(process.env.PATH??``).split(j.delimiter).filter(Boolean).map(t=>j.join(t,e));for(let i of r){let r;try{r=await Je.realpath(i),await Je.access(r,Je.constants.X_OK)}catch{continue}if(!Kh(t,r)&&!qh(r)&&r!==n)throw Error(`Checker executable '${e}' must resolve inside the competition repository or a trusted runtime directory`);return r}throw Error(`Checker executable '${e}' was not found`)}async function Yh(e){let t=[];for(let n of e)try{(await Je.stat(n)).isDirectory()&&t.push(n)}catch{}return t}async function Xh(e){let t=await Je.realpath(Se.homedir());if(e===j.parse(e).root||e===t)throw Error(`Solve checker repository must be a dedicated directory, not the filesystem or home root`)}async function Zh(e){let t=await Je.realpath(e);return await Xh(t),t}async function Qh(e){let t=j.join(e,`.git`),n;try{n=await Je.lstat(t)}catch{return}if(n.isSymbolicLink())throw Error(`Solve checker repository .git must not be a symbolic link`);if(!n.isDirectory()&&!n.isFile())return;let r;try{let t={...process.env};for(let e of[`GIT_DIR`,`GIT_WORK_TREE`,`GIT_INDEX_FILE`,`GIT_OBJECT_DIRECTORY`,`GIT_ALTERNATE_OBJECT_DIRECTORIES`,`GIT_COMMON_DIR`,`GIT_CONFIG_COUNT`,`GIT_CONFIG_PARAMETERS`])delete t[e];let n=await Mh(`/usr/bin/git`,[`-C`,e,`rev-parse`,`--verify`,`HEAD^{commit}`],{encoding:`utf8`,maxBuffer:1e5,env:{...t,GIT_CONFIG_GLOBAL:`/dev/null`,GIT_CONFIG_SYSTEM:`/dev/null`,GIT_CONFIG_NOSYSTEM:`1`,GIT_TERMINAL_PROMPT:`0`}}),i=String(n.stdout).trim();/^[0-9a-f]{40}$/i.test(i)&&(r=i.toLowerCase())}catch{}return{kind:n.isDirectory()?`directory`:`file`,...r?{commit:r}:{}}}async function $h(e,t,n){let r=await Zh(e);if(process.platform!==`linux`)throw Error(`Solve checkers require the Linux sandbox runtime (bubblewrap) with network isolation`);try{await Je.access(Nh,Je.constants.X_OK)}catch{throw Error(`Solve checkers require /usr/bin/bwrap; install bubblewrap or run the checker in a Tangle sandbox`)}let i=await Jh(t,r,await Je.realpath(process.execPath)),a=await Qh(r),o=(await Yh(Ph)).flatMap(e=>[`--ro-bind`,e,e]),s=Kh(r,i)?`/work/${j.relative(r,i)}`:qh(i)?i:`/checker/node`;!Kh(r,i)&&!qh(i)&&o.push(`--ro-bind`,i,`/checker/node`);let c=a?.kind===`directory`?[`--tmpfs`,`/work/.git`]:a?.kind===`file`?[`--ro-bind`,`/dev/null`,`/work/.git`]:[];return{executable:Nh,args:[`--die-with-parent`,`--new-session`,`--unshare-all`,`--clearenv`,...o,`--proc`,`/proc`,`--dev`,`/dev`,`--tmpfs`,`/tmp`,`--dir`,`/tmp/home`,`--bind`,r,`/work`,...c,`--chdir`,`/work`,`--setenv`,`HOME`,`/tmp/home`,...a?.commit?[`--setenv`,`TANGLE_SOLVE_COMMIT`,a.commit]:[],`--setenv`,`TMPDIR`,`/tmp`,`--setenv`,`PATH`,`/checker:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,`--setenv`,`LANG`,`C.UTF-8`,`--setenv`,`PYTHONDONTWRITEBYTECODE`,`1`,`--setenv`,`XDG_CONFIG_HOME`,`/tmp/home/.config`,`--setenv`,`XDG_CACHE_HOME`,`/tmp/home/.cache`,`--setenv`,`XDG_DATA_HOME`,`/tmp/home/.local/share`,`--setenv`,`GIT_CONFIG_GLOBAL`,`/dev/null`,`--setenv`,`GIT_CONFIG_SYSTEM`,`/dev/null`,`--setenv`,`NPM_CONFIG_USERCONFIG`,`/dev/null`,s,...n]}}async function eg(e,t){if(!t.command||t.command.includes(`/../`)||Fh(t.command))throw Error(`The competition checker command is invalid`);if(!Array.isArray(t.args))throw Error(`The competition checker arguments must be an array`);for(let e of t.args)Ih(e,`Checker argument`);let n=t.timeout_ms??15*6e4;if(!Number.isSafeInteger(n)||n<1e3||n>60*6e4)throw Error(`Checker timeout must be between one second and one hour`);let r=await Zh(e),i;try{let e=await $h(r,t.command,t.args);i=await Mh(e.executable,e.args,{cwd:r,timeout:n,maxBuffer:4194304,encoding:`utf8`})}catch(e){let t=e,n=t.stderr?.trim()||t.stdout?.trim()||t.message||`checker failed`;throw Error(`Pinned checker failed: ${n}`)}let a=String(i.stdout),o=String(i.stderr);return{...Wh(await Gh(r,t,a)),stdout:a,stderr:o}}async function tg(e,t){try{let{root:n,manifest:r}=await vm(e,t.directory),i=await Cm(n),a=r.provenance?await wm(n,r,i,{allowMissing:!0}):void 0,o=Np(),s=H(`Running ${r.title} checker…`);t.json||s.start();let c;try{c=await eg(n,r.checker)}finally{s.stop()}let l=Om(c,a,r.provenance,void 0,{allowMissingSource:!0,requirePullRequest:!1}),u=fn(T(32)),d=Oh(c.candidateRef,u),f={version:1,competition:r.slug,candidateRef:c.candidateRef,evidence:l.evidence,evidenceJson:c.evidenceJson,evidenceRefs:l.evidenceRefs,salt:u,candidateId:d,...a?