@narumitw/pi-sync 0.57.9 → 0.57.10

package/dist/chunks/chunk-RX3WGWVL.ts.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/settings/config.ts", "../../src/settings/config-file.ts", "../../src/settings/settings-validation.ts", "../../src/settings/settings-store.ts"],
+  "sourcesContent": ["import { createHash } from \"node:crypto\";\nimport { backendIdentityCoordinates } from \"../backends/backend-identity.js\";\nimport { normalizeGitBranch, normalizeGitDirectory, normalizeGitRemote } from \"../backends/git/git-config.js\";\nimport { normalizeWebDavPath, normalizeWebDavUrl } from \"../backends/webdav/webdav-config.js\";\nimport { normalizeLocalFields } from \"../sync/local-field-policy.js\";\nimport { normalizeSyncInclude } from \"../sync/sync-policy.js\";\nimport { localConfigPath, readActiveLocalConfigDocumentForRepair } from \"./config-file.js\";\nimport { requireSettings } from \"./settings-store.js\";\nimport type {\n  AnySyncConfig,\n  OnSwitchAction,\n  PartialConfig,\n  PiSyncSettingsV3,\n  StorageConnectionSettings,\n  SyncSetupSettings,\n} from \"./settings-types.js\";\nimport {\n  DEFAULT_ON_SWITCH,\n  isCloudflareR2Endpoint,\n  normalizeS3Bucket,\n  normalizeS3Endpoint,\n  normalizeStoragePath,\n  optionalString,\n  ownObject,\n  requiredString,\n  validateConfigName,\n  validateSettingsDocument,\n} from \"./settings-validation.js\";\n\nexport async function loadConfig(setupName?: string): Promise<AnySyncConfig> {\n  return configFromSettings(await requireSettings(), setupName);\n}\n\n/** A background freshness read must never trigger legacy-file publication. */\nexport async function loadConfigForCheck(): Promise<AnySyncConfig> {\n  const document = await readActiveLocalConfigDocumentForRepair();\n  if (!document) throw new Error(`Missing pi-sync settings: ${localConfigPath()}`);\n  validateSettingsDocument(document.parsed);\n  return configFromSettings(document.parsed as PiSyncSettingsV3);\n}\n\nfunction configFromSettings(settings: PiSyncSettingsV3, setupName?: string): AnySyncConfig {\n  const selectedName = setupName ?? settings.activeSyncSetup;\n  if (!selectedName) throw new Error(\"No sync setups are configured.\");\n  validateConfigName(selectedName, \"sync setup\");\n  const setup = ownObject<SyncSetupSettings>(settings.syncSetups, selectedName);\n  if (!setup) throw new Error(`Invalid pi-sync settings: sync setup \u201C${selectedName}\u201D was not found.`);\n  const connectionName = setup.storage.connection;\n  const connection = ownObject<StorageConnectionSettings>(settings.storageConnections, connectionName);\n  if (!connection) {\n    throw new Error(\n      `Invalid pi-sync settings: sync setup \u201C${selectedName}\u201D references missing storage connection \u201C${connectionName}\u201D.`,\n    );\n  }\n  return {\n    ...resolveSyncConfig(\n      selectedName,\n      setup,\n      connectionName,\n      connection,\n      settings.onSwitch,\n      settings.skipSecretScan ?? false,\n      settings.showStatus ?? true,\n    ),\n    debug: settings.debug ?? false,\n  };\n}\n\nexport type SyncSetupStorageReview = Pick<\n  PartialConfig,\n  \"connectionName\" | \"storageKind\" | \"storagePath\" | \"bucket\" | \"branch\"\n>;\n\n/** A validated setup-facing projection used by manager and settings UI. */\nexport async function loadPartialConfig(setupName?: string): Promise<PartialConfig> {\n  const config = await loadConfig(setupName);\n  return {\n    setupName: config.setupName,\n    ...storageReviewFromConfig(config),\n    include: [...config.include],\n    automatic: config.automatic,\n    automaticTransfer: config.automaticTransfer ?? false,\n    agentMode: config.agentMode ?? false,\n    continuous: config.continuous ?? false,\n    onSwitch: config.onSwitch,\n    showStatus: config.showStatus,\n  };\n}\n\nexport function syncSetupStorageReview(\n  setupName: string,\n  setup: SyncSetupSettings,\n  connectionName: string,\n  connection: StorageConnectionSettings,\n): SyncSetupStorageReview {\n  return storageReviewFromConfig(\n    resolveSyncConfig(setupName, setup, connectionName, connection, DEFAULT_ON_SWITCH, false, true),\n  );\n}\n\nexport function syncSetupReviewIdentity(\n  setupName: string,\n  setup: SyncSetupSettings,\n  connectionName: string,\n  connection: StorageConnectionSettings,\n) {\n  return syncConfigReviewIdentity(\n    resolveSyncConfig(setupName, setup, connectionName, connection, DEFAULT_ON_SWITCH, false, true),\n  );\n}\n\nexport function syncConfigReviewIdentity(config: AnySyncConfig) {\n  return JSON.stringify([\n    config.setupName,\n    config.connectionName,\n    backendIdentityCoordinates(config),\n    config.include,\n    config.automatic,\n    config.automaticTransfer ?? false,\n    config.agentMode ?? false,\n    config.localFields,\n    config.mergeSettings ?? false,\n    config.mergeContent ?? false,\n    config.partialSync ?? false,\n    // Preserve existing Off identities and cached candidates across the upgrade.\n    ...(config.continuous ? [\"continuous\"] : []),\n  ]);\n}\n\nexport function syncConfigReviewFingerprint(config: AnySyncConfig) {\n  return createHash(\"sha256\").update(syncConfigReviewIdentity(config)).digest(\"hex\");\n}\n\n/** Internal freshness token, including credentials; never display or persist it. */\nexport function syncCheckConfigFingerprint(config: AnySyncConfig) {\n  return createHash(\"sha256\")\n    .update(JSON.stringify({ ...config, showStatus: undefined, debug: undefined }))\n    .digest(\"hex\");\n}\n\nfunction storageReviewFromConfig(config: AnySyncConfig): SyncSetupStorageReview {\n  return {\n    connectionName: config.connectionName,\n    storageKind: config.backend.type,\n    storagePath: config.storagePath,\n    ...(config.backend.type === \"s3\"\n      ? { bucket: config.backend.destination.bucket }\n      : config.backend.type === \"git\"\n        ? { branch: config.backend.destination.branch }\n        : {}),\n  };\n}\n\nfunction resolveSyncConfig(\n  setupName: string,\n  setup: SyncSetupSettings,\n  connectionName: string,\n  connection: StorageConnectionSettings,\n  onSwitch: OnSwitchAction,\n  skipSecretScan: boolean,\n  showStatus: boolean,\n): AnySyncConfig {\n  const storagePath = normalizeStoragePath(setup.storage.path);\n  const namespace = storagePath === \"./\" ? \"root\" : storagePath.slice(storagePath.lastIndexOf(\"/\") + 1);\n  const include = normalizeSyncInclude(setup.sync.include);\n  const common = {\n    setupName,\n    connectionName,\n    storagePath,\n    snapshotIdentity: namespace,\n    include,\n    automatic: setup.sync.automatic,\n    automaticTransfer: setup.sync.automaticTransfer ?? false,\n    agentMode: setup.sync.agentMode ?? false,\n    continuous: setup.sync.continuous ?? false,\n    localFields: setup.sync.localFields === undefined ? undefined : normalizeLocalFields(setup.sync.localFields),\n    mergeSettings: setup.sync.mergeSettings ?? false,\n    mergeContent: setup.sync.mergeContent ?? false,\n    partialSync: setup.sync.partialSync ?? false,\n    onSwitch,\n    skipSecretScan,\n    showStatus,\n  };\n  if (connection.type === \"git\") {\n    return {\n      ...common,\n      backend: {\n        type: \"git\",\n        profile: { kind: \"git\", remote: normalizeGitRemote(connection.remote) as string },\n        destination: {\n          branch: normalizeGitBranch(setup.storage.branch),\n          directory: normalizeGitDirectory(storagePath),\n          namespace,\n        },\n      },\n    };\n  }\n  if (connection.type === \"webdav\") {\n    return {\n      ...common,\n      backend: {\n        type: \"webdav\",\n        profile: {\n          kind: \"webdav\",\n          url: normalizeWebDavUrl(connection.url) as string,\n          username: connection.credentials.username,\n          password: connection.credentials.password,\n        },\n        destination: { path: normalizeWebDavPath(storagePath), namespace },\n      },\n    };\n  }\n  return {\n    ...common,\n    backend: {\n      type: \"s3\",\n      profile: {\n        kind: isCloudflareR2Endpoint(connection.endpoint) ? \"r2\" : \"s3-compatible\",\n        endpoint: normalizeS3Endpoint(connection.endpoint),\n        region: requiredString(connection.region, \"S3 region\"),\n        accessKeyId: connection.credentials.accessKeyId,\n        secretAccessKey: connection.credentials.secretAccessKey,\n        sessionToken: optionalString(connection.credentials.sessionToken, \"S3 session token\"),\n      },\n      destination: {\n        bucket: normalizeS3Bucket(setup.storage.bucket),\n        prefix: storagePath,\n        namespace,\n      },\n    },\n  };\n}\n\nexport function sessionTokenWarnings(config: { endpoint?: string; sessionToken?: string }) {\n  if (!isCloudflareR2Endpoint(config.endpoint) || !config.sessionToken) return [];\n  return [\n    \"session token: configured for Cloudflare R2; if R2 rejects X-Amz-Security-Token, pi-sync retries once without it. R2 static access keys usually do not need a session token.\",\n  ];\n}\n\nexport function syncSessionsWarnings(config: { include: readonly string[] }) {\n  if (!config.include.includes(\"sessions\")) return [];\n  return [\n    \"sessions: included; Pi session JSONL can contain prompts, tool output, file paths, images, and secrets. Sync sessions only to storage you trust.\",\n  ];\n}\n\nexport function isEnabled(value: boolean | string | undefined, defaultValue: boolean) {\n  if (value === undefined) return defaultValue;\n  if (typeof value === \"boolean\") return value;\n  return ![\"0\", \"false\", \"no\", \"off\"].includes(value.trim().toLowerCase());\n}\n\nexport function isExplicitlyEnabled(value: boolean | string | undefined) {\n  if (typeof value === \"boolean\") return value;\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(value?.trim().toLowerCase() ?? \"\");\n}\n", "import { randomUUID } from \"node:crypto\";\nimport {\n  mkdir,\n  mkdirSync,\n  realpath,\n  realpathSync,\n  rmdir,\n  rmdirSync,\n  stat,\n  statSync,\n  utimes,\n  utimesSync,\n} from \"node:fs\";\nimport fs from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { getAgentDir } from \"@earendil-works/pi-coding-agent\";\nimport lockfile from \"proper-lockfile\";\n\nconst CONFIG_FILE_NAME = \"pi-sync.json\";\nconst LEGACY_CONFIG_FILE_NAME = \"pi-sync.local.json\";\nconst configMigrationNotices = new Map<string, string>();\nconst legacyPresenceNoticed = new Set<string>();\nconst CONFIG_LOCK_STALE_MS = 30_000;\nconst CONFIG_LOCK_UPDATE_MS = 10_000;\nconst LOCKFILE_FS_ADAPTER = {\n  mkdir,\n  mkdirSync,\n  realpath,\n  realpathSync,\n  rmdir,\n  rmdirSync,\n  stat,\n  statSync,\n  utimes,\n  utimesSync,\n};\n\ntype PublishFile = (source: string, destination: string) => Promise<void>;\nlet publishConfigFile: PublishFile = publishFileWithoutReplacement;\nlet beforeConfigPublicationHook: () => Promise<void> = async () => undefined;\nlet afterMissingConfigReadProbeHook: () => Promise<void> = async () => undefined;\nlet afterReplacementInstalledHook: () => Promise<void> = async () => undefined;\nlet afterConfigQuarantinedHook: () => Promise<void> = async () => undefined;\n\nexport type FileIdentity = { dev: number; ino: number };\n\nexport async function withConfigFilePublicationForTest<T>(publish: PublishFile, run: () => Promise<T>): Promise<T> {\n  const previous = publishConfigFile;\n  publishConfigFile = publish;\n  try {\n    return await run();\n  } finally {\n    publishConfigFile = previous;\n  }\n}\n\nexport async function withConfigPublicationReadyHookForTest<T>(\n  hook: () => Promise<void>,\n  run: () => Promise<T>,\n): Promise<T> {\n  const previous = beforeConfigPublicationHook;\n  beforeConfigPublicationHook = hook;\n  try {\n    return await run();\n  } finally {\n    beforeConfigPublicationHook = previous;\n  }\n}\n\nexport async function withMissingConfigReadProbeHookForTest<T>(\n  hook: () => Promise<void>,\n  run: () => Promise<T>,\n): Promise<T> {\n  const previous = afterMissingConfigReadProbeHook;\n  afterMissingConfigReadProbeHook = hook;\n  try {\n    return await run();\n  } finally {\n    afterMissingConfigReadProbeHook = previous;\n  }\n}\n\nexport async function withConfigReplacementInstalledHookForTest<T>(\n  hook: () => Promise<void>,\n  run: () => Promise<T>,\n): Promise<T> {\n  const previous = afterReplacementInstalledHook;\n  afterReplacementInstalledHook = hook;\n  try {\n    return await run();\n  } finally {\n    afterReplacementInstalledHook = previous;\n  }\n}\n\nexport async function withConfigQuarantinedHookForTest<T>(\n  hook: () => Promise<void>,\n  run: () => Promise<T>,\n): Promise<T> {\n  const previous = afterConfigQuarantinedHook;\n  afterConfigQuarantinedHook = hook;\n  try {\n    return await run();\n  } finally {\n    afterConfigQuarantinedHook = previous;\n  }\n}\n\ntype ConfigSnapshot = {\n  bytes: Buffer;\n  identity: FileIdentity;\n  parsed: Record<string, unknown>;\n};\n\nexport type LocalConfigDocument = ConfigSnapshot & { path: string };\n\nexport function localConfigPath() {\n  return path.join(getAgentDir(), CONFIG_FILE_NAME);\n}\n\nexport function legacyLocalConfigPath() {\n  return path.join(getAgentDir(), LEGACY_CONFIG_FILE_NAME);\n}\n\nexport async function activeLocalConfigPath() {\n  const canonicalPath = localConfigPath();\n  const legacyPath = legacyLocalConfigPath();\n  return withLocalConfigReadLockIfNeeded(async () => {\n    if (await pathExists(canonicalPath)) return canonicalPath;\n    return (await pathExists(legacyPath)) ? legacyPath : canonicalPath;\n  });\n}\n\nexport function consumeLocalConfigMigrationNotice() {\n  const configPath = localConfigPath();\n  const notice = configMigrationNotices.get(configPath);\n  configMigrationNotices.delete(configPath);\n  return notice;\n}\n\nexport async function readActiveLocalConfigDocumentForRepair(): Promise<LocalConfigDocument | undefined> {\n  const canonicalPath = localConfigPath();\n  const legacyPath = legacyLocalConfigPath();\n  return withLocalConfigReadLockIfNeeded(async () => {\n    const filePath = (await pathExists(canonicalPath)) ? canonicalPath : legacyPath;\n    const snapshot = await readConfigSnapshotIfExists(filePath);\n    return snapshot ? { path: filePath, ...snapshot } : undefined;\n  });\n}\n\nexport async function readMigratingLocalConfigDocument(\n  validateForMigration: (settings: Record<string, unknown>) => void,\n): Promise<LocalConfigDocument | undefined> {\n  return withLocalConfigReadLockIfNeeded(async () => {\n    const configPath = await prepareLocalConfigPath(validateForMigration);\n    const snapshot = await readConfigSnapshotIfExists(configPath);\n    return snapshot ? { path: configPath, ...snapshot } : undefined;\n  });\n}\n\nasync function withLocalConfigReadLockIfNeeded<T>(read: () => Promise<T>): Promise<T> {\n  if ((await pathExists(localConfigPath())) || (await pathExists(legacyLocalConfigPath()))) {\n    return withLocalConfigFileLock(read);\n  }\n  await afterMissingConfigReadProbeHook();\n  if (await pathExists(configMutationLockPath())) return withLocalConfigFileLock(read);\n  return read();\n}\n\nexport function updateLocalConfigDocument<T extends Record<string, unknown>>(\n  defaultValue: T,\n  update: (current: T) => T,\n  validate: (value: Record<string, unknown>) => void,\n  signal?: AbortSignal,\n): Promise<T> {\n  return withLocalConfigFileLock(async () => {\n    signal?.throwIfAborted();\n    const configPath = await prepareLocalConfigPath(validate);\n    const snapshot = await readConfigSnapshotIfExists(configPath);\n    const document = snapshot ? { path: configPath, ...snapshot } : undefined;\n    const current = document ? (structuredClone(document.parsed) as T) : structuredClone(defaultValue);\n    const next = update(current);\n    validate(next);\n    signal?.throwIfAborted();\n    if (document && JSON.stringify(document.parsed) === JSON.stringify(next)) return next;\n    if (document) await replaceLocalConfigDocumentUnlocked(document, next);\n    else await installPrivateConfigExclusively(localConfigPath(), serializedConfig(next));\n    return next;\n  });\n}\n\nexport function createLocalConfigDocument(value: Record<string, unknown>) {\n  return withLocalConfigFileLock(async () => {\n    const bytes = serializedConfig(value);\n    try {\n      await installPrivateConfigExclusively(localConfigPath(), bytes);\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"EEXIST\") {\n        throw new Error(\"Pi-sync settings were created concurrently; reopen settings and retry.