mainflow 0.41.0 → 0.43.0-alpha.1

package/dist/{operation-DlR1P_Pt.js → operation-BhBbGauo.js}

@@ -1,6 +1,7 @@
-import { At as WriteError, B as renumberRequest, G as applyOperation, H as renumberPath, Mt as splitFrontMatter, Ot as ConflictError, U as renumberText, V as renumberFiles, W as scopeOfPath, _t as readsAsText, at as nowMinute, ct as nodeStorage, dt as MAX_BLOB_BYTES, ft as MAX_FILE_BYTES, gt as exceedsFileLimit, ht as comparePaths, jt as contentHash, kt as DATA_DIR, lt as ACCESS_HEADERS, mt as SOCKET_MAX_AGE_CLOSE, pt as ROUTES, ut as BLOB_HASH, vt as requestTime, yt as textBytes, z as applyOffline } from "./host-BAMZmRy8.js";
+import { $t as WriteError, B as applyOffline, Bt as registeredName, Ct as readsAsText, G as scopeOfPath, Gt as nodeStorage, H as renumberFiles, J as syncedDir, K as hubDigest, Ot as hubRequirements, St as exceedsFileLimit, Tt as textBytes, U as renumberPath, V as renumberRequest, W as renumberText, X as applyOperation, Y as syncedPath, Zt as ConflictError, _t as MAX_FILE_BYTES, bt as VERSION_HEADER, en as contentHash, ht as MAX_BLOB_BYTES, kt as versionMismatch, mt as BLOB_HASH, pt as ACCESS_HEADERS, q as mayHoldSynced, tn as splitFrontMatter, ut as nowMinute, vt as ROUTES, wt as requestTime, xt as comparePaths, yt as SOCKET_MAX_AGE_CLOSE } from "./host-BJvqZy-i.js";
+import { t as CLI_VERSION } from "./version-Dvv4jwF1.js";
 import { createHash, randomBytes } from "node:crypto";
-import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
@@ -15,14 +16,13 @@ import { EventEmitter } from "node:events";
 import { COPYFILE_EXCL } from "node:constants";
 import { appendFile, mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { diff3Merge } from "node-diff3";
-import ignore from "ignore";
 //#region ../sync/dist/paths.js
 /** The sync client's own directory, inside local/ so it is neither synced nor committed. */
 const SYNC_DIR = "local/sync";
 /** The settings a machine keeps instead of the environment variables: { url, clientId, clientSecret }. Never synced or committed. */
 const SETTINGS_FILE = "local/sync.json";
-const syncPaths = (root) => {
-	const data = join(root, DATA_DIR);
+const syncPaths = (dirs) => {
+	const data = dirs.data;
 	const own = join(data, SYNC_DIR);
 	return {
 		data,
@@ -50,27 +50,8 @@ const syncPaths = (root) => {
 		log: join(own, "sync.log")
 	};
 };
-/** Names programs leave behind while writing: editor swap and backup files, temporary files, Finder's. */
-const TRANSIENT = [
-	/\.tmp$/,
-	/\.sw[a-p]$/,
-	/\.swx$/,
-	/~$/,
-	/^\.#/,
-	/^4913$/,
-	/\.crswap$/,
-	/^\.DS_Store$/
-];
-/** Whether a file at `path` (relative to .mainflow/) is synced. */
-function isSynced(path) {
-	const parts = path.split("/");
-	if (parts.some((part) => part === "" || part === "." || part === "..")) return false;
-	if (parts[0] === "local" && !(parts[1] === "sessions" && parts.length === 3)) return false;
-	const name = parts.at(-1);
-	return !TRANSIENT.some((pattern) => pattern.test(name));
-}
-/** Whether the directory at `path` may hold synced files, so a scan walks into it. */
-const mayHoldSynced = (path) => path !== "local" ? !path.startsWith("local/") || path === "local/sessions" : true;
+/** Whether a file at `path` (relative to .mainflow/) is synced (syncedPath in the core package). */
+const isSynced = syncedPath;
 /**
 * Whether the client's file watcher watches inside the directory at `path`: one that may hold synced files, and
 * local/sync/ itself for the outbox; the directories under local/sync/ hold only the client's own files.
@@ -89,22 +70,30 @@ const ENV = {
 	clientSecret: "MAINFLOW_SYNC_CLIENT_SECRET",
 	onDemand: "MAINFLOW_SYNC_ON_DEMAND"
 };
-/** The values of MAINFLOW_SYNC_ON_DEMAND that turn it on; any other value that is not empty turns it off. */
+/** The values of MAINFLOW_SYNC_ON_DEMAND that keep it on; any other value that is not empty (such as 0) turns it off. */
 const ON = /* @__PURE__ */ new Set([
 	"1",
 	"true",
 	"on"
 ]);
-/** The hub's name as config.yaml gives it. */
-function hubName(root) {
-	const config = parse$1(readFileSync(join(root, DATA_DIR, "config.yaml"), "utf8"));
-	if (typeof config?.hub !== "string") throw new Error(`${join(root, DATA_DIR, "config.yaml")} names no hub`);
+/**
+* The hub's name as config.yaml gives it. A hub whose config.yaml is not downloaded yet, as in a new environment before
+* its first `mainflow sync`, has the name it was registered under.
+*/
+function hubName(dirs, env = process.env) {
+	const file = join(dirs.data, "config.yaml");
+	if (!existsSync(file)) {
+		const registered = registeredName(dirs, env);
+		if (registered) return registered;
+	}
+	const config = parse$1(readFileSync(file, "utf8"));
+	if (typeof config?.hub !== "string") throw new Error(`${file} names no hub`);
 	return config.hub;
 }
 const text = (value) => typeof value === "string" ? value : "";
 /** What .mainflow/local/sync.json holds, nothing when there is no such file. */
-function stored(root) {
-	const file = join(root, DATA_DIR, SETTINGS_FILE);
+function stored(dirs) {
+	const file = join(dirs.data, SETTINGS_FILE);
 	if (!existsSync(file)) return {};
 	try {
 		return JSON.parse(readFileSync(file, "utf8")) ?? {};
@@ -115,20 +104,20 @@ function stored(root) {
 /**
 * The sync settings of the hub at `root`, or null when either half of the token is missing. Each value comes from its
 * environment variable, or from sync.json when the variable is unset or empty; the server is DEFAULT_SYNC_URL when
-* neither names one.
+* neither names one, and on-demand download is on unless one of them sets it off.
 */
-function syncSettings(root, env = process.env) {
-	const saved = stored(root);
+function syncSettings(dirs, env = process.env) {
+	const saved = stored(dirs);
 	const url = env[ENV.url] || text(saved.url) || "https://mainflow-sync.carlos209310.space";
 	const clientId = env[ENV.clientId] || text(saved.clientId);
 	const clientSecret = env[ENV.clientSecret] || text(saved.clientSecret);
 	if (!clientId || !clientSecret) return null;
-	const onDemand = env[ENV.onDemand] ? ON.has(env[ENV.onDemand].trim().toLowerCase()) : saved.onDemand === true;
+	const onDemand = env[ENV.onDemand] ? ON.has(env[ENV.onDemand].trim().toLowerCase()) : saved.onDemand !== false;
 	return {
 		url: url.replace(/\/+$/, ""),
 		clientId,
 		clientSecret,
-		hub: hubName(root),
+		hub: hubName(dirs, env),
 		onDemand
 	};
 }
@@ -142,9 +131,9 @@ const EARLIER_TOKEN = {
 * nothing reads now: where that token is and which two values to set instead, never the token itself. Null when the
 * settings are whole or no earlier token is kept, so a hub that never synced writes to its local files without a word.
 */
-function earlierToken(root, env = process.env) {
-	if (syncSettings(root, env)) return null;
-	const where = [...env[EARLIER_TOKEN.env] ? [EARLIER_TOKEN.env] : [], ...text(stored(root)[EARLIER_TOKEN.key]) ? [`the ${EARLIER_TOKEN.key} key of .mainflow/${SETTINGS_FILE}`] : []];
+function earlierToken(dirs, env = process.env) {
+	if (syncSettings(dirs, env)) return null;
+	const where = [...env[EARLIER_TOKEN.env] ? [EARLIER_TOKEN.env] : [], ...text(stored(dirs)[EARLIER_TOKEN.key]) ? [`the ${EARLIER_TOKEN.key} key of .mainflow/${SETTINGS_FILE}`] : []];
 	if (where.length === 0) return null;
 	return `${where.join(" and ")} ${where.length > 1 ? "are" : "is"} no longer read, so mainflow does not write through the sync server; set ${ENV.clientId} and ${ENV.clientSecret}, or clientId and clientSecret in .mainflow/${SETTINGS_FILE}, to a Cloudflare Access service token`;
 }
@@ -172,6 +161,32 @@ var Unreachable = class extends Error {
 		this.broken = broken;
 	}
 };
+/**
+* The hub takes writes only from other mainflow versions than this CLI's (`client-outdated`): nothing of the request was
+* applied or kept. Unreachable as any 5xx, so a write stays in the outbox and goes again after `retryAfter` seconds; the
+* message says which versions the hub takes and the command that installs one.
+*/
+var ClientOutdatedError = class extends Unreachable {
+	retryAfter;
+	constructor(message, retryAfter) {
+		super(message, false);
+		this.retryAfter = retryAfter;
+	}
+};
+/**
+* The hub is being migrated or restored in batches, or such a rewrite stopped partway (`hub-rewriting`): nothing of the
+* request was applied or kept. Unreachable as any 5xx, so a write stays in the outbox and goes again; `rewrite` is the
+* rewrite's state, for a command that waits for it or says what holds the hub.
+*/
+var HubRewritingError = class extends Unreachable {
+	rewrite;
+	retryAfter;
+	constructor(message, rewrite, retryAfter) {
+		super(message, false);
+		this.rewrite = rewrite;
+		this.retryAfter = retryAfter;
+	}
+};
 /** The server refused before the hub (400, 404) or failed (500), or Cloudflare Access in front of it refused (AccessRefused). */
 var ServerError = class extends Error {
 	status;
@@ -261,7 +276,8 @@ var ServerApi = class {
 		wire: 0,
 		body: 0,
 		sent: 0,
-		listed: 0
+		listed: 0,
+		unchanged: 0
 	};
 	constructor(settings, timeoutMs = 3e4) {
 		this.settings = settings;
@@ -283,11 +299,15 @@ var ServerApi = class {
 			maxFreeSockets: 1
 		});
 	}
-	/** The service token's headers, which every request and the WebSocket's upgrade carry. Never logged. */
+	/**
+	* The service token's headers, and the CLI's version when the settings name it (VERSION_HEADER), which every request
+	* and the WebSocket's upgrade carry. Never logged.