{source:a}:{},deviceAddress:o.account.address,clientSubmissionId:E(),createdAt:new Date().toISOString()};await km(j.join(n,`.tangle-solve-run.json`),f),t.json?z({localRun:f}):(B(`Checker output recorded locally for operator evaluation`),U({Competition:r.slug,Candidate:c.candidateRef,"Device address":o.account.address,"Evidence refs":l.evidenceRefs.length}),V("Commit any changes, then run `tangle solve submit` from this directory."),r.provenance&&!a&&V(`Add your GitHub fork as 'origin' before submitting. The task repository is available as '${gm}'.`))}catch(e){G(e)}}const ng=/^0x[0-9a-f]{64}$/i;async function rg(e){let t=await $p({deviceAddress:e.deviceAddress,apiUrl:e.apiUrl,profile:e.profile}),n=await e.signer.signMessage({message:t.message});return{walletChallengeId:t.challengeId,walletSignature:n}}async function ig(e,t){try{let{root:n,manifest:r}=await vm(e,t.directory);Xp({profile:t.profile});let i=await Cm(n),a=await Am(n);if(a.competition!==r.slug)throw Error(`.tangle-solve-run.json does not match this competition`);if(!ng.test(a.salt)||!ng.test(a.candidateId))throw Error("This run predates durable candidate identity. Run `tangle solve run` again");let o=r.provenance?await wm(n,r,i):void 0;if(r.provenance&&a.source&&!Em(a.source,o))throw Error("The saved run points to a different repository or revision. Keep your fork as 'origin' and run `tangle solve run` again before submitting");let s=Mp();if(!s)throw Error("No Solve device signer found. Run `tangle solve run` first");if(s.account.address.toLowerCase()!==a.deviceAddress.toLowerCase())throw Error("The local Solve device account changed after `tangle solve run`; run the checker again");let c=H(`Checking the committed candidate…`);t.json||c.start();let l;try{l=await eg(n,r.checker)}finally{c.stop()}if(l.candidateRef!==a.candidateRef||l.evidenceJson!==a.evidenceJson)throw Error("The committed checker output changed after `tangle solve run`; run the checker again");if(Oh(l.candidateRef,a.salt).toLowerCase()!==a.candidateId.toLowerCase())throw Error(`The saved candidate identity does not match the checker output; run the checker again`);let u=Jp(t.prUrl);if(!r.provenance&&u)throw Error(`This competition does not accept GitHub pull request provenance`);if(u){if(!o)throw Error(`A provenance policy is required for a pull request`);await jm({pullRequest:u,taskRepository:o.taskRepository,submissionRepository:o.submissionRepository,submissionRevision:i})}let d=Om(l,o,r.provenance,u,{requirePullRequest:!0}),f={...a,...o?{source:o}:{},chainState:{status:`submitting`,transactions:{...a.chainState?.transactions??{}}}},p=j.join(n,`.tangle-solve-run.json`);await km(p,f);let m=H(`Submitting candidate to Tempo…`);t.json||m.start();let h;try{h=await jh(lm(r),s.account,{artifactRef:l.candidateRef,salt:a.salt,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs},{resumeTransactions:f.chainState?.transactions,onTransaction:async(e,t)=>{f={...f,chainState:{status:`submitting`,transactions:{...f.chainState?.transactions??{},[e]:t}}},await km(p,f)}})}finally{m.stop()}f={...f,chainReceipt:h,chainState:{status:`accepted`,transactions:{...f.chainState?.transactions??{},...Mm(h)}}},await km(p,f);let g=await rg({deviceAddress:h.address,signer:s.account,apiUrl:t.apiUrl,profile:t.profile}),_=await Qp({path:`/v1/submissions`,method:`POST`,apiUrl:t.apiUrl,profile:t.profile,body:{competition:r.slug,candidateRef:l.candidateRef,candidateId:h.candidateId,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs,deviceAddress:h.address,reportTxHash:h.report,evaluationTxHash:h.evaluation,transactions:Mm(h),...r.provenance&&o?{source:{...o,...u?{pullRequest:u}:{}}}:{},clientSubmissionId:a.clientSubmissionId,...g,...t.model?{model:t.model}:{},...t.note?{note:t.note}:{}}});t.json?z({..._,transactions:Mm(h),candidateId:h.candidateId}):(B(`Submission accepted on Tempo`),U({Competition:r.slug,Candidate:h.candidateId,"Device address":h.address,"Report transaction":h.report,"Evaluation transaction":h.evaluation,"Submission ID":typeof _.id==`string`?