@teammy/cli 0.0.0-stage → 0.0.2

package/dist/main.js

@@ -0,0 +1,2908 @@
+// apps/client/control.ts
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+
+// packages/protocol/devices.ts
+import { z as z3 } from "zod";
+
+// packages/protocol/identity.ts
+import { z } from "zod";
+var NameSchema = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/);
+var DeviceIdSchema = z.uuid();
+var BindRequestSchema = z.object({ deviceId: DeviceIdSchema }).strict();
+var BindingSchema = z.object({
+  workspaceId: NameSchema,
+  memberId: NameSchema,
+  deviceId: DeviceIdSchema
+});
+var MembersSchema = z.object({ members: z.array(NameSchema) });
+
+// packages/protocol/files.ts
+import { z as z2 } from "zod";
+var MAX_BLOB_BYTES = 10 * 1024 * 1024;
+var MAX_BATCH_FILES = 200;
+var HashSchema = z2.string().regex(/^[a-f0-9]{64}$/);
+var RevisionSchema = z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var FilePathSchema = z2.string().min(1).max(1024).refine((path) => {
+  if (path !== path.normalize("NFC") || /[\\\x00-\x1f\x7f:<>"|?*]/.test(path)) return false;
+  return path.split("/").every(
+    (part) => part.length > 0 && part.length <= 255 && part !== "." && part !== ".." && !/[. ]$/.test(part) && !/^\.teammy(?:-|$)/i.test(part) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part)
+  );
+}, "Path must be a portable, normalized relative file path.");
+var BlobRefSchema = z2.object({
+  sha256: HashSchema,
+  size: z2.number().int().min(0).max(MAX_BLOB_BYTES)
+});
+var FileChangeSchema = z2.discriminatedUnion("kind", [
+  BlobRefSchema.extend({ kind: z2.literal("upsert"), path: FilePathSchema }).strict(),
+  z2.object({ kind: z2.literal("delete"), path: FilePathSchema }).strict()
+]);
+var FileCommitSchema = z2.object({
+  operationId: z2.uuid(),
+  parentRevision: RevisionSchema,
+  changes: z2.array(FileChangeSchema).min(1).max(MAX_BATCH_FILES)
+}).strict().refine(
+  (batch) => new Set(batch.changes.map((change) => change.path)).size === batch.changes.length,
+  "Duplicate paths in a batch."
+);
+var CommitResultSchema = z2.object({ operationId: z2.uuid(), revision: RevisionSchema });
+var FileEntrySchema = BlobRefSchema.extend({
+  path: FilePathSchema,
+  revision: RevisionSchema
+});
+var ManifestSchema = z2.object({
+  revision: RevisionSchema,
+  files: z2.array(FileEntrySchema),
+  nextCursor: z2.string().nullable()
+});
+var FileRevisionSchema = z2.object({
+  revision: RevisionSchema,
+  operationId: z2.uuid(),
+  createdAt: z2.string(),
+  changes: z2.array(FileChangeSchema)
+});
+var ChangesSchema = z2.object({
+  headRevision: RevisionSchema,
+  revisions: z2.array(FileRevisionSchema)
+});
+var BlobCheckSchema = z2.object({ hashes: z2.array(HashSchema).max(MAX_BATCH_FILES) }).strict();
+var MissingBlobsSchema = z2.object({ missing: z2.array(HashSchema) });
+
+// packages/protocol/devices.ts
+var CredentialSchema = z3.string().regex(/^tmy_[a-f0-9]{64}$/);
+var EnrollmentSchema = z3.object({
+  operationId: z3.uuid(),
+  memberId: NameSchema,
+  deviceId: DeviceIdSchema,
+  credential: CredentialSchema
+}).strict();
+var EffectivePolicySchema = z3.object({
+  checkIntervalSeconds: z3.number().min(1).max(86400),
+  fileSettleSeconds: z3.number().min(0).max(86400)
+}).strict();
+var SyncSummarySchema = z3.object({
+  checkedAt: z3.string(),
+  published: z3.boolean(),
+  appliedFiles: z3.number().int().nonnegative(),
+  pendingFiles: z3.number().int().nonnegative(),
+  sessionSources: z3.number().int().nonnegative(),
+  errors: z3.array(z3.string().max(1e3)).max(20)
+}).strict();
+var DeviceStatusSchema = z3.object({
+  clientVersion: z3.string().max(64),
+  receivedRevision: RevisionSchema.nullable(),
+  appliedRevision: RevisionSchema.nullable(),
+  effectivePolicy: EffectivePolicySchema,
+  overrides: z3.array(z3.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
+  configError: z3.string().max(2e3).nullable(),
+  reportError: z3.string().max(2e3).nullable(),
+  lastSync: SyncSummarySchema.nullable()
+}).strict();
+var WebDevicesSchema = z3.object({
+  devices: z3.array(
+    z3.object({
+      memberId: NameSchema,
+      bound: z3.boolean(),
+      lastSeenAt: z3.string().nullable(),
+      status: DeviceStatusSchema.nullable()
+    })
+  )
+});
+
+// packages/protocol/project.ts
+import { z as z4 } from "zod";
+var ServerUrlSchema = z4.string().url().max(2048).refine((value) => {
+  const url = new URL(value);
+  return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
+}, "Use an HTTP(S) server URL without credentials, query or fragment.");
+var SyncPolicySchema = z4.object({
+  checkIntervalSeconds: z4.number().int().min(1).max(86400),
+  fileSettleSeconds: z4.number().int().min(0).max(86400)
+}).strict();
+var DEFAULT_POLICY = { checkIntervalSeconds: 60, fileSettleSeconds: 60 };
+var ProjectConfigSchema = z4.object({
+  schemaVersion: z4.literal(1),
+  projectId: NameSchema,
+  projectName: z4.string().trim().min(1).max(120),
+  description: z4.string().max(2e3),
+  publicServerUrl: ServerUrlSchema,
+  configRevision: RevisionSchema,
+  scopeProfile: z4.literal("workspace-and-sessions-v1"),
+  sync: SyncPolicySchema
+}).strict();
+var SetupSchema = z4.object({
+  operationId: z4.uuid(),
+  projectName: z4.string().trim().min(1).max(120),
+  description: z4.string().max(2e3).default(""),
+  publicServerUrl: ServerUrlSchema,
+  adminId: NameSchema,
+  members: z4.array(NameSchema).max(100).default([]),
+  existingWorkspaceId: NameSchema.optional(),
+  sync: SyncPolicySchema.default(DEFAULT_POLICY)
+}).strict();
+var SetupStatusSchema = z4.object({
+  initialized: z4.boolean(),
+  existingWorkspaces: z4.array(NameSchema)
+});
+var ConfigUpdateSchema = ProjectConfigSchema.pick({
+  projectName: true,
+  description: true,
+  publicServerUrl: true,
+  sync: true
+}).extend({ expectedRevision: RevisionSchema }).strict();
+var MemberSchema = z4.object({
+  id: NameSchema,
+  displayName: z4.string().max(120),
+  role: z4.enum(["admin", "member"]),
+  enabled: z4.boolean(),
+  revision: RevisionSchema,
+  bound: z4.boolean(),
+  fileRevision: RevisionSchema,
+  lastPublishedAt: z4.string().nullable()
+});
+var WebSessionSchema = z4.object({
+  workspaceId: NameSchema,
+  memberId: NameSchema,
+  displayName: z4.string(),
+  role: z4.enum(["admin", "member"])
+});
+var MemberCreateSchema = z4.object({ id: NameSchema, displayName: z4.string().trim().max(120).default("") }).strict();
+var MemberUpdateSchema = z4.object({
+  expectedRevision: RevisionSchema,
+  displayName: z4.string().trim().max(120).optional(),
+  enabled: z4.boolean().optional()
+}).strict();
+
+// packages/protocol/sessions.ts
+import { createHash } from "node:crypto";
+import { z as z5 } from "zod";
+var AgentSchema = z5.enum(["claude-code", "codex", "cursor", "pi", "dsh"]);
+var SessionSnapshotSchema = z5.object({
+  formatVersion: z5.literal(1),
+  adapterVersion: z5.literal(1),
+  agent: AgentSchema,
+  nativeId: z5.string().min(1).max(512),
+  cwd: z5.string().min(1).max(4096),
+  messages: z5.array(
+    z5.object({
+      id: z5.string().min(1).max(1024),
+      role: z5.enum(["user", "assistant"]),
+      text: z5.string().min(1).max(2 * 1024 * 1024),
+      source: z5.string().min(1).max(1024)
+    }).strict()
+  ).max(5e4)
+}).strict().refine(
+  (s) => new Set(s.messages.map((m) => m.id)).size === s.messages.length,
+  "Duplicate message IDs."
+);
+function sessionKey(agent, nativeId) {
+  return createHash("sha256").update(JSON.stringify([agent, nativeId])).digest("hex");
+}
+var SessionCommitSchema = z5.object({
+  operationId: z5.uuid(),
+  sessionKey: HashSchema,
+  parentRevision: RevisionSchema,
+  blob: BlobRefSchema
+}).strict();
+var SessionInfoSchema = z5.object({
+  owner: NameSchema,
+  sessionKey: HashSchema,
+  agent: AgentSchema,
+  nativeId: z5.string(),
+  cwd: z5.string(),
+  title: z5.string(),
+  revision: RevisionSchema,
+  updatedAt: z5.string(),
+  messageCount: z5.number().int().nonnegative(),
+  blob: BlobRefSchema
+});
+var SessionListSchema = z5.object({
+  sessions: z5.array(SessionInfoSchema),
+  nextCursor: RevisionSchema.nullable()
+});
+var SessionSearchSchema = z5.object({
+  matches: z5.array(
+    z5.object({
+      owner: NameSchema,
+      sessionKey: HashSchema,
+      revision: RevisionSchema,
+      messageId: z5.string(),
+      role: z5.enum(["user", "assistant"]),
+      snippet: z5.string()
+    })
+  ),
+  nextCursor: RevisionSchema.nullable()
+});
+
+// packages/transport/hub-client.ts
+import { z as z7 } from "zod";
+import { createHash as createHash2 } from "node:crypto";
+
+// packages/protocol/index.ts
+import { z as z6 } from "zod";
+var PROTOCOL_VERSION = 1;
+var HealthSchema = z6.object({ status: z6.literal("ok") });
+var ServerInfoSchema = z6.object({
+  name: z6.literal("teammy"),
+  version: z6.string().min(1),
+  protocolVersion: z6.literal(PROTOCOL_VERSION),
+  capabilities: z6.array(z6.string())
+});
+var ErrorResponseSchema = z6.object({
+  error: z6.object({
+    code: z6.string(),
+    message: z6.string(),
+    requestId: z6.string()
+  })
+});
+
+// packages/transport/hub-client.ts
+var HubRequestError = class extends Error {
+  constructor(message2, status, code, requestId) {
+    super(message2);
+    this.status = status;
+    this.code = code;
+    this.requestId = requestId;
+    this.name = "HubRequestError";
+  }
+  status;
+  code;
+  requestId;
+};
+var HubClient = class {
+  constructor(serverUrl, timeoutMs = 1e4, credentials, abortSignal) {
+    this.timeoutMs = timeoutMs;
+    this.credentials = credentials;
+    this.abortSignal = abortSignal;
+    this.baseUrl = new URL(serverUrl);
+    if (!["http:", "https:"].includes(this.baseUrl.protocol) || this.baseUrl.username || this.baseUrl.password || this.baseUrl.search || this.baseUrl.hash) {
+      throw new Error("Server URL must use HTTP(S), without credentials, query, or fragment.");
+    }
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+      throw new Error("Request timeout must be a positive integer.");
+    }
+    if (!this.baseUrl.pathname.endsWith("/")) this.baseUrl.pathname += "/";
+  }
+  timeoutMs;
+  credentials;
+  abortSignal;
+  baseUrl;
+  health() {
+    return this.request("GET", "healthz", HealthSchema);
+  }
+  serverInfo() {
+    return this.request("GET", "api/v1/server", ServerInfoSchema);
+  }
+  get url() {
+    return this.baseUrl.toString();
+  }
+  bind(deviceId) {
+    return this.request("POST", "api/v1/bind", BindingSchema, { deviceId });
+  }
+  members() {
+    return this.request("GET", "api/v1/members", MembersSchema);
+  }
+  missingBlobs(hashes) {
+    return this.request("POST", "api/v1/blobs/check", MissingBlobsSchema, { hashes });
+  }
+  uploadBlob(hash2, content) {
+    if (content.byteLength > MAX_BLOB_BYTES)
+      throw new Error("Content exceeds the file size limit.");
+    return this.request("PUT", `api/v1/blobs/${HashSchema.parse(hash2)}`, BlobRefSchema, content);
+  }
+  async downloadBlob(hash2) {
+    const { response, signal } = await this.fetchResponse(
+      "GET",
+      `api/v1/blobs/${HashSchema.parse(hash2)}`
+    );
+    if (!response.ok) return this.decode(response, signal, z7.never());
+    const reader = response.body?.getReader();
+    if (!reader) throw new Error("Server returned no content body.");
+    const parts = [];
+    let size = 0;
+    try {
+      for (; ; ) {
+        const result = await reader.read();
+        if (result.done) break;
+        size += result.value.byteLength;
+        if (size > MAX_BLOB_BYTES) throw new Error("Downloaded content exceeds the size limit.");
+        parts.push(result.value);
+      }
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    const bytes = Buffer.concat(parts, size);
+    if (createHash2("sha256").update(bytes).digest("hex") !== hash2)
+      throw new Error("Downloaded content failed integrity verification.");
+    return bytes;
+  }
+  commitFiles(batch) {
+    return this.request("POST", "api/v1/files/commits", CommitResultSchema, batch);
+  }
+  fileManifest(owner, revision, after = "", limit = 200) {
+    const query = new URLSearchParams({ after, limit: String(limit) });
+    if (revision !== void 0) query.set("revision", String(revision));
+    return this.request(
+      "GET",
+      `api/v1/files/${encodeURIComponent(owner)}/manifest?${query}`,
+      ManifestSchema
+    );
+  }
+  fileChanges(owner, after) {
+    return this.request(
+      "GET",
+      `api/v1/files/${encodeURIComponent(owner)}/changes?after=${after}`,
+      ChangesSchema
+    );
+  }
+  reportDeviceStatus(status) {
+    return this.request(
+      "PUT",
+      "api/v1/devices/self/status",
+      z7.object({ ok: z7.literal(true) }),
+      status
+    );
+  }
+  enroll(request) {
+    return this.request("POST", "api/v1/devices/enroll", BindingSchema, request);
+  }
+  projectConfig() {
+    return this.request("GET", "api/v1/project/config", ProjectConfigSchema);
+  }
+  commitSession(commit) {
+    return this.request(
+      "POST",
+      "api/v1/sessions/commits",
+      CommitResultSchema,
+      SessionCommitSchema.parse(commit)
+    );
+  }
+  sessions(after = 0, limit = 50) {
+    return this.request(
+      "GET",