+	*/
 	get access() {
 		return {
 			[ACCESS_HEADERS.clientId]: this.settings.clientId,
-			[ACCESS_HEADERS.clientSecret]: this.settings.clientSecret
+			[ACCESS_HEADERS.clientSecret]: this.settings.clientSecret,
+			...this.settings.version === void 0 ? {} : { [VERSION_HEADER]: this.settings.version }
 		};
 	}
 	/** A failure to reach the server or of the connection, as the Unreachable it is. */
@@ -319,8 +339,13 @@ var ServerApi = class {
 		} catch {
 			throw new Unreachable(`the sync server answered ${answer.status} without a readable body`, true);
 		}
-		if (answer.status >= 500) throw new Unreachable(`the sync server failed (${answer.status})`, true);
 		const refused = parsed;
+		if (answer.status === 503 && refused.reason === "client-outdated") throw new ClientOutdatedError(`the sync server refused the write: ${refused.message ?? "this mainflow version may not write to the hub"}`, Math.max(1, Number(answer.retryAfter) || 60));
+		if (answer.status === 503 && refused.reason === "hub-rewriting") {
+			const rewriting = parsed;
+			throw new HubRewritingError(rewriting.message, rewriting.rewrite, Math.max(1, Number(answer.retryAfter) || 10));
+		}
+		if (answer.status >= 500) throw new Unreachable(`the sync server failed (${answer.status})`, true);
 		if (answer.status === 404 || refused.reason === "malformed") throw new ServerError(`the sync server refused: ${refused.message ?? answer.status}`, answer.status);
 		return {
 			status: answer.status,
@@ -543,6 +568,7 @@ var ServerApi = class {
 		this.transfer.batches++;
 		this.transfer.files += body.files.filter((entry) => entry.kind === "file").length;
 		this.transfer.listed += body.files.filter((entry) => entry.kind === "listed").length;
+		if (body.unchanged === true) this.transfer.unchanged++;
 		this.transfer.wire += wire;
 		this.transfer.body += size;
 		this.transfer.sent += sent;
@@ -558,6 +584,9 @@ var ServerApi = class {
 	* `listOnly` asks for the files under those prefixes as `listed`, without their text. A part of the hub alone is taken
 	* from `after` on, and ends with the batch that covers `through`; only the paths of that range are told of. `blobs` takes
 	* the binary files too, each that differs from `have` as `blob`; `have` names a binary file by its sha256 then.
+	* `digest` names the digest of `have` and the directories the client holds (hubDigest), asked on the first batch of a
+	* whole hub's snapshot with `blobs`: a server whose hub it is the digest of answers that nothing differs, and the
+	* snapshot is that one batch, with the client's directories as the entries, as the server would have listed them.
 	*/
 	async snapshot(have = /* @__PURE__ */ new Map(), options = {}) {
 		const paths = [...have.keys()].sort(comparePaths);
@@ -569,14 +598,23 @@ var ServerApi = class {
 			for (;;) {
 				while (after !== void 0 && start < paths.length && comparePaths(paths[start], after) <= 0) start++;
 				const range = Object.fromEntries(paths.slice(start).map((path) => [path, have.get(path)]));
-				const { seq, files, next } = await this.batch({
+				const asking = options.digest !== void 0 && options.blobs === true && after === void 0;
+				const { seq, files, next, unchanged } = await this.batch({
 					protocol: 3,
 					have: range,
 					unknown: true,
 					...after === void 0 ? {} : { after },
+					...asking ? { digest: options.digest.value } : {},
 					...options.listOnly?.length ? { listOnly: options.listOnly } : {},
 					...options.blobs ? { blobs: true } : {}
 				});
+				if (unchanged === true && asking) return [{
+					seq,
+					files: options.digest.dirs.map((path) => ({
+						kind: "dir",
+						path
+					}))
+				}];
 				if (parts.length > 0 && seq < parts.at(-1).seq) break;
 				parts.push({
 					seq,
@@ -613,6 +651,53 @@ var ServerApi = class {
 		return body;
 	}
 	/**
+	* A page of the hub's change log (ROUTES.changes), newest first. A server from before the log has no such route: a
+	* ServerError of status 404, as is any refusal.
+	*/
+	async changes(request = {}) {
+		const { body } = await this.call("POST", ROUTES.changes(this.settings.hub), {
+			protocol: 3,
+			...request
+		}, "read");
+		if (!body.ok) throw new ServerError(`the sync server refused the change log: ${body.message}`, body.status);
+		return body;
+	}
+	/**
+	* Put the hub, or a path of it, back to a seq or a time (ROUTES.restore): the hub's answer, applied, set off in batches
+	* (`started`), or refused. It goes on a connection of its own, as an upload does, and is never sent again, since it has
+	* no requestId: one sent again after its answer was lost finds the hub as it left it only when nothing was written in
+	* between, and else puts that writing back too. A server from before the log has no such route: a ServerError of status
+	* 404. A hub being rewritten throws HubRewritingError.
+	*/
+	async restore(request) {
+		return (await this.call("POST", ROUTES.restore(this.settings.hub), {
+			protocol: 3,
+			...request
+		}, "fresh")).body;
+	}
+	/**
+	* Convert the hub to the server's data format on the server (ROUTES.migrate): the hub's answer, applied, set off in
+	* batches (`started`), or refused. It goes on a connection of its own and is never sent again, as a restore. A server
+	* from before the route answers 404 from its router: a ServerError of status 404. A hub being rewritten throws
+	* HubRewritingError.
+	*/
+	async migrate(request = {}) {
+		return (await this.call("POST", ROUTES.migrate(this.settings.hub), {
+			protocol: 3,
+			...request
+		}, "fresh")).body;
+	}
+	/**
+	* The migration or restore the server runs on the hub in batches, or ran last (ROUTES.rewrite). It goes on a connection
+	* of the reads, so one the server closed meanwhile is asked again. A server from before batches has no such route: a
+	* ServerError of status 404.
+	*/
+	async rewrite() {
+		const { body } = await this.call("POST", ROUTES.rewrite(this.settings.hub), { protocol: 3 }, "read");
+		if (!body.ok) throw new ServerError(`the sync server refused to tell the hub's rewrite: ${body.message}`, body.status);
+		return body;
+	}
+	/**
 	* Open the hub's broadcast connection, taking the binary files too (ROUTES.socket). It opens before the client knows
 	* whether the server keeps binary files (blobRoute), and a server from before them reads nothing of `blobs`.
 	*/
@@ -764,135 +849,6 @@ function mergeThreeWay(current, base, incoming) {
 	};
 }
 //#endregion
-//#region ../sync/dist/scope.js
-/** The name of a file of ignore rules. */
-const GITIGNORE = ".gitignore";
-const decoder$1 = new TextDecoder("utf-8", { fatal: true });
-/** The text of the file at `file`, or null when there is none or it cannot be read. */
-function readText(file) {
-	try {
-		return readFileSync(file, "utf8");
-	} catch {
-		return null;
-	}
-}
-/** The hub's ignore rules, by the directory of each .gitignore, as last read. */
-var SyncScope = class {
-	/** Each .gitignore's text and rules by its directory, relative to .mainflow/ with `/`, '' for .mainflow/ itself */
-	rules = /* @__PURE__ */ new Map();
-	/** Whether each path, a directory's ending in `/`, is ignored under the rules as they are */
-	decided = /* @__PURE__ */ new Map();
-	changes = 0;
-	/** How many times the rules changed: a caller that noted it tells whether they changed since. */
-	get generation() {
-		return this.changes;
-	}
-	/** The text of `dir`'s .gitignore as the rules have it, null for none. */
-	text(dir) {
-		return this.rules.get(dir)?.text ?? null;
-	}
-	/** Take `text` as the .gitignore of `dir`, null for none; true when that changes the rules. */
-	set(dir, text) {
-		if ((this.rules.get(dir)?.text ?? null) === text) return false;
-		if (text === null) this.rules.delete(dir);
-		else this.rules.set(dir, {
-			text,
-			matcher: ignore().add(text)
-		});
-		this.decided.clear();
-		this.changes++;
-		return true;
-	}
-	/** Forget the rules of every directory but `dirs`, as when a scan of the whole hub no longer finds the others. */
-	keepOnly(dirs) {
-		for (const dir of this.rules.keys()) if (!dirs.has(dir)) this.set(dir, null);
-	}
-	/** Whether the file at `path`, relative to .mainflow/, is synced: by the sync client's own rules, and not ignored. */
-	synced(path) {
-		return isSynced(path) && !this.ignored(path, false);
-	}
-	/** Whether a scan walks into the directory at `path`: one that may hold synced files, and not ignored. */
-	walks(path) {
-		return mayHoldSynced(path) && !this.ignored(path, true);
-	}
-	/** Whether git leaves the file or directory (`dir`) at `path` out: it, or a directory above it, is ignored. */
-	ignored(path, dir) {
-		if (path === "local" || path.startsWith("local/")) return false;
-		const parts = path.split("/");
-		if (parts.some((part) => part === "" || part === "." || part === "..")) return true;
-		const key = dir ? `${path}/` : path;
-		const known = this.decided.get(key);
-		if (known !== void 0) return known;
-		let out = false;
-		for (let n = 1; n <= parts.length && !out; n++) out = this.matches(parts, n, n < parts.length || dir);
-		this.decided.set(key, out);
-		return out;
-	}
-	/**
-	* Whether the rules ignore the first `n` parts of a path, a directory's when `dir`: each .gitignore above it in turn,
-	* from .mainflow/ down, the last one with a pattern that matches deciding.
-	*/
-	matches(parts, n, dir) {
-		if (parts[n - 1] === ".git") return true;
-		let out = false;
-		for (let depth = 0; depth < n; depth++) {
-			const rules = this.rules.get(parts.slice(0, depth).join("/"));
-			if (!rules) continue;
-			const test = rules.matcher.test(`${parts.slice(depth, n).join("/")}${dir ? "/" : ""}`);
-			if (test.ignored) out = true;
-			else if (test.unignored) out = false;
-		}
-		return out;
-	}
-	/**
-	* Read every .gitignore under `data`, the hub's .mainflow/, again, and return the synced files there; it walks only into
-	* the directories the rules leave in, as git does. Synchronous, for a start and for `mainflow check`.
-	*/
-	load(data) {
-		const files = [];
-		const dirs = /* @__PURE__ */ new Set();
-		const visit = (dir) => {
-			let entries;
-			try {
-				entries = readdirSync(join(data, dir), { withFileTypes: true });
-			} catch {
-				return;
-			}
-			dirs.add(dir);
-			this.set(dir, entries.some((entry) => entry.name === ".gitignore" && entry.isFile()) ? readText(join(data, dir, GITIGNORE)) : null);
-			for (const entry of entries) {
-				const path = dir ? `${dir}/${entry.name}` : entry.name;
-				if (entry.isDirectory()) {
-					if (this.walks(path)) visit(path);
-				} else if (entry.isFile() && this.synced(path)) files.push(path);
-			}
-		};
-		visit("");
-		this.keepOnly(dirs);
-		return files;
-	}
-};
-/**
-* The synced files of the hub at `root` larger than the sync server keeps (MAX_FILE_BYTES): UTF-8 text the hub's
-* .gitignore files leave in. The sync client leaves them out of sync; `mainflow check` warns of them.
