@narumitw/pi-sync 0.25.0 → 0.29.0

package/src/config.ts

@@ -1,19 +1,35 @@
-import type { Dirent } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import type { ExtensionCommandContext, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { isDeniedPath, safeName } from "./paths.js";
+import {
+	type ExtensionCommandContext,
+	type ExtensionContext,
+	getAgentDir,
+} from "@earendil-works/pi-coding-agent";
+import { safeName } from "./paths.js";
+import { DEFAULT_SYNC_FILES, normalizeExtraFiles, normalizeSyncFiles } from "./sync-policy.js";
 import type { PartialConfig, Snapshot, SyncConfig, SyncState } from "./types.js";
 
+export { extraFilePathsByLower, normalizeExtraFiles, normalizeSyncFiles } from "./sync-policy.js";
+
 const VERSION = 1;
 const DEFAULT_PROFILE = "default";
 const DEFAULT_PREFIX = "pi-sync";
 const DEFAULT_REGION = "auto";
-const TOP_LEVEL_FILES = new Set(["settings.json", "keybindings.json", "models.json", "AGENTS.md", "APPEND_SYSTEM.md"]);
-const TOP_LEVEL_FILE_NAMES = new Set([...TOP_LEVEL_FILES].map((name) => name.toLowerCase()));
-const TOP_LEVEL_DIRS = new Set(["skills", "prompts", "themes", "extensions"]);
-const RESERVED_TOP_LEVEL_NAMES = new Set([...TOP_LEVEL_DIRS, "sessions"]);
+
+export const DEPRECATED_PI_SYNC_ENV_NAMES = [
+	"PI_SYNC_ENDPOINT",
+	"PI_SYNC_BUCKET",
+	"PI_SYNC_REGION",
+	"PI_SYNC_ACCESS_KEY_ID",
+	"PI_SYNC_SECRET_ACCESS_KEY",
+	"PI_SYNC_SESSION_TOKEN",
+	"PI_SYNC_PROFILE",
+	"PI_SYNC_PREFIX",
+	"PI_SYNC_AUTO_SYNC",
+	"PI_SYNC_SESSIONS",
+] as const;
 
 function trimSlashes(value: string) {
 	return value.replace(/^\/+|\/+$/g, "");
@@ -40,12 +56,12 @@ function sessionDirFromContext(ctx: ExtensionCommandContext | ExtensionContext)
 		: undefined;
 }
 
-export async function loadConfigInternal(): Promise<SyncConfig> {
-	const partial = await loadPartialConfig();
-	const endpoint = partial.endpoint;
-	const bucket = partial.bucket;
-	const accessKeyId = partial.accessKeyId;
-	const secretAccessKey = partial.secretAccessKey;
+export async function loadConfigInternal(targetName?: string): Promise<SyncConfig> {
+	const partial = await loadPartialConfig(targetName);
+	const endpoint = normalizeConfiguredString(partial.endpoint);
+	const bucket = normalizeConfiguredString(partial.bucket);
+	const accessKeyId = normalizeConfiguredString(partial.accessKeyId);
+	const secretAccessKey = normalizeConfiguredString(partial.secretAccessKey);
 	const missing = [
 		["endpoint", endpoint],
 		["bucket", bucket],
@@ -55,59 +71,267 @@ export async function loadConfigInternal(): Promise<SyncConfig> {
 		.filter(([, value]) => !value)
 		.map(([name]) => name);
 	if (missing.length > 0) {
-		throw new Error(`Missing pi-sync config: ${missing.join(", ")}. Run /pisync init or set PI_SYNC_* environment variables.`);
+		throw new Error(
+			`Missing pi-sync config: ${missing.join(", ")}. Use /sync setup or edit ${localConfigPath()}.`,
+		);
+	}
+	if (!endpoint || !bucket || !accessKeyId || !secretAccessKey) {
+		throw new Error("Missing pi-sync config after validation.");
 	}
 