+      `api/v1/sessions?${new URLSearchParams({ after: String(after), limit: String(limit) })}`,
+      SessionListSchema
+    );
+  }
+  session(owner, key, revision) {
+    return this.request(
+      "GET",
+      `api/v1/sessions/${encodeURIComponent(owner)}/${HashSchema.parse(key)}${revision === void 0 ? "" : `?revision=${revision}`}`,
+      SessionInfoSchema
+    );
+  }
+  searchSessions(query, after = 0, limit = 50) {
+    return this.request(
+      "GET",
+      `api/v1/sessions/search?${new URLSearchParams({ q: query, after: String(after), limit: String(limit) })}`,
+      SessionSearchSchema
+    );
+  }
+  async request(method, path, schema, requestBody) {
+    const { response, signal } = await this.fetchResponse(method, path, requestBody);
+    return this.decode(response, signal, schema);
+  }
+  async fetchResponse(method, path, requestBody) {
+    const timeout = AbortSignal.timeout(this.timeoutMs);
+    const signal = this.abortSignal ? AbortSignal.any([timeout, this.abortSignal]) : timeout;
+    const binary = requestBody instanceof Uint8Array;
+    const response = await fetch(new URL(path, this.baseUrl), {
+      method,
+      headers: {
+        accept: "application/json",
+        ...requestBody === void 0 ? {} : { "content-type": binary ? "application/octet-stream" : "application/json" },
+        ...this.credentials ? {
+          authorization: `Bearer ${this.credentials.token}`,
+          "x-teammy-device": this.credentials.deviceId
+        } : {}
+      },
+      ...requestBody === void 0 ? {} : { body: binary ? Uint8Array.from(requestBody).buffer : JSON.stringify(requestBody) },
+      signal,
+      redirect: "error"
+    });
+    return { response, signal };
+  }
+  async decode(response, signal, schema) {
+    const requestId = response.headers.get("x-request-id") ?? void 0;
+    let body;
+    try {
+      body = await response.json();
+    } catch (error) {
+      if (signal.aborted) throw signal.reason;
+      if (!(error instanceof SyntaxError)) throw error;
+    }
+    if (!response.ok) {
+      const parsed2 = ErrorResponseSchema.safeParse(body);
+      throw new HubRequestError(
+        parsed2.success ? parsed2.data.error.message : "Hub request failed.",
+        response.status,
+        parsed2.success ? parsed2.data.error.code : "HTTP_ERROR",
+        parsed2.success ? parsed2.data.error.requestId : requestId
+      );
+    }
+    const parsed = schema.safeParse(body);
+    if (!parsed.success) {
+      throw new HubRequestError(
+        "Hub returned an incompatible response.",
+        response.status,
+        "INVALID_RESPONSE",
+        requestId
+      );
+    }
+    return parsed.data;
+  }
+};
+
+// apps/client/project-state.ts
+import { randomBytes, randomUUID } from "node:crypto";
+var projectClientMigration = String.raw`
+ CREATE TABLE client_enrollments(root TEXT PRIMARY KEY REFERENCES connections(root),server_url TEXT NOT NULL,request_json TEXT NOT NULL);
+ CREATE TABLE client_project_config(root TEXT PRIMARY KEY REFERENCES connections(root),config_json TEXT NOT NULL,descriptor_hash TEXT NOT NULL);
+`;
+var ClientProjectState = class {
+  constructor(state, root) {
+    this.state = state;
+    this.root = root;
+  }
+  state;
+  root;
+  enrollment(url, memberId, reconnect = false) {
+    const deviceId = this.state.deviceFor(this.root);
+    const row = this.state.db.prepare("SELECT * FROM client_enrollments WHERE root=?").get(this.root);
+    if (row && !reconnect) {
+      const request2 = EnrollmentSchema.parse(JSON.parse(String(row.request_json)));
+      if (row.server_url !== url || request2.memberId !== memberId)
+        throw new Error("Another enrollment is pending for this root; use the same member/server.");
+      return request2;
+    }
+    const request = {
+      operationId: randomUUID(),
+      memberId,
+      deviceId,
+      credential: `tmy_${randomBytes(32).toString("hex")}`
+    };
+    this.state.db.prepare(
+      "INSERT INTO client_enrollments VALUES (?,?,?) ON CONFLICT(root) DO UPDATE SET server_url=excluded.server_url,request_json=excluded.request_json"
+    ).run(this.root, url, JSON.stringify(request));
+    return request;
+  }
+  completeEnrollment() {
+    this.state.db.prepare("DELETE FROM client_enrollments WHERE root=?").run(this.root);
+  }
+  cached() {
+    const row = this.state.db.prepare("SELECT * FROM client_project_config WHERE root=?").get(this.root);
+    return row ? {
+      config: ProjectConfigSchema.parse(JSON.parse(String(row.config_json))),
+      hash: String(row.descriptor_hash)
+    } : void 0;
+  }
+  save(config, hash2) {
+    this.state.db.prepare(
+      "INSERT INTO client_project_config VALUES (?,?,?) ON CONFLICT(root) DO UPDATE SET config_json=excluded.config_json,descriptor_hash=excluded.descriptor_hash"
+    ).run(this.root, JSON.stringify(config), hash2);
+  }
+};
+
+// apps/client/project-file.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// apps/client/files/local-fs.ts
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, realpath, rename, rmdir, unlink } from "node:fs/promises";
+import { dirname, join, relative, sep } from "node:path";
+import { setImmediate } from "node:timers/promises";
+function missing(error) {
+  return error instanceof Error && "code" in error && ["ENOENT", "ENOTDIR"].includes(String(error.code));
+}
+function signature(stat2) {
+  return [stat2.dev, stat2.ino, stat2.size, stat2.mtimeNs, stat2.ctimeNs].join(":");
+}
+function ignored(path) {
+  return path.split("/").some(
+    (part) => part === ".git" || part === ".DS_Store" || /^\.teammy(?:-|$)/i.test(part) || /(?:~|\.(?:swp|swx|tmp|part))$/i.test(part)
+  );
+}
+async function safePath(root, path, createParents = false) {
+  FilePathSchema.parse(path);
+  const rootStat = await lstat(root);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+    throw new Error(`Sync root must be an ordinary directory: ${root}`);
+  const parts = path.split("/");
+  let parent = root;
+  for (const part of parts.slice(0, -1)) {
+    parent = join(parent, part);
+    if (createParents)
+      await mkdir(parent).catch((error) => {
+        if (error.code !== "EEXIST") throw error;
+      });
+    const stat2 = await lstat(parent);
+    if (stat2.isSymbolicLink()) throw new Error(`Refusing a symlink in sync path: ${path}`);
+    if (!stat2.isDirectory())
+      throw Object.assign(new Error(`Parent is not a directory: ${path}`), { code: "ENOTDIR" });
+  }
+  return join(root, ...parts);
+}
+async function metadata(root, path) {
+  try {
+    const target = await safePath(root, path);
+    const stat2 = await lstat(target, { bigint: true });
+    if (stat2.isSymbolicLink() || !stat2.isFile() && !stat2.isDirectory())
+      throw new Error(`Unsupported filesystem entry: ${path}`);
+    return { signature: signature(stat2), directory: stat2.isDirectory() };
+  } catch (error) {
+    if (missing(error)) return null;
+    throw error;
+  }
+}
+async function walk(root, prefix = "") {
+  const files = /* @__PURE__ */ new Map();
+  const issues = [];
+  const directory = prefix ? await safePath(root, prefix) : root;
+  const rootStat = await lstat(directory);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+    throw new Error("Author directory is unavailable or is not an ordinary directory.");
+  const pending = [prefix];
+  let visited = 0;
+  while (pending.length) {
+    const current = pending.pop();
+    try {
+      const full = current ? await safePath(root, current) : root;
+      const directoryStat = await lstat(full);
+      if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink())
+        throw new Error(`Directory changed while scanning: ${current}`);
+      for (const entry of await readdir(full, { withFileTypes: true })) {
+        const path = current ? `${current}/${entry.name}` : entry.name;
+        if (ignored(path)) continue;
+        try {
+          FilePathSchema.parse(path);
+          const stat2 = await lstat(await safePath(root, path), { bigint: true });
+          if (stat2.isDirectory() && !stat2.isSymbolicLink()) pending.push(path);
+          else if (stat2.isFile()) files.set(path, signature(stat2));
+          else throw new Error(`Unsupported filesystem entry: ${path}`);
+        } catch (error) {
+          issues.push(
+            `${path}: ${error instanceof Error ? error.message : "Cannot inspect entry"}`
+          );
+        }
+        if (++visited % 200 === 0) await setImmediate();
+        if (visited > 1e5)
+          throw new Error("Scan limit exceeded; no deletions will be inferred.");
+      }
+    } catch (error) {
+      issues.push(error instanceof Error ? error.message : "Directory scan failed");
+    }
+  }
+  return { files, issues, complete: issues.length === 0 };
+}
+async function readStable(root, path) {
+  const target = await safePath(root, path);
+  const resolvedBefore = await realpath(target);
+  const inside = relative(await realpath(root), resolvedBefore);
+  if (inside.startsWith(`..${sep}`) || inside === "..")
+    throw new Error(`File escapes sync root: ${path}`);
+  const file = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const before = await file.stat({ bigint: true });
+    if (!before.isFile() || before.size > BigInt(MAX_BLOB_BYTES))
+      throw new Error(
+        `Only regular files up to ${MAX_BLOB_BYTES} bytes can be synchronized: ${path}`
+      );
+    const buffer = Buffer.alloc(Number(before.size) + 1);
+    let count = 0;
+    while (count < buffer.length) {
+      const { bytesRead } = await file.read(buffer, count, buffer.length - count, null);
+      if (!bytesRead) break;
+      count += bytesRead;
+    }
+    const after = await file.stat({ bigint: true });
+    const final = await lstat(await safePath(root, path), { bigint: true });
+    if (signature(before) !== signature(after) || signature(after) !== signature(final) || count !== Number(before.size) || await realpath(target) !== resolvedBefore)
+      throw new Error(`File changed while reading: ${path}`);
+    const bytes = buffer.subarray(0, count);
+    return {
+      bytes,
+      signature: signature(after),
+      sha256: createHash3("sha256").update(bytes).digest("hex")
+    };
+  } finally {
+    await file.close();
+  }
+}
+async function syncDirectory(directory) {
+  if (process.platform === "win32") return;
+  const handle = await open(directory, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function replaceFile(root, path, bytes, expected) {
+  const target = await safePath(root, path, true);
+  const temporary = join(dirname(target), `.teammy-${randomUUID2()}.tmp`);
+  const file = await open(temporary, "wx", 384);
+  try {
+    try {
+      await file.writeFile(bytes);
+      await file.sync();
+    } finally {
+      await file.close();
+    }
+    const latest = await metadata(root, path);
+    if (latest?.directory) {
+      if (expected !== null) throw new Error(`Local file changed before replacement: ${path}`);
+      await rmdir(target);
+    } else if ((latest?.signature ?? null) !== expected)
+      throw new Error(`Local file changed before replacement: ${path}`);
+    await safePath(root, path);
+    await rename(temporary, target);
+    let directory = dirname(target);
+    for (; ; ) {
+      await syncDirectory(directory);
+      if (directory === dirname(root)) break;
+      directory = dirname(directory);
+    }
+  } finally {
+    await unlink(temporary).catch((error) => {
+      if (!missing(error)) throw error;
+    });
+  }
+}
+async function removeFile(root, path, expected) {
+  const latest = await metadata(root, path);
+  if (!latest) return;
+  if (latest.directory || latest.signature !== expected)
+    throw new Error(`Local file changed before deletion: ${path}`);
+  const target = await safePath(root, path);
+  await unlink(target);
+  await syncDirectory(dirname(target));
+  let parent = dirname(target);
+  while (parent !== root) {
+    try {
+      await rmdir(parent);
+      await syncDirectory(dirname(parent));
+    } catch {
+      break;
+    }
+    parent = dirname(parent);
+  }
+}
+
+// apps/client/project-file.ts
+var name = ".teammy.json";
+async function applyProjectFile(local, input) {
+  const config = ProjectConfigSchema.parse(input);
+  const binding = local.state.binding(local.root);
+  if (!binding || binding.workspaceId !== config.projectId)
+    throw new Error("Project configuration does not match the local binding.");
+  const cached = local.cached();
+  if (cached && config.configRevision < cached.config.configRevision)
+    throw new Error("Server project configuration moved backwards.");
+  const bytes = Buffer.from(JSON.stringify(config, null, 2) + "\n");
+  const hash2 = createHash4("sha256").update(bytes).digest("hex");
+  const entry = await metadata(local.root, name);
+  let signature2 = null;
+  if (entry) {
+    if (entry.directory)
+      throw new Error("Project configuration path is a directory; preserving it.");
+    const existing = await readStable(local.root, name);
+    signature2 = existing.signature;
+    if (existing.sha256 !== hash2 && existing.sha256 !== cached?.hash)
+      throw new Error(
+        "Existing .teammy.json is not the expected managed copy. Preserve it elsewhere before retrying."