-*/
-function oversizedFiles(root) {
-	const data = join(root, DATA_DIR);
-	const out = [];
-	for (const path of new SyncScope().load(data)) {
-		const file = join(data, path);
-		try {
-			if (statSync(file).size <= 19e5) continue;
-			const bytes = textBytes(decoder$1.decode(readFileSync(file)));
-			if (bytes > 19e5) out.push({
-				path,
-				bytes
-			});
-		} catch {}
-	}
-	return out;
-}
-//#endregion
 //#region ../sync/dist/state.js
 /** The requestId an outbox entry goes under: its id, with the number of the try for a binary file's write sent again. */
 const requestIdOf = (entry) => entry.kind === "blob" && entry.retry ? `${entry.id}-${entry.retry}` : entry.id;
@@ -900,7 +856,8 @@ const requestIdOf = (entry) => entry.kind === "blob" && entry.retry ? `${entry.i
 const waiting = (entry) => entry.refused === void 0;
 /** A new entry's id. */
 const entryId = () => randomBytes(8).toString("hex");
-const entryPaths = (entry) => entry.kind === "op" ? Object.keys(entry.written) : [entry.path];
+/** The files an entry writes; none for a directory's removal. */
+const entryPaths = (entry) => entry.kind === "op" ? Object.keys(entry.written) : entry.kind === "rmdir" ? [] : [entry.path];
 /** A local minute without an offset, the `now` of protocol 1 */
 const LOCAL_MINUTE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})$/;
 /** Protocols whose write requests read the same as the current one's: protocol 3 changed only how a snapshot is taken. */
@@ -953,13 +910,18 @@ function writeJson(file, value) {
 	writeFileSync(temp, JSON.stringify(value, null, 1));
 	renameSync(temp, file);
 }
-const readKnown = (root) => readJson(syncPaths(root).known, {}).files ?? {};
+const readKnown = (dirs) => readJson(syncPaths(dirs).known, {}).files ?? {};
+/** The directories known.json names; none from a client before it kept them. */
+const readKnownDirs = (hub) => {
+	const dirs = readJson(syncPaths(hub).known, {}).dirs;
+	return Array.isArray(dirs) ? dirs.filter((dir) => typeof dir === "string") : [];
+};
 /** What known.json writes before a binary file's sha256, apart from a text's content hash. */
 const BLOB_PREFIX = "blob:";
 /** The text of the version known.json names by `hash`; undefined when it was not kept, as by a sync client before known/. */
-function readKnownText(root, hash) {
+function readKnownText(dirs, hash) {
 	try {
-		const text = readFileSync(join(syncPaths(root).knownTexts, hash), "utf8");
+		const text = readFileSync(join(syncPaths(dirs).knownTexts, hash), "utf8");
 		return contentHash(text) === hash ? text : void 0;
 	} catch {
 		return;
@@ -970,9 +932,10 @@ function readKnownText(root, hash) {
 * there yet; the texts of versions it no longer names are removed. A version whose text the client does not have keeps
 * the text known/ holds, if any. The new texts go first, then known.json, then the removals, so a client killed at any
 * step leaves a known.json whose every text is in known/. A binary file is given as its sha256 with BLOB_PREFIX, and no text.
+* `dirs` are the directories it names.
 */
-function writeKnown(root, files) {
-	const dir = syncPaths(root).knownTexts;
+function writeKnown(hub, files, dirs = []) {
+	const dir = syncPaths(hub).knownTexts;
 	mkdirSync(dir, { recursive: true });
 	const named = new Set(Object.values(files).map((file) => file.hash));
 	const held = new Set(readdirSync(dir));
@@ -982,26 +945,29 @@ function writeKnown(root, files) {
 		renameSync(join(dir, `${hash}.tmp`), join(dir, hash));
 		held.add(hash);
 	}
-	const known = { files: Object.fromEntries(Object.entries(files).map(([path, file]) => [path, file.hash])) };
-	writeJson(syncPaths(root).known, known);
+	const known = {
+		files: Object.fromEntries(Object.entries(files).map(([path, file]) => [path, file.hash])),
+		...dirs.length > 0 ? { dirs } : {}
+	};
+	writeJson(syncPaths(hub).known, known);
 	for (const name of held) if (!named.has(name)) rmSync(join(dir, name), { force: true });
 }
-const writeQueue = (root, entries) => writeJson(syncPaths(root).queue, { entries });
-const readRemote = (root) => readJson(syncPaths(root).remote, {}).files ?? {};
-const writeRemote = (root, files) => writeJson(syncPaths(root).remote, { files });
+const writeQueue = (dirs, entries) => writeJson(syncPaths(dirs).queue, { entries });
+const readRemote = (dirs) => readJson(syncPaths(dirs).remote, {}).files ?? {};
+const writeRemote = (dirs, files) => writeJson(syncPaths(dirs).remote, { files });
 /** The queue as queue.json has it; an entry from before entries had ids gets one, written back. Call under the write lock. */
-function readQueue(root) {
-	const entries = readJson(syncPaths(root).queue, {}).entries ?? [];
+function readQueue(dirs) {
+	const entries = readJson(syncPaths(dirs).queue, {}).entries ?? [];
 	if (entries.every((entry) => typeof entry.id === "string")) return entries;
 	const named = entries.map((entry) => ({
 		...entry,
 		id: entry.id ?? entryId()
 	}));
-	writeQueue(root, named);
+	writeQueue(dirs, named);
 	return named;
 }
 /** Run `fn` under the hub's write lock, the one every mainflow writer of this machine takes. */
-const underLock = (root, fn) => nodeStorage(root).lock(fn);
+const underLock = (dirs, fn) => nodeStorage(dirs).lock(fn);
 //#endregion
 //#region ../sync/dist/swap-helper.js
 const HELPER_SOURCE = "mainflow-swap.c";
@@ -1376,14 +1342,14 @@ const SWAP_PAUSE_MS = 6e4;
 /** queue.json, relative to .mainflow/: other writers append to it, and the client sends what they appended */
 const OUTBOX = `${SYNC_DIR}/queue.json`;
 const sleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-const decoder = new TextDecoder("utf-8", { fatal: true });
+const decoder$1 = new TextDecoder("utf-8", { fatal: true });
 const sameLocal = (a, b) => a.kind === b.kind && (a.kind !== "text" || a.text === b.text) && (a.kind !== "binary" || a.hash === b.hash);
 /** What `bytes` read from a file are: a text when they are UTF-8, a binary file otherwise. */
 function contentOf(bytes) {
 	try {
 		return {
 			kind: "text",
-			text: decoder.decode(bytes)
+			text: decoder$1.decode(bytes)
 		};
 	} catch {
 		return {
@@ -1510,7 +1476,7 @@ function heldBase(entry) {
 */
 function textAt(entry, path) {
 	if (entry.kind === "op") return entry.written[path];
-	if (entry.path !== path || entry.kind === "blob") return void 0;
+	if (entry.path !== path || entry.kind === "blob" || entry.kind === "rmdir") return void 0;
 	if (entry.kind === "remove") return null;
 	return entry.text;
 }
@@ -1556,7 +1522,7 @@ function holdsFiles(parts, held) {
 }
 var SyncClient = class extends EventEmitter {
 	opts;
-	root;
+	dirs;
 	paths;
 	api;
 	problems = [];
@@ -1654,14 +1620,6 @@ var SyncClient = class extends EventEmitter {
 	uploadWanted = false;
 	/** Why the server refused the upload of this environment's copy, as last reported (snapshotNow); null once it holds the hub */
 	uploadRefusal = null;
-	/** The hub's .gitignore files, which leave a file out of sync as they leave it out of git (src/scope.ts) */
-	scope = new SyncScope();
-	/**
-	* The generation of the rules (SyncScope.generation) the last snapshot was asked for under. A file the rules left out
-	* then was not taken in, whatever the server sent, nor a broadcast of it since; rules changed after it may let such a
-	* file in, so the snapshot is taken again (walk), and a file not taken in from the server waits for it (scopeStale).
-	*/
-	scopeTaken = -1;
 	/**
 	* The paths the server last named `unknown`: it holds no file there and never removed one. A file here at such a path
 	* is new to the server, whatever known.json says, as when another environment uploaded the hub to a new server
@@ -1670,6 +1628,15 @@ var SyncClient = class extends EventEmitter {
 	unheld = /* @__PURE__ */ new Set();
 	/** The hub's seq of each path's version in `cloud`: a version from the server with a seq no higher is not newer */
 	fileSeq = /* @__PURE__ */ new Map();
+	/** The hub's seq of each directory as the server last named it, held or removed, as fileSeq is of a file */
+	dirSeq = /* @__PURE__ */ new Map();
+	/**
+	* The directories the server held that the client had here, as known.json keeps them: one gone here is sent as removed
+	* (queueRemovedDirs), and one a snapshot names is made here only when it is not among them
+	*/
+	syncedDirs = /* @__PURE__ */ new Set();
+	/** The check for directories gone here that is to run a moment from now (checkDirs) */
+	dirCheck = null;
 	/** The hub's seq up to which the client has taken in every change: the last snapshot and the broadcasts after it */
 	hubSeq = -1;
 	/** The seqs of the broadcasts on the current connection above hubSeq with a change between that never arrived */
@@ -1723,6 +1690,13 @@ var SyncClient = class extends EventEmitter {
 	flushRun = null;
 	resyncing = null;
 	resyncAgain = false;
+	/**
+	* The snapshot the hub held off while the server migrates or restores it in batches (HubRewritingError): taken again
+	* when its reload broadcast comes, or after the Retry-After it came with, whichever is first. The connection stays
+	* open meanwhile, so the client neither reconnects nor asks for the snapshot more often than that.
+	*/
+	snapshotHeld = false;
+	snapshotTimer;
 	/** Whether a snapshot has been taken, after which a path the server never mentioned does not exist there */
 	synced = false;
 	reconnectTimer;
@@ -1748,15 +1722,25 @@ var SyncClient = class extends EventEmitter {
 	backoff = 500;
 	lastPong = 0;
 	knownTimer;
+	/**
+	* Until when the outbox waits, in ms since the epoch, after the hub refused a write for a while: for this CLI's version
+	* (ClientOutdatedError), or while it is migrated or restored in batches (HubRewritingError). The Retry-After it came
+	* with, so an environment left on an older CLI, or one writing during a rewrite, asks once a while, not once a second.
+	* The write stays in the outbox meanwhile, and idle does not wait for it. With the message last told of an outdated
+	* CLI (a `client-outdated` problem), so the same one is told once, until a write goes through again.
+	*/
+	heldUntil = 0;
+	outdatedMessage = null;
 	constructor(opts) {
 		super();
 		this.opts = opts;
-		this.root = opts.root;
-		this.paths = syncPaths(opts.root);
+		this.dirs = opts.dirs;
+		this.paths = syncPaths(opts.dirs);
 		this.api = new ServerApi(opts.settings);
 		this.firstContact = new Promise((resolve) => {
 			this.once("synced", resolve);
 			this.once("offline", resolve);
+			this.once("held", resolve);
 		});
 	}
 	trace(line) {
@@ -1769,19 +1753,13 @@ var SyncClient = class extends EventEmitter {
 	get online() {
 		return this.connected && !this.stopped;
 	}
-	/**
-	* Whether the file at `path` is synced: by the sync client's own rules (src/paths.ts) and the hub's .gitignore files as
-	* last read (src/scope.ts). Anything else is left as it is here, whatever the server holds.
-	*/
+	/** Whether the file at `path` is synced (src/paths.ts). Anything else is left as it is here, whatever the server holds. */
 	syncs(path) {
-		return this.scope.synced(path);
+		return isSynced(path);
 	}
-	/**
-	* Whether the hub's .gitignore files changed since the last snapshot was asked for: a file they let in since may be on
-	* the server although the client took nothing of it in.
