@teammy/cli 0.0.7 → 0.0.9

package/dist/main.js

@@ -257,7 +257,7 @@ var SessionSearchSchema = z4.object({
 });
 
 // packages/transport/hub-client.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import { createHash } from "node:crypto";
 
 // packages/protocol/index.ts
@@ -278,6 +278,33 @@ var ErrorResponseSchema = z5.object({
   })
 });
 
+// packages/protocol/shared-files.ts
+import { z as z6 } from "zod";
+var PROJECT_FILE_OWNER = "_project";
+var FileOwnerSchema = z6.union([NameSchema, z6.literal(PROJECT_FILE_OWNER)]);
+var SharedPathSchema = z6.string().max(255).refine((path) => {
+  const directory = path.endsWith("/");
+  const name2 = directory ? path.slice(0, -1) : path;
+  return FilePathSchema.safeParse(name2).success && !name2.includes("/") && !name2.startsWith(".") && !/^_?teammy/i.test(name2) && (directory ? name2.startsWith("_") : name2.includes("."));
+}, "Use a root file (README.md) or an underscore-prefixed directory (_template/).");
+var SharedFilesConfigSchema = z6.object({
+  maintainer: NameSchema.nullable(),
+  paths: z6.array(SharedPathSchema).max(30).refine((paths) => new Set(paths.map((p) => p.toLowerCase())).size === paths.length),
+  revision: RevisionSchema
+}).strict();
+var SharedFilesUpdateSchema = SharedFilesConfigSchema.omit({ revision: true }).extend({ expectedRevision: RevisionSchema }).strict();
+var SharedFileCommitSchema = FileCommitSchema.safeExtend({
+  configRevision: RevisionSchema
+});
+function privateWorkspacePath(path) {
+  return path.split("/").some((part) => /^\.teammy(?:[-.]|$)/i.test(part));
+}
+function sharedPathAllowed(path, paths) {
+  return !privateWorkspacePath(path) && paths.some(
+    (entry) => entry.endsWith("/") ? path === entry.slice(0, -1) || path.startsWith(entry) : path === entry
+  );
+}
+
 // packages/transport/hub-client.ts
 var HubRequestError = class extends Error {
   constructor(message2, status, code, requestId) {
@@ -340,7 +367,7 @@ var HubClient = class {
       "GET",
       `api/v1/blobs/${HashSchema.parse(hash2)}`
     );
-    if (!response.ok) return this.decode(response, signal, z6.never());
+    if (!response.ok) return this.decode(response, signal, z7.never());
     const reader = response.body?.getReader();
     if (!reader) throw new Error("Server returned no content body.");
     const parts = [];
@@ -385,7 +412,7 @@ var HubClient = class {
     return this.request(
       "PUT",
       "api/v1/devices/self/status",
-      z6.object({ ok: z6.literal(true) }),
+      z7.object({ ok: z7.literal(true) }),
       status
     );
   }
@@ -395,6 +422,15 @@ var HubClient = class {
   projectConfig() {
     return this.request("GET", "api/v1/project/config", ProjectConfigSchema);
   }
+  sharedFilesConfig() {
+    return this.request("GET", "api/v1/project/shared-files", SharedFilesConfigSchema);
+  }
+  commitSharedFiles(batch, configRevision) {
+    return this.request("POST", "api/v1/files/_project/commits", CommitResultSchema, {
+      ...batch,
+      configRevision
+    });
+  }
   commitSession(commit) {
     return this.request(
       "POST",
@@ -488,48 +524,6 @@ import { homedir } from "node:os";
 import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
 import { parseArgs } from "node:util";
 
-// apps/client/runtime/state.ts
-var runtimeMigration = `
-ALTER TABLE file_index ADD COLUMN seen_local INTEGER NOT NULL DEFAULT 0;
-UPDATE file_index SET seen_local=1 WHERE signature IS NOT NULL OR hash IS NOT NULL;
-CREATE TABLE client_runtime(root TEXT PRIMARY KEY REFERENCES connections(root), enabled INTEGER NOT NULL DEFAULT 0, status_json TEXT);
-CREATE TABLE client_preparations(root TEXT PRIMARY KEY REFERENCES connections(root), identity TEXT NOT NULL, input_json TEXT NOT NULL, complete INTEGER NOT NULL DEFAULT 0);
-`;
-var RuntimeState = class {
-  constructor(state) {
-    this.state = state;
-  }
-  state;
-  enabled(root) {
-    return Boolean(
-      this.state.db.prepare("SELECT enabled FROM client_runtime WHERE root=?").get(root)?.enabled
-    );
-  }
-  enable(root, enabled) {
-    if (!this.state.binding(root)) throw new Error("Connect this workspace first.");
-    this.state.db.prepare(
-      "INSERT INTO client_runtime(root,enabled) VALUES (?,?) ON CONFLICT(root) DO UPDATE SET enabled=excluded.enabled"
-    ).run(root, Number(enabled));
-  }
-  roots() {
-    return this.state.db.prepare("SELECT root FROM client_runtime WHERE enabled=1").all().map((r) => String(r.root));
-  }
-  status(root) {
-    const row = this.state.db.prepare("SELECT status_json FROM client_runtime WHERE root=?").get(root);
-    return row?.status_json ? JSON.parse(String(row.status_json)) : null;
-  }
-  save(root, status) {
-    this.state.db.prepare(
-      "INSERT INTO client_runtime(root,status_json) VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
-    ).run(root, JSON.stringify(status));
-  }
-};
-
-// apps/client/state.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { join as join4, relative as relative2, isAbsolute, sep as sep2 } from "node:path";
-import { z as z8 } from "zod";
-
 // packages/state/sqlite.ts
 import { chmodSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
@@ -571,6 +565,317 @@ function openDatabase(path, migrations, busyTimeoutMs = 5e3) {
   }
 }
 