_.id:_.submission?.id}))}catch(e){G(e)}}function ag(){let e=new S(`solve`).description(`Participate in Tangle Solve competitions`);e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(Fm),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).action(tg),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(ig),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).action(Fp);let t=e.command(`device`).description(`List and revoke the Solve devices bound to your account`);return t.command(`list`).description(`List your devices and whether each may submit jobs on Tempo`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(e=>Eh(e)),t.command(`revoke <address>`).description(`Permanently revoke a device; the local device is revoked with its own key`).option(`--reason <text>`,`Why the device is revoked (shown to the account)`).option(`--yes`,`Confirm the permanent revocation without a prompt`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action((e,t)=>Dh(e,t)),e}function og(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sandboxes/${t}/runtime/ssh`}function sg(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function cg(e){return`'${e.replace(/'/g,`''`)}'`}function lg(e){return e===`win32`?`NUL`:`/dev/null`}function ug(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${cg(`<token>`)}; ssh ${e.map(cg).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${sg(`<token>`)} ssh ${e.map(sg).join(` `)}`}function dg(e){return e.connection!==void 0&&!e.connection.ssh}function fg(){Tn(`SSH is not enabled for this sandbox.`),V(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function pg(e,t=[],n=process.platform){let r=lg(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function mg(){return new S(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).allowUnknownOption(!0).action(async(e,t,n)=>{let{context:r,client:i}=J(n),a=H(`Getting SSH credentials...`);a.start();let o=await Y(i,r,e);if(dg(o)){a.stop(),fg();return}o=await X(o);let s=await o.ssh();if(a.stop(),!s){fg();return}let c={...s,proxyCommand:og(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=pg(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(ug(l,process.platform));return}V(`Connecting via tunnel...`);let u=Ee(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(Tn(`SSH client not found. Please install OpenSSH.`),process.exit(1)),G(e)}),u.on(`exit`,e=>{process.exit(e??0)})})}function hg(){let e=new S(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).action(async e=>{let t=H(`Fetching SSH keys...`);try{t.start();let n=await q(K(e)).sshKeys.list();t.stop(),e.json?z({sshKeys:n}):n.length===0?V(`No SSH keys found.`):jn([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),G(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).action(async(e,t)=>{let n=H(`Adding SSH key...`);try{let r=fe(t.keyFile,`utf8`).trim();n.start();let i=await q(K(t)).sshKeys.create(e,r);n.stop(),t.json?z({sshKey:i}):B(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),G(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=H(`Deleting SSH key...`);try{n.start(),await q(K(t)).sshKeys.delete(e),n.stop(),B(`Deleted SSH key ${e}`)}catch(e){n.stop(),G(e)}}),e}function gg(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function _g(){return new S(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||gg(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new gn(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===gn.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===gn.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),gg(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}function vg(){let e=new S(`team`).description(`Manage teams`);return Sg(e,`list`).description(`List teams for the current account`).action(async e=>{let t=K(e),n=q(t),r=e.json?null:H(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){z({teams:i,activeTeamId:t.activeTeamId??null});return}R(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}),Sg(e,`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).action(async(e,t)=>{let n=K(t),r=q(n),i=t.json?null:H(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&_c(a,n.profile),i?.stop(),t.json){z({team:a,active:!!t.switch});return}B(`Team created: ${mc(a)}`),t.switch&&B(`Active team set to ${a.name}`)}),Sg(e,`switch <team>`).description(`Set the active team for the current profile`).action(async(e,t)=>{let n=K(t),r=await hc(q(n),e);if(_c(r,n.profile),t.json){z({team:r,activeTeamId:r.id});return}B(`Active team set to ${mc(r)}`)}),e.command(`current`).description(`Show the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{let t=ti(e.profile);if(e.json){z(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}U({ID:t.activeTeamId,Name:t.activeTeamName})}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{if(vc(e.profile),e.json){z({activeTeamId:null});return}B(`Active team cleared.