@cursor/july 0.1.31 → 0.1.32

package/dist/files-backends/agent-store-presigned-url.js

@@ -1,347 +1,1023 @@
-/**
- * Vendored from `@anysphere/agent-store-sync` `presigned-url.ts` so the
- * published `@cursor/july` tarball does not depend on that private workspace
- * package (not on npm). Keep in sync when the source validator changes.
- */
-export class PresignedUrlRejectedError extends Error {
-    constructor(options) {
-        super(options.message);
-        this.name = "PresignedUrlRejectedError";
-        this.code = options.code;
-        this.url = options.url;
-    }
-}
-/**
- * Strict default: accepts `https:` URLs to an AWS S3 endpoint with no
- * userinfo and no private/internal address. Rejects DNS hosts that
- * resolve into the private IP space and IPv4-mapped IPv6 literals.
- */
-export function defaultPresignedUrlValidator(url) {
-    assertSafeAuthority(url);
-    if (url.protocol !== "https:") {
-        throw new PresignedUrlRejectedError({
-            code: "scheme_not_allowed",
-            message: `Refused presigned URL with non-https scheme: ${url.protocol}`,
-            url: redactPresignedUrlString(url),
-        });
-    }
-    const hostname = stripIPv6Brackets(url.hostname);
-    if (isLocalOrInternalHost(hostname)) {
-        throw new PresignedUrlRejectedError({
-            code: "private_host_not_allowed",
-            message: `Refused https presigned URL with private/internal host: ${hostname}`,
-            url: redactPresignedUrlString(url),
-        });
-    }
-    if (!isAwsS3Hostname(hostname)) {
-        throw new PresignedUrlRejectedError({
-            code: "host_not_allowed",
-            message: `Refused presigned URL whose host is not an AWS S3 endpoint: ${hostname}`,
-            url: redactPresignedUrlString(url),
+// ../../node_modules/.pnpm/@connectrpc+connect@1.6.1_patch_hash=c9c7616ccfc0246b19c6537f56676d8501713cb6c94b440d13_ef7275568c8b1f1f499006dc986c70d2/node_modules/@connectrpc/connect/dist/esm/code.js
+var Code;
+(function(Code2) {
+  Code2[Code2["Canceled"] = 1] = "Canceled";
+  Code2[Code2["Unknown"] = 2] = "Unknown";
+  Code2[Code2["InvalidArgument"] = 3] = "InvalidArgument";
+  Code2[Code2["DeadlineExceeded"] = 4] = "DeadlineExceeded";
+  Code2[Code2["NotFound"] = 5] = "NotFound";
+  Code2[Code2["AlreadyExists"] = 6] = "AlreadyExists";
+  Code2[Code2["PermissionDenied"] = 7] = "PermissionDenied";
+  Code2[Code2["ResourceExhausted"] = 8] = "ResourceExhausted";
+  Code2[Code2["FailedPrecondition"] = 9] = "FailedPrecondition";
+  Code2[Code2["Aborted"] = 10] = "Aborted";
+  Code2[Code2["OutOfRange"] = 11] = "OutOfRange";
+  Code2[Code2["Unimplemented"] = 12] = "Unimplemented";
+  Code2[Code2["Internal"] = 13] = "Internal";
+  Code2[Code2["Unavailable"] = 14] = "Unavailable";
+  Code2[Code2["DataLoss"] = 15] = "DataLoss";
+  Code2[Code2["Unauthenticated"] = 16] = "Unauthenticated";
+})(Code || (Code = {}));
+
+// ../agent-store-sync/dist/bcs-transport.js
+var DIRECTORY_LIST_PAGE_SIZE = 1e3;
+var DIRECTORY_LIST_MAX_PAGES = 10;
+var DIRECTORY_LIST_MAX_ENTRIES = DIRECTORY_LIST_PAGE_SIZE * DIRECTORY_LIST_MAX_PAGES;
+
+// ../agent-store-sync/dist/conflict-events.js
+import * as fs2 from "node:fs";
+
+// ../agent-store-sync/dist/paths.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+var PRIVATE_DIR_MODE = 448;
+var AgentStorePathError = class extends Error {
+  constructor({ code, message, failedPath }) {
+    super(message);
+    this.name = "AgentStorePathError";
+    this.code = code;
+    this.failedPath = failedPath;
+  }
+};
+function assertNoSymlinkInPath(targetPath, options = {}) {
+  const deps = getDeps(options);
+  const resolved = deps.path.resolve(targetPath);
+  const segments = getPathSegments(resolved, deps.path);
+  for (const segment of segments) {
+    const stat = tryLstat(segment, deps.fs);
+    if (!stat) {
+      return;
+    }
+    if (stat.isSymbolicLink()) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Refusing to use symlinked agent store path: ${segment}`,
+        failedPath: segment
+      });
+    }
+  }
+}
+function ensureSecureDirectoryChain(targetDir, options = {}) {
+  const deps = getDeps(options);
+  const resolvedTarget = deps.path.resolve(targetDir);
+  const trustedBase = options.trustedBase !== void 0 ? deps.path.resolve(options.trustedBase) : findTrustedDirectoryAncestor(resolvedTarget, deps);
+  if (resolvedTarget === trustedBase) {
+    assertRealDirectorySegment(trustedBase, deps);
+    return;
+  }
+  const relative = deps.path.relative(trustedBase, resolvedTarget);
+  if (relative.length === 0 || relative.startsWith("..") || deps.path.isAbsolute(relative)) {
+    throw new AgentStorePathError({
+      code: "invalid_store_base",
+      message: `Refusing to create ${resolvedTarget} outside trusted base ${trustedBase}`,
+      failedPath: resolvedTarget
+    });
+  }
+  const segments = relative.split(deps.path.sep).filter((segment) => segment.length > 0);
+  let current = trustedBase;
+  for (const segment of segments) {
+    assertRealDirectorySegment(current, deps);
+    current = deps.path.join(current, segment);
+    ensureRealDirectorySegment(current, deps);
+  }
+}
+function getDeps(options) {
+  var _a;
+  var _b, _c, _d, _e, _f, _g, _h;
+  return {
+    env: (_b = options.env) !== null && _b !== void 0 ? _b : process.env,
+    fs: (_c = options.fs) !== null && _c !== void 0 ? _c : fs,
+    geteuid: (_d = options.geteuid) !== null && _d !== void 0 ? _d : (_a = process.geteuid) === null || _a === void 0 ? void 0 : _a.bind(process),
+    osTmpdir: (_e = options.osTmpdir) !== null && _e !== void 0 ? _e : os.tmpdir,
+    path: (_f = options.path) !== null && _f !== void 0 ? _f : path,
+    platform: (_g = options.platform) !== null && _g !== void 0 ? _g : process.platform,
+    windowsAcl: (_h = options.windowsAcl) !== null && _h !== void 0 ? _h : {}
