granite-mem 0.1.9 → 0.1.11

package/dist/index.js

@@ -2715,9 +2715,9 @@ function statusCommand(options = {}) {
 }
 
 // src/commands/mcp.ts
-import fs18 from "fs";
-import path14 from "path";
-import { spawn as spawn2 } from "child_process";
+import fs19 from "fs";
+import path15 from "path";
+import { spawn } from "child_process";
 
 // src/mcp/server.ts
 import { serve as serve2 } from "@hono/node-server";
@@ -3165,7 +3165,21 @@ var STANDARD_FRONTMATTER_KEYS = /* @__PURE__ */ new Set([
 ]);
 
 // src/version.ts
-var GRANITE_VERSION = "0.1.2";
+import fs13 from "fs";
+import path9 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var GRANITE_VERSION = readPackageVersion();
+function readPackageVersion() {
+  const packageJsonPath = path9.resolve(path9.dirname(fileURLToPath2(import.meta.url)), "../package.json");
+  try {
+    const packageJson = JSON.parse(fs13.readFileSync(packageJsonPath, "utf-8"));
+    if (typeof packageJson.version === "string" && packageJson.version.length > 0) {
+      return packageJson.version;
+    }
+  } catch {
+  }
+  return "0.0.0";
+}
 
 // src/mcp/server.ts
 var readOnlyAnnotations = {
@@ -3186,14 +3200,15 @@ var gardenAdjudicationReasonCodeSchema = z.enum([
   "blocked",
   "low-value"
 ]);
-function buildServerInstructions(runtime) {
+function buildServerInstructions(runtime, role) {
   const types = runtime.listNoteTypes();
   const signature = runtime.getTypeRegistrySignature();
   const defaultType = runtime.getDefaultNoteType();
+  const canWrite = role === "write";
   const lines = [
     "# Granite \u2014 Knowledge Compilation System",
     "",
-    "You are operating a local-first markdown knowledge base. You are the primary writer and gardener of this vault \u2014 the human rarely edits notes directly.",
+    canWrite ? "You are operating a local-first markdown knowledge base. You are the primary writer and gardener of this vault \u2014 the human rarely edits notes directly." : "You are operating a local-first markdown knowledge base in read-only mode. Inspect and compile context from the vault, but do not attempt to mutate it.",
     "",
     "## Public Interface",
     "",
@@ -3205,16 +3220,18 @@ function buildServerInstructions(runtime) {
     "- **granite_query** \u2014 run structured queries over typed notes and indexed fields",
     "- **granite_compile_context** \u2014 compile a typed brief for a topic or slug using the graph",
     "- **granite_plan_garden** \u2014 compute the highest-leverage notes or clusters to revisit next",
-    "- **granite_adjudicate_garden_opportunity** \u2014 explicitly downrank or clear a garden opportunity the operator has adjudicated",
     "- **granite_list_garden_adjudications** \u2014 inspect the active operator adjudications influencing garden planning",
-    "- **granite_capture_knowledge** \u2014 capture new knowledge into the vault",
     "- **granite_extract_document** \u2014 read a local document into raw extracted text without importing it",
-    "- **granite_import_document** \u2014 attach a file and create a linked source note with caller-provided content",
     "- **granite_understand_note** \u2014 inspect a note in context, not in isolation",
-    "- **granite_revise_note** \u2014 make targeted edits when workflow prompts are insufficient",
-    "- **granite_dispose_note** \u2014 archive by default, delete only when intentional",
-    "",
-    "Use prompts for the higher-level workflows: refine notes, compile topics, and process the inbox.",
+    ...canWrite ? [
+      "- **granite_adjudicate_garden_opportunity** \u2014 explicitly downrank or clear a garden opportunity the operator has adjudicated",
+      "- **granite_capture_knowledge** \u2014 capture new knowledge into the vault",
+      "- **granite_import_document** \u2014 attach a file and create a linked source note with caller-provided content",
+      "- **granite_revise_note** \u2014 make targeted edits when workflow prompts are insufficient",
+      "- **granite_dispose_note** \u2014 archive by default, delete only when intentional",
+      "",
+      "Use prompts for the higher-level workflows: refine notes, compile topics, and process the inbox."
+    ] : [],
     "",
     `## Note Types (vault registry, sig=${signature})`,
     "",
@@ -3238,15 +3255,18 @@ function buildServerInstructions(runtime) {
     "## Working Principles",
     "",
     "- **Read in context.** Prefer granite_understand_note over piecing together note, backlinks, and suggestions manually.",
-    "- **Capture first, refine second.** Capture quickly, then use workflow prompts to turn captures into durable knowledge.",
-    "- **Link aggressively.** Use [[wikilinks]] in note bodies and follow recommendations after each revision.",
-    "- **Archive before delete.** Knowledge systems should prefer reversible lifecycle transitions.",
-    "- **Respect the type registry.** Every note's type must exist in the vault config; write tools reject unknown types and report validation issues in their response.",
+    ...canWrite ? [
+      "- **Capture first, refine second.** Capture quickly, then use workflow prompts to turn captures into durable knowledge.",
+      "- **Link aggressively.** Use [[wikilinks]] in note bodies and follow recommendations after each revision.",
+      "- **Archive before delete.** Knowledge systems should prefer reversible lifecycle transitions."
+    ] : [],
+    canWrite ? "- **Respect the type registry.** Every note's type must exist in the vault config; write tools reject unknown types and report validation issues in their response." : "- **Respect the type registry.** Every note's type is governed by the vault config exposed in granite://vault/types.",
     "- **Prefer explicit extraction for documents.** Use granite://notes/{slug} for markdown, granite://vault/types for type contracts, and granite_extract_document before summarizing imported documents."
   );
   return lines.join("\n");
 }
-function createGraniteMcpServer(runtime) {
+function createGraniteMcpServer(runtime, options = {}) {
+  const role = options.role ?? "write";
   const server = new McpServer(
     {
       name: "granite",
@@ -3255,16 +3275,18 @@ function createGraniteMcpServer(runtime) {
     },
     {
       capabilities: { logging: {} },
-      instructions: buildServerInstructions(runtime)
+      instructions: buildServerInstructions(runtime, role)
     }
   );
-  registerTools(server, runtime);
+  registerTools(server, runtime, role);
   registerResources(server, runtime);
-  registerPrompts(server, runtime);
+  if (role === "write") {
+    registerPrompts(server, runtime);
+  }
   return server;
 }
-async function startGraniteMcpStdioServer(runtime) {
-  const server = createGraniteMcpServer(runtime);
+async function startGraniteMcpStdioServer(runtime, options = {}) {
+  const server = createGraniteMcpServer(runtime, options);
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(`Granite MCP server listening on stdio for ${runtime.vaultRoot}`);
@@ -3332,7 +3354,8 @@ function buildTypeSchema(runtime, describe) {
     `${describe} Valid types in this vault: ${names.join(", ")}.`
   );
 }
-function registerTools(server, runtime) {
+function registerTools(server, runtime, role) {
+  const canWrite = role === "write";
   server.registerTool("granite_wakeup", {
     title: "Granite Wakeup",
     description: "Load a compressed AAAK snapshot of the entire vault into context. Call this at the start of every session to know what exists, how notes cluster, and what changed recently. Costs ~200-500 tokens instead of reading every note.",
@@ -3365,7 +3388,7 @@ function registerTools(server, runtime) {
     const result = runtime.planGarden({ anchor_slug, limit });
     return toolResult(renderGardenPlanMarkdown(result));
   });
-  server.registerTool("granite_adjudicate_garden_opportunity", {
+  if (canWrite) server.registerTool("granite_adjudicate_garden_opportunity", {
     title: "Adjudicate Granite Garden Opportunity",
     description: "Record an explicit operator adjudication for a specific garden opportunity. Use this when a deterministic signal is real but should be downranked locally, or when an old adjudication should be cleared.",
     inputSchema: {
@@ -3403,7 +3426,7 @@ function registerTools(server, runtime) {
     const adjudications = runtime.listGardenAdjudications();
     return toolResult(renderGardenAdjudicationsMarkdown(adjudications));
   });
-  server.registerTool("granite_capture_knowledge", {
+  if (canWrite) server.registerTool("granite_capture_knowledge", {
     title: "Capture Granite Knowledge",
     description: "Capture new knowledge into the vault. Use this for raw captures, semi-structured notes, or deliberately titled note drafts. Returns recommendations for what to connect or write next.",
     inputSchema: {
@@ -3455,7 +3478,7 @@ function registerTools(server, runtime) {
     });
     return toolResult(renderMutationResultMarkdown("Captured", result.note, result.recommendations, result.validation));
   });
-  server.registerTool("granite_import_document", {
+  if (canWrite) server.registerTool("granite_import_document", {
     title: "Import Granite Document",
     description: "Import a local document into the vault by attaching the file, creating a linked source note, and storing caller-provided document content in that note. This tool does not read, clean, or summarize the document for you.",
     inputSchema: {
@@ -3501,7 +3524,7 @@ function registerTools(server, runtime) {
       content: buildUnderstandNoteContent(result)
     };
   });
-  server.registerTool("granite_revise_note", {
+  if (canWrite) server.registerTool("granite_revise_note", {
     title: "Revise Granite Note",
     description: "Make a targeted revision to an existing note. Use this when a workflow prompt tells you exactly what to change, or when you need a precise manual intervention.",
     inputSchema: {
@@ -3587,7 +3610,7 @@ Suggested stub: ${result.suggested_stub.type} "${result.suggested_stub.title}" \
     ].join("\n");
     return toolResult(summary);
   });
-  server.registerTool("granite_dispose_note", {
+  if (canWrite) server.registerTool("granite_dispose_note", {
     title: "Dispose Granite Note",
     description: "Remove a note from the active knowledge loop. Archive by default; delete only when you are intentionally discarding the note.",
     inputSchema: {
@@ -3841,6 +3864,7 @@ function createGraniteMcpHttpApp(runtime, options) {
   const app = new Hono2();
   const allowedHosts = buildAllowedHosts(options.host, options.port);
   const allowedOrigins = buildAllowedOrigins(options.host, options.port, options.allowedOrigins ?? []);
+  const role = options.role ?? "write";
   app.use("/mcp", async (c, next) => {
     const requestHost = (c.req.header("host") ?? "").toLowerCase();
     if (allowedHosts.size > 0 && !allowedHosts.has(requestHost)) {
@@ -3869,7 +3893,7 @@ function createGraniteMcpHttpApp(runtime, options) {
   app.get("/health", (c) => c.json({ status: "ok", name: "granite-mcp", version: GRANITE_VERSION }));
   app.all("/mcp", async (c) => {
     const origin = c.req.header("origin");
-    const server = createGraniteMcpServer(runtime);