 	return {
-		endpoint: endpoint!,
-		bucket: bucket!,
-		region: partial.region ?? DEFAULT_REGION,
-		accessKeyId: accessKeyId!,
-		secretAccessKey: secretAccessKey!,
-		sessionToken: partial.sessionToken,
-		profile: partial.profile ?? DEFAULT_PROFILE,
-		prefix: trimSlashes(partial.prefix ?? DEFAULT_PREFIX),
+		endpoint,
+		bucket,
+		region: normalizeOptionalString(partial.region) ?? DEFAULT_REGION,
+		accessKeyId,
+		secretAccessKey,
+		sessionToken: normalizeOptionalString(partial.sessionToken),
+		profile: normalizeOptionalString(partial.profile) ?? DEFAULT_PROFILE,
+		prefix: trimSlashes(normalizeOptionalString(partial.prefix) ?? DEFAULT_PREFIX),
+		target: partial.target ?? DEFAULT_PROFILE,
+		storageProfile: partial.storageProfile ?? DEFAULT_PROFILE,
+		storageKind: partial.storageKind,
+		autoSync: isEnabled(partial.autoSync, true),
+		settingsVersion: partial.settingsVersion ?? 1,
+		syncFiles: normalizeSyncFiles(partial.syncFiles),
 		syncSessions: isExplicitlyEnabled(partial.syncSessions),
 		extraFiles: normalizeExtraFiles(partial.extraFiles),
 	};
 }
 
-export async function loadConfig(): Promise<SyncConfig> {
-	return loadConfigInternal();
+export async function loadConfig(targetName?: string): Promise<SyncConfig> {
+	return loadConfigInternal(targetName);
+}
+
+export async function configuredTargetNames() {
+	const settings = await readLocalConfigObject();
+	if (!settings) return [];
+	if (!isV2SettingsObject(settings)) return [];
+	return Object.keys(requireNamedObjectMap(settings.targets, "targets")).sort((left, right) =>
+		left.localeCompare(right),
+	);
+}
+
+export async function loadPartialConfig(targetName?: string): Promise<PartialConfig> {
+	const fileConfig = (await readLocalConfigObject()) ?? {};
+	if (isV2SettingsObject(fileConfig)) return resolveV2PartialConfig(fileConfig, targetName);
+	if (targetName !== undefined) {
+		throw new Error("--target requires version 2 pi-sync settings with named targets.");
+	}
+	return resolveLegacyPartialConfig(fileConfig as PartialConfig);
+}
+
+export function deprecatedPiSyncEnvironmentNames() {
+	return DEPRECATED_PI_SYNC_ENV_NAMES.filter((name) => hasEnv(name));
+}
+
+export function deprecatedPiSyncEnvironmentWarnings() {
+	const names = deprecatedPiSyncEnvironmentNames();
+	if (names.length === 0) return [];
+	return [
+		`deprecated environment: ${names.join(", ")} still override pi-sync settings but will be removed in a future major version. Move them to ${localConfigPath()}; values are not shown.`,
+	];
 }
 
-export async function loadPartialConfig(): Promise<PartialConfig> {
-	const fileConfig = (await readJsonIfExists<PartialConfig>(localConfigPath())) ?? {};
+function resolveLegacyPartialConfig(fileConfig: PartialConfig): PartialConfig {
 	return {
 		...fileConfig,
+		target: DEFAULT_PROFILE,
+		storageProfile: DEFAULT_PROFILE,
+		settingsVersion: 1,
 		endpoint: process.env.PI_SYNC_ENDPOINT ?? process.env.R2_ENDPOINT ?? fileConfig.endpoint,
 		bucket: process.env.PI_SYNC_BUCKET ?? process.env.R2_BUCKET ?? fileConfig.bucket,
 		region: process.env.PI_SYNC_REGION ?? process.env.AWS_REGION ?? fileConfig.region,
-		accessKeyId: process.env.PI_SYNC_ACCESS_KEY_ID ?? process.env.AWS_ACCESS_KEY_ID ?? fileConfig.accessKeyId,
-		secretAccessKey: process.env.PI_SYNC_SECRET_ACCESS_KEY ?? process.env.AWS_SECRET_ACCESS_KEY ?? fileConfig.secretAccessKey,
+		accessKeyId:
+			process.env.PI_SYNC_ACCESS_KEY_ID ?? process.env.AWS_ACCESS_KEY_ID ?? fileConfig.accessKeyId,
+		secretAccessKey:
+			process.env.PI_SYNC_SECRET_ACCESS_KEY ??
+			process.env.AWS_SECRET_ACCESS_KEY ??
+			fileConfig.secretAccessKey,
 		sessionToken: selectSessionToken(fileConfig.sessionToken),
 		profile: process.env.PI_SYNC_PROFILE ?? fileConfig.profile,
 		prefix: process.env.PI_SYNC_PREFIX ?? fileConfig.prefix,
 		autoSync: process.env.PI_SYNC_AUTO_SYNC ?? fileConfig.autoSync,
 		syncSessions: process.env.PI_SYNC_SESSIONS ?? fileConfig.syncSessions,
-		extraFiles: fileConfig.extraFiles,
 	};
 }
 