\");\n      }\n      throw error;\n    }\n  });\n}\n\nexport function replaceLocalConfigDocument(document: LocalConfigDocument, value: Record<string, unknown>) {\n  return withLocalConfigFileLock(() => replaceLocalConfigDocumentUnlocked(document, value));\n}\n\nasync function replaceLocalConfigDocumentUnlocked(document: LocalConfigDocument, value: Record<string, unknown>) {\n  const nextBytes = serializedConfig(value);\n  const canonicalPath = localConfigPath();\n  if (document.path !== canonicalPath) {\n    if (!(await configDocumentStillMatches(document))) throw settingsChangedError();\n    let installed: FileIdentity;\n    try {\n      installed = await installPrivateConfigExclusively(canonicalPath, nextBytes);\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"EEXIST\") {\n        throw new Error(\"Canonical settings were created concurrently; no settings were replaced.\");\n      }\n      throw error;\n    }\n    if (!(await configDocumentStillMatches(document))) {\n      await quarantineAndRemoveConfigIfMatchesUnlocked(canonicalPath, installed, nextBytes);\n      throw settingsChangedError();\n    }\n    return;\n  }\n\n  const quarantinePath = await claimCanonicalConfigDocument(document);\n  let installed: FileIdentity;\n  try {\n    installed = await installPrivateConfigExclusively(canonicalPath, nextBytes);\n  } catch (error) {\n    await restoreQuarantinedConfig(canonicalPath, quarantinePath);\n    if ((error as NodeJS.ErrnoException).code === \"EEXIST\") {\n      throw new Error(\"Canonical settings changed concurrently; no settings were replaced.\");\n    }\n    throw error;\n  }\n  try {\n    await afterReplacementInstalledHook();\n    if (!(await fileIdentityAndContentsMatch(quarantinePath, document.identity, document.bytes))) {\n      throw settingsChangedError();\n    }\n    if (process.platform !== \"win32\") await fs.chmod(quarantinePath, 0o600);\n  } catch (error) {\n    await quarantineAndRemoveConfigIfMatchesUnlocked(canonicalPath, installed, nextBytes);\n    await restoreQuarantinedConfig(canonicalPath, quarantinePath);\n    throw error;\n  }\n  await fs.rm(quarantinePath).catch(() => undefined);\n  await syncParentDirectory(canonicalPath).catch(() => undefined);\n}\n\nasync function prepareLocalConfigPath(validateForMigration: (settings: Record<string, unknown>) => void) {\n  const canonicalPath = localConfigPath();\n  const legacyPath = legacyLocalConfigPath();\n  if (await pathExists(canonicalPath)) {\n    const legacyStatus = await secureIgnoredLegacyIfPresent(legacyPath);\n    if (legacyStatus !== \"missing\" && !legacyPresenceNoticed.has(canonicalPath)) {\n      legacyPresenceNoticed.add(canonicalPath);\n      recordConfigMigrationNotice(\n        canonicalPath,\n        legacyStatus === \"private\"\n          ? `${LEGACY_CONFIG_FILE_NAME} legacy settings were ignored because ${CONFIG_FILE_NAME} takes precedence. Delete ${LEGACY_CONFIG_FILE_NAME} after confirming your settings.`\n          : `${LEGACY_CONFIG_FILE_NAME} legacy settings were ignored because ${CONFIG_FILE_NAME} takes precedence, but pi-sync could not verify them as a private regular file. Secure or delete the legacy path after confirming your settings.`,\n      );\n    }\n    return canonicalPath;\n  }\n\n  const legacy = await readConfigSnapshotIfExists(legacyPath);\n  if (!legacy) return canonicalPath;\n  validateForMigration(legacy.parsed);\n\n  let installedIdentity: FileIdentity;\n  try {\n    installedIdentity = await installPrivateConfigExclusively(canonicalPath, legacy.bytes);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"EEXIST\") {\n      recordConfigMigrationNotice(\n        canonicalPath,\n        `${LEGACY_CONFIG_FILE_NAME} legacy settings were ignored because ${CONFIG_FILE_NAME} was created concurrently and takes precedence.`,\n      );\n      return canonicalPath;\n    }\n    recordConfigMigrationNotice(\n      canonicalPath,\n      `Could not migrate ${LEGACY_CONFIG_FILE_NAME} to ${CONFIG_FILE_NAME}; the legacy settings were used for this session and were not changed.`,\n    );\n    return legacyPath;\n  }\n\n  if (!(await configSnapshotStillMatches(legacyPath, legacy))) {\n    const removed = await quarantineAndRemoveConfigIfMatchesUnlocked(canonicalPath, installedIdentity, legacy.bytes);\n    recordConfigMigrationNotice(\n      canonicalPath,\n      removed\n        ? `${LEGACY_CONFIG_FILE_NAME} changed during migration; the stale ${CONFIG_FILE_NAME} copy was removed and the legacy settings were used for this session.`\n        : `${LEGACY_CONFIG_FILE_NAME} changed during migration, but ${CONFIG_FILE_NAME} was replaced concurrently and takes precedence.`,\n    );\n    return removed ? legacyPath : canonicalPath;\n  }\n\n  legacyPresenceNoticed.add(canonicalPath);\n  recordConfigMigrationNotice(\n    canonicalPath,\n    `pi-sync settings migrated from ${LEGACY_CONFIG_FILE_NAME} to ${CONFIG_FILE_NAME}; the private legacy file was retained as a recovery copy and can be deleted after verification.`,\n  );\n  return canonicalPath;\n}\n\nasync function secureIgnoredLegacyIfPresent(filePath: string) {\n  let pathStat: Awaited<ReturnType<typeof fs.lstat>>;\n  try {\n    pathStat = await fs.lstat(filePath);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return \"missing\" as const;\n    return \"unsafe\" as const;\n  }\n  if (pathStat.isSymbolicLink() || !pathStat.isFile()) return \"unsafe\" as const;\n\n  let handle: fs.FileHandle | undefined;\n  try {\n    handle = await fs.open(filePath, \"r\");\n    const openedStat = await handle.stat();\n    if (openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) {\n      return \"unsafe\" as const;\n    }\n    if (process.platform !== \"win32\" && (openedStat.mode & 0o777) !== 0o600) {\n      await handle.chmod(0o600);\n    }\n    return \"private\" as const;\n  } catch {\n    return \"unsafe\" as const;\n  } finally {\n    await handle?.close().catch(() => undefined);\n  }\n}\n\nasync function readConfigSnapshotIfExists(filePath: string): Promise<ConfigSnapshot | undefined> {\n  let pathStat: Awaited<ReturnType<typeof fs.lstat>>;\n  try {\n    pathStat = await fs.lstat(filePath);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw error;\n  }\n  if (pathStat.isSymbolicLink()) {\n    throw new Error(`Refusing to read symlinked pi-sync config: ${filePath}`);\n  }\n  if (!pathStat.isFile()) throw new Error(`pi-sync config is not a regular file: ${filePath}`);\n\n  const handle = await fs.open(filePath, \"r\");\n  try {\n    const openedStat = await handle.stat();\n    if (openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) {\n      throw new Error(`pi-sync config changed while opening: ${filePath}`);\n    }\n    if (process.platform !== \"win32\" && (openedStat.mode & 0o777) !== 0o600) {\n      await handle.chmod(0o600);\n    }\n    const bytes = await handle.readFile();\n    return {\n      bytes,\n      identity: { dev: openedStat.dev, ino: openedStat.ino },\n      parsed: parseConfigObject(bytes, filePath),\n    };\n  } finally {\n    await handle.close();\n  }\n}\n\nfunction serializedConfig(value: Record<string, unknown>) {\n  return Buffer.from(`${JSON.stringify(value, null, \"\\t\")}\\n`, \"utf8\");\n}\n\nfunction parseConfigObject(bytes: Buffer, filePath: string) {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(bytes.toString(\"utf8\"));\n  } catch {\n    throw new SyntaxError(`Invalid JSON in pi-sync config: ${filePath}`);\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(`pi-sync config must contain a JSON object: ${filePath}`);\n  }\n  return parsed as Record<string, unknown>;\n}\n\nasync function installPrivateConfigExclusively(filePath: string, bytes: Buffer) {\n  await fs.mkdir(path.dirname(filePath), { recursive: true });\n  const temporaryPath = path.join(\n    path.dirname(filePath),\n    `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.migrate`,\n  );\n  let handle: fs.FileHandle | undefined;\n  try {\n    handle = await fs.open(temporaryPath, \"wx\", 0o600);\n    await handle.writeFile(bytes);\n    if (process.platform !== \"win32\") await handle.chmod(0o600);\n    await handle.sync();\n    await handle.close();\n    handle = undefined;\n    await publishConfigFile(temporaryPath, filePath);\n    const installed = await fs.lstat(filePath);\n    let publishedHandle: fs.FileHandle | undefined;\n    let publicationError: unknown;\n    try {\n      if (installed.isSymbolicLink() || !installed.isFile()) {\n        throw new Error(`Published pi-sync settings are not a regular file: ${filePath}`);\n      }\n      publishedHandle = await fs.open(filePath, \"r+\");\n      const published = await publishedHandle.stat();\n      if (published.dev !== installed.dev || published.ino !== installed.ino) {\n        throw new Error(`Published pi-sync settings changed while opening: ${filePath}`);\n      }\n      if (process.platform !== \"win32\") await publishedHandle.chmod(0o600);\n      await publishedHandle.sync();\n      await syncParentDirectory(filePath);\n    } catch (error) {\n      publicationError = error;\n    } finally {\n      await publishedHandle?.close().catch(() => undefined);\n    }\n    if (publicationError) {\n      await quarantineAndRemoveConfigIfMatchesUnlocked(filePath, { dev: installed.dev, ino: installed.ino }, bytes);\n      throw publicationError;\n    }\n    return { dev: installed.dev, ino: installed.ino };\n  } finally {\n    await handle?.close().catch(() => undefined);\n    await fs.rm(temporaryPath, { force: true }).catch(() => undefined);\n  }\n}\n\nasync function configDocumentStillMatches(document: LocalConfigDocument) {\n  return fileIdentityAndContentsMatch(document.path, document.identity, document.bytes);\n}\n\nasync function claimCanonicalConfigDocument(document: LocalConfigDocument) {\n  const quarantinePath = path.join(\n    path.dirname(document.path),\n    `.${path.basename(document.path)}.${randomUUID()}.schema-migration-source`,\n  );\n  try {\n    await fs.rename(document.path, quarantinePath);\n    await syncParentDirectory(document.path);\n  } catch (error) {\n    await restoreQuarantinedConfig(document.path, quarantinePath);\n    throw error;\n  }\n  if (!(await fileIdentityAndContentsMatch(quarantinePath, document.identity, document.bytes))) {\n    await restoreQuarantinedConfig(document.path, quarantinePath);\n    throw settingsChangedError();\n  }\n  if (await pathExists(document.path)) {\n    await restoreQuarantinedConfig(document.path, quarantinePath);\n    throw new Error(\"Canonical settings changed concurrently; no settings were replaced.\");\n  }\n  return quarantinePath;\n}\n\nfunction settingsChangedError() {\n  return new Error(\"pi-sync settings changed during migration; no settings were replaced.\");\n}\n\nasync function configSnapshotStillMatches(filePath: string, snapshot: ConfigSnapshot) {\n  return fileIdentityAndContentsMatch(filePath, snapshot.identity, snapshot.bytes);\n}\n\nexport function quarantineAndRemoveConfigIfMatches(filePath: string, identity: FileIdentity, expectedBytes: Buffer) {\n  return withLocalConfigFileLock(() => quarantineAndRemoveConfigIfMatchesUnlocked(filePath, identity, expectedBytes));\n}\n\nasync function quarantineAndRemoveConfigIfMatchesUnlocked(\n  filePath: string,\n  identity: FileIdentity,\n  expectedBytes: Buffer,\n) {\n  const quarantinePath = path.join(\n    path.dirname(filePath),\n    `.${path.basename(filePath)}.${randomUUID()}.migration-retired`,\n  );\n  try {\n    await fs.rename(filePath, quarantinePath);\n  } catch {\n    return false;\n  }\n  await afterConfigQuarantinedHook();\n  try {\n    await syncParentDirectory(filePath);\n  } catch {\n    await restoreQuarantinedConfig(filePath, quarantinePath);\n    return false;\n  }\n\n  const matches = await fileIdentityAndContentsMatch(quarantinePath, identity, expectedBytes);\n  if (!matches) {\n    await restoreQuarantinedConfig(filePath, quarantinePath);\n    return false;\n  }\n  if (await pathExists(filePath)) {\n    await fs.rm(quarantinePath, { force: true });\n    await syncParentDirectory(filePath);\n    return false;\n  }\n  await fs.rm(quarantinePath);\n  await syncParentDirectory(filePath);\n  return true;\n}\n\nasync function fileIdentityAndContentsMatch(filePath: string, identity: FileIdentity, expectedBytes: Buffer) {\n  try {\n    const current = await fs.lstat(filePath);\n    if (current.isSymbolicLink()) return false;\n    if (current.dev !== identity.dev || current.ino !== identity.ino) return false;\n    return (await fs.readFile(filePath)).equals(expectedBytes);\n  } catch {\n    return false;\n  }\n}\n\nasync function restoreQuarantinedConfig(filePath: string, quarantinePath: string) {\n  try {\n    await renameFileWithoutReplacement(quarantinePath, filePath);\n    if (process.platform !== \"win32\") await fs.chmod(filePath, 0o600);\n    await syncParentDirectory(filePath);\n    return;\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") return;\n  }\n  try {\n    if (process.platform !== \"win32\") await fs.chmod(quarantinePath, 0o600);\n    await syncParentDirectory(filePath);\n  } catch {\n    // Preserve the quarantine rather than risk deleting settings that changed concurrently.