+// apps/client/files/publication-state.ts
+var FilePublicationState = class {
+  constructor(db, scope = "member") {
+    this.db = db;
+    const prefix = scope === "project" ? "project_" : "";
+    this.tables = {
+      publications: prefix + "publications",
+      owner_files: prefix + "owner_files",
+      outbox: prefix + "outbox"
+    };
+  }
+  db;
+  tables;
+  discard(root) {
+    this.db.prepare(`DELETE FROM ${this.tables.outbox} WHERE root=?`).run(root);
+  }
+  publication(root) {
+    this.db.prepare(`INSERT OR IGNORE INTO ${this.tables.publications}(root) VALUES (?)`).run(root);
+    const row = this.db.prepare(`SELECT revision, initialized FROM ${this.tables.publications} WHERE root=?`).get(root);
+    return { revision: Number(row.revision), initialized: Boolean(row.initialized) };
+  }
+  initializePublication(root, revision, files, options = {}) {
+    transaction(this.db, () => {
+      if (options.discardPending) this.discard(root);
+      if (this.pending(root))
+        throw new Error("Cannot replace a baseline with a publication pending.");
+      this.db.prepare(
+        `INSERT INTO ${this.tables.publications} VALUES (?, ?, 1) ON CONFLICT(root) DO UPDATE SET revision=excluded.revision, initialized=1`
+      ).run(root, revision);
+      this.db.prepare(`DELETE FROM ${this.tables.owner_files} WHERE root=?`).run(root);
+      for (const file of files)
+        this.db.prepare(`INSERT INTO ${this.tables.owner_files} VALUES (?, ?, ?, ?)`).run(root, file.path, file.sha256, file.size);
+    });
+  }
+  ownerFiles(root) {
+    return new Map(
+      this.db.prepare(`SELECT path, hash, size FROM ${this.tables.owner_files} WHERE root=?`).all(root).map((row) => [String(row.path), { sha256: String(row.hash), size: Number(row.size) }])
+    );
+  }
+  pending(root) {
+    const row = this.db.prepare(
+      `SELECT request_json, attempts, retry_at, last_error FROM ${this.tables.outbox} WHERE root=?`
+    ).get(root);
+    return row ? {
+      batch: FileCommitSchema.parse(JSON.parse(String(row.request_json))),
+      attempts: Number(row.attempts),
+      retryAt: Number(row.retry_at),
+      lastError: row.last_error === null ? null : String(row.last_error)
+    } : void 0;
+  }
+  enqueue(root, batch) {
+    const fixed = FileCommitSchema.parse(batch);
+    transaction(this.db, () => {
+      const publication = this.publication(root);
+      if (!publication.initialized || publication.revision !== fixed.parentRevision)
+        throw new Error("Publication baseline is not ready.");
+      if (this.pending(root)) throw new Error("A publication is already pending.");
+      this.db.prepare(`INSERT INTO ${this.tables.outbox}(root, request_json) VALUES (?, ?)`).run(root, JSON.stringify(fixed));
+    });
+  }
+  acknowledge(root, result2) {
+    transaction(this.db, () => {
+      const pending = this.pending(root);
+      if (!pending || pending.batch.operationId !== result2.operationId || result2.revision < pending.batch.parentRevision || result2.revision > pending.batch.parentRevision + 1)
+        throw new Error("Unexpected publication acknowledgement.");
+      for (const change of pending.batch.changes) {
+        if (change.kind === "delete")
+          this.db.prepare(`DELETE FROM ${this.tables.owner_files} WHERE root=? AND path=?`).run(root, change.path);
+        else
+          this.db.prepare(
+            `INSERT INTO ${this.tables.owner_files} VALUES (?, ?, ?, ?) ON CONFLICT(root, path) DO UPDATE SET hash=excluded.hash, size=excluded.size`
+          ).run(root, change.path, change.sha256, change.size);
+      }
+      this.db.prepare(`UPDATE ${this.tables.publications} SET revision=? WHERE root=?`).run(result2.revision, root);
+      this.db.prepare(`DELETE FROM ${this.tables.outbox} WHERE root=?`).run(root);
+    });
+  }
+  postpone(root, operationId, reason, now, blocked) {
+    const pending = this.pending(root);
+    if (!pending || pending.batch.operationId !== operationId) return;
+    const retryAt = blocked ? Number.MAX_SAFE_INTEGER : now + Math.min(9e5, 6e4 * 2 ** Math.min(pending.attempts, 4));
+    this.db.prepare(
+      `UPDATE ${this.tables.outbox} SET attempts=attempts+1, retry_at=?, last_error=? WHERE root=?`
+    ).run(retryAt, reason, root);
+  }
+  retryPublication(root) {
+    this.db.prepare(`UPDATE ${this.tables.outbox} SET retry_at=0, last_error=NULL WHERE root=?`).run(root);
+  }
+};
+
+// apps/client/files/state.ts
+var syncMigration = String.raw`
+  CREATE TABLE file_index (
+    root TEXT NOT NULL, path TEXT NOT NULL, signature TEXT, dirty INTEGER NOT NULL DEFAULT 1,
+    event_pending INTEGER NOT NULL DEFAULT 0, generation INTEGER NOT NULL DEFAULT 1,
+    observed_at REAL NOT NULL, hash TEXT, verified_at REAL NOT NULL DEFAULT 0,
+    PRIMARY KEY(root, path)
+  );
+  CREATE INDEX dirty_files ON file_index(root, dirty, observed_at);
+  CREATE INDEX audit_files ON file_index(root, dirty, verified_at);
+  CREATE TABLE received_files (root TEXT NOT NULL, owner TEXT NOT NULL, path TEXT NOT NULL, hash TEXT NOT NULL, size INTEGER NOT NULL, PRIMARY KEY(root, owner, path));
+  CREATE TABLE received_progress (root TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL, PRIMARY KEY(root, owner));
+  CREATE TABLE receive_jobs (root TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL, changes_json TEXT NOT NULL, next_index INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(root, owner));
+  CREATE TABLE sync_status (root TEXT PRIMARY KEY, status_json TEXT NOT NULL);
+`;
+var SyncState = class {
+  constructor(state, root, scope = "member") {
+    this.root = root;
+    this.db = state.db;
+    const prefix = scope === "project" ? "project_" : "";
+    this.tables = {
+      file_index: prefix + "file_index",
+      received_files: prefix + "received_files",
+      received_progress: prefix + "received_progress",
+      receive_jobs: prefix + "receive_jobs",
+      sync_status: prefix + "sync_status"
+    };
+  }
+  root;
+  db;
+  tables;
+  index(onlyDirty = false) {
+    return this.db.prepare(
+      `SELECT * FROM ${this.tables.file_index} WHERE root=?${onlyDirty ? " AND dirty=1" : ""}`
+    ).all(this.root).map((row) => ({
+      path: String(row.path),
+      signature: row.signature === null ? null : String(row.signature),
+      dirty: Boolean(row.dirty),
+      eventPending: Boolean(row.event_pending),
+      generation: Number(row.generation),
+      observedAt: Number(row.observed_at),
+      hash: row.hash === null ? null : String(row.hash),
+      verifiedAt: Number(row.verified_at),
+      seenLocal: Boolean(row.seen_local)
+    }));
+  }
+  audit(before, limit) {
+    return this.db.prepare(
+      `SELECT path FROM ${this.tables.file_index} WHERE root=? AND dirty=0 AND signature IS NOT NULL AND verified_at<=? ORDER BY verified_at LIMIT ?`
+    ).all(this.root, before, limit).map((row) => this.get(String(row.path)));
+  }
+  get(path) {
+    const row = this.db.prepare(`SELECT * FROM ${this.tables.file_index} WHERE root=? AND path=?`).get(this.root, path);
+    return row ? {
+      path,
+      signature: row.signature === null ? null : String(row.signature),
+      dirty: Boolean(row.dirty),
+      eventPending: Boolean(row.event_pending),
+      generation: Number(row.generation),
+      observedAt: Number(row.observed_at),
+      hash: row.hash === null ? null : String(row.hash),
+      verifiedAt: Number(row.verified_at),
+      seenLocal: Boolean(row.seen_local)
+    } : void 0;
+  }
+  restartWaiting(now) {
+    this.db.prepare(`UPDATE ${this.tables.file_index} SET observed_at=? WHERE root=? AND dirty=1`).run(now, this.root);
+  }
+  event(path, now) {
+    this.db.prepare(
+      `INSERT INTO ${this.tables.file_index}(root, path, observed_at, event_pending) VALUES (?, ?, ?, 1)
+      ON CONFLICT(root,path) DO UPDATE SET dirty=1, event_pending=1, generation=generation+1, observed_at=excluded.observed_at`
+    ).run(this.root, path, now);
+    this.db.prepare(
+      `UPDATE ${this.tables.file_index} SET dirty=1, event_pending=1, generation=generation+1, observed_at=? WHERE root=? AND substr(path,1,length(?))=?`
+    ).run(now, this.root, `${path}/`, `${path}/`);
+  }
+  observe(path, signature2, now) {
+    const prior = this.get(path);
+    if (!prior) {
+      if (signature2 !== null)
+        this.db.prepare(
+          `INSERT INTO ${this.tables.file_index}(root,path,signature,observed_at,seen_local) VALUES (?,?,?,?,1)`
+        ).run(this.root, path, signature2, now);
+    } else if (signature2 !== prior.signature) {
+      this.db.prepare(
+        `UPDATE ${this.tables.file_index} SET seen_local=MAX(seen_local, ? IS NOT NULL), signature=?, dirty=1, generation=generation+1, observed_at=?, event_pending=0 WHERE root=? AND path=?`
+      ).run(signature2, signature2, prior.eventPending ? prior.observedAt : now, this.root, path);
+    } else if (prior.eventPending) {
+      this.db.prepare(`UPDATE ${this.tables.file_index} SET event_pending=0 WHERE root=? AND path=?`).run(this.root, path);
+    }
+  }
+  clean(path, generation, hash2, now) {
+    this.db.prepare(
+      `UPDATE ${this.tables.file_index} SET dirty=0, hash=?, verified_at=? WHERE root=? AND path=? AND generation=?`
+    ).run(hash2, now, this.root, path, generation);
+  }
+  verified(path, now) {