-	*/
-	get scopeStale() {
-		return this.scope.generation !== this.scopeTaken;
+	/** Whether the directory at `path` is synced: one that may hold synced files, apart from local/ itself, which every machine has of its own (src/paths.ts). */
+	syncsDir(path) {
+		return syncedDir(path);
 	}
 	/** Writes waiting in the outbox for the server: not the ones it refused, which wait for nothing (src/state.ts). */
 	get queued() {
@@ -1834,7 +1812,6 @@ var SyncClient = class extends EventEmitter {
 				this.info("", `atomic exchange unavailable, writing with a rename: ${swapper.reason}`);
 			}
 		}
-		this.scope.load(this.paths.data);
 		await this.restoreKnown();
 		this.restoreRemote();
 		await this.whenFree(() => this.syncQueue());
@@ -1859,7 +1836,8 @@ var SyncClient = class extends EventEmitter {
 	async restoreKnown() {
 		this.copied = !existsSync(this.paths.known);
 		this.blobsCompared = !this.copied && !existsSync(this.paths.copyBlobs);
-		for (const [path, hash] of Object.entries(readKnown(this.root))) {
+		for (const dir of readKnownDirs(this.dirs)) this.syncedDirs.add(dir);
+		for (const [path, hash] of Object.entries(readKnown(this.dirs))) {
 			if (hash.startsWith("blob:")) {
 				const disk = {
 					hash: hash.slice(5),
@@ -1870,7 +1848,7 @@ var SyncClient = class extends EventEmitter {
 				continue;
 			}
 			const local = await this.readLocal(path);
-			const text = local.kind === "text" && contentHash(local.text) === hash ? local.text : readKnownText(this.root, hash);
+			const text = local.kind === "text" && contentHash(local.text) === hash ? local.text : readKnownText(this.dirs, hash);
 			const disk = text === void 0 ? { hash } : {
 				hash,
 				text
@@ -1920,6 +1898,7 @@ var SyncClient = class extends EventEmitter {
 		this.closing = true;
 		this.stopped = true;
 		clearTimeout(this.reconnectTimer);
+		clearTimeout(this.snapshotTimer);
 		clearInterval(this.pingTimer);
 		clearInterval(this.warmTimer);
 		clearInterval(this.rescanTimer);
@@ -1960,6 +1939,7 @@ var SyncClient = class extends EventEmitter {
 		await new Promise((resolve) => {
 			this.once("synced", resolve);
 			this.once("offline", resolve);
+			this.once("held", resolve);
 			this.connect();
 		});
 	}
@@ -1973,7 +1953,8 @@ var SyncClient = class extends EventEmitter {
 		this.outboxChanged();
 		for (;;) {
 			const work = besidesAwaiting ? [...this.work].filter((promise) => !this.awaitingEdit.has(this.workPaths.get(promise) ?? "")) : [...this.work];
-			if (!(work.length > 0 || [...this.inflight.values()].some((n) => n > 0) || this.flushing || this.resyncing !== null || this.online && this.nextEntry(this.queue).entry !== void 0)) return true;
+			const sendable = this.online && this.heldUntil <= Date.now() && this.nextEntry(this.queue).entry !== void 0;
+			if (!(work.length > 0 || [...this.inflight.values()].some((n) => n > 0) || this.flushing || this.resyncing !== null || sendable)) return true;
 			if (Date.now() > deadline) return false;
 			await (work.length > 0 ? Promise.race([Promise.allSettled(work), sleep$1(50)]) : sleep$1(50));
 		}
@@ -2113,7 +2094,9 @@ var SyncClient = class extends EventEmitter {
 			this.track(this.resync());
 			return;
 		}
-		for (const event of message.files) this.receive(event, seq);
+		for (const event of message.files) if (event.kind === "dir") this.receiveDir(event.path, seq, true);
+		else if (event.kind === "dirRemoved") this.receiveDirRemoved(event.path, seq);
+		else this.receive(event, seq);
 		if (this.ahead.size > 0 && this.synced && this.resyncing === null) {
 			this.log(`missed the hub's changes ${this.hubSeq + 1} to ${Math.min(...this.ahead) - 1}; reloading the snapshot`);
 			this.track(this.resync());
@@ -2135,10 +2118,6 @@ var SyncClient = class extends EventEmitter {
 	* as a listed text does in a snapshot.
 	*/
 	receive(event, seq) {
-		if (event.kind === "dir") {
-			if ((event.path.split("/")[0] !== "local" || event.path === "local/sessions") && !this.scope.ignored(event.path, true)) this.track(mkdir(join(this.paths.data, event.path), { recursive: true }));
-			return;
-		}
 		if (!this.syncs(event.path)) return;
 		const file = event.kind === "file" ? event.text : event.kind === "blob" ? {
 			kind: "blob",
@@ -2180,6 +2159,58 @@ var SyncClient = class extends EventEmitter {
 		const mainline = MAINLINE_FILE.exec(event.path)?.[1];
 		if (mainline !== void 0 && this.remote.size > 0) this.fetchOpened(mainline);
 	}
+	/**
+	* A directory the server holds as of the hub's `seq`, from a broadcast (`live`) or a snapshot. One the client had here
+	* and that is gone now, named by a snapshot, was removed here: it is not made again, and its removal is queued
+	* (queueRemovedDirs). Any other is made here and known from then on; a broadcast's always is, an operation having just
+	* made it. A directory the client does not sync, and a version no newer than the one the client holds, as a snapshot's
+	* after the broadcast of its removal, are left alone.
+	*/
+	receiveDir(path, seq, live) {
+		if (!this.syncsDir(path) || seq <= (this.dirSeq.get(path) ?? -1)) return;
+		this.dirSeq.set(path, seq);
+		const dir = join(this.paths.data, path);
+		if (!live && this.syncedDirs.has(path) && !existsSync(dir)) {
+			this.trace(`dir ${path} seq ${seq}: removed here`);
+			return;
+		}
+		this.knowDir(path);
+		this.track(mkdir(dir, { recursive: true }));
+	}
+	/**
+	* The server removed the directory at `path` as of the hub's `seq`, as a broadcast tells, or a snapshot that no longer
+	* names it: removed here too when nothing is in it, under the write lock, so no mainflow write puts a file in it
+	* meanwhile. One that holds anything, as a file written here not sent yet, stays; the file's write makes it on the
+	* server again.
+	*/
+	receiveDirRemoved(path, seq) {
+		if (!this.syncsDir(path) || seq <= (this.dirSeq.get(path) ?? -1)) return;
+		this.dirSeq.set(path, seq);
+		this.forgetDir(path);
+		this.trace(`dir ${path} removed seq ${seq}`);
+		this.track(this.whenFree(() => this.locked(() => this.removeEmptyDir(path))).catch((error) => this.log(`${path}/: ${error.message}`)));
+	}
+	/** Remove the directory at `path` when nothing is in it; one gone already, or holding anything, stays as it is. True when it went. */
+	removeEmptyDir(path) {
+		try {
+			rmdirSync(join(this.paths.data, path));
+			return true;
+		} catch (error) {
+			const code = error.code;
+			if (code !== "ENOENT" && code !== "ENOTEMPTY" && code !== "EEXIST" && code !== "ENOTDIR") throw error;
+			return false;
+		}
+	}
+	/** The server holds the directory at `path`, and the client has it here: known from now on. */
+	knowDir(path) {
+		if (this.syncedDirs.has(path)) return;
+		this.syncedDirs.add(path);
+		this.saveKnown();
+	}
+	/** The server no longer holds the directory at `path`. */
+	forgetDir(path) {
+		if (this.syncedDirs.delete(path)) this.saveKnown();
+	}
 	/** Whether the client holds `path` as of the hub's `seq` or later. */
 	reached(path, seq) {
 		return this.hubSeq >= seq || (this.fileSeq.get(path) ?? -1) >= seq;
@@ -2222,8 +2253,7 @@ var SyncClient = class extends EventEmitter {
 	* reconciled: the server broadcasts a change after storing it, so a snapshot asked for later holds it. One that
 	* still does not, and brought nothing newer, is asked for again after a pause; after STALLED_SNAPSHOTS of them the
 	* server is taken to have lost those changes, as when its storage was replaced: the versions the client holds from
-	* after the gap are forgotten and the snapshot is taken once more, as it is. So is it when the hub's .gitignore files
-	* changed after it was asked for (scopeStale): a file they let in since was not taken in. The connection has its
+	* after the gap are forgotten and the snapshot is taken once more, as it is. The connection has its
 	* snapshot once one ends while it is open (I1); one that fails leaves it without, and the client reconnects to take a
 	* fresh one, rather than send on the snapshot of an earlier connection.
 	*/
@@ -2247,6 +2277,7 @@ var SyncClient = class extends EventEmitter {
 						this.log(`the sync server's snapshot stays without the hub's changes ${missing}; taking it as complete`);
 						this.ahead.clear();
 						for (const [path, seq] of this.fileSeq) if (seq > this.hubSeq) this.fileSeq.delete(path);
+						for (const [path, seq] of this.dirSeq) if (seq > this.hubSeq) this.dirSeq.delete(path);
 						stalled = 0;
 						this.resyncAgain = true;
 						continue;
@@ -2254,11 +2285,17 @@ var SyncClient = class extends EventEmitter {
 					this.log(`missed the hub's changes ${missing} while taking the snapshot; reloading it`);
 					if (stalled > 0) await sleep$1(250 * 2 ** (stalled - 1));
 					this.resyncAgain = true;
-				} while ((this.resyncAgain || this.scopeStale) && !this.closing);
+				} while (this.resyncAgain && !this.closing);
 				this.current = this.connected && !this.closing;
+				if (this.snapshotHeld) {
+					this.snapshotHeld = false;
+					clearTimeout(this.snapshotTimer);
+					if (this.current) this.emit("synced");
+				}
 			} catch (error) {
 				this.current = false;
-				this.ws?.close();
+				if (error instanceof HubRewritingError && this.connected && !this.closing) this.holdSnapshot(error);
+				else this.ws?.close();
 				throw error;
 			} finally {
 				this.resyncing = null;
@@ -2268,6 +2305,19 @@ var SyncClient = class extends EventEmitter {
 		return this.resyncing;
 	}
 	/**
+	* The server held the snapshot off while it migrates or restores the hub in batches: the connection stays open, and
+	* the snapshot is taken again on the reload broadcast that ends the rewrite, or after the Retry-After of the refusal,
+	* whichever is first. Nothing is sent meanwhile, as before any snapshot. A client starting or reconnecting meanwhile
+	* is done waiting for its first contact (`held`).
+	*/
+	holdSnapshot(error) {
+		if (!this.snapshotHeld) this.log(`${error.message}; the snapshot is taken again once it is done`);
+		this.snapshotHeld = true;
+		clearTimeout(this.snapshotTimer);
+		this.snapshotTimer = setTimeout(() => void this.track(this.resync().catch((failed) => this.log(`could not reload the snapshot: ${failed.message}`))), error.retryAfter * 1e3);
+		this.emit("held");
+	}
+	/**
 	* Take the hub as of the snapshot's seq, asking only for what differs from what the client holds (holdings). The
 	* snapshot comes in batches, each as of its own seq; the WebSocket was open before the first, so every change after
 	* it comes as a broadcast, and the first batch's seq is the one the whole snapshot is as of. A file the server sent,
@@ -2275,8 +2325,8 @@ var SyncClient = class extends EventEmitter {
 	* batch's seq; a file neither named nor sent is not on the server. A broadcast arriving meanwhile may be older or
 	* newer than either; each file keeps whichever version has the higher seq. A path the server never held a file at
 	* (`unknown`) is one it has no file at: a file here, even one never synced or one known.json names, is sent as new and
-	* never removed (reconcile, unheld). What the
-	* client does not sync (syncs), as a file the hub's .gitignore leaves out, is not taken in, whatever the server sends.
+	* never removed (reconcile, unheld). What the client does not sync (syncs), as a file in a scratch/ directory, is not
+	* taken in, whatever the server sends.
 	*
 	* A server without the hub first gets the local one. When it refuses the upload and still holds no file, the snapshot
 	* fails without taking anything in: an empty hub would tell a copy without known.json to remove every file it holds.
