@jini-ai/platform 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @jini-ai/platform
 
+## 0.5.2
+
+### Patch Changes
+
+- Tovu clean-up release (2026-10-08): code Tovu moved into Jini, plus the Jini clean-up (see the commit log since 0.5.1).
+
 ## 0.5.1 — 2026-10-04
 
 - `./secrets` exports the canonical site-key names (`SiteKeyHandle`, `FixedSiteKeyKeyring`, `UnusableSiteKeyError`, `SiteKeyFileAlreadyExistsError`, `parseSiteKeyHex`, `fingerprintSiteKeyHex`, `inspectSiteKeyMaterial`, `revealSiteKeyMaterial`, `generateFileSiteKey`, `deriveFromSiteKey`, `deriveSigningSecretFromSiteKey` and the matching types). Every `RootKey*` name stays exported as a `@deprecated` alias of the same binding, to be removed on or after 2026-11-01. Additive: no behavior or signature change.

package/dist/asset-cache.d.ts

@@ -1,4 +1,5 @@
 import { lookup as dnsLookupCb } from 'node:dns';
+import { Agent, type Dispatcher } from 'undici';
 /** Media extensions we are willing to cache + proxy. Anything else (HTML,
  *  CSS, JS, fonts) is intentionally left alone so this surface never becomes a
  *  general-purpose open proxy. */
@@ -43,15 +44,25 @@ export interface AssetCacheOptions {
     fetchImpl?: typeof fetch;
     /** Injectable `dns.lookup` for the connection-time SSRF guard (tests). */
     lookupImpl?: DnsLookupCb;
+    /** Host-supplied dispatcher must enforce the same connection-time public-address guard. */
+    dispatcher?: Dispatcher;
 }
 export interface AssetCache {
     get(rawUrl: string): Promise<AssetCacheResult>;
+    /** Closes only the default adapter; an injected dispatcher remains owned by its host. */
+    close?(): Promise<void>;
 }
+/** Default adapter: validate DNS at connection time, so the checked address is the connected one. */
+export declare function createAssetCacheDispatcher(_required: Record<string, never>, { lookupImpl }?: {
+    lookupImpl?: DnsLookupCb;
+}): Agent;
 /** Build a disk-backed cache for external sandboxed-content media. Concurrent
  *  requests for the same URL share one in-flight fetch; completed fetches
  *  persist to `<cacheDir>/<sha256>` (+ `.json` sidecar) and are replayed from
  *  disk. */
-export declare function createAssetCache(opts: AssetCacheOptions): AssetCache;
+export declare function createAssetCache(opts: AssetCacheOptions, options?: {
+    dispatcher?: Dispatcher;
+}): AssetCache;
 /** Exposed for tests that need to assert the on-disk key layout. */
 export declare function assetCacheKey(rawUrl: string): string;
 export {};

package/dist/asset-cache.js

@@ -127,11 +127,15 @@ export function createValidatingLookup(lookupImpl = dnsLookupCb) {
         });
     };
 }
+/** Default adapter: validate DNS at connection time, so the checked address is the connected one. */
+export function createAssetCacheDispatcher(_required, { lookupImpl } = {}) {
+    return new Agent({ connect: { lookup: createValidatingLookup(lookupImpl) } });
+}
 /** Build a disk-backed cache for external sandboxed-content media. Concurrent
  *  requests for the same URL share one in-flight fetch; completed fetches
  *  persist to `<cacheDir>/<sha256>` (+ `.json` sidecar) and are replayed from
  *  disk. */
-export function createAssetCache(opts) {
+export function createAssetCache(opts, options = {}) {
     const cacheDir = opts.cacheDir;
     const maxBytes = opts.maxBytes ?? 64 * 1024 * 1024;
     const timeoutMs = opts.fetchTimeoutMs ?? 15_000;
@@ -139,9 +143,8 @@ export function createAssetCache(opts) {
     // Pin SSRF validation to the actual outbound connection: the Agent resolves
     // the host once, and `validatingLookup` rejects the connection if that exact
     // address is private. No separate pre-validation lookup to rebind around.
-    const dispatcher = new Agent({
-        connect: { lookup: createValidatingLookup(opts.lookupImpl) },
-    });
+    const suppliedDispatcher = options.dispatcher ?? opts.dispatcher;
+    const dispatcher = suppliedDispatcher ?? createAssetCacheDispatcher({}, opts.lookupImpl ? { lookupImpl: opts.lookupImpl } : {});
     const inflight = new Map();
     function keyFor(rawUrl) {
         return createHash('sha256').update(rawUrl).digest('hex');
@@ -279,7 +282,8 @@ export function createAssetCache(opts) {
         inflight.set(key, pending);
         return pending;
     }
-    return { get };
+    return { get, close: async () => { if (!suppliedDispatcher)
+            await dispatcher.close(); } };
 }
 /** Exposed for tests that need to assert the on-disk key layout. */
 export function assetCacheKey(rawUrl) {