+    const server = createGraniteMcpServer(runtime, { role });
     const transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: void 0,
       enableJsonResponse: options.jsonResponse ?? false
@@ -3941,13 +3965,13 @@ function corsHeaders(origin, allowedOrigins) {
 }
 
 // src/mcp/runtime.ts
-import fs17 from "fs";
-import path13 from "path";
+import fs18 from "fs";
+import path14 from "path";
 
 // src/core/assets.ts
 import { createHash } from "crypto";
-import fs13 from "fs";
-import path9 from "path";
+import fs14 from "fs";
+import path10 from "path";
 var MIME_TYPES = {
   ".gif": "image/gif",
   ".jpeg": "image/jpeg",
@@ -3967,23 +3991,23 @@ var MIME_TYPES = {
 };
 var IMAGE_EXTS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]);
 function attachAsset(vaultRoot, filePath) {
-  if (!fs13.existsSync(filePath)) {
+  if (!fs14.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
-  const assetsDir = path9.join(vaultRoot, "assets");
-  fs13.mkdirSync(assetsDir, { recursive: true });
-  const fileName = path9.basename(filePath);
-  const destPath = path9.join(assetsDir, fileName);
+  const assetsDir = path10.join(vaultRoot, "assets");
+  fs14.mkdirSync(assetsDir, { recursive: true });
+  const fileName = path10.basename(filePath);
+  const destPath = path10.join(assetsDir, fileName);
   let finalName = fileName;
-  if (fs13.existsSync(destPath)) {
-    const ext2 = path9.extname(fileName);
-    const base = path9.basename(fileName, ext2);
+  if (fs14.existsSync(destPath)) {
+    const ext2 = path10.extname(fileName);
+    const base = path10.basename(fileName, ext2);
     finalName = `${base}-${Date.now()}${ext2}`;
   }
-  const finalPath = path9.join(assetsDir, finalName);
-  fs13.copyFileSync(filePath, finalPath);
-  const relativePath = path9.posix.join("assets", finalName);
-  const ext = path9.extname(finalName).toLowerCase();
+  const finalPath = path10.join(assetsDir, finalName);
+  fs14.copyFileSync(filePath, finalPath);
+  const relativePath = path10.posix.join("assets", finalName);
+  const ext = path10.extname(finalName).toLowerCase();
   return {
     file: finalName,
     path: finalPath,
@@ -3998,11 +4022,11 @@ function assetResourceUri(fileName) {
   return `granite://assets/${encodeURIComponent(fileName)}`;
 }
 function listAssetFiles(vaultRoot) {
-  const assetsDir = path9.join(vaultRoot, "assets");
-  if (!fs13.existsSync(assetsDir)) {
+  const assetsDir = path10.join(vaultRoot, "assets");
+  if (!fs14.existsSync(assetsDir)) {
     return [];
   }
-  return fs13.readdirSync(assetsDir).filter((file) => fs13.statSync(path9.join(assetsDir, file)).isFile()).sort((a, b) => a.localeCompare(b));
+  return fs14.readdirSync(assetsDir).filter((file) => fs14.statSync(path10.join(assetsDir, file)).isFile()).sort((a, b) => a.localeCompare(b));
 }
 function completeAssetFiles(vaultRoot, prefix = "") {
   const normalizedPrefix = prefix.toLowerCase();
@@ -4010,12 +4034,12 @@ function completeAssetFiles(vaultRoot, prefix = "") {
 }
 function readAssetResource(vaultRoot, fileName) {
   const resolvedName = sanitizeAssetFileName(fileName);
-  const fullPath = path9.join(vaultRoot, "assets", resolvedName);
-  if (!fs13.existsSync(fullPath)) {
+  const fullPath = path10.join(vaultRoot, "assets", resolvedName);
+  if (!fs14.existsSync(fullPath)) {
     throw new Error(`Asset not found: ${resolvedName}`);
   }
   const mimeType = getAssetMimeType(resolvedName);
-  const buffer = fs13.readFileSync(fullPath);
+  const buffer = fs14.readFileSync(fullPath);
   const uri = assetResourceUri(resolvedName);
   if (isTextMimeType(mimeType)) {
     return {
@@ -4031,16 +4055,16 @@ function readAssetResource(vaultRoot, fileName) {
   };
 }
 function getAssetMimeType(fileName) {
-  const ext = path9.extname(fileName).toLowerCase();
+  const ext = path10.extname(fileName).toLowerCase();
   return MIME_TYPES[ext] ?? "application/octet-stream";
 }
 function sha256File(filePath) {
   const hash = createHash("sha256");
-  hash.update(fs13.readFileSync(filePath));
+  hash.update(fs14.readFileSync(filePath));
   return hash.digest("hex");
 }
 function sanitizeAssetFileName(fileName) {
-  const normalized = path9.basename(fileName);
+  const normalized = path10.basename(fileName);
   if (!normalized || normalized === "." || normalized === ".." || normalized !== fileName) {
     throw new Error(`Invalid asset name: ${fileName}`);
   }
@@ -4051,13 +4075,13 @@ function isTextMimeType(mimeType) {
 }
 
 // src/core/garden-adjudications.ts
-import fs14 from "fs";
-import path10 from "path";
+import fs15 from "fs";
+import path11 from "path";
 var GARDEN_ADJUDICATION_STORE_VERSION = 1;
 var GARDEN_ADJUDICATION_DEFAULT_BLOCKED_RECHECK_DAYS = 14;
 var GARDEN_ADJUDICATION_FILE = "garden-adjudications.json";
 function getGardenAdjudicationsPath(vaultRoot) {
-  return path10.join(getGraniteDir(vaultRoot), GARDEN_ADJUDICATION_FILE);
+  return path11.join(getGraniteDir(vaultRoot), GARDEN_ADJUDICATION_FILE);
 }
 function createEmptyGardenAdjudicationStore() {
   return {
@@ -4067,19 +4091,19 @@ function createEmptyGardenAdjudicationStore() {
 }
 function readGardenAdjudicationStore(vaultRoot) {
   const filePath = getGardenAdjudicationsPath(vaultRoot);
-  if (!fs14.existsSync(filePath)) {
+  if (!fs15.existsSync(filePath)) {
     return createEmptyGardenAdjudicationStore();
   }
-  const parsed = JSON.parse(fs14.readFileSync(filePath, "utf-8"));
+  const parsed = JSON.parse(fs15.readFileSync(filePath, "utf-8"));
   return normalizeGardenAdjudicationStore(parsed);
 }
 function writeGardenAdjudicationStore(vaultRoot, store) {
   const filePath = getGardenAdjudicationsPath(vaultRoot);
-  fs14.mkdirSync(path10.dirname(filePath), { recursive: true });
+  fs15.mkdirSync(path11.dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs14.writeFileSync(tempPath, `${JSON.stringify(store, null, 2)}
+  fs15.writeFileSync(tempPath, `${JSON.stringify(store, null, 2)}
 `, "utf-8");
-  fs14.renameSync(tempPath, filePath);
+  fs15.renameSync(tempPath, filePath);
 }
 function normalizeGardenAdjudicationStore(value) {
   if (!isRecord(value)) {
@@ -4207,9 +4231,9 @@ function isRecord(value) {
 }
 
 // src/core/extract-document.ts
-import fs16 from "fs";
+import fs17 from "fs";
 import os2 from "os";
-import path12 from "path";
+import path13 from "path";
 import * as childProcess from "child_process";
 import mammoth from "mammoth";
 import XLSX from "xlsx";
@@ -4217,13 +4241,13 @@ import { XMLParser } from "fast-xml-parser";
 import { unzipSync } from "fflate";
 
 // src/core/import-document.ts
-import fs15 from "fs";
-import path11 from "path";
+import fs16 from "fs";
+import path12 from "path";
 function importDocument(vaultRoot, config, filePath, options = {}) {
   const asset = attachAsset(vaultRoot, filePath);
   const title = normalizeTitle(options.title) ?? defaultImportedDocumentTitle(filePath);
   const created = createNote(vaultRoot, config, "source", title, buildImportedDocumentBody(asset, options.content));
-  const raw = fs15.readFileSync(created.filepath, "utf-8");
+  const raw = fs16.readFileSync(created.filepath, "utf-8");
   const { frontmatter, body } = parseFrontmatter(raw);
   frontmatter.status = "inbox";
   frontmatter.source = "extraction";
@@ -4236,14 +4260,14 @@ function importDocument(vaultRoot, config, filePath, options = {}) {
   frontmatter.document_mime = asset.mime_type;
   frontmatter.document_sha256 = asset.sha256;
   frontmatter.document_resource_uri = asset.resource_uri;
-  fs15.writeFileSync(created.filepath, serializeFrontmatter(frontmatter, body), "utf-8");
+  fs16.writeFileSync(created.filepath, serializeFrontmatter(frontmatter, body), "utf-8");
   return {
     note: readNote(created.filepath),
     asset
   };
 }
 function defaultImportedDocumentTitle(filePath) {
-  const base = path11.basename(filePath, path11.extname(filePath)).trim();
+  const base = path12.basename(filePath, path12.extname(filePath)).trim();
   if (!base) {
     return "Imported Document";
   }
@@ -4316,8 +4340,8 @@ var PPTX_XML_PARSER = new XMLParser({
   trimValues: true
 });
 async function extractDocument(filePath) {
-  const resolvedPath = path12.resolve(filePath);
-  const extension = path12.extname(resolvedPath).toLowerCase();
+  const resolvedPath = path13.resolve(filePath);
+  const extension = path13.extname(resolvedPath).toLowerCase();
   switch (extension) {
     case ".pdf":
       return extractPdfWithFerrules(resolvedPath);
@@ -4328,7 +4352,7 @@ async function extractDocument(filePath) {
     case ".pptx":
       return extractPptx(resolvedPath);
     default:
-      throw new Error(`Unsupported document type: "${extension || path12.basename(resolvedPath)}". Expected one of: .pdf, .docx, .xlsx, .pptx`);
+      throw new Error(`Unsupported document type: "${extension || path13.basename(resolvedPath)}". Expected one of: .pdf, .docx, .xlsx, .pptx`);
   }
 }
 async function extractDocx(filePath) {
@@ -4388,7 +4412,7 @@ async function extractXlsx(filePath) {
   };
 }
 async function extractPptx(filePath) {
-  const archive = unzipSync(new Uint8Array(fs16.readFileSync(filePath)));
+  const archive = unzipSync(new Uint8Array(fs17.readFileSync(filePath)));
   const slideNames = Object.keys(archive).filter((name) => /^ppt\/slides\/slide\d+\.xml$/i.test(name)).sort(comparePptxSlides);
   const sections = [];
   for (const slideName of slideNames) {
@@ -4398,7 +4422,7 @@ async function extractPptx(filePath) {
     if (textRuns.length === 0) {
       continue;
     }
-    sections.push(`Slide: ${path12.basename(slideName, ".xml")}`);
+    sections.push(`Slide: ${path13.basename(slideName, ".xml")}`);
     sections.push(...textRuns);
   }
   const rawText = normalizeRawText(sections.join("\n"));
@@ -4420,7 +4444,7 @@ async function extractPptx(filePath) {
 }
 async function extractPdfWithFerrules(filePath) {
   const titleHint = defaultImportedDocumentTitle(filePath);
-  const tmpDir = fs16.mkdtempSync(path12.join(os2.tmpdir(), "granite-ferrules-"));
+  const tmpDir = fs17.mkdtempSync(path13.join(os2.tmpdir(), "granite-ferrules-"));
   try {
     try {
       childProcess.execFileSync("ferrules", [filePath, "--output-dir", tmpDir], {
@@ -4453,7 +4477,7 @@ async function extractPdfWithFerrules(filePath) {
       title_hint: titleHint
     };
   } finally {
-    fs16.rmSync(tmpDir, { recursive: true, force: true });
+    fs17.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
 function comparePptxSlides(left, right) {
@@ -4496,7 +4520,7 @@ function visitNode(value, onStringField) {
 function extractFerrulesRawText(outputFiles) {
   const markdownFiles = outputFiles.filter((file) => /\.(md|markdown|txt)$/i.test(file));
   for (const markdownFile of markdownFiles) {
-    const content = normalizeRawText(fs16.readFileSync(markdownFile, "utf-8"));
+    const content = normalizeRawText(fs17.readFileSync(markdownFile, "utf-8"));
     if (content) {
       return content;
     }
@@ -4521,7 +4545,7 @@ function extractFerrulesRawText(outputFiles) {
 function detectFerrulesReadingBasis(outputFiles) {
   const jsonFiles = outputFiles.filter((file) => /\.json$/i.test(file));
   for (const jsonFile of jsonFiles) {
-    const content = fs16.readFileSync(jsonFile, "utf-8").toLowerCase();