@@ -2309,8 +2359,6 @@ var SyncClient = class extends EventEmitter {
 		/** Whether the hub was uploaded, and why the server refused the upload; asked again, the snapshot may hold the hub */
 		let uploaded = false;
 		let refusal = null;
-		/** The rules' generation the snapshot is asked for under: what it holds is taken in as they leave it in */
-		let asked;
 		/** Whether the snapshot is asked for with the binary files */
 		let withBlobs = false;
 		if (!this.probed) await this.probeBlobs();
@@ -2321,15 +2369,20 @@ var SyncClient = class extends EventEmitter {
 			have = new Map([...held].map(([path, text]) => [path, this.hashOf(path, text)]));
 			for (const [path, blob] of heldBlobs) have.set(path, blob.hash);
 			for (const [path, hash] of this.remote) have.set(path, hash);
-			asked = this.scope.generation;
 			withBlobs = this.blobSupport === true;
 			if (!withBlobs && !this.blobsCompared && !existsSync(this.paths.copyBlobs)) {
 				mkdirSync(this.paths.own, { recursive: true });
 				writeFileSync(this.paths.copyBlobs, "");
 			}
+			const dirs = this.knownDirs();
+			const digest = withBlobs && have.size > 0 ? {
+				value: hubDigest(have, dirs),
+				dirs
+			} : void 0;
 			parts = await this.api.snapshot(have, {
 				listOnly: this.listOnly(this.copied && !this.synced),
-				blobs: this.blobSupport === true
+				blobs: this.blobSupport === true,
+				...digest ? { digest } : {}
 			});
 			if (uploaded || holdsFiles(parts, have)) break;
 			if (this.opts.settings.onDemand === true) {
@@ -2338,7 +2391,7 @@ var SyncClient = class extends EventEmitter {
 					this.problem({
 						kind: "upload-needed",
 						path: "",
-						message: `the sync server has no copy of hub ${this.opts.settings.hub}; this environment downloads on demand and may lack files, so it does not upload its copy. Run mainflow sync, with on-demand downloads off, in an environment that keeps every file of the hub, such as the one that commits it with git, to upload it; this one waits and syncs once the hub is there`
+						message: `the sync server has no copy of hub ${this.opts.settings.hub}; this environment downloads on demand and may lack files, so it does not upload its copy. Run mainflow sync, with on-demand downloads off, in an environment that keeps every file of the hub (run it there with MAINFLOW_SYNC_ON_DEMAND=0), to upload it; this one waits and syncs once the hub is there`
 					});
 				}
 				throw new Error("the sync server has no copy of the hub, and this environment downloads on demand, so it waits for one that keeps every file to upload it");
@@ -2362,6 +2415,7 @@ var SyncClient = class extends EventEmitter {
 		if (seq < before) {
 			this.log(`the sync server's seq went back from ${before} to ${seq}; taking its snapshot as it is`);
 			this.fileSeq.clear();
+			this.dirSeq.clear();
 			this.hubSeq = -1;
 			this.ahead.clear();
 		}
@@ -2372,8 +2426,16 @@ var SyncClient = class extends EventEmitter {
 		this.snapshotAnswers.clear();
 		const fromCopy = this.copied && !this.synced;
 		const blobsFromCopy = withBlobs && !this.blobsCompared;
+		/** The directories the snapshot names: every one the server holds */
+		const dirs = /* @__PURE__ */ new Set();
 		for (const part of parts) for (const event of part.files) {
-			if (event.kind !== "dir" && !this.syncs(event.path)) continue;
+			if (event.kind === "dir") {
+				named.add(event.path);
+				dirs.add(event.path);
+				this.receiveDir(event.path, part.seq, false);
+				continue;
+			}
+			if (!this.syncs(event.path)) continue;
 			if (event.kind === "listed") {
 				named.add(event.path);
 				if (this.mayStay(event.path, held)) this.keepRemote(event.path, event.hash, part.seq);
@@ -2441,7 +2503,7 @@ var SyncClient = class extends EventEmitter {
 				path
 			}, seq);
 		}
-		this.scopeTaken = asked;
+		for (const path of this.syncedDirs) if (!dirs.has(path)) this.receiveDirRemoved(path, seq);
 		this.log(`took the snapshot at seq ${seq} in ${parts.length} batch${parts.length === 1 ? "" : "es"}: ${sent} files sent, ${present.size - sent} already held here${this.remote.size > 0 ? `, ${this.remote.size} only on the server` : ""}`);
 		this.takenUpTo(seq);
 		this.synced = true;
@@ -2456,6 +2518,7 @@ var SyncClient = class extends EventEmitter {
 		for (const path of await this.walk()) this.schedule(path);
 		for (const path of this.stalledDownloads) this.schedule(path);
 		this.stalledDownloads.clear();
+		await this.queueRemovedDirs();
 	}
 	/**
 	* Ask the server whether it keeps binary files (blobSupport), once per connection, before its snapshot. A probe that
@@ -2618,7 +2681,7 @@ var SyncClient = class extends EventEmitter {
 			if (expected?.blob && expected.hash === disk.hash) this.expected.delete(path);
 			if (isBlob(this.cloud.get(path))) this.cloud.delete(path);
 		}
-		if (forgotten.size > 0) await this.whenFree(() => underLock(this.root, () => writeKnown(this.root, this.knownFiles())));
+		if (forgotten.size > 0) await this.whenFree(() => underLock(this.dirs, () => writeKnown(this.dirs, this.knownFiles(), this.knownDirs())));
 		return forgotten;
 	}
 	/** The server refused the upload, so it holds what it held: the binary files forgetBinaries forgot are known again. */
@@ -2720,7 +2783,7 @@ var SyncClient = class extends EventEmitter {
 			const after = this.expected.get(path);
 			if (after !== seen && after !== void 0 && this.matches(after, local)) return this.schedule(path);
 		}
-		const target = this.cloud.has(path) ? this.cloud.get(path) : this.synced && !this.scopeStale && (this.blobSupport === true || !this.knownBinary(path)) ? null : void 0;
+		const target = this.cloud.has(path) ? this.cloud.get(path) : this.synced && (this.blobSupport === true || !this.knownBinary(path)) ? null : void 0;
 		const disk = this.expected.get(path);
 		const unheld = target === null && this.unheld.has(path);
 		if (disk === void 0) {
@@ -2799,7 +2862,7 @@ var SyncClient = class extends EventEmitter {
 		}
 		if (text === null) return false;
 		try {
-			return decoder.decode(bytes) === text;
+			return decoder$1.decode(bytes) === text;
 		} catch {
 			return false;
 		}
@@ -2844,6 +2907,9 @@ var SyncClient = class extends EventEmitter {
 	* now on (I4). A version only written here, still in the outbox, is never confirmed.
 	*/
 	confirm(path, disk) {
+		if (disk !== null) {
+			for (let at = path.lastIndexOf("/"); at > 0; at = path.lastIndexOf("/", at - 1)) if (this.syncsDir(path.slice(0, at))) this.knowDir(path.slice(0, at));
+		}
 		const held = this.confirmed.get(path);
 		if (held === void 0 ? false : held === null ? disk === null : disk !== null && held.hash === disk.hash && (held.text !== void 0 || disk.text === void 0)) return;
 		this.confirmed.set(path, disk);
@@ -2908,7 +2974,7 @@ var SyncClient = class extends EventEmitter {
 		this.tellOnce(`large:${path}:${hash}`, {
 			kind: "skipped-large",
 			path,
-			message: `${path} is larger than ${limit}, so it is not synced and not overwritten; other environments do not see it. ${binary ? "Make it smaller" : "Split it"}, or add it to .mainflow/.gitignore`
+			message: `${path} is larger than ${limit}, so it is not synced and not overwritten; other environments do not see it. ${binary ? "Make it smaller" : "Split it"}, or move it into a scratch/ directory, which is never synced`
 		});
 	}
 	/**
@@ -3065,7 +3131,7 @@ var SyncClient = class extends EventEmitter {
 			const fetched = [];
 			for (const part of parts) for (const event of part.files) {
 				if (event.kind === "dir") {
-					this.receive(event, part.seq);
+					this.receiveDir(event.path, part.seq, false);
 					continue;
 				}
 				mentioned.add(event.path);
@@ -3223,7 +3289,7 @@ var SyncClient = class extends EventEmitter {
 		await this.fetchPaths([path]).catch((error) => this.log(`${path}: could not download it: ${error.message}`));
 	}
 	restoreRemote() {
-		for (const [path, hash] of Object.entries(readRemote(this.root))) if (this.syncs(path) && artifactOf(path) !== null && this.expected.get(path) === void 0) this.remote.set(path, hash);
+		for (const [path, hash] of Object.entries(readRemote(this.dirs))) if (this.syncs(path) && artifactOf(path) !== null && this.expected.get(path) === void 0) this.remote.set(path, hash);
 	}
 	/**
 	* What remote.json lists: the files only on the server, and the artifacts whose download failed and waits for a retry.
@@ -3258,7 +3324,7 @@ var SyncClient = class extends EventEmitter {
 		const listed = this.listedRemote();
 		if (listed.size === 0 && !existsSync(this.paths.remote)) return;
 		try {
-			writeRemote(this.root, Object.fromEntries([...listed].sort(([a], [b]) => comparePaths(a, b))));
+			writeRemote(this.dirs, Object.fromEntries([...listed].sort(([a], [b]) => comparePaths(a, b))));
 		} catch (error) {
 			this.log(`could not save local/sync/remote.json: ${error.message}`);
 		}
@@ -3843,6 +3909,88 @@ var SyncClient = class extends EventEmitter {
 		this.trace(`removal of ${path} changed before it was queued; reconciling it again`);
 		this.schedule(path);
 	}
+	/**
+	* Queue the removal of each directory the client had here that is gone (syncedDirs), with nothing the client knows of
+	* in it: no file the client left there and has not sent the removal of, no write in the outbox of a file there, which
+	* goes first, and no file the server holds there that is not written here yet, nor one only on the server. The
+	* deepest go first, so the server finds the ones in each removed already; one holding anything holds the ones above it
+	* too. Each is checked again in the hold of the write lock that queues it, so a directory made again meanwhile stays.
+	* Only once a snapshot was taken, since what the server holds is unknown before.
+	*/
+	async queueRemovedDirs() {
+		if (!this.synced || this.closing) return;
+		const exists = (dir) => existsSync(join(this.paths.data, dir));
+		const gone = [...this.syncedDirs].filter((dir) => this.syncsDir(dir) && !exists(dir));
+		if (gone.length === 0) return;
+		gone.sort((a, b) => b.split("/").length - a.split("/").length || comparePaths(a, b));
+		const queued = [];
+		await this.whenFree(() => this.editQueue((entries) => {
+			const files = [
+				...[...this.expected].flatMap(([path, disk]) => disk === null ? [] : [path]),
+				...[...this.cloud].flatMap(([path, file]) => file === null ? [] : [path]),
+				...this.remote.keys(),
+				...this.awaiting,
+				...entries.flatMap(entryPaths)
+			];
+			const held = /* @__PURE__ */ new Set();
+			const hold = (dir) => {
+				for (let at = dir.length; at > 0; at = dir.lastIndexOf("/", at - 1)) held.add(dir.slice(0, at));
+			};
+			for (const path of files) hold(path.slice(0, Math.max(0, path.lastIndexOf("/"))));
+			for (const dir of gone) {
+				if (held.has(dir) || exists(dir)) {
+					hold(dir);
+					continue;
+				}
+				if (entries.some((entry) => entry.kind === "rmdir" && entry.path === dir)) continue;
+				entries.push({
+					kind: "rmdir",
+					path: dir,
+					id: entryId()
+				});
+				queued.push(dir);
+			}
+			return queued.length > 0;
+		}));
+		if (queued.length === 0) return;
+		this.log(`queued rmdir ${queued.join(", ")} (${this.queue.length} waiting)`);
+		if (this.online) this.track(this.flushQueue());
+	}
+	/**
+	* Queue the removal of the directories gone here a moment from now, once for every call in that moment; counted as
+	* work under way meanwhile, so idle() waits for it.