+      );
+    if (existing.sha256 === hash2) {
+      local.save(config, hash2);
+      return;
+    }
+  }
+  await replaceFile(local.root, name, bytes, signature2);
+  local.save(config, hash2);
+}
+
+// apps/client/control.ts
+var controlClientMigration = "CREATE TABLE client_control(root TEXT PRIMARY KEY REFERENCES connections(root),status_json TEXT NOT NULL);";
+var ControlPlane = class {
+  constructor(state, root, version, overrides, apply) {
+    this.state = state;
+    this.root = root;
+    this.overrides = overrides;
+    this.apply = apply;
+    const binding = state.binding(root);
+    if (!binding) throw new Error("Connect this root first.");
+    this.client = new HubClient(binding.serverUrl, 1e4, binding, this.stop.signal);
+    this.local = new ClientProjectState(state, root);
+    const row = state.db.prepare("SELECT status_json FROM client_control WHERE root=?").get(root);
+    const prior = row ? DeviceStatusSchema.parse(JSON.parse(String(row.status_json))) : void 0;
+    const cached = this.local.cached();
+    this.status = {
+      clientVersion: version,
+      receivedRevision: cached?.config.configRevision ?? null,
+      appliedRevision: null,
+      effectivePolicy: EffectivePolicySchema.parse({
+        ...DEFAULT_POLICY,
+        ...cached?.config.sync,
+        ...overrides
+      }),
+      overrides: Object.keys(overrides),
+      configError: null,
+      reportError: null,
+      lastSync: prior?.lastSync ?? null
+    };
+    apply(this.status.effectivePolicy);
+  }
+  state;
+  root;
+  overrides;
+  apply;
+  client;
+  local;
+  status;
+  enabled = true;
+  stop = new AbortController();
+  running;
+  persist() {
+    this.state.db.prepare(
+      "INSERT INTO client_control VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
+    ).run(this.root, JSON.stringify(this.status));
+  }
+  updateSync(summary) {
+    this.status.lastSync = summary;
+    this.persist();
+  }
+  async tick() {
+    if (this.stop.signal.aborted) return;
+    try {
+      const config = await this.client.projectConfig();
+      this.status.receivedRevision = config.configRevision;
+      await applyProjectFile(this.local, config);
+      const effective = EffectivePolicySchema.parse({ ...config.sync, ...this.overrides });
+      this.apply(effective);
+      this.status.effectivePolicy = effective;
+      this.status.appliedRevision = config.configRevision;
+      this.status.configError = null;
+    } catch (error) {
+      if (!this.local.cached() && error instanceof HubRequestError && ["SETUP_REQUIRED", "PROJECT_NOT_FOUND", "NOT_FOUND"].includes(error.code)) {
+        this.enabled = false;
+        return;
+      }
+      this.status.configError = (error instanceof Error ? error.message : "Configuration update failed.").slice(0, 2e3);
+    }
+    this.persist();
+    this.status.reportError = null;
+    try {
+      await this.client.reportDeviceStatus(this.status);
+    } catch (error) {
+      this.status.reportError = String(error).slice(0, 2e3);
+    }
+    this.persist();
+  }
+  start() {
+    if (this.running || !this.enabled) return;
+    this.running = (async () => {
+      while (!this.stop.signal.aborted && this.enabled) {
+        try {
+          await setTimeout2(3e4, void 0, { signal: this.stop.signal });
+          await this.tick();
+        } catch (error) {
+          if (!this.stop.signal.aborted) {
+            this.status.configError = String(error).slice(0, 2e3);
+          }
+        }
+      }
+    })();
+  }
+  async close() {
+    this.stop.abort();
+    await this.running;
+  }
+};
+function readControlStatus(state, root) {
+  const row = state.db.prepare("SELECT status_json FROM client_control WHERE root=?").get(root);
+  return row ? DeviceStatusSchema.parse(JSON.parse(String(row.status_json))) : null;
+}
+
+// apps/client/connection.ts
+import { readFile, mkdir as mkdir2 } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
+
+// apps/client/root-lock.ts
+import { createHash as createHash5 } from "node:crypto";
+import { join as join2 } from "node:path";
+
+// packages/state/sqlite.ts
+import { chmodSync, mkdirSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+function transaction(db, action) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = action();
+    db.exec("COMMIT");
+    return result;
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+}
+function openDatabase(path, migrations) {
+  mkdirSync(dirname2(path), { recursive: true, mode: 448 });
+  const db = new DatabaseSync(path);
+  try {
+    chmodSync(path, 384);
+    db.exec(
+      "PRAGMA busy_timeout = 5000; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;"
+    );
+    transaction(db, () => {
+      const version = Number(db.prepare("PRAGMA user_version").get().user_version);
+      if (version > migrations.length)
+        throw new Error("Database was created by a newer Teammy version.");
+      for (let index = version; index < migrations.length; index++) {
+        db.exec(migrations[index]);
+        db.exec(`PRAGMA user_version = ${index + 1}`);
+      }
+    });
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+}
+
+// apps/client/root-lock.ts
+function acquireRootLock(root, stateDirectory) {
+  let lock;
+  try {
+    lock = openDatabase(
+      join2(stateDirectory, "locks", `${createHash5("sha256").update(root).digest("hex")}.sqlite3`),
+      []
+    );
+    lock.exec("PRAGMA busy_timeout=0; BEGIN IMMEDIATE");
+    return lock;
+  } catch (error) {
+    lock?.close();
+    if (error instanceof Error && /locked|busy/.test(error.message))
+      throw new Error("Another sync or connect process is using this root.");
+    throw error;
+  }
+}
+
+// apps/client/connection.ts
+async function connectProject(state, root, directory, options) {
+  const lock = acquireRootLock(root, directory);
+  try {
+    const transport = new HubClient(options.url);
+    const existing = state.binding(root);
+    const project = new ClientProjectState(state, root);
+    if (existing && existing.serverUrl !== transport.url)
+      throw new Error("This root is connected to another server.");
+    let member = options.member;
+    if (existing && !options.reconnect && !options.tokenFile) {
+      if (member && member !== existing.memberId)
+        throw new Error("This root belongs to a different member.");
+      const client2 = new HubClient(existing.serverUrl, 1e4, existing);
+      await client2.members();
+    } else if (options.tokenFile) {
+      const token = CredentialSchema.parse((await readFile(options.tokenFile, "utf8")).trim());
+      const deviceId = state.deviceFor(root);
+      const client2 = new HubClient(options.url, 1e4, { token, deviceId });
+      const binding2 = await client2.bind(deviceId);
+      state.saveBinding(root, client2.url, token, binding2);
+    } else {
+      member ??= existing?.memberId;
+      if (!member && process.stdin.isTTY) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        try {
+          member = (await rl.question("Member ID: ")).trim();
+        } finally {
+          rl.close();
+        }
+      }
+      if (!member) throw new Error("--member is required when input is not interactive.");
+      NameSchema.parse(member);
+      if (existing && existing.memberId !== member)
+        throw new Error("This root belongs to a different member.");
+      const request = project.enrollment(transport.url, member, Boolean(options.reconnect));
+      const binding2 = await transport.enroll(request);
+      state.saveBinding(root, transport.url, request.credential, binding2);
+      project.completeEnrollment();
+    }
+    const binding = state.binding(root);
+    const client = new HubClient(binding.serverUrl, 1e4, binding);
+    const info = await client.serverInfo();
+    if (info.capabilities.includes("project-config")) {
+      try {
+        await applyProjectFile(project, await client.projectConfig());
+      } catch (error) {
+        if (!(options.tokenFile && error instanceof Error && "code" in error && ["SETUP_REQUIRED", "PROJECT_NOT_FOUND"].includes(String(error.code))))
+          throw error;
+      }
+    }
+    const own = await metadata(root, binding.memberId);
+    if (own && !own.directory) throw new Error("Member path is not a directory.");
+    if (!own) await mkdir2(await safePath(root, binding.memberId));
+    const { token: _, ...visible } = binding;
+    return { ...visible, configRevision: project.cached()?.config.configRevision ?? null };
+  } finally {
+    lock.close();
+  }
+}
+
+// apps/client/main.ts
+import { parseArgs as parseArgs3 } from "node:util";
+import { mkdir as mkdir7, realpath as realpath6 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { join as join11, resolve as resolve6 } from "node:path";
+
+// apps/client/state.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { join as join3 } from "node:path";
+import { z as z8 } from "zod";
+
+// apps/client/sessions/state.ts
+var sessionClientMigration = String.raw`
+  CREATE TABLE session_sources (
+    root TEXT NOT NULL REFERENCES connections(root), path TEXT NOT NULL, agent TEXT NOT NULL, project_dir TEXT NOT NULL,
+    session_key TEXT, revision INTEGER NOT NULL DEFAULT 0, hash TEXT, signature TEXT,
+    checked_at INTEGER NOT NULL DEFAULT 0, verified_at INTEGER NOT NULL DEFAULT 0, last_error TEXT, adopt_existing INTEGER NOT NULL DEFAULT 0,
+    pending_json TEXT, pending_signature TEXT, attempts INTEGER NOT NULL DEFAULT 0, retry_at INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY(root, path), UNIQUE(root, session_key)
+  );
+  CREATE INDEX session_source_scheduling ON session_sources(root, checked_at, path);
+  CREATE TABLE session_discovery (
+    root TEXT NOT NULL REFERENCES connections(root), directory TEXT NOT NULL, agent TEXT NOT NULL, project_dir TEXT NOT NULL,
+    PRIMARY KEY(root, directory)
+  );
+  CREATE TABLE session_discovery_cache (
+    root TEXT NOT NULL, path TEXT NOT NULL, signature TEXT NOT NULL, PRIMARY KEY(root, path)
+  );
+`;
+var SessionState = class {
+  constructor(state, root) {
+    this.state = state;
+    this.root = root;
+  }
+  state;
+  root;
+  track(agent, path, projectDir, adoptExisting = false) {
+    const prior = this.get(path);
+    if (prior && (prior.agent !== agent || prior.projectDir !== projectDir))
+      throw new Error("Source is registered with different settings; untrack it first.");
+    this.state.db.prepare(
+      `INSERT INTO session_sources(root,path,agent,project_dir,adopt_existing) VALUES (?,?,?,?,?)
+      ON CONFLICT(root,path) DO UPDATE SET adopt_existing=MAX(adopt_existing,excluded.adopt_existing)`
+    ).run(this.root, path, agent, projectDir, Number(adoptExisting));
+  }
+  get(path) {
+    return this.sources(path)[0];
+  }
+  sources(path, limit = 2147483647) {
+    return this.state.db.prepare(
+      `SELECT * FROM session_sources WHERE root=? ${path === void 0 ? "" : "AND path=?"} ORDER BY checked_at, path LIMIT ?`
+    ).all(this.root, ...path === void 0 ? [] : [path], limit).map((row) => ({
+      path: String(row.path),
+      agent: row.agent,
+      projectDir: String(row.project_dir),
+      key: row.session_key,
+      revision: Number(row.revision),
+      hash: row.hash,
+      signature: row.signature,
+      checkedAt: Number(row.checked_at),
+      verifiedAt: Number(row.verified_at),
+      lastError: row.last_error,
+      adoptExisting: Boolean(row.adopt_existing),
+      pending: row.pending_json ? SessionCommitSchema.parse(JSON.parse(String(row.pending_json))) : null,
+      pendingSignature: row.pending_signature,
+      attempts: Number(row.attempts),
+      retryAt: Number(row.retry_at)
+    }));
+  }
+  status() {
+    return this.sources().map(({ pending, pendingSignature: _signature, ...row }) => ({
+      ...row,
+      pendingOperation: pending?.operationId ?? null
+    }));
+  }
+  untrack(path) {
+    this.state.db.prepare("DELETE FROM session_sources WHERE root=? AND path=?").run(this.root, path);
+  }
+  checked(path, error = null) {
+    this.state.db.prepare("UPDATE session_sources SET checked_at=?, last_error=? WHERE root=? AND path=?").run(Date.now(), error, this.root, path);
+  }
+  stage(path, request, signature2) {
+    this.state.db.prepare(
+      "UPDATE session_sources SET session_key=?, pending_json=?, pending_signature=?, attempts=0, retry_at=0 WHERE root=? AND path=? AND pending_json IS NULL"
+    ).run(request.sessionKey, JSON.stringify(request), signature2, this.root, path);
+  }
+  acknowledge(path, revision, hash2, signature2) {
+    this.state.db.prepare(
+      `UPDATE session_sources SET revision=?, hash=?, signature=?, verified_at=?, pending_json=NULL, pending_signature=NULL, attempts=0, retry_at=0, last_error=NULL, adopt_existing=0 WHERE root=? AND path=?`
+    ).run(revision, hash2, signature2, Date.now(), this.root, path);
+  }
+  baseline(path, key, revision) {
+    this.state.db.prepare("UPDATE session_sources SET session_key=?, revision=? WHERE root=? AND path=?").run(key, revision, this.root, path);
+  }
+  retry() {
+    this.state.db.prepare("UPDATE session_sources SET retry_at=0 WHERE root=?").run(this.root);
+  }
+  postpone(source, error, blocked) {
+    const at = blocked ? Number.MAX_SAFE_INTEGER : Date.now() + Math.min(9e5, 6e4 * 2 ** Math.min(source.attempts, 4));
+    this.state.db.prepare(
+      "UPDATE session_sources SET retry_at=?, attempts=attempts+1, last_error=? WHERE root=? AND path=?"
+    ).run(at, error, this.root, source.path);
+  }
+  discover(agent, directory, projectDir) {
+    this.state.db.prepare(
+      "INSERT INTO session_discovery VALUES (?,?,?,?) ON CONFLICT(root,directory) DO UPDATE SET agent=excluded.agent,project_dir=excluded.project_dir"
+    ).run(this.root, directory, agent, projectDir);
+    this.state.db.prepare("DELETE FROM session_discovery_cache WHERE root=?").run(this.root);
+  }
+  directories() {
+    return this.state.db.prepare("SELECT * FROM session_discovery WHERE root=? ORDER BY directory").all(this.root).map((row) => ({
+      directory: String(row.directory),
+      agent: row.agent,
+      projectDir: String(row.project_dir)
+    }));
+  }
+};
+
+// apps/client/files/state.ts
+var syncMigration = String.raw`
+  CREATE TABLE file_index (
+    root TEXT NOT NULL, path TEXT NOT NULL, signature TEXT, dirty INTEGER NOT NULL DEFAULT 1,
+    event_pending INTEGER NOT NULL DEFAULT 0, generation INTEGER NOT NULL DEFAULT 1,
+    observed_at REAL NOT NULL, hash TEXT, verified_at REAL NOT NULL DEFAULT 0,
+    PRIMARY KEY(root, path)
+  );
+  CREATE INDEX dirty_files ON file_index(root, dirty, observed_at);
+  CREATE INDEX audit_files ON file_index(root, dirty, verified_at);
+  CREATE TABLE received_files (root TEXT NOT NULL, owner TEXT NOT NULL, path TEXT NOT NULL, hash TEXT NOT NULL, size INTEGER NOT NULL, PRIMARY KEY(root, owner, path));
+  CREATE TABLE received_progress (root TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL, PRIMARY KEY(root, owner));
+  CREATE TABLE receive_jobs (root TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL, changes_json TEXT NOT NULL, next_index INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(root, owner));
+  CREATE TABLE sync_status (root TEXT PRIMARY KEY, status_json TEXT NOT NULL);
+`;
+var SyncState = class {
+  constructor(state, root) {
+    this.root = root;
+    this.db = state.db;
+  }
+  root;
+  db;
+  index(onlyDirty = false) {
+    return this.db.prepare(`SELECT * FROM file_index WHERE root=?${onlyDirty ? " AND dirty=1" : ""}`).all(this.root).map((row) => ({
+      path: String(row.path),
+      signature: row.signature === null ? null : String(row.signature),
+      dirty: Boolean(row.dirty),
+      eventPending: Boolean(row.event_pending),
+      generation: Number(row.generation),
+      observedAt: Number(row.observed_at),
+      hash: row.hash === null ? null : String(row.hash),
+      verifiedAt: Number(row.verified_at)
+    }));
+  }
+  audit(before, limit) {
+    return this.db.prepare(
+      "SELECT path FROM file_index WHERE root=? AND dirty=0 AND signature IS NOT NULL AND verified_at<=? ORDER BY verified_at LIMIT ?"