+  };
+}
+function assertDirectoryStat(targetPath, stat) {
+  if (stat.isSymbolicLink()) {
+    throw new AgentStorePathError({
+      code: "symlink_refused",
+      message: `Refusing to use symlinked agent store path: ${targetPath}`,
+      failedPath: targetPath
+    });
+  }
+  if (!stat.isDirectory()) {
+    throw new AgentStorePathError({
+      code: "not_directory",
+      message: `Agent store path is not a directory: ${targetPath}`,
+      failedPath: targetPath
+    });
+  }
+}
+function findTrustedDirectoryAncestor(targetPath, deps) {
+  var _a;
+  const segments = getPathSegments(deps.path.resolve(targetPath), deps.path);
+  let trusted = (_a = segments[0]) !== null && _a !== void 0 ? _a : deps.path.resolve(targetPath);
+  for (let i = 1; i < segments.length; i++) {
+    const segment = segments[i];
+    const stat = tryLstat(segment, deps.fs);
+    if (!stat) {
+      break;
+    }
+    if (stat.isSymbolicLink()) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Refusing to use symlinked agent store path: ${segment}`,
+        failedPath: segment
+      });
+    }
+    if (!stat.isDirectory()) {
+      throw new AgentStorePathError({
+        code: "not_directory",
+        message: `Agent store path is not a directory: ${segment}`,
+        failedPath: segment
+      });
+    }
+    trusted = segment;
+  }
+  return trusted;
+}
+function assertRealDirectorySegment(targetPath, deps) {
+  const stat = tryLstat(targetPath, deps.fs);
+  if (!stat) {
+    throw new AgentStorePathError({
+      code: "not_directory",
+      message: `Trusted directory does not exist: ${targetPath}`,
+      failedPath: targetPath
+    });
+  }
+  assertDirectoryStat(targetPath, stat);
+}
+function ensureRealDirectorySegment(targetPath, deps) {
+  let stat = tryLstat(targetPath, deps.fs);
+  if (!stat) {
+    try {
+      deps.fs.mkdirSync(targetPath, { mode: PRIVATE_DIR_MODE });
+    } catch (error) {
+      if (!isNodeError(error) || error.code !== "EEXIST") {
+        throw error;
+      }
+    }
+    stat = tryLstat(targetPath, deps.fs);
+    if (!stat) {
+      throw new AgentStorePathError({
+        code: "not_directory",
+        message: `Failed to create directory: ${targetPath}`,
+        failedPath: targetPath
+      });
+    }
+  }
+  assertDirectoryStat(targetPath, stat);
+}
+function getPathSegments(targetPath, pathModule) {
+  const root = pathModule.parse(targetPath).root;
+  const rest = targetPath.slice(root.length);
+  const parts = rest.split(/[\\/]+/).filter(Boolean);
+  const segments = [];
+  let current = root;
+  if (root) {
+    segments.push(root);
+  }
+  for (const part of parts) {
+    current = current === root ? pathModule.join(root, part) : pathModule.join(current, part);
+    segments.push(current);
+  }
+  return segments;
+}
+function tryLstat(targetPath, fsModule) {
+  try {
+    return fsModule.lstatSync(targetPath);
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") {
+      return void 0;
+    }
+    throw err;
+  }
+}
+function isNodeError(err) {
+  return err instanceof Error && typeof err.code === "string";
+}
+
+// ../agent-store-sync/dist/conflict-events.js
+var CONFLICT_JOURNAL_ROTATE_BYTES = 4 * 1024 * 1024;
+var O_NOFOLLOW_FLAG = fs2.constants.O_NOFOLLOW;
+
+// ../agent-store-sync/dist/local-index.js
+import * as fs4 from "node:fs";
+import * as path3 from "node:path";
+
+// ../agent-store-sync/dist/secure-open.js
+import * as fs3 from "node:fs";
+import * as path2 from "node:path";
+function openSecureSqlitePath(resolvedPath, mode) {
+  const parentDir = path2.dirname(resolvedPath);
+  const parentDirFd = openParentDirectoryNoFollow(parentDir);
+  let cleanupParentFd = true;
+  try {
+    const parentStat = fs3.fstatSync(parentDirFd);
+    if (!parentStat.isDirectory()) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Refusing to open sqlite under non-directory parent: ${parentDir}`,
+        failedPath: parentDir
+      });
+    }
+    const parentIdentity = {
+      dev: parentStat.dev,
+      ino: parentStat.ino
+    };
+    assertParentDirInodeMatchesPath(parentIdentity, parentDir);
+    const leafFd = openRegularFileNoFollowCreate(resolvedPath, mode);
+    let leafIdentity;
+    try {
+      const leafStat = fs3.fstatSync(leafFd);
+      if (!leafStat.isFile()) {
+        throw new AgentStorePathError({
+          code: "symlink_refused",
+          message: `Refusing to open non-regular sqlite path: ${resolvedPath}`,
+          failedPath: resolvedPath
         });
+      }
+      assertResolvedPathStillCanonical(resolvedPath);
+      leafIdentity = { dev: leafStat.dev, ino: leafStat.ino };
+    } finally {
+      fs3.closeSync(leafFd);
+    }
+    let verified = false;
+    let closed = false;
+    const closeParent = () => {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      fs3.closeSync(parentDirFd);
+    };
+    const verifyOpenedInode = () => {
+      if (verified) {
+        return;
+      }
+      assertParentDirInodeMatchesPath(parentIdentity, parentDir);
+      assertLeafInodeUnchanged(resolvedPath, leafIdentity);
+      verified = true;
+    };
+    cleanupParentFd = false;
+    return {
+      sqlitePath: resolvedPath,
+      verifyOpenedInode,
+      close: closeParent
+    };
+  } finally {
+    if (cleanupParentFd) {
+      fs3.closeSync(parentDirFd);
     }
+  }
 }
-/**
- * True when `hostname` is an AWS S3 object-storage endpoint:
- * `*.amazonaws.com` with at least one label in
- * {@link S3_OBJECT_LABELS}. Covers modern virtual-host, path-style,
- * dualstack, accelerate, and FIPS URLs. Rejects the S3-named control
- * planes (`s3-control`, `s3-outposts`, `s3-object-lambda`) and the
- * legacy regional virtual-host form AWS deprecated in 2019, both of
- * which would otherwise let a tampered presign issuer turn the sync
- * client into a signed-request gadget against non-storage APIs.