package/dist/child-environment.d.ts

@@ -0,0 +1,18 @@
+/** Environment isolation for child processes; hosts name the settings that belong to one run. */
+/**
+ * Copy an environment without host-selected keys. Reports names only, never values; no I/O.
+ * Windows callers opt into case-insensitive matching so duplicate spellings cannot survive.
+ * @returns A fresh environment and the configured names whose defined values were omitted.
+ * @complexity O(e + k) time/space for e environment entries and k configured names.
+ * @example omitEnvironmentKeys({ env: parent, keys: ['WORKSPACE_STORAGE'] });
+ */
+export declare function omitEnvironmentKeys({ env, keys }: {
+    env: Readonly<Record<string, string | undefined>>;
+    keys: readonly string[];
+}, { caseInsensitive }?: {
+    caseInsensitive?: boolean;
+}): {
+    env: Record<string, string | undefined>;
+    omitted: string[];
+};
+//# sourceMappingURL=child-environment.d.ts.map

package/dist/child-environment.js

@@ -0,0 +1,26 @@
+/** Environment isolation for child processes; hosts name the settings that belong to one run. */
+/**
+ * Copy an environment without host-selected keys. Reports names only, never values; no I/O.
+ * Windows callers opt into case-insensitive matching so duplicate spellings cannot survive.
+ * @returns A fresh environment and the configured names whose defined values were omitted.
+ * @complexity O(e + k) time/space for e environment entries and k configured names.
+ * @example omitEnvironmentKeys({ env: parent, keys: ['WORKSPACE_STORAGE'] });
+ */
+export function omitEnvironmentKeys({ env, keys }, { caseInsensitive = false } = {}) {
+    const normalize = (key) => caseInsensitive ? key.toUpperCase() : key;
+    const names = new Map(keys.map((key) => [normalize(key), key]));
+    const child = {};
+    const omitted = new Set();
+    for (const [key, value] of Object.entries(env)) {
+        const name = names.get(normalize(key));
+        if (name !== undefined) {
+            if (value !== undefined)
+                omitted.add(name);
+        }
+        else {
+            child[key] = value;
+        }
+    }
+    return { env: child, omitted: [...omitted] };
+}
+//# sourceMappingURL=child-environment.js.map

package/dist/fs/boot-identity.d.ts

@@ -0,0 +1,10 @@
+export interface BootIdentity {
+    id: string;
+    startedAtMs: number;
+}
+/** Kernel boot identity distinguishes a recycled PID across reboots. Unknown identity fails safe
+ * to the existing liveness probe; no age timeout is used to evict a potentially live owner.
+ * Native calls are bounded and cached once per process. @complexity O(1) bounded OS reads.
+ */
+export declare function readBootIdentity(_required: Record<string, never>, _options?: {}): BootIdentity | undefined;
+//# sourceMappingURL=boot-identity.d.ts.map