+    const content = fs17.readFileSync(jsonFile, "utf-8").toLowerCase();
     if (content.includes('"ocr"') || content.includes("ocr_") || content.includes("ocr ")) {
       return "ocr";
     }
@@ -4535,7 +4559,7 @@ function preferFerrulesResultsJson(left, right) {
 }
 function safeReadJson(filePath) {
   try {
-    return JSON.parse(fs16.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs17.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -4580,10 +4604,10 @@ function collectLeafStrings(value) {
   return dedupeStrings(out);
 }
 function walkFiles(root) {
-  const entries = fs16.readdirSync(root, { withFileTypes: true });
+  const entries = fs17.readdirSync(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path12.join(root, entry.name);
+    const fullPath = path13.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkFiles(fullPath));
       continue;
@@ -5010,7 +5034,7 @@ var GraniteMcpRuntime = class {
   lastSignature;
   lastIndexCheckAt = 0;
   constructor(vaultRoot, options = {}) {
-    this.vaultRoot = path13.resolve(vaultRoot);
+    this.vaultRoot = path14.resolve(vaultRoot);
     this.config = loadConfig(this.vaultRoot);
     this.db = openDatabase(this.vaultRoot);
     this.indexCheckIntervalMs = options.indexCheckIntervalMs ?? 1500;
@@ -5456,7 +5480,7 @@ var GraniteMcpRuntime = class {
     };
   }
   async extractDocument(input) {
-    const resolvedPath = path13.isAbsolute(input.file_path) ? input.file_path : path13.join(this.vaultRoot, input.file_path);
+    const resolvedPath = path14.isAbsolute(input.file_path) ? input.file_path : path14.join(this.vaultRoot, input.file_path);
     return extractDocument(resolvedPath);
   }
   updateNote(slug, input) {
@@ -5480,7 +5504,7 @@ var GraniteMcpRuntime = class {
   }
   reviseNote(slug, input) {
     const note = this.requireNote(slug);
-    const raw = fs17.readFileSync(note.filepath, "utf-8");
+    const raw = fs18.readFileSync(note.filepath, "utf-8");
     const { frontmatter, body: existingBody } = parseFrontmatter(raw);
     let body = existingBody;
     let nextFilepath = note.filepath;
@@ -5492,10 +5516,10 @@ var GraniteMcpRuntime = class {
         throw new Error(`Unknown note type "${input.type}". Valid types in this vault: ${valid}.`);
       }
       if (frontmatter.type !== input.type) {
-        const targetFolder = path13.join(this.vaultRoot, nextType.folder);
-        fs17.mkdirSync(targetFolder, { recursive: true });
-        const candidatePath = path13.join(targetFolder, `${slug}.md`);
-        if (candidatePath !== note.filepath && fs17.existsSync(candidatePath)) {
+        const targetFolder = path14.join(this.vaultRoot, nextType.folder);
+        fs18.mkdirSync(targetFolder, { recursive: true });
+        const candidatePath = path14.join(targetFolder, `${slug}.md`);
+        if (candidatePath !== note.filepath && fs18.existsSync(candidatePath)) {
           throw new Error(`Cannot move "${slug}" to type "${input.type}" because ${candidatePath} already exists.`);
         }
         frontmatter.type = input.type;
@@ -5554,9 +5578,9 @@ ${input.append}
       }
     }
     frontmatter.modified = (/* @__PURE__ */ new Date()).toISOString();
-    fs17.writeFileSync(nextFilepath, serializeFrontmatter(frontmatter, body), "utf-8");
-    if (movedType && nextFilepath !== note.filepath && fs17.existsSync(note.filepath)) {
-      fs17.unlinkSync(note.filepath);
+    fs18.writeFileSync(nextFilepath, serializeFrontmatter(frontmatter, body), "utf-8");
+    if (movedType && nextFilepath !== note.filepath && fs18.existsSync(note.filepath)) {
+      fs18.unlinkSync(note.filepath);
     }
     return this.afterWrite(slug, movedType || input.title !== void 0 || (input.aliases?.length ?? 0) > 0);
   }
@@ -5576,7 +5600,7 @@ ${input.append}
         note: revised.note
       };
     }
-    fs17.unlinkSync(note.filepath);
+    fs18.unlinkSync(note.filepath);
     this.refreshIndex(true);
     return {
       slug,
@@ -5587,7 +5611,7 @@ ${input.append}
     };
   }
   readVaultConfigRaw() {
-    return fs17.readFileSync(path13.join(this.vaultRoot, CONFIG_FILENAME), "utf-8");
+    return fs18.readFileSync(path14.join(this.vaultRoot, CONFIG_FILENAME), "utf-8");
   }
   readVaultTypesJson() {
     return JSON.stringify({
@@ -5600,7 +5624,7 @@ ${input.append}
   }
   readNoteMarkdown(slug) {
     const note = this.requireNote(slug);
-    return fs17.readFileSync(note.filepath, "utf-8");
+    return fs18.readFileSync(note.filepath, "utf-8");
   }
   readAsset(fileName) {
     return readAssetResource(this.vaultRoot, fileName);
@@ -6037,7 +6061,7 @@ ${input.append}
     };
   }
   applyMutations(filepath, input) {
-    const raw = fs17.readFileSync(filepath, "utf-8");
+    const raw = fs18.readFileSync(filepath, "utf-8");
     const { frontmatter, body: existingBody } = parseFrontmatter(raw);
     let body = existingBody;
     if (input.title !== void 0) {
@@ -6077,7 +6101,7 @@ ${input.append}
 `;
     }
     frontmatter.modified = (/* @__PURE__ */ new Date()).toISOString();
-    fs17.writeFileSync(filepath, serializeFrontmatter(frontmatter, body), "utf-8");
+    fs18.writeFileSync(filepath, serializeFrontmatter(frontmatter, body), "utf-8");
   }
   afterWrite(slug, fullRebuild) {
     if (fullRebuild) {
@@ -6109,16 +6133,16 @@ ${input.append}
     let noteCount = 0;
     let latestNoteMtimeMs = 0;
     for (const typeConfig of Object.values(this.config.note_types)) {
-      const folder = path13.join(this.vaultRoot, typeConfig.folder);
-      if (!fs17.existsSync(folder)) {
+      const folder = path14.join(this.vaultRoot, typeConfig.folder);
+      if (!fs18.existsSync(folder)) {
         continue;
       }
-      for (const entry of fs17.readdirSync(folder)) {
+      for (const entry of fs18.readdirSync(folder)) {
         if (!entry.endsWith(".md")) {
           continue;
         }
         noteCount += 1;
-        const stat = fs17.statSync(path13.join(folder, entry));
+        const stat = fs18.statSync(path14.join(folder, entry));
         latestNoteMtimeMs = Math.max(latestNoteMtimeMs, stat.mtimeMs);
       }
     }
@@ -6130,8 +6154,8 @@ ${input.append}
     };
   }
   getConfigMtimeMs() {
-    const configPath = path13.join(this.vaultRoot, CONFIG_FILENAME);
-    return fs17.existsSync(configPath) ? fs17.statSync(configPath).mtimeMs : 0;
+    const configPath = path14.join(this.vaultRoot, CONFIG_FILENAME);
+    return fs18.existsSync(configPath) ? fs18.statSync(configPath).mtimeMs : 0;
   }
   getLastRebuildMs() {
     const value = this.getMetaValue("last_rebuild");
@@ -6395,145 +6419,19 @@ function jaccard(left, right) {
   return union === 0 ? 0 : intersection / union;
 }
 
-// src/tunnel.ts
-import { spawn } from "child_process";
-async function startTunnel(options) {
-  if (options.provider === "cloudflare") {
-    return startCloudflareTunnel(options);
-  }
-  return startTailscaleFunnel(options);
-}
-function stopTunnel(tunnelProcess) {
-  if (!tunnelProcess.killed) {
-    tunnelProcess.kill("SIGTERM");
-  }
-}
-function spawnError(binary, installUrl, err) {
-  if (err.code === "ENOENT") {
-    return new Error(`${binary} is not installed. Install it from ${installUrl}`);
-  }
-  return new Error(`Failed to start ${binary}: ${err.message}`);
-}
-function startCloudflareTunnel(options) {
-  return new Promise((resolve, reject) => {
-    const localUrl = `http://${options.host}:${options.port}`;
-    const child = spawn("cloudflared", ["tunnel", "--url", localUrl], {
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let settled = false;
-    const settle = (fn) => {
-      if (settled) return;
-      settled = true;
-      fn();
-    };
-    const onData = (chunk) => {
-      const match = chunk.toString().match(/https:\/\/[^\s]+\.trycloudflare\.com/);
-      if (match) {
-        clearTimeout(timer);
-        settle(() => resolve({ url: match[0], process: child }));
-      }
-    };
-    child.stderr?.on("data", onData);
-    child.stdout?.on("data", onData);
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      settle(() => reject(spawnError(
-        "cloudflared",
-        "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/",
-        err
-      )));
-    });
-    child.on("exit", (code) => {
-      clearTimeout(timer);
-      settle(() => reject(new Error(`cloudflared exited with code ${code} before establishing tunnel`)));
-    });
-    const timer = setTimeout(() => {
-      child.kill("SIGTERM");
-      settle(() => reject(new Error("Timed out waiting for cloudflared to establish tunnel")));
-    }, 3e4);
-  });
-}
-async function getTailscaleHostname() {
-  return new Promise((resolve, reject) => {
-    const status = spawn("tailscale", ["status", "--json"], {
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let settled = false;
-    let output = "";
-    status.stdout?.on("data", (chunk) => {
-      output += chunk.toString();
-    });
-    status.on("error", (err) => {
-      if (!settled) {
-        settled = true;
-        reject(spawnError("tailscale", "https://tailscale.com/download", err));
-      }
-    });
-    status.on("exit", (code) => {
-      if (settled) return;
-      settled = true;
-      if (code !== 0) {
-        reject(new Error(`tailscale status exited with code ${code}. Is Tailscale running?`));
-        return;
-      }
-      try {
-        const parsed = JSON.parse(output);
-        const dnsName = parsed.Self?.DNSName ?? "";
-        const hostname = dnsName.replace(/\.$/, "");
-        if (!hostname) {
-          reject(new Error("Could not determine Tailscale hostname"));
-        } else {
-          resolve(hostname);
-        }
-      } catch {
-        reject(new Error("Failed to parse tailscale status output"));
-      }
-    });
-  });
-}
-async function startTailscaleFunnel(options) {
-  const hostname = await getTailscaleHostname();
-  const publicUrl = `https://${hostname}:${options.port}`;
-  return new Promise((resolve, reject) => {
-    const child = spawn("tailscale", ["funnel", String(options.port)], {
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let settled = false;
-    child.on("error", (err) => {
-      if (!settled) {
-        settled = true;
-        reject(new Error(`Failed to start tailscale funnel: ${err.message}`));
-      }
-    });
-    const timer = setTimeout(() => {
-      settled = true;
-      resolve({ url: publicUrl, process: child });
-    }, 2e3);
-    child.on("exit", (exitCode) => {
-      if (!settled) {
-        settled = true;
-        clearTimeout(timer);
-        reject(new Error(
-          `tailscale funnel exited with code ${exitCode}. Make sure Tailscale Funnel is enabled: https://tailscale.com/kb/1223/funnel`
-        ));
-      }
-    });
-  });
-}
-
 // src/commands/mcp.ts
 function pidPath(vaultRoot) {
-  return path14.join(getGraniteDir(vaultRoot), "mcp.pid");
+  return path15.join(getGraniteDir(vaultRoot), "mcp.pid");
 }
 function urlPath(vaultRoot) {
-  return path14.join(getGraniteDir(vaultRoot), "mcp.url");
+  return path15.join(getGraniteDir(vaultRoot), "mcp.url");
 }
 function ensureGraniteDir(vaultRoot) {
-  fs18.mkdirSync(getGraniteDir(vaultRoot), { recursive: true });