- */
-export function isAwsS3Hostname(hostname) {
-    const lowered = hostname.toLowerCase();
-    if (lowered !== "amazonaws.com" && !lowered.endsWith(".amazonaws.com")) {
-        return false;
-    }
-    const labels = lowered.split(".");
-    return labels.some(label => S3_OBJECT_LABELS.has(label));
-}
-const S3_OBJECT_LABELS = new Set(["s3", "s3-accelerate", "s3-fips"]);
-/**
- * Like {@link defaultPresignedUrlValidator} plus a case-insensitive
- * exact-match check against `allowedHosts` (no subdomain wildcards).
- */
-export function createHostAllowlistValidator(allowedHosts) {
-    const allowed = new Set(allowedHosts.map(host => host.toLowerCase()));
-    return (url) => {
-        defaultPresignedUrlValidator(url);
-        if (!allowed.has(url.hostname.toLowerCase())) {
-            throw new PresignedUrlRejectedError({
-                code: "host_not_allowed",
-                message: `Refused presigned URL whose host is not in the allowlist: ${url.hostname}`,
-                url: redactPresignedUrlString(url),
-            });
-        }
-    };
+function openRegularFileNoFollowCreate(filePath, mode) {
+  const flags = symlinkSafeOpenCreateFlags();
+  try {
+    return fs3.openSync(filePath, flags, mode);
+  } catch (error) {
+    if (isNofollowSymlinkRefusal(error)) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Refusing to open symlinked path: ${filePath}`,
+        failedPath: filePath
+      });
+    }
+    throw error;
+  }
 }
-/**
- * Virtual-host S3 endpoints for the production `agent-stores` bucket
- * (matches backend `getAgentStoreBucket()` in
- * `backend/server/src/agent-stores/utils/agentStoreS3.ts`, which presigns
- * with a `us-east-1` `S3Client` and the SDK's default virtual-host
- * addressing). Both the regional form emitted by modern AWS SDK v3 and
- * the legacy global form are listed so a presign issuer upgrade or
- * downgrade can't trip the allowlist. Path-style (`s3.amazonaws.com/agent-stores/…`)
- * is intentionally not listed: the server never sets `forcePathStyle`,
- * and admitting bare `s3.amazonaws.com` would re-open the "any bucket"
- * gap this allowlist exists to close.
- */
-export const BCS_AGENT_STORE_BUCKET_HOSTS = [
-    "agent-stores.s3.us-east-1.amazonaws.com",
-    "agent-stores.s3.amazonaws.com",
-];
-const PLAYGROUND_AGENT_STORE_BUCKET_HOSTS = [
-    "agent-stores-928182716709-us-west-2-an.s3.us-west-2.amazonaws.com",
-    "agent-stores-928182716709-us-west-2-an.s3.amazonaws.com",
-];
-/**
- * Production validator for the BCS agent-store sync transport: strict
- * default (https, S3 endpoint, no private hosts, no userinfo) plus the
- * {@link BCS_AGENT_STORE_BUCKET_HOSTS} pin. Pre-built so callers don't
- * accidentally pass {@link defaultPresignedUrlValidator}, which would
- * accept any AWS S3 bucket on the internet and let a buggy or
- * compromised presign issuer redirect sync traffic away from the real
- * `agent-stores` bucket.
- */
-export function createBcsPresignedUrlValidator() {
-    return createHostAllowlistValidator(BCS_AGENT_STORE_BUCKET_HOSTS);
-}
-/**
- * True when `backendUrl` targets a local dev backend (localhost or
- * lclhst.build). Matches IDE checks in `cursor-always-local` /
- * `cursorCredsService`.
- */
-export function isLocalAgentStoreBackendUrl(backendUrl) {
-    const trimmed = backendUrl.trim();
-    if (trimmed === "") {
-        return false;
-    }
-    return trimmed.includes("localhost") || trimmed.includes("lclhst.build");
-}
-function isPlaygroundAgentStoreBackendUrl(backendUrl) {
+function openParentDirectoryNoFollow(parentDir) {
+  const flags = symlinkSafeDirectoryOpenFlags();
+  try {
+    return fs3.openSync(parentDir, flags);
+  } catch (error) {
+    if (isNofollowSymlinkRefusal(error) || isNodeError2(error) && error.code === "ENOTDIR" && isSymlink(parentDir)) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Refusing to open sqlite under symlinked parent: ${parentDir}`,
+        failedPath: parentDir
+      });
+    }
+    throw error;
+  }
+}
+function isSymlink(targetPath) {
+  try {
+    return fs3.lstatSync(targetPath).isSymbolicLink();
+  } catch (_a) {
+    return false;
+  }
+}
+function assertResolvedPathStillCanonical(resolvedPath) {
+  let realpath;
+  try {
+    realpath = fs3.realpathSync.native(resolvedPath);
+  } catch (error) {
+    throw new AgentStorePathError({
+      code: "symlink_refused",
+      message: `Unable to resolve realpath for ${resolvedPath}: ${error instanceof Error ? error.message : String(error)}`,
+      failedPath: resolvedPath
+    });
+  }
+  if (realpath !== resolvedPath) {
+    throw new AgentStorePathError({
+      code: "symlink_refused",
+      message: `Refusing path with symlinked parent: ${resolvedPath} -> ${realpath}`,
+      failedPath: resolvedPath
+    });
+  }
+}
+function assertLeafInodeUnchanged(resolvedPath, expected) {
+  const flags = symlinkSafeReopenFlags();
+  let fd;
+  try {
+    fd = fs3.openSync(resolvedPath, flags);
+  } catch (error) {
+    if (isNofollowSymlinkRefusal(error)) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Sqlite path became symlinked between open and verification: ${resolvedPath}`,
+        failedPath: resolvedPath
+      });
+    }
+    throw error;
+  }
+  try {
+    const stat = fs3.fstatSync(fd);
+    assertResolvedPathStillCanonical(resolvedPath);
+    if (stat.dev !== expected.dev || stat.ino !== expected.ino) {