+    this.db.prepare(`UPDATE ${this.tables.file_index} SET verified_at=? WHERE root=? AND path=?`).run(now, this.root, path);
+  }
+  revision(owner) {
+    const row = this.db.prepare(`SELECT revision FROM ${this.tables.received_progress} WHERE root=? AND owner=?`).get(this.root, owner);
+    return row ? Number(row.revision) : void 0;
+  }
+  // The author's acknowledged publication is also its last known mirror baseline.
+  // Persist this without reapplying bytes: local edits may already be newer.
+  acknowledgeOwnFiles(owner, revision, files) {
+    if ((this.revision(owner) ?? -1) >= revision || this.job(owner)) return;
+    transaction(this.db, () => {
+      this.db.prepare(`DELETE FROM ${this.tables.received_files} WHERE root=? AND owner=?`).run(this.root, owner);
+      for (const file of files)
+        this.db.prepare(`INSERT INTO ${this.tables.received_files} VALUES (?,?,?,?,?)`).run(this.root, owner, file.path, file.sha256, file.size);
+      this.db.prepare(
+        `INSERT INTO ${this.tables.received_progress} VALUES (?,?,?) ON CONFLICT(root,owner) DO UPDATE SET revision=excluded.revision`
+      ).run(this.root, owner, revision);
+    });
+  }
+  received(owner, path) {
+    const row = this.db.prepare(
+      `SELECT hash,size FROM ${this.tables.received_files} WHERE root=? AND owner=? AND path=?`
+    ).get(this.root, owner, path);
+    return row ? { sha256: String(row.hash), size: Number(row.size) } : void 0;
+  }
+  job(owner) {
+    const row = this.db.prepare(`SELECT * FROM ${this.tables.receive_jobs} WHERE root=? AND owner=?`).get(this.root, owner);
+    return row ? {
+      revision: Number(row.revision),
+      changes: JSON.parse(String(row.changes_json)),
+      nextIndex: Number(row.next_index)
+    } : void 0;
+  }
+  queue(owner, revision, changes) {
+    this.db.prepare(
+      `INSERT INTO ${this.tables.receive_jobs}(root, owner, revision, changes_json) VALUES (?, ?, ?, ?)`
+    ).run(this.root, owner, revision, JSON.stringify(changes));
+  }
+  applied(owner, change, nextIndex) {
+    transaction(this.db, () => {
+      if (change.kind === "delete")
+        this.db.prepare(`DELETE FROM ${this.tables.received_files} WHERE root=? AND owner=? AND path=?`).run(this.root, owner, change.path);
+      else
+        this.db.prepare(
+          `INSERT INTO ${this.tables.received_files} VALUES (?,?,?,?,?) ON CONFLICT(root,owner,path) DO UPDATE SET hash=excluded.hash,size=excluded.size`
+        ).run(this.root, owner, change.path, change.sha256, change.size);
+      this.db.prepare(`UPDATE ${this.tables.receive_jobs} SET next_index=? WHERE root=? AND owner=?`).run(nextIndex, this.root, owner);
+    });
+  }
+  finish(owner) {
+    transaction(this.db, () => {
+      const job = this.job(owner);
+      if (!job || job.nextIndex !== job.changes.length)
+        throw new Error("Receive batch is not fully applied.");
+      this.db.prepare(
+        `INSERT INTO ${this.tables.received_progress} VALUES (?,?,?) ON CONFLICT(root,owner) DO UPDATE SET revision=excluded.revision`
+      ).run(this.root, owner, job.revision);
+      this.db.prepare(`DELETE FROM ${this.tables.receive_jobs} WHERE root=? AND owner=?`).run(this.root, owner);
+    });
+  }
+  saveStatus(status) {
+    this.db.prepare(
+      `INSERT INTO ${this.tables.sync_status} VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json`
+    ).run(this.root, JSON.stringify(status));
+  }
+  status() {
+    const row = this.db.prepare(`SELECT status_json FROM ${this.tables.sync_status} WHERE root=?`).get(this.root);
+    return row ? JSON.parse(String(row.status_json)) : null;
+  }
+};
+
+// apps/client/files/project-schema.ts
+var projectFilesClientMigration = `
+  CREATE TABLE project_publications (root TEXT PRIMARY KEY REFERENCES connections(root), revision INTEGER NOT NULL DEFAULT 0, initialized INTEGER NOT NULL DEFAULT 0);
+  CREATE TABLE project_owner_files (root TEXT NOT NULL REFERENCES connections(root), path TEXT NOT NULL, hash TEXT NOT NULL, size INTEGER NOT NULL, PRIMARY KEY(root, path));
+  CREATE TABLE project_outbox (root TEXT PRIMARY KEY REFERENCES connections(root), request_json TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, retry_at INTEGER NOT NULL DEFAULT 0, last_error TEXT);
+  ${syncMigration.replace(/\b(file_index|dirty_files|audit_files|received_files|received_progress|receive_jobs|sync_status)\b/g, "project_$1")}
+  ALTER TABLE project_file_index ADD COLUMN seen_local INTEGER NOT NULL DEFAULT 0;
+  CREATE TABLE project_file_settings (root TEXT PRIMARY KEY REFERENCES connections(root), config_json TEXT NOT NULL);
+`;
+
+// apps/client/runtime/state.ts
+var runtimeMigration = `
+ALTER TABLE file_index ADD COLUMN seen_local INTEGER NOT NULL DEFAULT 0;
+UPDATE file_index SET seen_local=1 WHERE signature IS NOT NULL OR hash IS NOT NULL;
+CREATE TABLE client_runtime(root TEXT PRIMARY KEY REFERENCES connections(root), enabled INTEGER NOT NULL DEFAULT 0, status_json TEXT);
+CREATE TABLE client_preparations(root TEXT PRIMARY KEY REFERENCES connections(root), identity TEXT NOT NULL, input_json TEXT NOT NULL, complete INTEGER NOT NULL DEFAULT 0);
+`;
+var RuntimeState = class {
+  constructor(state) {
+    this.state = state;
+  }
+  state;
+  enabled(root) {
+    return Boolean(
+      this.state.db.prepare("SELECT enabled FROM client_runtime WHERE root=?").get(root)?.enabled
+    );
+  }
+  enable(root, enabled) {
+    if (!this.state.binding(root)) throw new Error("Connect this workspace first.");
+    this.state.db.prepare(
+      "INSERT INTO client_runtime(root,enabled) VALUES (?,?) ON CONFLICT(root) DO UPDATE SET enabled=excluded.enabled"
+    ).run(root, Number(enabled));
+  }
+  roots() {
+    return this.state.db.prepare("SELECT root FROM client_runtime WHERE enabled=1").all().map((r) => String(r.root));
+  }
+  status(root) {
+    const row = this.state.db.prepare("SELECT status_json FROM client_runtime WHERE root=?").get(root);
+    return row?.status_json ? JSON.parse(String(row.status_json)) : null;
+  }
+  save(root, status) {
+    this.state.db.prepare(
+      "INSERT INTO client_runtime(root,status_json) VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
+    ).run(root, JSON.stringify(status));
+  }
+};
+
+// apps/client/state.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { join as join4, relative as relative2, isAbsolute, sep as sep2 } from "node:path";
+import { z as z9 } from "zod";
+
 // apps/client/workspace.ts
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -591,7 +896,7 @@ function signature(stat2) {
 }
 function ignored(path) {
   return path.split("/").some(
-    (part) => part === ".git" || part === ".DS_Store" || /^\.teammy(?:-|$)/i.test(part) || /(?:~|\.(?:swp|swx|tmp|part))$/i.test(part)
+    (part) => part === ".git" || part === ".DS_Store" || /^\.teammy(?:[-.]|$)/i.test(part) || /(?:~|\.(?:swp|swx|tmp|part))$/i.test(part)
   );
 }
 async function safePath(root, path, createParents = false) {
@@ -626,7 +931,7 @@ async function metadata(root, path) {
     throw error;
   }
 }
-async function walk(root, prefix = "") {
+async function walk(root, prefix = "", excludes = ignored) {
   const files = /* @__PURE__ */ new Map();
   const issues = [];
   const directory = prefix ? await safePath(root, prefix) : root;
@@ -644,7 +949,7 @@ async function walk(root, prefix = "") {
         throw new Error(`Directory changed while scanning: ${current}`);
       for (const entry of await readdir(full, { withFileTypes: true })) {
         const path = current ? `${current}/${entry.name}` : entry.name;
-        if (ignored(path)) continue;
+        if (excludes(path, entry.isDirectory())) continue;
         try {
           FilePathSchema.parse(path);
           const stat2 = await lstat(await safePath(root, path), { bigint: true });
@@ -846,8 +1151,8 @@ async function prepareWorkspace(state, root, input, reconnect = false) {
     }
     if (prior && !prior.complete && prior.input_json === JSON.stringify(input)) {
       await verifyWorkspace(state, root);
-      const ignore2 = await ignorePlan(root);
-      if (ignore2) await replaceFile(ignore2.parent, ".gitignore", ignore2.bytes, ignore2.signature);
+      const ignore3 = await ignorePlan(root);
+      if (ignore3) await replaceFile(ignore3.parent, ".gitignore", ignore3.bytes, ignore3.signature);
       return;
     }
     throw new Error(
@@ -856,7 +1161,7 @@ async function prepareWorkspace(state, root, input, reconnect = false) {
   }
   if (state.binding(root) || prior)
     throw new Error("Connected workspace is missing. Restore its directory before syncing.");
-  const ignore = await ignorePlan(root);
+  const ignore2 = await ignorePlan(root);
   await mkdir2(root);
   try {
     const identity = await directoryIdentity(root);
@@ -867,7 +1172,7 @@ async function prepareWorkspace(state, root, input, reconnect = false) {
     });
     throw e;
   }
-  if (ignore) await replaceFile(ignore.parent, ".gitignore", ignore.bytes, ignore.signature);
+  if (ignore2) await replaceFile(ignore2.parent, ".gitignore", ignore2.bytes, ignore2.signature);
 }
 function completePreparation(state, root) {
   state.db.prepare("UPDATE client_preparations SET complete=1 WHERE root=?").run(root);
@@ -950,43 +1255,43 @@ var ClientLog = class {
 import { setTimeout as setTimeout2 } from "node:timers/promises";
 
