@rigxyz/tapd 0.3.0 → 0.4.1

package/dist/{chunk-N3KRCOBG.js → chunk-JBX2ZRMD.js}

@@ -94,6 +94,17 @@ async function createBinding(opts) {
   });
   return expectJson(route, res);
 }
+async function revokeImportEdge(opts) {
+  const fn = opts.fetch ?? fetch;
+  const res = await fn(
+    joinUrl(opts.baseUrl, `/v1/me/imports/${encodeURIComponent(opts.edgeId)}`),
+    { method: "DELETE", headers: { authorization: `Bearer ${opts.accessToken}` } }
+  );
+  if (res.ok) return { revoked: true, status: res.status };
+  const body = await readJson(res);
+  const reason = typeof body === "object" && body !== null && "reason" in body ? String(body.reason) : void 0;
+  return { revoked: false, status: res.status, ...reason ? { reason } : {} };
+}
 var RelayClient = class {
   baseUrl;
   bindingId;
@@ -148,7 +159,14 @@ var RelayClient = class {
     );
     return expectJson(route, res);
   }
-  /** PUT bytes to a presigned URL. Throws on non-2xx. */
+  /**
+   * PUT bytes to a presigned URL. Throws on non-2xx — except 409, which
+   * means the content-addressed object is already stored (same hash = same
+   * bytes). That's idempotent success, not a conflict: two files with
+   * identical content (e.g. several empty files), or an initial upload that
+   * overlaps the daemon's first scan, race to PUT the same key. Treating
+   * 409 as fatal aborts the whole push and wedges sync at "N pending".
+   */
   async putObjectBytes(uploadUrl, bytes) {
     const route = "PUT <uploadUrl>";
     const res = await this.fetch(uploadUrl, {
@@ -156,6 +174,7 @@ var RelayClient = class {
       body: new Uint8Array(bytes),
       headers: { "content-length": String(bytes.byteLength) }
     });
+    if (res.status === 409) return;
     if (!res.ok) {
       throw new RelayError(route, res.status, await readJson(res));
     }
@@ -426,6 +445,15 @@ function isAlwaysExcluded(posixPath) {
   }
   return false;
 }
+function isUnderAny(posixPath, prefixes) {
+  for (const raw of prefixes) {
+    const prefix = raw.replace(/\/+$/, "");
+    if (prefix === "") continue;
+    if (posixPath === prefix) return true;
+    if (posixPath.startsWith(prefix + "/")) return true;
+  }
+  return false;
+}
 
 // src/walker.ts
 import { readdirSync, statSync } from "fs";
@@ -462,6 +490,7 @@ function walk(rootDir, opts) {
   const emptyDirs = [];
   const directoriesScanned = [];
   const warnings = [];
+  const excludePaths = opts.excludePaths ?? [];
   walkDir(".");
   return { files, emptyDirs, directoriesScanned, warnings };
   function walkDir(rel) {
@@ -479,6 +508,10 @@ function walk(rootDir, opts) {
       const posix = posixOf(childRel);
       const isDir = ent.isDirectory();
       if (isAlwaysExcluded(posix)) continue;
+      if (excludePaths.length > 0 && isUnderAny(posix, excludePaths)) {
+        hasVisible = true;
+        continue;
+      }
       if (opts.ignore.ignores(posix + (isDir ? "/" : ""))) continue;
       if (ent.isSymbolicLink()) {
         warnings.push({ path: posix, reason: "symlink" });
@@ -537,9 +570,33 @@ async function hashFile(absPath) {
 import { createHash as createHash2 } from "crypto";
 import { readFileSync as readFileSync3 } from "fs";
 import { join as join4 } from "path";
+
+// src/pool.ts
+async function mapPool(items, limit, fn) {
+  let next = 0;
+  let failed = false;
+  const worker = async () => {
+    while (!failed) {
+      const idx = next++;
+      if (idx >= items.length) break;
+      const item = items[idx];
+      try {
+        await fn(item);
+      } catch (err) {
+        failed = true;
+        throw err;
+      }
+    }
+  };
+  const n = Math.max(1, Math.min(limit, items.length));
+  await Promise.all(Array.from({ length: n }, worker));
+}
+
+// src/init.ts
 function sha256OfBuffer(bytes) {
   return `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
 }
+var UPLOAD_CONCURRENCY = 8;
 var AlreadyInitializedError = class extends Error {
   constructor(path) {
     super(`already initialized \u2014 ${path} exists`);
@@ -584,27 +641,27 @@ async function init(opts) {
   const mutatedDuringScan = /* @__PURE__ */ new Set();
   let uploaded = 0;
   let reused = 0;
-  for (const [hash, f] of uniqueHashes) {
-    const prep = await client.prepareUpload({ hash, size: f.size });
+  await mapPool([...uniqueHashes.values()], UPLOAD_CONCURRENCY, async (f) => {
+    const prep = await client.prepareUpload({ hash: f.hash, size: f.size });
     if (prep.exists) {
       reused += 1;
-      continue;
+      return;
     }
     const bytes = readFileSync3(join4(opts.rootDir, f.path));
     const actual = sha256OfBuffer(bytes);
-    if (actual !== hash) {
+    if (actual !== f.hash) {
       mutatedDuringScan.add(f.path);
       scan.warnings.push({
         path: f.path,
         reason: "invalid_path"
         // closest existing warning kind; semantics are file-mutated-mid-scan
       });
-      continue;