+  fs19.mkdirSync(getGraniteDir(vaultRoot), { recursive: true });
 }
 function readPid(vaultRoot) {
   try {
-    const raw = fs18.readFileSync(pidPath(vaultRoot), "utf-8").trim();
+    const raw = fs19.readFileSync(pidPath(vaultRoot), "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isNaN(pid)) return null;
     try {
@@ -6548,26 +6446,26 @@ function readPid(vaultRoot) {
 }
 function writeDaemonState(vaultRoot, pid, url) {
   ensureGraniteDir(vaultRoot);
-  fs18.writeFileSync(pidPath(vaultRoot), String(pid), "utf-8");
-  fs18.writeFileSync(urlPath(vaultRoot), url, "utf-8");
+  fs19.writeFileSync(pidPath(vaultRoot), String(pid), "utf-8");
+  fs19.writeFileSync(urlPath(vaultRoot), url, "utf-8");
 }
 function cleanupFiles(vaultRoot) {
   try {
-    fs18.unlinkSync(pidPath(vaultRoot));
+    fs19.unlinkSync(pidPath(vaultRoot));
   } catch {
   }
   try {
-    fs18.unlinkSync(urlPath(vaultRoot));
+    fs19.unlinkSync(urlPath(vaultRoot));
   } catch {
   }
 }
 async function mcpCommand(options) {
-  const tunnel = options.tunnel;
-  const transport = tunnel ? "http" : parseTransport(options.transport);
+  const transport = parseTransport(options.transport);
+  const role = parseMcpRole(options.role);
   const vaultRoot = resolveVaultRoot(options.vault);
   if (options.background) {
     if (transport !== "http") {
-      console.error("--background requires --transport http or --tunnel");
+      console.error("--background requires --transport http");
       process.exit(1);
     }
     const running = readPid(vaultRoot);
@@ -6575,16 +6473,16 @@ async function mcpCommand(options) {
       console.error(`MCP server already running (PID ${running}). Use "granite mcp stop" first.`);
       process.exit(1);
     }
-    const logFile = path14.join(getGraniteDir(vaultRoot), "mcp.log");
+    const logFile = path15.join(getGraniteDir(vaultRoot), "mcp.log");
     ensureGraniteDir(vaultRoot);
-    const fd = fs18.openSync(logFile, "a");
-    const child = spawn2(process.execPath, process.argv.slice(1), {
+    const fd = fs19.openSync(logFile, "a");
+    const child = spawn(process.execPath, process.argv.slice(1), {
       detached: true,
       stdio: ["ignore", fd, fd],
       env: { ...process.env, GRANITE_MCP_DAEMONIZED: "1" }
     });
     child.unref();
-    fs18.closeSync(fd);
+    fs19.closeSync(fd);
     if (!child.pid) {
       console.error("Failed to start background process");
       process.exit(1);
@@ -6597,9 +6495,7 @@ async function mcpCommand(options) {
   }
   const isDaemon = process.env.GRANITE_MCP_DAEMONIZED === "1";
   const runtime = new GraniteMcpRuntime(vaultRoot);
-  let tunnelProcess = null;
   const shutdown = () => {
-    if (tunnelProcess) stopTunnel(tunnelProcess);
     if (isDaemon) cleanupFiles(vaultRoot);
     runtime.close();
     process.exit(0);
@@ -6614,34 +6510,13 @@ async function mcpCommand(options) {
       host,
       port,
       allowedOrigins: options.allowOrigin ?? [],
-      jsonResponse: options.jsonResponse ?? false
+      jsonResponse: options.jsonResponse ?? false,
+      role
     });
     if (isDaemon) writeDaemonState(vaultRoot, process.pid, localUrl);
-    if (tunnel) {
-      try {
-        console.error(`
-Starting ${tunnel} tunnel...`);
-        const result = await startTunnel({ provider: tunnel, port, host });
-        tunnelProcess = result.process;
-        const publicMcpUrl = `${result.url}/mcp`;
-        console.error(`
-\u{1F687} Tunnel active!
-`);
-        console.error(`  Public MCP endpoint: ${publicMcpUrl}`);
-        console.error(`  Provider: ${tunnel}`);
-        console.error(`
-Use this URL in your remote MCP client configuration.
-`);
-        if (isDaemon) writeDaemonState(vaultRoot, process.pid, publicMcpUrl);
-      } catch (err) {
-        console.error(`
-Failed to start tunnel: ${err instanceof Error ? err.message : err}`);
-        shutdown();
-      }
-    }
     return;
   }
-  await startGraniteMcpStdioServer(runtime);
+  await startGraniteMcpStdioServer(runtime, { role });
 }
 function mcpStopCommand(options) {
   const vaultRoot = resolveVaultRoot(options.vault);
@@ -6663,7 +6538,7 @@ function mcpStatusCommand(options) {
   }
   let url = "";
   try {
-    url = fs18.readFileSync(urlPath(vaultRoot), "utf-8").trim();
+    url = fs19.readFileSync(urlPath(vaultRoot), "utf-8").trim();
   } catch {
   }
   console.error(`MCP server is running (PID ${pid})`);
@@ -6672,10 +6547,10 @@ function mcpStatusCommand(options) {
 function resolveVaultRoot(explicitVault) {
   const fromEnv = process.env.GRANITE_VAULT;
   if (explicitVault) {
-    return path14.resolve(explicitVault);
+    return path15.resolve(explicitVault);
   }
   if (fromEnv) {
-    return path14.resolve(fromEnv);
+    return path15.resolve(fromEnv);
   }
   return requireVaultRoot();
 }
@@ -6697,26 +6572,31 @@ function parsePort(value) {
   }
   return parsed;
 }
+function parseMcpRole(value) {
+  const role = value ?? "write";
+  if (role === "read" || role === "write") return role;
+  throw new Error(`Invalid MCP role: ${role}. Expected "read" or "write".`);
+}
 
 // src/commands/daemon.ts
-import fs19 from "fs";
-import path15 from "path";
-import { spawn as spawn3 } from "child_process";
+import fs20 from "fs";
+import path16 from "path";
+import { spawn as spawn2 } from "child_process";
 function pidPath2(vaultRoot) {
-  return path15.join(getGraniteDir(vaultRoot), "daemon.pid");
+  return path16.join(getGraniteDir(vaultRoot), "daemon.pid");
 }
 function statePath(vaultRoot) {
-  return path15.join(getGraniteDir(vaultRoot), "daemon.state.json");
+  return path16.join(getGraniteDir(vaultRoot), "daemon.state.json");
 }
 function logPath(vaultRoot) {
-  return path15.join(getGraniteDir(vaultRoot), "daemon.log");
+  return path16.join(getGraniteDir(vaultRoot), "daemon.log");
 }
 function ensureGraniteDir2(vaultRoot) {
-  fs19.mkdirSync(getGraniteDir(vaultRoot), { recursive: true });
+  fs20.mkdirSync(getGraniteDir(vaultRoot), { recursive: true });
 }
 function readPid2(vaultRoot) {
   try {
-    const raw = fs19.readFileSync(pidPath2(vaultRoot), "utf-8").trim();
+    const raw = fs20.readFileSync(pidPath2(vaultRoot), "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isNaN(pid)) return null;
     try {
@@ -6731,7 +6611,7 @@ function readPid2(vaultRoot) {
 }
 function readState(vaultRoot) {
   try {
-    const raw = fs19.readFileSync(statePath(vaultRoot), "utf-8");
+    const raw = fs20.readFileSync(statePath(vaultRoot), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -6739,16 +6619,16 @@ function readState(vaultRoot) {
 }
 function writeState(vaultRoot, state) {
   ensureGraniteDir2(vaultRoot);
-  fs19.writeFileSync(pidPath2(vaultRoot), String(state.pid), "utf-8");
-  fs19.writeFileSync(statePath(vaultRoot), JSON.stringify(state, null, 2), "utf-8");
+  fs20.writeFileSync(pidPath2(vaultRoot), String(state.pid), "utf-8");
+  fs20.writeFileSync(statePath(vaultRoot), JSON.stringify(state, null, 2), "utf-8");
 }
 function cleanupFiles2(vaultRoot) {
   try {
-    fs19.unlinkSync(pidPath2(vaultRoot));
+    fs20.unlinkSync(pidPath2(vaultRoot));
   } catch {
   }
   try {
-    fs19.unlinkSync(statePath(vaultRoot));
+    fs20.unlinkSync(statePath(vaultRoot));
   } catch {
   }
 }
@@ -6762,10 +6642,10 @@ function parsePort2(value, fallback) {
 }
 function resolveVaultRoot2(explicitVault) {
   const fromEnv = process.env.GRANITE_VAULT;
-  if (explicitVault) return path15.resolve(explicitVault);
-  if (fromEnv) return path15.resolve(fromEnv);
+  if (explicitVault) return path16.resolve(explicitVault);
+  if (fromEnv) return path16.resolve(fromEnv);
   const defaultRoot = getDefaultVaultRoot();
-  if (fs19.existsSync(path15.join(defaultRoot, "granite.yml"))) return defaultRoot;
+  if (fs20.existsSync(path16.join(defaultRoot, "granite.yml"))) return defaultRoot;
   return requireVaultRoot();
 }
 async function daemonCommand(options) {
@@ -6821,20 +6701,20 @@ function daemonStartCommand(options) {
   }
   ensureGraniteDir2(vaultRoot);
   const logFile = logPath(vaultRoot);
-  const fd = fs19.openSync(logFile, "a");
+  const fd = fs20.openSync(logFile, "a");
   const origArgs = process.argv.slice(1);
   const startIdx = origArgs.findIndex((a) => a === "start");
   const childArgs = startIdx >= 0 ? [...origArgs.slice(0, startIdx), ...origArgs.slice(startIdx + 1)] : origArgs;
   const runningTs = /\.ts$/.test(process.argv[1] ?? "");
   const runner = runningTs ? "npx" : process.execPath;
   const runnerArgs = runningTs ? ["tsx", ...childArgs] : childArgs;
-  const child = spawn3(runner, runnerArgs, {
+  const child = spawn2(runner, runnerArgs, {
     detached: true,
     stdio: ["ignore", fd, fd],
     env: { ...process.env, GRANITE_DAEMONIZED: "1", GRANITE_VAULT: vaultRoot }
   });
   child.unref();
-  fs19.closeSync(fd);
+  fs20.closeSync(fd);
   if (!child.pid) {
     console.error("Failed to start daemon.");
     process.exit(1);
@@ -6876,12 +6756,12 @@ function daemonStatusCommand(options) {
 function daemonLogsCommand(options) {
   const vaultRoot = resolveVaultRoot2(options.vault);
   const lf = logPath(vaultRoot);
-  if (!fs19.existsSync(lf)) {
+  if (!fs20.existsSync(lf)) {
     console.error("No log file yet.");
     process.exit(1);
   }
   const n = Math.max(1, parseInt(options.lines ?? "100", 10) || 100);
-  const raw = fs19.readFileSync(lf, "utf-8");
+  const raw = fs20.readFileSync(lf, "utf-8");
   const lines = raw.split("\n");
   const tail = lines.slice(Math.max(0, lines.length - n)).join("\n");
   process.stdout.write(tail);
@@ -7164,6 +7044,1056 @@ function splitCsv(value) {
   return value ? value.split(",").map((part) => part.trim()).filter(Boolean) : [];
 }
 
+// src/commands/sync.ts
+import fs22 from "fs";
+import path18 from "path";
+import { Hono as Hono3 } from "hono";
+import { serve as serve3 } from "@hono/node-server";
+
+// src/core/sync.ts
+import crypto2 from "crypto";
+import fs21 from "fs";
+import os3 from "os";
+import path17 from "path";
+var SYNC_STATE_FILENAME = "sync.json";
+var SYNC_PROTOCOL_VERSION = 1;
+function getSyncStatePath(vaultRoot) {
+  return path17.join(getGraniteDir(vaultRoot), SYNC_STATE_FILENAME);
+}
+function loadSyncState(vaultRoot) {
+  const statePath2 = getSyncStatePath(vaultRoot);
+  if (!fs21.existsSync(statePath2)) {
+    const state2 = createDefaultSyncState();
+    saveSyncState(vaultRoot, state2);
+    return state2;
+  }
+  const raw = fs21.readFileSync(statePath2, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    preserveCorruptSyncState(statePath2, raw);
+    const state2 = createDefaultSyncState();
+    saveSyncState(vaultRoot, state2);
+    return state2;
+  }
+  const deviceId = parsed.device_id || createDeviceId();
+  const localToken = parsed.local_token || createToken();
+  const state = {
+    version: SYNC_PROTOCOL_VERSION,
+    device_id: deviceId,
+    device_name: parsed.device_name || os3.hostname(),
+    local_token: localToken,
+    conflict_policy: normalizeConflictPolicy(parsed.conflict_policy),
+    primary_device_id: parsed.primary_device_id || deviceId,
+    remotes: parsed.remotes ?? {},
+    access_tokens: normalizeAccessTokens(parsed.access_tokens, localToken),
+    baselines: parsed.baselines ?? {},