+	*/
+	checkDirs() {
+		if (this.closing || this.dirCheck) return;
+		this.dirCheck = this.track(sleep$1(SETTLE_MS).then(() => {
+			this.dirCheck = null;
+			return this.queueRemovedDirs();
+		}).catch((error) => this.log(`directories: ${error.message}`)));
+	}
+	/**
+	* What the server answered to the removal of a directory: removed, or not there, it is known no more. Kept, as when
+	* another environment has just put a file in it, it is made here again, as the server holds it, so it is not sent
+	* again; the file comes as the server's broadcast. Refused, as by a server from before dir.remove (`unknown-operation`),
+	* it is known no more either: the next snapshot makes it here again, as before, rather than it being sent again and again.
+	*/
+	async settleRmdir(entry, answer) {
+		const { path } = entry;
+		const response = answer;
+		this.trace(`response ${path}/ ${response.ok ? response.value : `${response.reason}: ${response.message}`}`);
+		if (!response.ok) {
+			this.forgetDir(path);
+			this.dirSeq.delete(path);
+			this.info(path, `the directory was removed here and the sync server did not remove it (${response.message}); it comes back with the next snapshot`);
+			return;
+		}
+		if (response.value === "kept") {
+			for (const notice of response.notices) this.info(notice.path, `${notice.message} (removed here; the directory is back)`);
+			await this.whenFree(() => this.locked(() => mkdirSync(join(this.paths.data, path), { recursive: true })));
+			return;
+		}
+		this.forgetDir(path);
+		if (response.files.length > 0) await this.delivery(path, response.seq);
+	}
 	async settleRemove(entry, response) {
 		const { path } = entry;
 		if (!response.ok) return this.refuse(entry, [{
@@ -3920,7 +4068,7 @@ var SyncClient = class extends EventEmitter {
 			hash: entry.hash,
 			blob: true
 		});
-		else this.expected.set(entry.path, null);
+		else if (entry.kind === "remove") this.expected.set(entry.path, null);
 	}
 	/**
 	* Hold the write lock for `fn`; work stop() abandoned gets an error ('abandoned after stop') instead, so it leaves
@@ -3929,7 +4077,7 @@ var SyncClient = class extends EventEmitter {
 	*/
 	locked(fn) {
 		if (this.abandoned) throw new Error("abandoned after stop");
-		return underLock(this.root, fn);
+		return underLock(this.dirs, fn);
 	}
 	/**
 	* Change the outbox: read queue.json, take in the entries other writers appended since it was last read, let `edit`
@@ -3944,7 +4092,7 @@ var SyncClient = class extends EventEmitter {
 	}
 	/** editQueue for a caller that holds the write lock already. */
 	editHeld(edit) {
-		const entries = readQueue(this.root);
+		const entries = readQueue(this.dirs);
 		const known = new Set(this.queue.map((entry) => entry.id));
 		let changed = false;
 		const fresh = [];
@@ -3968,7 +4116,7 @@ var SyncClient = class extends EventEmitter {
 			this.resolveBases(entries);
 		}
 		if (changed) {
-			writeQueue(this.root, entries);
+			writeQueue(this.dirs, entries);
 			this.pruneStaged(entries);
 		}
 		this.queue = entries;
@@ -4166,6 +4314,8 @@ var SyncClient = class extends EventEmitter {
 	async sendOutbox() {
 		this.flushing = true;
 		try {
+			const held = this.heldUntil - Date.now();
+			if (held > 0) return this.retryQueue(held);
 			while (this.caughtUp) {
 				let entry;
 				let wake;
@@ -4379,7 +4529,7 @@ var SyncClient = class extends EventEmitter {
 			if (at < 0) return false;
 			entries.splice(at, 1);
 			for (const later of entries.slice(at)) {
-				if (later.kind === "op" || later.path !== entry.path || later.sent !== void 0 || later.base !== entry.hash) continue;
+				if (later.kind === "op" || later.kind === "rmdir" || later.path !== entry.path || later.sent !== void 0 || later.base !== entry.hash) continue;
 				if (later.kind === "remove" && entry.base === null) continue;
 				later.base = entry.base;
 			}
@@ -4422,6 +4572,7 @@ var SyncClient = class extends EventEmitter {
 		this.renumbering.delete(entry.id);
 		if (renumbered) this.log(`renumbered ${renumbered.map((r) => `${r.from} → ${r.to}`).join(", ")}`);
 		for (const path of entryPaths(entry)) this.schedule(path);
+		if (entry.kind !== "rmdir") this.checkDirs();
 		this.emit("settled", entry.id);
 	}
 	/**
@@ -4489,12 +4640,31 @@ var SyncClient = class extends EventEmitter {
 		} catch (error) {
 			if (!(error instanceof Unreachable)) throw error;
 			this.trace(`send ${entry.id} failed: ${error.message}`);
+			if (error instanceof HubRewritingError) {
+				this.heldUntil = Date.now() + error.retryAfter * 1e3;
+				this.log(`${error.message}; the outbox is sent again in ${error.retryAfter} s`);
+				return null;
+			}
+			if (error instanceof ClientOutdatedError) {
+				this.heldUntil = Date.now() + error.retryAfter * 1e3;
+				if (error.message !== this.outdatedMessage) {
+					const paths = entryPaths(entry);
+					this.problem({
+						kind: "client-outdated",
+						path: paths[0] ?? "",
+						message: `${error.message}. ${request.op}${paths.length ? ` of ${paths.join(", ")}` : ""} and the writes after it wait in the outbox, sent again every ${error.retryAfter} s until then`
+					});
+				}
+				this.outdatedMessage = error.message;
+				return null;
+			}
 			if (error.broken && !fresh && !this.closing) return this.request(entry, request, true, true);
 			return null;
 		}
+		this.outdatedMessage = null;
 		if (!response.ok && response.reason === "uncertain") {
 			const paths = entryPaths(entry);
-			this.problem({
+			if (entry.kind !== "rmdir") this.problem({
 				kind: "uncertain",
 				path: paths[0] ?? "",
 				message: `${request.op} of ${paths.join(", ")} was sent before without an answer, and the sync server no longer keeps its answers from then (${response.message}); it is sent again as a new request and may apply twice, so check the result for a duplicate`
@@ -4505,8 +4675,8 @@ var SyncClient = class extends EventEmitter {
 	}
 	/**
 	* The request an outbox entry sends, made when it is first sent, from the entry alone: an operation on the current
-	* protocol, a deletion with the time it is first sent, an Edit's replacement to be made again on the server's latest
-	* version, an edit as patchRequest makes it. Null for an edit that cannot be sent: its base is a write the server
+	* protocol, a deletion with the time it is first sent, a directory's removal, an Edit's replacement to be made again on
+	* the server's latest version, an edit as patchRequest makes it. Null for an edit that cannot be sent: its base is a write the server
 	* refused or did not take as it was, so its base never became known, or moving it onto the server's merge overlaps.
 	* Every write ahead of it was answered, so a base still unknown never will be.
 	*/
@@ -4529,6 +4699,11 @@ var SyncClient = class extends EventEmitter {
 			size: entry.size,
 			base: entry.base
 		};
+		if (entry.kind === "rmdir") return {
+			protocol: 3,
+			op: "dir.remove",
+			path: entry.path
+		};
 		if (entry.replace) return {
 			protocol: 3,
 			op: "text.replace",
@@ -4675,6 +4850,7 @@ var SyncClient = class extends EventEmitter {
 				last: entry.replaced
 			}, request.text);
 			else if (entry.kind === "blob") await this.settleBlob(entry, response);
+			else if (entry.kind === "rmdir") await this.settleRmdir(entry, response);
 			return true;
 		} finally {
 			for (const path of paths) {
@@ -4785,7 +4961,7 @@ var SyncClient = class extends EventEmitter {
 	*/
 	renumberDisk(paths, renumbered) {
 		const storage = {
-			...nodeStorage(this.root),
+			...nodeStorage(this.dirs),
 			lock: (fn) => fn()
 		};
 		const seen = new Map([...new Set(paths)].filter((path) => this.syncs(path)).map((path) => [path, this.expected.get(path)]));
@@ -4827,6 +5003,26 @@ var SyncClient = class extends EventEmitter {
 				text
 			});
 		}
+		for (const path of [...seen.keys(), ...binary.map(([path]) => path)]) this.pruneMoved(path, renumberPath(path, renumbered));
+	}
+	/**
+	* Remove the directories above `from` that its move to `to` emptied, the deepest first, up to the first one that still
+	* holds anything or is above `to` as well. One the server holds goes on the server too, as any directory gone here
+	* (queueRemovedDirs). It does not take the write lock: its caller holds it.
+	*/
+	pruneMoved(from, to) {
+		if (from === to) return;
+		for (let at = from.lastIndexOf("/"); at > 0; at = from.lastIndexOf("/", at - 1)) {
+			const dir = from.slice(0, at);
+			if (to.startsWith(`${dir}/`)) return;
+			try {
+				if (!this.removeEmptyDir(dir)) return;
+			} catch (error) {
+				this.log(`${dir}/: could not remove it after renumbering: ${error.message}`);
+				return;
+			}
+			this.trace(`dir ${dir} emptied by renumbering, removed here`);
+		}
 	}
 	commit(storage, changes) {
 		for (const change of changes) if (change.kind === "write") storage.write(change.path, change.text);
@@ -5098,16 +5294,9 @@ var SyncClient = class extends EventEmitter {
 		}]);
 		if ("files" in response && response.files.some((f) => f.path === path)) await this.delivery(path, response.seq);
 	}
-	/**
-	* The synced files here, by path. Each directory's .gitignore is read again on the way, before what the directory
-	* holds, so a change to one takes effect from the next scan on; a directory the rules leave out is not walked into.
-	* Rules changed since the last snapshot was asked for take it again: a file they let in that is on the server, as
-	* another environment sent it while the rules here left it out, comes then, not only on the next connection. A walk
-	* of a snapshot being taken leaves that to it (resync).
-	*/
+	/** The synced files here, by path: a walk into the directories that may hold them alone (src/paths.ts). */
 	async walk() {
 		const out = [];
-		const dirs = /* @__PURE__ */ new Set();
 		const visit = async (dir) => {
 			let entries;
 			try {
@@ -5115,51 +5304,31 @@ var SyncClient = class extends EventEmitter {
 			} catch {
 				return;
 			}
-			dirs.add(dir);
-			this.scope.set(dir, entries.some((entry) => entry.name === ".gitignore" && entry.isFile()) ? await this.readRules(dir) : null);
 			for (const entry of entries) {
 				const path = dir ? `${dir}/${entry.name}` : entry.name;
 				if (entry.isDirectory()) {
-					if (this.scope.walks(path)) await visit(path);
+					if (mayHoldSynced(path)) await visit(path);
 				} else if (entry.isFile() && this.syncs(path)) out.push(path);
 			}
 		};
 		await visit("");
-		this.scope.keepOnly(dirs);
-		if (this.scopeStale && this.synced && this.connected && this.resyncing === null && !this.closing) {
-			this.log("the hub's .gitignore changed; reloading the snapshot for the files it lets in");
-			this.track(this.resync().catch((error) => this.log(`could not reload the snapshot: ${error.message}`)));
-		}
 		return out;
 	}
-	/**
-	* The text of the .gitignore in `dir`, which is there, as walk takes it. A text other than the rules have may be one
-	* being written, as `cat >` empties a file before it fills it, and a rule missing for a moment would let its files in,
-	* to be sent: it is read again after EMPTY_RECHECK_MS and taken only when it reads the same, empty too. Until then, and
-	* while the file cannot be read, the rules stay as they were; the next walk reads it again.