+      throw new AgentStorePathError({
+        code: "symlink_refused",
+        message: `Sqlite path inode drifted between open and verification (expected dev=${expected.dev} ino=${expected.ino}, got dev=${stat.dev} ino=${stat.ino}): ${resolvedPath}`,
+        failedPath: resolvedPath
+      });
+    }
+  } finally {
+    fs3.closeSync(fd);
+  }
+}
+function assertParentDirInodeMatchesPath(expected, parentDir) {
+  let pathStat;
+  try {
+    pathStat = fs3.lstatSync(parentDir);
+  } catch (error) {
+    throw new AgentStorePathError({
+      code: "symlink_refused",
+      message: `Unable to lstat parent directory ${parentDir}: ${error instanceof Error ? error.message : String(error)}`,
+      failedPath: parentDir
+    });
+  }
+  if (pathStat.isSymbolicLink()) {
+    throw new AgentStorePathError({
+      code: "symlink_refused",
+      message: `Parent directory became symlinked between open and verification: ${parentDir}`,
+      failedPath: parentDir
+    });
+  }
+  if (pathStat.dev !== expected.dev || pathStat.ino !== expected.ino) {
+    throw new AgentStorePathError({
+      code: "symlink_refused",
+      message: `Parent directory inode drifted between open and verification (expected dev=${expected.dev} ino=${expected.ino}, got dev=${pathStat.dev} ino=${pathStat.ino}): ${parentDir}`,
+      failedPath: parentDir
+    });
+  }
+}
+function symlinkSafeOpenCreateFlags() {
+  var _a;
+  const constants3 = fs3.constants;
+  let flags = (_a = constants3.O_RDWR) !== null && _a !== void 0 ? _a : 0;
+  if (typeof constants3.O_CREAT === "number") {
+    flags |= constants3.O_CREAT;
+  }
+  if (typeof constants3.O_NOFOLLOW === "number") {
+    flags |= constants3.O_NOFOLLOW;
+  }
+  if (typeof constants3.O_CLOEXEC === "number") {
+    flags |= constants3.O_CLOEXEC;
+  }
+  return flags;
+}
+function symlinkSafeReopenFlags() {
+  var _a;
+  const constants3 = fs3.constants;
+  let flags = (_a = constants3.O_RDONLY) !== null && _a !== void 0 ? _a : 0;
+  if (typeof constants3.O_NOFOLLOW === "number") {
+    flags |= constants3.O_NOFOLLOW;
+  }
+  if (typeof constants3.O_CLOEXEC === "number") {
+    flags |= constants3.O_CLOEXEC;
+  }
+  return flags;
+}
+function symlinkSafeDirectoryOpenFlags() {
+  var _a;
+  const constants3 = fs3.constants;
+  let flags = (_a = constants3.O_RDONLY) !== null && _a !== void 0 ? _a : 0;
+  if (typeof constants3.O_DIRECTORY === "number") {
+    flags |= constants3.O_DIRECTORY;
+  }
+  if (typeof constants3.O_NOFOLLOW === "number") {
+    flags |= constants3.O_NOFOLLOW;
+  }
+  if (typeof constants3.O_CLOEXEC === "number") {
+    flags |= constants3.O_CLOEXEC;
+  }
+  return flags;
+}
+function isNofollowSymlinkRefusal(error) {
+  if (!isNodeError2(error)) {
+    return false;
+  }
+  if (error.code === "ELOOP" || error.code === "EMLINK") {
+    return true;
+  }
+  if (error.code === "EPERM" && hasNofollowConstant()) {
+    return true;
+  }
+  return false;
+}
+function hasNofollowConstant() {
+  return typeof fs3.constants.O_NOFOLLOW === "number";
+}
+function isNodeError2(error) {
+  return error instanceof Error && typeof error.code === "string";
+}
+
+// ../agent-store-sync/dist/local-index.js
+var CURRENT_SCHEMA_VERSION = 3;
+var PRIVATE_FILE_MODE = 384;
+var META_DELETION_ARMED = "deletion_armed";
+var META_FILES_ROOT_DEV = "files_root_dev";
+var META_FILES_ROOT_INO = "files_root_ino";
+var LocalIndexError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "LocalIndexError";
+  }
+};
+var LocalAgentStoreIndex = class _LocalAgentStoreIndex {
+  static open(indexPath, options) {
+    const resolvedPath = path3.resolve(indexPath);
+    const existing = _LocalAgentStoreIndex.openHandles.get(resolvedPath);
+    if (existing !== void 0 && !existing.closed) {
+      return existing;
+    }
+    assertNoSymlinkInPath(resolvedPath);
+    ensureSecureDirectoryChain(path3.dirname(resolvedPath));
+    assertNoSymlinkInPath(resolvedPath);
+    const opened = openSecureSqlitePath(resolvedPath, PRIVATE_FILE_MODE);
+    let db;
     try {
-        const hostname = new URL(backendUrl).hostname.toLowerCase();
-        return (hostname === "playground.cursor.sh" ||
-            hostname.endsWith(".playground.cursor.sh"));
-    }
-    catch (_a) {
-        return false;
-    }
+      db = new options.sqlite(opened.sqlitePath);
+      opened.verifyOpenedInode();
+      restrictIndexFileModes(resolvedPath);
+      const index = new _LocalAgentStoreIndex(resolvedPath, db);
+      index.opened = opened;
+      index.migrate();
+      index.restrictFileModes();
+      _LocalAgentStoreIndex.openHandles.set(resolvedPath, index);
+      return index;
+    } catch (error) {
+      db === null || db === void 0 ? void 0 : db.close();
+      opened.close();
+      throw error;
+    }
+  }
+  constructor(indexPath, db) {
+    this.indexPath = indexPath;
+    this.db = db;
+    this.closed = false;
+  }
+  close() {
+    var _a;
+    if (this.closed) {
+      return;
+    }
+    this.db.close();
+    (_a = this.opened) === null || _a === void 0 ? void 0 : _a.close();
+    this.opened = void 0;
+    this.closed = true;
+    _LocalAgentStoreIndex.openHandles.delete(this.indexPath);
+  }
+  getFile(relPath) {
+    const row = this.db.prepare("SELECT rel_path, last_synced_sha, last_seen_etag, size, last_synced_ms, direction, state, tombstone_etag, deleted_at_ms FROM files WHERE rel_path = ?").get(relPath);
+    return row === void 0 ? void 0 : fileEntryFromRow(row);