+      return;
     }
     await client.putObjectBytes(prep.uploadUrl, bytes);
-    await client.completeUpload({ hash, size: f.size });
+    await client.completeUpload({ hash: f.hash, size: f.size });
     uploaded += 1;
-  }
+  });
   const events = [
     ...hashed.filter((f) => !mutatedDuringScan.has(f.path)).map((f) => ({
       op: "write",
@@ -756,20 +813,347 @@ async function join5(opts) {
   };
 }
 
-// src/applier.ts
-import { createHash as createHash3, randomBytes } from "crypto";
+// src/imports.ts
 import {
   existsSync as existsSync3,
-  lstatSync,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
   readFileSync as readFileSync4,
+  realpathSync,
+  statSync as statSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3, isAbsolute, join as join6, relative } from "path";
+var NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
+function validateImportName(name) {
+  if (!name) return "empty_name";
+  if (!NAME_RE.test(name)) {
+    return "invalid_name (must match ^[a-z0-9][a-z0-9_-]*$ \u2014 lowercase slug, no dots/slashes/..)";
+  }
+  return null;
+}
+function normalizeImportPath(p) {
+  return p.replace(/\\/g, "/").split("/").filter((s) => s !== "" && s !== ".").join("/");
+}
+function validateImportPath(rootDir, importPath) {
+  if (!importPath) return "empty_path";
+  if (isAbsolute(importPath)) return "absolute_path";
+  const norm = normalizeImportPath(importPath);
+  if (norm === "" || norm === ".") return "root_path (cannot mount over the rig root)";
+  const segs = norm.split("/");
+  if (segs.some((s) => s === "..")) return "dotdot_in_path";
+  if (segs.some((s) => s === "")) return "empty_segment";
+  if (segs[0] === ".rig") return "reserved_rig_path";
+  const realRoot = realpathSync(rootDir);
+  const abs = join6(realRoot, norm);
+  if (!isWithin(realRoot, abs)) return "escapes_root";
+  const realMount = realpathNearestExisting(abs);
+  if (!isWithin(realRoot, realMount)) return "symlink_escape";
+  const fileAncestor = firstExistingFileOnPath(abs);
+  if (fileAncestor) {
+    return fileAncestor === abs ? "mount_path_is_file" : "ancestor_is_file";
+  }
+  return null;
+}
+function validateImports(opts) {
+  const valid = [];
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  const acceptedPaths = [];
+  for (const imp of opts.imports) {
+    const reject = (reason) => errors.push({ name: imp.name, path: imp.path, reason });
+    const nameErr = validateImportName(imp.name);
+    if (nameErr) {
+      reject(nameErr);
+      continue;
+    }
+    if (seenNames.has(imp.name)) {
+      reject("duplicate_name");
+      continue;
+    }
+    const pathErr = validateImportPath(opts.rootDir, imp.path);
+    if (pathErr) {
+      reject(pathErr);
+      continue;
+    }
+    const norm = normalizeImportPath(imp.path);
+    if (acceptedPaths.some((p) => pathsOverlap(p, norm))) {
+      reject("overlaps_other_import");
+      continue;
+    }
+    if (opts.primaryTrackedPaths.some((tp) => tp === norm || tp.startsWith(norm + "/"))) {
+      reject("over_primary_content");
+      continue;
+    }
+    seenNames.add(imp.name);
+    acceptedPaths.push(norm);
+    valid.push({ ...imp, path: norm });
+  }
+  return { valid, errors };
+}
+function primaryStateDbPath(rootDir) {
+  return join6(rootDir, ".rig", "tap", "state.local.db");
+}
+function importStateDbPath(rootDir, name) {
+  return join6(rootDir, ".rig", "tap", "imports", name, "state.local.db");
+}
+function importsDir(rootDir) {
+  return join6(rootDir, ".rig", "tap", "imports");
+}
+function importMountFile(rootDir, name) {
+  return join6(importsDir(rootDir), `${name}.local.json`);
+}
+var MOUNT_FILE_SUFFIX = ".local.json";
+function writeImportMount(rootDir, name, mount) {
+  const path = importMountFile(rootDir, name);
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync2(path, JSON.stringify(mount, null, 2) + "\n", { mode: 384 });
+}
+function readImportMount(rootDir, name) {
+  const file = importMountFile(rootDir, name);
+  if (!existsSync3(file)) return { ok: false, reason: "missing_token_file" };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(file, "utf8"));
+  } catch {
+    return { ok: false, reason: "malformed_json" };
+  }
+  if (typeof parsed.bindingId !== "string" || parsed.bindingId === "") {
+    return { ok: false, reason: "missing_bindingId" };
+  }
+  if (typeof parsed.relayUrl !== "string" || parsed.relayUrl === "") {
+    return { ok: false, reason: "missing_relayUrl" };
+  }
+  if (typeof parsed.token !== "string" || parsed.token === "") {
+    return { ok: false, reason: "missing_token" };
+  }
+  if (typeof parsed.path !== "string" || parsed.path === "") {
+    return { ok: false, reason: "missing_path" };
+  }
+  const ops = Array.isArray(parsed.ops) ? parsed.ops : [];
+  if (!ops.includes("read") || !ops.includes("subscribe")) {
+    return { ok: false, reason: "insufficient_ops (need read+subscribe)" };
