@narumitw/pi-sync 0.49.14 → 0.50.0

package/dist/chunks/{chunk-APZVBSM6.ts → chunk-C7XY5NF5.ts}

@@ -1,17 +1,24 @@
 // @generated by scripts/build-runtime.mjs; do not edit.
 // @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
+import {
+  backendIdentityCoordinates,
+  normalizeEndpointIdentity,
+  normalizeWebDavIdentityUrl,
+  normalizeWebDavPath,
+  normalizeWebDavUrl,
+  validateWebDavCredentials
+} from "./chunk-6LP3MCR2.ts";
 import {
   normalizeGitBranch,
   normalizeGitDirectory,
   normalizeGitRemote,
-  normalizeGitRemoteIdentity,
-  stateDir
-} from "./chunk-F5QL2GPY.ts";
+  normalizeGitRemoteIdentity
+} from "./chunk-TEN2ZBJV.ts";
 import {
   normalizeSyncInclude
-} from "./chunk-YQ6UW7IF.ts";
+} from "./chunk-JAAKLL6M.ts";
 
-// src/config-file.ts
+// src/settings/config-file.ts
 import { randomUUID } from "node:crypto";
 import {
   mkdir,
@@ -72,6 +79,15 @@ function consumeLocalConfigMigrationNotice() {
   configMigrationNotices.delete(configPath);
   return notice;
 }
+async function readActiveLocalConfigDocumentForRepair() {
+  const canonicalPath = localConfigPath();
+  const legacyPath = legacyLocalConfigPath();
+  return withLocalConfigReadLockIfNeeded(async () => {
+    const filePath = await pathExists(canonicalPath) ? canonicalPath : legacyPath;
+    const snapshot = await readConfigSnapshotIfExists(filePath);
+    return snapshot ? { path: filePath, ...snapshot } : void 0;
+  });
+}
 async function readMigratingLocalConfigDocument(validateForMigration) {
   return withLocalConfigReadLockIfNeeded(async () => {
     const configPath = await prepareLocalConfigPath(validateForMigration);
@@ -482,162 +498,9 @@ function recordConfigMigrationNotice(configPath, notice) {
   if (!configMigrationNotices.has(configPath)) configMigrationNotices.set(configPath, notice);
 }
 
-// src/config.ts
-import { createHash, randomUUID as randomUUID2 } from "node:crypto";
-import fs2 from "node:fs/promises";
-import os from "node:os";
+// src/settings/settings-validation.ts
 import path2 from "node:path";
-import {
-  getAgentDir as getAgentDir2
-} from "@earendil-works/pi-coding-agent";
-
-// src/webdav-config.ts
-var DEFAULT_PATH = "pi-sync";
-function normalizeWebDavIdentityUrl(value) {
-  try {
-    const url = new URL(value.trim());
-    url.username = "";
-    url.password = "";
-    url.search = "";
-    url.hash = "";
-    url.pathname = `${url.pathname.replace(/\/+$/u, "")}/`;
-    return url.toString();
-  } catch {
-    return value.trim();
-  }
-}
-function normalizeWebDavUrl(value) {
-  const normalized = normalizeOptionalString(value);
-  if (!normalized) return void 0;
-  let url;
-  try {
-    url = new URL(normalized);
-  } catch {
-    throw new Error("Invalid pi-sync WebDAV URL.");
-  }
-  if (url.username || url.password || url.search || url.hash) {
-    throw new Error(
-      "Invalid pi-sync WebDAV URL: credentials, query, and fragment are not allowed."