+function resolveV2PartialConfig(
+	settings: Record<string, unknown>,
+	targetName?: string,
+): PartialConfig {
+	const targets = requireNamedObjectMap(settings.targets, "targets");
+	const profiles = requireNamedObjectMap(settings.profiles, "profiles");
+	validateUniqueRemoteTargets(targets);
+	const selectedTarget =
+		targetName ?? normalizeOptionalString(asOptionalString(settings.activeTarget));
+	if (!selectedTarget) throw new Error("Invalid pi-sync settings: activeTarget is required.");
+	validateConfigName(selectedTarget, "target");
+	const target = ownObject(targets, selectedTarget);
+	if (!target)
+		throw new Error(`Invalid pi-sync settings: target "${selectedTarget}" was not found.`);
+	const storageProfile = normalizeOptionalString(asOptionalString(target.profile));
+	if (!storageProfile) {
+		throw new Error(`Invalid pi-sync settings: target "${selectedTarget}" is missing profile.`);
+	}
+	validateConfigName(storageProfile, "storage profile");
+	const profile = ownObject(profiles, storageProfile);
+	if (!profile) {
+		throw new Error(
+			`Invalid pi-sync settings: target "${selectedTarget}" references missing profile "${storageProfile}".`,
+		);
+	}
+	const kind = asOptionalString(profile.kind);
+	if (kind !== undefined && kind !== "r2" && kind !== "s3-compatible") {
+		throw new Error(
+			`Invalid pi-sync settings: profile "${storageProfile}" has unsupported kind "${kind}".`,
+		);
+	}
+	return {
+		target: selectedTarget,
+		storageProfile,
+		storageKind: kind,
+		settingsVersion: 2,
+		endpoint:
+			process.env.PI_SYNC_ENDPOINT ?? process.env.R2_ENDPOINT ?? asOptionalString(profile.endpoint),
+		bucket: process.env.PI_SYNC_BUCKET ?? process.env.R2_BUCKET ?? asOptionalString(target.bucket),
+		region:
+			process.env.PI_SYNC_REGION ?? process.env.AWS_REGION ?? asOptionalString(profile.region),
+		accessKeyId:
+			process.env.PI_SYNC_ACCESS_KEY_ID ??
+			process.env.AWS_ACCESS_KEY_ID ??
+			asOptionalString(profile.accessKeyId),
+		secretAccessKey:
+			process.env.PI_SYNC_SECRET_ACCESS_KEY ??
+			process.env.AWS_SECRET_ACCESS_KEY ??
+			asOptionalString(profile.secretAccessKey),
+		sessionToken: selectSessionToken(asOptionalString(profile.sessionToken)),
+		profile: process.env.PI_SYNC_PROFILE ?? asOptionalString(target.namespace) ?? selectedTarget,
+		prefix: process.env.PI_SYNC_PREFIX ?? asOptionalString(target.prefix),
+		autoSync: process.env.PI_SYNC_AUTO_SYNC ?? asOptionalBoolean(target.autoSync),
+		syncFiles: target.syncFiles,
+		syncSessions: process.env.PI_SYNC_SESSIONS ?? asOptionalBoolean(target.syncSessions),
+		extraFiles: target.extraFiles,
+	};
+}
+
+function isV2SettingsObject(value: Record<string, unknown>) {
+	const hasV2Fields =
+		Object.hasOwn(value, "profiles") ||
+		Object.hasOwn(value, "targets") ||
+		Object.hasOwn(value, "activeTarget");
+	if (!hasV2Fields) return false;
+	if (value.version !== 2) {
+		throw new Error("Invalid pi-sync settings: version must be 2 for profiles and targets.");
+	}
+	return true;
+}
+
+function validateUniqueRemoteTargets(targets: Record<string, unknown>) {
+	const identities = new Map<string, string>();
+	for (const name of Object.keys(targets)) {
+		const target = ownObject(targets, name);