+  }
+  return {
+    ok: true,
+    spec: {
+      name,
+      bindingId: parsed.bindingId,
+      relayUrl: parsed.relayUrl,
+      token: parsed.token,
+      path: parsed.path
+    }
+  };
+}
+function loadImportMounts(rootDir) {
+  const dir = importsDir(rootDir);
+  const ready = [];
+  const broken = [];
+  if (!existsSync3(dir)) return { ready, broken };
+  for (const ent of readdirSync2(dir, { withFileTypes: true })) {
+    if (!ent.isFile() || !ent.name.endsWith(MOUNT_FILE_SUFFIX)) continue;
+    const name = ent.name.slice(0, -MOUNT_FILE_SUFFIX.length);
+    const nameErr = validateImportName(name);
+    if (nameErr) {
+      broken.push({ name, path: "", reason: nameErr });
+      continue;
+    }
+    const res = readImportMount(rootDir, name);
+    if (!res.ok) {
+      broken.push({ name, path: "", reason: res.reason });
+      continue;
+    }
+    ready.push(res.spec);
+  }
+  return { ready, broken };
+}
+function isWithin(parent, child) {
+  const rel = relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function realpathNearestExisting(abs) {
+  let cur = abs;
+  while (!existsSync3(cur)) {
+    const parent = dirname3(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  const realExisting = realpathSync(cur);
+  const remainder = relative(cur, abs);
+  return remainder ? join6(realExisting, remainder) : realExisting;
+}
+function firstExistingFileOnPath(abs) {
+  let cur = abs;
+  for (; ; ) {
+    if (existsSync3(cur)) {
+      return statSync2(cur).isFile() ? cur : null;
+    }
+    const parent = dirname3(cur);
+    if (parent === cur) return null;
+    cur = parent;
+  }
+}
+function pathsOverlap(a, b) {
+  return a === b || a.startsWith(b + "/") || b.startsWith(a + "/");
+}
+
+// src/import-invite.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5, rmSync } from "fs";
+import { dirname as dirname4, join as joinPath2 } from "path";
+var ImportValidationFailed = class extends Error {
+  constructor(reason) {
+    super(`import rejected: ${reason}`);
+    this.reason = reason;
+    this.name = "ImportValidationFailed";
+  }
+  reason;
+};
+var ImportTokenScopeError = class extends Error {
+  constructor(ops) {
+    super(
+      ops ? `invite token has ops [${ops.join(", ")}] \u2014 a mirror needs read+subscribe` : `invite can't drive a mirror \u2014 it needs read+subscribe`
+    );
+    this.ops = ops;
+    this.name = "ImportTokenScopeError";
+  }
+  ops;
+};
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+function deriveName(canonicalPath) {
+  const segs = canonicalPath.split("/").filter(Boolean);
+  return segs[segs.length - 1] ?? "";
+}
+function readPrimaryTrackedPaths(rootDir) {
+  const dbPath = primaryStateDbPath(rootDir);
+  if (!existsSync4(dbPath)) return [];
+  const db = openStateDb(dbPath);
+  try {
+    return db.listPaths();
+  } finally {
+    db.close();
+  }
+}
+async function addImport(opts) {
+  const path = normalizeImportPath(opts.path);
+  const name = opts.name && opts.name.length > 0 ? opts.name : deriveName(path);
+  const existing = loadImportMounts(opts.rootDir).ready;
+  const candidate = { name, bindingId: "", relayUrl: "", token: "", path };
+  const { valid, errors } = validateImports({
+    rootDir: opts.rootDir,
+    imports: [...existing, candidate],
+    primaryTrackedPaths: readPrimaryTrackedPaths(opts.rootDir)
+  });
+  if (!valid.some((v) => v.name === name && v.path === path)) {
+    const err = errors.find((e) => e.name === name);
+    throw new ImportValidationFailed(err?.reason ?? "invalid_import");
+  }
+  const primaryBindingId = readBindingConfig(opts.rootDir)?.bindingId;
+  const { baseUrl, secret } = parseInviteUrl(opts.inviteUrl);
+  let accepted;
+  try {
+    accepted = await acceptInvite({
+      baseUrl,
+      secret,
+      accessToken: opts.accessToken ?? null,
+      request: {
+        ...opts.deviceLabel ? { deviceLabel: opts.deviceLabel } : {},
+        importer: { ...primaryBindingId ? { bindingId: primaryBindingId } : {}, path }
+      },
+      fetch: opts.fetch
+    });
+  } catch (err) {
+    if (err instanceof RelayError && isRecord(err.body) && err.body.reason === "import_requires_read_subscribe") {
+      throw new ImportTokenScopeError();
+    }
+    throw err;
+  }
+  const ops = accepted.token.ops;
+  if (!ops.includes("read") || !ops.includes("subscribe")) {
+    throw new ImportTokenScopeError(ops);
+  }
+  writeImportMount(opts.rootDir, name, {
+    bindingId: accepted.bindingId,
+    relayUrl: baseUrl,
+    token: accepted.token.secret,
+    ops,
+    path,
+    ...accepted.importEdgeId ? { edgeId: accepted.importEdgeId } : {}
+  });
+  return {
+    name,
+    path,
+    bindingId: accepted.bindingId,
+    ops,
+    ...accepted.importEdgeId ? { edgeId: accepted.importEdgeId } : {},
+    // Only meaningful when we actually sent a binding to verify.