\n  }\n}\n\nfunction configMutationLockPath() {\n  return `${localConfigPath()}.mutation-lock`;\n}\n\nexport async function withLocalConfigFileLock<T>(run: () => Promise<T>): Promise<T> {\n  const configPath = localConfigPath();\n  await fs.mkdir(path.dirname(configPath), { recursive: true });\n  let compromisedError: Error | undefined;\n  const release = await lockfile.lock(configPath, {\n    fs: LOCKFILE_FS_ADAPTER,\n    lockfilePath: configMutationLockPath(),\n    realpath: false,\n    stale: CONFIG_LOCK_STALE_MS,\n    update: CONFIG_LOCK_UPDATE_MS,\n    retries: { retries: 100, factor: 1.2, minTimeout: 10, maxTimeout: 100 },\n    onCompromised: (error) => {\n      compromisedError = error;\n    },\n  });\n  try {\n    const result = await run();\n    if (compromisedError) throw compromisedError;\n    return result;\n  } finally {\n    await release();\n  }\n}\n\nasync function syncParentDirectory(filePath: string) {\n  if (process.platform === \"win32\") return;\n  let handle: fs.FileHandle | undefined;\n  try {\n    handle = await fs.open(path.dirname(filePath), \"r\");\n    await handle.sync();\n  } finally {\n    await handle?.close().catch(() => undefined);\n  }\n}\n\nasync function publishFileWithoutReplacement(source: string, destination: string) {\n  await beforeConfigPublicationHook();\n  await renameFileWithoutReplacement(source, destination);\n}\n\nasync function renameFileWithoutReplacement(source: string, destination: string) {\n  if (await pathExists(destination)) {\n    throw Object.assign(new Error(`Settings already exist: ${destination}`), { code: \"EEXIST\" });\n  }\n  await fs.rename(source, destination);\n}\n\nasync function pathExists(filePath: string) {\n  try {\n    await fs.lstat(filePath);\n    return true;\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw error;\n  }\n}\n\nfunction recordConfigMigrationNotice(configPath: string, notice: string) {\n  if (!configMigrationNotices.has(configPath)) configMigrationNotices.set(configPath, notice);\n}\n", "import path from \"node:path\";\nimport { normalizeEndpointIdentity } from \"../backends/backend-identity.js\";\nimport {\n  normalizeGitBranch,\n  normalizeGitDirectory,\n  normalizeGitRemote,\n  normalizeGitRemoteIdentity,\n} from \"../backends/git/git-config.js\";\nimport {\n  normalizeWebDavIdentityUrl,\n  normalizeWebDavPath,\n  normalizeWebDavUrl,\n  validateWebDavCredentials,\n} from \"../backends/webdav/webdav-config.js\";\nimport { normalizeLocalFields } from \"../sync/local-field-policy.js\";\nimport { normalizeSyncInclude } from \"../sync/sync-policy.js\";\nimport { localConfigPath } from \"./config-file.js\";\nimport type {\n  OnSwitchAction,\n  PiSyncSettingsV3,\n  StorageConnectionSettings,\n  SyncSetupSettings,\n} from \"./settings-types.js\";\n\nexport const DEFAULT_ON_SWITCH: OnSwitchAction = \"ask-before-pull\";\n\nexport function normalizeOnSwitch(value: unknown): OnSwitchAction {\n  if (value === \"ask-before-pull\" || value === \"pull-after-switch\" || value === \"switch-only\") {\n    return value;\n  }\n  throw new Error(\n    'Invalid pi-sync settings: onSwitch must be \"ask-before-pull\", \"pull-after-switch\", or \"switch-only\".',\n  );\n}\n\nexport function validateSettingsDocument(value: Record<string, unknown>): PiSyncSettingsV3 {\n  if (value.version !== 3 && value.version !== 4 && value.version !== 5) {\n    throw new Error(\n      `Unsupported pi-sync settings: version 3 or 4 or 5 is required. Keep the existing ${path.basename(localConfigPath())} for recovery and use a compatible pi-sync client or review a separate supported setup; do not downgrade portable field policies. pi-sync will not migrate or overwrite unsupported settings.`,\n    );\n  }\n  rejectLegacyFields(\n    value,\n    [\n      \"profiles\",\n      \"targets\",\n      \"activeTarget\",\n      \"targetSwitchAction\",\n      \"endpoint\",\n      \"bucket\",\n      \"region\",\n      \"accessKeyId\",\n      \"secretAccessKey\",\n      \"sessionToken\",\n      \"profile\",\n      \"prefix\",\n      \"autoSync\",\n      \"syncFiles\",\n      \"syncSessions\",\n      \"extraFiles\",\n    ],\n    \"top level\",\n  );\n  normalizeOnSwitch(value.onSwitch);\n  if (value.skipSecretScan !== undefined && typeof value.skipSecretScan !== \"boolean\") {\n    throw new Error(\"Invalid pi-sync settings: skipSecretScan must be boolean.\");\n  }\n  if (value.showStatus !== undefined && typeof value.showStatus !== \"boolean\") {\n    throw new Error(\"Invalid pi-sync settings: showStatus must be boolean.\");\n  }\n  if (value.debug !== undefined && typeof value.debug !== \"boolean\") {\n    throw new Error(\"Invalid pi-sync settings: debug must be boolean.\");\n  }\n  const storageConnections = requireNamedObjectMap(\n    value.storageConnections,\n    \"storageConnections\",\n    \"storage connection\",\n  );\n  const syncSetups = requireNamedObjectMap(value.syncSetups, \"syncSetups\", \"sync setup\");\n  for (const name of Object.keys(storageConnections)) {\n    validateStorageConnection(\n      name,\n      requireOwnObject(storageConnections, name, \"storage connection\") as Record<string, unknown>,\n    );\n  }\n  for (const name of Object.keys(syncSetups)) {\n    validateSyncSetup(\n      name,\n      requireOwnObject(syncSetups, name, \"sync setup\") as Record<string, unknown>,\n      storageConnections,\n    );\n  }\n  const names = Object.keys(syncSetups);\n  const activeSyncSetup = optionalCanonicalReference(value.activeSyncSetup, \"activeSyncSetup\");\n  if (names.length === 0) {\n    if (activeSyncSetup !== undefined) {\n      throw new Error(\"Invalid pi-sync settings: empty syncSetups cannot have activeSyncSetup.\");\n    }\n  } else if (!activeSyncSetup || !Object.hasOwn(syncSetups, activeSyncSetup)) {\n    throw new Error(\"Invalid pi-sync settings: activeSyncSetup must reference an existing own-property sync setup.\");\n  }\n  for (const setup of Object.values(syncSetups)) {\n    const policy = (setup as SyncSetupSettings).sync;\n    if (policy.localFields !== undefined && value.version !== 4 && value.version !== 5)\n      throw new Error(\"localFields requires explicit settings version 4; older binaries must refuse portable state.\");\n  }\n  for (const setup of Object.values(syncSetups)) {\n    const policy = (setup as SyncSetupSettings).sync;\n    if ((policy.mergeContent || policy.partialSync) && value.version !== 5)\n      throw new Error(\"Content/partial sync requires explicit settings version 5.\");\n  }\n  validateUniqueRemoteSyncSetups(syncSetups, storageConnections);\n  return value as PiSyncSettingsV3;\n}\n\nfunction validateStorageConnection(name: string, value: Record<string, unknown>) {\n  rejectLegacyFields(\n    value,\n    [\"kind\", \"accessKeyId\", \"secretAccessKey\", \"sessionToken\", \"username\", \"password\"],\n    `storage connection \u201C${name}\u201D`,\n  );\n  const type = requiredString(value.type, `storage connection \u201C${name}\u201D type`);\n  if (type !== \"s3\" && type !== \"git\" && type !== \"webdav\") {\n    throw new Error(`Invalid pi-sync settings: storage connection \u201C${name}\u201D has unsupported type.`);\n  }\n  const known = [\"endpoint\", \"region\", \"remote\", \"url\", \"credentials\"];\n  const allowed =\n    type === \"s3\"\n      ? new Set([\"endpoint\", \"region\", \"credentials\"])\n      : type === \"git\"\n        ? new Set([\"remote\"])\n        : new Set([\"url\", \"credentials\"]);\n  if (known.some((field) => Object.hasOwn(value, field) && !allowed.has(field))) {\n    throw new Error(\n      `Invalid pi-sync settings: ${type.toUpperCase()} storage connection \u201C${name}\u201D mixes backend fields.`,\n    );\n  }\n  if (type === \"git\") {\n    if (!normalizeGitRemote(requiredString(value.remote, `Git remote for \u201C${name}\u201D`))) {\n      throw new Error(`Invalid pi-sync settings: Git remote for \u201C${name}\u201D is required.`);\n    }\n    return;\n  }\n  const credentials = requireRecord(value.credentials, `credentials for storage connection \u201C${name}\u201D`);\n  if (type === \"webdav\") {\n    normalizeWebDavUrl(requiredString(value.url, `WebDAV URL for \u201C${name}\u201D`));\n    const username = requiredString(credentials.username, `WebDAV username for \u201C${name}\u201D`);\n    const password = requiredSecret(credentials.password, `WebDAV password for \u201C${name}\u201D`);\n    if ([\"accessKeyId\", \"secretAccessKey\", \"sessionToken\"].some((field) => Object.hasOwn(credentials, field))) {\n      throw new Error(`Invalid pi-sync settings: WebDAV credentials for \u201C${name}\u201D mix fields.`);\n    }\n    validateWebDavCredentials(username, password);\n    return;\n  }\n  normalizeS3Endpoint(requiredString(value.endpoint, `S3 endpoint for \u201C${name}\u201D`));\n  requiredString(value.region, `S3 region for \u201C${name}\u201D`);\n  requiredString(credentials.accessKeyId, `S3 access key id for \u201C${name}\u201D`);\n  requiredSecret(credentials.secretAccessKey, `S3 secret access key for \u201C${name}\u201D`);\n  optionalString(credentials.sessionToken, `S3 session token for \u201C${name}\u201D`);\n  if ([\"username\", \"password\"].some((field) => Object.hasOwn(credentials, field))) {\n    throw new Error(`Invalid pi-sync settings: S3 credentials for \u201C${name}\u201D mix fields.`);\n  }\n}\n\nfunction validateSyncSetup(name: string, value: Record<string, unknown>, connections: Record<string, unknown>) {\n  rejectLegacyFields(\n    value,\n    [\n      \"profile\",\n      \"bucket\",\n      \"branch\",\n      \"path\",\n      \"prefix\",\n      \"directory\",\n      \"namespace\",\n      \"autoSync\",\n      \"syncFiles\",\n      \"syncSessions\",\n      \"extraFiles\",\n    ],\n    `sync setup \u201C${name}\u201D`,\n  );\n  const storage = requireRecord(value.storage, `storage for sync setup \u201C${name}\u201D`);\n  const sync = requireRecord(value.sync, `sync policy for sync setup \u201C${name}\u201D`);\n  rejectLegacyFields(storage, [\"profile\", \"prefix\", \"directory\", \"namespace\"], `storage for sync setup \u201C${name}\u201D`);\n  rejectLegacyFields(\n    sync,\n    [\"autoSync\", \"syncFiles\", \"syncSessions\", \"extraFiles\"],\n    `sync policy for sync setup \u201C${name}\u201D`,\n  );\n  const connectionName = requiredCanonicalReference(\n    storage.connection,\n    `storage connection reference for sync setup \u201C${name}\u201D`,\n  );\n  validateConfigName(connectionName, \"storage connection reference\");\n  const connection = ownObject<Record<string, unknown>>(connections, connectionName);\n  if (!connection) {\n    throw new Error(\n      `Invalid pi-sync settings: sync setup \u201C${name}\u201D references missing storage connection \u201C${connectionName}\u201D.`,\n    );\n  }\n  const type = connection.type;\n  normalizeStoragePath(requiredString(storage.path, `storage path for sync setup \u201C${name}\u201D`));\n  if (type === \"s3\") {\n    normalizeS3Bucket(requiredString(storage.bucket, `S3 bucket for sync setup \u201C${name}\u201D`));\n    if (Object.hasOwn(storage, \"branch\")) mixedSetupError(\"S3\", name);\n  } else if (type === \"git\") {\n    normalizeGitBranch(requiredString(storage.branch, `Git branch for sync setup \u201C${name}\u201D`));\n    if (Object.hasOwn(storage, \"bucket\")) mixedSetupError(\"Git\", name);\n  } else if (type === \"webdav\") {\n    if (Object.hasOwn(storage, \"bucket\") || Object.hasOwn(storage, \"branch\")) {\n      mixedSetupError(\"WebDAV\", name);\n    }\n  }\n  if (!Object.hasOwn(sync, \"include\")) {\n    throw new Error(`Invalid pi-sync settings: sync setup \u201C${name}\u201D is missing sync.include.`);\n  }\n  const include = normalizeSyncInclude(sync.include);\n  const localFields = normalizeLocalFields(sync.localFields);\n  if (localFields.length > 0 && !include.includes(\"settings.json\"))\n    throw new Error(\"Nonempty localFields requires settings.json in sync.include.\");\n  for (const key of [\"mergeContent\", \"partialSync\", \"agentMode\", \"continuous\"])\n    if (sync[key] !== undefined && typeof sync[key] !== \"boolean\") throw new Error(`${key} must be boolean.`);\n  if (sync.mergeSettings !== undefined && typeof sync.mergeSettings !== \"boolean\")\n    throw new Error(\"mergeSettings must be boolean.\");\n  if (sync.automaticTransfer !== undefined && typeof sync.automaticTransfer !== \"boolean\") {\n    throw new Error(`Invalid pi-sync settings: sync setup \u201C${name}\u201D sync.automaticTransfer must be boolean.`);\n  }\n  if (typeof sync.automatic !== \"boolean\") {\n    throw new Error(`Invalid pi-sync settings: sync setup \u201C${name}\u201D sync.automatic must be boolean.`);\n  }\n}\n\nfunction mixedSetupError(type: string, name: string): never {\n  throw new Error(`Invalid pi-sync settings: ${type} sync setup \u201C${name}\u201D mixes backend fields.`);\n}\n\nexport function validateUniqueRemoteSyncSetups(setups: Record<string, unknown>, connections: Record<string, unknown>) {\n  const identities = new Map<string, string>();\n  for (const name of Object.keys(setups)) {\n    const setup = requireOwnObject(setups, name, \"sync setup\") as unknown as SyncSetupSettings;\n    const connection = requireOwnObject(\n      connections,\n      setup.storage.connection,\n      \"storage connection\",\n    ) as unknown as StorageConnectionSettings;\n    const identity = effectiveSyncSetupRemoteIdentity(setup, connection);\n    const existing = identities.get(identity);\n    if (existing) {\n      throw new Error(\n        `Invalid pi-sync settings: sync setups \u201C${existing}\u201D and \u201C${name}\u201D use the same normalized remote location.`,\n      );\n    }\n    identities.set(identity, name);\n  }\n}\n\nexport function effectiveSyncSetupRemoteIdentity(setup: SyncSetupSettings, connection: StorageConnectionSettings) {\n  const storagePath = normalizeStoragePath(setup.storage.path);\n  if (connection.type === \"git\") {\n    return JSON.stringify([\n      \"git\",\n      normalizeGitRemoteIdentity(connection.remote),\n      normalizeGitBranch(setup.storage.branch),\n      normalizeGitDirectory(storagePath),\n    ]);\n  }\n  if (connection.type === \"webdav\") {\n    return JSON.stringify([\n      \"webdav\",\n      normalizeWebDavIdentityUrl(connection.url),\n      connection.credentials.username.trim(),\n      normalizeWebDavPath(storagePath),\n    ]);\n  }\n  return JSON.stringify([\n    \"s3\",\n    normalizeEndpointIdentity(connection.endpoint),\n    normalizeS3Bucket(setup.storage.bucket),\n    storagePath,\n  ]);\n}\n\nfunction rejectLegacyFields(value: Record<string, unknown>, fields: readonly string[], context: string) {\n  const field = fields.find((candidate) => Object.hasOwn(value, candidate));\n  if (field) {\n    throw new Error(`Invalid pi-sync settings: ${context} contains unsupported version 1/2 field \u201C${field}\u201D.`);\n  }\n}\n\nfunction requireNamedObjectMap(value: unknown, field: string, itemLabel: string) {\n  const result = requireRecord(value, field);\n  for (const name of Object.keys(result)) validateConfigName(name, itemLabel);\n  return result;\n}\n\nfunction requireOwnObject(value: Record<string, unknown>, key: string, label: string) {\n  const item = ownObject(value, key);\n  if (!item) throw new Error(`Invalid pi-sync settings: ${label} \u201C${key}\u201D must be an object.`);\n  return item;\n}\n\nexport function ownObject<T extends object>(value: Record<string, unknown>, key: string): T | undefined {\n  if (!Object.hasOwn(value, key)) return undefined;\n  const item = value[key];\n  return item && typeof item === \"object\" && !Array.isArray(item) ? (item as T) : undefined;\n}\n\nfunction requireRecord(value: unknown, field: string): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`Invalid pi-sync settings: ${field} must be an object.`);\n  }\n  return value as Record<string, unknown>;\n}\n\nexport function validateConfigName(value: string, field: string) {\n  if (\n    !value.trim() ||\n    value !== value.trim() ||\n    value.length > 100 ||\n    value === \"__proto__\" ||\n    value === \"prototype\" ||\n    value === \"constructor\" ||\n    hasControlCharacter(value)\n  ) {\n    throw new Error(`Invalid pi-sync settings: invalid ${field} name.`);\n  }\n}\n\nexport function requiredString(value: unknown, field: string) {\n  if (typeof value !== \"string\" || !value.trim() || hasControlCharacter(value)) {\n    throw new Error(`Invalid pi-sync settings: ${field} must be a non-empty string.`);\n  }\n  return value.trim();\n}\n\nfunction requiredCanonicalReference(value: unknown, field: string) {\n  const normalized = requiredString(value, field);\n  if (value !== normalized) {\n    throw new Error(`Invalid pi-sync settings: ${field} must not have surrounding whitespace.