package/dist/fs/boot-identity.js

@@ -0,0 +1,34 @@
+import fs from "node:fs";
+import { execFileSync } from "node:child_process";
+let cached;
+/** Kernel boot identity distinguishes a recycled PID across reboots. Unknown identity fails safe
+ * to the existing liveness probe; no age timeout is used to evict a potentially live owner.
+ * Native calls are bounded and cached once per process. @complexity O(1) bounded OS reads.
+ */
+export function readBootIdentity(_required, _options = {}) {
+    if (cached !== undefined)
+        return cached ?? undefined;
+    cached = null;
+    try {
+        let startedAtMs;
+        if (process.platform === "linux") {
+            const id = fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+            startedAtMs = Number(/^btime (\d+)$/m.exec(fs.readFileSync("/proc/stat", "utf8"))?.[1]) * 1000;
+            if (id && Number.isFinite(startedAtMs))
+                cached = { id, startedAtMs };
+        }
+        else {
+            const text = process.platform === "darwin"
+                ? execFileSync("/usr/sbin/sysctl", ["-n", "kern.boottime"], { encoding: "utf8", timeout: 3000 })
+                : process.platform === "win32"
+                    ? execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToUniversalTime().ToString('o')"], { encoding: "utf8", timeout: 3000, windowsHide: true })
+                    : "";
+            startedAtMs = process.platform === "darwin" ? Number(/sec\s*=\s*(\d+)/.exec(text)?.[1]) * 1000 : Date.parse(text.trim());
+            if (Number.isFinite(startedAtMs))
+                cached = { id: String(startedAtMs), startedAtMs };
+        }
+    }
+    catch { /* Permission/OS failure is unknown identity, never proof of death. */ }
+    return cached ?? undefined;
+}
+//# sourceMappingURL=boot-identity.js.map

package/dist/fs/directory-home.d.ts

@@ -0,0 +1,15 @@
+/** Resolve an operator-visible data home without I/O. Environment wins over settings.
+ * Empty overrides are errors; tilde expansion uses the supplied home, never a shell.
+ * @complexity O(n) in the chosen path length.
+ */
+export declare function resolveDirectoryHome({ homeDir, defaultFolder, envName, env, setting }: {
+    homeDir: string;
+    defaultFolder: string;
+    envName: string;
+    env: Record<string, string | undefined>;
+    setting?: string | undefined;
+}, { cwd, platform }?: {
+    cwd?: string;
+    platform?: NodeJS.Platform;
+}): string;
+//# sourceMappingURL=directory-home.d.ts.map

package/dist/fs/directory-home.js

@@ -0,0 +1,17 @@
+import path from "node:path";
+/** Resolve an operator-visible data home without I/O. Environment wins over settings.
+ * Empty overrides are errors; tilde expansion uses the supplied home, never a shell.
+ * @complexity O(n) in the chosen path length.
+ */
+export function resolveDirectoryHome({ homeDir, defaultFolder, envName, env, setting }, { cwd = homeDir, platform = process.platform } = {}) {
+    const paths = platform === "win32" ? path.win32 : path;
+    const selected = env[envName] ?? setting ?? paths.join(homeDir, defaultFolder);
+    if (!selected.trim())
+        throw new Error(`${envName} must name a directory`);
+    if (selected === "~")
+        return paths.resolve(homeDir);
+    if (selected.startsWith("~/") || selected.startsWith("~\\"))
+        return paths.resolve(homeDir, selected.slice(2));
+    return paths.resolve(cwd, selected);
+}
+//# sourceMappingURL=directory-home.js.map

package/dist/fs/directory-registry.d.ts

@@ -0,0 +1,50 @@
+import type { DurableJsonFile } from "./durable-json.js";
+export interface DirectoryRecord {
+    id: string;
+    name: string;
+    path: string;
+    createdBy: string;
+    lastOpened: string | null;
+}
+export interface DirectoryRegistry {
+    hasMigration(required: {
+        migration: string;
+    }, options?: {}): boolean;
+    migrations(required: Record<string, never>, options?: {}): string[];
+    list(required: Record<string, never>, options?: {}): DirectoryRecord[];
+    merge(required: {
+        entries: readonly DirectoryRecord[];
+        migration?: string;
+        migrations?: readonly string[];
+    }, options?: {}): DirectoryRecord[];
+    opened(required: {
+        path: string;
+        at: string;
+    }, options?: {}): void;
+    remove(required: {
+        path: string;
+    }, options?: {}): void;
+    relocate(required: {
+        from: string;
+        to: string;
+    }, options?: {}): void;
+}
+/** Shared catalog: corrupt state fails closed; every update holds one durable file lock.
+ * Canonical paths deduplicate symlink aliases. Identity collisions require explicit relocation.
+ * Optional host admission prunes rejected entries on list under that same lock, then reports once.
+ * @complexity O(n + m) records for merge, O(n) for other mutations, plus file I/O/lock wait.
+ */
+export declare function createDirectoryRegistry({ file, canonicalPath }: {
+    file: DurableJsonFile;
+    canonicalPath: (required: {
+        path: string;
+    }) => string;
+}, { discard, reportDiscarded }?: {
+    discard?: (required: {
+        entry: DirectoryRecord;
+    }) => boolean;
+    reportDiscarded?: (required: {
+        entries: DirectoryRecord[];
+    }) => void;
+}): DirectoryRegistry;
+//# sourceMappingURL=directory-registry.d.ts.map