+    ...primaryBindingId !== void 0 ? { importerBindingVerified: accepted.importerBindingVerified ?? false } : {}
+  };
+}
+function readRawMount(rootDir, name) {
+  const file = importMountFile(rootDir, name);
+  if (!existsSync4(file)) return null;
+  try {
+    return JSON.parse(readFileSync5(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function removeImport(opts) {
+  const mountPath = importMountFile(opts.rootDir, opts.name);
+  const res = readImportMount(opts.rootDir, opts.name);
+  const raw = readRawMount(opts.rootDir, opts.name);
+  const path = res.ok ? res.spec.path : raw?.path ?? null;
+  let revoke2;
+  if (!raw?.edgeId || !raw.relayUrl) {
+    revoke2 = "no-edge";
+  } else if (!opts.accessToken) {
+    revoke2 = "no-token";
+  } else {
+    try {
+      const r = await revokeImportEdge({
+        baseUrl: raw.relayUrl,
+        edgeId: raw.edgeId,
+        accessToken: opts.accessToken,
+        fetch: opts.fetch
+      });
+      revoke2 = r.revoked ? "revoked" : r.status === 403 ? "not-creator" : r.status === 404 ? "gone" : "offline";
+    } catch {
+      revoke2 = "offline";
+    }
+  }
+  let removed = false;
+  if (existsSync4(mountPath)) {
+    rmSync(mountPath, { force: true });
+    removed = true;
+  }
+  rmSync(dirname4(importStateDbPath(opts.rootDir, opts.name)), {
+    recursive: true,
+    force: true
+  });
+  let purged = false;
+  if (opts.purge && path) {
+    rmSync(joinPath2(opts.rootDir, path), { recursive: true, force: true });
+    purged = true;
+  }
+  return { removed, path, purged, revoke: revoke2 };
+}
+
+// src/applier.ts
+import { createHash as createHash3, randomBytes } from "crypto";
+import {
+  existsSync as existsSync5,
+  lstatSync,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync6,
   renameSync,
   rmdirSync,
-  rmSync,
-  writeFileSync as writeFileSync2
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { basename, dirname as dirname3, extname, join as join6, sep as sep2 } from "path";
+import { basename, dirname as dirname5, extname, join as join7, sep as sep2 } from "path";
 var STATE_KEY_CONFLICT_COUNT = "conflict_count";
 var HashMismatchError = class extends Error {
   constructor(path, expectedHash, actualHash) {
@@ -789,10 +1173,10 @@ function sha256Hex(bytes) {
   return createHash3("sha256").update(bytes).digest("hex");
 }
 function sha256OfFile(absPath) {
-  return `sha256:${sha256Hex(readFileSync4(absPath))}`;
+  return `sha256:${sha256Hex(readFileSync6(absPath))}`;
 }
 function conflictSidecarPath(path, ev) {
-  const dir = dirname3(path);
+  const dir = dirname5(path);
   const ext = extname(path);
   const stem = basename(path, ext);
   const actor = ev.actorDeviceId ?? "unknown";
@@ -811,16 +1195,16 @@ function findConflictSidecars(rootDir) {
   walk2(".");
   return out;
   function walk2(rel) {
-    const abs = rel === "." ? rootDir : join6(rootDir, rel);
+    const abs = rel === "." ? rootDir : join7(rootDir, rel);
     let entries;
     try {
-      entries = readdirSync2(abs, { withFileTypes: true });
+      entries = readdirSync3(abs, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
       if (ent.isSymbolicLink()) continue;
-      const childRel = rel === "." ? ent.name : join6(rel, ent.name);
+      const childRel = rel === "." ? ent.name : join7(rel, ent.name);
       if (ent.isDirectory()) {
         if (SCAN_SKIP_DIRS.has(ent.name)) continue;
         walk2(childRel);
@@ -830,7 +1214,7 @@ function findConflictSidecars(rootDir) {
       const parsed = parseConflictSidecar(ent.name);
       if (!parsed) continue;
       const sidecarPosix = sep2 === "/" ? childRel : childRel.replaceAll(sep2, "/");
-      const dir = dirname3(sidecarPosix);
+      const dir = dirname5(sidecarPosix);
       const original = dir === "." ? `${parsed.stem}${parsed.ext}` : `${dir}/${parsed.stem}${parsed.ext}`;
       out.push({ path: original, sidecarPath: sidecarPosix });
     }
@@ -846,6 +1230,7 @@ function bumpConflictCount(stateDb) {
 var STATE_KEY_LAST_APPLY_ERROR = "last_apply_error";
 var STATE_KEY_LAST_APPLY_ERROR_AT = "last_apply_error_at";
 async function applyOnce(opts) {
+  const mode = opts.mode ?? "primary";
   const cursor = opts.stateDb.getCursor();
   const since = await opts.client.listChanges({ after: cursor, limit: opts.limit });
   let applied = 0;
@@ -858,7 +1243,8 @@ async function applyOnce(opts) {
         rootDir: opts.rootDir,
         client: opts.client,
         stateDb: opts.stateDb,
-        event: ev
+        event: ev,
+        mode
       });
       if (wasEcho) echoSkipped += 1;
       else applied += 1;
@@ -883,13 +1269,14 @@ async function applyOnce(opts) {
   return { applied, echoSkipped, errored, events: since.events, errors };
 }
 async function applyEvent(opts) {
-  const { rootDir, client, stateDb, event: ev } = opts;
-  const abs = join6(rootDir, ev.path);