+		if (!target || typeof target.profile !== "string" || typeof target.bucket !== "string")
+			continue;
+		const identity = effectiveTargetRemoteIdentity(target, name);
+		const existing = identities.get(identity);
+		if (existing) {
+			throw new Error(
+				`Invalid pi-sync settings: targets "${existing}" and "${name}" use the same remote destination.`,
+			);
+		}
+		identities.set(identity, name);
+	}
+}
+
+export function effectiveTargetRemoteIdentity(target: Record<string, unknown>, name: string) {
+	const profile = typeof target.profile === "string" ? target.profile.trim() : "";
+	const bucket = normalizeRemoteKeySegment(
+		process.env.PI_SYNC_BUCKET ??
+			process.env.R2_BUCKET ??
+			(typeof target.bucket === "string" ? target.bucket : ""),
+	);
+	const prefix = normalizeRemoteKeySegment(
+		process.env.PI_SYNC_PREFIX ??
+			(typeof target.prefix === "string" ? target.prefix : DEFAULT_PREFIX),
+	);
+	const namespace = normalizeRemoteKeySegment(
+		process.env.PI_SYNC_PROFILE ?? (typeof target.namespace === "string" ? target.namespace : name),
+	);
+	return JSON.stringify([profile, bucket, prefix, namespace]);
+}
+
+function normalizeRemoteKeySegment(value: string) {
+	return trimSlashes(value.trim());
+}
+
+function requireNamedObjectMap(value: unknown, field: string): Record<string, unknown> {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error(`Invalid pi-sync settings: ${field} must be an object.`);
+	}
+	for (const name of Object.keys(value)) validateConfigName(name, field.slice(0, -1));
+	return value as Record<string, unknown>;
+}
+
+function ownObject(
+	value: Record<string, unknown>,
+	key: string,
+): Record<string, unknown> | undefined {
+	if (!Object.hasOwn(value, key)) return undefined;
+	const item = value[key];
+	return item && typeof item === "object" && !Array.isArray(item)
+		? (item as Record<string, unknown>)
+		: undefined;
+}
+
+function validateConfigName(value: string, field: string) {
+	if (
+		!value.trim() ||
+		value.length > 100 ||
+		value === "__proto__" ||
+		value === "prototype" ||
+		value === "constructor" ||
+		// biome-ignore lint/suspicious/noControlCharactersInRegex: Config identifiers cannot render terminal controls.
+		/[\u0000-\u001f\u007f-\u009f]/u.test(value)
+	) {
+		throw new Error(`Invalid pi-sync settings: invalid ${field} name.`);
+	}
+}
+
+function asOptionalString(value: unknown) {
+	if (value === undefined) return undefined;
+	if (typeof value !== "string") throw new Error("Invalid pi-sync settings: expected a string.");
+	return value;
+}
+
+function asOptionalBoolean(value: unknown) {
+	if (value === undefined) return undefined;
+	if (typeof value !== "boolean") throw new Error("Invalid pi-sync settings: expected a boolean.");
+	return value;
+}
+
 export async function configuredSessionDir() {
 	const envSessionDir = normalizeOptionalString(process.env.PI_CODING_AGENT_SESSION_DIR);
 	if (envSessionDir) return expandHome(envSessionDir);
-	const settings = await readJsonIfExists<{ sessionDir?: string }>(path.join(agentDir(), "settings.json"));
+	const settings = await readJsonIfExists<{ sessionDir?: string }>(
+		path.join(agentDir(), "settings.json"),
+	);
 	return settings?.sessionDir ? expandHome(settings.sessionDir) : undefined;
 }
 