 // packages/protocol/devices.ts
-import { z as z7 } from "zod";
-var CredentialSchema = z7.string().regex(/^tmy_[a-f0-9]{64}$/);
-var EnrollmentSchema = z7.object({
-  operationId: z7.uuid(),
+import { z as z8 } from "zod";
+var CredentialSchema = z8.string().regex(/^tmy_[a-f0-9]{64}$/);
+var EnrollmentSchema = z8.object({
+  operationId: z8.uuid(),
   projectId: NameSchema,
   memberId: NameSchema,
   deviceId: DeviceIdSchema,
   credential: CredentialSchema
 }).strict();
-var EffectivePolicySchema = z7.object({
-  checkIntervalSeconds: z7.number().min(1).max(86400),
-  fileSettleSeconds: z7.number().min(0).max(86400)
+var EffectivePolicySchema = z8.object({
+  checkIntervalSeconds: z8.number().min(1).max(86400),
+  fileSettleSeconds: z8.number().min(0).max(86400)
 }).strict();
-var SyncSummarySchema = z7.object({
-  checkedAt: z7.string(),
-  published: z7.boolean(),
-  appliedFiles: z7.number().int().nonnegative(),
-  pendingFiles: z7.number().int().nonnegative(),
-  sessionSources: z7.number().int().nonnegative(),
-  errors: z7.array(z7.string().max(1e3)).max(20)
+var SyncSummarySchema = z8.object({
+  checkedAt: z8.string(),
+  published: z8.boolean(),
+  appliedFiles: z8.number().int().nonnegative(),
+  pendingFiles: z8.number().int().nonnegative(),
+  sessionSources: z8.number().int().nonnegative(),
+  errors: z8.array(z8.string().max(1e3)).max(20)
 }).strict();
-var DeviceStatusSchema = z7.object({
-  clientVersion: z7.string().max(64),
+var DeviceStatusSchema = z8.object({
+  clientVersion: z8.string().max(64),
   receivedRevision: RevisionSchema.nullable(),
   appliedRevision: RevisionSchema.nullable(),
   effectivePolicy: EffectivePolicySchema,
-  overrides: z7.array(z7.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
-  configError: z7.string().max(2e3).nullable(),
-  reportError: z7.string().max(2e3).nullable(),
+  overrides: z8.array(z8.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
+  configError: z8.string().max(2e3).nullable(),
+  reportError: z8.string().max(2e3).nullable(),
   lastSync: SyncSummarySchema.nullable()
 }).strict();
-var WebDevicesSchema = z7.object({
-  devices: z7.array(
-    z7.object({
+var WebDevicesSchema = z8.object({
+  devices: z8.array(
+    z8.object({
       memberId: NameSchema,
-      bound: z7.boolean(),
-      lastSeenAt: z7.string().nullable(),
+      bound: z8.boolean(),
+      lastSeenAt: z8.string().nullable(),
       status: DeviceStatusSchema.nullable()
     })
   )
@@ -1297,157 +1602,15 @@ var SessionState = class {
   }
 };
 