package/dist/fs/directory-registry.js

@@ -0,0 +1,99 @@
+/** Shared catalog: corrupt state fails closed; every update holds one durable file lock.
+ * Canonical paths deduplicate symlink aliases. Identity collisions require explicit relocation.
+ * Optional host admission prunes rejected entries on list under that same lock, then reports once.
+ * @complexity O(n + m) records for merge, O(n) for other mutations, plus file I/O/lock wait.
+ */
+export function createDirectoryRegistry({ file, canonicalPath }, { discard, reportDiscarded = () => { } } = {}) {
+    function read() {
+        const result = file.read({});
+        if (result.state === "missing")
+            return { version: 1, entries: [], migrations: [] };
+        if (result.state !== "ok")
+            throw new Error("The shared directory registry is unreadable; nothing was overwritten.");
+        const state = result.value;
+        if (state?.version !== 1 || !Array.isArray(state.entries) || !Array.isArray(state.migrations) ||
+            !state.migrations.every((item) => typeof item === "string") || !state.entries.every(validRecord)) {
+            throw new Error("The shared directory registry has an invalid format; nothing was overwritten.");
+        }
+        return state;
+    }
+    const canonical = (value) => canonicalPath({ path: value });
+    const update = (change) => file.withLock({ critical: () => {
+            const previous = read(), next = change(previous);
+            if (JSON.stringify(next) !== JSON.stringify(previous))
+                file.write({ value: next });
+        } });
+    const registry = {
+        hasMigration: ({ migration }, _optional = {}) => read().migrations.includes(migration),
+        migrations: (_required, _optional = {}) => read().migrations,
+        list: (_required, _optional = {}) => {
+            const current = read();
+            if (!discard || !current.entries.some((entry) => discard({ entry })))
+                return current.entries;
+            let entries = current.entries;
+            let removed = [];
+            // Re-read under the same mutation lock; never overwrite a sibling process's new rows.
+            update((state) => {
+                removed = state.entries.filter((entry) => discard({ entry }));
+                const discarded = new Set(removed);
+                entries = state.entries.filter((entry) => !discarded.has(entry));
+                return { ...state, entries };
+            });
+            if (removed.length)
+                reportDiscarded({ entries: removed });
+            return entries;
+        },
+        merge({ entries, migration, migrations = [] }, _optional = {}) {
+            let result = [];
+            update((state) => {
+                if (migration && state.migrations.includes(migration)) {
+                    result = state.entries;
+                    return state;
+                }
+                const byPath = new Map(state.entries.map((entry) => [canonical(entry.path), { ...entry, path: canonical(entry.path) }]));
+                const byId = new Map([...byPath.values()].map((entry) => [entry.id, entry.path]));
+                for (const entry of entries) {
+                    if (!validRecord(entry))
+                        throw new Error("Cannot register an invalid directory record.");
+                    const dir = canonical(entry.path);
+                    const previous = byPath.get(dir);
+                    if (byId.has(entry.id) && byId.get(entry.id) !== dir)
+                        throw new Error(`Directory identity ${entry.id} is already registered at another path.`);
+                    // Reopening a site cannot reset who originally created it or its stable identity.
+                    const lastOpened = [previous?.lastOpened, entry.lastOpened].filter((at) => typeof at === "string").sort((a, b) => Date.parse(a) - Date.parse(b)).at(-1) ?? null;
+                    const next = previous ? { ...previous, name: entry.name, lastOpened } : { ...entry, path: dir };
+                    byPath.set(dir, next);
+                    byId.set(next.id, dir);
+                }
+                result = [...byPath.values()];
+                return { ...state, entries: result, migrations: [...new Set([...state.migrations, ...migrations, ...(migration ? [migration] : [])])] };
+            });
+            return result;
+        },
+        opened({ path, at }, _optional = {}) {
+            if (!Number.isFinite(Date.parse(at)))
+                throw new Error("The last-opened timestamp is invalid.");
+            update((state) => ({ ...state, entries: state.entries.map((entry) => canonical(entry.path) === canonical(path) ? { ...entry, lastOpened: at } : entry) }));
+        },
+        remove({ path }, _optional = {}) {
+            update((state) => ({ ...state, entries: state.entries.filter((entry) => canonical(entry.path) !== canonical(path)) }));
+        },
+        relocate({ from, to }, _optional = {}) {
+            update((state) => {
+                const target = canonical(to), source = canonical(from);
+                if (state.entries.some((entry) => canonical(entry.path) === target && canonical(entry.path) !== source))
+                    throw new Error("Relocation would overwrite a registered directory.");
+                return { ...state, entries: state.entries.map((entry) => canonical(entry.path) === source ? { ...entry, path: target } : entry) };
+            });
+        },
+    };
+    return registry;
+}
+function validRecord(entry) {
+    if (!entry || typeof entry !== "object")
+        return false;
+    const row = entry;
+    return [row.id, row.name, row.path, row.createdBy].every((value) => typeof value === "string" && value.length > 0) &&
+        (row.lastOpened === null || (typeof row.lastOpened === "string" && Number.isFinite(Date.parse(row.lastOpened))));
+}
+//# sourceMappingURL=directory-registry.js.map