+  const { rootDir, client, stateDb, event: ev, mode } = opts;
+  const mirror = mode === "mirror";
+  const abs = join7(rootDir, ev.path);
   switch (ev.op) {
     case "write": {
       if (!ev.hash) throw new Error(`write event ${ev.id} missing hash`);
       const local = stateDb.getPath(ev.path);
-      if (local?.lastSeenHash === ev.hash && existsSync3(abs)) {
+      if (local?.lastSeenHash === ev.hash && existsSync5(abs)) {
         stateDb.upsertPath({
           path: ev.path,
           lastAppliedChangeId: ev.id,
@@ -899,12 +1286,15 @@ async function applyEvent(opts) {
         });
         return true;
       }
-      if (existsSync3(abs) && lstatSync(abs).isDirectory()) {
-        throw new Error(
-          `file_vs_dir_collision: ${ev.path} is a local directory; refusing to overwrite with a file`
-        );
+      if (existsSync5(abs) && lstatSync(abs).isDirectory()) {
+        if (!mirror) {
+          throw new Error(
+            `file_vs_dir_collision: ${ev.path} is a local directory; refusing to overwrite with a file`
+          );
+        }
+        rmSync2(abs, { recursive: true, force: true });
       }
-      const localDirty = existsSync3(abs) && local?.lastSeenHash != null && sha256OfFile(abs) !== local.lastSeenHash;
+      const localDirty = !mirror && existsSync5(abs) && local?.lastSeenHash != null && sha256OfFile(abs) !== local.lastSeenHash;
       const dl = await client.downloadUrl(ev.hash);
       const bytes = await client.getObjectBytes(dl.downloadUrl);
       const actualHash = `sha256:${sha256Hex(bytes)}`;
@@ -913,10 +1303,10 @@ async function applyEvent(opts) {
       }
       if (localDirty) {
         const sidecarPath = conflictSidecarPath(ev.path, ev);
-        const sidecarAbs = join6(rootDir, sidecarPath);
-        mkdirSync3(dirname3(sidecarAbs), { recursive: true });
+        const sidecarAbs = join7(rootDir, sidecarPath);
+        mkdirSync4(dirname5(sidecarAbs), { recursive: true });
         const tmp2 = `${sidecarAbs}.tap-tmp.${randomBytes(6).toString("hex")}`;
-        writeFileSync2(tmp2, bytes, { mode: ev.executable ? 493 : 420 });
+        writeFileSync3(tmp2, bytes, { mode: ev.executable ? 493 : 420 });
         renameSync(tmp2, sidecarAbs);
         stateDb.upsertPath({
           path: ev.path,
@@ -928,9 +1318,9 @@ async function applyEvent(opts) {
         bumpConflictCount(stateDb);
         return false;
       }
-      mkdirSync3(dirname3(abs), { recursive: true });
+      mkdirSync4(dirname5(abs), { recursive: true });
       const tmp = `${abs}.tap-tmp.${randomBytes(6).toString("hex")}`;
-      writeFileSync2(tmp, bytes, { mode: ev.executable ? 493 : 420 });
+      writeFileSync3(tmp, bytes, { mode: ev.executable ? 493 : 420 });
       renameSync(tmp, abs);
       stateDb.upsertPath({
         path: ev.path,
@@ -942,36 +1332,43 @@ async function applyEvent(opts) {
       return false;
     }
     case "delete": {
-      if (existsSync3(abs)) {
+      if (existsSync5(abs)) {
         if (lstatSync(abs).isDirectory()) {
-          throw new Error(
-            `delete_vs_dir: ${ev.path} is a local directory; refusing recursive removal`
-          );
-        }
-        const localStateRow = stateDb.getPath(ev.path);
-        const localBytesHash = sha256OfFile(abs);
-        const localDirty = localStateRow?.lastSeenHash != null && localBytesHash !== localStateRow.lastSeenHash;
-        const localUntracked = localStateRow?.lastSeenHash == null;
-        if (localDirty || localUntracked) {
-          stateDb.upsertPath({
-            path: ev.path,
-            lastAppliedChangeId: ev.id,
-            // null so scanAndPush's `prev?.lastSeenHash === hash` check
-            // falls through and the file gets re-submitted as a write.
-            lastSeenHash: null,
-            localDirty: true,
-            lastScanAt: (/* @__PURE__ */ new Date()).toISOString()
-          });
-          bumpConflictCount(stateDb);
+          if (!mirror) {
+            throw new Error(
+              `delete_vs_dir: ${ev.path} is a local directory; refusing recursive removal`
+            );
+          }
+          rmSync2(abs, { recursive: true, force: true });
+          stateDb.deletePath(ev.path);
           return false;
         }
-        rmSync(abs, { force: true });
+        if (!mirror) {
+          const localStateRow = stateDb.getPath(ev.path);
+          const localBytesHash = sha256OfFile(abs);
+          const localDirty = localStateRow?.lastSeenHash != null && localBytesHash !== localStateRow.lastSeenHash;
+          const localUntracked = localStateRow?.lastSeenHash == null;
+          if (localDirty || localUntracked) {
+            stateDb.upsertPath({
+              path: ev.path,
+              lastAppliedChangeId: ev.id,
+              // null so scanAndPush's `prev?.lastSeenHash === hash` check
+              // falls through and the file gets re-submitted as a write.