+  }
+  listFiles() {
+    const rows = this.db.prepare("SELECT rel_path, last_synced_sha, last_seen_etag, size, last_synced_ms, direction, state, tombstone_etag, deleted_at_ms FROM files ORDER BY rel_path ASC").all();
+    return rows.map(fileEntryFromRow);
+  }
+  upsertFile(entry) {
+    var _a, _b;
+    const state = (_a = entry.state) !== null && _a !== void 0 ? _a : "live";
+    const tombstoneEtag = state === "tombstoned" ? entry.tombstoneEtag : null;
+    const deletedAtMs = state === "tombstoned" ? entry.deletedAtMs : null;
+    this.db.prepare(`
+        INSERT INTO files (
+          rel_path,
+          last_synced_sha,
+          last_seen_etag,
+          size,
+          last_synced_ms,
+          direction,
+          state,
+          tombstone_etag,
+          deleted_at_ms
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(rel_path) DO UPDATE SET
+          last_synced_sha = excluded.last_synced_sha,
+          last_seen_etag = excluded.last_seen_etag,
+          size = excluded.size,
+          last_synced_ms = excluded.last_synced_ms,
+          direction = excluded.direction,
+          state = excluded.state,
+          tombstone_etag = excluded.tombstone_etag,
+          deleted_at_ms = excluded.deleted_at_ms
+      `).run(entry.relPath, entry.lastSyncedSha, (_b = entry.lastSeenEtag) !== null && _b !== void 0 ? _b : null, entry.size, entry.lastSyncedMs, entry.direction, state, tombstoneEtag !== null && tombstoneEtag !== void 0 ? tombstoneEtag : null, deletedAtMs !== null && deletedAtMs !== void 0 ? deletedAtMs : null);
+    this.restrictFileModes();
+  }
+  listPendingDeletes() {
+    const rows = this.db.prepare("SELECT rel_path, base_etag, requested_at_ms, mutation_id FROM pending_deletes ORDER BY rel_path ASC").all();
+    return rows.map((row) => {
+      var _a;
+      return {
+        relPath: row.rel_path,
+        baseEtag: row.base_etag,
+        requestedAtMs: row.requested_at_ms,
+        mutationId: (_a = row.mutation_id) !== null && _a !== void 0 ? _a : void 0
+      };
+    });
+  }
+  hasPendingDelete(relPath) {
+    const row = this.db.prepare("SELECT rel_path FROM pending_deletes WHERE rel_path = ?").get(relPath);
+    return row !== void 0;
+  }
+  upsertPendingDelete(entry) {
+    var _a;
+    this.db.prepare(`
+        INSERT INTO pending_deletes (
+          rel_path,
+          base_etag,
+          requested_at_ms,
+          mutation_id
+        ) VALUES (?, ?, ?, ?)
+        ON CONFLICT(rel_path) DO UPDATE SET
+          base_etag = excluded.base_etag,
+          requested_at_ms = excluded.requested_at_ms,
+          mutation_id = excluded.mutation_id
+      `).run(entry.relPath, entry.baseEtag, entry.requestedAtMs, (_a = entry.mutationId) !== null && _a !== void 0 ? _a : null);
+    this.restrictFileModes();
+  }
+  removePendingDelete(relPath) {
+    const result = this.db.prepare("DELETE FROM pending_deletes WHERE rel_path = ?").run(relPath);
+    return result.changes > 0;
+  }
+  /** Recovery-mode escape hatch: drop every unflushed deletion intent. */
+  clearPendingDeletes() {
+    const result = this.db.prepare("DELETE FROM pending_deletes").run();
+    return result.changes;
+  }
+  /**
+   * Durable recovery step: unarm scan-based deletion, forget the recorded
+   * `files/` root identity, and drop every unflushed deletion intent in one
+   * shot. Called when the identity guard trips so a subsequent round starts
+   * from the legacy restore semantics until a clean round re-arms. Returns
+   * the number of pending deletes cleared.
+   */
+  disarmDeletionAndClearPending() {
+    const disarm = this.db.transaction(() => {
+      this.db.prepare(`
+          INSERT INTO meta (key, value)
+          VALUES (?, ?)
+          ON CONFLICT(key) DO UPDATE SET value = excluded.value
+        `).run(META_DELETION_ARMED, "0");
+      this.db.prepare("DELETE FROM meta WHERE key = ?").run(META_FILES_ROOT_DEV);
+      this.db.prepare("DELETE FROM meta WHERE key = ?").run(META_FILES_ROOT_INO);
+      return this.db.prepare("DELETE FROM pending_deletes").run().changes;
+    });
+    const cleared = disarm();
+    this.restrictFileModes();
+    return cleared;
+  }
+  /**
+   * Arms scan-based deletion and records the `files/` root identity in one
+   * SQLite transaction so a crash cannot leave `deletion_armed=1` without
+   * both identity keys (which the next round would treat as compromised).
+   */
+  armDeletionWithIdentity(identity) {
+    const arm = this.db.transaction(() => {
+      const upsert = this.db.prepare(`
+        INSERT INTO meta (key, value)
+        VALUES (?, ?)
+        ON CONFLICT(key) DO UPDATE SET value = excluded.value
+      `);
+      upsert.run(META_DELETION_ARMED, "1");
+      upsert.run(META_FILES_ROOT_DEV, String(identity.dev));
+      upsert.run(META_FILES_ROOT_INO, String(identity.ino));
+    });
+    arm();
+    this.restrictFileModes();
+  }
+  deleteFile(relPath) {
+    const result = this.db.prepare("DELETE FROM files WHERE rel_path = ?").run(relPath);
+    if (result.changes > 0) {
+      this.restrictFileModes();
+    }
+    return result.changes > 0;
+  }
+  getMeta(key) {
+    const row = this.db.prepare("SELECT value FROM meta WHERE key = ?").get(key);
+    return row === null || row === void 0 ? void 0 : row.value;
+  }
+  setMeta(entry) {
+    this.db.prepare(`
+        INSERT INTO meta (key, value)
+        VALUES (?, ?)