package/dist/fs/directory-running-lock.d.ts

@@ -0,0 +1,43 @@
+import type { BootIdentity } from "./boot-identity.js";
+import type { DurableJsonFile } from "./durable-json.js";
+export interface DirectoryRunningRecord {
+    pid: number;
+    port: number;
+    app: string;
+    started: string;
+    token: string;
+    scheme: "http" | "https";
+    bootId?: string;
+}
+export interface DirectoryRunningLock {
+    peek(required: Record<string, never>, options?: {}): DirectoryRunningRecord | null;
+    read(required: Record<string, never>, options?: {}): DirectoryRunningRecord | null;
+    claim(required: {
+        record: DirectoryRunningRecord;
+    }, options?: {}): {
+        acquired: boolean;
+        record: DirectoryRunningRecord;
+    };
+    update(required: {
+        token: string;
+        port: number;
+    }, options?: {}): void;
+    release(required: {
+        token: string;
+    }, options?: {}): void;
+}
+/** A process lease is distinct from the brief file lock protecting its read/modify/write.
+ * Only proven process death permits stale cleanup. Release/update require the unique claim token.
+ * A zero port means boot is in progress and must still prevent a second database owner.
+ * @complexity O(1) bounded JSON I/O and one liveness probe, plus the file lock wait.
+ */
+export declare function createDirectoryRunningLock({ file, isAlive, remove }: {
+    file: DurableJsonFile;
+    isAlive: (required: {
+        pid: number;
+    }) => boolean;
+    remove: () => void;
+}, { bootIdentity }?: {
+    bootIdentity?: () => BootIdentity | undefined;
+}): DirectoryRunningLock;
+//# sourceMappingURL=directory-running-lock.d.ts.map