-export async function sessionDirForApply(ctx: ExtensionCommandContext | ExtensionContext, snapshot: Snapshot) {
+export async function sessionDirForApply(
+	ctx: ExtensionCommandContext | ExtensionContext,
+	snapshot: Snapshot,
+) {
 	const contextSessionDir = sessionDirFromContext(ctx);
 	const envSessionDir = normalizeOptionalString(process.env.PI_CODING_AGENT_SESSION_DIR);
 	if (envSessionDir) return contextSessionDir ?? expandHome(envSessionDir);
 
 	const localSessionDir = await configuredSessionDir();
-	if (contextSessionDir && path.resolve(contextSessionDir) !== path.resolve(localSessionDir ?? "")) {
+	if (
+		contextSessionDir &&
+		path.resolve(contextSessionDir) !== path.resolve(localSessionDir ?? "")
+	) {
 		return contextSessionDir;
 	}
 	return sessionDirFromSnapshot(snapshot) ?? contextSessionDir;
@@ -140,15 +364,34 @@ export async function writeState(profile: string, state: SyncState) {
 	await writeJson(statePath(profile), state);
 }
 
+export async function readStateForConfig(config: SyncConfig): Promise<SyncState> {
+	if (config.settingsVersion !== 2) return readState(config.profile);
+	return (
+		(await readJsonIfExists<SyncState>(statePathForConfig(config))) ?? {
+			version: VERSION,
+			profile: config.profile,
+			lastFileHashes: {},
+		}
+	);
+}
+
+export async function writeStateForConfig(config: SyncConfig, state: SyncState) {
+	await writeJson(statePathForConfig(config), state);
+}
+
+export function statePathForConfig(config: SyncConfig) {
+	if (config.settingsVersion !== 2) return statePath(config.profile);
+	const target = config.target ?? DEFAULT_PROFILE;
+	const hash = createHash("sha256").update(target).digest("hex").slice(0, 10);
+	return path.join(stateDir(), "targets", `${safeName(target)}-${hash}.state.json`);
+}
+
 export function agentDir() {
-	const configured = normalizeOptionalString(process.env.PI_CODING_AGENT_DIR);
-	return configured ? expandHome(configured) : path.join(os.homedir(), ".pi", "agent");
+	return getAgentDir();
 }
 
 function expandHome(value: string) {
-	return value === "~" || value.startsWith("~/")
-		? path.join(os.homedir(), value.slice(2))
-		: value;
+	return value === "~" || value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
 }
 
 export function stateDir() {
@@ -159,6 +402,106 @@ export function localConfigPath() {
 	return path.join(agentDir(), "pi-sync.local.json");
 }
 
+export function localConfigTemplate(): Record<string, unknown> {
+	return {
+		version: 2,
+		activeTarget: DEFAULT_PROFILE,
+		profiles: {
+			[DEFAULT_PROFILE]: {
+				kind: "r2",
+				endpoint: "https://<account-id>.r2.cloudflarestorage.com",
+				region: DEFAULT_REGION,
+				accessKeyId: "<access-key-id>",
+				secretAccessKey: "<secret-access-key>",
+			},
+		},
+		targets: {
+			[DEFAULT_PROFILE]: {
+				profile: DEFAULT_PROFILE,
+				bucket: "pi-sync",
+				namespace: DEFAULT_PROFILE,
+				prefix: DEFAULT_PREFIX,
+				autoSync: true,
+				syncFiles: [...DEFAULT_SYNC_FILES],
+				syncSessions: false,
+				extraFiles: [],
+			},
+		},
+	};
+}
+
+export async function readLocalConfigObject(): Promise<Record<string, unknown> | undefined> {
+	const configPath = localConfigPath();
+	try {
+		const stat = await fs.lstat(configPath);
+		if (stat.isSymbolicLink())
+			throw new Error(`Refusing to read symlinked pi-sync config: ${configPath}`);
+		if (!stat.isFile()) throw new Error(`pi-sync config is not a regular file: ${configPath}`);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		throw error;
+	}
+	const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as unknown;
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+		throw new Error(`pi-sync config must contain a JSON object: ${configPath}`);
+	}
+	return parsed as Record<string, unknown>;
+}
+
+let configUpdateQueue: Promise<void> = Promise.resolve();
+
+export function updateLocalConfig(
+	update: (current: Record<string, unknown>) => Record<string, unknown>,
+) {
+	const operation = configUpdateQueue.then(() => performLocalConfigUpdate(update));
+	configUpdateQueue = operation.then(
+		() => undefined,
+		() => undefined,
+	);
+	return operation;
+}
+
+async function performLocalConfigUpdate(
+	update: (current: Record<string, unknown>) => Record<string, unknown>,
+) {
+	const current = (await readLocalConfigObject()) ?? localConfigTemplate();
+	const next = update({ ...current });
+	await writeLocalConfigObject(next);
+	return next;
+}
+
+export async function writeLocalConfigObject(value: Record<string, unknown>) {
+	const configPath = localConfigPath();
+	await fs.mkdir(path.dirname(configPath), { recursive: true });
+	try {
+		const stat = await fs.lstat(configPath);
+		if (stat.isSymbolicLink())
+			throw new Error(`Refusing to overwrite symlinked pi-sync config: ${configPath}`);
+		if (!stat.isFile()) throw new Error(`pi-sync config is not a regular file: ${configPath}`);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	}
+
+	const temporaryPath = path.join(
+		path.dirname(configPath),
+		`.${path.basename(configPath)}.${process.pid}.${randomUUID()}.tmp`,
+	);
+	let handle: fs.FileHandle | undefined;
+	try {
+		handle = await fs.open(temporaryPath, "wx", 0o600);
+		await handle.writeFile(`${JSON.stringify(value, null, "\t")}\n`, "utf8");
+		if (process.platform !== "win32") await handle.chmod(0o600);
+		await handle.sync();
+		await handle.close();
+		handle = undefined;
+		await fs.rename(temporaryPath, configPath);
+	} catch (error) {
+		await handle?.close().catch(() => undefined);
+		await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+		throw error;
+	}
+}
+
 function statePath(profile: string) {
 	return path.join(stateDir(), `${safeName(profile)}.state.json`);
 }
@@ -186,8 +529,12 @@ export async function writeJson(filePath: string, value: unknown) {
 }
 