-    );
-  }
-  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "::1";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
-    throw new Error("Invalid pi-sync WebDAV URL: HTTPS is required except for loopback.");
-  }
-  url.pathname = `${url.pathname.replace(/\/+$/u, "")}/`;
-  return url.toString();
-}
-function normalizeWebDavPath(value) {
-  const normalized = trimSlashes(normalizeOptionalString(value) ?? DEFAULT_PATH);
-  if (!normalized || normalized.includes("\\") || hasControlCharacter(normalized) || normalized.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
-    throw new Error("Invalid pi-sync WebDAV path.");
-  }
-  return normalized;
-}
-function validateWebDavNamespace(value) {
-  if (value === "." || value === ".." || value.includes("/") || value.includes("\\") || hasControlCharacter(value)) {
-    throw new Error("Invalid pi-sync WebDAV namespace.");
-  }
-}
-function validateWebDavCredentials(username, password) {
-  if (username.includes(":") || hasControlCharacter(username) || password !== void 0 && hasControlCharacter(password)) {
-    throw new Error("Invalid pi-sync WebDAV credentials.");
-  }
-}
-function normalizeOptionalString(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-function trimSlashes(value) {
-  return value.replace(/^\/+|\/+$/gu, "");
-}
-function hasControlCharacter(value) {
-  return [...value].some((character) => {
-    const code = character.codePointAt(0) ?? 0;
-    return code < 32 || code >= 127 && code <= 159;
-  });
-}
-
-// src/config-errors.ts
-function isMissingConfigError(error) {
-  return error instanceof Error && (error.message.startsWith("Missing pi-sync settings.") || error.message === "No sync setups are configured.");
-}
-
-// src/config.ts
-var STATE_VERSION = 2;
 var DEFAULT_ON_SWITCH = "ask-before-pull";
-function sessionDirFromContext(ctx) {
-  const manager = ctx.sessionManager;
-  if (manager.usesDefaultSessionDir?.call(manager)) return void 0;
-  return typeof manager.getSessionDir === "function" ? manager.getSessionDir.call(manager) : void 0;
-}
-async function loadConfig(setupName) {
-  const settings = await requireSettings();
-  const selectedName = setupName ?? settings.activeSyncSetup;
-  if (!selectedName) throw new Error("No sync setups are configured.");
-  validateConfigName(selectedName, "sync setup");
-  const setup = ownObject(settings.syncSetups, selectedName);
-  if (!setup)
-    throw new Error(`Invalid pi-sync settings: sync setup \u201C${selectedName}\u201D was not found.`);
-  const connectionName = setup.storage.connection;
-  const connection = ownObject(
-    settings.storageConnections,
-    connectionName
-  );
-  if (!connection) {
-    throw new Error(
-      `Invalid pi-sync settings: sync setup \u201C${selectedName}\u201D references missing storage connection \u201C${connectionName}\u201D.`
-    );
-  }
-  return resolveSyncConfig(selectedName, setup, connectionName, connection, settings.onSwitch);
-}
-async function loadPartialConfig(setupName) {
-  const config = await loadConfig(setupName);
-  return {
-    setupName: config.setupName,
-    ...storageReviewFromConfig(config),
-    include: [...config.include],
-    automatic: config.automatic,
-    onSwitch: config.onSwitch
-  };
-}
-function syncSetupStorageReview(setupName, setup, connectionName, connection) {
-  return storageReviewFromConfig(
-    resolveSyncConfig(setupName, setup, connectionName, connection, DEFAULT_ON_SWITCH)
-  );
-}
-function syncSetupReviewIdentity(setupName, setup, connectionName, connection) {
-  return syncConfigReviewIdentity(
-    resolveSyncConfig(setupName, setup, connectionName, connection, DEFAULT_ON_SWITCH)
-  );
-}
-function syncConfigReviewIdentity(config) {
-  return JSON.stringify([
-    config.setupName,
-    config.connectionName,
-    backendIdentityCoordinates(config),
-    config.include,
-    config.automatic
-  ]);
-}
-function syncConfigReviewFingerprint(config) {
-  return createHash("sha256").update(syncConfigReviewIdentity(config)).digest("hex");
-}
-function storageReviewFromConfig(config) {
-  return {
-    connectionName: config.connectionName,
-    storageKind: config.backend.type,
-    storagePath: config.storagePath,
-    ...config.backend.type === "s3" ? { bucket: config.backend.destination.bucket } : config.backend.type === "git" ? { branch: config.backend.destination.branch } : {}
-  };
-}
-async function configuredSyncSetupNames() {
-  const settings = await readLocalConfigObject();
-  return settings ? Object.keys(settings.syncSetups).sort((left, right) => left.localeCompare(right)) : [];
-}
-async function loadOnSwitch() {
-  return (await requireSettings()).onSwitch;
-}
 function normalizeOnSwitch(value) {
   if (value === "ask-before-pull" || value === "pull-after-switch" || value === "switch-only") {
     return value;
@@ -646,75 +509,6 @@ function normalizeOnSwitch(value) {
     'Invalid pi-sync settings: onSwitch must be "ask-before-pull", "pull-after-switch", or "switch-only".'