`)}),Sg(e,`members [team]`).description(`List team members`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){z({team:i,members:a});return}R(a,[{key:`id`,header:`ID`,width:36},{key:`customerEmail`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}),Sg(e,`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile),a=yg(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){z({team:i,member:o});return}B(`Member updated: ${o.customerEmail}`),U({Team:i.name,Role:o.role,Status:o.status})}),Sg(e,`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile),a=yg(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){z({team:i,invitation:o});return}B(`Invitation created for ${o.email}`),U({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),B(`Re-run with --json to retrieve the invitation token for sharing.`)}),Sg(e,`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile);if(!(!t.force&&!t.json&&!await Bi(`Leave team '${i.name}'? (y/N) `,`--force`))){if(await r.teams.leave(i.id),n.activeTeamId===i.id&&vc(n.profile),t.json){z({success:!0,teamId:i.id});return}B(`Left team: ${i.name}`)}}),Sg(e,`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).action(async(e,t,n)=>{let r=K(n),i=q(r),a=await gc(i,t,r.profile);if(!(!n.force&&!n.json&&!await Bi(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `,`--force`))){if(await i.teams.transferOwnership(a.id,e),n.json){z({success:!0,teamId:a.id,newOwnerCustomerId:e});return}B(`Ownership transferred for ${a.name}`)}}),e.addCommand(bg()),e.addCommand(xg()),Sg(e,`invitations [team]`).description(`List pending and historical team invitations`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){z({team:i,invitations:a});return}R(a,[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}),Sg(e,`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).action(async(e,t)=>{let n=K(t),r=q(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&_c(a,n.profile),t.json){z({member:i,activeTeamId:a?.id??null});return}B(`Invitation accepted for team ${i.teamId}`),a&&B(`Active team set to ${a.name}`)}),Sg(e,`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).action(async(e,t)=>{if(await q(K(t)).teams.revokeInvitation(e),t.json){z({success:!0,invitationId:e});return}B(`Invitation revoked: ${e}`)}),Sg(e,`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){z({success:!0,teamId:i.id,memberId:e});return}B(`Member removed: ${e}`)}),e}function yg(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function bg(){let e=new S(`secret`).description(`Manage team secrets`);return Sg(e,`list [team]`).description(`List team secret names`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){z({team:i,secrets:a});return}R(a,[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}),Sg(e,`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=K(n),i=q(r),a=await gc(i,n.team,r.profile),o=await Tp({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){z({team:a,secret:s});return}B(`Team secret saved: ${s.name}`)}),Sg(e,`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Bi(`Delete team secret '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteSecret(i.id,e),t.json){z({success:!0,teamId:i.id,name:e});return}B(`Team secret deleted: ${e}`)}}),Sg(e,`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){z({teamId:i.id,...a});return}console.log(a.value)}),e}function xg(){let e=new S(`templates`).description(`Manage team golden-path templates`);return Sg(e,`list [team]`).description(`List a team's golden-path templates`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){z({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}R(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}),Sg(e,`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).action(async(e,t,n)=>{let r=K(n),i=q(r),a=await gc(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){z({team:a,template:s});return}B(`Team template created: ${s.name} (${s.id})`)}),Sg(e,`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=K(t),r=q(n),i=await gc(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Bi(`Delete template '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteTemplate(i.id,e),t.json){z({success:!0,teamId:i.id,templateId:e});return}B(`Team template deleted: ${e}`)}}),e}function Sg(e,t){return e.command(t).option(`--profile <profile>`,`Credential profile`)}async function Cg(e,t,n){let r=new AbortController,i=()=>r.abort();try{let n=q(K({...e,timeout:void 0}));process.once(`SIGINT`,i),process.once(`SIGTERM`,i);let a=await t(n,{...e.timeout===void 0?