+    ).all(this.root, before, limit).map((row) => this.get(String(row.path)));
+  }
+  get(path) {
+    const row = this.db.prepare("SELECT * FROM file_index WHERE root=? AND path=?").get(this.root, path);
+    return row ? {
+      path,
+      signature: row.signature === null ? null : String(row.signature),
+      dirty: Boolean(row.dirty),
+      eventPending: Boolean(row.event_pending),
+      generation: Number(row.generation),
+      observedAt: Number(row.observed_at),
+      hash: row.hash === null ? null : String(row.hash),
+      verifiedAt: Number(row.verified_at)
+    } : void 0;
+  }
+  restartWaiting(now) {
+    this.db.prepare("UPDATE file_index SET observed_at=? WHERE root=? AND dirty=1").run(now, this.root);
+  }
+  event(path, now) {
+    this.db.prepare(
+      `INSERT INTO file_index(root, path, observed_at, event_pending) VALUES (?, ?, ?, 1)
+      ON CONFLICT(root,path) DO UPDATE SET dirty=1, event_pending=1, generation=generation+1, observed_at=excluded.observed_at`
+    ).run(this.root, path, now);
+    this.db.prepare(
+      "UPDATE file_index SET dirty=1, event_pending=1, generation=generation+1, observed_at=? WHERE root=? AND substr(path,1,length(?))=?"
+    ).run(now, this.root, `${path}/`, `${path}/`);
+  }
+  observe(path, signature2, now) {
+    const prior = this.get(path);
+    if (!prior) {
+      if (signature2 !== null)
+        this.db.prepare("INSERT INTO file_index(root,path,signature,observed_at) VALUES (?,?,?,?)").run(this.root, path, signature2, now);
+    } else if (signature2 !== prior.signature) {
+      this.db.prepare(
+        "UPDATE file_index SET signature=?, dirty=1, generation=generation+1, observed_at=?, event_pending=0 WHERE root=? AND path=?"
+      ).run(signature2, prior.eventPending ? prior.observedAt : now, this.root, path);
+    } else if (prior.eventPending) {
+      this.db.prepare("UPDATE file_index SET event_pending=0 WHERE root=? AND path=?").run(this.root, path);
+    }
+  }
+  clean(path, generation, hash2, now) {
+    this.db.prepare(
+      "UPDATE file_index SET dirty=0, hash=?, verified_at=? WHERE root=? AND path=? AND generation=?"
+    ).run(hash2, now, this.root, path, generation);
+  }
+  verified(path, now) {
+    this.db.prepare("UPDATE file_index SET verified_at=? WHERE root=? AND path=?").run(now, this.root, path);
+  }
+  revision(owner) {
+    const row = this.db.prepare("SELECT revision FROM received_progress WHERE root=? AND owner=?").get(this.root, owner);
+    return row ? Number(row.revision) : void 0;
+  }
+  received(owner, path) {
+    const row = this.db.prepare("SELECT hash,size FROM received_files WHERE root=? AND owner=? AND path=?").get(this.root, owner, path);
+    return row ? { sha256: String(row.hash), size: Number(row.size) } : void 0;
+  }
+  job(owner) {
+    const row = this.db.prepare("SELECT * FROM receive_jobs WHERE root=? AND owner=?").get(this.root, owner);
+    return row ? {
+      revision: Number(row.revision),
+      changes: JSON.parse(String(row.changes_json)),
+      nextIndex: Number(row.next_index)
+    } : void 0;
+  }
+  queue(owner, revision, changes) {
+    this.db.prepare("INSERT INTO receive_jobs(root, owner, revision, changes_json) VALUES (?, ?, ?, ?)").run(this.root, owner, revision, JSON.stringify(changes));
+  }
+  applied(owner, change, nextIndex) {
+    transaction(this.db, () => {
+      if (change.kind === "delete")
+        this.db.prepare("DELETE FROM received_files WHERE root=? AND owner=? AND path=?").run(this.root, owner, change.path);
+      else
+        this.db.prepare(
+          "INSERT INTO received_files VALUES (?,?,?,?,?) ON CONFLICT(root,owner,path) DO UPDATE SET hash=excluded.hash,size=excluded.size"
+        ).run(this.root, owner, change.path, change.sha256, change.size);
+      this.db.prepare("UPDATE receive_jobs SET next_index=? WHERE root=? AND owner=?").run(nextIndex, this.root, owner);
+    });
+  }
+  finish(owner) {
+    transaction(this.db, () => {
+      const job = this.job(owner);
+      if (!job || job.nextIndex !== job.changes.length)
+        throw new Error("Receive batch is not fully applied.");
+      this.db.prepare(
+        "INSERT INTO received_progress VALUES (?,?,?) ON CONFLICT(root,owner) DO UPDATE SET revision=excluded.revision"
+      ).run(this.root, owner, job.revision);
+      this.db.prepare("DELETE FROM receive_jobs WHERE root=? AND owner=?").run(this.root, owner);
+    });
+  }
+  saveStatus(status) {
+    this.db.prepare(
+      "INSERT INTO sync_status VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
+    ).run(this.root, JSON.stringify(status));
+  }
+  status() {
+    const row = this.db.prepare("SELECT status_json FROM sync_status WHERE root=?").get(this.root);
+    return row ? JSON.parse(String(row.status_json)) : null;
+  }
+};
+
+// apps/client/state.ts
+var LocalBindingSchema = BindingSchema.extend({
+  root: z8.string(),
+  serverUrl: z8.string(),
+  token: z8.string()
+});
+var ClientState = class {
+  db;
+  constructor(directory) {
+    this.db = openDatabase(join3(directory, "client.sqlite3"), [
+      String.raw`
+      CREATE TABLE connections (root TEXT PRIMARY KEY, device_id TEXT NOT NULL, binding_json TEXT);
+    `,
+      String.raw`
+        CREATE TABLE publications (root TEXT PRIMARY KEY REFERENCES connections(root), revision INTEGER NOT NULL DEFAULT 0, initialized INTEGER NOT NULL DEFAULT 0);
+        CREATE TABLE owner_files (root TEXT NOT NULL REFERENCES connections(root), path TEXT NOT NULL, hash TEXT NOT NULL, size INTEGER NOT NULL, PRIMARY KEY(root, path));
+        CREATE TABLE outbox (root TEXT PRIMARY KEY REFERENCES connections(root), request_json TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, retry_at INTEGER NOT NULL DEFAULT 0, last_error TEXT);
+      `,
+      syncMigration,
+      sessionClientMigration,
+      projectClientMigration,
+      controlClientMigration
+    ]);
+  }
+  close() {
+    this.db.close();
+  }
+  deviceFor(root) {
+    this.db.prepare("INSERT OR IGNORE INTO connections (root, device_id) VALUES (?, ?)").run(root, randomUUID3());
+    return String(
+      this.db.prepare("SELECT device_id FROM connections WHERE root=?").get(root).device_id
+    );
+  }
+  binding(root) {
+    const row = this.db.prepare("SELECT binding_json FROM connections WHERE root=?").get(root);
+    return row?.binding_json ? LocalBindingSchema.parse(JSON.parse(String(row.binding_json))) : void 0;
+  }
+  saveBinding(root, serverUrl, token, binding) {
+    const prior = this.binding(root);
+    if (prior && (prior.workspaceId !== binding.workspaceId || prior.memberId !== binding.memberId || prior.serverUrl !== serverUrl)) {
+      throw new Error(
+        "This root is already connected to another member or server. Use a different local root."
+      );
+    }
+    if (this.deviceFor(root) !== binding.deviceId)
+      throw new Error("Server returned a different device identity.");
+    const local = LocalBindingSchema.parse({ ...binding, root, serverUrl, token });
+    this.db.prepare("UPDATE connections SET binding_json=? WHERE root=?").run(JSON.stringify(local), root);
+    return local;
+  }
+  publication(root) {
+    this.db.prepare("INSERT OR IGNORE INTO publications(root) VALUES (?)").run(root);
+    const row = this.db.prepare("SELECT revision, initialized FROM publications WHERE root=?").get(root);
+    return { revision: Number(row.revision), initialized: Boolean(row.initialized) };
+  }
+  initializePublication(root, revision, files) {
+    transaction(this.db, () => {
+      if (this.pending(root))
+        throw new Error("Cannot replace a baseline with a publication pending.");
+      this.db.prepare(
+        "INSERT INTO publications VALUES (?, ?, 1) ON CONFLICT(root) DO UPDATE SET revision=excluded.revision, initialized=1"
+      ).run(root, revision);
+      this.db.prepare("DELETE FROM owner_files WHERE root=?").run(root);
+      for (const file of files)
+        this.db.prepare("INSERT INTO owner_files VALUES (?, ?, ?, ?)").run(root, file.path, file.sha256, file.size);
+    });
+  }
+  ownerFiles(root) {
+    return new Map(
+      this.db.prepare("SELECT path, hash, size FROM owner_files WHERE root=?").all(root).map((row) => [String(row.path), { sha256: String(row.hash), size: Number(row.size) }])
+    );
+  }
+  pending(root) {
+    const row = this.db.prepare("SELECT request_json, attempts, retry_at, last_error FROM outbox WHERE root=?").get(root);
+    return row ? {
+      batch: FileCommitSchema.parse(JSON.parse(String(row.request_json))),
+      attempts: Number(row.attempts),
+      retryAt: Number(row.retry_at),
+      lastError: row.last_error === null ? null : String(row.last_error)
+    } : void 0;
+  }
+  enqueue(root, batch) {
+    const fixed = FileCommitSchema.parse(batch);
+    transaction(this.db, () => {
+      const publication = this.publication(root);
+      if (!publication.initialized || publication.revision !== fixed.parentRevision)
+        throw new Error("Publication baseline is not ready.");
+      if (this.pending(root)) throw new Error("A publication is already pending.");
+      this.db.prepare("INSERT INTO outbox(root, request_json) VALUES (?, ?)").run(root, JSON.stringify(fixed));
+    });
+  }
+  acknowledge(root, result) {
+    transaction(this.db, () => {
+      const pending = this.pending(root);
+      if (!pending || pending.batch.operationId !== result.operationId || result.revision < pending.batch.parentRevision || result.revision > pending.batch.parentRevision + 1)
+        throw new Error("Unexpected publication acknowledgement.");
+      for (const change of pending.batch.changes) {
+        if (change.kind === "delete")
+          this.db.prepare("DELETE FROM owner_files WHERE root=? AND path=?").run(root, change.path);
+        else
+          this.db.prepare(
+            "INSERT INTO owner_files VALUES (?, ?, ?, ?) ON CONFLICT(root, path) DO UPDATE SET hash=excluded.hash, size=excluded.size"
+          ).run(root, change.path, change.sha256, change.size);
+      }
+      this.db.prepare("UPDATE publications SET revision=? WHERE root=?").run(result.revision, root);
+      this.db.prepare("DELETE FROM outbox WHERE root=?").run(root);
+    });
+  }
+  postpone(root, operationId, reason, now, blocked) {
+    const pending = this.pending(root);
+    if (!pending || pending.batch.operationId !== operationId) return;
+    const retryAt = blocked ? Number.MAX_SAFE_INTEGER : now + Math.min(9e5, 6e4 * 2 ** Math.min(pending.attempts, 4));
+    this.db.prepare("UPDATE outbox SET attempts=attempts+1, retry_at=?, last_error=? WHERE root=?").run(retryAt, reason, root);
+  }
+  retryPublication(root) {
+    this.db.prepare("UPDATE outbox SET retry_at=0, last_error=NULL WHERE root=?").run(root);
+  }
+};
+
+// apps/client/sessions/command.ts
+import { createHash as createHash7 } from "node:crypto";
+import { realpath as realpath3 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
+import { parseArgs } from "node:util";
+
+// apps/client/state-location.ts
+import { mkdir as mkdir3, realpath as realpath2 } from "node:fs/promises";
+import { isAbsolute, relative as relative2, resolve, sep as sep2 } from "node:path";
+async function stateLocation(root, directory) {
+  await mkdir3(resolve(directory), { recursive: true, mode: 448 });
+  const canonical = await realpath2(directory);
+  const contains = (parent, child) => {
+    const path = relative2(parent, child);
+    return path === "" || !isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep2}`);
+  };
+  if (contains(root, canonical) || contains(canonical, root))
+    throw new Error(
+      "Client state and the shared root must be separate directories, with neither containing the other."