 function selectSessionToken(fileSessionToken: string | undefined) {
-	if (hasEnv("PI_SYNC_SESSION_TOKEN")) return normalizeOptionalString(process.env.PI_SYNC_SESSION_TOKEN);
-	return normalizeOptionalString(process.env.AWS_SESSION_TOKEN) ?? normalizeOptionalString(fileSessionToken);
+	if (hasEnv("PI_SYNC_SESSION_TOKEN"))
+		return normalizeOptionalString(process.env.PI_SYNC_SESSION_TOKEN);
+	return (
+		normalizeOptionalString(process.env.AWS_SESSION_TOKEN) ??
+		normalizeOptionalString(fileSessionToken)
+	);
 }
 
 export function sessionTokenWarnings(config: { endpoint?: string; sessionToken?: string }) {
@@ -204,19 +551,14 @@ export function syncSessionsWarnings(config: { syncSessions?: boolean }) {
 	];
 }
 
-function isSecurityTokenInvalidArgument(text: string) {
-	return (
-		text.includes("<Code>InvalidArgument</Code>") &&
-		text.includes("<Message>X-Amz-Security-Token</Message>")
-	);
-}
-
 export function isCloudflareR2Endpoint(endpoint: string | undefined) {
 	const value = endpoint?.trim();
 	if (!value) return false;
 	try {
 		const hostname = new URL(value).hostname.toLowerCase();
-		return hostname === "r2.cloudflarestorage.com" || hostname.endsWith(".r2.cloudflarestorage.com");
+		return (
+			hostname === "r2.cloudflarestorage.com" || hostname.endsWith(".r2.cloudflarestorage.com")
+		);
 	} catch {
 		return false;
 	}
@@ -227,47 +569,15 @@ function normalizeOptionalString(value: string | undefined) {
 	return normalized ? normalized : undefined;
 }
 
-export function normalizeExtraFiles(value: unknown) {
-	if (!Array.isArray(value)) return [];
-	const seen = new Set<string>();
-	return value
-		.filter((item): item is string => typeof item === "string")
-		.map((item) => item.trim())
-		.filter((item) => {
-			const lower = item.toLowerCase();
-			if (
-				item === "" ||
-				item === "." ||
-				item === ".." ||
-				item.includes("/") ||
-				item.includes("\\") ||
-				TOP_LEVEL_FILE_NAMES.has(lower) ||
-				isDeniedPath(item) ||
-				RESERVED_TOP_LEVEL_NAMES.has(lower) ||
-				seen.has(lower)
-			) {
-				return false;
-			}
-			seen.add(lower);
-			return true;
-		});
-}
-
-export function extraFilePathsByLower(value: unknown) {
-	return new Map(normalizeExtraFiles(value).map((fileName) => [fileName.toLowerCase(), fileName]));
-}
-
-function selectTopLevelFileEntry(entries: Dirent[], fileName: string) {
-	const exact = entries.find((entry) => entry.isFile() && entry.name === fileName);
-	if (exact) return exact;
-	const lower = fileName.toLowerCase();
-	return entries
-		.filter((entry) => entry.isFile() && entry.name.toLowerCase() === lower)
-		.sort((left, right) => left.name.localeCompare(right.name))[0];
+function normalizeConfiguredString(value: string | undefined) {
+	const normalized = normalizeOptionalString(value);
+	return normalized && !/^<[^>]+>$/u.test(normalized) && !normalized.includes("<account-id>")
+		? normalized
+		: undefined;
 }
 
 function hasEnv(name: string) {
-	return Object.prototype.hasOwnProperty.call(process.env, name);
+	return Object.hasOwn(process.env, name);
 }
 
 export function isEnabled(value: boolean | string | undefined, defaultValue: boolean) {
@@ -284,7 +594,3 @@ export function isExplicitlyEnabled(value: boolean | string | undefined) {
 export function isMissingConfigError(error: unknown) {
 	return error instanceof Error && error.message.startsWith("Missing pi-sync config:");
 }
-
-function errorMessage(error: unknown) {
-	return error instanceof Error ? error.message : String(error);
-}