+              lastSeenHash: null,
+              localDirty: true,
+              lastScanAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            bumpConflictCount(stateDb);
+            return false;
+          }
+        }
+        rmSync2(abs, { force: true });
       }
       stateDb.deletePath(ev.path);
       return false;
     }
     case "mkdir": {
-      mkdirSync3(abs, { recursive: true });
+      mkdirSync4(abs, { recursive: true });
       stateDb.upsertPath({
         path: ev.path,
         lastAppliedChangeId: ev.id,
@@ -982,9 +1379,13 @@ async function applyEvent(opts) {
       return false;
     }
     case "rmdir": {
-      try {
-        rmdirSync(abs);
-      } catch {
+      if (mirror) {
+        rmSync2(abs, { recursive: true, force: true });
+      } else {
+        try {
+          rmdirSync(abs);
+        } catch {
+        }
       }
       stateDb.deletePath(ev.path);
       return false;
@@ -1130,19 +1531,120 @@ function asError(err, fallbackName) {
   return e;
 }
 
+// src/subscription.ts
+var DEFAULT_POLL_SECONDS = 3;
+var SSE_APPLY_DEBOUNCE_MS = 50;
+async function startSubscription(opts) {
+  const { mode } = opts;
+  const stateDb = openStateDb(opts.stateDbPath);
+  const client = new RelayClient({
+    baseUrl: opts.config.relayUrl,
+    bindingId: opts.config.bindingId,
+    token: opts.config.token,
+    fetch: opts.fetch
+  });
+  const pollSeconds = opts.pollSeconds ?? DEFAULT_POLL_SECONDS;
+  let stopped = false;
+  let pollTimer;
+  let sseApplyTimer;
+  let sseSubscriber;
+  let applyInFlight = null;
+  let rerunRequested = false;
+  let lastApplyResult;
+  const triggerApply = () => {
+    if (applyInFlight) {
+      rerunRequested = true;
+      return applyInFlight;
+    }
+    const loop = (async () => {
+      try {
+        do {
+          rerunRequested = false;
+          try {
+            lastApplyResult = await applyOnce({
+              rootDir: opts.rootDir,
+              client,
+              stateDb,
+              mode
+            });
+          } catch (err) {
+            console.error("tapd apply error:", err);
+          }
+        } while (rerunRequested && !stopped);
+        return lastApplyResult;
+      } finally {
+        applyInFlight = null;
+      }
+    })();
+    applyInFlight = loop;
+    return loop;
+  };
+  const schedulePoll = () => {
+    if (stopped) return;
+    pollTimer = setTimeout(() => {
+      triggerApply().finally(() => schedulePoll());
+    }, pollSeconds * 1e3);
+  };
+  const scheduleSseApply = () => {
+    if (stopped) return;
+    if (sseApplyTimer) clearTimeout(sseApplyTimer);
+    sseApplyTimer = setTimeout(() => {
+      sseApplyTimer = void 0;
+      void triggerApply();
+    }, SSE_APPLY_DEBOUNCE_MS);
+  };
+  if (!opts.noSse) {
+    sseSubscriber = subscribe({
+      baseUrl: opts.config.relayUrl,
+      bindingId: opts.config.bindingId,
+      token: opts.config.token,
+      fetch: opts.fetch,
+      heartbeatTimeoutMs: opts.sseHeartbeatTimeoutMs,
+      onChange: () => scheduleSseApply(),
+      onError: (err) => {
+        console.error("tapd sse:", err.message);
+      }
+    });
+  }
+  await triggerApply();
+  schedulePoll();
+  return {
+    async stop() {
+      stopped = true;
+      if (pollTimer) clearTimeout(pollTimer);
+      if (sseApplyTimer) clearTimeout(sseApplyTimer);
+      if (sseSubscriber) await sseSubscriber.stop();
+      await Promise.allSettled([applyInFlight ?? Promise.resolve()]);
+      stateDb.close();
+    },
+    async applyNow() {
+      const result = await triggerApply();
+      return result ?? {
+        applied: 0,
+        echoSkipped: 0,
+        errored: 0,
+        events: [],
+        errors: []
+      };
+    },
+    stateDb
+  };
+}
+
 // src/uploader.ts
 import { createHash as createHash4 } from "crypto";
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
+var UPLOAD_CONCURRENCY2 = 8;
 function sha256OfBuffer2(bytes) {
   return `sha256:${createHash4("sha256").update(bytes).digest("hex")}`;
 }
 async function computeLocalDiff(opts) {
-  const { rootDir, stateDb, ignore: ignore2 } = opts;
-  const scan = walk(rootDir, { ignore: ignore2 });
+  const { rootDir, stateDb, ignore: ignore2, excludePaths } = opts;
+  const scan = walk(rootDir, { ignore: ignore2, excludePaths });
   const writes = [];
   for (const f of scan.files) {
-    const hash = await hashFile(join7(rootDir, f.path));
+    const hash = await hashFile(join8(rootDir, f.path));
     const prev = stateDb.getPath(f.path);
     if (prev?.lastSeenHash === hash) continue;
     const baseChangeId = prev?.lastAppliedChangeId ?? void 0;
@@ -1205,23 +1707,23 @@ async function scanAndPush(opts) {
   const skipWarnings = [];
   let uploaded = 0;
   let reused = 0;
-  for (const [hash, f] of uniqueHashes) {
-    const prep = await client.prepareUpload({ hash, size: f.size });
+  await mapPool([...uniqueHashes.values()], UPLOAD_CONCURRENCY2, async (f) => {
+    const prep = await client.prepareUpload({ hash: f.hash, size: f.size });
     if (prep.exists) {
       reused += 1;
-      continue;
+      return;
     }
-    const bytes = readFileSync5(join7(rootDir, f.path));
+    const bytes = readFileSync7(join8(rootDir, f.path));
     const actual = sha256OfBuffer2(bytes);
-    if (actual !== hash) {
+    if (actual !== f.hash) {
       mutatedPaths.add(f.path);
       skipWarnings.push({ path: f.path, reason: `mutated_during_scan:${actual}` });
-      continue;
+      return;
     }
     await client.putObjectBytes(prep.uploadUrl, bytes);
-    await client.completeUpload({ hash, size: f.size });
+    await client.completeUpload({ hash: f.hash, size: f.size });