+    );
+  return canonical;
+}
+
+// apps/client/sessions/hooks.ts
+import { createHash as createHash6, randomUUID as randomUUID4 } from "node:crypto";
+import { mkdir as mkdir4, open as open2, opendir, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
+import { z as z9 } from "zod";
+
+// apps/client/sessions/normalize.ts
+function object(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function textContent(value) {
+  if (typeof value === "string") return value;
+  if (!Array.isArray(value)) return "";
+  return value.flatMap((block) => {
+    const part = object(block);
+    return ["text", "input_text", "output_text"].includes(String(part.type)) && typeof part.text === "string" ? [part.text] : [];
+  }).join("\n");
+}
+function parseJsonl(text) {
+  const lines = text.split("\n");
+  const rows = [];
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    if (!line.trim()) continue;
+    if (Buffer.byteLength(line) > 8 * 1024 * 1024) throw new Error("Session record exceeds 8 MiB.");
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      if (index === lines.length - 1 && !text.endsWith("\n")) return { rows, incomplete: true };
+      throw new Error(`Invalid session JSON at line ${index + 1}.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error(`Invalid session record at line ${index + 1}.`);
+    rows.push({ line: index + 1, value: object(parsed) });
+  }
+  return { rows, incomplete: false };
+}
+function normalizeJsonl(agent, text) {
+  const { rows, incomplete } = parseJsonl(text);
+  let nativeId;
+  let cwd;
+  const messages = [];
+  const ids = /* @__PURE__ */ new Map();
+  const add = (role, content, id, line) => {
+    if (role !== "user" && role !== "assistant") return;
+    const text2 = textContent(content);
+    if (!text2.trim()) return;
+    const base = typeof id === "string" && id ? id : `line:${line}`;
+    const count = (ids.get(base) ?? 0) + 1;
+    ids.set(base, count);
+    messages.push({ id: `${base}#${count}`, role, text: text2, source: `line:${line}` });
+  };
+  for (const { line, value: row } of rows) {
+    if (agent === "claude-code") {
+      if (row.isSidechain === true) continue;
+      if (row.sessionId) {
+        if (nativeId && nativeId !== row.sessionId)
+          throw new Error("Mixed Claude session identities.");
+        nativeId = row.sessionId;
+      }
+      if (row.cwd && !cwd) cwd = row.cwd;
+      if (row.type === "user" || row.type === "assistant") {
+        const message2 = object(row.message);
+        add(message2.role ?? row.type, message2.content, row.uuid, line);
+      }
+    } else if (agent === "codex") {
+      const payload = object(row.payload);
+      if (row.type === "session_meta") {
+        if (nativeId && nativeId !== payload.id) throw new Error("Mixed Codex session identities.");
+        nativeId = payload.id;
+        cwd = payload.cwd;
+      }
+      if (row.type === "response_item" && payload.type === "message" && payload.channel !== "analysis")
+        add(payload.role, payload.content, payload.id, line);
+    } else if (agent === "pi") {
+      if (row.type === "session") {
+        if (row.version !== 3) throw new Error("Unsupported Pi session version (expected 3).");
+        if (nativeId) throw new Error("Multiple Pi session headers.");
+        nativeId = row.id;
+        cwd = row.cwd;
+      }
+      if (row.type === "message") {
+        const message2 = object(row.message);
+        add(message2.role, message2.content, row.id, line);
+      }
+    } else {
+      if (row.type === "session") {
+        if (row.version !== 0) throw new Error("Unsupported DSH session version (expected 0).");
+        if (nativeId) throw new Error("Multiple DSH session headers.");
+        if (Number(row.delegationDepth ?? 0) > 0)
+          throw new Error("DSH delegated sessions are not collected.");
+        nativeId = row.id;
+        cwd = row.cwd;
+      }
+      if (row.type === "user/message" || row.type === "assistant/message") {
+        const data = object(row.data);
+        const message2 = row.type === "assistant/message" ? object(data.message) : data;
+        if (object(message2.source).kind === "plugin") continue;
+        add(
+          row.type === "user/message" ? "user" : "assistant",
+          message2.content,
+          `seq:${row.seq}`,
+          line
+        );
+      }
+    }
+  }
+  return {
+    snapshot: SessionSnapshotSchema.parse({
+      formatVersion: 1,
+      adapterVersion: 1,
+      agent,
+      nativeId,
+      cwd,
+      messages
+    }),
+    incomplete
+  };
+}
+
+// apps/client/sessions/hooks.ts
+var HintSchema = z9.object({
+  agent: AgentSchema,
+  path: z9.string().min(1).max(4096).refine(isAbsolute2),
+  projectDir: z9.string().min(1).max(4096).refine(isAbsolute2)
+});
+function inbox(directory, root) {
+  return join4(directory, "session-hints", createHash6("sha256").update(root).digest("hex"));
+}
+async function recordHint(directory, root, input) {
+  const hint = HintSchema.parse(input);
+  const targetDir = inbox(directory, root);
+  await mkdir4(targetDir, { recursive: true, mode: 448 });
+  const target = join4(
+    targetDir,
+    `${createHash6("sha256").update(JSON.stringify(hint)).digest("hex")}.json`
+  );
+  const temporary = `${target}.${randomUUID4()}.tmp`;
+  const handle = await open2(temporary, "wx", 384);
+  try {
+    await handle.writeFile(JSON.stringify(hint));
+  } finally {
+    await handle.close();
+  }
+  await rename2(temporary, target);
+}
+async function consumeHints(directory, root, sessions) {
+  const issues = [];
+  let dir;
+  try {
+    dir = await opendir(inbox(directory, root));
+  } catch (error) {
+    if (error.code === "ENOENT") return issues;
+    throw error;
+  }
+  let count = 0;
+  for await (const entry of dir) {
+    if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+    if (count++ >= 50) break;
+    const path = join4(inbox(directory, root), entry.name);
+    try {
+      const handle = await open2(path, "r");
+      let body;
+      try {
+        if ((await handle.stat()).size > 16384) throw new Error("Oversized hook hint.");
+        body = await handle.readFile("utf8");
+      } finally {
+        await handle.close();
+      }
+      const hint = HintSchema.parse(JSON.parse(body));
+      sessions.track(hint.agent, hint.path, hint.projectDir);
+      await unlink2(path);
+    } catch (error) {
+      issues.push(
+        `hook hint ${entry.name}: ${error instanceof Error ? error.message : "invalid hint"}`
+      );
+    }
+  }
+  return issues;
+}
+async function hookPayload() {
+  let size = 0;
+  const parts = [];
+  const timeout = setTimeout(() => process.stdin.destroy(new Error("Hook input timeout.")), 500);
+  try {
+    for await (const part of process.stdin) {
+      const bytes = Buffer.from(part);
+      size += bytes.length;
+      if (size > 16384) throw new Error("Hook payload too large.");
+      parts.push(bytes);
+    }
+    return object(JSON.parse(Buffer.concat(parts).toString("utf8")));
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// apps/client/sessions/command.ts
+var help = `Usage: teammy session COMMAND [options]
+
+  track       --agent AGENT --file PATH [--project-dir DIR] [--adopt-existing]
+  untrack     --file PATH (does not delete server history)
+  discover    --agent AGENT [--directory DIR] [--project-dir DIR]
+  undiscover  --directory DIR (also untrack any previously discovered sources to stop them)
+  sources     Show registered sources, discovery directories and collection errors
+  hook        --agent AGENT [--file PATH] [--project-dir DIR]; accepts JSON on stdin
+  list        [--after N] [--limit N]
+  read        --owner MEMBER --key KEY [--revision N]
+  search      --query TEXT [--after N] [--limit N]
+
+Shared options: --root DIR (./workspaces), --state-dir DIR (~/.teammy/client).
+AGENT: claude-code, codex, cursor, pi, dsh. Project defaults to the shared root's parent.
+track/discover only register local sources. Run teammy sync to collect and publish.
+Discover uses native default locations except DSH, which requires --directory.
+Hook only records a local hint, emits no stdout, and always exits successfully.
+`;
+async function runSessionCommand(args) {
+  const command = args[0];
+  if (!command || ["--help", "-h", "help"].includes(command)) {
+    process.stdout.write(help);
+    return 0;
+  }
+  const { values } = parseArgs({
+    args: args.slice(1),
+    options: {
+      root: { type: "string", default: resolve2("workspaces") },
+      "state-dir": { type: "string", default: join5(homedir(), ".teammy", "client") },
+      agent: { type: "string" },
+      file: { type: "string" },
+      directory: { type: "string" },
+      "project-dir": { type: "string" },
+      "adopt-existing": { type: "boolean" },
+      owner: { type: "string" },
+      key: { type: "string" },
+      revision: { type: "string" },
+      query: { type: "string" },
+      after: { type: "string", default: "0" },
+      limit: { type: "string", default: "50" },
+      help: { type: "boolean", short: "h" }
+    }
+  });
+  if (values.help) {
+    process.stdout.write(help);
+    return 0;
+  }
+  const root = await realpath3(resolve2(values.root));
+  const directory = await stateLocation(root, values["state-dir"]);
+  const projectDir = await realpath3(resolve2(values["project-dir"] ?? dirname3(root)));
+  if (command === "hook") {
+    const payload = values.file ? {} : await hookPayload();
+    const file = values.file ?? payload.transcript_path ?? payload.session_file ?? payload.sessionFile;
+    if (typeof file === "string" && file)
+      await recordHint(directory, root, {
+        agent: AgentSchema.parse(values.agent),
+        path: resolve2(file),
+        projectDir
+      });
+    return 0;
+  }
+  const state = new ClientState(directory);
+  try {
+    const binding = state.binding(root);
+    if (!binding) throw new Error("Connect this root first.");
+    const sessions = new SessionState(state, root);
+    const client = new HubClient(binding.serverUrl, 1e4, binding);
+    let output;
+    if (command === "track" || command === "untrack") {
+      if (!values.file) throw new Error("--file is required.");
+      const path = resolve2(values.file);
+      if (command === "track")
+        sessions.track(
+          AgentSchema.parse(values.agent),
+          path,
+          projectDir,
+          Boolean(values["adopt-existing"])
+        );
+      else sessions.untrack(path);
+      output = sessions.status();
+    } else if (command === "discover" || command === "undiscover") {
+      if (command === "undiscover") {
+        if (!values.directory) throw new Error("--directory is required.");
+        state.db.prepare("DELETE FROM session_discovery WHERE root=? AND directory=?").run(root, await realpath3(resolve2(values.directory)));
+      } else {
+        const agent = AgentSchema.parse(values.agent);
+        const defaults = {
+          "claude-code": join5(homedir(), ".claude", "projects"),
+          codex: join5(process.env.CODEX_HOME ?? join5(homedir(), ".codex"), "sessions"),
+          cursor: join5(
+            process.env.CURSOR_CONFIG_DIR ?? join5(homedir(), ".cursor"),
+            "chats",
+            createHash7("md5").update(projectDir).digest("hex")
+          ),
+          pi: join5(process.env.PI_CODING_AGENT_DIR ?? join5(homedir(), ".pi", "agent"), "sessions"),
+          dsh: void 0
+        };
+        const path = values.directory ?? defaults[agent];
+        if (!path) throw new Error("DSH requires its configured persistence --directory.");
+        sessions.discover(agent, await realpath3(resolve2(path)), projectDir);
+      }
+      output = sessions.directories();
+    } else if (command === "sources")
+      output = { sources: sessions.status(), discovery: sessions.directories() };
+    else {
+      const after = Number(values.after);
+      const limit = Number(values.limit);
+      if (!Number.isSafeInteger(after) || after < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        throw new Error("Invalid pagination options.");
+      if (command === "list") output = await client.sessions(after, limit);
+      else if (command === "search") {
+        if (!values.query) throw new Error("--query is required.");
+        output = await client.searchSessions(values.query, after, limit);
+      } else if (command === "read") {
+        if (!values.owner || !values.key) throw new Error("--owner and --key are required.");
+        const revision = values.revision === void 0 ? void 0 : Number(values.revision);
+        if (revision !== void 0 && (!Number.isSafeInteger(revision) || revision < 1))
+          throw new Error("Invalid revision.");
+        const session = await client.session(values.owner, values.key, revision);
+        const snapshot = SessionSnapshotSchema.parse(
+          JSON.parse(Buffer.from(await client.downloadBlob(session.blob.sha256)).toString("utf8"))
+        );
+        output = { session, snapshot };
+      } else throw new Error("Unknown session command. Use teammy session --help.");
+    }
+    process.stdout.write(`${JSON.stringify(output, null, 2)}
+`);
+    return 0;
+  } finally {
+    state.close();
+  }
+}
+
+// apps/client/sync-command.ts
+import { realpath as realpath5 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join10, resolve as resolve5 } from "node:path";
+import { setTimeout as setTimeout3 } from "node:timers/promises";
+import { parseArgs as parseArgs2 } from "node:util";
+
+// apps/client/sessions/synchronizer.ts
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { join as join8 } from "node:path";
+
+// packages/storage/local-blob-store.ts
+import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
+import { link, mkdir as mkdir5, open as open3, readFile as readFile2, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
+function hash(content) {
+  return createHash8("sha256").update(content).digest("hex");
+}
+function hasCode(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+var BlobIntegrityError = class extends Error {
+  constructor(sha256) {
+    super(`Stored content failed integrity verification: ${sha256}`);
+    this.sha256 = sha256;
+    this.name = "BlobIntegrityError";
+  }
+  sha256;
+};
+var LocalBlobStore = class {
+  root;
+  constructor(root) {
+    this.root = resolve3(root);
+  }
+  async put(content) {
+    const bytes = Buffer.from(content);
+    const sha256 = hash(bytes);
+    const target = this.pathFor(sha256);
+    await mkdir5(dirname4(target), { recursive: true, mode: 448 });
+    const temporary = `${target}.${randomUUID5()}.tmp`;
+    const file = await open3(temporary, "wx", 384);
+    try {
+      try {
+        await file.writeFile(bytes);
+        await file.sync();
+      } finally {
+        await file.close();
+      }
+      try {
+        await link(temporary, target);
+      } catch (error) {
+        if (!hasCode(error, "EEXIST")) throw error;
+        await this.get(sha256);
+      }
+      if (process.platform !== "win32") {
+        let directory = dirname4(target);
+        for (; ; ) {
+          const handle = await open3(directory, "r");
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
+          if (directory === dirname4(this.root)) break;
+          directory = dirname4(directory);
+        }
+      }
+    } finally {
+      await unlink3(temporary);
+    }
+    return { sha256, size: bytes.byteLength };
+  }
+  async get(sha256) {
+    const target = this.pathFor(sha256);