-	*/
-	async readRules(dir) {
-		const held = this.scope.text(dir);
-		const read = () => readFile(join(this.paths.data, dir, GITIGNORE), "utf8").catch(() => null);
-		const text = await read();
-		if (text === null || text === held) return held;
-		await sleep$1(EMPTY_RECHECK_MS);
-		return await read() === text ? text : held;
-	}
-	/** The directories an upload holds: every one outside local/ that the hub's .gitignore files leave in. */
+	/** The directories an upload holds: every synced one (syncsDir) outside local/. */
 	async walkDirs(dir = "") {
 		const out = [];
 		const entries = await readdir(join(this.paths.data, dir), { withFileTypes: true }).catch(() => []);
 		for (const entry of entries) {
 			const path = dir ? `${dir}/${entry.name}` : entry.name;
-			if (!entry.isDirectory() || path === "local" || path.startsWith("local/") || this.scope.ignored(path, true)) continue;
+			if (!entry.isDirectory() || path === "local" || !this.syncsDir(path)) continue;
 			out.push(path, ...await this.walkDirs(path));
 		}
 		return out;
 	}
 	/**
 	* Compare every synced file's size, modification time and inode with the last scan and reconcile what changed,
-	* plus every file expected on disk that is gone. A file modified in the last moment may still be being written,
+	* plus every file expected on disk that is gone, and queue the removal of the directories gone here
+	* (queueRemovedDirs). A file modified in the last moment may still be being written,
 	* so it waits for the next scan unless `immediate`. `baseline` only records what is there. An immediate scan waits for
 	* the reconciles it started unless `settle` is false, for a caller that waits for them itself (flushTool).
 	*/
@@ -5180,6 +5349,7 @@ var SyncClient = class extends EventEmitter {
 			this.signatures.delete(path);
 			this.schedule(path);
 		}
+		await this.queueRemovedDirs();
 		if (settle) await Promise.allSettled(this.chains.values());
 	}
 	/**
@@ -5197,13 +5367,13 @@ var SyncClient = class extends EventEmitter {
 				}, SETTLE_MS));
 				return;
 			}
-			const rules = path === ".gitignore" || path.endsWith(`/.gitignore`);
-			if (!rules && !this.syncs(path)) return;
+			if (this.syncedDirs.has(path)) this.checkDirs();
+			if (!this.syncs(path)) return;
 			this.trace(`watched ${path}`);
 			clearTimeout(timers.get(path));
 			timers.set(path, setTimeout(() => {
 				timers.delete(path);
-				this.track(this.whenSettled(path).then(() => rules ? this.scan(true) : this.schedule(path)));
+				this.track(this.whenSettled(path).then(() => this.schedule(path)));
 			}, SETTLE_MS));
 		};
 		try {
@@ -5296,13 +5466,18 @@ var SyncClient = class extends EventEmitter {
 		for (const [path, disk] of this.confirmed) if (disk) files[path] = disk.blob ? { hash: `${BLOB_PREFIX}${disk.hash}` } : disk;
 		return files;
 	}
+	/** The directories known.json names (syncedDirs), in path order. */
+	knownDirs() {
+		return [...this.syncedDirs].sort(comparePaths);
+	}
 	saveKnownNow(final = false) {
 		if (this.abandoned && !final) return;
 		clearTimeout(this.knownTimer);
 		this.knownTimer = void 0;
 		const files = this.knownFiles();
+		const dirs = this.knownDirs();
 		try {
-			underLock(this.root, () => writeKnown(this.root, files));
+			underLock(this.dirs, () => writeKnown(this.dirs, files, dirs));
 		} catch (error) {
 			this.log(`could not save local/sync/known.json: ${error.message}`);
 		}
@@ -5312,8 +5487,8 @@ var SyncClient = class extends EventEmitter {
 //#region ../sync/dist/ipc.js
 const SECRET_HEADER = "x-mainflow-sync";
 /** The running sync client of the hub at `root`, or null when none runs. */
-function readDaemon(root) {
-	const file = syncPaths(root).daemon;
+function readDaemon(dirs) {
+	const file = syncPaths(dirs).daemon;
 	if (!existsSync(file)) return null;
 	try {
 		const info = JSON.parse(readFileSync(file, "utf8"));
@@ -5366,8 +5541,8 @@ async function callDaemon(daemon, route, body, timeoutMs = 6e4) {
 /** How long a probe waits for the sync client's answer; a client holding the write lock answers after it. */
 const PROBE_MS = 2e3;
 /** The sync client daemon.json names, asked whether it runs; null without daemon.json or a live process at its pid. */
-async function probeDaemon(root, timeoutMs = PROBE_MS) {
-	const daemon = readDaemon(root);
+async function probeDaemon(dirs, timeoutMs = PROBE_MS) {
+	const daemon = readDaemon(dirs);
 	if (!daemon) return null;
 	try {
 		return {
@@ -5393,9 +5568,9 @@ const sameDaemon = (a, b) => a !== null && a.pid === b.pid && a.port === b.port
 * Remove daemon.json when it still says what `gone` said, under the write lock, so a sync client that claimed the hub
 * meanwhile keeps it. Call holding the lock.
 */
-function forgetDaemon(root, gone) {
-	if (!sameDaemon(readDaemon(root), gone)) return false;
-	rmSync(syncPaths(root).daemon, { force: true });
+function forgetDaemon(dirs, gone) {
+	if (!sameDaemon(readDaemon(dirs), gone)) return false;
+	rmSync(syncPaths(dirs).daemon, { force: true });
 	return true;
 }
 /** The Edit a request's body names, its file and its one replacement, or null. */
@@ -5419,7 +5594,7 @@ function callIn(body) {
 	};
 }
 /** Serve `client` to this machine's mainflow commands until closed. */
-async function serveIpc(root, client) {
+async function serveIpc(dirs, client) {
 	const secret = randomBytes(16).toString("hex");
 	const server = createServer(async (req, res) => {
 		const reply = (status, value) => res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(value));
@@ -5466,13 +5641,13 @@ async function serveIpc(root, client) {
 	});
 	await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
 	const port = server.address().port;
-	const file = syncPaths(root).daemon;
-	const probe = await probeDaemon(root);
-	const other = underLock(root, () => {
-		const running = readDaemon(root);
+	const file = syncPaths(dirs).daemon;
+	const probe = await probeDaemon(dirs);
+	const other = underLock(dirs, () => {
+		const running = readDaemon(dirs);
 		const reused = running !== null && probe?.state === "gone" && sameDaemon(running, probe.daemon);
 		if (running && running.pid !== process.pid && !reused) return running;
-		mkdirSync(syncPaths(root).own, { recursive: true });
+		mkdirSync(syncPaths(dirs).own, { recursive: true });
 		writeFileSync(file, JSON.stringify({
 			pid: process.pid,
 			port,
@@ -5500,7 +5675,7 @@ async function serveIpc(root, client) {
 //#region ../sync/dist/daemon.js
 async function startDaemon(options) {
 	const client = new SyncClient(options);
-	const ipc = await serveIpc(options.root, client);
+	const ipc = await serveIpc(options.dirs, client);
 	try {
 		await client.start();
 	} catch (error) {
@@ -5544,11 +5719,11 @@ const FETCH_TOOLS = /* @__PURE__ */ new Set([
 	"MultiEdit"
 ]);
 /** The file of the hub at `root` that `payload` names in file_path, relative to .mainflow/; null outside it. */
-function hubPath(root, payload) {
+function hubPath(dirs, payload) {
 	const input = payload.tool_input ?? {};
 	if (typeof input.file_path !== "string") return null;
 	const file = isAbsolute(input.file_path) ? input.file_path : resolve(payload.cwd ?? process.cwd(), input.file_path);
-	const path = relative(join(root, DATA_DIR), file).split(sep).join("/");
+	const path = relative(dirs.data, file).split(sep).join("/");
 	if (path.startsWith("../") || path === ".." || isAbsolute(path)) return null;
 	return path;
 }
@@ -5570,11 +5745,11 @@ function editOf(path, payload) {
 * needs nothing; an Edit of one replacement is replayed on the latest version; another file tool names the file it
 * wrote; anything else, such as a Bash command that may have written any file, rescans every file and names none.
 */
-function planFlush(root, payload) {
+function planFlush(dirs, payload) {
 	const tool = payload.tool_name ?? "";
 	if (!FILE_TOOLS.has(tool)) return { skip: false };
 	if (typeof (payload.tool_input ?? {}).file_path !== "string") return { skip: false };
-	const path = hubPath(root, payload);
+	const path = hubPath(dirs, payload);
 	if (path === null || !isSynced(path)) return { skip: true };
 	const edit = editOf(path, payload);
 	return edit ? {
@@ -5602,11 +5777,11 @@ function hookAnswer(result) {
 * What to download before the tool in `payload` runs in the hub at `root`: the artifact it reads or writes, when the file
 * is not here, so it may be only on the sync server. Null for anything else, which needs nothing.
 */
-function planFetch(root, payload) {
+function planFetch(dirs, payload) {
 	const tool = payload.tool_name ?? "";
 	if (!FETCH_TOOLS.has(tool)) return null;
-	const path = hubPath(root, payload);
-	if (path === null || !isSynced(path) || artifactOf(path) === null || existsSync(join(root, ".mainflow", path))) return null;
+	const path = hubPath(dirs, payload);
+	if (path === null || !isSynced(path) || artifactOf(path) === null || existsSync(join(dirs.data, path))) return null;
 	return {
 		path,
 		write: tool !== "Read"
@@ -5617,8 +5792,8 @@ function planFetch(root, payload) {
 * change then waits for the Edit's PostToolUse report (docs/sync.md "等 Edit 的回報"). Null for anything else, which
 * announces nothing: a change no Edit announced is sent at once.
 */
-function planAnnounce(root, payload) {
-	const path = hubPath(root, payload);
+function planAnnounce(dirs, payload) {
+	const path = hubPath(dirs, payload);
 	if (path === null || !isSynced(path)) return null;
 	const edit = editOf(path, payload);
 	return edit && edit.old !== "" ? edit : null;
@@ -5630,10 +5805,53 @@ const fetchDenial = (reason) => JSON.stringify({ hookSpecificOutput: {
 	permissionDecisionReason: `mainflow sync: ${reason}`
 } });
 //#endregion
+//#region ../sync/dist/oversized.js
+const decoder = new TextDecoder("utf-8", { fatal: true });
+/** The synced files under `data`, the hub's .mainflow/, by path: a walk into the directories that may hold them alone. */
+function syncedFiles(data) {
+	const files = [];
+	const visit = (dir) => {
+		let entries;
+		try {
+			entries = readdirSync(join(data, dir), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const path = dir ? `${dir}/${entry.name}` : entry.name;
+			if (entry.isDirectory()) {
+				if (mayHoldSynced(path)) visit(path);
+			} else if (entry.isFile() && isSynced(path)) files.push(path);
+		}
+	};
+	visit("");
+	return files;
+}
+/**
+* The synced files of the hub at `root` larger than the sync server keeps (MAX_FILE_BYTES): UTF-8 text of the sync
+* scope. The sync client leaves them out of sync; `mainflow check` warns of them.