+    tombstones: parsed.tombstones ?? {}
+  };
+  if (state.primary_device_id === "" || state.primary_device_id === void 0) {
+    state.primary_device_id = state.device_id;
+  }
+  return state;
+}
+function saveSyncState(vaultRoot, state) {
+  const statePath2 = getSyncStatePath(vaultRoot);
+  fs21.mkdirSync(path17.dirname(statePath2), { recursive: true });
+  fs21.writeFileSync(statePath2, JSON.stringify(state, null, 2) + "\n", "utf-8");
+}
+function createDefaultSyncState() {
+  const deviceId = createDeviceId();
+  const localToken = createToken();
+  return {
+    version: SYNC_PROTOCOL_VERSION,
+    device_id: deviceId,
+    device_name: os3.hostname(),
+    local_token: localToken,
+    conflict_policy: "manual",
+    primary_device_id: deviceId,
+    remotes: {},
+    access_tokens: {
+      default: {
+        name: "default",
+        token: localToken,
+        role: "write",
+        created_at: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    },
+    baselines: {},
+    tombstones: {}
+  };
+}
+function grantSyncAccess(state, name, role, now = /* @__PURE__ */ new Date()) {
+  const safeName = normalizeAccessName(name);
+  const grant = {
+    name: safeName,
+    token: createToken(),
+    role,
+    created_at: now.toISOString()
+  };
+  state.access_tokens[safeName] = grant;
+  return grant;
+}
+function revokeSyncAccess(state, name) {
+  const safeName = normalizeAccessName(name);
+  if (!state.access_tokens[safeName]) {
+    return false;
+  }
+  delete state.access_tokens[safeName];
+  return true;
+}
+function resolveSyncAccessRole(state, token) {
+  if (!token) return null;
+  for (const grant of Object.values(state.access_tokens)) {
+    if (grant.token === token) return grant.role;
+  }
+  return null;
+}
+function setSyncConflictPolicy(state, policy, primaryDeviceId) {
+  state.conflict_policy = policy;
+  if (primaryDeviceId) {
+    state.primary_device_id = primaryDeviceId;
+  }
+}
+function buildSyncManifest(vaultRoot, state) {
+  const files = listSyncFiles(vaultRoot);
+  const filePaths = new Set(files.map((file) => file.path));
+  const deletions = /* @__PURE__ */ new Map();
+  for (const [relativePath, tombstone] of Object.entries(state.tombstones)) {
+    if (filePaths.has(relativePath)) continue;
+    deletions.set(relativePath, {
+      path: relativePath,
+      hash: tombstone.hash,
+      deleted_at: tombstone.deleted_at,
+      device_id: tombstone.device_id
+    });
+  }
+  for (const [relativePath, baseline] of Object.entries(state.baselines)) {
+    if (filePaths.has(relativePath) || deletions.has(relativePath)) continue;
+    deletions.set(relativePath, {
+      path: relativePath,
+      hash: baseline.hash,
+      deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      device_id: state.device_id
+    });
+  }
+  return {
+    version: SYNC_PROTOCOL_VERSION,
+    device_id: state.device_id,
+    device_name: state.device_name,
+    conflict_policy: state.conflict_policy,
+    primary_device_id: state.primary_device_id,
+    files,
+    deletions: [...deletions.values()].sort((a, b) => a.path.localeCompare(b.path))
+  };
+}
+function listSyncFiles(vaultRoot) {
+  const root = path17.resolve(vaultRoot);
+  const files = [];
+  walkVault(root, "", files);
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return files;
+}
+function readSyncFilePayload(vaultRoot, relativePath, state) {
+  const safePath = normalizeSyncPath(relativePath);
+  const absolutePath = resolveSyncPath(vaultRoot, safePath);
+  if (!fs21.existsSync(absolutePath) || !fs21.statSync(absolutePath).isFile()) {
+    throw new Error(`Sync file not found: ${safePath}`);
+  }
+  const stat = fs21.statSync(absolutePath);
+  const content = fs21.readFileSync(absolutePath);
+  return {
+    path: safePath,
+    hash: hashBuffer(content),
+    size: stat.size,
+    modified: stat.mtime.toISOString(),
+    device_id: state.device_id,
+    content_base64: content.toString("base64"),
+    base_hash: state.baselines[safePath]?.hash ?? null
+  };
+}
+function getSyncFileHash(vaultRoot, relativePath) {
+  const safePath = normalizeSyncPath(relativePath);
+  const absolutePath = resolveSyncPath(vaultRoot, safePath);
+  if (!fs21.existsSync(absolutePath) || !fs21.statSync(absolutePath).isFile()) {
+    return null;
+  }
+  return hashFile(absolutePath);
+}
+function detectLocalDeletions(vaultRoot, state, now = /* @__PURE__ */ new Date()) {
+  let changed = false;
+  const existing = new Set(listSyncFiles(vaultRoot).map((file) => file.path));
+  for (const [relativePath, baseline] of Object.entries(state.baselines)) {
+    if (existing.has(relativePath) || state.tombstones[relativePath]) continue;
+    state.tombstones[relativePath] = {
+      hash: baseline.hash,
+      deleted_at: now.toISOString(),
+      device_id: state.device_id
+    };
+    delete state.baselines[relativePath];
+    changed = true;
+  }
+  return changed;
+}
+function applyIncomingFile(vaultRoot, state, incoming, now = /* @__PURE__ */ new Date()) {
+  const safePath = normalizeSyncPath(incoming.path);
+  const content = decodeBase64Strict(incoming.content_base64, safePath);
+  const incomingHash = hashBuffer(content);
+  if (incomingHash !== incoming.hash) {
+    throw new Error(`Hash mismatch for ${safePath}`);
+  }
+  const absolutePath = resolveSyncPath(vaultRoot, safePath);
+  const localHash = fs21.existsSync(absolutePath) && fs21.statSync(absolutePath).isFile() ? hashFile(absolutePath) : null;
+  const baseHash = state.baselines[safePath]?.hash ?? incoming.base_hash ?? null;
+  const tombstone = state.tombstones[safePath];
+  if (localHash === incoming.hash) {
+    markBaseline(state, safePath, incoming.hash, incoming.modified);
+    delete state.tombstones[safePath];
+    return { path: safePath, action: "unchanged" };
+  }
+  if (!localHash && tombstone) {
+    if (tombstone.hash === incoming.hash) {
+      return { path: safePath, action: "unchanged" };
+    }
+    if (state.conflict_policy === "primary_wins") {
+      if (incoming.device_id === state.primary_device_id) {
+        writeSyncedFile(absolutePath, content, incoming.modified);
+        markBaseline(state, safePath, incoming.hash, incoming.modified);
+        delete state.tombstones[safePath];
+        return { path: safePath, action: "created" };
+      }
+      if (state.device_id === state.primary_device_id) {
+        const conflictPath3 = writeConflictCopy(vaultRoot, safePath, incoming.device_id, content, incoming.modified, now);
+        return { path: safePath, action: "kept_local_primary", conflict_path: conflictPath3 };
+      }
+    }
+    const conflictPath2 = writeConflictCopy(vaultRoot, safePath, incoming.device_id, content, incoming.modified, now);
+    return { path: safePath, action: "conflict_copy_created", conflict_path: conflictPath2 };
+  }
+  if (!localHash) {
+    writeSyncedFile(absolutePath, content, incoming.modified);
+    markBaseline(state, safePath, incoming.hash, incoming.modified);
+    delete state.tombstones[safePath];
+    return { path: safePath, action: "created" };
+  }
+  if (baseHash && incoming.hash === baseHash) {
+    return { path: safePath, action: "unchanged" };
+  }
+  if (baseHash && localHash === baseHash) {
+    writeSyncedFile(absolutePath, content, incoming.modified);
+    markBaseline(state, safePath, incoming.hash, incoming.modified);
+    delete state.tombstones[safePath];
+    return { path: safePath, action: "updated" };
+  }
+  if (state.conflict_policy === "primary_wins") {
+    if (incoming.device_id === state.primary_device_id) {
+      writeSyncedFile(absolutePath, content, incoming.modified);
+      markBaseline(state, safePath, incoming.hash, incoming.modified);
+      delete state.tombstones[safePath];
+      return { path: safePath, action: "overwrote_local_primary" };
+    }
+    if (state.device_id === state.primary_device_id) {
+      const conflictPath2 = writeConflictCopy(vaultRoot, safePath, incoming.device_id, content, incoming.modified, now);
+      return { path: safePath, action: "kept_local_primary", conflict_path: conflictPath2 };
+    }
+  }
+  const conflictPath = writeConflictCopy(vaultRoot, safePath, incoming.device_id, content, incoming.modified, now);
+  return { path: safePath, action: "conflict_copy_created", conflict_path: conflictPath };
+}
+function applyIncomingDeletion(vaultRoot, state, incoming, now = /* @__PURE__ */ new Date()) {
+  const safePath = normalizeSyncPath(incoming.path);
+  const absolutePath = resolveSyncPath(vaultRoot, safePath);
+  const localHash = fs21.existsSync(absolutePath) && fs21.statSync(absolutePath).isFile() ? hashFile(absolutePath) : null;
+  const baseHash = state.baselines[safePath]?.hash ?? null;
+  const tombstone = state.tombstones[safePath];
+  const incomingDeletesKnownBase = baseHash !== null && incoming.hash === baseHash;
+  if (!localHash) {
+    if (!incomingDeletesKnownBase && tombstone?.hash !== incoming.hash) {
+      return { path: safePath, action: "delete_ignored_missing" };
+    }
+    state.tombstones[safePath] = {
+      hash: incoming.hash,
+      deleted_at: incoming.deleted_at,
+      device_id: incoming.device_id
+    };
+    delete state.baselines[safePath];
+    return { path: safePath, action: "delete_ignored_missing" };
+  }
+  if (tombstone?.hash === incoming.hash) {
+    return { path: safePath, action: "unchanged" };
+  }
+  if (localHash !== incoming.hash && !incomingDeletesKnownBase) {
+    return { path: safePath, action: "delete_rejected_unknown_hash" };
+  }
+  if (localHash === incoming.hash || baseHash !== null && localHash === baseHash) {
+    fs21.unlinkSync(absolutePath);
+    state.tombstones[safePath] = {
+      hash: incoming.hash,
+      deleted_at: incoming.deleted_at,
+      device_id: incoming.device_id
+    };
+    delete state.baselines[safePath];
+    return { path: safePath, action: "deleted" };
+  }
+  if (state.conflict_policy === "primary_wins") {
+    if (incoming.device_id === state.primary_device_id && incomingDeletesKnownBase) {
+      fs21.unlinkSync(absolutePath);
+      state.tombstones[safePath] = {
+        hash: incoming.hash,
+        deleted_at: incoming.deleted_at,
+        device_id: incoming.device_id
+      };
+      delete state.baselines[safePath];
+      return { path: safePath, action: "deleted" };
+    }
+    if (state.device_id === state.primary_device_id) {
+      state.tombstones[safePath] = {
+        hash: incoming.hash,
+        deleted_at: incoming.deleted_at,
+        device_id: incoming.device_id
+      };
+      return { path: safePath, action: "kept_local_primary" };
+    }
+  }
+  const content = fs21.readFileSync(absolutePath);
+  const conflictPath = writeConflictCopy(vaultRoot, safePath, incoming.device_id, content, now.toISOString(), now);
+  fs21.unlinkSync(absolutePath);
+  state.tombstones[safePath] = {
+    hash: incoming.hash,
+    deleted_at: incoming.deleted_at,
+    device_id: incoming.device_id
+  };
+  delete state.baselines[safePath];
+  return { path: safePath, action: "delete_conflict_copy_created", conflict_path: conflictPath };
+}
+function markBaseline(state, relativePath, hash, modified) {
+  state.baselines[relativePath] = { hash, modified };