+    let content;
+    try {
+      content = await readFile2(target);
+    } catch (error) {
+      if (hasCode(error, "ENOENT")) return void 0;
+      throw error;
+    }
+    if (hash(content) !== sha256) throw new BlobIntegrityError(sha256);
+    return content;
+  }
+  pathFor(sha256) {
+    if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Invalid SHA-256 content identifier.");
+    return join6(this.root, "sha256", sha256.slice(0, 2), sha256);
+  }
+};
+
+// apps/client/sessions/source.ts
+import { open as open4, stat, realpath as realpath4 } from "node:fs/promises";
+import { relative as relative3, isAbsolute as isAbsolute3, sep as sep3 } from "node:path";
+import * as zlib from "node:zlib";
+
+// apps/client/sessions/cursor.ts
+import { createHash as createHash9 } from "node:crypto";
+import { basename, dirname as dirname5, resolve as resolve4 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { fileURLToPath } from "node:url";
+function fields(bytes) {
+  const data = Buffer.from(bytes);
+  let offset = 0;
+  const varint = () => {
+    let value = 0n;
+    for (let i = 0; i < 10; i++) {
+      if (offset >= data.length) throw new Error("Truncated Cursor protobuf.");
+      const byte = data[offset++];
+      value |= BigInt(byte & 127) << BigInt(i * 7);
+      if (byte < 128) return value;
+    }
+    throw new Error("Invalid Cursor protobuf integer.");
+  };
+  const result = /* @__PURE__ */ new Map();
+  while (offset < data.length) {
+    const tag = varint();
+    const field = Number(tag >> 3n);
+    if (field < 1 || field > 536870911) throw new Error("Invalid Cursor protobuf field.");
+    const wire = Number(tag & 7n);
+    if (wire === 0) varint();
+    else if (wire === 1) offset += 8;
+    else if (wire === 5) offset += 4;
+    else if (wire === 2) {
+      const length = Number(varint());
+      if (!Number.isSafeInteger(length) || length > data.length - offset)
+        throw new Error("Truncated Cursor protobuf value.");
+      const values = result.get(field) ?? [];
+      values.push(data.subarray(offset, offset + length));
+      result.set(field, values);
+      offset += length;
+    } else throw new Error("Unsupported Cursor protobuf wire type.");
+    if (offset > data.length) throw new Error("Truncated Cursor protobuf value.");
+  }
+  return result;
+}
+function readCursor(path, projectDir) {
+  const db = new DatabaseSync2(path, { readOnly: true });
+  try {
+    db.exec("PRAGMA query_only=ON; PRAGMA busy_timeout=100; BEGIN");
+    if (db.prepare("PRAGMA user_version").get()?.user_version !== 1)
+      throw new Error("Unsupported Cursor CLI store version (expected 1).");
+    const row = db.prepare("SELECT value FROM meta WHERE key='0' AND length(value)<=2097152").get();
+    const hex = row?.value;
+    if (typeof hex !== "string" || !/^(?:[a-fA-F0-9]{2})+$/.test(hex))
+      throw new Error("Invalid Cursor metadata.");
+    const meta = object(JSON.parse(Buffer.from(hex, "hex").toString("utf8")));
+    if (typeof meta.agentId !== "string" || meta.agentId !== basename(dirname5(path)) || meta.subagentInfo != null)
+      throw new Error("Invalid or delegated Cursor session identity.");
+    let budget = 64 * 1024 * 1024;
+    const blob = (id) => {
+      if (!/^[a-f0-9]{64}$/.test(id)) throw new Error("Invalid Cursor blob reference.");
+      const value = db.prepare("SELECT data FROM blobs WHERE id=? AND length(data)<=?").get(id, budget)?.data;
+      if (!(value instanceof Uint8Array))
+        throw new Error("Cursor history missing or exceeds 64 MiB.");
+      const bytes = Buffer.from(value);
+      budget -= bytes.length;
+      if (createHash9("sha256").update(bytes).digest("hex") !== id)
+        throw new Error("Cursor blob failed integrity verification.");
+      return bytes;
+    };
+    const root = fields(blob(String(meta.latestRootBlobId)));
+    const bucket = basename(dirname5(dirname5(path)));
+    const md5 = (cwd2) => createHash9("md5").update(resolve4(cwd2)).digest("hex");
+    let cwd = md5(projectDir) === bucket ? projectDir : void 0;
+    for (const uri of root.get(9) ?? []) {
+      try {
+        const native = fileURLToPath(uri.toString("utf8"));
+        if (md5(native) === bucket) {
+          cwd = native;
+          break;
+        }
+      } catch {
+      }
+    }
+    if (!cwd) throw new Error("Cursor workspace cannot be verified against its storage bucket.");
+    const refs = [];
+    for (const archive of root.get(13) ?? root.get(11) ?? [])
+      refs.push(...fields(blob(archive.toString("hex"))).get(1) ?? []);
+    refs.push(...root.get(1) ?? []);
+    if (refs.length > 5e4) throw new Error("Cursor history exceeds 50000 messages.");
+    const messages = [];
+    const counts = /* @__PURE__ */ new Map();
+    for (const ref of refs) {
+      const key = ref.toString("hex");
+      const message2 = object(
+        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(blob(key)))
+      );
+      const cursor = object(object(message2.providerOptions).cursor);
+      if (cursor.isSummary || !["user", "assistant"].includes(String(message2.role))) continue;
+      let text = textContent(message2.content);
+      if (message2.role === "user") {
+        if (!cursor.requestId) continue;
+        const start = text.indexOf("<user_query>");
+        const end = text.lastIndexOf("</user_query>");
+        if (start >= 0 && end > start) text = text.slice(start + 12, end).trim();
+      }
+      if (!text.trim()) continue;
+      const id = createHash9("sha256").update(JSON.stringify([message2.role, cursor.requestId ?? "", text])).digest("hex");
+      const count = (counts.get(id) ?? 0) + 1;
+      counts.set(id, count);
+      messages.push({
+        id: `${id}#${count}`,
+        role: message2.role,
+        text,
+        source: `blob:${key}`
+      });
+    }
+    return SessionSnapshotSchema.parse({
+      formatVersion: 1,
+      adapterVersion: 1,
+      agent: "cursor",
+      nativeId: meta.agentId,
+      cwd,
+      messages
+    });
+  } finally {
+    db.close();
+  }
+}
+
+// apps/client/sessions/source.ts
+var MAX_SOURCE_BYTES = 64 * 1024 * 1024;
+async function sourceSignature(path, agent) {
+  const paths = agent === "cursor" ? [path, `${path}-wal`] : [path];
+  const signatures = [];
+  for (const file of paths) {
+    try {
+      const s = await stat(file, { bigint: true });
+      if (!s.isFile()) throw new Error("Session source must be a regular file.");
+      signatures.push([
+        String(s.dev),
+        String(s.ino),
+        String(s.size),
+        String(s.mtimeNs),
+        String(s.ctimeNs)
+      ]);
+    } catch (error) {
+      if (file !== path && error.code === "ENOENT")
+        signatures.push(null);
+      else throw error;
+    }
+  }
+  return JSON.stringify(signatures);
+}
+async function readSource(agent, path, projectDir) {
+  const signature2 = await sourceSignature(path, agent);
+  let result;
+  if (agent === "cursor") result = { snapshot: readCursor(path, projectDir), incomplete: false };
+  else {
+    const handle = await open4(path, "r");
+    let bytes;
+    try {
+      const size = (await handle.stat()).size;
+      if (size > MAX_SOURCE_BYTES) throw new Error("Session source exceeds 64 MiB.");
+      bytes = Buffer.alloc(size + 1);
+      let offset = 0;
+      while (offset < bytes.length) {
+        const read = await handle.read(bytes, offset, bytes.length - offset, offset);
+        if (!read.bytesRead) break;
+        offset += read.bytesRead;
+      }
+      bytes = bytes.subarray(0, offset);
+      if (offset > size) throw new Error("Session source changed while reading; retry next cycle.");
+    } finally {
+      await handle.close();
+    }
+    if (agent === "dsh" && path.endsWith(".zstd")) {
+      const decompress = zlib.zstdDecompressSync;
+      if (!decompress)
+        throw new Error(
+          "Compressed DSH sessions require Node.js with zstd support (22.15+ or 24+)."
+        );
+      bytes = decompress(bytes, { maxOutputLength: MAX_SOURCE_BYTES });
+    }
+    result = normalizeJsonl(agent, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  }
+  if (signature2 !== await sourceSignature(path, agent))
+    throw new Error("Session source changed while reading; retry next cycle.");
+  const cwd = await realpath4(result.snapshot.cwd);
+  const project = await realpath4(projectDir);
+  const rel = relative3(project, cwd);
+  if (rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute3(rel))
+    throw new Error("Session cwd is outside the registered project.");
+  return { ...result, signature: signature2 };
+}
+
+// apps/client/sessions/discovery.ts
+import { opendir as opendir2 } from "node:fs/promises";
+import { join as join7 } from "node:path";
+async function* candidates(directory, agent) {
+  const queue = [directory];
+  while (queue.length) {
+    const current = queue.shift();
+    const dir = await opendir2(current);
+    for await (const entry of dir) {
+      const path = join7(current, entry.name);
+      if (entry.isDirectory()) queue.push(path);
+      if (entry.isFile() && (agent === "cursor" ? entry.name === "store.db" : entry.name.endsWith(".jsonl") || agent === "dsh" && entry.name.endsWith(".jsonl.zstd")))
+        yield path;
+      else yield null;
+    }
+  }
+}
+var SessionDiscovery = class {
+  constructor(state) {
+    this.state = state;
+  }
+  state;
+  scans = /* @__PURE__ */ new Map();
+  async cycle() {
+    const issues = [];
+    let entries = 500;
+    let reads = 5;
+    const configs = this.state.directories();
+    for (const [directory, scan] of this.scans) {
+      if (!configs.some((config) => config.directory === directory)) {
+        await scan.iterator.return(void 0);
+        this.scans.delete(directory);
+      }
+    }
+    for (const config of configs) {
+      let scan = this.scans.get(config.directory);
+      if (!scan) {
+        scan = { iterator: candidates(config.directory, config.agent), nextAt: 0 };
+        this.scans.set(config.directory, scan);
+      }
+      if (scan.nextAt > Date.now()) continue;
+      try {
+        while (entries > 0 && reads > 0) {
+          entries--;
+          const entry = await scan.iterator.next();
+          if (entry.done) {
+            scan.iterator = candidates(config.directory, config.agent);
+            scan.nextAt = Date.now() + 3e5;
+            break;
+          }
+          const path = entry.value;
+          if (!path || this.state.get(path)) continue;
+          const signature2 = await sourceSignature(path, config.agent);
+          const db = this.state.state.db;
+          if (db.prepare(
+            "SELECT 1 FROM session_discovery_cache WHERE root=? AND path=? AND signature=?"
+          ).get(this.state.root, path, signature2))
+            continue;
+          reads--;
+          try {
+            const result = await readSource(config.agent, path, config.projectDir);
+            if (result.incomplete) continue;
+            this.state.track(config.agent, path, config.projectDir);
+          } catch (error) {
+            const message2 = error instanceof Error ? error.message : "Discovery failed.";
+            if (!message2.includes("outside the registered project"))
+              issues.push(`${path}: ${message2}`);
+            if (!message2.includes("outside the registered project")) continue;
+          }
+          db.prepare(
+            "INSERT INTO session_discovery_cache VALUES (?,?,?) ON CONFLICT(root,path) DO UPDATE SET signature=excluded.signature"
+          ).run(this.state.root, path, signature2);
+        }
+      } catch (error) {
+        issues.push(
+          `${config.directory}: ${error instanceof Error ? error.message : "Discovery failed."}`
+        );
+        await scan.iterator.return(void 0);
+        scan.iterator = candidates(config.directory, config.agent);
+        scan.nextAt = Date.now() + 3e5;
+      }
+    }
+    return issues;
+  }
+  async close() {
+    for (const scan of this.scans.values()) await scan.iterator.return(void 0);
+  }
+};
+
+// apps/client/sessions/synchronizer.ts
+var SessionSynchronizer = class {
+  constructor(state, root, directory, signal) {
+    this.root = root;
+    this.directory = directory;
+    const binding = state.binding(root);
+    if (!binding) throw new Error("Connect this root before collecting sessions.");
+    this.client = new HubClient(binding.serverUrl, 1e4, binding, signal);
+    this.blobs = new LocalBlobStore(join8(directory, "blobs"));
+    this.index = new SessionState(state, root);
+    this.discovery = new SessionDiscovery(this.index);
+  }
+  root;
+  directory;
+  index;
+  client;
+  blobs;
+  discovery;
+  capable = false;
+  async cycle() {
+    const report = { published: 0, checked: 0, issues: [] };
+    report.issues.push(...await consumeHints(this.directory, this.root, this.index));
+    report.issues.push(...await this.discovery.cycle());
+    const sources = this.index.sources(void 0, 200);
+    if (sources.length && !this.capable) {
+      const info = await this.client.serverInfo();
+      if (!["blobs", "session-revisions"].every(
+        (capability) => info.capabilities.includes(capability)
+      ))
+        throw new Error("Server does not support session publication. Upgrade the server first.");
+      this.capable = true;
+    }
+    let reads = 5;
+    let uploads = 5;
+    for (const source of sources) {
+      if (reads <= 0 || uploads <= 0 || report.checked >= 200) break;
+      report.checked++;
+      this.index.checked(source.path, source.lastError);
+      try {
+        if (source.pending) {
+          if (source.retryAt > Date.now()) {
+            if (source.lastError)
+              report.issues.push(`${source.path}: ${source.lastError} (retry deferred)`);
+            continue;
+          }
+          uploads--;
+          await this.flush(source);
+          report.published++;
+          continue;
+        }
+        const signature2 = await sourceSignature(source.path, source.agent);
+        if (signature2 === source.signature && Date.now() - source.verifiedAt < 864e5) {
+          this.index.checked(source.path);
+          continue;
+        }
+        reads--;
+        const observed = await readSource(source.agent, source.path, source.projectDir);
+        if (observed.incomplete)
+          throw new Error("Final session record is incomplete; waiting for the next save.");
+        if (!observed.snapshot.messages.length) {
+          this.index.checked(source.path);
+          continue;
+        }
+        const key = sessionKey(source.agent, observed.snapshot.nativeId);
+        if (source.key && source.key !== key)
+          throw new Error(
+            "Native session identity changed at this path; register the new source explicitly."
+          );
+        const bytes = Buffer.from(JSON.stringify(observed.snapshot));
+        if (bytes.length > MAX_BLOB_BYTES)
+          throw new Error("Normalized session exceeds the 10 MiB snapshot limit.");
+        const blob = await this.blobs.put(bytes);
+        let revision = source.revision;
+        if (!source.key) {
+          try {
+            const owner = this.index.state.binding(this.root).memberId;
+            const current = await this.client.session(owner, key);
+            if (current.blob.sha256 !== blob.sha256 && !source.adoptExisting)
+              throw new Error(
+                "Server session already exists with different content; inspect it, then track with --adopt-existing to continue."