package/dist/fs/directory-running-lock.js

@@ -0,0 +1,66 @@
+/** A process lease is distinct from the brief file lock protecting its read/modify/write.
+ * Only proven process death permits stale cleanup. Release/update require the unique claim token.
+ * A zero port means boot is in progress and must still prevent a second database owner.
+ * @complexity O(1) bounded JSON I/O and one liveness probe, plus the file lock wait.
+ */
+export function createDirectoryRunningLock({ file, isAlive, remove }, { bootIdentity } = {}) {
+    function readLive(cleanup = true) {
+        const result = file.read({});
+        if (result.state === "missing")
+            return null;
+        if (result.state !== "ok")
+            throw new Error("The running lock is unreadable; refusing to open this directory's database.");
+        const record = result.value;
+        if (!validRunningRecord(record))
+            throw new Error("The running lock is invalid; refusing to open this directory's database.");
+        const boot = bootIdentity?.();
+        const sameBoot = !boot || (record.bootId !== undefined ? record.bootId === boot.id : Date.parse(record.started) >= boot.startedAtMs);
+        if (sameBoot && isAlive({ pid: record.pid }))
+            return record;
+        if (cleanup)
+            remove();
+        return null;
+    }
+    return {
+        peek: (_required, _optional = {}) => readLive(false),
+        read: (_required, _optional = {}) => file.read({}).state === "missing" ? null : file.withLock({ critical: () => readLive() }),
+        claim({ record }, _optional = {}) {
+            if (!validRunningRecord(record))
+                throw new Error("Cannot claim an invalid running lock.");
+            return file.withLock({ critical: () => {
+                    const existing = readLive();
+                    if (existing)
+                        return { acquired: false, record: existing };
+                    const boot = bootIdentity?.();
+                    const claimed = boot ? { ...record, bootId: boot.id } : record;
+                    file.write({ value: claimed });
+                    return { acquired: true, record: claimed };
+                } });
+        },
+        update({ token, port }, _optional = {}) {
+            if (!Number.isInteger(port) || port < 1 || port > 65535)
+                throw new Error("Running port must be between 1 and 65535.");
+            file.withLock({ critical: () => {
+                    const record = readLive();
+                    if (!record || record.token !== token)
+                        throw new Error("Running lock ownership was lost.");
+                    file.write({ value: { ...record, port } });
+                } });
+        },
+        release({ token }, _optional = {}) {
+            if (file.read({}).state === "missing")
+                return;
+            file.withLock({ critical: () => { if (readLive()?.token === token)
+                    remove(); } });
+        },
+    };
+}
+function validRunningRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    return Number.isSafeInteger(record.pid) && record.pid > 0 && Number.isInteger(record.port) && record.port >= 0 && record.port <= 65535 &&
+        typeof record.app === "string" && record.app.length > 0 && typeof record.token === "string" && record.token.length > 0 &&
+        (record.bootId === undefined || typeof record.bootId === "string") && typeof record.started === "string" && Number.isFinite(Date.parse(record.started)) && ["http", "https"].includes(record.scheme);
+}
+//# sourceMappingURL=directory-running-lock.js.map

package/dist/fs/directory-sync.d.ts

@@ -0,0 +1,20 @@
+import { type UserDirectoryOptions } from "./user-data-directories.js";
+export type DirectorySyncProvider = "iCloud" | "OneDrive" | "Dropbox" | "Google Drive";
+/** Detect provider roots, never infer syncing just because a provider is installed. Canonical
+ * containment catches redirected Documents, while marker files cover older client layouts.
+ * Dropbox publishes info.json paths; macOS File Provider mounts identify their provider.
+ * @complexity O(a + p) small account/mount lists and ancestor probes, no recursive site scan.
+ */
+export declare function detectDirectorySync({ dir, homeDir, documents }: {
+    dir: string;
+    homeDir: string;
+    documents: string;
+}, { env, platform, readText, canonicalPath, listDirectories, exists, oneDriveRoots, windowsOneDriveRoots, }?: UserDirectoryOptions & {
+    canonicalPath?: (required: {
+        path: string;
+    }) => string;
+    listDirectories?: (root: string) => string[];
+    exists?: (file: string) => boolean;
+    oneDriveRoots?: readonly string[];
+}): DirectorySyncProvider | null;
+//# sourceMappingURL=directory-sync.d.ts.map