-// apps/client/files/state.ts
-var syncMigration = String.raw`
-  CREATE TABLE file_index (
-    root TEXT NOT NULL, path TEXT NOT NULL, signature TEXT, dirty INTEGER NOT NULL DEFAULT 1,
-    event_pending INTEGER NOT NULL DEFAULT 0, generation INTEGER NOT NULL DEFAULT 1,
-    observed_at REAL NOT NULL, hash TEXT, verified_at REAL NOT NULL DEFAULT 0,
-    PRIMARY KEY(root, path)
-  );
-  CREATE INDEX dirty_files ON file_index(root, dirty, observed_at);
-  CREATE INDEX audit_files ON file_index(root, dirty, verified_at);
-  CREATE TABLE received_files (root TEXT NOT NULL, owner TEXT NOT NULL, path TEXT NOT NULL, hash TEXT NOT NULL, size INTEGER NOT NULL, PRIMARY KEY(root, owner, path));
-  CREATE TABLE received_progress (root TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL, PRIMARY KEY(root, owner));
-  CREATE TABLE receive_jobs (root TEXT NOT NULL, owner TEXT NOT NULL, revision INTEGER NOT NULL, changes_json TEXT NOT NULL, next_index INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(root, owner));
-  CREATE TABLE sync_status (root TEXT PRIMARY KEY, status_json TEXT NOT NULL);
-`;
-var SyncState = class {
-  constructor(state, root) {
-    this.root = root;
-    this.db = state.db;
-  }
-  root;
-  db;
-  index(onlyDirty = false) {
-    return this.db.prepare(`SELECT * FROM file_index WHERE root=?${onlyDirty ? " AND dirty=1" : ""}`).all(this.root).map((row) => ({
-      path: String(row.path),
-      signature: row.signature === null ? null : String(row.signature),
-      dirty: Boolean(row.dirty),
-      eventPending: Boolean(row.event_pending),
-      generation: Number(row.generation),
-      observedAt: Number(row.observed_at),
-      hash: row.hash === null ? null : String(row.hash),
-      verifiedAt: Number(row.verified_at),
-      seenLocal: Boolean(row.seen_local)
-    }));
-  }
-  audit(before, limit) {
-    return this.db.prepare(
-      "SELECT path FROM file_index WHERE root=? AND dirty=0 AND signature IS NOT NULL AND verified_at<=? ORDER BY verified_at LIMIT ?"
-    ).all(this.root, before, limit).map((row) => this.get(String(row.path)));
-  }
-  get(path) {
-    const row = this.db.prepare("SELECT * FROM file_index WHERE root=? AND path=?").get(this.root, path);
-    return row ? {
-      path,
-      signature: row.signature === null ? null : String(row.signature),
-      dirty: Boolean(row.dirty),
-      eventPending: Boolean(row.event_pending),
-      generation: Number(row.generation),
-      observedAt: Number(row.observed_at),
-      hash: row.hash === null ? null : String(row.hash),
-      verifiedAt: Number(row.verified_at),
-      seenLocal: Boolean(row.seen_local)
-    } : void 0;
-  }
-  restartWaiting(now) {
-    this.db.prepare("UPDATE file_index SET observed_at=? WHERE root=? AND dirty=1").run(now, this.root);
-  }
-  event(path, now) {
-    this.db.prepare(
-      `INSERT INTO file_index(root, path, observed_at, event_pending) VALUES (?, ?, ?, 1)
-      ON CONFLICT(root,path) DO UPDATE SET dirty=1, event_pending=1, generation=generation+1, observed_at=excluded.observed_at`
-    ).run(this.root, path, now);
-    this.db.prepare(
-      "UPDATE file_index SET dirty=1, event_pending=1, generation=generation+1, observed_at=? WHERE root=? AND substr(path,1,length(?))=?"
-    ).run(now, this.root, `${path}/`, `${path}/`);
-  }
-  observe(path, signature2, now) {
-    const prior = this.get(path);
-    if (!prior) {
-      if (signature2 !== null)
-        this.db.prepare(
-          "INSERT INTO file_index(root,path,signature,observed_at,seen_local) VALUES (?,?,?,?,1)"
-        ).run(this.root, path, signature2, now);
-    } else if (signature2 !== prior.signature) {
-      this.db.prepare(
-        "UPDATE file_index SET seen_local=MAX(seen_local, ? IS NOT NULL), signature=?, dirty=1, generation=generation+1, observed_at=?, event_pending=0 WHERE root=? AND path=?"
-      ).run(signature2, signature2, prior.eventPending ? prior.observedAt : now, this.root, path);
-    } else if (prior.eventPending) {
-      this.db.prepare("UPDATE file_index SET event_pending=0 WHERE root=? AND path=?").run(this.root, path);
-    }
-  }
-  clean(path, generation, hash2, now) {
-    this.db.prepare(
-      "UPDATE file_index SET dirty=0, hash=?, verified_at=? WHERE root=? AND path=? AND generation=?"
-    ).run(hash2, now, this.root, path, generation);
-  }
-  verified(path, now) {
-    this.db.prepare("UPDATE file_index SET verified_at=? WHERE root=? AND path=?").run(now, this.root, path);
-  }
-  revision(owner) {
-    const row = this.db.prepare("SELECT revision FROM received_progress WHERE root=? AND owner=?").get(this.root, owner);
-    return row ? Number(row.revision) : void 0;
-  }
-  received(owner, path) {
-    const row = this.db.prepare("SELECT hash,size FROM received_files WHERE root=? AND owner=? AND path=?").get(this.root, owner, path);
-    return row ? { sha256: String(row.hash), size: Number(row.size) } : void 0;
-  }
-  job(owner) {
-    const row = this.db.prepare("SELECT * FROM receive_jobs WHERE root=? AND owner=?").get(this.root, owner);
-    return row ? {
-      revision: Number(row.revision),
-      changes: JSON.parse(String(row.changes_json)),
-      nextIndex: Number(row.next_index)
-    } : void 0;
-  }
-  queue(owner, revision, changes) {
-    this.db.prepare("INSERT INTO receive_jobs(root, owner, revision, changes_json) VALUES (?, ?, ?, ?)").run(this.root, owner, revision, JSON.stringify(changes));
-  }
-  applied(owner, change, nextIndex) {
-    transaction(this.db, () => {
-      if (change.kind === "delete")
-        this.db.prepare("DELETE FROM received_files WHERE root=? AND owner=? AND path=?").run(this.root, owner, change.path);
-      else
-        this.db.prepare(
-          "INSERT INTO received_files VALUES (?,?,?,?,?) ON CONFLICT(root,owner,path) DO UPDATE SET hash=excluded.hash,size=excluded.size"
-        ).run(this.root, owner, change.path, change.sha256, change.size);
-      this.db.prepare("UPDATE receive_jobs SET next_index=? WHERE root=? AND owner=?").run(nextIndex, this.root, owner);
-    });
-  }
-  finish(owner) {
-    transaction(this.db, () => {
-      const job = this.job(owner);
-      if (!job || job.nextIndex !== job.changes.length)
-        throw new Error("Receive batch is not fully applied.");
-      this.db.prepare(
-        "INSERT INTO received_progress VALUES (?,?,?) ON CONFLICT(root,owner) DO UPDATE SET revision=excluded.revision"
-      ).run(this.root, owner, job.revision);
-      this.db.prepare("DELETE FROM receive_jobs WHERE root=? AND owner=?").run(this.root, owner);
-    });
-  }
-  saveStatus(status) {
-    this.db.prepare(
-      "INSERT INTO sync_status VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
-    ).run(this.root, JSON.stringify(status));
-  }
-  status() {
-    const row = this.db.prepare("SELECT status_json FROM sync_status WHERE root=?").get(this.root);
-    return row ? JSON.parse(String(row.status_json)) : null;
-  }
-};
-
 // apps/client/state.ts
 var LocalBindingSchema = BindingSchema.extend({
-  root: z8.string(),
-  serverUrl: z8.string(),
-  token: z8.string()
+  root: z9.string(),
+  serverUrl: z9.string(),
+  token: z9.string()
 });
-var ClientState = class {
-  db;
+var ClientState = class extends FilePublicationState {
   constructor(directory) {
-    this.db = openDatabase(join4(directory, "client.sqlite3"), [
+    const db = openDatabase(join4(directory, "client.sqlite3"), [
       String.raw`
       CREATE TABLE connections (root TEXT PRIMARY KEY, device_id TEXT NOT NULL, binding_json TEXT);
     `,
@@ -1460,8 +1623,10 @@ var ClientState = class {
       sessionClientMigration,
       projectClientMigration,
       controlClientMigration,
-      runtimeMigration
+      runtimeMigration,
+      projectFilesClientMigration
     ]);
+    super(db);
   }
   close() {
     this.db.close();
@@ -1503,73 +1668,6 @@ var ClientState = class {
     this.db.prepare("UPDATE connections SET binding_json=? WHERE root=?").run(JSON.stringify(local), root);
     return local;
   }
-  publication(root) {
-    this.db.prepare("INSERT OR IGNORE INTO publications(root) VALUES (?)").run(root);
-    const row = this.db.prepare("SELECT revision, initialized FROM publications WHERE root=?").get(root);
-    return { revision: Number(row.revision), initialized: Boolean(row.initialized) };
-  }
-  initializePublication(root, revision, files) {
-    transaction(this.db, () => {
-      if (this.pending(root))
-        throw new Error("Cannot replace a baseline with a publication pending.");
-      this.db.prepare(
-        "INSERT INTO publications VALUES (?, ?, 1) ON CONFLICT(root) DO UPDATE SET revision=excluded.revision, initialized=1"
-      ).run(root, revision);
-      this.db.prepare("DELETE FROM owner_files WHERE root=?").run(root);
-      for (const file of files)
-        this.db.prepare("INSERT INTO owner_files VALUES (?, ?, ?, ?)").run(root, file.path, file.sha256, file.size);
-    });
-  }
-  ownerFiles(root) {
-    return new Map(
-      this.db.prepare("SELECT path, hash, size FROM owner_files WHERE root=?").all(root).map((row) => [String(row.path), { sha256: String(row.hash), size: Number(row.size) }])
-    );
-  }
-  pending(root) {
-    const row = this.db.prepare("SELECT request_json, attempts, retry_at, last_error FROM outbox WHERE root=?").get(root);
-    return row ? {
-      batch: FileCommitSchema.parse(JSON.parse(String(row.request_json))),
-      attempts: Number(row.attempts),
-      retryAt: Number(row.retry_at),
-      lastError: row.last_error === null ? null : String(row.last_error)
-    } : void 0;
-  }
-  enqueue(root, batch) {
-    const fixed = FileCommitSchema.parse(batch);
-    transaction(this.db, () => {
-      const publication = this.publication(root);
-      if (!publication.initialized || publication.revision !== fixed.parentRevision)
-        throw new Error("Publication baseline is not ready.");
-      if (this.pending(root)) throw new Error("A publication is already pending.");
-      this.db.prepare("INSERT INTO outbox(root, request_json) VALUES (?, ?)").run(root, JSON.stringify(fixed));
-    });
-  }
-  acknowledge(root, result2) {
-    transaction(this.db, () => {
-      const pending = this.pending(root);
-      if (!pending || pending.batch.operationId !== result2.operationId || result2.revision < pending.batch.parentRevision || result2.revision > pending.batch.parentRevision + 1)
-        throw new Error("Unexpected publication acknowledgement.");
-      for (const change of pending.batch.changes) {
-        if (change.kind === "delete")
-          this.db.prepare("DELETE FROM owner_files WHERE root=? AND path=?").run(root, change.path);
-        else
-          this.db.prepare(
-            "INSERT INTO owner_files VALUES (?, ?, ?, ?) ON CONFLICT(root, path) DO UPDATE SET hash=excluded.hash, size=excluded.size"
-          ).run(root, change.path, change.sha256, change.size);
-      }
-      this.db.prepare("UPDATE publications SET revision=? WHERE root=?").run(result2.revision, root);
-      this.db.prepare("DELETE FROM outbox WHERE root=?").run(root);
-    });
-  }
-  postpone(root, operationId, reason, now, blocked) {
-    const pending = this.pending(root);
-    if (!pending || pending.batch.operationId !== operationId) return;
-    const retryAt = blocked ? Number.MAX_SAFE_INTEGER : now + Math.min(9e5, 6e4 * 2 ** Math.min(pending.attempts, 4));
-    this.db.prepare("UPDATE outbox SET attempts=attempts+1, retry_at=?, last_error=? WHERE root=?").run(retryAt, reason, root);
-  }
-  retryPublication(root) {
-    this.db.prepare("UPDATE outbox SET retry_at=0, last_error=NULL WHERE root=?").run(root);
-  }
 };
 