+        ON CONFLICT(key) DO UPDATE SET value = excluded.value
+      `).run(entry.key, entry.value);
+    this.restrictFileModes();
+  }
+  migrate() {
+    this.db.pragma("journal_mode = WAL");
+    this.db.pragma("synchronous = NORMAL");
+    this.db.pragma("busy_timeout = 5000");
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS meta (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+    `);
+    const version = this.getMeta("schema_version");
+    if (version === void 0) {
+      this.createCurrentSchema();
+      return;
+    }
+    const parsedVersion = Number(version);
+    if (!Number.isInteger(parsedVersion) || parsedVersion < 1 || parsedVersion > CURRENT_SCHEMA_VERSION) {
+      throw new LocalIndexError("unsupported_schema_version", `Unsupported agent store index schema version: ${version}`);
+    }
+    this.createFilesTableIfNeeded();
+    if (parsedVersion < 2) {
+      this.migrateV1ToV2();
+    }
+    if (parsedVersion < 3) {
+      this.migrateV2ToV3();
+    }
+  }
+  createCurrentSchema() {
+    this.createFilesTableIfNeeded();
+    this.createPendingDeletesTableIfNeeded();
+    this.setMeta({
+      key: "schema_version",
+      value: String(CURRENT_SCHEMA_VERSION)
+    });
+  }
+  createFilesTableIfNeeded() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS files (
+        rel_path TEXT PRIMARY KEY,
+        last_synced_sha TEXT NOT NULL,
+        last_seen_etag TEXT,
+        size INTEGER NOT NULL,
+        last_synced_ms INTEGER NOT NULL,
+        direction TEXT NOT NULL CHECK(direction IN ('pulled', 'pushed')),
+        state TEXT NOT NULL DEFAULT 'live' CHECK(state IN ('live', 'tombstoned')),
+        tombstone_etag TEXT,
+        deleted_at_ms INTEGER
+      );
+    `);
+  }
+  createPendingDeletesTableIfNeeded() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS pending_deletes (
+        rel_path TEXT PRIMARY KEY,
+        base_etag TEXT NOT NULL,
+        requested_at_ms INTEGER NOT NULL,
+        mutation_id TEXT
+      );
+    `);
+  }
+  migrateV1ToV2() {
+    const columns = this.db.prepare("PRAGMA table_info(files)").all();
+    if (columns.some((column) => column.name === "last_seen_sha")) {
+      this.db.exec("ALTER TABLE files RENAME COLUMN last_seen_sha TO last_synced_sha");
+    }
+    if (!columns.some((column) => column.name === "last_seen_etag")) {
+      this.db.exec("ALTER TABLE files ADD COLUMN last_seen_etag TEXT");
+    }
+    this.setMeta({
+      key: "schema_version",
+      value: "2"
+    });
+  }
+  migrateV2ToV3() {
+    const columns = this.db.prepare("PRAGMA table_info(files)").all();
+    if (!columns.some((column) => column.name === "state")) {
+      this.db.exec("ALTER TABLE files ADD COLUMN state TEXT NOT NULL DEFAULT 'live' CHECK(state IN ('live', 'tombstoned'))");
+    }
+    if (!columns.some((column) => column.name === "tombstone_etag")) {
+      this.db.exec("ALTER TABLE files ADD COLUMN tombstone_etag TEXT");
+    }
+    if (!columns.some((column) => column.name === "deleted_at_ms")) {
+      this.db.exec("ALTER TABLE files ADD COLUMN deleted_at_ms INTEGER");
+    }
+    this.createPendingDeletesTableIfNeeded();
+    this.setMeta({
+      key: "schema_version",
+      value: String(CURRENT_SCHEMA_VERSION)
+    });
+  }
+  restrictFileModes() {
+    restrictIndexFileModes(this.indexPath);
+  }
+};
+LocalAgentStoreIndex.openHandles = /* @__PURE__ */ new Map();
+function fileEntryFromRow(row) {
+  var _a, _b, _c;
+  return {
+    relPath: row.rel_path,
+    lastSyncedSha: row.last_synced_sha,
+    lastSeenEtag: (_a = row.last_seen_etag) !== null && _a !== void 0 ? _a : void 0,
+    size: row.size,
+    lastSyncedMs: row.last_synced_ms,
+    direction: row.direction,
+    state: row.state,
+    tombstoneEtag: (_b = row.tombstone_etag) !== null && _b !== void 0 ? _b : void 0,
+    deletedAtMs: (_c = row.deleted_at_ms) !== null && _c !== void 0 ? _c : void 0
+  };
 }
-/**
- * Presign validator for the sync client. Production/staging and playground
- * backends are pinned to their respective agent-store buckets. For a local dev API (see
- * {@link isLocalAgentStoreBackendUrl}), allow `http:` to loopback only
- * (LocalStack) and still pin all other URLs to {@link BCS_AGENT_STORE_BUCKET_HOSTS}.
- */
-export function createAgentStorePresignedUrlValidatorForBackend(backendUrl) {
-    if (isLocalAgentStoreBackendUrl(backendUrl)) {
-        return createLocalDevAgentStorePresignedUrlValidator();
+function restrictIndexFileModes(indexPath) {
+  for (const filePath of [indexPath, `${indexPath}-wal`, `${indexPath}-shm`]) {
+    if (fs4.existsSync(filePath)) {
+      fs4.chmodSync(filePath, PRIVATE_FILE_MODE);
     }
-    if (isPlaygroundAgentStoreBackendUrl(backendUrl)) {
-        return createHostAllowlistValidator(PLAYGROUND_AGENT_STORE_BUCKET_HOSTS);
-    }
-    return createBcsPresignedUrlValidator();
+  }
 }
-function createLocalDevAgentStorePresignedUrlValidator() {
-    const bcsValidator = createBcsPresignedUrlValidator();
-    return (url) => {
-        assertSafeAuthority(url);
-        const hostname = stripIPv6Brackets(url.hostname);
-        if (url.protocol === "http:" && isLoopbackHostName(hostname)) {
-            return;
-        }
-        bcsValidator(url);
-    };
+
+// ../agent-store-sync/dist/metrics-emitter.js
+var NOOP_METRICS_EMITTER = Object.freeze({
+  onDiskFull() {
+  },
+  onSymlinkRefused() {
+  },
+  onNetworkError() {
+  },
+  onRoundCompleted() {
+  },
+  onError() {
+  },
+  onConflict() {
+  },
+  tokenMinted() {
+  },
+  tokenRefreshUnauthorized() {
+  }
+});
+
+// ../agent-store-sync/dist/metrics-aggregator.js
+var DISK_FULL_REPEAT_WINDOW_MS = 5 * 60 * 1e3;
+
+// ../agent-store-sync/dist/presigned-url.js
+var PresignedUrlRejectedError = class extends Error {
+  constructor(options) {
+    super(options.message);
+    this.name = "PresignedUrlRejectedError";
+    this.code = options.code;
+    this.url = options.url;
+  }
+};
+function defaultPresignedUrlValidator(url) {
+  assertSafeAuthority(url);
+  if (url.protocol !== "https:") {
+    throw new PresignedUrlRejectedError({
+      code: "scheme_not_allowed",
+      message: `Refused presigned URL with non-https scheme: ${url.protocol}`,
+      url: redactPresignedUrlString(url)
+    });
+  }
+  const hostname = stripIPv6Brackets(url.hostname);
+  if (isLocalOrInternalHost(hostname)) {
+    throw new PresignedUrlRejectedError({
+      code: "private_host_not_allowed",
+      message: `Refused https presigned URL with private/internal host: ${hostname}`,
+      url: redactPresignedUrlString(url)
+    });
+  }
+  if (!isAwsS3Hostname(hostname)) {
+    throw new PresignedUrlRejectedError({
+      code: "host_not_allowed",
+      message: `Refused presigned URL whose host is not an AWS S3 endpoint: ${hostname}`,
+      url: redactPresignedUrlString(url)
+    });
+  }
+}
+function isAwsS3Hostname(hostname) {
+  const lowered = hostname.toLowerCase();
+  if (lowered !== "amazonaws.com" && !lowered.endsWith(".amazonaws.com")) {
+    return false;
+  }
+  const labels = lowered.split(".");
+  return labels.some((label) => S3_OBJECT_LABELS.has(label));
+}
+var S3_OBJECT_LABELS = /* @__PURE__ */ new Set(["s3", "s3-accelerate", "s3-fips"]);
+function createHostAllowlistValidator(allowedHosts) {
+  const allowed = new Set(allowedHosts.map((host) => host.toLowerCase()));
+  return (url) => {
+    defaultPresignedUrlValidator(url);
+    if (!allowed.has(url.hostname.toLowerCase())) {
+      throw new PresignedUrlRejectedError({
+        code: "host_not_allowed",
+        message: `Refused presigned URL whose host is not in the allowlist: ${url.hostname}`,
+        url: redactPresignedUrlString(url)
+      });
+    }
+  };
+}
+var BCS_AGENT_STORE_BUCKET_HOSTS = [
+  "agent-stores.s3.us-east-1.amazonaws.com",
+  "agent-stores.s3.amazonaws.com"
+];
+function createBcsPresignedUrlValidator() {
+  return createHostAllowlistValidator(BCS_AGENT_STORE_BUCKET_HOSTS);
 }
-/**
- * Like {@link defaultPresignedUrlValidator} plus `http://localhost` /
- * `127.0.0.1` / `[::1]` (any port) for LocalStack-backed unit tests.