   );
 }
-function resolveSyncConfig(setupName, setup, connectionName, connection, onSwitch) {
-  const storagePath = normalizeStoragePath(setup.storage.path);
-  const namespace = storagePath.slice(storagePath.lastIndexOf("/") + 1);
-  const include = normalizeSyncInclude(setup.sync.include);
-  const common = {
-    setupName,
-    connectionName,
-    storagePath,
-    snapshotIdentity: namespace,
-    include,
-    automatic: setup.sync.automatic,
-    onSwitch
-  };
-  if (connection.type === "git") {
-    return {
-      ...common,
-      backend: {
-        type: "git",
-        profile: { kind: "git", remote: normalizeGitRemote(connection.remote) },
-        destination: {
-          branch: normalizeGitBranch(setup.storage.branch),
-          directory: normalizeGitDirectory(storagePath),
-          namespace
-        }
-      }
-    };
-  }
-  if (connection.type === "webdav") {
-    return {
-      ...common,
-      backend: {
-        type: "webdav",
-        profile: {
-          kind: "webdav",
-          url: normalizeWebDavUrl(connection.url),
-          username: connection.credentials.username,
-          password: connection.credentials.password
-        },
-        destination: { path: normalizeWebDavPath(storagePath), namespace }
-      }
-    };
-  }
-  return {
-    ...common,
-    backend: {
-      type: "s3",
-      profile: {
-        kind: isCloudflareR2Endpoint(connection.endpoint) ? "r2" : "s3-compatible",
-        endpoint: normalizeS3Endpoint(connection.endpoint),
-        region: requiredString(connection.region, "S3 region"),
-        accessKeyId: connection.credentials.accessKeyId,
-        secretAccessKey: connection.credentials.secretAccessKey,
-        sessionToken: optionalString(connection.credentials.sessionToken, "S3 session token")
-      },
-      destination: {
-        bucket: normalizeS3Bucket(setup.storage.bucket),
-        prefix: storagePath,
-        namespace
-      }
-    }
-  };
-}
-async function requireSettings() {
-  const settings = await readLocalConfigObject();
-  if (!settings) {
-    throw new Error(`Missing pi-sync settings. Use /sync setup or create ${localConfigPath()}.`);
-  }
-  return settings;
-}
 function validateSettingsDocument(value) {
   if (value.version !== 3) {
     throw new Error(
@@ -744,6 +538,9 @@ function validateSettingsDocument(value) {
     "top level"
   );
   normalizeOnSwitch(value.onSwitch);
+  if (value.skipSecretScan !== void 0 && typeof value.skipSecretScan !== "boolean") {
+    throw new Error("Invalid pi-sync settings: skipSecretScan must be boolean.");
+  }
   const storageConnections = requireNamedObjectMap(
     value.storageConnections,
     "storageConnections",
@@ -966,12 +763,12 @@ function requireRecord(value, field) {
   return value;
 }
 function validateConfigName(value, field) {
-  if (!value.trim() || value !== value.trim() || value.length > 100 || value === "__proto__" || value === "prototype" || value === "constructor" || hasControlCharacter2(value)) {
+  if (!value.trim() || value !== value.trim() || value.length > 100 || value === "__proto__" || value === "prototype" || value === "constructor" || hasControlCharacter(value)) {
     throw new Error(`Invalid pi-sync settings: invalid ${field} name.`);
   }
 }
 function requiredString(value, field) {
-  if (typeof value !== "string" || !value.trim() || hasControlCharacter2(value)) {
+  if (typeof value !== "string" || !value.trim() || hasControlCharacter(value)) {
     throw new Error(`Invalid pi-sync settings: ${field} must be a non-empty string.`);