{}:{timeoutMs:Number(e.timeout)*1e3},resumeJobId:e.resumeJob,signal:r.signal,onProgress:e=>{process.stderr.write(`Publication ${e.id}: ${e.status}\n`)}}).finally(()=>{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)});e.json?z(a):B(`template`in a?`Published template: ${a.template.slug}`:`Published template version: ${a.version.id}`)}catch(t){if(t instanceof o&&t.status!==401&&t.job&&[`pending`,`scanning`,`ready`].includes(t.job.status)){let e=[`tangle`,`template`,...n,`--resume-job`,t.job.id].map(qe).join(` `);Object.assign(t,{fix:{command:e}})}G(t,e.json)}}function wg(){let e=new S(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).action(async e=>{let t=q(K(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){z({templates:n});return}R(n,[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forkCount`,header:`Forks`,width:8},{key:`sandboxCount`,header:`Sandboxes`,width:12},{key:`updatedAt`,header:`Updated`,width:24}])}),e.command(`get <id-or-slug>`).action(async(e,t)=>{let n=await q(K(t)).publicTemplates.get(e);if(t.json){z({template:n});return}z(n)}),e.command(`versions <id-or-slug>`).action(async(e,t)=>{let n=await q(K(t)).publicTemplates.versions(e);if(t.json){z({versions:n});return}R(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`createdAt`,header:`Created`,width:24}])}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).action((e,t,n,r)=>Cg(r,async(i,a)=>({template:await i.publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom},a)}),[`publish`,e,t,n])),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).action((e,t,n,r)=>Cg(r,async(i,a)=>({version:await i.publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes},a)}),[`publish-version`,e,t,n])),e}function Tg(){let e=new S(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:Ig(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:Vg(e.limit)},n=Dg(e),r=e.json?null:H(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return z(i);Ag(i.items),Pg(i.nextCursor)}catch(t){kg(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).action(async(e,t)=>{try{let n=Dg(t);if(t.ndjson){await Og(n,e);return}let r=t.json?null:H(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:Vg(t.limit)});if(r?.stop(),t.json)return z(i);jg(i.items),i.truncated&&U({Spans:`${i.items.length} of ${i.total} (truncated)`}),Pg(i.nextCursor)}catch(e){kg(e,t)}}),e.addCommand(Eg()),e}function Eg(){let e=new S(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).action(async e=>{try{let t={status:e.status===void 0?void 0:Rg(e.status),gate:e.gate===void 0?void 0:Bg(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:Vg(e.limit)},n=Dg(e),r=e.json?null:H(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return z(i);Mg(i.items),Pg(i.nextCursor)}catch(t){kg(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).action(async(e,t)=>{try{let n=Dg(t),r=t.json?null:H(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return z(i);Ng(i)}catch(e){kg(e,t)}}),e}function Dg(e){let t=Gr(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return _n({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function Og(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function kg(e,t){return G(e,t.json===!0)}function Ag(e){R(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:Fg(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function jg(e){R(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function Mg(e){R(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function Ng(e){U({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function Pg(e){e&&U({"Next page":`--cursor ${e}`})}function Fg(e){return e===null?`-`:`$${e.toFixed(4)}`}function Ig(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const Lg=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function Rg(e){let t=Lg.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${Lg.join(`, `)}`)}const zg=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function Bg(e){let t=zg.