`);\n  }\n  return normalized;\n}\n\nfunction optionalCanonicalReference(value: unknown, field: string) {\n  const normalized = optionalString(value, field);\n  if (normalized !== undefined && value !== normalized) {\n    throw new Error(`Invalid pi-sync settings: ${field} must not have surrounding whitespace.`);\n  }\n  return normalized;\n}\n\nfunction requiredSecret(value: unknown, field: string) {\n  if (typeof value !== \"string\" || !value || hasControlCharacter(value)) {\n    throw new Error(`Invalid pi-sync settings: ${field} must be configured.`);\n  }\n  return value;\n}\n\nexport function optionalString(value: unknown, field: string) {\n  if (value === undefined) return undefined;\n  if (typeof value !== \"string\" || hasControlCharacter(value)) {\n    throw new Error(`Invalid pi-sync settings: ${field} must be a string.`);\n  }\n  return value.trim() || undefined;\n}\n\nexport function normalizeStoragePath(value: string) {\n  if (value.trim() === \".\" || value.trim() === \"./\") return \"./\";\n  const normalized = value.trim().replace(/^\\/+|\\/+$/gu, \"\");\n  if (\n    !normalized ||\n    normalized.length > 1024 ||\n    normalized.startsWith(\"-\") ||\n    normalized.includes(\"\\\\\") ||\n    hasControlCharacter(normalized) ||\n    normalized.split(\"/\").some((segment) => !segment || segment === \".\" || segment === \"..\")\n  ) {\n    throw new Error(\"Invalid pi-sync settings: storage.path must be a safe relative path.\");\n  }\n  return normalized;\n}\n\nexport function normalizeS3Endpoint(value: string) {\n  let url: URL;\n  try {\n    url = new URL(value.trim());\n  } catch {\n    throw new Error(\"Invalid pi-sync S3 endpoint.\");\n  }\n  const loopback = url.hostname === \"127.0.0.1\" || url.hostname === \"localhost\" || url.hostname === \"[::1]\";\n  if (\n    (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && loopback)) ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  ) {\n    throw new Error(\"Invalid pi-sync S3 endpoint: HTTPS is required except for loopback.\");\n  }\n  url.pathname = url.pathname.replace(/\\/+$/gu, \"\");\n  return url.toString().replace(/\\/$/u, \"\");\n}\n\nexport function normalizeS3Bucket(value: string | undefined) {\n  const bucket = requiredString(value, \"S3 bucket\");\n  if (bucket.includes(\"/\") || bucket.includes(\"\\\\\") || bucket.startsWith(\"-\")) {\n    throw new Error(\"Invalid pi-sync S3 bucket.\");\n  }\n  return bucket;\n}\n\nfunction hasControlCharacter(value: string) {\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: Stored settings cannot contain controls.\n  return /[\\u0000-\\u001f\\u007f-\\u009f]/u.test(value);\n}\n\nexport function isCloudflareR2Endpoint(endpoint: string | undefined) {\n  const value = endpoint?.trim();\n  if (!value) return false;\n  try {\n    const hostname = new URL(value).hostname.toLowerCase();\n    return hostname === \"r2.cloudflarestorage.com\" || hostname.endsWith(\".r2.cloudflarestorage.com\");\n  } catch {\n    return false;\n  }\n}\n\nexport function ownRecord(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === \"object\" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n", "import { localConfigPath, readMigratingLocalConfigDocument, updateLocalConfigDocument } from \"./config-file.js\";\nimport type { OnSwitchAction, PiSyncSettingsV3 } from \"./settings-types.js\";\nimport { DEFAULT_ON_SWITCH, validateSettingsDocument } from \"./settings-validation.js\";\n\nlet configUpdateQueue: Promise<void> = Promise.resolve();\n\nexport async function requireSettings() {\n  const settings = await readLocalConfigObject();\n  if (!settings) {\n    throw new Error(`Missing pi-sync settings. Open /sync and choose Set up sync, or create ${localConfigPath()}.`);\n  }\n  return settings;\n}\n\nexport async function configuredSyncSetupNames() {\n  const settings = await readLocalConfigObject();\n  return settings ? Object.keys(settings.syncSetups).sort((left, right) => left.localeCompare(right)) : [];\n}\n\nexport async function loadOnSwitch(): Promise<OnSwitchAction> {\n  return (await requireSettings()).onSwitch;\n}\n\nexport function localConfigTemplate(): PiSyncSettingsV3 {\n  return {\n    version: 3,\n    onSwitch: DEFAULT_ON_SWITCH,\n    skipSecretScan: false,\n    showStatus: true,\n    debug: false,\n    storageConnections: {},\n    syncSetups: {},\n  };\n}\n\nexport async function readLocalConfigDocument() {\n  const document = await readMigratingLocalConfigDocument((settings) => {\n    validateSettingsDocument(settings);\n  });\n  if (document) validateSettingsDocument(document.parsed);\n  return document;\n}\n\nexport async function readLocalConfigObject(): Promise<PiSyncSettingsV3 | undefined> {\n  return (await readLocalConfigDocument())?.parsed as PiSyncSettingsV3 | undefined;\n}\n\nexport function updateLocalConfig(update: (current: PiSyncSettingsV3) => PiSyncSettingsV3, signal?: AbortSignal) {\n  const operation = configUpdateQueue.then(() => {\n    signal?.throwIfAborted();\n    return performLocalConfigUpdate(update, signal);\n  });\n  configUpdateQueue = operation.then(\n    () => undefined,\n    () => undefined,\n  );\n  return operation;\n}\n\nasync function performLocalConfigUpdate(update: (current: PiSyncSettingsV3) => PiSyncSettingsV3, signal?: AbortSignal) {\n  return updateLocalConfigDocument(localConfigTemplate(), update, validateSettingsDocument, signal);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;;;ACA3B,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,mBAAmB;AAC5B,OAAO,cAAc;AAErB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,yBAAyB,oBAAI,IAAoB;AACvD,IAAM,wBAAwB,oBAAI,IAAY;AAC9C,IAAM,uBAAuB;AAC7B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAI,oBAAiC;AACrC,IAAI,8BAAmD,YAAY;AACnE,IAAI,kCAAuD,YAAY;AACvE,IAAI,gCAAqD,YAAY;AACrE,IAAI,6BAAkD,YAAY;AA0E3D,SAAS,kBAAkB;AAChC,SAAO,KAAK,KAAK,YAAY,GAAG,gBAAgB;AAClD;AAEO,SAAS,wBAAwB;AACtC,SAAO,KAAK,KAAK,YAAY,GAAG,uBAAuB;AACzD;AAEA,eAAsB,wBAAwB;AAC5C,QAAM,gBAAgB,gBAAgB;AACtC,QAAM,aAAa,sBAAsB;AACzC,SAAO,gCAAgC,YAAY;AACjD,QAAI,MAAM,WAAW,aAAa,EAAG,QAAO;AAC5C,WAAQ,MAAM,WAAW,UAAU,IAAK,aAAa;AAAA,EACvD,CAAC;AACH;AAEO,SAAS,oCAAoC;AAClD,QAAM,aAAa,gBAAgB;AACnC,QAAM,SAAS,uBAAuB,IAAI,UAAU;AACpD,yBAAuB,OAAO,UAAU;AACxC,SAAO;AACT;AAEA,eAAsB,yCAAmF;AACvG,QAAM,gBAAgB,gBAAgB;AACtC,QAAM,aAAa,sBAAsB;AACzC,SAAO,gCAAgC,YAAY;AACjD,UAAM,WAAY,MAAM,WAAW,aAAa,IAAK,gBAAgB;AACrE,UAAM,WAAW,MAAM,2BAA2B,QAAQ;AAC1D,WAAO,WAAW,EAAE,MAAM,UAAU,GAAG,SAAS,IAAI;AAAA,EACtD,CAAC;AACH;AAEA,eAAsB,iCACpB,sBAC0C;AAC1C,SAAO,gCAAgC,YAAY;AACjD,UAAM,aAAa,MAAM,uBAAuB,oBAAoB;AACpE,UAAM,WAAW,MAAM,2BAA2B,UAAU;AAC5D,WAAO,WAAW,EAAE,MAAM,YAAY,GAAG,SAAS,IAAI;AAAA,EACxD,CAAC;AACH;AAEA,eAAe,gCAAmC,MAAoC;AACpF,MAAK,MAAM,WAAW,gBAAgB,CAAC,KAAO,MAAM,WAAW,sBAAsB,CAAC,GAAI;AACxF,WAAO,wBAAwB,IAAI;AAAA,EACrC;AACA,QAAM,gCAAgC;AACtC,MAAI,MAAM,WAAW,uBAAuB,CAAC,EAAG,QAAO,wBAAwB,IAAI;AACnF,SAAO,KAAK;AACd;AAEO,SAAS,0BACd,cACA,QACA,UACA,QACY;AACZ,SAAO,wBAAwB,YAAY;AACzC,YAAQ,eAAe;AACvB,UAAM,aAAa,MAAM,uBAAuB,QAAQ;AACxD,UAAM,WAAW,MAAM,2BAA2B,UAAU;AAC5D,UAAM,WAAW,WAAW,EAAE,MAAM,YAAY,GAAG,SAAS,IAAI;AAChE,UAAM,UAAU,WAAY,gBAAgB,SAAS,MAAM,IAAU,gBAAgB,YAAY;AACjG,UAAM,OAAO,OAAO,OAAO;AAC3B,aAAS,IAAI;AACb,YAAQ,eAAe;AACvB,QAAI,YAAY,KAAK,UAAU,SAAS,MAAM,MAAM,KAAK,UAAU,IAAI,EAAG,QAAO;AACjF,QAAI,SAAU,OAAM,mCAAmC,UAAU,IAAI;AAAA,QAChE,OAAM,gCAAgC,gBAAgB,GAAG,iBAAiB,IAAI,CAAC;AACpF,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,0BAA0B,OAAgC;AACxE,SAAO,wBAAwB,YAAY;AACzC,UAAM,QAAQ,iBAAiB,KAAK;AACpC,QAAI;AACF,YAAM,gCAAgC,gBAAgB,GAAG,KAAK;AAAA,IAChE,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,UAAU;AACtD,cAAM,IAAI,MAAM,wEAAwE;AAAA,MAC1F;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAMA,eAAe,mCAAmC,UAA+B,OAAgC;AAC/G,QAAM,YAAY,iBAAiB,KAAK;AACxC,QAAM,gBAAgB,gBAAgB;AACtC,MAAI,SAAS,SAAS,eAAe;AACnC,QAAI,CAAE,MAAM,2BAA2B,QAAQ,EAAI,OAAM,qBAAqB;AAC9E,QAAIA;AACJ,QAAI;AACF,MAAAA,aAAY,MAAM,gCAAgC,eAAe,SAAS;AAAA,IAC5E,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,UAAU;AACtD,cAAM,IAAI,MAAM,0EAA0E;AAAA,MAC5F;AACA,YAAM;AAAA,IACR;AACA,QAAI,CAAE,MAAM,2BAA2B,QAAQ,GAAI;AACjD,YAAM,2CAA2C,eAAeA,YAAW,SAAS;AACpF,YAAM,qBAAqB;AAAA,IAC7B;AACA;AAAA,EACF;AAEA,QAAM,iBAAiB,MAAM,6BAA6B,QAAQ;AAClE,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,gCAAgC,eAAe,SAAS;AAAA,EAC5E,SAAS,OAAO;AACd,UAAM,yBAAyB,eAAe,cAAc;AAC5D,QAAK,MAAgC,SAAS,UAAU;AACtD,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,8BAA8B;AACpC,QAAI,CAAE,MAAM,6BAA6B,gBAAgB,SAAS,UAAU,SAAS,KAAK,GAAI;AAC5F,YAAM,qBAAqB;AAAA,IAC7B;AACA,QAAI,QAAQ,aAAa,QAAS,OAAM,GAAG,MAAM,gBAAgB,GAAK;AAAA,EACxE,SAAS,OAAO;AACd,UAAM,2CAA2C,eAAe,WAAW,SAAS;AACpF,UAAM,yBAAyB,eAAe,cAAc;AAC5D,UAAM;AAAA,EACR;AACA,QAAM,GAAG,GAAG,cAAc,EAAE,MAAM,MAAM,MAAS;AACjD,QAAM,oBAAoB,aAAa,EAAE,MAAM,MAAM,MAAS;AAChE;AAEA,eAAe,uBAAuB,sBAAmE;AACvG,QAAM,gBAAgB,gBAAgB;AACtC,QAAM,aAAa,sBAAsB;AACzC,MAAI,MAAM,WAAW,aAAa,GAAG;AACnC,UAAM,eAAe,MAAM,6BAA6B,UAAU;AAClE,QAAI,iBAAiB,aAAa,CAAC,sBAAsB,IAAI,aAAa,GAAG;AAC3E,4BAAsB,IAAI,aAAa;AACvC;AAAA,QACE;AAAA,QACA,iBAAiB,YACb,GAAG,uBAAuB,yCAAyC,gBAAgB,6BAA6B,uBAAuB,qCACvI,GAAG,uBAAuB,yCAAyC,gBAAgB;AAAA,MACzF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,MAAM,2BAA2B,UAAU;AAC1D,MAAI,CAAC,OAAQ,QAAO;AACpB,uBAAqB,OAAO,MAAM;AAElC,MAAI;AACJ,MAAI;AACF,wBAAoB,MAAM,gCAAgC,eAAe,OAAO,KAAK;AAAA,EACvF,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,UAAU;AACtD;AAAA,QACE;AAAA,QACA,GAAG,uBAAuB,yCAAyC,gBAAgB;AAAA,MACrF;AACA,aAAO;AAAA,IACT;AACA;AAAA,MACE;AAAA,MACA,qBAAqB,uBAAuB,OAAO,gBAAgB;AAAA,IACrE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAE,MAAM,2BAA2B,YAAY,MAAM,GAAI;AAC3D,UAAM,UAAU,MAAM,2CAA2C,eAAe,mBAAmB,OAAO,KAAK;AAC/G;AAAA,MACE;AAAA,MACA,UACI,GAAG,uBAAuB,wCAAwC,gBAAgB,0EAClF,GAAG,uBAAuB,kCAAkC,gBAAgB;AAAA,IAClF;AACA,WAAO,UAAU,aAAa;AAAA,EAChC;AAEA,wBAAsB,IAAI,aAAa;AACvC;AAAA,IACE;AAAA,IACA,kCAAkC,uBAAuB,OAAO,gBAAgB;AAAA,EAClF;AACA,SAAO;AACT;AAEA,eAAe,6BAA6B,UAAkB;AAC5D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,GAAG,MAAM,QAAQ;AAAA,EACpC,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,WAAO;AAAA,EACT;AACA,MAAI,SAAS,eAAe,KAAK,CAAC,SAAS,OAAO,EAAG,QAAO;AAE5D,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,UAAU,GAAG;AACpC,UAAM,aAAa,MAAM,OAAO,KAAK;AACrC,QAAI,WAAW,QAAQ,SAAS,OAAO,WAAW,QAAQ,SAAS,KAAK;AACtE,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,aAAa,YAAY,WAAW,OAAO,SAAW,KAAO;AACvE,YAAM,OAAO,MAAM,GAAK;AAAA,IAC1B;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,UAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7C;AACF;AAEA,eAAe,2BAA2B,UAAuD;AAC/F,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,GAAG,MAAM,QAAQ;AAAA,EACpC,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACA,MAAI,SAAS,eAAe,GAAG;AAC7B,UAAM,IAAI,MAAM,8CAA8C,QAAQ,EAAE;AAAA,EAC1E;AACA,MAAI,CAAC,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,yCAAyC,QAAQ,EAAE;AAE3F,QAAM,SAAS,MAAM,GAAG,KAAK,UAAU,GAAG;AAC1C,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,KAAK;AACrC,QAAI,WAAW,QAAQ,SAAS,OAAO,WAAW,QAAQ,SAAS,KAAK;AACtE,YAAM,IAAI,MAAM,yCAAyC,QAAQ,EAAE;AAAA,IACrE;AACA,QAAI,QAAQ,aAAa,YAAY,WAAW,OAAO,SAAW,KAAO;AACvE,YAAM,OAAO,MAAM,GAAK;AAAA,IAC1B;AACA,UAAM,QAAQ,MAAM,OAAO,SAAS;AACpC,WAAO;AAAA,MACL;AAAA,MACA,UAAU,EAAE,KAAK,WAAW,KAAK,KAAK,WAAW,IAAI;AAAA,MACrD,QAAQ,kBAAkB,OAAO,QAAQ;AAAA,IAC3C;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,iBAAiB,OAAgC;AACxD,SAAO,OAAO,KAAK,GAAG,KAAK,UAAU,OAAO,MAAM,GAAI,CAAC;AAAA,GAAM,MAAM;AACrE;AAEA,SAAS,kBAAkB,OAAe,UAAkB;AAC1D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;AAAA,EAC5C,QAAQ;AACN,UAAM,IAAI,YAAY,mCAAmC,QAAQ,EAAE;AAAA,EACrE;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,8CAA8C,QAAQ,EAAE;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,eAAe,gCAAgC,UAAkB,OAAe;AAC9E,QAAM,GAAG,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1D,QAAM,gBAAgB,KAAK;AAAA,IACzB,KAAK,QAAQ,QAAQ;AAAA,IACrB,IAAI,KAAK,SAAS,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC;AAAA,EAC5D;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,eAAe,MAAM,GAAK;AACjD,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,QAAQ,aAAa,QAAS,OAAM,OAAO,MAAM,GAAK;AAC1D,UAAM,OAAO,KAAK;AAClB,UAAM,OAAO,MAAM;AACnB,aAAS;AACT,UAAM,kBAAkB,eAAe,QAAQ;AAC/C,UAAM,YAAY,MAAM,GAAG,MAAM,QAAQ;AACzC,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,UAAI,UAAU,eAAe,KAAK,CAAC,UAAU,OAAO,GAAG;AACrD,cAAM,IAAI,MAAM,sDAAsD,QAAQ,EAAE;AAAA,MAClF;AACA,wBAAkB,MAAM,GAAG,KAAK,UAAU,IAAI;AAC9C,YAAM,YAAY,MAAM,gBAAgB,KAAK;AAC7C,UAAI,UAAU,QAAQ,UAAU,OAAO,UAAU,QAAQ,UAAU,KAAK;AACtE,cAAM,IAAI,MAAM,qDAAqD,QAAQ,EAAE;AAAA,MACjF;AACA,UAAI,QAAQ,aAAa,QAAS,OAAM,gBAAgB,MAAM,GAAK;AACnE,YAAM,gBAAgB,KAAK;AAC3B,YAAM,oBAAoB,QAAQ;AAAA,IACpC,SAAS,OAAO;AACd,yBAAmB;AAAA,IACrB,UAAE;AACA,YAAM,iBAAiB,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IACtD;AACA,QAAI,kBAAkB;AACpB,YAAM,2CAA2C,UAAU,EAAE,KAAK,UAAU,KAAK,KAAK,UAAU,IAAI,GAAG,KAAK;AAC5G,YAAM;AAAA,IACR;AACA,WAAO,EAAE,KAAK,UAAU,KAAK,KAAK,UAAU,IAAI;AAAA,EAClD,UAAE;AACA,UAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAC3C,UAAM,GAAG,GAAG,eAAe,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACnE;AACF;AAEA,eAAe,2BAA2B,UAA+B;AACvE,SAAO,6BAA6B,SAAS,MAAM,SAAS,UAAU,SAAS,KAAK;AACtF;AAEA,eAAe,6BAA6B,UAA+B;AACzE,QAAM,iBAAiB,KAAK;AAAA,IAC1B,KAAK,QAAQ,SAAS,IAAI;AAAA,IAC1B,IAAI,KAAK,SAAS,SAAS,IAAI,CAAC,IAAI,WAAW,CAAC;AAAA,EAClD;AACA,MAAI;AACF,UAAM,GAAG,OAAO,SAAS,MAAM,cAAc;AAC7C,UAAM,oBAAoB,SAAS,IAAI;AAAA,EACzC,SAAS,OAAO;AACd,UAAM,yBAAyB,SAAS,MAAM,cAAc;AAC5D,UAAM;AAAA,EACR;AACA,MAAI,CAAE,MAAM,6BAA6B,gBAAgB,SAAS,UAAU,SAAS,KAAK,GAAI;AAC5F,UAAM,yBAAyB,SAAS,MAAM,cAAc;AAC5D,UAAM,qBAAqB;AAAA,EAC7B;AACA,MAAI,MAAM,WAAW,SAAS,IAAI,GAAG;AACnC,UAAM,yBAAyB,SAAS,MAAM,cAAc;AAC5D,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB;AAC9B,SAAO,IAAI,MAAM,uEAAuE;AAC1F;AAEA,eAAe,2BAA2B,UAAkB,UAA0B;AACpF,SAAO,6BAA6B,UAAU,SAAS,UAAU,SAAS,KAAK;AACjF;AAMA,eAAe,2CACb,UACA,UACA,eACA;AACA,QAAM,iBAAiB,KAAK;AAAA,IAC1B,KAAK,QAAQ,QAAQ;AAAA,IACrB,IAAI,KAAK,SAAS,QAAQ,CAAC,IAAI,WAAW,CAAC;AAAA,EAC7C;AACA,MAAI;AACF,UAAM,GAAG,OAAO,UAAU,cAAc;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,2BAA2B;AACjC,MAAI;AACF,UAAM,oBAAoB,QAAQ;AAAA,EACpC,QAAQ;AACN,UAAM,yBAAyB,UAAU,cAAc;AACvD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,MAAM,6BAA6B,gBAAgB,UAAU,aAAa;AAC1F,MAAI,CAAC,SAAS;AACZ,UAAM,yBAAyB,UAAU,cAAc;AACvD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,WAAW,QAAQ,GAAG;AAC9B,UAAM,GAAG,GAAG,gBAAgB,EAAE,OAAO,KAAK,CAAC;AAC3C,UAAM,oBAAoB,QAAQ;AAClC,WAAO;AAAA,EACT;AACA,QAAM,GAAG,GAAG,cAAc;AAC1B,QAAM,oBAAoB,QAAQ;AAClC,SAAO;AACT;AAEA,eAAe,6BAA6B,UAAkB,UAAwB,eAAuB;AAC3G,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,MAAM,QAAQ;AACvC,QAAI,QAAQ,eAAe,EAAG,QAAO;AACrC,QAAI,QAAQ,QAAQ,SAAS,OAAO,QAAQ,QAAQ,SAAS,IAAK,QAAO;AACzE,YAAQ,MAAM,GAAG,SAAS,QAAQ,GAAG,OAAO,aAAa;AAAA,EAC3D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,yBAAyB,UAAkB,gBAAwB;AAChF,MAAI;AACF,UAAM,6BAA6B,gBAAgB,QAAQ;AAC3D,QAAI,QAAQ,aAAa,QAAS,OAAM,GAAG,MAAM,UAAU,GAAK;AAChE,UAAM,oBAAoB,QAAQ;AAClC;AAAA,EACF,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU;AAAA,EAC1D;AACA,MAAI;AACF,QAAI,QAAQ,aAAa,QAAS,OAAM,GAAG,MAAM,gBAAgB,GAAK;AACtE,UAAM,oBAAoB,QAAQ;AAAA,EACpC,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,yBAAyB;AAChC,SAAO,GAAG,gBAAgB,CAAC;AAC7B;AAEA,eAAsB,wBAA2B,KAAmC;AAClF,QAAM,aAAa,gBAAgB;AACnC,QAAM,GAAG,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,MAAI;AACJ,QAAM,UAAU,MAAM,SAAS,KAAK,YAAY;AAAA,IAC9C,IAAI;AAAA,IACJ,cAAc,uBAAuB;AAAA,IACrC,UAAU;AAAA,IACV,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,EAAE,SAAS,KAAK,QAAQ,KAAK,YAAY,IAAI,YAAY,IAAI;AAAA,IACtE,eAAe,CAAC,UAAU;AACxB,yBAAmB;AAAA,IACrB;AAAA,EACF,CAAC;AACD,MAAI;AACF,UAAM,SAAS,MAAM,IAAI;AACzB,QAAI,iBAAkB,OAAM;AAC5B,WAAO;AAAA,EACT,UAAE;AACA,UAAM,QAAQ;AAAA,EAChB;AACF;AAEA,eAAe,oBAAoB,UAAkB;AACnD,MAAI,QAAQ,aAAa,QAAS;AAClC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,KAAK,QAAQ,QAAQ,GAAG,GAAG;AAClD,UAAM,OAAO,KAAK;AAAA,EACpB,UAAE;AACA,UAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7C;AACF;AAEA,eAAe,8BAA8B,QAAgB,aAAqB;AAChF,QAAM,4BAA4B;AAClC,QAAM,6BAA6B,QAAQ,WAAW;AACxD;AAEA,eAAe,6BAA6B,QAAgB,aAAqB;AAC/E,MAAI,MAAM,WAAW,WAAW,GAAG;AACjC,UAAM,OAAO,OAAO,IAAI,MAAM,2BAA2B,WAAW,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAAA,EAC7F;AACA,QAAM,GAAG,OAAO,QAAQ,WAAW;AACrC;AAEA,eAAe,WAAW,UAAkB;AAC1C,MAAI;AACF,UAAM,GAAG,MAAM,QAAQ;AACvB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACF;AAEA,SAAS,4BAA4B,YAAoB,QAAgB;AACvE,MAAI,CAAC,uBAAuB,IAAI,UAAU,EAAG,wBAAuB,IAAI,YAAY,MAAM;AAC5F;;;AC7lBA,OAAOC,WAAU;AAwBV,IAAM,oBAAoC;AAE1C,SAAS,kBAAkB,OAAgC;AAChE,MAAI,UAAU,qBAAqB,UAAU,uBAAuB,UAAU,eAAe;AAC3F,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,yBAAyB,OAAkD;AACzF,MAAI,MAAM,YAAY,KAAK,MAAM,YAAY,KAAK,MAAM,YAAY,GAAG;AACrE,UAAM,IAAI;AAAA,MACR,oFAAoFC,MAAK,SAAS,gBAAgB,CAAC,CAAC;AAAA,IACtH;AAAA,EACF;AACA;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,oBAAkB,MAAM,QAAQ;AAChC,MAAI,MAAM,mBAAmB,UAAa,OAAO,MAAM,mBAAmB,WAAW;AACnF,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,MAAI,MAAM,eAAe,UAAa,OAAO,MAAM,eAAe,WAAW;AAC3E,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,MAAI,MAAM,UAAU,UAAa,OAAO,MAAM,UAAU,WAAW;AACjE,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,QAAM,qBAAqB;AAAA,IACzB,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,sBAAsB,MAAM,YAAY,cAAc,YAAY;AACrF,aAAW,QAAQ,OAAO,KAAK,kBAAkB,GAAG;AAClD;AAAA,MACE;AAAA,MACA,iBAAiB,oBAAoB,MAAM,oBAAoB;AAAA,IACjE;AAAA,EACF;AACA,aAAW,QAAQ,OAAO,KAAK,UAAU,GAAG;AAC1C;AAAA,MACE;AAAA,MACA,iBAAiB,YAAY,MAAM,YAAY;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,OAAO,KAAK,UAAU;AACpC,QAAM,kBAAkB,2BAA2B,MAAM,iBAAiB,iBAAiB;AAC3F,MAAI,MAAM,WAAW,GAAG;AACtB,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AAAA,EACF,WAAW,CAAC,mBAAmB,CAAC,OAAO,OAAO,YAAY,eAAe,GAAG;AAC1E,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACA,aAAW,SAAS,OAAO,OAAO,UAAU,GAAG;AAC7C,UAAM,SAAU,MAA4B;AAC5C,QAAI,OAAO,gBAAgB,UAAa,MAAM,YAAY,KAAK,MAAM,YAAY;AAC/E,YAAM,IAAI,MAAM,8FAA8F;AAAA,EAClH;AACA,aAAW,SAAS,OAAO,OAAO,UAAU,GAAG;AAC7C,UAAM,SAAU,MAA4B;AAC5C,SAAK,OAAO,gBAAgB,OAAO,gBAAgB,MAAM,YAAY;AACnE,YAAM,IAAI,MAAM,4DAA4D;AAAA,EAChF;AACA,iCAA+B,YAAY,kBAAkB;AAC7D,SAAO;AACT;AAEA,SAAS,0BAA0B,MAAc,OAAgC;AAC/E;AAAA,IACE;AAAA,IACA,CAAC,QAAQ,eAAe,mBAAmB,gBAAgB,YAAY,UAAU;AAAA,IACjF,4BAAuB,IAAI;AAAA,EAC7B;AACA,QAAM,OAAO,eAAe,MAAM,MAAM,4BAAuB,IAAI,aAAQ;AAC3E,MAAI,SAAS,QAAQ,SAAS,SAAS,SAAS,UAAU;AACxD,UAAM,IAAI,MAAM,sDAAiD,IAAI,8BAAyB;AAAA,EAChG;AACA,QAAM,QAAQ,CAAC,YAAY,UAAU,UAAU,OAAO,aAAa;AACnE,QAAM,UACJ,SAAS,OACL,oBAAI,IAAI,CAAC,YAAY,UAAU,aAAa,CAAC,IAC7C,SAAS,QACP,oBAAI,IAAI,CAAC,QAAQ,CAAC,IAClB,oBAAI,IAAI,CAAC,OAAO,aAAa,CAAC;AACtC,MAAI,MAAM,KAAK,CAAC,UAAU,OAAO,OAAO,OAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG;AAC7E,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,YAAY,CAAC,6BAAwB,IAAI;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,SAAS,OAAO;AAClB,QAAI,CAAC,mBAAmB,eAAe,MAAM,QAAQ,wBAAmB,IAAI,QAAG,CAAC,GAAG;AACjF,YAAM,IAAI,MAAM,kDAA6C,IAAI,qBAAgB;AAAA,IACnF;AACA;AAAA,EACF;AACA,QAAM,cAAc,cAAc,MAAM,aAAa,4CAAuC,IAAI,QAAG;AACnG,MAAI,SAAS,UAAU;AACrB,uBAAmB,eAAe,MAAM,KAAK,wBAAmB,IAAI,QAAG,CAAC;AACxE,UAAM,WAAW,eAAe,YAAY,UAAU,6BAAwB,IAAI,QAAG;AACrF,UAAM,WAAW,eAAe,YAAY,UAAU,6BAAwB,IAAI,QAAG;AACrF,QAAI,CAAC,eAAe,mBAAmB,cAAc,EAAE,KAAK,CAAC,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,GAAG;AACzG,YAAM,IAAI,MAAM,0DAAqD,IAAI,oBAAe;AAAA,IAC1F;AACA,8BAA0B,UAAU,QAAQ;AAC5C;AAAA,EACF;AACA,sBAAoB,eAAe,MAAM,UAAU,yBAAoB,IAAI,QAAG,CAAC;AAC/E,iBAAe,MAAM,QAAQ,uBAAkB,IAAI,QAAG;AACtD,iBAAe,YAAY,aAAa,8BAAyB,IAAI,QAAG;AACxE,iBAAe,YAAY,iBAAiB,kCAA6B,IAAI,QAAG;AAChF,iBAAe,YAAY,cAAc,8BAAyB,IAAI,QAAG;AACzE,MAAI,CAAC,YAAY,UAAU,EAAE,KAAK,CAAC,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,GAAG;AAC/E,UAAM,IAAI,MAAM,sDAAiD,IAAI,oBAAe;AAAA,EACtF;AACF;AAEA,SAAS,kBAAkB,MAAc,OAAgC,aAAsC;AAC7G;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,oBAAe,IAAI;AAAA,EACrB;AACA,QAAM,UAAU,cAAc,MAAM,SAAS,gCAA2B,IAAI,QAAG;AAC/E,QAAM,OAAO,cAAc,MAAM,MAAM,oCAA+B,IAAI,QAAG;AAC7E,qBAAmB,SAAS,CAAC,WAAW,UAAU,aAAa,WAAW,GAAG,gCAA2B,IAAI,QAAG;AAC/G;AAAA,IACE;AAAA,IACA,CAAC,YAAY,aAAa,gBAAgB,YAAY;AAAA,IACtD,oCAA+B,IAAI;AAAA,EACrC;AACA,QAAM,iBAAiB;AAAA,IACrB,QAAQ;AAAA,IACR,qDAAgD,IAAI;AAAA,EACtD;AACA,qBAAmB,gBAAgB,8BAA8B;AACjE,QAAM,aAAa,UAAmC,aAAa,cAAc;AACjF,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,8CAAyC,IAAI,sDAA4C,cAAc;AAAA,IACzG;AAAA,EACF;AACA,QAAM,OAAO,WAAW;AACxB,uBAAqB,eAAe,QAAQ,MAAM,qCAAgC,IAAI,QAAG,CAAC;AAC1F,MAAI,SAAS,MAAM;AACjB,sBAAkB,eAAe,QAAQ,QAAQ,kCAA6B,IAAI,QAAG,CAAC;AACtF,QAAI,OAAO,OAAO,SAAS,QAAQ,EAAG,iBAAgB,MAAM,IAAI;AAAA,EAClE,WAAW,SAAS,OAAO;AACzB,uBAAmB,eAAe,QAAQ,QAAQ,mCAA8B,IAAI,QAAG,CAAC;AACxF,QAAI,OAAO,OAAO,SAAS,QAAQ,EAAG,iBAAgB,OAAO,IAAI;AAAA,EACnE,WAAW,SAAS,UAAU;AAC5B,QAAI,OAAO,OAAO,SAAS,QAAQ,KAAK,OAAO,OAAO,SAAS,QAAQ,GAAG;AACxE,sBAAgB,UAAU,IAAI;AAAA,IAChC;AAAA,EACF;AACA,MAAI,CAAC,OAAO,OAAO,MAAM,SAAS,GAAG;AACnC,UAAM,IAAI,MAAM,8CAAyC,IAAI,iCAA4B;AAAA,EAC3F;AACA,QAAM,UAAU,qBAAqB,KAAK,OAAO;AACjD,QAAM,cAAc,qBAAqB,KAAK,WAAW;AACzD,MAAI,YAAY,SAAS,KAAK,CAAC,QAAQ,SAAS,eAAe;AAC7D,UAAM,IAAI,MAAM,8DAA8D;AAChF,aAAW,OAAO,CAAC,gBAAgB,eAAe,aAAa,YAAY;AACzE,QAAI,KAAK,GAAG,MAAM,UAAa,OAAO,KAAK,GAAG,MAAM,UAAW,OAAM,IAAI,MAAM,GAAG,GAAG,mBAAmB;AAC1G,MAAI,KAAK,kBAAkB,UAAa,OAAO,KAAK,kBAAkB;AACpE,UAAM,IAAI,MAAM,gCAAgC;AAClD,MAAI,KAAK,sBAAsB,UAAa,OAAO,KAAK,sBAAsB,WAAW;AACvF,UAAM,IAAI,MAAM,8CAAyC,IAAI,gDAA2C;AAAA,EAC1G;AACA,MAAI,OAAO,KAAK,cAAc,WAAW;AACvC,UAAM,IAAI,MAAM,8CAAyC,IAAI,wCAAmC;AAAA,EAClG;AACF;AAEA,SAAS,gBAAgB,MAAc,MAAqB;AAC1D,QAAM,IAAI,MAAM,6BAA6B,IAAI,qBAAgB,IAAI,8BAAyB;AAChG;AAEO,SAAS,+BAA+B,QAAiC,aAAsC;AACpH,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,QAAQ,OAAO,KAAK,MAAM,GAAG;AACtC,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,YAAY;AACzD,UAAM,aAAa;AAAA,MACjB;AAAA,MACA,MAAM,QAAQ;AAAA,MACd;AAAA,IACF;AACA,UAAM,WAAW,iCAAiC,OAAO,UAAU;AACnE,UAAM,WAAW,WAAW,IAAI,QAAQ;AACxC,QAAI,UAAU;AACZ,YAAM,IAAI;AAAA,QACR,+CAA0C,QAAQ,oBAAU,IAAI;AAAA,MAClE;AAAA,IACF;AACA,eAAW,IAAI,UAAU,IAAI;AAAA,EAC/B;AACF;AAEO,SAAS,iCAAiC,OAA0B,YAAuC;AAChH,QAAM,cAAc,qBAAqB,MAAM,QAAQ,IAAI;AAC3D,MAAI,WAAW,SAAS,OAAO;AAC7B,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,MACA,2BAA2B,WAAW,MAAM;AAAA,MAC5C,mBAAmB,MAAM,QAAQ,MAAM;AAAA,MACvC,sBAAsB,WAAW;AAAA,IACnC,CAAC;AAAA,EACH;AACA,MAAI,WAAW,SAAS,UAAU;AAChC,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,MACA,2BAA2B,WAAW,GAAG;AAAA,MACzC,WAAW,YAAY,SAAS,KAAK;AAAA,MACrC,oBAAoB,WAAW;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA,0BAA0B,WAAW,QAAQ;AAAA,IAC7C,kBAAkB,MAAM,QAAQ,MAAM;AAAA,IACtC;AAAA,EACF,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAgC,QAA2B,SAAiB;AACtG,QAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,OAAO,OAAO,OAAO,SAAS,CAAC;AACxE,MAAI,OAAO;AACT,UAAM,IAAI,MAAM,6BAA6B,OAAO,iDAA4C,KAAK,SAAI;AAAA,EAC3G;AACF;AAEA,SAAS,sBAAsB,OAAgB,OAAe,WAAmB;AAC/E,QAAM,SAAS,cAAc,OAAO,KAAK;AACzC,aAAW,QAAQ,OAAO,KAAK,MAAM,EAAG,oBAAmB,MAAM,SAAS;AAC1E,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAgC,KAAa,OAAe;AACpF,QAAM,OAAO,UAAU,OAAO,GAAG;AACjC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,6BAA6B,KAAK,UAAK,GAAG,2BAAsB;AAC3F,SAAO;AACT;AAEO,SAAS,UAA4B,OAAgC,KAA4B;AACtG,MAAI,CAAC,OAAO,OAAO,OAAO,GAAG,EAAG,QAAO;AACvC,QAAM,OAAO,MAAM,GAAG;AACtB,SAAO,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,IAAK,OAAa;AAClF;AAEA,SAAS,cAAc,OAAgB,OAAwC;AAC7E,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,6BAA6B,KAAK,qBAAqB;AAAA,EACzE;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAe,OAAe;AAC/D,MACE,CAAC,MAAM,KAAK,KACZ,UAAU,MAAM,KAAK,KACrB,MAAM,SAAS,OACf,UAAU,eACV,UAAU,eACV,UAAU,iBACV,oBAAoB,KAAK,GACzB;AACA,UAAM,IAAI,MAAM,qCAAqC,KAAK,QAAQ;AAAA,EACpE;AACF;AAEO,SAAS,eAAe,OAAgB,OAAe;AAC5D,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,KAAK,oBAAoB,KAAK,GAAG;AAC5E,UAAM,IAAI,MAAM,6BAA6B,KAAK,8BAA8B;AAAA,EAClF;AACA,SAAO,MAAM,KAAK;AACpB;AAEA,SAAS,2BAA2B,OAAgB,OAAe;AACjE,QAAM,aAAa,eAAe,OAAO,KAAK;AAC9C,MAAI,UAAU,YAAY;AACxB,UAAM,IAAI,MAAM,6BAA6B,KAAK,wCAAwC;AAAA,EAC5F;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,OAAgB,OAAe;AACjE,QAAM,aAAa,eAAe,OAAO,KAAK;AAC9C,MAAI,eAAe,UAAa,UAAU,YAAY;AACpD,UAAM,IAAI,MAAM,6BAA6B,KAAK,wCAAwC;AAAA,EAC5F;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,OAAe;AACrD,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,oBAAoB,KAAK,GAAG;AACrE,UAAM,IAAI,MAAM,6BAA6B,KAAK,sBAAsB;AAAA,EAC1E;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAAgB,OAAe;AAC5D,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,oBAAoB,KAAK,GAAG;AAC3D,UAAM,IAAI,MAAM,6BAA6B,KAAK,oBAAoB;AAAA,EACxE;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEO,SAAS,qBAAqB,OAAe;AAClD,MAAI,MAAM,KAAK,MAAM,OAAO,MAAM,KAAK,MAAM,KAAM,QAAO;AAC1D,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,eAAe,EAAE;AACzD,MACE,CAAC,cACD,WAAW,SAAS,QACpB,WAAW,WAAW,GAAG,KACzB,WAAW,SAAS,IAAI,KACxB,oBAAoB,UAAU,KAC9B,WAAW,MAAM,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW,YAAY,OAAO,YAAY,IAAI,GACvF;AACA,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,OAAe;AACjD,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACA,QAAM,WAAW,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;AAClG,MACG,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAC5D,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,MACJ;AACA,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MAAI,WAAW,IAAI,SAAS,QAAQ,UAAU,EAAE;AAChD,SAAO,IAAI,SAAS,EAAE,QAAQ,QAAQ,EAAE;AAC1C;AAEO,SAAS,kBAAkB,OAA2B;AAC3D,QAAM,SAAS,eAAe,OAAO,WAAW;AAChD,MAAI,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,WAAW,GAAG,GAAG;AAC3E,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAe;AAE1C,SAAO,gCAAgC,KAAK,KAAK;AACnD;AAEO,SAAS,uBAAuB,UAA8B;AACnE,QAAM,QAAQ,UAAU,KAAK;AAC7B,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,KAAK,EAAE,SAAS,YAAY;AACrD,WAAO,aAAa,8BAA8B,SAAS,SAAS,2BAA2B;AAAA,EACjG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,OAAqD;AAC7E,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC;AAC5G;;;AC1aA,IAAI,oBAAmC,QAAQ,QAAQ;AAEvD,eAAsB,kBAAkB;AACtC,QAAM,WAAW,MAAM,sBAAsB;AAC7C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,0EAA0E,gBAAgB,CAAC,GAAG;AAAA,EAChH;AACA,SAAO;AACT;AAEA,eAAsB,2BAA2B;AAC/C,QAAM,WAAW,MAAM,sBAAsB;AAC7C,SAAO,WAAW,OAAO,KAAK,SAAS,UAAU,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,IAAI,CAAC;AACzG;AAEA,eAAsB,eAAwC;AAC5D,UAAQ,MAAM,gBAAgB,GAAG;AACnC;AAEO,SAAS,sBAAwC;AACtD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,oBAAoB,CAAC;AAAA,IACrB,YAAY,CAAC;AAAA,EACf;AACF;AAEA,eAAsB,0BAA0B;AAC9C,QAAM,WAAW,MAAM,iCAAiC,CAAC,aAAa;AACpE,6BAAyB,QAAQ;AAAA,EACnC,CAAC;AACD,MAAI,SAAU,0BAAyB,SAAS,MAAM;AACtD,SAAO;AACT;AAEA,eAAsB,wBAA+D;AACnF,UAAQ,MAAM,wBAAwB,IAAI;AAC5C;AAEO,SAAS,kBAAkB,QAAyD,QAAsB;AAC/G,QAAM,YAAY,kBAAkB,KAAK,MAAM;AAC7C,YAAQ,eAAe;AACvB,WAAO,yBAAyB,QAAQ,MAAM;AAAA,EAChD,CAAC;AACD,sBAAoB,UAAU;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,eAAe,yBAAyB,QAAyD,QAAsB;AACrH,SAAO,0BAA0B,oBAAoB,GAAG,QAAQ,0BAA0B,MAAM;AAClG;;;AHhCA,eAAsB,WAAW,WAA4C;AAC3E,SAAO,mBAAmB,MAAM,gBAAgB,GAAG,SAAS;AAC9D;AAGA,eAAsB,qBAA6C;AACjE,QAAM,WAAW,MAAM,uCAAuC;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,6BAA6B,gBAAgB,CAAC,EAAE;AAC/E,2BAAyB,SAAS,MAAM;AACxC,SAAO,mBAAmB,SAAS,MAA0B;AAC/D;AAEA,SAAS,mBAAmB,UAA4B,WAAmC;AACzF,QAAM,eAAe,aAAa,SAAS;AAC3C,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,gCAAgC;AACnE,qBAAmB,cAAc,YAAY;AAC7C,QAAM,QAAQ,UAA6B,SAAS,YAAY,YAAY;AAC5E,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,8CAAyC,YAAY,uBAAkB;AACnG,QAAM,iBAAiB,MAAM,QAAQ;AACrC,QAAM,aAAa,UAAqC,SAAS,oBAAoB,cAAc;AACnG,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,8CAAyC,YAAY,sDAA4C,cAAc;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,MACD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,SAAS,kBAAkB;AAAA,MAC3B,SAAS,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,SAAS,SAAS;AAAA,EAC3B;AACF;AAQA,eAAsB,kBAAkB,WAA4C;AAClF,QAAM,SAAS,MAAM,WAAW,SAAS;AACzC,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,GAAG,wBAAwB,MAAM;AAAA,IACjC,SAAS,CAAC,GAAG,OAAO,OAAO;AAAA,IAC3B,WAAW,OAAO;AAAA,IAClB,mBAAmB,OAAO,qBAAqB;AAAA,IAC/C,WAAW,OAAO,aAAa;AAAA,IAC/B,YAAY,OAAO,cAAc;AAAA,IACjC,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,EACrB;AACF;AAEO,SAAS,uBACd,WACA,OACA,gBACA,YACwB;AACxB,SAAO;AAAA,IACL,kBAAkB,WAAW,OAAO,gBAAgB,YAAY,mBAAmB,OAAO,IAAI;AAAA,EAChG;AACF;AAEO,SAAS,wBACd,WACA,OACA,gBACA,YACA;AACA,SAAO;AAAA,IACL,kBAAkB,WAAW,OAAO,gBAAgB,YAAY,mBAAmB,OAAO,IAAI;AAAA,EAChG;AACF;AAEO,SAAS,yBAAyB,QAAuB;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,OAAO;AAAA,IACP,OAAO;AAAA,IACP,2BAA2B,MAAM;AAAA,IACjC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO,qBAAqB;AAAA,IAC5B,OAAO,aAAa;AAAA,IACpB,OAAO;AAAA,IACP,OAAO,iBAAiB;AAAA,IACxB,OAAO,gBAAgB;AAAA,IACvB,OAAO,eAAe;AAAA;AAAA,IAEtB,GAAI,OAAO,aAAa,CAAC,YAAY,IAAI,CAAC;AAAA,EAC5C,CAAC;AACH;AAEO,SAAS,4BAA4B,QAAuB;AACjE,SAAO,WAAW,QAAQ,EAAE,OAAO,yBAAyB,MAAM,CAAC,EAAE,OAAO,KAAK;AACnF;AAGO,SAAS,2BAA2B,QAAuB;AAChE,SAAO,WAAW,QAAQ,EACvB,OAAO,KAAK,UAAU,EAAE,GAAG,QAAQ,YAAY,QAAW,OAAO,OAAU,CAAC,CAAC,EAC7E,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,QAA+C;AAC9E,SAAO;AAAA,IACL,gBAAgB,OAAO;AAAA,IACvB,aAAa,OAAO,QAAQ;AAAA,IAC5B,aAAa,OAAO;AAAA,IACpB,GAAI,OAAO,QAAQ,SAAS,OACxB,EAAE,QAAQ,OAAO,QAAQ,YAAY,OAAO,IAC5C,OAAO,QAAQ,SAAS,QACtB,EAAE,QAAQ,OAAO,QAAQ,YAAY,OAAO,IAC5C,CAAC;AAAA,EACT;AACF;AAEA,SAAS,kBACP,WACA,OACA,gBACA,YACA,UACA,gBACA,YACe;AACf,QAAM,cAAc,qBAAqB,MAAM,QAAQ,IAAI;AAC3D,QAAM,YAAY,gBAAgB,OAAO,SAAS,YAAY,MAAM,YAAY,YAAY,GAAG,IAAI,CAAC;AACpG,QAAM,UAAU,qBAAqB,MAAM,KAAK,OAAO;AACvD,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,IACA,WAAW,MAAM,KAAK;AAAA,IACtB,mBAAmB,MAAM,KAAK,qBAAqB;AAAA,IACnD,WAAW,MAAM,KAAK,aAAa;AAAA,IACnC,YAAY,MAAM,KAAK,cAAc;AAAA,IACrC,aAAa,MAAM,KAAK,gBAAgB,SAAY,SAAY,qBAAqB,MAAM,KAAK,WAAW;AAAA,IAC3G,eAAe,MAAM,KAAK,iBAAiB;AAAA,IAC3C,cAAc,MAAM,KAAK,gBAAgB;AAAA,IACzC,aAAa,MAAM,KAAK,eAAe;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,WAAW,SAAS,OAAO;AAC7B,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACP,MAAM;AAAA,QACN,SAAS,EAAE,MAAM,OAAO,QAAQ,mBAAmB,WAAW,MAAM,EAAY;AAAA,QAChF,aAAa;AAAA,UACX,QAAQ,mBAAmB,MAAM,QAAQ,MAAM;AAAA,UAC/C,WAAW,sBAAsB,WAAW;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,WAAW,SAAS,UAAU;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACP,MAAM;AAAA,QACN,SAAS;AAAA,UACP,MAAM;AAAA,UACN,KAAK,mBAAmB,WAAW,GAAG;AAAA,UACtC,UAAU,WAAW,YAAY;AAAA,UACjC,UAAU,WAAW,YAAY;AAAA,QACnC;AAAA,QACA,aAAa,EAAE,MAAM,oBAAoB,WAAW,GAAG,UAAU;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,QACP,MAAM,uBAAuB,WAAW,QAAQ,IAAI,OAAO;AAAA,QAC3D,UAAU,oBAAoB,WAAW,QAAQ;AAAA,QACjD,QAAQ,eAAe,WAAW,QAAQ,WAAW;AAAA,QACrD,aAAa,WAAW,YAAY;AAAA,QACpC,iBAAiB,WAAW,YAAY;AAAA,QACxC,cAAc,eAAe,WAAW,YAAY,cAAc,kBAAkB;AAAA,MACtF;AAAA,MACA,aAAa;AAAA,QACX,QAAQ,kBAAkB,MAAM,QAAQ,MAAM;AAAA,QAC9C,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,QAAsD;AACzF,MAAI,CAAC,uBAAuB,OAAO,QAAQ,KAAK,CAAC,OAAO,aAAc,QAAO,CAAC;AAC9E,SAAO;AAAA,IACL;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,QAAwC;AAC3E,MAAI,CAAC,OAAO,QAAQ,SAAS,UAAU,EAAG,QAAO,CAAC;AAClD,SAAO;AAAA,IACL;AAAA,EACF;AACF;AAEO,SAAS,UAAU,OAAqC,cAAuB;AACpF,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,SAAO,CAAC,CAAC,KAAK,SAAS,MAAM,KAAK,EAAE,SAAS,MAAM,KAAK,EAAE,YAAY,CAAC;AACzE;AAEO,SAAS,oBAAoB,OAAqC;AACvE,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,SAAO,CAAC,KAAK,QAAQ,OAAO,IAAI,EAAE,SAAS,OAAO,KAAK,EAAE,YAAY,KAAK,EAAE;AAC9E;",
+  "names": ["installed", "path", "path"]
+}