   }
   return value.trim();
@@ -991,21 +788,22 @@ function optionalCanonicalReference(value, field) {
   return normalized;
 }
 function requiredSecret(value, field) {
-  if (typeof value !== "string" || !value || hasControlCharacter2(value)) {
+  if (typeof value !== "string" || !value || hasControlCharacter(value)) {
     throw new Error(`Invalid pi-sync settings: ${field} must be configured.`);
   }
   return value;
 }
 function optionalString(value, field) {
   if (value === void 0) return void 0;
-  if (typeof value !== "string" || hasControlCharacter2(value)) {
+  if (typeof value !== "string" || hasControlCharacter(value)) {
     throw new Error(`Invalid pi-sync settings: ${field} must be a string.`);
   }
   return value.trim() || void 0;
 }
 function normalizeStoragePath(value) {
+  if (value.trim() === "." || value.trim() === "./") return "./";
   const normalized = value.trim().replace(/^\/+|\/+$/gu, "");
-  if (!normalized || normalized.length > 1024 || normalized.startsWith("-") || normalized.includes("\\") || hasControlCharacter2(normalized) || normalized.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+  if (!normalized || normalized.length > 1024 || normalized.startsWith("-") || normalized.includes("\\") || hasControlCharacter(normalized) || normalized.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
     throw new Error("Invalid pi-sync settings: storage.path must be a safe relative path.");
   }
   return normalized;
@@ -1031,98 +829,46 @@ function normalizeS3Bucket(value) {
   }
   return bucket;
 }
-function normalizeEndpointIdentity(endpoint) {
+function hasControlCharacter(value) {
+  return /[\u0000-\u001f\u007f-\u009f]/u.test(value);
+}
+function isCloudflareR2Endpoint(endpoint) {
+  const value = endpoint?.trim();
+  if (!value) return false;
   try {
-    const url = new URL(endpoint.trim());
-    url.hostname = url.hostname.toLowerCase();
-    url.pathname = url.pathname.replace(/\/+$/gu, "");
-    return url.toString().replace(/\/$/u, "");
+    const hostname = new URL(value).hostname.toLowerCase();
+    return hostname === "r2.cloudflarestorage.com" || hostname.endsWith(".r2.cloudflarestorage.com");
   } catch {
-    return endpoint.trim();
+    return false;
   }
 }
-async function configuredSessionDir() {
-  const settings = await readJsonIfExists(
-    path2.join(agentDir(), "settings.json")
-  );
-  return settings?.sessionDir ? expandHome(settings.sessionDir) : void 0;
-}
-async function sessionDirForApply(ctx, snapshot) {
-  const contextSessionDir = sessionDirFromContext(ctx);
-  const localSessionDir = await configuredSessionDir();
-  if (contextSessionDir && path2.resolve(contextSessionDir) !== path2.resolve(localSessionDir ?? "")) {
-    return contextSessionDir;
-  }
-  return sessionDirFromSnapshot(snapshot) ?? contextSessionDir;
+function ownRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function sessionDirFromSnapshot(snapshot) {
-  const settingsFile = snapshot.files.find((file) => file.path === "settings.json");
-  if (!settingsFile) return void 0;
-  try {
-    const settings = JSON.parse(
-      decodeBase64Strict(settingsFile.contentBase64, settingsFile.path).toString("utf8")
+
+// src/settings/settings-store.ts
+var configUpdateQueue = Promise.resolve();
+async function requireSettings() {
+  const settings = await readLocalConfigObject();
+  if (!settings) {
+    throw new Error(
+      `Missing pi-sync settings. Open /sync and choose Set up sync, or create ${localConfigPath()}.`
     );