package/dist/fs/directory-sync.js

@@ -0,0 +1,87 @@
+import fs from "node:fs";
+import path from "node:path";
+import { readOptionalText, readWindowsOneDriveRoots } from "./user-data-directories.js";
+/** Detect provider roots, never infer syncing just because a provider is installed. Canonical
+ * containment catches redirected Documents, while marker files cover older client layouts.
+ * Dropbox publishes info.json paths; macOS File Provider mounts identify their provider.
+ * @complexity O(a + p) small account/mount lists and ancestor probes, no recursive site scan.
+ */
+export function detectDirectorySync({ dir, homeDir, documents }, { env = process.env, platform = process.platform, readText = (file) => readOptionalText({ file }), canonicalPath = ({ path: value }) => { try {
+    return fs.realpathSync(value);
+}
+catch {
+    return path.resolve(value);
+} }, listDirectories = (root) => { try {
+    return fs.readdirSync(root);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return [];
+    throw error;
+} }, exists = fs.existsSync, oneDriveRoots = [], windowsOneDriveRoots = () => readWindowsOneDriveRoots({}), } = {}) {
+    const paths = platform === "win32" ? path.win32 : path.posix;
+    const roots = [];
+    const add = (root, provider) => { if (root)
+        roots.push({ root, provider }); };
+    if (platform === "darwin") {
+        const cloud = paths.join(homeDir, "Library", "Mobile Documents", "com~apple~CloudDocs");
+        add(cloud, "iCloud");
+        // Documents need not be a symlink on newer macOS: the cloud Documents entry is evidence
+        // of Desktop & Documents being enabled, rather than merely iCloud Drive being installed.
+        if (exists(paths.join(cloud, "Documents")))
+            add(documents, "iCloud");
+        const mounts = paths.join(homeDir, "Library", "CloudStorage");
+        for (const name of listDirectories(mounts)) {
+            if (name.startsWith("OneDrive-"))
+                add(paths.join(mounts, name), "OneDrive");
+            else if (name.startsWith("GoogleDrive-"))
+                add(paths.join(mounts, name), "Google Drive");
+            else if (name.startsWith("Dropbox"))
+                add(paths.join(mounts, name), "Dropbox");
+        }
+    }
+    for (const root of [env.OneDrive, env.OneDriveConsumer, env.OneDriveCommercial, ...oneDriveRoots])
+        add(root, "OneDrive");
+    if (platform === "win32" && !env.OneDrive && !env.OneDriveConsumer && !env.OneDriveCommercial) {
+        for (const root of windowsOneDriveRoots())
+            add(root, "OneDrive");
+    }
+    const dropboxFiles = platform === "win32" ? [env.APPDATA, env.LOCALAPPDATA].filter((root) => Boolean(root)).map((root) => paths.join(root, "Dropbox", "info.json")) : [paths.join(homeDir, ".dropbox", "info.json")];
+    for (const file of dropboxFiles) {
+        const text = readText(file);
+        if (!text)
+            continue;
+        // Provider-owned metadata can be torn/corrupt; it is optional evidence, never a boot gate.
+        let accounts;
+        try {
+            accounts = JSON.parse(text);
+        }
+        catch {
+            continue;
+        }
+        if (!accounts || typeof accounts !== "object" || Array.isArray(accounts))
+            continue;
+        for (const account of Object.values(accounts))
+            if (typeof account?.path === "string")
+                add(account.path, "Dropbox");
+    }
+    const canonical = (value) => { const resolved = canonicalPath({ path: value }); return platform === "win32" ? resolved.toLowerCase() : resolved; };
+    const target = canonical(dir);
+    for (const { root, provider } of roots) {
+        const resolved = canonical(root);
+        if (target === resolved || target.startsWith(resolved + paths.sep))
+            return provider;
+    }
+    let ancestor = paths.resolve(dir);
+    while (true) {
+        if (exists(paths.join(ancestor, ".dropbox.cache")))
+            return "Dropbox";
+        if (exists(paths.join(ancestor, ".tmp.drivedownload")) || exists(paths.join(ancestor, ".tmp.driveupload")))
+            return "Google Drive";
+        const parent = paths.dirname(ancestor);
+        if (parent === ancestor)
+            return null;
+        ancestor = parent;
+    }
+}
+//# sourceMappingURL=directory-sync.js.map