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${zg.join(`, `)}`)}function Vg(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Hg(){return new S(`usage`).description(`Show account usage and billing information`).action(async e=>{let{client:t}=J(e),n=e.json?null:H(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?z({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),U({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":Ug(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":Wg(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),U({Plan:i.plan,Status:i.status,"Credits Available":Wg(i.creditsAvailableUsd),"Credits Used":Wg(i.creditsUsedUsd),"Monthly Balance":Wg(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),U({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())})}function Ug(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Wg(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function Gg(){return new S(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{if(t.clear){Lr(),V(`Cleared the active sandbox.`);return}if(e){Ir(e),V(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=Fr();V(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")})}function Kg(e){R(e,[{key:`id`,header:`ID`},{key:`nodeId`,header:`Node`},{key:`name`,header:`Name`},{key:`contentType`,header:`Content Type`},{key:`byteSize`,header:`Bytes`},{key:`createdAt`,header:`Created`}])}function qg(e){e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.listArtifacts(e,t);if(n.json)return z(r);Kg(r.artifacts)}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).action(async(e,t,n,r)=>{let i=await(await Q(r)).workflows.downloadArtifact(e,t,n),a=r.out??n;try{me(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return z({file:a,contentType:i.contentType,bytes:i.bytes.length});V(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)})}function Jg(e){R(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function Yg(e){e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=(await(await Q(t)).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return z({decisions:n});Jg(n)}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).action(async(e,t,n)=>{let r=await Q(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return z(a);if(a.resumed){V(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}V(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)})}function Xg(e){try{return fe(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Zg(e){R(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function Qg(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;V(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),R(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function $g(e){if(U({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(V(`Triggers`),e_(e.triggers)),e.validationErrors.length>0){V(`Validation issues`);for(let t of e.validationErrors)console.log(`  ${t.path}: ${t.message}`)}}function e_(e){R(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function t_(e){e.command(`list`).description(`List your workflows`).action(async e=>{let t=await(await Q(e)).workflows.list();if(e.json)return z(t);Zg(t)}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).action(async e=>{let t=await(await Q(e)).workflows.fleetInsights({window:e.window});if(e.json)return z(t);Qg(t)}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).action(async(e,t)=>{let n=await(await Q(t)).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
+`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return z(n);$g(n)}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Xg(e),r=await(await Q(t)).workflows.create(n);if(t.json)return z(r);V(`Created workflow ${r.id} (${r.name}).`),$g(r)}),e.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Xg(e),r=await Q(t),i=await r.workflows.validate(n,{structural:!0});if(!i.valid){if(process.exitCode=1,t.json)return z(i);V(`Invalid workflow:`);for(let e of i.errors)console.log(`  ${e.path}: ${e.message}`);return}let a=(await r.workflows.list()).find(e=>e.name===i.name);if(a){let e=await r.workflows.update(a.id,n);if(t.json)return z({action:`updated`,workflow:e});V(`Updated workflow ${e.id} (${e.name}) — matched by name.`),$g(e);return}let o=await r.workflows.create(n);if(t.json)return z({action:`created`,workflow:o});V(`Created workflow ${o.id} (${o.name}).