 // apps/client/state-location.ts
@@ -1593,7 +1691,7 @@ async function stateLocation(root, directory) {
 import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypto";
 import { mkdir as mkdir4, open as open2, opendir, rename as rename2, unlink as unlink2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3, join as join5 } from "node:path";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // apps/client/sessions/normalize.ts
 function object(value) {
@@ -1711,10 +1809,10 @@ function normalizeJsonl(agent, text) {
 }
 
 // apps/client/sessions/hooks.ts
-var HintSchema = z9.object({
+var HintSchema = z10.object({
   agent: AgentSchema,
-  path: z9.string().min(1).max(4096).refine(isAbsolute3),
-  projectDir: z9.string().min(1).max(4096).refine(isAbsolute3)
+  path: z10.string().min(1).max(4096).refine(isAbsolute3),
+  projectDir: z10.string().min(1).max(4096).refine(isAbsolute3)
 });
 function inbox(directory, root) {
   return join5(directory, "session-hints", createHash5("sha256").update(root).digest("hex"));
@@ -1927,7 +2025,7 @@ import { setTimeout as setTimeout4 } from "node:timers/promises";
 
 // apps/client/client-command.ts
 import { parseArgs as parseArgs2 } from "node:util";
-import { join as join10, resolve as resolve5 } from "node:path";
+import { join as join11, resolve as resolve5 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
@@ -1956,6 +2054,64 @@ function acquireRootLock(root, stateDirectory) {
   }
 }
 
+// apps/client/local-config.ts
+import { constants as constants2 } from "node:fs";
+import { open as open3, writeFile } from "node:fs/promises";
+import { join as join8 } from "node:path";
+import { z as z11 } from "zod";
+import ignore from "ignore";
+var LOCAL_CONFIG_NAME = ".teammy-local.json";
+var LocalConfigSchema = z11.object({
+  files: z11.object({ ignore: z11.array(z11.string().max(1024)).max(256).default([]) }).strict().default({ ignore: [] })
+}).strict();
+async function ensureLocalConfig(root) {
+  try {
+    await writeFile(
+      join8(root, LOCAL_CONFIG_NAME),
+      JSON.stringify({ files: { ignore: [] } }, null, 2) + "\n",
+      { flag: "wx", mode: 384 }
+    );
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+  }
+}
+async function loadLocalRules(root) {
+  let rules = [];
+  try {
+    const file = await open3(
+      join8(root, LOCAL_CONFIG_NAME),
+      constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK
+    );
+    try {
+      const before = await file.stat();
+      if (!before.isFile() || before.size > 65536)
+        throw new Error("Expected a regular configuration file no larger than 64 KiB.");
+      const buffer = Buffer.alloc(65537);
+      const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+      if (bytesRead > 65536 || bytesRead !== before.size)
+        throw new Error("Configuration exceeds the read limit or changed while reading.");
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead));
+      const after = await file.stat();
+      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs)
+        throw new Error("Configuration is being saved; retry on the next check.");
+      rules = LocalConfigSchema.parse(JSON.parse(text)).files.ignore;
+    } finally {
+      await file.close();
+    }
+  } catch (error) {
+    if (!missing(error))
+      throw new Error(
+        `${LOCAL_CONFIG_NAME}: invalid or unreadable configuration; uploads paused.`,
+        { cause: error }
+      );
+  }
+  const matcher = ignore().add(rules);
+  return {
+    fingerprint: JSON.stringify(rules),
+    excludes: (path, directory = false) => ignored(path) || matcher.ignores(path + (directory && !path.endsWith("/") ? "/" : ""))
+  };
+}
+
 // apps/client/connection.ts
 async function connectProject(state, root, directory, options) {
   const lock = acquireRootLock(root, directory);
@@ -2030,6 +2186,7 @@ async function connectProject(state, root, directory, options) {
     const own = await metadata(root, binding.memberId);
     if (own && !own.directory) throw new Error("Member path is not a directory.");
     if (!own) await mkdir5(await safePath(root, binding.memberId));
+    await ensureLocalConfig(root);
     const { token: _, ...visible } = binding;
     return { ...visible, configRevision: project.cached()?.config.configRevision ?? null };
   } finally {
@@ -2040,21 +2197,21 @@ async function connectProject(state, root, directory, options) {
 // apps/client/runtime/ipc.ts
 import { createConnection } from "node:net";
 import { mkdir as mkdir6, lstat as lstat3, chmod } from "node:fs/promises";
-import { join as join8 } from "node:path";
-import { z as z10 } from "zod";
-var RequestSchema = z10.object({
-  method: z10.enum(["ping", "wake", "status", "once"]),
-  root: z10.string().max(4096).optional()
+import { join as join9 } from "node:path";
+import { z as z12 } from "zod";
+var RequestSchema = z12.object({
+  method: z12.enum(["ping", "wake", "status", "once"]),
+  root: z12.string().max(4096).optional()
 }).strict();
 function socketPath(directory) {
-  return join8(
+  return join9(
     "/tmp",
     `teammy-${process.getuid?.() ?? "user"}-${rootKey(directory)}`,
     "control.sock"
   );
 }
 async function prepareSocketDirectory(directory) {
-  const path = join8(socketPath(directory), "..");
+  const path = join9(socketPath(directory), "..");
   await mkdir6(path, { recursive: true, mode: 448 });
   const stat2 = await lstat3(path);
   if (!stat2.isDirectory() || stat2.isSymbolicLink() || stat2.uid !== process.getuid?.())
@@ -2117,8 +2274,8 @@ async function runningDaemon(directory) {
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname5, join as join9, resolve as resolve4 } from "node:path";
-import { mkdir as mkdir7, readFile as readFile2, writeFile, rename as rename3 } from "node:fs/promises";
+import { dirname as dirname5, join as join10, resolve as resolve4 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile2, writeFile as writeFile2, rename as rename3 } from "node:fs/promises";
 import { setTimeout as setTimeout3 } from "node:timers/promises";
 var execute = promisify2(execFile2);
 var exec2 = (file, args, options = {}) => execute(file, args, { timeout: 45e3, ...options });
@@ -2135,7 +2292,7 @@ function serviceDefinition(directory, executable, entry, platform = process.plat
   if (platform === "darwin")
     return {
       id,
-      path: join9(userHome, "Library", "LaunchAgents", id + ".plist"),
+      path: join10(userHome, "Library", "LaunchAgents", id + ".plist"),
       content: `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict><key>Label</key><string>${id}</string><key>ProgramArguments</key><array>${args.map((a) => `<string>${xml(a)}</string>`).join("")}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>30</integer><key>WorkingDirectory</key><string>${xml(userHome)}</string></dict></plist>
@@ -2144,7 +2301,7 @@ function serviceDefinition(directory, executable, entry, platform = process.plat
   if (platform === "linux")
     return {
       id: id + ".service",
-      path: join9(userHome, ".config", "systemd", "user", id + ".service"),
+      path: join10(userHome, ".config", "systemd", "user", id + ".service"),
       content: `[Unit]
 Description=Teammy background synchronization
 [Service]
@@ -2203,7 +2360,7 @@ async function ensureDaemon(directory, version) {
   await mkdir7(dirname5(definition.path), { recursive: true });
   if (old !== definition.content) {
     const temp = definition.path + `.${process.pid}.tmp`;
-    await writeFile(temp, definition.content, { mode: 384 });
+    await writeFile2(temp, definition.content, { mode: 384 });
     await rename3(temp, definition.path);
   }
   if (process.platform === "darwin") {
@@ -2263,7 +2420,7 @@ function json(value) {
 // apps/client/client-command.ts
 var locationOptions = {
   root: { type: "string", default: resolve5("workspaces") },
-  "state-dir": { type: "string", default: join10(homedir3(), ".teammy", "client") },
+  "state-dir": { type: "string", default: join11(homedir3(), ".teammy", "client") },
   json: { type: "boolean" },
   help: { type: "boolean", short: "h" }
 };
@@ -2385,13 +2542,13 @@ async function runClientCommand(command, args, version) {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { watch } from "node:fs";
 import { lstat as lstat4, mkdir as mkdir9 } from "node:fs/promises";
-import { join as join12, sep as sep4 } from "node:path";
+import { join as join13, sep as sep4 } from "node:path";
 import { performance } from "node:perf_hooks";
 