+              );
+            revision = current.revision;
+          } catch (error) {
+            if (!(error instanceof HubRequestError && error.code === "SESSION_NOT_FOUND"))
+              throw error;
+          }
+          this.index.baseline(source.path, key, revision);
+        }
+        if (blob.sha256 === source.hash) {
+          this.index.acknowledge(source.path, revision, blob.sha256, observed.signature);
+          continue;
+        }
+        this.index.stage(
+          source.path,
+          { operationId: randomUUID6(), sessionKey: key, parentRevision: revision, blob },
+          observed.signature
+        );
+        uploads--;
+        await this.flush(this.index.get(source.path));
+        report.published++;
+      } catch (error) {
+        const message2 = error instanceof Error ? error.message : "Session synchronization failed.";
+        this.index.checked(source.path, message2);
+        report.issues.push(`${source.path}: ${message2}`);
+      }
+    }
+    return report;
+  }
+  async flush(source) {
+    const request = source.pending;
+    try {
+      const { missing: missing2 } = await this.client.missingBlobs([request.blob.sha256]);
+      if (missing2.some((hash2) => hash2 !== request.blob.sha256))
+        throw new Error("Server requested unrelated session content.");
+      if (missing2.length) {
+        const bytes = await this.blobs.get(request.blob.sha256);
+        if (!bytes) throw new Error("Queued session snapshot is missing.");
+        const ref = await this.client.uploadBlob(request.blob.sha256, bytes);
+        if (ref.sha256 !== request.blob.sha256 || ref.size !== request.blob.size)
+          throw new Error("Server acknowledged different session content.");
+      }
+      const result = await this.client.commitSession(request);
+      if (result.operationId !== request.operationId || result.revision < request.parentRevision || result.revision > request.parentRevision + 1)
+        throw new Error("Invalid session acknowledgement.");
+      this.index.acknowledge(
+        source.path,
+        result.revision,
+        request.blob.sha256,
+        source.pendingSignature
+      );
+    } catch (error) {
+      const blocked = error instanceof HubRequestError && error.status >= 400 && error.status < 500 && ![408, 429].includes(error.status);
+      this.index.postpone(
+        source,
+        error instanceof Error ? error.message : "Upload failed.",
+        blocked
+      );
+      throw error;
+    }
+  }
+  async close() {
+    await this.discovery.close();
+  }
+};
+
+// apps/client/files/synchronizer.ts
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { watch } from "node:fs";
+import { lstat as lstat2, mkdir as mkdir6 } from "node:fs/promises";
+import { join as join9, sep as sep4 } from "node:path";
+import { performance } from "node:perf_hooks";
+
+// apps/client/publication.ts
+var PublicationQueue = class {
+  constructor(state, blobs, transport) {
+    this.state = state;
+    this.blobs = blobs;
+    this.transport = transport;
+  }
+  state;
+  blobs;
+  transport;
+  async flush(root, now = Date.now()) {
+    const pending = this.state.pending(root);
+    if (!pending || pending.retryAt > now) return false;
+    try {
+      const hashes = [
+        ...new Set(
+          pending.batch.changes.flatMap(
+            (change) => change.kind === "upsert" ? [change.sha256] : []
+          )
+        )
+      ];
+      const { missing: missing2 } = await this.transport.missingBlobs(hashes);
+      for (const hash2 of missing2) {
+        if (!hashes.includes(hash2)) throw new Error("Server requested unrelated content.");
+        const content = await this.blobs.get(hash2);
+        if (!content) throw new Error("A queued content snapshot is missing from local storage.");
+        const result = await this.transport.uploadBlob(hash2, content);
+        if (result.sha256 !== hash2 || result.size !== content.byteLength)
+          throw new Error("Server acknowledged different content.");
+      }
+      this.state.acknowledge(root, await this.transport.commitFiles(pending.batch));
+      return true;
+    } catch (error) {
+      const blocked = error instanceof HubRequestError && error.status >= 400 && error.status < 500 && ![408, 429].includes(error.status);
+      this.state.postpone(
+        root,
+        pending.batch.operationId,
+        error instanceof Error ? error.message : "Publication failed.",
+        now,
+        blocked
+      );
+      throw error;
+    }
+  }
+};
+
+// apps/client/files/synchronizer.ts
+var FileSynchronizer = class {
+  constructor(state, root, stateDirectory, options = {}) {
+    this.state = state;
+    this.root = root;
+    this.options = options;
+    const binding = state.binding(root);
+    if (!binding) throw new Error("Connect this root before synchronizing.");
+    this.binding = binding;
+    this.client = new HubClient(binding.serverUrl, 3e4, binding, this.abort.signal);
+    this.blobs = new LocalBlobStore(join9(stateDirectory, "blobs"));
+    this.queue = new PublicationQueue(state, this.blobs, this.client);
+    this.index = new SyncState(state, root);
+    this.ownRoot = join9(root, binding.memberId);
+    const started = performance.now();
+    const epoch = Date.now();
+    this.clock = options.clock ?? (() => epoch + performance.now() - started);
+    this.settleMs = options.settleMs ?? 6e4;
+    this.index.restartWaiting(this.clock());
+  }
+  state;
+  root;
+  options;
+  index;
+  binding;
+  client;
+  blobs;
+  queue;
+  ownRoot;
+  clock;
+  settleMs;
+  watcher;
+  watchIssues = [];
+  lastScan = -Infinity;
+  busy = false;
+  stopped = false;
+  abort = new AbortController();
+  async checkCapabilities() {
+    const info = await this.client.serverInfo();
+    if (!["identity", "blobs", "file-revisions"].every(
+      (capability) => info.capabilities.includes(capability)
+    ))
+      throw new Error("Server does not support file synchronization.");
+  }
+  setSettleMs(value) {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 864e5)
+      throw new Error("Invalid stable wait interval.");
+    this.settleMs = value;
+  }
+  close() {
+    this.stopped = true;
+    this.abort.abort();
+    this.watcher?.close();
+    this.watcher = void 0;
+  }
+  async cycle() {
+    if (this.busy || this.stopped) throw new Error("Synchronizer is already running or closed.");
+    this.busy = true;
+    const settleMs = this.settleMs;
+    const report = {
+      published: false,
+      appliedFiles: 0,
+      waitingFiles: 0,
+      pendingPublication: false,
+      issues: this.watchIssues.splice(0)
+    };
+    try {
+      try {
+        await this.initializeAuthor();
+        const ownStat = await lstat2(await safePath(this.root, this.binding.memberId));
+        if (!ownStat.isDirectory() || ownStat.isSymbolicLink())
+          throw new Error("Author directory is unavailable or is a symlink.");
+        this.listen();
+        if (this.clock() - this.lastScan >= (this.options.reconcileMs ?? 3e5)) {
+          await this.reconcile("", report.issues);
+          this.lastScan = this.clock();
+        }
+        const blocked = await this.refreshDirty(report.issues);
+        await this.audit(report.issues);
+        report.published = await this.queue.flush(this.root, this.clock());
+        if (!this.state.pending(this.root) && !this.stopped) {
+          await this.stage(blocked, report.issues, settleMs);
+          report.published = await this.queue.flush(this.root, this.clock()) || report.published;
+        }
+      } catch (error) {
+        report.issues.push(`publish: ${message(error)}`);
+      }
+      if (!this.stopped) {
+        try {
+          for (const member of (await this.client.members()).members) {
+            if (member === this.binding.memberId || this.stopped) continue;
+            try {
+              report.appliedFiles += await this.receive(member);
+            } catch (error) {
+              report.issues.push(`${member}: ${message(error)}`);
+            }
+          }
+        } catch (error) {
+          report.issues.push(`receive: ${message(error)}`);
+        }
+      }
+      report.waitingFiles = this.index.index(true).length;
+      report.pendingPublication = Boolean(this.state.pending(this.root));
+      this.index.saveStatus({ ...report, checkedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      return report;
+    } finally {
+      this.busy = false;
+    }
+  }
+  async manifest(owner) {
+    let revision;
+    let after = "";
+    const files = [];
+    for (; ; ) {
+      const page = await this.client.fileManifest(owner, revision, after);
+      if (revision !== void 0 && page.revision !== revision)
+        throw new Error("Manifest changed version during pagination.");
+      revision = page.revision;
+      files.push(...page.files);
+      if (page.nextCursor === null) return { revision, files };
+      if (page.nextCursor === after || files.length > 1e5)
+        throw new Error("Manifest pagination did not make bounded progress.");
+      after = page.nextCursor;
+    }
+  }
+  async initializeAuthor() {
+    if (this.state.publication(this.root).initialized) return;
+    const manifest = await this.manifest(this.binding.memberId);
+    if (manifest.revision > 0) {
+      if (!this.options.adoptBaseline)
+        throw new Error(
+          "Published history exists but the local baseline is missing. Verify local files, then use --adopt-baseline."
+        );
+      for (const file of manifest.files) {
+        const local = await readStable(this.ownRoot, file.path);
+        if (local.sha256 !== file.sha256)
+          throw new Error(
+            `Cannot adopt baseline: local ${file.path} differs from the published file.`
+          );
+      }
+    } else {
+      const ownerPath = await safePath(this.root, this.binding.memberId);
+      await mkdir6(ownerPath).catch((error) => {
+        if (error.code !== "EEXIST") throw error;
+      });
+    }
+    this.state.initializePublication(this.root, manifest.revision, manifest.files);
+  }
+  listen() {
+    if (this.options.watch === false || this.watcher || this.stopped) return;
+    try {
+      this.watcher = watch(this.ownRoot, { recursive: true }, (_event, filename) => {
+        if (!filename) {
+          this.lastScan = -Infinity;
+          return;
+        }
+        const path = filename.toString().split(sep4).join("/");
+        if (!ignored(path)) this.index.event(path, this.clock());
+      });
+      this.watcher.on("error", (error) => {
+        this.watchIssues.push(`File watcher: ${message(error)}; metadata scans remain enabled.`);
+        this.watcher?.close();
+        this.watcher = void 0;
+        this.lastScan = -Infinity;
+      });
+    } catch (error) {
+      this.watchIssues.push(`File watcher unavailable: ${message(error)}; using metadata scans.`);
+    }
+  }
+  async reconcile(prefix, issues) {
+    const scan = await walk(this.ownRoot, prefix);
+    const now = this.clock();
+    for (const [path, signature2] of scan.files) this.index.observe(path, signature2, now);
+    if (scan.complete) {
+      for (const prior of this.index.index()) {
+        if ((!prefix || prior.path.startsWith(`${prefix}/`)) && !ignored(prior.path) && !scan.files.has(prior.path))
+          this.index.observe(prior.path, null, now);
+      }
+    }
+    issues.push(...scan.issues);
+  }
+  async refreshDirty(issues) {
+    const blocked = /* @__PURE__ */ new Set();
+    for (const prior of this.index.index(true)) {
+      if (this.stopped) break;
+      try {
+        const current = await metadata(this.ownRoot, prior.path);
+        if (current?.directory) {
+          await this.reconcile(prior.path, issues);
+          this.index.observe(prior.path, null, this.clock());
+        } else this.index.observe(prior.path, current?.signature ?? null, this.clock());
+      } catch (error) {
+        blocked.add(prior.path);
+        issues.push(`${prior.path}: ${message(error)}`);
+      }
+    }
+    return blocked;
+  }
+  async audit(issues) {
+    let bytes = 0;
+    for (const prior of this.index.audit(
+      this.clock() - (this.options.auditAgeMs ?? 864e5),
+      this.options.auditBudget ?? 20
+    )) {
+      if (this.stopped || bytes > 20 * 1024 * 1024) break;
+      try {
+        const local = await readStable(this.ownRoot, prior.path);
+        bytes += local.bytes.length;
+        if (local.sha256 !== prior.hash || local.signature !== prior.signature)
+          this.index.event(prior.path, this.clock());
+        this.index.verified(prior.path, this.clock());
+      } catch (error) {
+        this.index.event(prior.path, this.clock());
+        issues.push(`${prior.path}: ${message(error)}`);
+      }
+    }
+  }
+  async stage(blocked, issues, settleMs) {
+    const ready = this.index.index(true).filter(
+      (row) => !blocked.has(row.path) && !row.eventPending && this.clock() - row.observedAt >= settleMs
+    );
+    if (!ready.length) return;
+    const baseline = this.state.ownerFiles(this.root);
+    const planned = new Map(baseline);
+    const changes = [];
+    const snapshots = [];
+    let bytes = 0;
+    ready.sort((a, b) => Number(a.signature !== null) - Number(b.signature !== null));
+    for (const row of ready) {
+      if (this.stopped || changes.length >= MAX_BATCH_FILES || bytes > 20 * 1024 * 1024) break;
+      try {
+        if (row.signature === null) {
+          const current = await metadata(this.ownRoot, row.path);
+          if (current && !current.directory) {
+            this.index.event(row.path, this.clock());
+            continue;
+          }
+          if (baseline.has(row.path)) {
+            changes.push({ kind: "delete", path: row.path });
+            planned.delete(row.path);
+          } else {
+            this.index.clean(row.path, row.generation, null, this.clock());
+            continue;
+          }
+          snapshots.push({ path: row.path, generation: row.generation, hash: null });
+          continue;
+        }
+        const key = row.path.toLowerCase();
+        const collision = [...planned.keys()].some(
+          (path) => path !== row.path && (path.toLowerCase() === key || path.toLowerCase().startsWith(`${key}/`) || key.startsWith(`${path.toLowerCase()}/`))
+        );
+        if (collision) continue;
+        const local = await readStable(this.ownRoot, row.path);
+        bytes += local.bytes.length;
+        if (local.signature !== row.signature || this.index.get(row.path)?.generation !== row.generation) {
+          this.index.event(row.path, this.clock());
+          continue;
+        }
+        if (baseline.get(row.path)?.sha256 === local.sha256) {
+          this.index.clean(row.path, row.generation, local.sha256, this.clock());
+          continue;
+        }
+        const ref = await this.blobs.put(local.bytes);
+        changes.push({ kind: "upsert", path: row.path, ...ref });
+        planned.set(row.path, ref);
+        snapshots.push({ path: row.path, generation: row.generation, hash: local.sha256 });
+      } catch (error) {
+        this.index.event(row.path, this.clock());
+        issues.push(`${row.path}: ${message(error)}`);
+      }
+    }
+    if (!changes.length) return;