`),$g(o)}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).action(async(e,t,n)=>{let r=Xg(t),i=await(await Q(n)).workflows.update(e,r,{...n.note===void 0?{}:{note:n.note}});if(n.json)return z(i);V(`Updated workflow ${i.id} (${i.name}).`),$g(i)}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{if(!t.force&&!await Bi(`Delete workflow ${e}? `,`--force`)){V(`Delete cancelled.`);return}if(await(await Q(t)).workflows.delete(e),t.json)return z({deleted:!0,id:e});V(`Deleted workflow ${e}.`)}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).action(async(e,t)=>{let n=Xg(e),r=await(await Q(t)).workflows.validate(n,{...t.structural?{structural:!0}:{}});if(t.json)return z(r);if(r.valid)V(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{V(`Invalid workflow:`);for(let e of r.errors)console.log(`  ${e.path}: ${e.message}`);process.exitCode=1}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).action(async e=>{z(await(await Q(e)).workflows.schema())})}async function n_(e,t,n){let r=await(await Q(n)).workflows.setEnabled(e,t);if(n.json)return z(r);V(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),$g(r)}function r_(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function i_(e,t){try{me(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function a_(e){R(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function o_(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function s_(e){e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await n_(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await n_(e,!1,t)}),e.command(`templates`).description(`List the curated starter workflow templates`).action(async e=>{let t=await(await Q(e)).workflows.listTemplates();if(e.json)return z(t);a_(t)}),e.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,du,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).action(async(e,t)=>{let n=fu(t.param,`param`)??{},r=await(await Q(t)).workflows.instantiateTemplate(e,n);if(t.json)return z(r);if(!r.created){V(`Template ${e} needs provider connections before it can run:`);for(let e of r.connectionRequirements)console.log(`  ${e.connected?`✓`:`✗`} ${o_(e,r.connectionRequirements)}`);process.exitCode=1;return}let{workflow:i}=r;if(i.definitionYaml===null)throw Error(`Workflow ${i.id} was created but the server returned no definition YAML`);if(V(`Created workflow ${i.id} (${i.name}).`),t.file){i_(t.file,i.definitionYaml),V(`Wrote ${t.file}.`);return}process.stdout.write(i.definitionYaml.endsWith(`
 `)?i.definitionYaml:`${i.definitionYaml}\n`)})}function c_(e){R(e,[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updatedAt`,header:`Updated`}])}function l_(e){U({Key:e.key,Version:e.version,Updated:e.updatedAt}),V(`Value`),z(e.value)}function u_(e){let t=e.command(`kv`).description(`Read and write a workflow's cross-run KV state`);t.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=await(await Q(t)).workflows.listKv(e);if(t.json)return z(n);c_(n.entries)}),t.command(`get`).description(`Show one KV entry (value and version)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.getKv(e,t);if(n.json)return z(r);l_(r)}),t.command(`set`).description(`Write a KV entry from a JSON value`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).argument(`<json>`,`Value as JSON (e.g. '{"cursor":123}' or '"abc"')`).option(`--cas <version>`,`Compare-and-swap: write only if the stored version still equals this`).action(async(e,t,n,r)=>{let i=r_(n,`<json>`),a=r.cas===void 0?void 0:Go(r.cas,`--cas`),o=await Q(r),s=a===void 0?await o.workflows.putKv(e,t,i):await o.workflows.casKv(e,t,a,i);if(r.json)return z(s);l_(s)}),t.command(`delete`).description(`Delete a KV entry (idempotent)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).action(async(e,t,n)=>{let r=await(await Q(n)).workflows.deleteKv(e,t);if(n.json)return z(r);V(r.deleted?`Deleted KV entry "${t}" of workflow ${e}.`:`No KV entry "${t}" on workflow ${e}.`)})}function d_(e){R(e.map(e=>({rev:e.rev,created:e.createdAt,by:e.createdBy,source:e.source,note:e.note??``})),[{key:`rev`,header:`Rev`},{key:`created`,header:`Created`},{key:`by`,header:`Created By`},{key:`source`,header:`Source`},{key:`note`,header:`Note`}])}function f_(e){e.command(`revisions`).description(`List a workflow's definition revision history (newest first)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=await(await Q(t)).workflows.listRevisions(e);if(t.json)return z(n);d_(n)}),e.command(`revision`).description(`Show one revision's metadata and definition YAML`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number`).action(async(e,t,n)=>{let r=Go(t,`<rev>`),i=await(await Q(n)).workflows.getRevision(e,r);if(n.json)return z(i);U({Revision:i.rev,Created:i.createdAt,"Created by":i.createdBy,Source:i.source,Note:i.note??``}),process.stdout.write(i.yaml.endsWith(`