 // packages/storage/local-blob-store.ts
 import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
-import { link, mkdir as mkdir8, open as open3, readFile as readFile3, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname6, join as join11, resolve as resolve6 } from "node:path";
+import { link, mkdir as mkdir8, open as open4, readFile as readFile3, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname6, join as join12, resolve as resolve6 } from "node:path";
 function hash(content) {
   return createHash8("sha256").update(content).digest("hex");
 }
@@ -2417,7 +2574,7 @@ var LocalBlobStore = class {
     const target = this.pathFor(sha256);
     await mkdir8(dirname6(target), { recursive: true, mode: 448 });
     const temporary = `${target}.${randomUUID5()}.tmp`;
-    const file = await open3(temporary, "wx", 384);
+    const file = await open4(temporary, "wx", 384);
     try {
       try {
         await file.writeFile(bytes);
@@ -2434,7 +2591,7 @@ var LocalBlobStore = class {
       if (process.platform !== "win32") {
         let directory = dirname6(target);
         for (; ; ) {
-          const handle = await open3(directory, "r");
+          const handle = await open4(directory, "r");
           try {
             await handle.sync();
           } finally {
@@ -2463,7 +2620,7 @@ var LocalBlobStore = class {
   }
   pathFor(sha256) {
     if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Invalid SHA-256 content identifier.");
-    return join11(this.root, "sha256", sha256.slice(0, 2), sha256);
+    return join12(this.root, "sha256", sha256.slice(0, 2), sha256);
   }
 };
 
@@ -2514,7 +2671,7 @@ var PublicationQueue = class {
 };
 
 // apps/client/files/synchronizer.ts
-var FileSynchronizer = class {
+var FileSynchronizer = class _FileSynchronizer {
   constructor(state, root, stateDirectory, options = {}) {
     this.state = state;
     this.root = root;
@@ -2523,10 +2680,18 @@ var FileSynchronizer = class {
     if (!binding) throw new Error("Connect this root before synchronizing.");
     this.binding = binding;
     this.client = new HubClient(binding.serverUrl, 3e4, binding, this.abort.signal);
-    this.blobs = new LocalBlobStore(join12(stateDirectory, "blobs"));
-    this.queue = new PublicationQueue(state, this.blobs, this.client);
-    this.index = new SyncState(state, root);
-    this.ownRoot = join12(root, binding.memberId);
+    this.blobs = new LocalBlobStore(join13(stateDirectory, "blobs"));
+    this.projectScope = options.scope === "project";
+    this.owner = this.projectScope ? PROJECT_FILE_OWNER : binding.memberId;
+    this.publication = new FilePublicationState(state.db, options.scope);
+    this.queue = new PublicationQueue(this.publication, this.blobs, {
+      missingBlobs: (hashes) => this.client.missingBlobs(hashes),
+      uploadBlob: (hash2, bytes) => this.client.uploadBlob(hash2, bytes),
+      commitFiles: (batch) => this.projectScope ? this.client.commitSharedFiles(batch, this.sharedConfig.revision) : this.client.commitFiles(batch)
+    });
+    this.index = new SyncState(state, root, options.scope);
+    this.ownRoot = this.projectScope ? root : join13(root, binding.memberId);
+    this.common = this.projectScope ? void 0 : new _FileSynchronizer(state, root, stateDirectory, { ...options, scope: "project" });
     const started = performance.now();
     const epoch = Date.now();
     this.clock = options.clock ?? (() => epoch + performance.now() - started);
@@ -2537,6 +2702,13 @@ var FileSynchronizer = class {
   root;
   options;
   index;
+  publication;
+  common;
+  projectScope;
+  owner;
+  sharedConfig;
+  rulesFingerprint;
+  excludes = ignored;
   binding;
   client;
   blobs;
@@ -2561,9 +2733,11 @@ var FileSynchronizer = class {
     if (!Number.isSafeInteger(value) || value < 0 || value > 864e5)
       throw new Error("Invalid stable wait interval.");
     this.settleMs = value;
+    this.common?.setSettleMs(value);
   }
   close() {
     this.stopped = true;
+    this.common?.close();
     this.abort.abort();
     this.watcher?.close();
     this.watcher = void 0;
@@ -2581,8 +2755,56 @@ var FileSynchronizer = class {
     };
     try {
       try {
+        if (this.projectScope) {
+          try {
+            this.sharedConfig = await this.client.sharedFilesConfig();
+          } catch (error) {
+            if (error instanceof HubRequestError && error.status === 404) return report;
+            throw error;
+          }
+          const fingerprint = JSON.stringify(this.sharedConfig);
+          const cached = this.state.db.prepare("SELECT config_json FROM project_file_settings WHERE root=?").get(this.root);
+          const previous = cached ? JSON.parse(String(cached.config_json)) : void 0;
+          const wasMaintainer = previous?.maintainer === this.binding.memberId;
+          const isMaintainer = this.sharedConfig.maintainer === this.binding.memberId;
+          const publication = this.publication.publication(this.root);
+          if (wasMaintainer && publication.initialized && publication.revision > (this.index.revision(PROJECT_FILE_OWNER) ?? -1))
+            this.index.acknowledgeOwnFiles(
+              PROJECT_FILE_OWNER,
+              publication.revision,
+              [...this.publication.ownerFiles(this.root)].map(([path, file]) => ({
+                path,
+                ...file,
+                revision: publication.revision
+              }))
+            );
+          if (!isMaintainer) this.publication.discard(this.root);
+          if (!wasMaintainer || !isMaintainer || previous?.revision !== this.sharedConfig.revision) {
+            report.appliedFiles += await this.receive(PROJECT_FILE_OWNER);
+            if (this.index.job(PROJECT_FILE_OWNER)) return report;
+          }
+          if (cached?.config_json !== fingerprint) {
+            if (isMaintainer) await this.resetPublication();
+            this.state.db.prepare(
+              "INSERT INTO project_file_settings VALUES (?,?) ON CONFLICT(root) DO UPDATE SET config_json=excluded.config_json"
+            ).run(this.root, fingerprint);
+            this.lastScan = -Infinity;
+          }
+          if (!isMaintainer) return report;
+          this.excludes = (path) => ignored(path) || !sharedPathAllowed(path, this.sharedConfig.paths);
+        } else {
+          const rules = await loadLocalRules(this.root);
+          this.excludes = rules.excludes;
+          if (this.rulesFingerprint !== rules.fingerprint) {
+            this.rulesFingerprint = rules.fingerprint;
+            this.lastScan = -Infinity;
+          }
+        }
+        const pending = this.publication.pending(this.root);
+        if (pending?.batch.changes.some((change) => this.excludes(change.path)))
+          await this.resetPublication();
         await this.initializeAuthor();
-        const ownStat = await lstat4(await safePath(this.root, this.binding.memberId));
+        const ownStat = await lstat4(this.ownRoot);
         if (!ownStat.isDirectory() || ownStat.isSymbolicLink())
           throw new Error("Author directory is unavailable or is a symlink.");
         this.listen();
@@ -2593,14 +2815,14 @@ var FileSynchronizer = class {
         const blocked = await this.refreshDirty(report.issues);
         await this.audit(report.issues);
         report.published = await this.queue.flush(this.root, this.clock());
-        if (!this.state.pending(this.root) && !this.stopped) {
+        if (!this.publication.pending(this.root) && !this.stopped) {
           await this.stage(blocked, report.issues, settleMs);
           report.published = await this.queue.flush(this.root, this.clock()) || report.published;
         }
       } catch (error) {
         report.issues.push(`publish: ${message(error)}`);
       }
-      if (!this.stopped) {
+      if (!this.stopped && !this.projectScope) {
         try {
           for (const member of (await this.client.members()).members) {
             if (member === this.binding.memberId || this.stopped) continue;
@@ -2614,8 +2836,16 @@ var FileSynchronizer = class {
           report.issues.push(`receive: ${message(error)}`);
         }
       }
-      report.waitingFiles = this.index.index(true).length;
-      report.pendingPublication = Boolean(this.state.pending(this.root));
+      if (this.common && !this.stopped) {
+        const common = await this.common.cycle();
+        report.published ||= common.published;
+        report.appliedFiles += common.appliedFiles;
+        report.waitingFiles += common.waitingFiles;
+        report.pendingPublication ||= common.pendingPublication;
+        report.issues.push(...common.issues.map((issue) => `project files: ${issue}`));
+      }
+      report.waitingFiles += this.index.index(true).filter((row) => !this.excludes(row.path)).length;
+      report.pendingPublication ||= Boolean(this.publication.pending(this.root));
       this.index.saveStatus({ ...report, checkedAt: (/* @__PURE__ */ new Date()).toISOString() });
       return report;
     } finally {
@@ -2638,9 +2868,17 @@ var FileSynchronizer = class {
       after = page.nextCursor;
     }
   }
+  async resetPublication() {
+    const manifest = await this.manifest(this.owner);
+    for (const row of this.index.index()) this.index.event(row.path, this.clock());
+    this.publication.initializePublication(this.root, manifest.revision, manifest.files, {
+      discardPending: true
+    });
+    this.lastScan = -Infinity;
+  }
   async initializeAuthor() {
-    if (this.state.publication(this.root).initialized) return;
-    const manifest = await this.manifest(this.binding.memberId);
+    if (this.publication.publication(this.root).initialized) return;
+    const manifest = await this.manifest(this.owner);
     if (manifest.revision > 0 && this.options.adoptBaseline) {
       for (const file of manifest.files) {
         const local = await readStable(this.ownRoot, file.path);
@@ -2650,11 +2888,11 @@ var FileSynchronizer = class {
           );
       }
     }
-    const ownerPath = await safePath(this.root, this.binding.memberId);
+    const ownerPath = this.projectScope ? this.root : await safePath(this.root, this.owner);
     await mkdir9(ownerPath).catch((error) => {
       if (error.code !== "EEXIST") throw error;
     });
-    this.state.initializePublication(this.root, manifest.revision, manifest.files);
+    this.publication.initializePublication(this.root, manifest.revision, manifest.files);
   }
   listen() {
     if (this.options.watch === false || this.watcher || this.stopped) return;
@@ -2665,7 +2903,7 @@ var FileSynchronizer = class {
           return;
         }
         const path = filename.toString().split(sep4).join("/");
-        if (!ignored(path)) this.index.event(path, this.clock());
+        if (!this.excludes(path)) this.index.event(path, this.clock());
       });
       this.watcher.on("error", (error) => {
         this.watchIssues.push(`File watcher: ${message(error)}; metadata scans remain enabled.`);
@@ -2678,12 +2916,12 @@ var FileSynchronizer = class {
     }
   }
   async reconcile(prefix, issues) {
-    const scan = await walk(this.ownRoot, prefix);
+    const scan = await walk(this.ownRoot, prefix, this.excludes);
     const now = this.clock();
     for (const [path, signature2] of scan.files) this.index.observe(path, signature2, now);
     if (scan.complete) {
       for (const prior of this.index.index()) {
-        if ((!prefix || prior.path.startsWith(`${prefix}/`)) && !ignored(prior.path) && !scan.files.has(prior.path))
+        if ((!prefix || prior.path.startsWith(`${prefix}/`)) && !this.excludes(prior.path) && !scan.files.has(prior.path))
           this.index.observe(prior.path, null, now);
       }
     }
@@ -2692,6 +2930,7 @@ var FileSynchronizer = class {
   async refreshDirty(issues) {
     const blocked = /* @__PURE__ */ new Set();
     for (const prior of this.index.index(true)) {
+      if (this.excludes(prior.path)) continue;
       if (this.stopped) break;
       try {
         const current = await metadata(this.ownRoot, prior.path);
@@ -2712,6 +2951,7 @@ var FileSynchronizer = class {
       this.clock() - (this.options.auditAgeMs ?? 864e5),
       this.options.auditBudget ?? 20
     )) {
+      if (this.excludes(prior.path)) continue;
       if (this.stopped || bytes > 20 * 1024 * 1024) break;
       try {
         const local = await readStable(this.ownRoot, prior.path);
@@ -2727,10 +2967,10 @@ var FileSynchronizer = class {
   }
   async stage(blocked, issues, settleMs) {
     const ready = this.index.index(true).filter(
-      (row) => !blocked.has(row.path) && !row.eventPending && this.clock() - row.observedAt >= settleMs
+      (row) => !this.excludes(row.path) && !blocked.has(row.path) && !row.eventPending && this.clock() - row.observedAt >= settleMs
     );
     if (!ready.length) return;
-    const baseline = this.state.ownerFiles(this.root);
+    const baseline = this.publication.ownerFiles(this.root);
     const planned = new Map(baseline);
     const changes = [];
     const snapshots = [];
@@ -2788,9 +3028,9 @@ var FileSynchronizer = class {
     const rootStat = await lstat4(this.ownRoot);
     if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
       throw new Error("Author directory disappeared before publication.");
-    this.state.enqueue(this.root, {
+    this.publication.enqueue(this.root, {
       operationId: randomUUID6(),
-      parentRevision: this.state.publication(this.root).revision,
+      parentRevision: this.publication.publication(this.root).revision,
       changes
     });
     for (const snapshot of snapshots)
@@ -2834,7 +3074,7 @@ var FileSynchronizer = class {
       }
     }
     const job = this.index.job(owner);
-    const ownerRoot = await safePath(this.root, owner);
+    const ownerRoot = this.projectScope ? this.root : await safePath(this.root, owner);
     await mkdir9(ownerRoot).catch((error) => {
       if (error.code !== "EEXIST") throw error;
     });
@@ -2891,7 +3131,7 @@ function message(error) {
 