+}
+function normalizeSyncPath(relativePath) {
+  const withSlashes = relativePath.replace(/\\/g, "/");
+  const normalized = path17.posix.normalize(withSlashes);
+  if (!withSlashes || normalized === "." || normalized.startsWith("../") || normalized === ".." || path17.isAbsolute(withSlashes)) {
+    throw new Error(`Unsafe sync path: ${relativePath}`);
+  }
+  if (isIgnoredSyncPath(normalized)) {
+    throw new Error(`Path is not syncable: ${relativePath}`);
+  }
+  return normalized;
+}
+function isIgnoredSyncPath(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/");
+  const first = normalized.split("/")[0];
+  if (first === ".git" || first === "node_modules") return true;
+  if (first === ".granite") return true;
+  if (normalized === ".DS_Store") return true;
+  const rootDerivedFiles = /* @__PURE__ */ new Set([
+    "index.db",
+    "mcp.pid",
+    "mcp.url",
+    "mcp.log",
+    "daemon.pid",
+    "daemon.state.json",
+    "daemon.log",
+    SYNC_STATE_FILENAME
+  ]);
+  return rootDerivedFiles.has(normalized) || normalized.startsWith("index.db-");
+}
+function createDefaultRemoteName(url) {
+  return url.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-|-$/g, "");
+}
+function normalizeRemoteUrl(address, port) {
+  const withScheme = /^https?:\/\//.test(address) ? address : `http://${address}`;
+  const url = new URL(withScheme);
+  if (port && !url.port) {
+    url.port = port;
+  }
+  if (url.pathname === "/sync" || url.pathname.endsWith("/sync/")) {
+    url.pathname = url.pathname.replace(/\/sync\/?$/, "");
+  }
+  url.pathname = url.pathname.replace(/\/+$/, "");
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function suggestedRemoteName(address) {
+  return createDefaultRemoteName(normalizeRemoteUrl(address)) || "remote";
+}
+function createDeviceId() {
+  return `dev_${crypto2.randomUUID()}`;
+}
+function createToken() {
+  return crypto2.randomBytes(24).toString("base64url");
+}
+function normalizeConflictPolicy(value) {
+  return value === "primary_wins" ? "primary_wins" : "manual";
+}
+function normalizeAccessTokens(value, localToken) {
+  const grants = {};
+  let shouldMigrateLocalToken = value === void 0;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const entries = Object.entries(value);
+    shouldMigrateLocalToken = true;
+    for (const [rawName, rawGrant] of entries) {
+      if (!rawGrant || typeof rawGrant !== "object" || Array.isArray(rawGrant)) continue;
+      const grant = rawGrant;
+      const token = typeof grant.token === "string" && grant.token ? grant.token : null;
+      if (!token) continue;
+      const name = normalizeOptionalAccessName(grant.name) ?? normalizeOptionalAccessName(rawName);
+      if (!name) continue;
+      grants[name] = {
+        name,
+        token,
+        role: normalizeAccessRole(grant.role),
+        created_at: typeof grant.created_at === "string" && grant.created_at ? grant.created_at : (/* @__PURE__ */ new Date(0)).toISOString()
+      };
+      shouldMigrateLocalToken = false;
+    }
+  } else if (value !== void 0) {
+    shouldMigrateLocalToken = true;
+  }
+  if (shouldMigrateLocalToken && !Object.values(grants).some((grant) => grant.token === localToken)) {
+    grants.default = {
+      name: "default",
+      token: localToken,
+      role: "write",
+      created_at: (/* @__PURE__ */ new Date(0)).toISOString()
+    };
+  }
+  return grants;
+}
+function normalizeAccessRole(value) {
+  return value === "read" ? "read" : "write";
+}
+function normalizeAccessName(name) {
+  const normalized = normalizeOptionalAccessName(name);
+  if (!normalized) {
+    throw new Error(`Invalid sync access name: ${name}`);
+  }
+  return normalized;
+}
+function normalizeOptionalAccessName(name) {
+  if (typeof name !== "string") return null;
+  const normalized = name.trim();
+  if (!/^[a-zA-Z0-9._-]+$/.test(normalized)) return null;
+  return normalized;
+}
+function preserveCorruptSyncState(statePath2, raw) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+  const backupPath = `${statePath2}.corrupt.${stamp}`;
+  try {
+    fs21.writeFileSync(backupPath, raw, "utf-8");
+  } catch {
+  }
+}
+function walkVault(root, relativeDir, out) {
+  const absoluteDir = relativeDir ? path17.join(root, ...relativeDir.split("/")) : root;
+  if (!fs21.existsSync(absoluteDir)) return;
+  for (const entry of fs21.readdirSync(absoluteDir, { withFileTypes: true })) {
+    const relativePath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
+    if (isIgnoredSyncPath(relativePath)) continue;
+    const absolutePath = path17.join(absoluteDir, entry.name);
+    if (entry.isDirectory()) {
+      walkVault(root, relativePath, out);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const stat = fs21.statSync(absolutePath);
+    out.push({
+      path: relativePath,
+      hash: hashFile(absolutePath),
+      size: stat.size,
+      modified: stat.mtime.toISOString()
+    });
+  }
+}
+function resolveSyncPath(vaultRoot, relativePath) {
+  const root = path17.resolve(vaultRoot);
+  const absolutePath = path17.resolve(root, ...relativePath.split("/"));
+  if (absolutePath !== root && !absolutePath.startsWith(`${root}${path17.sep}`)) {
+    throw new Error(`Unsafe sync path: ${relativePath}`);
+  }
+  return absolutePath;
+}
+function hashFile(filePath) {
+  return hashBuffer(fs21.readFileSync(filePath));
+}
+function hashBuffer(content) {
+  return crypto2.createHash("sha256").update(content).digest("hex");
+}
+function decodeBase64Strict(value, relativePath) {
+  const validBase64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+  if (!validBase64.test(value)) {
+    throw new Error(`Invalid base64 content for ${relativePath}`);
+  }
+  const content = Buffer.from(value, "base64");
+  if (content.toString("base64") !== value) {
+    throw new Error(`Invalid base64 content for ${relativePath}`);
+  }
+  return content;
+}
+function writeSyncedFile(absolutePath, content, modified) {
+  fs21.mkdirSync(path17.dirname(absolutePath), { recursive: true });
+  fs21.writeFileSync(absolutePath, content);
+  const mtime = new Date(modified);
+  if (!Number.isNaN(mtime.getTime())) {
+    fs21.utimesSync(absolutePath, mtime, mtime);
+  }
+}
+function writeConflictCopy(vaultRoot, originalPath, deviceId, content, modified, now) {
+  const conflictPath = buildConflictPath(originalPath, deviceId, now);
+  const absolutePath = resolveSyncPath(vaultRoot, conflictPath);
+  writeSyncedFile(absolutePath, content, modified);
+  return conflictPath;
+}
+function buildConflictPath(originalPath, deviceId, now) {
+  const dir = path17.posix.dirname(originalPath);
+  const ext = path17.posix.extname(originalPath);
+  const base = path17.posix.basename(originalPath, ext);
+  const safeDevice = deviceId.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+  const filename = `${base}.conflict.${safeDevice}.${stamp}${ext}`;
+  return dir === "." ? filename : `${dir}/${filename}`;
+}
+
+// src/commands/sync.ts
+var DEFAULT_SYNC_PORT = 8765;
+function syncStatusCommand(options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const manifest = withDetectedDeletions(vaultRoot, state);
+  if (options.json) {
+    console.log(jsonSuccess({
+      vault: vaultRoot,
+      state_file: getSyncStatePath(vaultRoot),
+      device_id: state.device_id,
+      device_name: state.device_name,
+      local_token_hint: maskToken(state.local_token),
+      access_tokens: listSafeAccessTokens(state),
+      conflict_policy: state.conflict_policy,
+      primary_device_id: state.primary_device_id,
+      remotes: state.remotes,
+      files: manifest.files.length,
+      deletions: manifest.deletions.length
+    }));
+    return;
+  }
+  console.log("Granite sync");
+  console.log(`  Vault:          ${vaultRoot}`);
+  console.log(`  Device:         ${state.device_name} (${state.device_id})`);
+  console.log(`  Write token:    ${maskToken(getDefaultWriteGrant(state)?.token ?? "")}`);
+  console.log(`  Policy:         ${formatPolicy(state)}`);
+  console.log(`  Access grants:  ${Object.keys(state.access_tokens).length}`);
+  console.log(`  Files:          ${manifest.files.length}`);
+  if (manifest.deletions.length > 0) {
+    console.log(`  Pending deletes:${manifest.deletions.length}`);
+  }
+  const remotes = Object.entries(state.remotes);
+  console.log("");
+  if (remotes.length === 0) {
+    console.log("No remotes configured.");
+    console.log("Add one: granite sync remote add macbook http://100.x.y.z:8765 --token <token>");
+    return;
+  }
+  console.log("Remotes:");
+  for (const [name, remote] of remotes) {
+    console.log(`  ${name}  ${remote.url}${remote.token ? "" : "  (no token)"}`);
+  }
+}
+function syncConfigCommand(options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  if (options.policy !== void 0) {
+    setSyncConflictPolicy(state, parsePolicy(options.policy), state.primary_device_id);
+  }
+  if (options.primaryThisDevice) {
+    state.primary_device_id = state.device_id;
+  }
+  if (options.primaryDevice) {
+    state.primary_device_id = options.primaryDevice;
+  }
+  saveSyncState(vaultRoot, state);
+  if (options.json) {
+    console.log(jsonSuccess({
+      conflict_policy: state.conflict_policy,
+      primary_device_id: state.primary_device_id,
+      device_id: state.device_id
+    }));
+    return;
+  }
+  console.log(`Sync policy: ${formatPolicy(state)}`);
+}
+function syncRemoteListCommand(options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  if (options.json) {
+    console.log(jsonSuccess(state.remotes));
+    return;
+  }
+  const remotes = Object.entries(state.remotes);
+  if (remotes.length === 0) {
+    console.log("No remotes configured.");
+    return;
+  }
+  for (const [name, remote] of remotes) {
+    console.log(`${name}	${remote.url}${remote.token ? "" : "	(no token)"}`);
+  }
+}
+function syncAccessListCommand(options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const grants = listSafeAccessTokens(state);
+  if (options.json) {
+    console.log(jsonSuccess(grants));
+    return;
+  }
+  if (grants.length === 0) {
+    console.log("No sync access grants configured.");
+    return;
+  }
+  for (const grant of grants) {
+    console.log(`${grant.name}	${grant.role}	${grant.token_hint}	${grant.created_at}`);
+  }
+}
+function syncAccessGrantCommand(name, options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const grant = grantSyncAccess(state, name, parseAccessRole(options.role));
+  saveSyncState(vaultRoot, state);
+  if (options.json) {
+    console.log(jsonSuccess(grant));
+    return;
+  }
+  console.log(`Granted ${grant.role} sync access "${grant.name}"`);
+  console.log(`Token: ${grant.token}`);
+}
+function syncAccessRevokeCommand(name, options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  if (!revokeSyncAccess(state, name)) {
+    console.error(`Unknown sync access grant: ${name}`);
+    process.exit(1);
+  }
+  saveSyncState(vaultRoot, state);
+  if (options.json) {
+    console.log(jsonSuccess({ revoked: name }));
+    return;
+  }
+  console.log(`Revoked sync access "${name}"`);
+}
+function syncRemoteAddCommand(nameOrAddress, addressMaybe, options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const address = addressMaybe ?? nameOrAddress;