-`)?i.yaml:`${i.yaml}\n`)}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).action(async(e,t,n)=>{let r=Go(t,`<rev>`),i=await(await Q(n)).workflows.rollback(e,r);if(n.json)return z(i);V(`Rolled back workflow ${i.id} to rev ${r}.`),$g(i)})}function p_(){let e=new S(`workflows`).description(`Create and manage Tangle workflows`);return t_(e),gu(e),s_(e),f_(e),u_(e),qg(e),Yg(e),e}function m_(e){for(let[t,n]of Object.entries(e.optsWithGlobals()))e.getOptionValue(t)===void 0&&n!==void 0&&e.setOptionValue(t,n)}const h_=e(import.meta.url)(`../package.json`);function g_(){let e=new S;e.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(h_.version??`0.0.0`).option(`--json`,`Output JSON where supported, including errors`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),e.hook(`preAction`,(e,t)=>{m_(t);let n=t.opts();yn(n.json===!0||n.ndjson===!0)}),e.addCommand(Sa()),e.addCommand(Sp()),e.addCommand(Gg()),e.addCommand(wp()),e.addCommand(Xf()),e.addCommand(op()),e.addCommand(sp()),e.addCommand(Js()),e.addCommand(mg()),e.addCommand(hg()),e.addCommand(_g()),e.addCommand(na()),e.addCommand(Dp()),e.addCommand(Vc()),e.addCommand(Hg()),e.addCommand(vg()),e.addCommand(wg()),e.addCommand(ja()),e.addCommand(Ha()),e.addCommand(mp()),e.addCommand(Hc()),e.addCommand(Gc()),e.addCommand(Af()),e.addCommand(Jd()),e.addCommand(p_()),e.addCommand(As()),e.addCommand(Cp()),e.addCommand(ag()),e.addCommand(Ep()),e.addCommand(Ua()),e.addCommand(fp()),e.addCommand(jf()),e.addCommand(Cs()),e.addCommand(ws()),e.addCommand(bp()),e.addCommand(cp()),e.addCommand(Tg()),e.addCommand(Sl());function t(e){e.configureHelp({showGlobalOptions:!0}),e.configureOutput({writeErr:()=>{}}),e.exitOverride(t=>{t.exitCode===0&&process.exit(0),G(t,e.optsWithGlobals().json===!0)});for(let n of e.commands)t(n)}return t(e),e}const __=g_();__.parseAsync(process.argv).catch(e=>{G(e,__.opts().json===!0)});export{};
+`)?i.yaml:`${i.yaml}\n`)}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).action(async(e,t,n)=>{let r=Go(t,`<rev>`),i=await(await Q(n)).workflows.rollback(e,r);if(n.json)return z(i);V(`Rolled back workflow ${i.id} to rev ${r}.`),$g(i)})}function p_(){let e=new S(`workflows`).description(`Create and manage Tangle workflows`);return t_(e),_u(e),s_(e),f_(e),u_(e),qg(e),Yg(e),e}function m_(e){for(let[t,n]of Object.entries(e.optsWithGlobals()))e.getOptionValue(t)===void 0&&n!==void 0&&e.setOptionValue(t,n)}const h_=e(import.meta.url)(`../package.json`);function g_(){let e=new S;e.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(h_.version??`0.0.0`).option(`--json`,`Output JSON where supported, including errors`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),e.hook(`preAction`,(e,t)=>{m_(t);let n=t.opts();yn(n.json===!0||n.ndjson===!0)}),e.addCommand(Sa()),e.addCommand(Sp()),e.addCommand(Gg()),e.addCommand(wp()),e.addCommand(Xf()),e.addCommand(op()),e.addCommand(sp()),e.addCommand(Js()),e.addCommand(mg()),e.addCommand(hg()),e.addCommand(_g()),e.addCommand(na()),e.addCommand(Dp()),e.addCommand(Vc()),e.addCommand(Hg()),e.addCommand(vg()),e.addCommand(wg()),e.addCommand(ja()),e.addCommand(Ha()),e.addCommand(mp()),e.addCommand(Hc()),e.addCommand(Gc()),e.addCommand(Af()),e.addCommand(Yd()),e.addCommand(p_()),e.addCommand(As()),e.addCommand(Cp()),e.addCommand(ag()),e.addCommand(Ep()),e.addCommand(Ua()),e.addCommand(fp()),e.addCommand(jf()),e.addCommand(Cs()),e.addCommand(ws()),e.addCommand(bp()),e.addCommand(cp()),e.addCommand(Tg()),e.addCommand(Sl());function t(e){e.configureHelp({showGlobalOptions:!0}),e.configureOutput({writeErr:()=>{}}),e.exitOverride(t=>{t.exitCode===0&&process.exit(0),G(t,e.optsWithGlobals().json===!0)});for(let n of e.commands)t(n)}return t(e),e}const __=g_();__.parseAsync(process.argv).catch(e=>{G(e,__.opts().json===!0)});export{};