+    const rootStat = await lstat2(this.ownRoot);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+      throw new Error("Author directory disappeared before publication.");
+    this.state.enqueue(this.root, {
+      operationId: randomUUID7(),
+      parentRevision: this.state.publication(this.root).revision,
+      changes
+    });
+    for (const snapshot of snapshots)
+      this.index.clean(snapshot.path, snapshot.generation, snapshot.hash, this.clock());
+  }
+  async receive(owner) {
+    if (!this.index.job(owner)) {
+      const revision = this.index.revision(owner);
+      if (revision === void 0) {
+        const manifest = await this.manifest(owner);
+        this.index.queue(
+          owner,
+          manifest.revision,
+          manifest.files.map((file) => ({
+            kind: "upsert",
+            path: file.path,
+            sha256: file.sha256,
+            size: file.size
+          }))
+        );
+      } else {
+        const delta = await this.client.fileChanges(owner, revision);
+        if (!delta.revisions.length) return 0;
+        const changes = /* @__PURE__ */ new Map();
+        let expected = revision + 1;
+        for (const entry of delta.revisions) {
+          if (entry.revision !== expected++) throw new Error("Server change history has a gap.");
+          for (const change of entry.changes) changes.set(change.path, change);
+        }
+        const finalNames = new Set(
+          [...changes.values()].filter((change) => change.kind === "upsert").map((change) => change.path.toLowerCase())
+        );
+        for (const change of changes.values()) {
+          if (change.kind === "delete" && !this.index.received(owner, change.path) && finalNames.has(change.path.toLowerCase()))
+            changes.delete(change.path);
+        }
+        const ordered = [...changes.values()].sort(
+          (a, b) => a.kind !== b.kind ? a.kind === "delete" ? -1 : 1 : a.kind === "delete" ? b.path.length - a.path.length : a.path.length - b.path.length
+        );
+        this.index.queue(owner, delta.revisions.at(-1).revision, ordered);
+      }
+    }
+    const job = this.index.job(owner);
+    const ownerRoot = await safePath(this.root, owner);
+    await mkdir6(ownerRoot).catch((error) => {
+      if (error.code !== "EEXIST") throw error;
+    });
+    const ownerStat = await lstat2(ownerRoot);
+    if (!ownerStat.isDirectory() || ownerStat.isSymbolicLink())
+      throw new Error("Mirror root is not an ordinary directory.");
+    let count = 0;
+    let bytes = 0;
+    for (let offset = job.nextIndex; offset < job.changes.length; offset++) {
+      if (this.stopped || count >= (this.options.applyBudget ?? 200) || bytes > 20 * 1024 * 1024)
+        break;
+      const change = job.changes[offset];
+      await this.apply(owner, ownerRoot, change);
+      this.index.applied(owner, change, offset + 1);
+      count++;
+      if (change.kind === "upsert") bytes += change.size;
+    }
+    if (this.index.job(owner).nextIndex === job.changes.length) this.index.finish(owner);
+    return count;
+  }
+  async apply(owner, root, change) {
+    const prior = this.index.received(owner, change.path);
+    const current = await metadata(root, change.path);
+    let local;
+    if (current && !current.directory) local = await readStable(root, change.path);
+    if (change.kind === "delete") {
+      if (!current) return;
+      if (current.directory && !prior) return;
+      if (!local || !prior || local.sha256 !== prior.sha256)
+        throw new Error(`Local mirror differs; preserving ${change.path}.`);
+      await removeFile(root, change.path, local.signature);
+    } else {
+      if (local?.sha256 === change.sha256) return;
+      if (local && (!prior || local.sha256 !== prior.sha256))
+        throw new Error(`Local mirror differs; preserving ${change.path}.`);
+      if (!current && prior && !this.options.restoreMissing)
+        throw new Error(
+          `Local mirror was removed; use --restore-missing to restore ${change.path}.`
+        );
+      let content = await this.blobs.get(change.sha256);
+      if (!content) {
+        content = await this.client.downloadBlob(change.sha256);
+        await this.blobs.put(content);
+      }
+      if (content.byteLength !== change.size)
+        throw new Error(`Content size mismatch: ${change.path}`);
+      await replaceFile(root, change.path, content, local?.signature ?? null);
+    }
+  }
+};
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// apps/client/sync-command.ts
+var help2 = `Usage: teammy sync [options]
+
+  --root DIR           Shared root (default: ./workspaces)
+  --state-dir DIR      Local state (default: ~/.teammy/client)
+  --once               Run one check and exit; pending changes remain saved
+  --interval-ms N      Check interval (default: 60000, minimum: 1000)
+  --settle-ms N        Per-file quiet period (default: 60000)
+  --adopt-baseline     Accept existing server history only if every published file matches locally
+  --restore-missing   Restore missing mirror files; existing local edits are still preserved
+  --retry              Retry file/session publications paused by a previous failure
+  --sessions-only      Collect sessions without applying shared files
+  -h, --help           Show this help
+
+Runs in the foreground until SIGINT/SIGTERM. Each run restarts the quiet period
+for pending files; --once does not wait for edits to settle. --settle-ms 0 can be
+used for an explicit immediate check. Only this member's directory is uploaded.
+`;
+async function runSyncCommand(args, version) {
+  const { values } = parseArgs2({
+    args,
+    options: {
+      root: { type: "string", default: resolve5("workspaces") },
+      "state-dir": { type: "string", default: join10(homedir2(), ".teammy", "client") },
+      once: { type: "boolean" },
+      "interval-ms": { type: "string" },
+      "settle-ms": { type: "string" },
+      "adopt-baseline": { type: "boolean" },
+      "restore-missing": { type: "boolean" },
+      retry: { type: "boolean" },
+      "sessions-only": { type: "boolean" },
+      help: { type: "boolean", short: "h" }
+    }
+  });
+  if (values.help) {
+    process.stdout.write(help2);
+    return 0;
+  }
+  let intervalMs = Number(values["interval-ms"] ?? 6e4);
+  const settleMs = Number(values["settle-ms"] ?? 6e4);
+  if (!Number.isSafeInteger(intervalMs) || intervalMs < 1e3 || intervalMs > 864e5 || !Number.isSafeInteger(settleMs) || settleMs < 0 || settleMs > 864e5)
+    throw new Error("Invalid sync timing options.");
+  const root = await realpath5(resolve5(values.root));
+  const stateDirectory = await stateLocation(root, values["state-dir"]);
+  const lock = acquireRootLock(root, stateDirectory);
+  let state;
+  let synchronizer;
+  let sessions;
+  let control;
+  const stopped = new AbortController();
+  const stop = () => {
+    stopped.abort();
+    synchronizer?.close();
+  };
+  try {
+    state = new ClientState(stateDirectory);
+    if (values.retry) state.retryPublication(root);
+    sessions = new SessionSynchronizer(state, root, stateDirectory, stopped.signal);
+    if (values.retry) sessions.index.retry();
+    if (!values["sessions-only"])
+      synchronizer = new FileSynchronizer(state, root, stateDirectory, {
+        settleMs,
+        adoptBaseline: Boolean(values["adopt-baseline"]),
+        restoreMissing: Boolean(values["restore-missing"])
+      });
+    const overrides = {};
+    if (values["interval-ms"] !== void 0) overrides.checkIntervalSeconds = intervalMs / 1e3;
+    if (values["settle-ms"] !== void 0) overrides.fileSettleSeconds = settleMs / 1e3;
+    control = new ControlPlane(state, root, version, overrides, (policy) => {
+      intervalMs = Math.round(policy.checkIntervalSeconds * 1e3);
+      synchronizer?.setSettleMs(Math.round(policy.fileSettleSeconds * 1e3));
+    });
+    await control.tick();
+    await synchronizer?.checkCapabilities();
+    if (!values.once) control.start();
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+    do {
+      const report = synchronizer ? await synchronizer.cycle() : { issues: [], published: false, appliedFiles: 0, waitingFiles: 0 };
+      let sessionReport;
+      try {
+        sessionReport = await sessions.cycle();
+      } catch (error) {
+        sessionReport = {
+          published: 0,
+          checked: 0,
+          issues: [error instanceof Error ? error.message : "Session synchronization failed."]
+        };
+      }
+      control.updateSync({
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        published: report.published,
+        appliedFiles: report.appliedFiles,
+        pendingFiles: report.waitingFiles + (state.pending(root)?.batch.changes.length ?? 0),
+        sessionSources: Number(
+          state.db.prepare("SELECT COUNT(*) n FROM session_sources WHERE root=?").get(root).n
+        ),
+        errors: [...report.issues, ...sessionReport.issues].slice(0, 20).map((message2) => message2.slice(0, 1e3))
+      });
+      if (values.once && control.enabled) await control.tick();
+      const combined = {
+        ...report,
+        sessions: sessionReport,
+        control: control.enabled ? control.status : null
+      };
+      process.stdout.write(`${JSON.stringify(combined)}
+`);
+      if (values.once)
+        return report.issues.length || sessionReport.issues.length || control.enabled && (control.status.configError || control.status.reportError) ? 1 : 0;
+      const finishedAt = Date.now();
+      while (!stopped.signal.aborted && Date.now() - finishedAt < intervalMs)
+        await setTimeout3(Math.min(1e3, intervalMs - (Date.now() - finishedAt)), void 0, {
+          signal: stopped.signal
+        }).catch((error) => {
+          if (!stopped.signal.aborted) throw error;
+        });
+    } while (!stopped.signal.aborted);
+    return 0;
+  } finally {
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
+    synchronizer?.close();
+    await control?.close();
+    await sessions?.close();
+    state?.close();
+    lock.close();
+  }
+}
+
+// apps/client/main.ts
+var help3 = `teammy \u2014 the Teammy collaboration client
+
+Usage:
+  teammy                            Show this help
+  teammy --help                     Show this help
+  teammy --version                  Show the installed client version
+  teammy server-info --url URL      Check server connection and protocol capabilities
+  teammy server-info --help         Show connection options
+  teammy connect --url URL [--member ID | --token-file FILE] [--reconnect] [--root DIR] [--state-dir DIR]
+  teammy status [--root DIR] [--state-dir DIR]
+  teammy sync [--root DIR] [--once]
+  teammy session --help              Collect, read and search Agent sessions
+
+Root defaults to ./workspaces; local state defaults to ~/.teammy/client.
+sync runs foreground synchronization; manage project settings in the server dashboard.
+The hub server is installed separately as @teammy/server (command: teammy-server).
+`;
+var serverInfoHelp = `Usage: teammy server-info --url URL
+
+Options:
+  --url URL    Hub HTTP(S) URL, including an optional path prefix
+  -h, --help   Show this help
+
+Prints server information as JSON after validating the protocol response.
+This command does not save a connection or bind a workspace.
+`;
+async function runCli(args, version) {
+  const command = args[0];
+  if (args.length === 0 || args.length === 1 && ["--help", "-h", "help"].includes(command)) {
+    process.stdout.write(help3);
+    return 0;
+  }
+  if (args.length === 1 && ["--version", "-v", "version"].includes(command)) {
+    process.stdout.write(`${version}
+`);
+    return 0;
+  }
+  if (command === "server") {
+    process.stderr.write('Install @teammy/server and run "teammy-server" to start the hub.\n');
+    return 1;
+  }
+  if (command === "session") {
+    try {
+      return await runSessionCommand(args.slice(1));
+    } catch (error) {
+      if (args[1] === "hook") return 0;
+      process.stderr.write(
+        `${error instanceof Error ? error.message : "Session command failed."}
+`
+      );
+      return 1;
+    }
+  }
+  if (command === "sync") {
+    try {
+      return await runSyncCommand(args.slice(1), version);
+    } catch (error) {
+      process.stderr.write(
+        `${error instanceof Error ? error.message : "Synchronization failed."}
+`
+      );
+      return 1;
+    }
+  }
+  if (command === "connect" || command === "status") {
+    try {
+      const { values } = parseArgs3({
+        args: args.slice(1),
+        options: {
+          url: { type: "string" },
+          "token-file": { type: "string" },
+          member: { type: "string" },
+          reconnect: { type: "boolean" },
+          root: { type: "string", default: resolve6("workspaces") },
+          "state-dir": { type: "string", default: join11(homedir3(), ".teammy", "client") }
+        }
+      });
+      const rootPath = resolve6(values.root);
+      if (command === "connect") await mkdir7(rootPath, { recursive: true });
+      const root = await realpath6(rootPath);
+      const state = new ClientState(await stateLocation(root, values["state-dir"]));
+      try {
+        if (command === "status") {
+          const binding = state.binding(root);
+          if (!binding) throw new Error("This root is not connected. Run teammy connect first.");
+          const { token: _token, ...publicBinding } = binding;
+          process.stdout.write(
+            `${JSON.stringify({ ...publicBinding, control: readControlStatus(state, root), sessions: new SessionState(state, root).status(), publication: state.publication(root), pending: state.pending(root) ? { operationId: state.pending(root).batch.operationId, retryAt: state.pending(root).retryAt, lastError: state.pending(root).lastError } : null, sync: new SyncState(state, root).status() }, null, 2)}
+`
+          );
+        } else {
+          if (!values.url) throw new Error("--url is required.");
+          const connected = await connectProject(
+            state,
+            root,
+            await stateLocation(root, values["state-dir"]),
+            {
+              url: values.url,
+              member: values.member,
+              tokenFile: values["token-file"],
+              reconnect: values.reconnect
+            }
+          );
+          process.stdout.write(`${JSON.stringify(connected, null, 2)}
+`);
+        }
+      } finally {
+        state.close();
+      }
+      return 0;
+    } catch (error) {
+      process.stderr.write(
+        `${error instanceof Error ? error.message : "Unable to open connection."}
+`
+      );
+      return 1;
+    }
+  }
+  if (command !== "server-info") {
+    process.stderr.write('Unknown command or arguments. Run "teammy --help" for usage.\n');
+    return 1;
+  }
+  try {
+    const { values } = parseArgs3({
+      args: args.slice(1),
+      options: {
+        help: { type: "boolean", short: "h" },
+        url: { type: "string" }
+      }
+    });
+    if (values.help) {
+      process.stdout.write(serverInfoHelp);
+      return 0;
+    }
+    if (!values.url?.trim()) throw new Error("--url is required.");
+    const info = await new HubClient(values.url).serverInfo();
+    process.stdout.write(`${JSON.stringify(info, null, 2)}
+`);
+    return 0;
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : "Unable to reach server."}
+`);
+    return 1;
+  }
+}
+export {
+  runCli
+};