+  const name = addressMaybe ? nameOrAddress : suggestedRemoteName(address);
+  const url = normalizeRemoteUrl(address, options.port);
+  state.remotes[name] = {
+    url,
+    ...options.token ? { token: options.token } : {}
+  };
+  saveSyncState(vaultRoot, state);
+  if (options.json) {
+    console.log(jsonSuccess({ name, remote: state.remotes[name] }));
+    return;
+  }
+  console.log(`Added remote "${name}" at ${url}`);
+  if (!options.token) {
+    console.log("No token stored. Add one with: granite sync remote add " + name + " " + url + " --token <token>");
+  }
+}
+function syncRemoteRemoveCommand(name, options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  if (!state.remotes[name]) {
+    console.error(`Unknown sync remote: ${name}`);
+    process.exit(1);
+  }
+  delete state.remotes[name];
+  saveSyncState(vaultRoot, state);
+  if (options.json) {
+    console.log(jsonSuccess({ removed: name }));
+    return;
+  }
+  console.log(`Removed remote "${name}"`);
+}
+function syncServeCommand(options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const host = options.host ?? "0.0.0.0";
+  const port = parsePort3(options.port, DEFAULT_SYNC_PORT);
+  const app = createSyncApp(vaultRoot);
+  console.log("Granite sync server running");
+  console.log(`  Vault:    ${vaultRoot}`);
+  console.log(`  Device:   ${state.device_name} (${state.device_id})`);
+  console.log(`  Listen:   http://${host}:${port}/sync`);
+  console.log(`  Grants:   ${Object.keys(state.access_tokens).length}`);
+  console.log("");
+  console.log("Create a token to share:");
+  console.log("  granite sync access grant <name> --role read   # pull-only replicas");
+  console.log("  granite sync access grant <name> --role write  # bidirectional sync");
+  console.log("");
+  console.log("Then on the other machine:");
+  console.log(`  granite sync remote add ${state.device_name} http://<tailscale-ip-or-dns>:${port} --token <token>`);
+  return serve3({ fetch: app.fetch, hostname: host, port });
+}
+async function syncPullCommand(remoteName, options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const remote = resolveRemote(state, remoteName, options.token);
+  withDetectedDeletions(vaultRoot, state);
+  const manifest = await fetchRemoteJson(remote, "/sync/manifest");
+  const summary = createSummary(remoteName, "pull");
+  for (const remoteFile of manifest.files) {
+    summary.checked++;
+    const localHash = getSyncFileHash(vaultRoot, remoteFile.path);
+    if (localHash === remoteFile.hash) {
+      markBaseline(state, remoteFile.path, remoteFile.hash, remoteFile.modified);
+      summary.skipped++;
+      continue;
+    }
+    const incoming = await fetchRemoteJson(
+      remote,
+      `/sync/file?path=${encodeURIComponent(remoteFile.path)}`
+    );
+    const result = applyIncomingFile(vaultRoot, state, incoming);
+    recordAction(summary, result);
+  }
+  for (const deletion of manifest.deletions) {
+    summary.checked++;
+    const validation = validateIncomingDeletion(vaultRoot, state, deletion);
+    if (validation) {
+      recordAction(summary, validation);
+      continue;
+    }
+    const result = applyIncomingDeletion(vaultRoot, state, deletion);
+    recordAction(summary, result);
+  }
+  saveSyncState(vaultRoot, state);
+  if (summary.changed > 0 || summary.deleted > 0 || summary.conflicts > 0) {
+    rebuildVaultIndex(vaultRoot);
+  }
+  if (!options.quiet) printSummary(summary, options.json);
+  return summary;
+}
+async function syncPushCommand(remoteName, options = {}) {
+  const vaultRoot = resolveVaultRoot3(options.vault);
+  const state = loadSyncState(vaultRoot);
+  const remote = resolveRemote(state, remoteName, options.token);
+  const manifest = withDetectedDeletions(vaultRoot, state);
+  const remoteManifest = await fetchRemoteJson(remote, "/sync/manifest");
+  const remoteHashes = new Map(remoteManifest.files.map((file) => [file.path, file.hash]));
+  const remoteDeletions = new Set(remoteManifest.deletions.map((deletion) => deletion.path));
+  const summary = createSummary(remoteName, "push");
+  for (const localFile of manifest.files) {
+    summary.checked++;
+    if (remoteHashes.get(localFile.path) === localFile.hash) {
+      markBaseline(state, localFile.path, localFile.hash, localFile.modified);
+      summary.skipped++;
+      continue;
+    }
+    const payload = readSyncFilePayload(vaultRoot, localFile.path, state);
+    const result = await fetchRemoteJson(remote, "/sync/file", {
+      method: "POST",
+      body: JSON.stringify(payload)
+    });
+    recordAction(summary, result);
+    if (isAcceptedRemoteAction(result.action)) {
+      markBaseline(state, localFile.path, localFile.hash, localFile.modified);
+    }
+  }
+  for (const deletion of manifest.deletions) {
+    if (remoteDeletions.has(deletion.path)) {
+      summary.skipped++;
+      continue;
+    }
+    summary.checked++;
+    const payload = {
+      path: deletion.path,
+      hash: deletion.hash,
+      deleted_at: deletion.deleted_at,
+      device_id: state.device_id
+    };
+    const result = await fetchRemoteJson(remote, "/sync/delete", {
+      method: "POST",
+      body: JSON.stringify(payload)
+    });
+    recordAction(summary, result);
+  }
+  saveSyncState(vaultRoot, state);
+  if (!options.quiet) printSummary(summary, options.json);
+  return summary;
+}
+async function syncRunCommand(remoteName, options = {}) {
+  const pull = await syncPullCommand(remoteName, { ...options, quiet: true });
+  const push = await syncPushCommand(remoteName, { ...options, quiet: true });
+  const summary = {
+    remote: remoteName,
+    direction: "run",
+    checked: pull.checked + push.checked,
+    changed: pull.changed + push.changed,
+    skipped: pull.skipped + push.skipped,
+    conflicts: pull.conflicts + push.conflicts,
+    deleted: pull.deleted + push.deleted,
+    actions: [...pull.actions, ...push.actions]
+  };
+  printSummary(summary, options.json);
+}
+async function syncWatchCommand(remoteName, options = {}) {
+  const intervalSeconds = parsePort3(options.interval, 30);
+  const direction = parseWatchDirection(options.direction);
+  console.error(`Granite sync watch ${direction} running every ${intervalSeconds}s for remote "${remoteName}".`);
+  while (true) {
+    try {
+      if (direction === "pull") {
+        await syncPullCommand(remoteName, { ...options, json: false });
+      } else {
+        await syncRunCommand(remoteName, { ...options, json: false });
+      }
+    } catch (error) {
+      console.error(`Sync failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalSeconds * 1e3));
+  }
+}
+function createSyncApp(vaultRoot) {
+  const app = new Hono3();
+  app.get("/sync/health", (c) => {
+    const state = loadSyncState(vaultRoot);
+    return c.json({
+      ok: true,
+      device_id: state.device_id,
+      device_name: state.device_name,
+      conflict_policy: state.conflict_policy,
+      primary_device_id: state.primary_device_id
+    });
+  });
+  app.use("/sync/*", async (c, next) => {
+    const state = loadSyncState(vaultRoot);
+    const token = readBearerToken(c.req.header("authorization"));
+    const role = resolveSyncAccessRole(state, token);
+    if (!role) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+    if (c.req.method !== "GET" && c.req.method !== "HEAD" && role !== "write") {
+      return c.json({ error: "Forbidden: write sync access is required" }, 403);
+    }
+    await next();
+  });
+  app.get("/sync/manifest", (c) => {
+    const state = loadSyncState(vaultRoot);
+    const manifest = buildSyncManifest(vaultRoot, state);
+    return c.json(manifest);
+  });
+  app.get("/sync/file", (c) => {
+    try {
+      const relativePath = c.req.query("path");
+      if (!relativePath) return c.json({ error: "path is required" }, 400);
+      const state = loadSyncState(vaultRoot);
+      return c.json(readSyncFilePayload(vaultRoot, relativePath, state));
+    } catch (error) {
+      return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+    }
+  });
+  app.post("/sync/file", async (c) => {
+    try {
+      const incoming = await c.req.json();
+      const state = loadSyncState(vaultRoot);
+      const result = applyIncomingFile(vaultRoot, state, incoming);
+      saveSyncState(vaultRoot, state);
+      if (result.action !== "unchanged") rebuildVaultIndex(vaultRoot);
+      return c.json(result);
+    } catch (error) {
+      return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+    }
+  });
+  app.post("/sync/delete", async (c) => {
+    try {
+      const incoming = await c.req.json();
+      const state = loadSyncState(vaultRoot);
+      const validation = validateIncomingDeletion(vaultRoot, state, incoming);
+      if (validation) return c.json(validation);
+      const result = applyIncomingDeletion(vaultRoot, state, incoming);
+      saveSyncState(vaultRoot, state);
+      if (result.action !== "delete_ignored_missing") rebuildVaultIndex(vaultRoot);
+      return c.json(result);
+    } catch (error) {
+      return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+    }
+  });
+  return app;
+}
+function resolveVaultRoot3(explicitVault) {
+  if (explicitVault) return path18.resolve(explicitVault);
+  if (process.env.GRANITE_VAULT) return path18.resolve(process.env.GRANITE_VAULT);
+  return requireVaultRoot();
+}
+function withDetectedDeletions(vaultRoot, state) {
+  if (detectLocalDeletions(vaultRoot, state)) {
+    saveSyncState(vaultRoot, state);
+  }
+  return buildSyncManifest(vaultRoot, state);
+}
+function parsePort3(value, fallback) {
+  const raw = value?.trim();
+  if (!raw) return fallback;
+  if (!/^\d+$/.test(raw)) throw new Error(`Invalid number: ${raw}`);
+  const parsed = Number.parseInt(raw, 10);
+  if (parsed <= 0 || parsed > 65535) throw new Error(`Invalid number: ${raw}`);
+  return parsed;
+}
+function parsePolicy(value) {
+  if (value === "manual") return "manual";
+  if (value === "primary-wins" || value === "primary_wins") return "primary_wins";
+  throw new Error("Invalid sync policy. Expected manual or primary-wins.");
+}
+function parseAccessRole(value) {
+  const role = value ?? "read";
+  if (role === "read" || role === "write") return role;
+  throw new Error("Invalid sync access role. Expected read or write.");
+}
+function parseWatchDirection(value) {
+  const direction = value ?? "run";
+  if (direction === "pull" || direction === "run") return direction;
+  throw new Error("Invalid sync watch direction. Expected pull or run.");
+}
+function formatPolicy(state) {
+  if (state.conflict_policy === "primary_wins") {
+    return `primary-wins (${state.primary_device_id})`;
+  }
+  return "manual";
+}
+function listSafeAccessTokens(state) {
+  return Object.values(state.access_tokens).map((grant) => ({
+    name: grant.name,
+    role: grant.role,
+    created_at: grant.created_at,
+    token_hint: maskToken(grant.token)
+  })).sort((a, b) => a.name.localeCompare(b.name));
+}
+function getDefaultWriteGrant(state) {
+  const defaultGrant = state.access_tokens.default;
+  if (defaultGrant?.role === "write") return defaultGrant;