- * Non-loopback `https:` URLs fall through to the strict default (any S3
- * bucket). Do not use for IDE wiring — use
- * {@link createAgentStorePresignedUrlValidatorForBackend} instead.
- */
-export function localhostPermissivePresignedUrlValidator(url) {
+function isLocalAgentStoreBackendUrl(backendUrl) {
+  const trimmed = backendUrl.trim();
+  if (trimmed === "") {
+    return false;
+  }
+  return trimmed.includes("localhost") || trimmed.includes("lclhst.build");
+}
+function createAgentStorePresignedUrlValidatorForBackend(backendUrl) {
+  return isLocalAgentStoreBackendUrl(backendUrl) ? createLocalDevAgentStorePresignedUrlValidator() : createBcsPresignedUrlValidator();
+}
+function createLocalDevAgentStorePresignedUrlValidator() {
+  const bcsValidator = createBcsPresignedUrlValidator();
+  return (url) => {
     assertSafeAuthority(url);
     const hostname = stripIPv6Brackets(url.hostname);
     if (url.protocol === "http:" && isLoopbackHostName(hostname)) {
-        return;
+      return;
     }
-    defaultPresignedUrlValidator(url);
+    bcsValidator(url);
+  };
 }
 function assertSafeAuthority(url) {
-    if (url.username !== "" || url.password !== "") {
-        throw new PresignedUrlRejectedError({
-            code: "userinfo_not_allowed",
-            message: "Refused presigned URL with embedded userinfo",
-            url: redactPresignedUrlString(url),
-        });
-    }
-}
-/**
- * Strip the query string and userinfo from a presigned URL so the AWS
- * SigV4 signature never reaches error messages or telemetry.
- */
-export function redactPresignedUrlString(url) {
-    try {
-        const parsed = typeof url === "string" ? new URL(url) : url;
-        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
-    }
-    catch (_a) {
-        return "<unparseable-presigned-url>";
-    }
+  if (url.username !== "" || url.password !== "") {
+    throw new PresignedUrlRejectedError({
+      code: "userinfo_not_allowed",
+      message: "Refused presigned URL with embedded userinfo",
+      url: redactPresignedUrlString(url)
+    });
+  }
 }
-/**
- * Parse and validate a server-returned presigned URL before fetch. Uses
- * {@link relPath} in error text (never the raw URL) so SigV4 credentials
- * cannot leak into messages.
- */
-export function assertPresignedUrlSafe(args) {
-    let parsed;
-    try {
-        parsed = new URL(args.rawUrl);
-    }
-    catch (_a) {
-        throw new Error(`Refusing unparseable presigned URL for ${args.relPath}`);
-    }
-    try {
-        args.validatePresignedUrl(parsed);
-    }
-    catch (error) {
-        throw new Error(`Refusing presigned URL for ${args.relPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error instanceof Error ? error : undefined });
-    }
+function redactPresignedUrlString(url) {
+  try {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  } catch (_a) {
+    return "<unparseable-presigned-url>";
+  }
 }
 function isLoopbackHostName(hostname) {
-    const lowered = hostname.toLowerCase();
-    return (lowered === "localhost" ||
-        lowered === "ip6-localhost" ||
-        lowered === "127.0.0.1" ||
-        lowered === "::1" ||
-        lowered === "0:0:0:0:0:0:0:1");
+  const lowered = hostname.toLowerCase();
+  return lowered === "localhost" || lowered === "ip6-localhost" || lowered === "127.0.0.1" || lowered === "::1" || lowered === "0:0:0:0:0:0:0:1";
 }
 function isLocalOrInternalHost(hostname) {
-    if (hostname.length === 0) {
-        return true;
-    }
-    if (isLoopbackHostName(hostname)) {
-        return true;
-    }
-    if (isIPv4Address(hostname)) {
-        return isPrivateOrInternalIPv4(hostname);
-    }
-    if (isIPv6Address(hostname)) {
-        return isPrivateOrInternalIPv6(hostname);
-    }
-    // DNS hostnames can't be classified without resolving; the caller
-    // relies on transport-level allowlists for those.