package/dist/chunks/{chunk-PQW6GS4J.ts → chunk-STVQQ5KG.ts}

@@ -1,27 +1,29 @@
 // @generated by scripts/build-runtime.mjs; do not edit.
 // @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
-import {
-  createSyncBackend
-} from "./chunk-ORGBI36T.ts";
 import {
   fileHashMap,
   hasLocalChanges,
   remoteChangedSinceState
-} from "./chunk-BDB4IDM3.ts";
+} from "./chunk-JY2RVOUL.ts";
+import {
+  createSyncBackend
+} from "./chunk-RAMHGOX2.ts";
 import {
   createStartupTimings
 } from "./chunk-M6VQJIOU.ts";
 import {
   throwIfAborted
 } from "./chunk-PWMWOJP4.ts";
-import {
-  createSnapshot,
-  inspectRemoteSelection
-} from "./chunk-QOFMXPM5.ts";
 import {
   readStateForConfig,
   syncStateFingerprint
-} from "./chunk-UPNVIUBN.ts";
+} from "./chunk-73MDIVYJ.ts";
+import {
+  createSnapshot
+} from "./chunk-PHANBTVM.ts";
+import {
+  inspectRemoteSelection
+} from "./chunk-DFJGTVPX.ts";
 
 // src/sync/sync-inspection.ts
 import { createHash } from "node:crypto";
@@ -59,4 +61,4 @@ async function inspectSync(config, options, signal, factory = createSyncBackend,
 export {
   inspectSync
 };
-//# sourceMappingURL=chunk-PQW6GS4J.ts.map
+//# sourceMappingURL=chunk-STVQQ5KG.ts.map

package/dist/chunks/{chunk-PQW6GS4J.ts.map → chunk-STVQQ5KG.ts.map}

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../../src/sync/sync-inspection.ts"],
   "sourcesContent": ["import { createHash } from \"node:crypto\";\nimport { createSyncBackend, type SyncBackendFactory } from \"../backends/backend-factory.js\";\nimport type { AnySyncConfig } from \"../settings/settings-types.js\";\nimport { createSnapshot } from \"../snapshot/snapshot.js\";\nimport type { SnapshotOptions } from \"../snapshot/snapshot-types.js\";\nimport { readStateForConfig, syncStateFingerprint } from \"../state/sync-state-store.js\";\nimport { throwIfAborted } from \"./signals.js\";\nimport { createStartupTimings, type StartupTimings } from \"./startup-timings.js\";\nimport { inspectRemoteSelection } from \"./sync-policy.js\";\nimport { fileHashMap, hasLocalChanges, remoteChangedSinceState } from \"./sync-state.js\";\n\n/** Advisory baseline-relative observation, never an authorization to transfer files. */\nexport async function inspectSync(\n  config: AnySyncConfig,\n  options: SnapshotOptions,\n  signal?: AbortSignal,\n  factory: SyncBackendFactory = createSyncBackend,\n  timings: StartupTimings = createStartupTimings(),\n) {\n  throwIfAborted(signal);\n  const backend = await timings.measure(\"backend initialization\", () => factory(config));\n  throwIfAborted(signal);\n  const local = await timings.measure(\"local snapshot\", () =>\n    createSnapshot(config.snapshotIdentity, { ...options, signal }),\n  );\n  throwIfAborted(signal);\n  const state = await timings.measure(\"sync state read\", () => readStateForConfig(config));\n  throwIfAborted(signal);\n  const head = await timings.measure(\"remote head\", () => backend.readHead(signal));\n  throwIfAborted(signal);\n  const freshness: { localIdentity?: string } = {\n    localIdentity: createHash(\"sha256\")\n      .update(JSON.stringify(fileHashMap(local)))\n      .digest(\"hex\"),\n  };\n  return {\n    ...freshness,\n    head,\n    selectionState: head ? inspectRemoteSelection(config.include, { selection: head.selection, files: [] }) : undefined,\n    localFiles: local.files.length,\n    localChanged: hasLocalChanges(local, state, config),\n    remoteChanged: remoteChangedSinceState(head, state, config, (left, right) => backend.sameRevision(left, right)),\n    firstSync: !state.lastAppliedSnapshot,\n    emptyInclude: config.include.length === 0,\n    stateIdentity: syncStateFingerprint(state),\n    destination: backend.destination,\n    capability: backend.capability,\n  };\n}\n\nexport type SyncInspection = Awaited<ReturnType<typeof inspectSync>>;\n\nexport interface StartupObservation {\n  setupName: string;\n  configIdentity: string;\n  checkedAt: string;\n  automaticTransfer?: boolean;\n  inspection: SyncInspection;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAY3B,eAAsB,YACpB,QACA,SACA,QACA,UAA8B,mBAC9B,UAA0B,qBAAqB,GAC/C;AACA,iBAAe,MAAM;AACrB,QAAM,UAAU,MAAM,QAAQ,QAAQ,0BAA0B,MAAM,QAAQ,MAAM,CAAC;AACrF,iBAAe,MAAM;AACrB,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAAQ;AAAA,IAAkB,MACpD,eAAe,OAAO,kBAAkB,EAAE,GAAG,SAAS,OAAO,CAAC;AAAA,EAChE;AACA,iBAAe,MAAM;AACrB,QAAM,QAAQ,MAAM,QAAQ,QAAQ,mBAAmB,MAAM,mBAAmB,MAAM,CAAC;AACvF,iBAAe,MAAM;AACrB,QAAM,OAAO,MAAM,QAAQ,QAAQ,eAAe,MAAM,QAAQ,SAAS,MAAM,CAAC;AAChF,iBAAe,MAAM;AACrB,QAAM,YAAwC;AAAA,IAC5C,eAAe,WAAW,QAAQ,EAC/B,OAAO,KAAK,UAAU,YAAY,KAAK,CAAC,CAAC,EACzC,OAAO,KAAK;AAAA,EACjB;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,gBAAgB,OAAO,uBAAuB,OAAO,SAAS,EAAE,WAAW,KAAK,WAAW,OAAO,CAAC,EAAE,CAAC,IAAI;AAAA,IAC1G,YAAY,MAAM,MAAM;AAAA,IACxB,cAAc,gBAAgB,OAAO,OAAO,MAAM;AAAA,IAClD,eAAe,wBAAwB,MAAM,OAAO,QAAQ,CAAC,MAAM,UAAU,QAAQ,aAAa,MAAM,KAAK,CAAC;AAAA,IAC9G,WAAW,CAAC,MAAM;AAAA,IAClB,cAAc,OAAO,QAAQ,WAAW;AAAA,IACxC,eAAe,qBAAqB,KAAK;AAAA,IACzC,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,EACtB;AACF;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAY3B,eAAsB,YACpB,QACA,SACA,QACA,UAA8B,mBAC9B,UAA0B,qBAAqB,GAC/C;AACA,iBAAe,MAAM;AACrB,QAAM,UAAU,MAAM,QAAQ,QAAQ,0BAA0B,MAAM,QAAQ,MAAM,CAAC;AACrF,iBAAe,MAAM;AACrB,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAAQ;AAAA,IAAkB,MACpD,eAAe,OAAO,kBAAkB,EAAE,GAAG,SAAS,OAAO,CAAC;AAAA,EAChE;AACA,iBAAe,MAAM;AACrB,QAAM,QAAQ,MAAM,QAAQ,QAAQ,mBAAmB,MAAM,mBAAmB,MAAM,CAAC;AACvF,iBAAe,MAAM;AACrB,QAAM,OAAO,MAAM,QAAQ,QAAQ,eAAe,MAAM,QAAQ,SAAS,MAAM,CAAC;AAChF,iBAAe,MAAM;AACrB,QAAM,YAAwC;AAAA,IAC5C,eAAe,WAAW,QAAQ,EAC/B,OAAO,KAAK,UAAU,YAAY,KAAK,CAAC,CAAC,EACzC,OAAO,KAAK;AAAA,EACjB;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,gBAAgB,OAAO,uBAAuB,OAAO,SAAS,EAAE,WAAW,KAAK,WAAW,OAAO,CAAC,EAAE,CAAC,IAAI;AAAA,IAC1G,YAAY,MAAM,MAAM;AAAA,IACxB,cAAc,gBAAgB,OAAO,OAAO,MAAM;AAAA,IAClD,eAAe,wBAAwB,MAAM,OAAO,QAAQ,CAAC,MAAM,UAAU,QAAQ,aAAa,MAAM,KAAK,CAAC;AAAA,IAC9G,WAAW,CAAC,MAAM;AAAA,IAClB,cAAc,OAAO,QAAQ,WAAW;AAAA,IACxC,eAAe,qBAAqB,KAAK;AAAA,IACzC,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,EACtB;AACF;",
   "names": []
 }

package/dist/chunks/{chunk-76NB4R7U.ts → chunk-TO2GMX3K.ts}

@@ -2,7 +2,7 @@
 // @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
 import {
   isDeniedPath
-} from "./chunk-HUZ5CR4W.ts";
+} from "./chunk-YZ5BQNRZ.ts";
 
 // src/sync/file-merge-planner.ts
 import { createHash } from "node:crypto";
@@ -104,4 +104,4 @@ export {
   mergePathIdentity,
   collidingPaths
 };
-//# sourceMappingURL=chunk-76NB4R7U.ts.map
+//# sourceMappingURL=chunk-TO2GMX3K.ts.map

package/dist/chunks/{chunk-GSNPASKB.ts → chunk-U77DWNRH.ts}

@@ -1,19 +1,19 @@
 // @generated by scripts/build-runtime.mjs; do not edit.
 // @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
-import {
-  setSyncStatus
-} from "./chunk-K3RIEL6J.ts";
 import {
   safeTerminalText
 } from "./chunk-AMJRUXFT.ts";
+import {
+  setSyncStatus
+} from "./chunk-K3RIEL6J.ts";
 import {
   syncCheckConfigFingerprint,
   syncConfigReviewFingerprint
-} from "./chunk-QO333NM4.ts";
+} from "./chunk-RX3WGWVL.ts";
 import {
   compareSyncInclude,
   sameSyncInclude
-} from "./chunk-QOFMXPM5.ts";
+} from "./chunk-DFJGTVPX.ts";
 