     uploaded += 1;
-  }
+  });
   const events = [];
   for (const w of diff.writes) {
     if (mutatedPaths.has(w.path)) continue;
@@ -1291,152 +1793,183 @@ function cursorLessThan(a, b) {
 }
 
 // src/start.ts
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import chokidar from "chokidar";
-var DEFAULT_POLL_SECONDS = 3;
+var DEFAULT_POLL_SECONDS2 = 3;
 var DEFAULT_DEBOUNCE_MS = 300;
+var NOOP_APPLY = {
+  applied: 0,
+  echoSkipped: 0,
+  errored: 0,
+  events: [],
+  errors: []
+};
+var NOOP_SCAN = {
+  uploaded: 0,
+  reused: 0,
+  submitted: [],
+  warnings: []
+};
 async function start(opts) {
   const config = readBindingConfig(opts.rootDir);
-  if (!config) {
+  let importSpecs;
+  let loaderBroken = [];
+  if (opts.imports) {
+    importSpecs = opts.imports;
+  } else {
+    const loaded = loadImportMounts(opts.rootDir);
+    importSpecs = loaded.ready;
+    loaderBroken = loaded.broken;
+  }
+  for (const e of loaderBroken) {
+    console.error(`tapd import "${e.name}": skipped \u2014 ${e.reason}`);
+  }
+  if (!config && importSpecs.length === 0) {
     throw new Error(
-      `no binding config at ${opts.rootDir}/.rig/tap-binding.local.json \u2014 run \`tapd init\` first`
+      `no binding config at ${opts.rootDir}/.rig/tap-binding.local.json and no imports \u2014 run \`tapd init\` first`
     );
   }
-  const stateDb = openStateDb(
-    join8(opts.rootDir, ".rig", "tap", "state.local.db")
-  );
-  const ignore2 = loadIgnore(opts.rootDir);
-  const client = new RelayClient({
-    baseUrl: config.relayUrl,
-    bindingId: config.bindingId,
-    token: config.token,
-    fetch: opts.fetch
-  });
-  const pollSeconds = opts.pollSeconds ?? DEFAULT_POLL_SECONDS;
+  const pollSeconds = opts.pollSeconds ?? DEFAULT_POLL_SECONDS2;
   const debounceMs = opts.debounceMs ?? DEFAULT_DEBOUNCE_MS;
   let stopped = false;
-  let pollTimer;
-  let scanTimer;
-  let sseApplyTimer;
+  let primary;
   let watcher;
+  let scanTimer;
   let scanInFlight = Promise.resolve();
-  let sseSubscriber;
-  let applyInFlight = null;
-  let rerunRequested = false;
-  let lastApplyResult;
-  const triggerApply = () => {
-    if (applyInFlight) {
-      rerunRequested = true;
-      return applyInFlight;
-    }
-    const loop = (async () => {
-      try {
-        do {
-          rerunRequested = false;
-          try {
-            lastApplyResult = await applyOnce({
-              rootDir: opts.rootDir,
-              client,
-              stateDb
-            });
-          } catch (err) {
-            console.error("tapd apply error:", err);
-          }
-        } while (rerunRequested && !stopped);
-        return lastApplyResult;
-      } finally {
-        applyInFlight = null;
-      }
-    })();
-    applyInFlight = loop;
-    return loop;
-  };
-  const schedulePoll = () => {
-    if (stopped) return;
-    pollTimer = setTimeout(() => {
-      triggerApply().finally(() => schedulePoll());
-    }, pollSeconds * 1e3);
-  };
-  const scheduleScan = () => {
-    if (stopped) return;
-    if (scanTimer) clearTimeout(scanTimer);
-    scanTimer = setTimeout(() => {
-      scanInFlight = scanAndPush({ rootDir: opts.rootDir, client, stateDb, ignore: ignore2 }).catch((err) => {
-        console.error("tapd scan error:", err);
-      });
-    }, debounceMs);
-  };
-  const SSE_APPLY_DEBOUNCE_MS = 50;
-  const scheduleSseApply = () => {
-    if (stopped) return;
-    if (sseApplyTimer) clearTimeout(sseApplyTimer);
-    sseApplyTimer = setTimeout(() => {
-      sseApplyTimer = void 0;
-      void triggerApply();
-    }, SSE_APPLY_DEBOUNCE_MS);
-  };
-  if (!opts.noSse) {
-    sseSubscriber = subscribe({
+  let writerClient;
+  const ignore2 = loadIgnore(opts.rootDir);
+  let importPaths = [];
+  if (config) {
+    primary = await startSubscription({
+      rootDir: opts.rootDir,
+      config,
+      stateDbPath: primaryStateDbPath(opts.rootDir),
+      mode: "primary",
+      fetch: opts.fetch,
+      pollSeconds,
+      noSse: opts.noSse,
+      sseHeartbeatTimeoutMs: opts.sseHeartbeatTimeoutMs
+    });
+  }
+  const primaryTrackedPaths = primary ? primary.stateDb.listPaths() : [];
+  const { valid: validImports, errors: importErrors } = validateImports({
+    rootDir: opts.rootDir,
+    imports: importSpecs,
+    primaryTrackedPaths
+  });
+  for (const e of importErrors) {
+    console.error(`tapd import "${e.name}" (${e.path}): skipped \u2014 ${e.reason}`);
+  }
+  importPaths = validImports.map((i) => i.path);
+  if (config && primary) {
+    const primaryStateDb = primary.stateDb;
+    writerClient = new RelayClient({
       baseUrl: config.relayUrl,
       bindingId: config.bindingId,
       token: config.token,
-      fetch: opts.fetch,
-      heartbeatTimeoutMs: opts.sseHeartbeatTimeoutMs,
-      onChange: () => scheduleSseApply(),
-      onError: (err) => {
-        console.error("tapd sse:", err.message);
+      fetch: opts.fetch
+    });
+    const scheduleScan = () => {
+      if (stopped) return;
+      if (scanTimer) clearTimeout(scanTimer);
+      scanTimer = setTimeout(() => {
+        scanInFlight = scanAndPush({
+          rootDir: opts.rootDir,
+          client: writerClient,
+          stateDb: primaryStateDb,
+          ignore: ignore2,
+          excludePaths: importPaths
+        }).catch((err) => {
+          console.error("tapd scan error:", err);
+        });
+      }, debounceMs);
+    };
+    if (!opts.noWatch) {
+      watcher = chokidar.watch(opts.rootDir, {
+        ignoreInitial: true,
+        // Hard-exclude tap metadata AND every import mount point — the
+        // latter so a mirrored subtree never triggers a re-upload into
+        // the primary binding.