 // apps/client/sessions/synchronizer.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 
 // packages/protocol/session-key.ts
 import { createHash as createHash9 } from "node:crypto";
@@ -2900,7 +3140,7 @@ function sessionKey(agent, nativeId) {
 }
 
 // apps/client/sessions/source.ts
-import { open as open4, stat, realpath as realpath5 } from "node:fs/promises";
+import { open as open5, stat, realpath as realpath5 } from "node:fs/promises";
 import { relative as relative4, isAbsolute as isAbsolute4, sep as sep5 } from "node:path";
 import * as zlib from "node:zlib";
 
@@ -3058,7 +3298,7 @@ async function readSource(agent, path, projectDir) {
   let result2;
   if (agent === "cursor") result2 = { snapshot: readCursor(path, projectDir), incomplete: false };
   else {
-    const handle = await open4(path, "r");
+    const handle = await open5(path, "r");
     let bytes;
     try {
       const size = (await handle.stat()).size;
@@ -3097,14 +3337,14 @@ async function readSource(agent, path, projectDir) {
 
 // apps/client/sessions/discovery.ts
 import { opendir as opendir2 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 async function* candidates(directory, agent) {
   const queue = [directory];
   while (queue.length) {
     const current = queue.shift();
     const dir = await opendir2(current);
     for await (const entry of dir) {
-      const path = join13(current, entry.name);
+      const path = join14(current, entry.name);
       if (entry.isDirectory()) queue.push(path);
       if (entry.isFile() && (agent === "cursor" ? entry.name === "store.db" : entry.name.endsWith(".jsonl") || agent === "dsh" && entry.name.endsWith(".jsonl.zstd")))
         yield path;
@@ -3192,7 +3432,7 @@ var SessionSynchronizer = class {
     const binding = state.binding(root);
     if (!binding) throw new Error("Connect this root before collecting sessions.");
     this.client = new HubClient(binding.serverUrl, 1e4, binding, signal);
-    this.blobs = new LocalBlobStore(join14(directory, "blobs"));
+    this.blobs = new LocalBlobStore(join15(directory, "blobs"));
     this.index = new SessionState(state, root);
     this.discovery = new SessionDiscovery(this.index);
   }
@@ -3348,6 +3588,7 @@ var SyncJob = class {
       this.sessions = new SessionSynchronizer(state, root, directory, this.abort.signal);
       if (options.retry) {
         state.retryPublication(root);
+        new FilePublicationState(state.db, "project").retryPublication(root);
         this.sessions.index.retry();
       }
       const overrides = {};
@@ -3449,12 +3690,15 @@ var SyncJob = class {
         (e) => Boolean(e)
       ) : []
     ].map(redact);
-    const pendingDownloads = Number(
-      this.state.db.prepare(
-        "SELECT COALESCE(SUM(json_array_length(changes_json)-next_index),0) n FROM receive_jobs WHERE root=?"
-      ).get(this.root).n
+    const pendingDownloads = ["receive_jobs", "project_receive_jobs"].reduce(
+      (total, table) => total + Number(
+        this.state.db.prepare(
+          `SELECT COALESCE(SUM(json_array_length(changes_json)-next_index),0) n FROM ${table} WHERE root=?`
+        ).get(this.root).n
+      ),
+      0
     );
-    const pendingFiles = report.waitingFiles + (this.state.pending(this.root)?.batch.changes.length ?? 0);
+    const pendingFiles = report.waitingFiles + (this.state.pending(this.root)?.batch.changes.length ?? 0) + (new FilePublicationState(this.state.db, "project").pending(this.root)?.batch.changes.length ?? 0);
     const now = Date.now(), checkedAt = new Date(now).toISOString();
     this.control.updateSync({
       checkedAt,