 // src/ui/sync-attention.ts
 import { truncateToWidth } from "@earendil-works/pi-tui";
@@ -164,4 +164,4 @@ export {
   observationMatchesConfig,
   observationSummary
 };
-//# sourceMappingURL=chunk-GSNPASKB.ts.map
+//# sourceMappingURL=chunk-U77DWNRH.ts.map

package/dist/chunks/{chunk-U3XRI2HF.ts → chunk-UCD7TQDT.ts}

@@ -1,15 +1,18 @@
 // @generated by scripts/build-runtime.mjs; do not edit.
 // @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
+import {
+  automaticSyncSummary
+} from "./chunk-ECYCNZOE.ts";
 import {
   addStorageConnection,
   addSyncSetup,
   saveNewV3Settings,
   updateStorageConnection,
   updateSyncSetup
-} from "./chunk-B4QZBDBT.ts";
+} from "./chunk-JXWTEJS5.ts";
 import {
-  automaticSyncSummary
-} from "./chunk-ECYCNZOE.ts";
+  syncErrorGuidance
+} from "./chunk-G4RUXRWZ.ts";
 import {
   AUTOMATIC_SYNC_DESCRIPTION,
   setSyncSetupCompletions
@@ -17,9 +20,6 @@ import {
 import {
   safeTerminalText
 } from "./chunk-AMJRUXFT.ts";
-import {
-  syncErrorGuidance
-} from "./chunk-G4RUXRWZ.ts";
 import {
   errorMessage
 } from "./chunk-7D5SF7P3.ts";
@@ -33,13 +33,10 @@ import {
   readLocalConfigObject,
   requiredString,
   validateConfigName
-} from "./chunk-QO333NM4.ts";
+} from "./chunk-RX3WGWVL.ts";
 import {
   throwIfAborted
 } from "./chunk-PWMWOJP4.ts";
-import {
-  DEFAULT_SYNC_INCLUDE
-} from "./chunk-QOFMXPM5.ts";
 import {
   normalizeWebDavPath,
   normalizeWebDavUrl,
@@ -50,6 +47,9 @@ import {
   normalizeGitDirectory,
   normalizeGitRemote
 } from "./chunk-T2SJD3N7.ts";
+import {
+  DEFAULT_SYNC_INCLUDE
+} from "./chunk-DFJGTVPX.ts";
 
 // src/commands/setup-completions.ts
 async function refreshTargetCompletions() {
@@ -1031,4 +1031,4 @@ export {
   showAddWebDavStorageProfile,
   showEditWebDavStorageProfile
 };
-//# sourceMappingURL=chunk-U3XRI2HF.ts.map
+//# sourceMappingURL=chunk-UCD7TQDT.ts.map

package/dist/chunks/{chunk-A6HU4ERM.ts → chunk-UGSSZWQ6.ts}

@@ -1,35 +1,19 @@
 // @generated by scripts/build-runtime.mjs; do not edit.
 // @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
 import {
-  regenerateSnapshotIdentity
-} from "./chunk-QOFMXPM5.ts";
+  normalizeLocalFields
+} from "./chunk-X7R6DCVF.ts";
 import {
   jsonEqual,
   parseSettingsDocument,
   renderSettingsMembers
 } from "./chunk-ZW5ZLGBI.ts";
+import {
+  regenerateSnapshotIdentity
+} from "./chunk-PHANBTVM.ts";
 
 // src/sync/local-fields.ts
 import { createHash } from "node:crypto";
-function normalizeLocalFields(value) {
-  if (value === void 0) return [];
-  if (!Array.isArray(value) || value.length > 128 || value.some(
-    (field) => typeof field !== "string" || !field || field.length > 128 || /[\p{Cc}\p{Cf}\p{Cs}]/u.test(field) || ["__proto__", "constructor", "prototype"].includes(field)
-  ))
-    throw new Error("localFields must be at most 128 safe settings.json root field names.");
-  if (new Set(value).size !== value.length) throw new Error("Duplicate localFields rule.");
-  for (const [first, second] of [
-    ["defaultProvider", "defaultModel"],
-    ["skills", "enableSkillCommands"],
-    ["queueMode", "steeringMode"],
-    ["websockets", "transport"],
-    ["enableAnalytics", "trackingId"]
-  ]) {
-    if (value.includes(first) !== value.includes(second))
-      throw new Error("Coupled settings fields must be excluded together.");
-  }
-  return [...value].sort();
-}
 function validateSnapshotFieldPolicy(snapshot) {
   if (snapshot.version !== 1 && snapshot.version !== 2 && snapshot.version !== 3)
     throw new Error("Unsupported snapshot format.");
@@ -114,11 +98,10 @@ function overlayLocalFields(portable, local, fields) {
 }
 
 export {
-  normalizeLocalFields,
   validateSnapshotFieldPolicy,
   validatePortableSnapshot,
   sameLocalFields,
   portableSnapshot,
   overlayLocalFields
 };
-//# sourceMappingURL=chunk-A6HU4ERM.ts.map
+//# sourceMappingURL=chunk-UGSSZWQ6.ts.map

package/dist/chunks/chunk-UGSSZWQ6.ts.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/sync/local-fields.ts"],
+  "sourcesContent": ["import { createHash } from \"node:crypto\";\nimport { regenerateSnapshotIdentity } from \"../snapshot/snapshot.js\";\nimport type { Snapshot, SnapshotFile } from \"../snapshot/snapshot-types.js\";\nimport {\n  type JsonDocument,\n  type JsonNode,\n  jsonEqual,\n  parseSettingsDocument,\n  renderSettingsMembers,\n} from \"./json-document.js\";\nimport { normalizeLocalFields } from \"./local-field-policy.js\";\n\nexport { normalizeLocalFields } from \"./local-field-policy.js\";\n\n/** Shared transport contract: older snapshots cannot carry portable policy metadata. */\nexport function validateSnapshotFieldPolicy(snapshot: Pick<Snapshot, \"version\" | \"localFields\">) {\n  if (snapshot.version !== 1 && snapshot.version !== 2 && snapshot.version !== 3)\n    throw new Error(\"Unsupported snapshot format.\");\n  if (snapshot.version === 1 && snapshot.localFields !== undefined)\n    throw new Error(\"Portable field policy requires snapshot version 2.\");\n  if (snapshot.version === 2 || snapshot.version === 3) {\n    if (snapshot.version === 2 && snapshot.localFields === undefined)\n      throw new Error(\"Snapshot version 2 requires explicit localFields rules.\");\n    normalizeLocalFields(snapshot.localFields);\n  }\n}\n/** Portable transport images must not carry values declared machine-local. Physical journal images are different. */\nexport function validatePortableSnapshot(snapshot: Snapshot) {\n  validateSnapshotFieldPolicy(snapshot);\n  if ((snapshot.version !== 2 && snapshot.version !== 3) || !snapshot.localFields?.length) return;\n  try {\n    for (const entry of snapshot.files) {\n      if (typeof entry?.path !== \"string\" || entry.path.toLowerCase() !== \"settings.json\") continue;\n      const document = parseSettingsDocument(Buffer.from(entry.contentBase64, \"base64\"));\n      if (snapshot.localFields.some((field) => document.root.members.has(field))) throw new Error(\"Excluded field.\");\n    }\n  } catch {\n    throw new Error(\"Portable snapshot settings.json retains excluded fields or has an unsupported document.\");\n  }\n}\nexport function sameLocalFields(left: unknown, right: unknown) {\n  if (left === undefined || right === undefined) return left === right;\n  return JSON.stringify(normalizeLocalFields(left)) === JSON.stringify(normalizeLocalFields(right));\n}\nfunction file(content: Buffer): SnapshotFile {\n  return {\n    path: \"settings.json\",\n    contentBase64: content.toString(\"base64\"),\n    sha256: createHash(\"sha256\").update(content).digest(\"hex\"),\n  };\n}\nexport function portableSnapshot(snapshot: Snapshot, fields: string[] | undefined): Snapshot {\n  if (fields === undefined) return snapshot;\n  const excluded = new Set(normalizeLocalFields(fields));\n  const files = snapshot.files.map((entry) => {\n    if (entry.path !== \"settings.json\" || excluded.size === 0) return entry;\n    const document = parseSettingsDocument(Buffer.from(entry.contentBase64, \"base64\"));\n    const object = Object.create(null);\n    for (const key of [...document.root.members.keys()].sort())\n      if (!excluded.has(key)) object[key] = document.root.members.get(key)?.node.value;\n    const canonical = (value: unknown): unknown =>\n      Array.isArray(value)\n        ? value.map(canonical)\n        : value && typeof value === \"object\"\n          ? Object.fromEntries(\n              Object.entries(value)\n                .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))\n                .map(([key, child]) => [key, canonical(child)]),\n            )\n          : value;\n    return file(Buffer.from(`${JSON.stringify(canonical(object))}\\n`));\n  });\n  return regenerateSnapshotIdentity({ ...snapshot, version: 2, localFields: [...excluded], files });\n}\nexport function overlayLocalFields(portable: Snapshot, local: Snapshot, fields: string[] | undefined): Snapshot {\n  if (!fields?.length) return portable;\n  const target = portable.files.find((entry) => entry.path === \"settings.json\");\n  const current = local.files.find((entry) => entry.path === \"settings.json\");\n  if (!target && !current) return portable;\n  const original = current\n    ? parseSettingsDocument(Buffer.from(current.contentBase64, \"base64\"))\n    : parseSettingsDocument(Buffer.from(\"{}\"));\n  if (!target) {\n    if (fields.some((field) => original.root.members.has(field)))\n      throw new Error(\"Portable settings deletion requires manual review; local-only fields were preserved.\");\n    return portable;\n  }\n  const incoming = parseSettingsDocument(Buffer.from(target.contentBase64, \"base64\"));\n  const selected = new Map<string, { document: JsonDocument; node: JsonNode }>();\n  const excluded = new Set(fields);\n  for (const [key, member] of incoming.root.members) {\n    if (excluded.has(key)) continue;\n    const existing = original.root.members.get(key);\n    selected.set(\n      key,\n      existing && jsonEqual(existing.node.value, member.node.value)\n        ? { document: original, node: existing.node }\n        : { document: incoming, node: member.node },\n    );\n  }\n  for (const [key, member] of original.root.members)\n    if (excluded.has(key)) selected.set(key, { document: original, node: member.node });\n  const content = renderSettingsMembers(original, selected);\n  return regenerateSnapshotIdentity({\n    ...portable,\n    files: portable.files.map((entry) => (entry.path === \"settings.json\" ? file(content) : entry)),\n  });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAepB,SAAS,4BAA4B,UAAqD;AAC/F,MAAI,SAAS,YAAY,KAAK,SAAS,YAAY,KAAK,SAAS,YAAY;AAC3E,UAAM,IAAI,MAAM,8BAA8B;AAChD,MAAI,SAAS,YAAY,KAAK,SAAS,gBAAgB;AACrD,UAAM,IAAI,MAAM,oDAAoD;AACtE,MAAI,SAAS,YAAY,KAAK,SAAS,YAAY,GAAG;AACpD,QAAI,SAAS,YAAY,KAAK,SAAS,gBAAgB;AACrD,YAAM,IAAI,MAAM,yDAAyD;AAC3E,yBAAqB,SAAS,WAAW;AAAA,EAC3C;AACF;AAEO,SAAS,yBAAyB,UAAoB;AAC3D,8BAA4B,QAAQ;AACpC,MAAK,SAAS,YAAY,KAAK,SAAS,YAAY,KAAM,CAAC,SAAS,aAAa,OAAQ;AACzF,MAAI;AACF,eAAW,SAAS,SAAS,OAAO;AAClC,UAAI,OAAO,OAAO,SAAS,YAAY,MAAM,KAAK,YAAY,MAAM,gBAAiB;AACrF,YAAM,WAAW,sBAAsB,OAAO,KAAK,MAAM,eAAe,QAAQ,CAAC;AACjF,UAAI,SAAS,YAAY,KAAK,CAAC,UAAU,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,iBAAiB;AAAA,IAC/G;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,MAAM,yFAAyF;AAAA,EAC3G;AACF;AACO,SAAS,gBAAgB,MAAe,OAAgB;AAC7D,MAAI,SAAS,UAAa,UAAU,OAAW,QAAO,SAAS;AAC/D,SAAO,KAAK,UAAU,qBAAqB,IAAI,CAAC,MAAM,KAAK,UAAU,qBAAqB,KAAK,CAAC;AAClG;AACA,SAAS,KAAK,SAA+B;AAC3C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,eAAe,QAAQ,SAAS,QAAQ;AAAA,IACxC,QAAQ,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAAA,EAC3D;AACF;AACO,SAAS,iBAAiB,UAAoB,QAAwC;AAC3F,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,WAAW,IAAI,IAAI,qBAAqB,MAAM,CAAC;AACrD,QAAM,QAAQ,SAAS,MAAM,IAAI,CAAC,UAAU;AAC1C,QAAI,MAAM,SAAS,mBAAmB,SAAS,SAAS,EAAG,QAAO;AAClE,UAAM,WAAW,sBAAsB,OAAO,KAAK,MAAM,eAAe,QAAQ,CAAC;AACjF,UAAM,SAAS,uBAAO,OAAO,IAAI;AACjC,eAAW,OAAO,CAAC,GAAG,SAAS,KAAK,QAAQ,KAAK,CAAC,EAAE,KAAK;AACvD,UAAI,CAAC,SAAS,IAAI,GAAG,EAAG,QAAO,GAAG,IAAI,SAAS,KAAK,QAAQ,IAAI,GAAG,GAAG,KAAK;AAC7E,UAAM,YAAY,CAAC,UACjB,MAAM,QAAQ,KAAK,IACf,MAAM,IAAI,SAAS,IACnB,SAAS,OAAO,UAAU,WACxB,OAAO;AAAA,MACL,OAAO,QAAQ,KAAK,EACjB,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE,EACpE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,IAClD,IACA;AACR,WAAO,KAAK,OAAO,KAAK,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI,CAAC;AAAA,EACnE,CAAC;AACD,SAAO,2BAA2B,EAAE,GAAG,UAAU,SAAS,GAAG,aAAa,CAAC,GAAG,QAAQ,GAAG,MAAM,CAAC;AAClG;AACO,SAAS,mBAAmB,UAAoB,OAAiB,QAAwC;AAC9G,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,SAAS,SAAS,MAAM,KAAK,CAAC,UAAU,MAAM,SAAS,eAAe;AAC5E,QAAM,UAAU,MAAM,MAAM,KAAK,CAAC,UAAU,MAAM,SAAS,eAAe;AAC1E,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO;AAChC,QAAM,WAAW,UACb,sBAAsB,OAAO,KAAK,QAAQ,eAAe,QAAQ,CAAC,IAClE,sBAAsB,OAAO,KAAK,IAAI,CAAC;AAC3C,MAAI,CAAC,QAAQ;AACX,QAAI,OAAO,KAAK,CAAC,UAAU,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC;AACzD,YAAM,IAAI,MAAM,sFAAsF;AACxG,WAAO;AAAA,EACT;AACA,QAAM,WAAW,sBAAsB,OAAO,KAAK,OAAO,eAAe,QAAQ,CAAC;AAClF,QAAM,WAAW,oBAAI,IAAwD;AAC7E,QAAM,WAAW,IAAI,IAAI,MAAM;AAC/B,aAAW,CAAC,KAAK,MAAM,KAAK,SAAS,KAAK,SAAS;AACjD,QAAI,SAAS,IAAI,GAAG,EAAG;AACvB,UAAM,WAAW,SAAS,KAAK,QAAQ,IAAI,GAAG;AAC9C,aAAS;AAAA,MACP;AAAA,MACA,YAAY,UAAU,SAAS,KAAK,OAAO,OAAO,KAAK,KAAK,IACxD,EAAE,UAAU,UAAU,MAAM,SAAS,KAAK,IAC1C,EAAE,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,IAC9C;AAAA,EACF;AACA,aAAW,CAAC,KAAK,MAAM,KAAK,SAAS,KAAK;AACxC,QAAI,SAAS,IAAI,GAAG,EAAG,UAAS,IAAI,KAAK,EAAE,UAAU,UAAU,MAAM,OAAO,KAAK,CAAC;AACpF,QAAM,UAAU,sBAAsB,UAAU,QAAQ;AACxD,SAAO,2BAA2B;AAAA,IAChC,GAAG;AAAA,IACH,OAAO,SAAS,MAAM,IAAI,CAAC,UAAW,MAAM,SAAS,kBAAkB,KAAK,OAAO,IAAI,KAAM;AAAA,EAC/F,CAAC;AACH;",
+  "names": []
+}

package/dist/chunks/chunk-X7R6DCVF.ts

@@ -0,0 +1,28 @@
+// @generated by scripts/build-runtime.mjs; do not edit.
+// @ts-nocheck -- generated JavaScript uses a .ts extension for Pi's Jiti loader.
+
+// src/sync/local-field-policy.ts
+function normalizeLocalFields(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.length > 128 || value.some(
+    (field) => typeof field !== "string" || !field || field.length > 128 || /[\p{Cc}\p{Cf}\p{Cs}]/u.test(field) || ["__proto__", "constructor", "prototype"].includes(field)
+  ))
+    throw new Error("localFields must be at most 128 safe settings.json root field names.");
+  if (new Set(value).size !== value.length) throw new Error("Duplicate localFields rule.");
+  for (const [first, second] of [
+    ["defaultProvider", "defaultModel"],
+    ["skills", "enableSkillCommands"],
+    ["queueMode", "steeringMode"],
+    ["websockets", "transport"],
+    ["enableAnalytics", "trackingId"]
+  ]) {
+    if (value.includes(first) !== value.includes(second))
+      throw new Error("Coupled settings fields must be excluded together.");
+  }
+  return [...value].sort();
+}
+
+export {
+  normalizeLocalFields
+};
+//# sourceMappingURL=chunk-X7R6DCVF.ts.map