+        ignored: (path) => {
+          const rel = path.startsWith(opts.rootDir) ? path.slice(opts.rootDir.length).replace(/^[/\\]/, "") : path;
+          if (isAlwaysExcluded(rel)) return true;
+          if (importPaths.length > 0 && isUnderAny(rel, importPaths)) return true;
+          return false;
+        },
+        awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 },
+        atomic: true
+      });
+      for (const ev of ["add", "change", "unlink", "addDir", "unlinkDir"]) {
+        watcher.on(ev, () => scheduleScan());
       }
+    }
+    scanInFlight = scanAndPush({
+      rootDir: opts.rootDir,
+      client: writerClient,
+      stateDb: primaryStateDb,
+      ignore: ignore2,
+      excludePaths: importPaths
+    }).catch((err) => {
+      console.error("tapd initial scan error:", err);
     });
+    await scanInFlight;
   }
-  if (!opts.noWatch) {
-    watcher = chokidar.watch(opts.rootDir, {
-      ignoreInitial: true,
-      // Ignore tap's own state files at the watcher level too — saves
-      // wakeups from sqlite WAL churn.
-      ignored: (path) => {
-        const rel = path.startsWith(opts.rootDir) ? path.slice(opts.rootDir.length).replace(/^[/\\]/, "") : path;
-        if (isAlwaysExcluded(rel)) return true;
-        return false;
-      },
-      // Reasonable defaults for laptop workloads.
-      awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 },
-      atomic: true
-    });
-    for (const ev of ["add", "change", "unlink", "addDir", "unlinkDir"]) {
-      watcher.on(ev, () => scheduleScan());
+  const imports = [];
+  const mirrorSubs = [];
+  for (const imp of validImports) {
+    try {
+      const sub = await startSubscription({
+        rootDir: join9(opts.rootDir, imp.path),
+        config: { bindingId: imp.bindingId, relayUrl: imp.relayUrl, token: imp.token },
+        stateDbPath: importStateDbPath(opts.rootDir, imp.name),
+        mode: "mirror",
+        fetch: opts.fetch,
+        pollSeconds,
+        noSse: opts.noSse,
+        sseHeartbeatTimeoutMs: opts.sseHeartbeatTimeoutMs
+      });
+      mirrorSubs.push(sub);
+      imports.push({
+        name: imp.name,
+        path: imp.path,
+        applyNow: () => sub.applyNow(),
+        stateDb: sub.stateDb
+      });
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      console.error(`tapd import "${imp.name}" (${imp.path}): failed to start \u2014 ${reason}`);
     }
   }
-  await triggerApply();
-  scanInFlight = scanAndPush({ rootDir: opts.rootDir, client, stateDb, ignore: ignore2 }).catch((err) => {
-    console.error("tapd initial scan error:", err);
-  });
-  await scanInFlight;
-  schedulePoll();
+  const stateDb = primary?.stateDb ?? imports[0]?.stateDb;
+  if (!stateDb) {
+    throw new Error("tapd start: no primary binding and no import mounted successfully");
+  }
   return {
     async stop() {
       stopped = true;
-      if (pollTimer) clearTimeout(pollTimer);
       if (scanTimer) clearTimeout(scanTimer);
-      if (sseApplyTimer) clearTimeout(sseApplyTimer);
-      if (sseSubscriber) await sseSubscriber.stop();
-      await Promise.allSettled([applyInFlight ?? Promise.resolve(), scanInFlight]);
+      await Promise.allSettled([scanInFlight]);
       if (watcher) await watcher.close();
-      stateDb.close();
+      const subs = [];
+      if (primary) subs.push(primary.stop());
+      for (const sub of mirrorSubs) subs.push(sub.stop());
+      await Promise.allSettled(subs);
     },
     async applyNow() {
-      const result = await triggerApply();
-      return result ?? {
-        applied: 0,
-        echoSkipped: 0,
-        errored: 0,
-        events: [],
-        errors: []
-      };
+      return primary ? primary.applyNow() : NOOP_APPLY;
     },
     async scanNow() {
-      return scanAndPush({ rootDir: opts.rootDir, client, stateDb, ignore: ignore2 });
+      if (!config || !primary || !writerClient) return NOOP_SCAN;
+      return scanAndPush({
+        rootDir: opts.rootDir,
+        client: writerClient,
+        stateDb: primary.stateDb,
+        ignore: ignore2,
+        excludePaths: importPaths
+      });
     },
-    stateDb
+    stateDb,
+    imports
   };
 }
 
@@ -1464,13 +1997,29 @@ export {
   InvalidInviteUrlError,
   parseInviteUrl,
   join5 as join,
+  validateImportName,
+  normalizeImportPath,
+  validateImportPath,
+  validateImports,
+  primaryStateDbPath,
+  importStateDbPath,
+  importsDir,
+  importMountFile,
+  writeImportMount,
+  readImportMount,
+  loadImportMounts,
+  ImportValidationFailed,
+  ImportTokenScopeError,
+  addImport,
+  removeImport,
   STATE_KEY_CONFLICT_COUNT,
   conflictSidecarPath,
   findConflictSidecars,
   applyOnce,
   subscribe,
+  startSubscription,
   computeLocalDiff,
   scanAndPush,
   start
 };
-//# sourceMappingURL=chunk-N3KRCOBG.js.map
+//# sourceMappingURL=chunk-JBX2ZRMD.js.map