-    return settings.sessionDir ? expandHome(settings.sessionDir) : void 0;
-  } catch {
-    return void 0;
   }
+  return settings;
 }
-function decodeBase64Strict(value, filePath) {
-  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(value) || value.length % 4 !== 0) {
-    throw new Error(`Invalid base64 content in snapshot file: ${filePath}`);
-  }
-  return Buffer.from(value, "base64");
-}
-async function readStateForConfig(config) {
-  return await readJsonIfExists(statePathForConfig(config)) ?? {
-    version: STATE_VERSION,
-    profile: config.snapshotIdentity,
-    lastFileHashes: {}
-  };
+async function configuredSyncSetupNames() {
+  const settings = await readLocalConfigObject();
+  return settings ? Object.keys(settings.syncSetups).sort((left, right) => left.localeCompare(right)) : [];
 }
-async function writeStateForConfig(config, state) {
-  await writeJson(statePathForConfig(config), state);
-}
-function statePathForConfig(config) {
-  const identity = backendIdentityCoordinates(config);
-  const hash = createHash("sha256").update(identity).digest("hex").slice(0, 16);
-  return path2.join(stateDir(), "setups", `${config.backend.type}-${hash}.state.json`);
-}
-function backendIdentityCoordinates(config) {
-  switch (config.backend.type) {
-    case "s3":
-      return JSON.stringify([
-        "s3",
-        normalizeEndpointIdentity(config.backend.profile.endpoint),
-        config.backend.destination.bucket,
-        config.storagePath
-      ]);
-    case "git":
-      return JSON.stringify([
-        "git",
-        normalizeGitRemoteIdentity(config.backend.profile.remote),
-        config.backend.destination.branch,
-        config.storagePath
-      ]);
-    case "webdav":
-      return JSON.stringify([
-        "webdav",
-        normalizeWebDavIdentityUrl(config.backend.profile.url),
-        config.backend.profile.username,
-        config.storagePath
-      ]);
-  }
-}
-function agentDir() {
-  return getAgentDir2();
-}
-function expandHome(value) {
-  return value === "~" || value.startsWith("~/") ? path2.join(os.homedir(), value.slice(2)) : value;
+async function loadOnSwitch() {
+  return (await requireSettings()).onSwitch;
 }
 function localConfigTemplate() {
   return {
     version: 3,
     onSwitch: DEFAULT_ON_SWITCH,
+    skipSecretScan: false,
     storageConnections: {},
     syncSetups: {}
   };
@@ -1137,7 +883,6 @@ async function readLocalConfigDocument() {
 async function readLocalConfigObject() {
   return (await readLocalConfigDocument())?.parsed;
 }
-var configUpdateQueue = Promise.resolve();
 function updateLocalConfig(update, signal) {
   const operation = configUpdateQueue.then(() => {
     signal?.throwIfAborted();
@@ -1152,27 +897,149 @@ function updateLocalConfig(update, signal) {
 async function performLocalConfigUpdate(update, signal) {
   return updateLocalConfigDocument(localConfigTemplate(), update, validateSettingsDocument, signal);
 }
-function lockPath() {
-  return path2.join(stateDir(), "lock");
+
+// src/settings/config.ts
+import { createHash } from "node:crypto";
+async function loadConfig(setupName) {
+  return configFromSettings(await requireSettings(), setupName);
 }
-async function ensureStateDir() {
-  await fs2.mkdir(stateDir(), { recursive: true });
+async function loadConfigForCheck() {
+  const document = await readActiveLocalConfigDocumentForRepair();
+  if (!document) throw new Error(`Missing pi-sync settings: ${localConfigPath()}`);
+  validateSettingsDocument(document.parsed);
+  return configFromSettings(document.parsed);
 }
-async function readJsonIfExists(filePath) {