package/dist/chunks/chunk-X7R6DCVF.ts.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/sync/local-field-policy.ts"],
+  "sourcesContent": ["/** Initial rules select whole root fields of the global settings.json only. */\nexport function normalizeLocalFields(value: unknown): string[] {\n  if (value === undefined) return [];\n  if (\n    !Array.isArray(value) ||\n    value.length > 128 ||\n    value.some(\n      (field) =>\n        typeof field !== \"string\" ||\n        !field ||\n        field.length > 128 ||\n        /[\\p{Cc}\\p{Cf}\\p{Cs}]/u.test(field) ||\n        [\"__proto__\", \"constructor\", \"prototype\"].includes(field),\n    )\n  )\n    throw new Error(\"localFields must be at most 128 safe settings.json root field names.\");\n  if (new Set(value).size !== value.length) throw new Error(\"Duplicate localFields rule.\");\n  for (const [first, second] of [\n    [\"defaultProvider\", \"defaultModel\"],\n    [\"skills\", \"enableSkillCommands\"],\n    [\"queueMode\", \"steeringMode\"],\n    [\"websockets\", \"transport\"],\n    [\"enableAnalytics\", \"trackingId\"],\n  ]) {\n    if (value.includes(first) !== value.includes(second))\n      throw new Error(\"Coupled settings fields must be excluded together.\");\n  }\n  return [...value].sort();\n}\n"],
+  "mappings": ";;;;AACO,SAAS,qBAAqB,OAA0B;AAC7D,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,SAAS,OACf,MAAM;AAAA,IACJ,CAAC,UACC,OAAO,UAAU,YACjB,CAAC,SACD,MAAM,SAAS,OACf,wBAAwB,KAAK,KAAK,KAClC,CAAC,aAAa,eAAe,WAAW,EAAE,SAAS,KAAK;AAAA,EAC5D;AAEA,UAAM,IAAI,MAAM,sEAAsE;AACxF,MAAI,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,OAAQ,OAAM,IAAI,MAAM,6BAA6B;AACvF,aAAW,CAAC,OAAO,MAAM,KAAK;AAAA,IAC5B,CAAC,mBAAmB,cAAc;AAAA,IAClC,CAAC,UAAU,qBAAqB;AAAA,IAChC,CAAC,aAAa,cAAc;AAAA,IAC5B,CAAC,cAAc,WAAW;AAAA,IAC1B,CAAC,mBAAmB,YAAY;AAAA,EAClC,GAAG;AACD,QAAI,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,MAAM;AACjD,YAAM,IAAI,MAAM,oDAAoD;AAAA,EACxE;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK;AACzB;",
+  "names": []
+}

package/dist/chunks/{chunk-HUZ5CR4W.ts → chunk-YZ5BQNRZ.ts}

@@ -48,52 +48,6 @@ function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
 
-// src/state/json-file.ts
-import { randomUUID } from "node:crypto";
-import fs from "node:fs/promises";
-import path2 from "node:path";
-async function readJsonIfExists(filePath) {
-  try {
-    return JSON.parse(await fs.readFile(filePath, "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
-  }
-}
-async function writeJson(filePath, value, options = {}) {
-  const content = `${JSON.stringify(value, null, "	")}
-`;
-  if (options.maxBytes !== void 0 && Buffer.byteLength(content) > options.maxBytes)
-    throw new Error(
-      "Private state document exceeds its storage bound; preserve existing evidence and use reviewed recovery."
-    );
-  await fs.mkdir(path2.dirname(filePath), { recursive: true, mode: 448 });
-  const temp = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
-  try {
-    const handle = await fs.open(temp, "wx", 384);
-    try {
-      await handle.writeFile(content);
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    if (process.platform !== "win32") await fs.chmod(temp, 384);
-    await fs.rename(temp, filePath);
-    await syncDirectory(path2.dirname(filePath));
-  } finally {
-    await fs.rm(temp, { force: true });
-  }
-}
-async function syncDirectory(directory) {
-  if (process.platform === "win32") return;
-  const handle = await fs.open(directory, "r");
-  try {
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-}
-
 export {
   isDeniedPath,
   isPathInside,
@@ -102,9 +56,6 @@ export {
   encodeKey,
   posixJoin,
   parentPaths,
-  toPosix,
-  readJsonIfExists,
-  writeJson,
-  syncDirectory
+  toPosix
 };
-//# sourceMappingURL=chunk-HUZ5CR4W.ts.map
+//# sourceMappingURL=chunk-YZ5BQNRZ.ts.map

package/dist/chunks/{chunk-HUZ5CR4W.ts.map → chunk-YZ5BQNRZ.ts.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../../src/paths.ts", "../../src/state/json-file.ts"],
-  "sourcesContent": ["import path from \"node:path\";\n\nexport function isDeniedPath(relativePath: string) {\n  const normalized = toPosix(relativePath);\n  const lower = normalized.toLowerCase();\n  const segments = lower.split(\"/\");\n  const base = path.posix.basename(lower);\n  return (\n    segments.includes(\"node_modules\") ||\n    segments.includes(\".git\") ||\n    segments.includes(\".pisync\") ||\n    segments.includes(\"pi-sync\") ||\n    segments.includes(\".pi-sync-state-migration.lock\") ||\n    base === \".env\" ||\n    base.startsWith(\".env.\") ||\n    base.endsWith(\".env\") ||\n    base.includes(\"secret\") ||\n    base.includes(\"token\") ||\n    base === \"pi-sync.json\" ||\n    base.startsWith(\"pi-sync.json.\") ||\n    base.startsWith(\".pi-sync.json.\") ||\n    base === \"pi-sync.local.json\" ||\n    base.startsWith(\"pi-sync.local.json.\") ||\n    base.startsWith(\".pi-sync.local.json.\")\n  );\n}\n\nexport function isPathInside(parent: string, child: string) {\n  const relative = path.relative(path.resolve(parent), path.resolve(child));\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n\nexport function safeJoin(root: string, relativePath: string) {\n  const target = path.resolve(root, relativePath);\n  assertWithinRoot(root, target, relativePath);\n  return target;\n}\n\nexport function assertWithinRoot(root: string, target: string, label = target) {\n  const resolvedRoot = path.resolve(root);\n  const resolvedTarget = path.resolve(target);\n  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) {\n    throw new Error(`Unsafe path in snapshot: ${label}`);\n  }\n}\n\nexport function encodeKey(key: string) {\n  return key.split(\"/\").map(encodeURIComponent).join(\"/\");\n}\n\nexport function posixJoin(...parts: string[]) {\n  return parts\n    .map((part) => trimSlashes(part))\n    .filter(Boolean)\n    .join(\"/\");\n}\n\nexport function parentPaths(relativePath: string) {\n  const results: string[] = [];\n  let index = relativePath.lastIndexOf(\"/\");\n  while (index > 0) {\n    results.push(relativePath.slice(0, index));\n    index = relativePath.lastIndexOf(\"/\", index - 1);\n  }\n  return results;\n}\n\nexport function toPosix(value: string) {\n  return value.split(path.sep).join(\"/\");\n}\n\nfunction trimSlashes(value: string) {\n  return value.replace(/^\\/+|\\/+$/g, \"\");\n}\n\nexport function safeName(value: string) {\n  return value.replace(/[^A-Za-z0-9._-]/g, \"_\");\n}\n", "import { randomUUID } from \"node:crypto\";\nimport fs from \"node:fs/promises\";\nimport path from \"node:path\";\n\nexport async function readJsonIfExists<T>(filePath: string): Promise<T | undefined> {\n  try {\n    return JSON.parse(await fs.readFile(filePath, \"utf8\")) as T;\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw error;\n  }\n}\n\nexport async function writeJson(filePath: string, value: unknown, options: { maxBytes?: number } = {}) {\n  const content = `${JSON.stringify(value, null, \"\\t\")}\\n`;\n  if (options.maxBytes !== undefined && Buffer.byteLength(content) > options.maxBytes)\n    throw new Error(\n      \"Private state document exceeds its storage bound; preserve existing evidence and use reviewed recovery.\",\n    );\n  await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });\n  const temp = `${filePath}.${process.pid}.${randomUUID()}.tmp`;\n  try {\n    const handle = await fs.open(temp, \"wx\", 0o600);\n    try {\n      await handle.writeFile(content);\n      await handle.sync();\n    } finally {\n      await handle.close();\n    }\n    if (process.platform !== \"win32\") await fs.chmod(temp, 0o600);\n    await fs.rename(temp, filePath);\n    await syncDirectory(path.dirname(filePath));\n  } finally {\n    await fs.rm(temp, { force: true });\n  }\n}\n\n/** POSIX rename/unlink durability; Windows does not expose directory fsync through Node. */\nexport async function syncDirectory(directory: string) {\n  if (process.platform === \"win32\") return;\n  const handle = await fs.open(directory, \"r\");\n  try {\n    await handle.sync();\n  } finally {\n    await handle.close();\n  }\n}\n"],
-  "mappings": ";;;;AAAA,OAAO,UAAU;AAEV,SAAS,aAAa,cAAsB;AACjD,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,QAAQ,WAAW,YAAY;AACrC,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,QAAM,OAAO,KAAK,MAAM,SAAS,KAAK;AACtC,SACE,SAAS,SAAS,cAAc,KAChC,SAAS,SAAS,MAAM,KACxB,SAAS,SAAS,SAAS,KAC3B,SAAS,SAAS,SAAS,KAC3B,SAAS,SAAS,+BAA+B,KACjD,SAAS,UACT,KAAK,WAAW,OAAO,KACvB,KAAK,SAAS,MAAM,KACpB,KAAK,SAAS,QAAQ,KACtB,KAAK,SAAS,OAAO,KACrB,SAAS,kBACT,KAAK,WAAW,eAAe,KAC/B,KAAK,WAAW,gBAAgB,KAChC,SAAS,wBACT,KAAK,WAAW,qBAAqB,KACrC,KAAK,WAAW,sBAAsB;AAE1C;AAEO,SAAS,aAAa,QAAgB,OAAe;AAC1D,QAAM,WAAW,KAAK,SAAS,KAAK,QAAQ,MAAM,GAAG,KAAK,QAAQ,KAAK,CAAC;AACxE,SAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AACpF;AAEO,SAAS,SAAS,MAAc,cAAsB;AAC3D,QAAM,SAAS,KAAK,QAAQ,MAAM,YAAY;AAC9C,mBAAiB,MAAM,QAAQ,YAAY;AAC3C,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAc,QAAgB,QAAQ,QAAQ;AAC7E,QAAM,eAAe,KAAK,QAAQ,IAAI;AACtC,QAAM,iBAAiB,KAAK,QAAQ,MAAM;AAC1C,MAAI,mBAAmB,gBAAgB,CAAC,eAAe,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,EAAE,GAAG;AAC/F,UAAM,IAAI,MAAM,4BAA4B,KAAK,EAAE;AAAA,EACrD;AACF;AAEO,SAAS,UAAU,KAAa;AACrC,SAAO,IAAI,MAAM,GAAG,EAAE,IAAI,kBAAkB,EAAE,KAAK,GAAG;AACxD;AAEO,SAAS,aAAa,OAAiB;AAC5C,SAAO,MACJ,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,EAC/B,OAAO,OAAO,EACd,KAAK,GAAG;AACb;AAEO,SAAS,YAAY,cAAsB;AAChD,QAAM,UAAoB,CAAC;AAC3B,MAAI,QAAQ,aAAa,YAAY,GAAG;AACxC,SAAO,QAAQ,GAAG;AAChB,YAAQ,KAAK,aAAa,MAAM,GAAG,KAAK,CAAC;AACzC,YAAQ,aAAa,YAAY,KAAK,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEO,SAAS,QAAQ,OAAe;AACrC,SAAO,MAAM,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AACvC;AAEA,SAAS,YAAY,OAAe;AAClC,SAAO,MAAM,QAAQ,cAAc,EAAE;AACvC;;;ACzEA,SAAS,kBAAkB;AAC3B,OAAO,QAAQ;AACf,OAAOA,WAAU;AAEjB,eAAsB,iBAAoB,UAA0C;AAClF,MAAI;AACF,WAAO,KAAK,MAAM,MAAM,GAAG,SAAS,UAAU,MAAM,CAAC;AAAA,EACvD,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,UAAU,UAAkB,OAAgB,UAAiC,CAAC,GAAG;AACrG,QAAM,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,GAAI,CAAC;AAAA;AACpD,MAAI,QAAQ,aAAa,UAAa,OAAO,WAAW,OAAO,IAAI,QAAQ;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,QAAM,GAAG,MAAMA,MAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvE,QAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC;AACvD,MAAI;AACF,UAAM,SAAS,MAAM,GAAG,KAAK,MAAM,MAAM,GAAK;AAC9C,QAAI;AACF,YAAM,OAAO,UAAU,OAAO;AAC9B,YAAM,OAAO,KAAK;AAAA,IACpB,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AACA,QAAI,QAAQ,aAAa,QAAS,OAAM,GAAG,MAAM,MAAM,GAAK;AAC5D,UAAM,GAAG,OAAO,MAAM,QAAQ;AAC9B,UAAM,cAAcA,MAAK,QAAQ,QAAQ,CAAC;AAAA,EAC5C,UAAE;AACA,UAAM,GAAG,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EACnC;AACF;AAGA,eAAsB,cAAc,WAAmB;AACrD,MAAI,QAAQ,aAAa,QAAS;AAClC,QAAM,SAAS,MAAM,GAAG,KAAK,WAAW,GAAG;AAC3C,MAAI;AACF,UAAM,OAAO,KAAK;AAAA,EACpB,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;",
-  "names": ["path"]
+  "sources": ["../../src/paths.ts"],
+  "sourcesContent": ["import path from \"node:path\";\n\nexport function isDeniedPath(relativePath: string) {\n  const normalized = toPosix(relativePath);\n  const lower = normalized.toLowerCase();\n  const segments = lower.split(\"/\");\n  const base = path.posix.basename(lower);\n  return (\n    segments.includes(\"node_modules\") ||\n    segments.includes(\".git\") ||\n    segments.includes(\".pisync\") ||\n    segments.includes(\"pi-sync\") ||\n    segments.includes(\".pi-sync-state-migration.lock\") ||\n    base === \".env\" ||\n    base.startsWith(\".env.\") ||\n    base.endsWith(\".env\") ||\n    base.includes(\"secret\") ||\n    base.includes(\"token\") ||\n    base === \"pi-sync.json\" ||\n    base.startsWith(\"pi-sync.json.\") ||\n    base.startsWith(\".pi-sync.json.\") ||\n    base === \"pi-sync.local.json\" ||\n    base.startsWith(\"pi-sync.local.json.\") ||\n    base.startsWith(\".pi-sync.local.json.\")\n  );\n}\n\nexport function isPathInside(parent: string, child: string) {\n  const relative = path.relative(path.resolve(parent), path.resolve(child));\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n\nexport function safeJoin(root: string, relativePath: string) {\n  const target = path.resolve(root, relativePath);\n  assertWithinRoot(root, target, relativePath);\n  return target;\n}\n\nexport function assertWithinRoot(root: string, target: string, label = target) {\n  const resolvedRoot = path.resolve(root);\n  const resolvedTarget = path.resolve(target);\n  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) {\n    throw new Error(`Unsafe path in snapshot: ${label}`);\n  }\n}\n\nexport function encodeKey(key: string) {\n  return key.split(\"/\").map(encodeURIComponent).join(\"/\");\n}\n\nexport function posixJoin(...parts: string[]) {\n  return parts\n    .map((part) => trimSlashes(part))\n    .filter(Boolean)\n    .join(\"/\");\n}\n\nexport function parentPaths(relativePath: string) {\n  const results: string[] = [];\n  let index = relativePath.lastIndexOf(\"/\");\n  while (index > 0) {\n    results.push(relativePath.slice(0, index));\n    index = relativePath.lastIndexOf(\"/\", index - 1);\n  }\n  return results;\n}\n\nexport function toPosix(value: string) {\n  return value.split(path.sep).join(\"/\");\n}\n\nfunction trimSlashes(value: string) {\n  return value.replace(/^\\/+|\\/+$/g, \"\");\n}\n\nexport function safeName(value: string) {\n  return value.replace(/[^A-Za-z0-9._-]/g, \"_\");\n}\n"],
+  "mappings": ";;;;AAAA,OAAO,UAAU;AAEV,SAAS,aAAa,cAAsB;AACjD,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,QAAQ,WAAW,YAAY;AACrC,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,QAAM,OAAO,KAAK,MAAM,SAAS,KAAK;AACtC,SACE,SAAS,SAAS,cAAc,KAChC,SAAS,SAAS,MAAM,KACxB,SAAS,SAAS,SAAS,KAC3B,SAAS,SAAS,SAAS,KAC3B,SAAS,SAAS,+BAA+B,KACjD,SAAS,UACT,KAAK,WAAW,OAAO,KACvB,KAAK,SAAS,MAAM,KACpB,KAAK,SAAS,QAAQ,KACtB,KAAK,SAAS,OAAO,KACrB,SAAS,kBACT,KAAK,WAAW,eAAe,KAC/B,KAAK,WAAW,gBAAgB,KAChC,SAAS,wBACT,KAAK,WAAW,qBAAqB,KACrC,KAAK,WAAW,sBAAsB;AAE1C;AAEO,SAAS,aAAa,QAAgB,OAAe;AAC1D,QAAM,WAAW,KAAK,SAAS,KAAK,QAAQ,MAAM,GAAG,KAAK,QAAQ,KAAK,CAAC;AACxE,SAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AACpF;AAEO,SAAS,SAAS,MAAc,cAAsB;AAC3D,QAAM,SAAS,KAAK,QAAQ,MAAM,YAAY;AAC9C,mBAAiB,MAAM,QAAQ,YAAY;AAC3C,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAc,QAAgB,QAAQ,QAAQ;AAC7E,QAAM,eAAe,KAAK,QAAQ,IAAI;AACtC,QAAM,iBAAiB,KAAK,QAAQ,MAAM;AAC1C,MAAI,mBAAmB,gBAAgB,CAAC,eAAe,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,EAAE,GAAG;AAC/F,UAAM,IAAI,MAAM,4BAA4B,KAAK,EAAE;AAAA,EACrD;AACF;AAEO,SAAS,UAAU,KAAa;AACrC,SAAO,IAAI,MAAM,GAAG,EAAE,IAAI,kBAAkB,EAAE,KAAK,GAAG;AACxD;AAEO,SAAS,aAAa,OAAiB;AAC5C,SAAO,MACJ,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,EAC/B,OAAO,OAAO,EACd,KAAK,GAAG;AACb;AAEO,SAAS,YAAY,cAAsB;AAChD,QAAM,UAAoB,CAAC;AAC3B,MAAI,QAAQ,aAAa,YAAY,GAAG;AACxC,SAAO,QAAQ,GAAG;AAChB,YAAQ,KAAK,aAAa,MAAM,GAAG,KAAK,CAAC;AACzC,YAAQ,aAAa,YAAY,KAAK,QAAQ,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEO,SAAS,QAAQ,OAAe;AACrC,SAAO,MAAM,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AACvC;AAEA,SAAS,YAAY,OAAe;AAClC,SAAO,MAAM,QAAQ,cAAc,EAAE;AACvC;",
+  "names": []
 }