-    return false;
+  if (hostname.length === 0) {
+    return true;
+  }
+  if (isLoopbackHostName(hostname)) {
+    return true;
+  }
+  if (isIPv4Address(hostname)) {
+    return isPrivateOrInternalIPv4(hostname);
+  }
+  if (isIPv6Address(hostname)) {
+    return isPrivateOrInternalIPv6(hostname);
+  }
+  return false;
 }
 function stripIPv6Brackets(hostname) {
-    return hostname.startsWith("[") && hostname.endsWith("]")
-        ? hostname.slice(1, -1)
-        : hostname;
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
 }
 function isIPv4Address(hostname) {
-    const parts = hostname.split(".");
-    if (parts.length !== 4) {
-        return false;
-    }
-    return parts.every(part => {
-        if (part.length === 0 || part.length > 3) {
-            return false;
-        }
-        if (!/^\d+$/.test(part)) {
-            return false;
-        }
-        const n = Number(part);
-        return Number.isInteger(n) && n >= 0 && n <= 255;
-    });
+  const parts = hostname.split(".");
+  if (parts.length !== 4) {
+    return false;
+  }
+  return parts.every((part) => {
+    if (part.length === 0 || part.length > 3) {
+      return false;
+    }
+    if (!/^\d+$/.test(part)) {
+      return false;
+    }
+    const n = Number(part);
+    return Number.isInteger(n) && n >= 0 && n <= 255;
+  });
 }
 function isPrivateOrInternalIPv4(hostname) {
-    const [a, b] = hostname.split(".").map(Number);
-    if (a === undefined || b === undefined) {
-        return true;
-    }
-    // RFC1918, loopback, link-local, multicast, unspecified, broadcast,
-    // carrier-grade NAT, and reserved blocks.
-    if (a === 0)
-        return true;
-    if (a === 10)
-        return true;
-    if (a === 127)
-        return true;
-    if (a === 169 && b === 254)
-        return true;
-    if (a === 172 && b >= 16 && b <= 31)
-        return true;
-    if (a === 192 && b === 168)
-        return true;
-    if (a === 100 && b >= 64 && b <= 127)
-        return true;
-    if (a >= 224 && a <= 239)
-        return true;
-    if (a >= 240)
-        return true;
-    return false;
+  const [a, b] = hostname.split(".").map(Number);
+  if (a === void 0 || b === void 0) {
+    return true;
+  }
+  if (a === 0)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  if (a === 100 && b >= 64 && b <= 127)
+    return true;
+  if (a >= 224 && a <= 239)
+    return true;
+  if (a >= 240)
+    return true;
+  return false;
 }
 function isIPv6Address(hostname) {
-    // Loose check — just enough to route the host to the IPv6 classifier.
-    return hostname.includes(":");
+  return hostname.includes(":");
 }
 function isPrivateOrInternalIPv6(hostname) {
-    const lowered = hostname.toLowerCase();
-    if (lowered === "::" || lowered === "::1") {
-        return true;
-    }
-    // IPv4-mapped IPv6 (RFC4291) routes back through the IPv4 classifier
-    // so `[::ffff:169.254.169.254]` can't slip past the private-IP check.
-    const mapped = extractIPv4MappedAddress(lowered);
-    if (mapped !== undefined) {
-        return isPrivateOrInternalIPv4(mapped);
-    }
-    // ULA fc00::/7, link-local fe80::/10, multicast ff00::/8.
-    if (lowered.startsWith("fc") || lowered.startsWith("fd")) {
-        return true;
-    }
-    if (lowered.startsWith("fe8") || lowered.startsWith("fe9")) {
-        return true;
-    }
-    if (lowered.startsWith("fea") || lowered.startsWith("feb")) {
-        return true;
-    }
-    if (lowered.startsWith("ff")) {
-        return true;
-    }
-    return false;
+  const lowered = hostname.toLowerCase();
+  if (lowered === "::" || lowered === "::1") {
+    return true;
+  }
+  const mapped = extractIPv4MappedAddress(lowered);
+  if (mapped !== void 0) {
+    return isPrivateOrInternalIPv4(mapped);
+  }
+  if (lowered.startsWith("fc") || lowered.startsWith("fd")) {
+    return true;
+  }
+  if (lowered.startsWith("fe8") || lowered.startsWith("fe9")) {
+    return true;
+  }
+  if (lowered.startsWith("fea") || lowered.startsWith("feb")) {
+    return true;
+  }
+  if (lowered.startsWith("ff")) {
+    return true;
+  }
+  return false;
 }
-// Convert an IPv4-mapped IPv6 literal (`::ffff:a.b.c.d` or
-// `::ffff:hhhh:hhhh`) to its dotted-quad form. Returns undefined otherwise.
 function extractIPv4MappedAddress(hostname) {
-    const dotted = hostname.match(/^(?:0:0:0:0:0|::):?ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
-    if (dotted) {
-        return dotted[1];
-    }
-    if (hostname.startsWith("::ffff:")) {
-        const tail = hostname.slice("::ffff:".length);
-        if (isIPv4Address(tail)) {
-            return tail;
-        }
-        const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-        if (hex) {
-            const high = Number.parseInt(hex[1], 16);
-            const low = Number.parseInt(hex[2], 16);
-            if (Number.isFinite(high) &&
-                Number.isFinite(low) &&
-                high >= 0 &&
-                high <= 0xffff &&
-                low >= 0 &&
-                low <= 0xffff) {
-                return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
-            }
-        }
-    }
-    return undefined;
+  const dotted = hostname.match(/^(?:0:0:0:0:0|::):?ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  if (dotted) {
+    return dotted[1];
+  }
+  if (hostname.startsWith("::ffff:")) {
+    const tail = hostname.slice("::ffff:".length);
+    if (isIPv4Address(tail)) {
+      return tail;
+    }
+    const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    if (hex) {
+      const high = Number.parseInt(hex[1], 16);
+      const low = Number.parseInt(hex[2], 16);
+      if (Number.isFinite(high) && Number.isFinite(low) && high >= 0 && high <= 65535 && low >= 0 && low <= 65535) {
+        return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+      }
+    }
+  }
+  return void 0;
 }
+
+// ../agent-store-sync/dist/resilience-events.js
+var NOOP_RESILIENCE_LISTENER = Object.freeze({
+  onDiskFull() {
+  },
+  onSymlinkRefused() {
+  },
+  onNetworkError() {
+  }
+});
+
+// ../agent-store-sync/dist/retrying-client.js
+var RETRYABLE_CONNECT_CODES = /* @__PURE__ */ new Set([
+  Code.Unavailable,
+  Code.ResourceExhausted,
+  Code.Internal,
+  Code.Aborted,
+  Code.DeadlineExceeded
+]);
+
+// ../agent-store-sync/dist/store-lock.js
+var STORE_LOCK_STALE_MS = 10 * 60 * 1e3;
+
+// ../agent-store-sync/dist/sync-engine.js
+var DEFAULT_MAX_FILE_SIZE_BYTES = 100 * 1024 * 1024;
+var TOMBSTONE_ROW_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
+export {
+  createAgentStorePresignedUrlValidatorForBackend
+};