-  try {
-    return JSON.parse(await fs2.readFile(filePath, "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
+function configFromSettings(settings, setupName) {
+  const selectedName = setupName ?? settings.activeSyncSetup;
+  if (!selectedName) throw new Error("No sync setups are configured.");
+  validateConfigName(selectedName, "sync setup");
+  const setup = ownObject(settings.syncSetups, selectedName);
+  if (!setup)
+    throw new Error(`Invalid pi-sync settings: sync setup \u201C${selectedName}\u201D was not found.`);
+  const connectionName = setup.storage.connection;
+  const connection = ownObject(
+    settings.storageConnections,
+    connectionName
+  );
+  if (!connection) {
+    throw new Error(
+      `Invalid pi-sync settings: sync setup \u201C${selectedName}\u201D references missing storage connection \u201C${connectionName}\u201D.`
+    );
   }
+  return resolveSyncConfig(
+    selectedName,
+    setup,
+    connectionName,
+    connection,
+    settings.onSwitch,
+    settings.skipSecretScan ?? false
+  );
+}
+async function loadPartialConfig(setupName) {
+  const config = await loadConfig(setupName);
+  return {
+    setupName: config.setupName,
+    ...storageReviewFromConfig(config),
+    include: [...config.include],
+    automatic: config.automatic,
+    onSwitch: config.onSwitch
+  };
+}
+function syncSetupStorageReview(setupName, setup, connectionName, connection) {
+  return storageReviewFromConfig(
+    resolveSyncConfig(setupName, setup, connectionName, connection, DEFAULT_ON_SWITCH, false)
+  );
 }
-async function writeJson(filePath, value) {
-  await fs2.mkdir(path2.dirname(filePath), { recursive: true });
-  const temp = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
-  await fs2.writeFile(temp, `${JSON.stringify(value, null, "	")}
-`, { mode: 384 });
-  if (process.platform !== "win32") await fs2.chmod(temp, 384);
-  await fs2.rename(temp, filePath);
+function syncSetupReviewIdentity(setupName, setup, connectionName, connection) {
+  return syncConfigReviewIdentity(
+    resolveSyncConfig(setupName, setup, connectionName, connection, DEFAULT_ON_SWITCH, false)
+  );
+}
+function syncConfigReviewIdentity(config) {
+  return JSON.stringify([
+    config.setupName,
+    config.connectionName,
+    backendIdentityCoordinates(config),
+    config.include,
+    config.automatic
+  ]);
+}
+function syncConfigReviewFingerprint(config) {
+  return createHash("sha256").update(syncConfigReviewIdentity(config)).digest("hex");
+}
+function syncCheckConfigFingerprint(config) {
+  return createHash("sha256").update(JSON.stringify(config)).digest("hex");
+}
+function storageReviewFromConfig(config) {
+  return {
+    connectionName: config.connectionName,
+    storageKind: config.backend.type,
+    storagePath: config.storagePath,
+    ...config.backend.type === "s3" ? { bucket: config.backend.destination.bucket } : config.backend.type === "git" ? { branch: config.backend.destination.branch } : {}
+  };
+}
+function resolveSyncConfig(setupName, setup, connectionName, connection, onSwitch, skipSecretScan) {
+  const storagePath = normalizeStoragePath(setup.storage.path);
+  const namespace = storagePath === "./" ? "root" : storagePath.slice(storagePath.lastIndexOf("/") + 1);
+  const include = normalizeSyncInclude(setup.sync.include);
+  const common = {
+    setupName,
+    connectionName,
+    storagePath,
+    snapshotIdentity: namespace,
+    include,
+    automatic: setup.sync.automatic,
+    onSwitch,
+    skipSecretScan
+  };
+  if (connection.type === "git") {