+  return Object.values(state.access_tokens).find((grant) => grant.role === "write") ?? null;
+}
+function maskToken(token) {
+  if (!token) return "(none)";
+  if (token.length <= 8) return "********";
+  return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+function resolveRemote(state, remoteName, tokenOverride) {
+  const remote = state.remotes[remoteName];
+  if (!remote) {
+    throw new Error(`Unknown sync remote: ${remoteName}`);
+  }
+  return {
+    ...remote,
+    ...tokenOverride ? { token: tokenOverride } : {}
+  };
+}
+async function fetchRemoteJson(remote, route, init = {}) {
+  const response = await fetch(remoteUrl(remote, route), {
+    ...init,
+    headers: {
+      ...init.body ? { "Content-Type": "application/json" } : {},
+      ...remote.token ? { Authorization: `Bearer ${remote.token}` } : {},
+      ...init.headers ?? {}
+    }
+  });
+  const text = await response.text();
+  let data;
+  try {
+    data = text ? JSON.parse(text) : {};
+  } catch {
+    throw new Error(`Remote returned non-JSON response (${response.status})`);
+  }
+  if (!response.ok) {
+    const message = typeof data === "object" && data && "error" in data ? String(data.error) : `Remote request failed (${response.status})`;
+    throw new Error(message);
+  }
+  return data;
+}
+function remoteUrl(remote, route) {
+  const base = remote.url.replace(/\/+$/, "");
+  return `${base}${route}`;
+}
+function readBearerToken(header) {
+  if (!header) return null;
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  return match ? match[1] : null;
+}
+function validateIncomingDeletion(vaultRoot, state, incoming) {
+  const safePath = normalizeSyncPath(incoming.path);
+  const localHash = getSyncFileHash(vaultRoot, safePath);
+  const baselineHash = state.baselines[safePath]?.hash;
+  const tombstoneHash = state.tombstones[safePath]?.hash;
+  if (incoming.hash === localHash || incoming.hash === baselineHash || incoming.hash === tombstoneHash) {
+    return null;
+  }
+  if (!localHash && !baselineHash && !tombstoneHash) {
+    return { path: safePath, action: "delete_ignored_missing" };
+  }
+  return { path: safePath, action: "delete_rejected_unknown_hash" };
+}
+function createSummary(remote, direction) {
+  return {
+    remote,
+    direction,
+    checked: 0,
+    changed: 0,
+    skipped: 0,
+    conflicts: 0,
+    deleted: 0,
+    actions: []
+  };
+}
+function recordAction(summary, result) {
+  summary.actions.push(result);
+  if (isConflictAction(result.action)) {
+    summary.conflicts++;
+    return;
+  }
+  if (result.action === "unchanged" || result.action === "delete_ignored_missing") {
+    summary.skipped++;
+    return;
+  }
+  if (result.action === "delete_rejected_unknown_hash") {
+    summary.conflicts++;
+    return;
+  }
+  if (result.action === "deleted") {
+    summary.deleted++;
+    return;
+  }
+  summary.changed++;
+}
+function isConflictAction(action) {
+  return action === "conflict_copy_created" || action === "delete_conflict_copy_created" || action === "kept_local_primary";
+}
+function isAcceptedRemoteAction(action) {
+  return action === "unchanged" || action === "created" || action === "updated" || action === "overwrote_local_primary" || action === "deleted" || action === "delete_ignored_missing";
+}
+function printSummary(summary, asJson) {
+  if (asJson) {
+    console.log(jsonSuccess(summary));
+    return;
+  }
+  console.log(
+    `Sync ${summary.direction} ${summary.remote}: ${summary.changed} changed, ${summary.deleted} deleted, ${summary.conflicts} conflict(s), ${summary.skipped} skipped`
+  );
+  for (const action of summary.actions.filter((item) => item.conflict_path)) {
+    console.log(`  conflict: ${action.path} -> ${action.conflict_path}`);
+  }
+}
+function rebuildVaultIndex(vaultRoot) {
+  try {
+    const config = loadConfig(vaultRoot);
+    const db = openDatabase(vaultRoot);
+    rebuildIndex(vaultRoot, config, db);
+    db.close();
+  } catch {
+  }
+}
+
 // src/index.ts
 var program = new Command();
 program.name("granite").description("Granite \u2014 a local-first knowledge compiler. capture \u2192 compile \u2192 query \u2192 output \u2192 lint").version(GRANITE_VERSION);
@@ -7224,7 +8154,7 @@ program.command("wakeup").description("Generate a compressed AAAK snapshot of th
 program.command("serve").description("Start the local web UI \u2014 browse, search, and visualize the knowledge graph").option("-p, --port <port>", "Port number", "4321").action((options) => {
   serveCommand(options);
 });
-var mcpCmd = program.command("mcp").description("Start Granite as an MCP server").option("--vault <path>", "Vault root. Defaults to the current Granite vault or $GRANITE_VAULT").option("--transport <transport>", "Transport to use: stdio or http", parseTransportOption, "stdio").option("--host <host>", "Host for HTTP transport", "127.0.0.1").option("--port <port>", "Port for HTTP transport", "3321").option("--allow-origin <origin>", "Allow an HTTP Origin for browser-based HTTP clients", collectValues, []).option("--json-response", "Prefer JSON HTTP responses instead of SSE streams").option("--tunnel <provider>", "Expose MCP over internet via tunnel (cloudflare or tailscale)").option("--background", "Run MCP server as a background daemon").action(async (options) => {
+var mcpCmd = program.command("mcp").description("Start Granite as an MCP server").option("--vault <path>", "Vault root. Defaults to the current Granite vault or $GRANITE_VAULT").option("--transport <transport>", "Transport to use: stdio or http", parseTransportOption, "stdio").option("--host <host>", "Host for HTTP transport", "127.0.0.1").option("--port <port>", "Port for HTTP transport", "3321").option("--allow-origin <origin>", "Allow an HTTP Origin for browser-based HTTP clients", collectValues, []).option("--json-response", "Prefer JSON HTTP responses instead of SSE streams").option("--background", "Run MCP server as a background daemon").option("--role <role>", "MCP access role: read or write", "write").action(async (options) => {
   await mcpCommand(options);
 });
 mcpCmd.command("stop").description("Stop a background MCP server").option("--vault <path>", "Vault root").action((options) => {
@@ -7248,6 +8178,48 @@ daemonCmd.command("status").description("Show status of the background daemon").
 daemonCmd.command("logs").description("Tail the daemon log file").option("--vault <path>", "Vault root").option("-n, --lines <count>", "Number of tail lines", "100").action((options) => {
   daemonLogsCommand(options);
 });
+var syncCmd = program.command("sync").description("Sync a vault directly with another machine over LAN, Tailscale, or private DNS");
+syncCmd.command("status").description("Show local sync identity, token, policy, and remotes").option("--vault <path>", "Vault root").option("--json", "Output as JSON").action((options) => {
+  syncStatusCommand(options);
+});
+syncCmd.command("config").description("Configure conflict resolution for this vault").option("--vault <path>", "Vault root").option("--policy <policy>", "Conflict policy: manual or primary-wins").option("--primary-device <device_id>", "Device that wins conflicts when policy is primary-wins").option("--primary-this-device", "Make this machine the primary device").option("--json", "Output as JSON").action((options) => {
+  syncConfigCommand(options);
+});
+var syncRemoteCmd = syncCmd.command("remote").description("Manage direct sync remotes");
+syncRemoteCmd.command("list").alias("ls").description("List configured sync remotes").option("--vault <path>", "Vault root").option("--json", "Output as JSON").action((options) => {
+  syncRemoteListCommand(options);
+});
+syncRemoteCmd.command("add").description("Add a remote by IP, Tailscale DNS name, or private domain").argument("<name-or-address>", "Remote name, or address when address is omitted").argument("[address]", "Remote address, e.g. http://100.x.y.z:8765").option("--vault <path>", "Vault root").option("--port <port>", "Port to add when the address has no port", "8765").option("--token <token>", "Remote sync token").option("--json", "Output as JSON").action((nameOrAddress, address, options) => {
+  syncRemoteAddCommand(nameOrAddress, address, options);
+});
+syncRemoteCmd.command("remove").alias("rm").description("Remove a sync remote").argument("<name>", "Remote name").option("--vault <path>", "Vault root").option("--json", "Output as JSON").action((name, options) => {
+  syncRemoteRemoveCommand(name, options);
+});
+var syncAccessCmd = syncCmd.command("access").description("Manage read/write sync access grants");
+syncAccessCmd.command("list").alias("ls").description("List sync access grants without revealing full tokens").option("--vault <path>", "Vault root").option("--json", "Output as JSON").action((options) => {
+  syncAccessListCommand(options);
+});
+syncAccessCmd.command("grant").description("Create or replace a named sync access grant").argument("<name>", "Grant name, e.g. ipad or teammate-alice").option("--vault <path>", "Vault root").option("--role <role>", "Access role: read or write", "read").option("--json", "Output as JSON").action((name, options) => {
+  syncAccessGrantCommand(name, options);
+});
+syncAccessCmd.command("revoke").description("Revoke a named sync access grant").argument("<name>", "Grant name").option("--vault <path>", "Vault root").option("--json", "Output as JSON").action((name, options) => {
+  syncAccessRevokeCommand(name, options);
+});
+syncCmd.command("serve").description("Serve this vault for direct sync from another machine").option("--vault <path>", "Vault root").option("--host <host>", "Host to bind to", "0.0.0.0").option("--port <port>", "Port to listen on", "8765").action((options) => {
+  syncServeCommand(options);
+});
+syncCmd.command("pull").description("Pull changes from a direct sync remote").argument("<remote>", "Remote name").option("--vault <path>", "Vault root").option("--token <token>", "Override remote token").option("--json", "Output as JSON").action(async (remote, options) => {
+  await syncPullCommand(remote, options);
+});
+syncCmd.command("push").description("Push changes to a direct sync remote").argument("<remote>", "Remote name").option("--vault <path>", "Vault root").option("--token <token>", "Override remote token").option("--json", "Output as JSON").action(async (remote, options) => {
+  await syncPushCommand(remote, options);
+});
+syncCmd.command("run").description("Pull then push changes with a direct sync remote").argument("<remote>", "Remote name").option("--vault <path>", "Vault root").option("--token <token>", "Override remote token").option("--json", "Output as JSON").action(async (remote, options) => {
+  await syncRunCommand(remote, options);
+});
+syncCmd.command("watch").description("Continuously run direct sync with a remote").argument("<remote>", "Remote name").option("--vault <path>", "Vault root").option("--interval <seconds>", "Seconds between sync runs", "30").option("--direction <direction>", "Watch direction: pull or run", "run").action(async (remote, options) => {
+  await syncWatchCommand(remote, options);
+});
 await program.parseAsync();
 function collectValues(value, previous) {
   return [...previous, value];