+    return {
+      ...common,
+      backend: {
+        type: "git",
+        profile: { kind: "git", remote: normalizeGitRemote(connection.remote) },
+        destination: {
+          branch: normalizeGitBranch(setup.storage.branch),
+          directory: normalizeGitDirectory(storagePath),
+          namespace
+        }
+      }
+    };
+  }
+  if (connection.type === "webdav") {
+    return {
+      ...common,
+      backend: {
+        type: "webdav",
+        profile: {
+          kind: "webdav",
+          url: normalizeWebDavUrl(connection.url),
+          username: connection.credentials.username,
+          password: connection.credentials.password
+        },
+        destination: { path: normalizeWebDavPath(storagePath), namespace }
+      }
+    };
+  }
+  return {
+    ...common,
+    backend: {
+      type: "s3",
+      profile: {
+        kind: isCloudflareR2Endpoint(connection.endpoint) ? "r2" : "s3-compatible",
+        endpoint: normalizeS3Endpoint(connection.endpoint),
+        region: requiredString(connection.region, "S3 region"),
+        accessKeyId: connection.credentials.accessKeyId,
+        secretAccessKey: connection.credentials.secretAccessKey,
+        sessionToken: optionalString(connection.credentials.sessionToken, "S3 session token")
+      },
+      destination: {
+        bucket: normalizeS3Bucket(setup.storage.bucket),
+        prefix: storagePath,
+        namespace
+      }
+    }
+  };
 }
 function sessionTokenWarnings(config) {
   if (!isCloudflareR2Endpoint(config.endpoint) || !config.sessionToken) return [];
@@ -1186,53 +1053,35 @@ function syncSessionsWarnings(config) {
     "sessions: included; Pi session JSONL can contain prompts, tool output, file paths, images, and secrets. Sync sessions only to storage you trust."
   ];
 }
-function isCloudflareR2Endpoint(endpoint) {
-  const value = endpoint?.trim();
-  if (!value) return false;
-  try {
-    const hostname = new URL(value).hostname.toLowerCase();
-    return hostname === "r2.cloudflarestorage.com" || hostname.endsWith(".r2.cloudflarestorage.com");
-  } catch {
-    return false;
-  }
-}
-function hasControlCharacter2(value) {
-  return /[\u0000-\u001f\u007f-\u009f]/u.test(value);
-}
 
 export {
   localConfigPath,
   activeLocalConfigPath,
   consumeLocalConfigMigrationNotice,
   createLocalConfigDocument,
-  normalizeWebDavUrl,
-  normalizeWebDavPath,
-  validateWebDavNamespace,
-  validateWebDavCredentials,
-  isMissingConfigError,
-  loadConfig,
-  loadPartialConfig,
-  syncSetupStorageReview,
-  syncSetupReviewIdentity,
-  syncConfigReviewIdentity,
-  syncConfigReviewFingerprint,
-  configuredSyncSetupNames,
-  loadOnSwitch,
   normalizeOnSwitch,
   effectiveSyncSetupRemoteIdentity,
   validateConfigName,
-  configuredSessionDir,
-  sessionDirForApply,
-  readStateForConfig,
-  writeStateForConfig,
-  agentDir,
+  requiredString,
+  normalizeStoragePath,
+  normalizeS3Endpoint,
+  normalizeS3Bucket,
+  isCloudflareR2Endpoint,
+  ownRecord,
+  configuredSyncSetupNames,
+  loadOnSwitch,
   localConfigTemplate,
   readLocalConfigObject,
   updateLocalConfig,
-  lockPath,
-  ensureStateDir,
+  loadConfig,
+  loadConfigForCheck,
+  loadPartialConfig,
+  syncSetupStorageReview,
+  syncSetupReviewIdentity,
+  syncConfigReviewIdentity,
+  syncConfigReviewFingerprint,
+  syncCheckConfigFingerprint,
   sessionTokenWarnings,
-  syncSessionsWarnings,
-  isCloudflareR2Endpoint
+  syncSessionsWarnings
 };
-//# sourceMappingURL=chunk-APZVBSM6.ts.map
+//# sourceMappingURL=chunk-C7XY5NF5.ts.map