+*/
+function oversizedFiles(dirs) {
+	const data = dirs.data;
+	const out = [];
+	for (const path of syncedFiles(data)) {
+		const file = join(data, path);
+		try {
+			if (statSync(file).size <= 19e5) continue;
+			const bytes = textBytes(decoder.decode(readFileSync(file)));
+			if (bytes > 19e5) out.push({
+				path,
+				bytes
+			});
+		} catch {}
+	}
+	return out;
+}
+//#endregion
 //#region ../sync/dist/outbox.js
 /** Whether the hub at `root` writes through the sync server. */
-function remoteMode(root, env = process.env) {
-	return readDaemon(root) !== null || syncSettings(root, env) !== null;
+function remoteMode(dirs, env = process.env) {
+	return readDaemon(dirs) !== null || syncSettings(dirs, env) !== null;
 }
 /** Refusals of an operation by the local files, as opposed to a write lock held too long; thrown as they are. */
 const refusals = /* @__PURE__ */ new WeakSet();
@@ -5644,8 +5862,8 @@ const refusedHere = (error) => error instanceof Error && refusals.has(error);
 * client reads the outbox under the same lock, so it never sees the files this changed without the entry that
 * explains them, and never takes them for an edit to send. A refusal here is thrown, and nothing is queued.
 */
-function queueOperation(root, request) {
-	const storage = nodeStorage(root);
+function queueOperation(dirs, request) {
+	const storage = nodeStorage(dirs);
 	return storage.lock(() => {
 		const before = {};
 		const keep = (path) => {
@@ -5669,7 +5887,7 @@ function queueOperation(root, request) {
 		const written = {};
 		for (const change of result.changes) if (change.kind !== "makeDir" && isSynced(change.path)) written[change.path] = held.read(change.path);
 		const id = entryId();
-		writeQueue(root, [...readQueue(root), {
+		writeQueue(dirs, [...readQueue(dirs), {
 			id,
 			kind: "op",
 			request: pending,
@@ -5683,8 +5901,8 @@ function queueOperation(root, request) {
 	});
 }
 /** How many writes wait in the outbox for the server, as queue.json says: not the ones it refused (src/state.ts). */
-function queuedCount(root) {
-	const file = syncPaths(root).queue;
+function queuedCount(dirs) {
+	const file = syncPaths(dirs).queue;
 	if (!existsSync(file)) return 0;
 	try {
 		return (JSON.parse(readFileSync(file, "utf8")).entries ?? []).filter(waiting).length;
@@ -5700,8 +5918,8 @@ const NOTIFY_MS = 200;
 * the server's answer, such as a hook or the interface. Without a sync client, or one that does not answer, nothing
 * happens: the client's watcher of queue.json and its rescan find the entry, a moment later.
 */
-async function notifyQueued(root) {
-	const daemon = readDaemon(root);
+async function notifyQueued(dirs) {
+	const daemon = readDaemon(dirs);
 	if (!daemon) return;
 	try {
 		await callDaemon(daemon, "/send", {}, NOTIFY_MS);
@@ -5711,12 +5929,12 @@ async function notifyQueued(root) {
 * Ask the sync client what became of entry `id`, giving it up to `timeoutMs`. A sync client that is still starting is
 * waited for. `waiting` when it is offline, or the time ran out first.
 */
-async function awaitOutcome(root, id, timeoutMs) {
+async function awaitOutcome(dirs, id, timeoutMs) {
 	const deadline = Date.now() + timeoutMs;
 	for (;;) {
 		const left = deadline - Date.now();
 		if (left <= 0) return { state: "waiting" };
-		const daemon = readDaemon(root);
+		const daemon = readDaemon(dirs);
 		if (daemon) try {
 			return await callDaemon(daemon, "/wait", {
 				id,
@@ -5729,6 +5947,54 @@ async function awaitOutcome(root, id, timeoutMs) {
 	}
 }
 //#endregion
+//#region src/version-gate.ts
+const INVALID_RANGE = "mainflow in .mainflow/config.yaml is not a valid semver range, so the mainflow version is not checked; run \"mainflow check\" for details";
+const READ_ENDING = "; writes will be refused until then";
+/**
+* Compare this CLI's version with the mainflow versions the hub's config.yaml takes writes from. A write outside the
+* range is refused; a read is warned about. A `mainflow` that is no range is only warned about, whatever the command,
+* since core reads it as no limit so that a typo does not shut every writer out. A hub that names no range, has no
+* readable config.yaml or takes this version is not checked. The comparison is core's versionMismatch, the one the
+* sync server makes, and its message carries upgradeCommand.
+*/
+function versionGate(dirs, version, command) {
+	let requirements;
+	try {
+		requirements = hubRequirements(nodeStorage(dirs));
+	} catch {
+		return { kind: "run" };
+	}
+	if (requirements?.mainflowInvalid) return {
+		kind: "warn",
+		message: INVALID_RANGE
+	};
+	if (!requirements?.mainflow) return { kind: "run" };
+	if (command.writes) {
+		const message = versionMismatch(requirements.mainflow, version);
+		return message === null ? { kind: "run" } : {
+			kind: "refuse",
+			message
+		};
+	}
+	const message = versionMismatch(requirements.mainflow, version, READ_ENDING);
+	return message === null ? { kind: "run" } : {
+		kind: "warn",
+		message
+	};
+}
+/**
+* The checkpoint of every write that goes through the writer (the commands, the interface, the hooks): throws a
+* WriteError when `version` is outside the range the hub takes writes from, and warns on stderr about a range that is
+* no range. A hook's write is not checked (`hook`), since a hook has to answer the host whatever the version; the
+* `hook` command itself warns once before it runs.
+*/
+function requireWritableVersion(dirs, version, options = {}) {
+	if (options.hook) return;
+	const verdict = versionGate(dirs, version, { writes: true });
+	if (verdict.kind === "refuse") throw new WriteError(`refusing to write: ${verdict.message}`);
+	if (verdict.kind === "warn") console.error(`! ${verdict.message}`);
+}
+//#endregion
 //#region src/remote/start.ts
 /** How long a sync client started in the background may take to claim the hub, its first request to the server included. */
 const STARTING_MS = 6e4;
@@ -5745,10 +6011,10 @@ const alive = (pid) => {
 * none. `env` gives the sync server and service token as the environment variables do; for a hub other than the one this
 * process was started in it is `{}`, so the process started reads that hub's own .mainflow/local/sync.json.
 */
-async function startSyncInBackground(root, env = process.env) {
-	const probe = await probeDaemon(root);
+async function startSyncInBackground(dirs, env = process.env) {
+	const probe = await probeDaemon(dirs);
 	if (probe && probe.state !== "gone") return { state: "running" };
-	const paths = syncPaths(root);
+	const paths = syncPaths(dirs);
 	const cli = process.argv[1];
 	if (process.env.MAINFLOW_NO_BACKGROUND_SYNC === "1") return {
 		state: "failed",
@@ -5758,10 +6024,10 @@ async function startSyncInBackground(root, env = process.env) {
 		state: "failed",
 		reason: "this process cannot tell where the mainflow CLI is"
 	};
-	const log = relative(root, paths.log);
-	return nodeStorage(root).lock(() => {
-		const reused = probe?.state === "gone" && forgetDaemon(root, probe.daemon) ? probe.daemon.pid : void 0;
-		if (reused === void 0 && readDaemon(root)) return { state: "starting" };
+	const log = paths.log;
+	return nodeStorage(dirs).lock(() => {
+		const reused = probe?.state === "gone" && forgetDaemon(dirs, probe.daemon) ? probe.daemon.pid : void 0;
+		if (reused === void 0 && readDaemon(dirs)) return { state: "starting" };
 		let previous = null;
 		try {
 			previous = existsSync(paths.started) ? JSON.parse(readFileSync(paths.started, "utf8")) : null;
@@ -5775,7 +6041,7 @@ async function startSyncInBackground(root, env = process.env) {
 		let pid;
 		try {
 			const child = spawn(process.execPath, [cli, "sync"], {
-				cwd: root,
+				cwd: dirs.root,
 				detached: true,
 				stdio: [
 					"ignore",
@@ -5817,8 +6083,8 @@ async function startSyncInBackground(root, env = process.env) {
 /** Added to a write the local files refused, unless the sync client runs with the server's latest state. */
 const STALE_COPY = "the local copy may not have caught up with the sync server yet; retry once mainflow sync has caught up (mainflow sync status)";
 /** Whether the hub's sync client runs and has the server's latest state, asked with a short wait. */
-async function caughtUp(root) {
-	const daemon = readDaemon(root);
+async function caughtUp(dirs) {
+	const daemon = readDaemon(dirs);
 	if (!daemon) return false;
 	try {
 		return (await callDaemon(daemon, "/status", void 0, 2e3)).caughtUp === true;
@@ -5844,29 +6110,30 @@ function writtenLines(written) {
 * other than the one this process was started in, such as another hub the interface shows, passes `{}`, so only its
 * own .mainflow/local/sync.json and sync client count.
 */
-function hubWriter(root, env = process.env, options = {}) {
+function hubWriter(dirs, env = process.env, options = {}) {
 	const startSync = options.startSync ?? startSyncInBackground;
 	return async (op, input) => {
-		if (!remoteMode(root, env)) return {
-			value: applyOperation(nodeStorage(root), op, input, { now: nowMinute() }).value,
+		requireWritableVersion(dirs, CLI_VERSION, { hook: options.hook });
+		if (!remoteMode(dirs, env)) return {
+			value: applyOperation(nodeStorage(dirs), op, input, { now: nowMinute() }).value,
 			queued: false,
 			renumbered: [],
 			notices: []
 		};
 		let queuedOp;
 		try {
-			queuedOp = queueOperation(root, {
+			queuedOp = queueOperation(dirs, {
 				protocol: 3,
 				op,
 				input,
 				now: requestTime()
 			});
 		} catch (error) {
-			if (refusedHere(error) && !await caughtUp(root)) error.message += `; ${STALE_COPY}`;
+			if (refusedHere(error) && !await caughtUp(dirs)) error.message += `; ${STALE_COPY}`;
 			throw error;
 		}
 		const { id, result } = queuedOp;
-		const start = await startSync(root, env);
+		const start = await startSync(dirs, env);
 		const queued = {
 			value: result.value,
 			queued: true,
@@ -5879,10 +6146,10 @@ function hubWriter(root, env = process.env, options = {}) {
 			stopped: `mainflow sync is not running (${start.reason}); the write waits in .mainflow/local/sync/queue.json until it runs`
 		};
 		if (options.confirmMs === void 0) {
-			await notifyQueued(root);
+			await notifyQueued(dirs);
 			return queued;
 		}
-		const outcome = await awaitOutcome(root, id, options.confirmMs);
+		const outcome = await awaitOutcome(dirs, id, options.confirmMs);
 		if (outcome.state === "applied") {
 			const { response } = outcome;
 			return {
@@ -5902,4 +6169,4 @@ function hubWriter(root, env = process.env, options = {}) {
 	};
 }
 //#endregion
-export { isSynced as A, ServerError as C, syncSettings as D, hubName as E, SETTINGS_FILE as O, ServerApi as S, earlierToken as T, readDaemon as _, remoteMode as a, readRemote as b, planAnnounce as c, toolCallOf as d, startDaemon as f, probeDaemon as g, callDaemon as h, queuedCount as i, syncPaths as j, SYNC_DIR as k, planFetch as l, DaemonUnavailable as m, hubWriter as n, fetchDenial as o, DaemonRunning as p, writtenLines as r, hookAnswer as s, CONFIRM_MS as t, planFlush as u, silentHint as v, ENV as w, oversizedFiles as x, watchTree as y };
+export { hubName as A, readRemote as C, Unreachable as D, ServerError as E, syncPaths as F, SETTINGS_FILE as M, SYNC_DIR as N, ENV as O, isSynced as P, watchTree as S, ServerApi as T, DaemonUnavailable as _, versionGate as a, readDaemon as b, oversizedFiles as c, planAnnounce as d, planFetch as f, DaemonRunning as g, startDaemon as h, requireWritableVersion as i, syncSettings as j, earlierToken as k, fetchDenial as l, toolCallOf as m, hubWriter as n, queuedCount as o, planFlush as p, writtenLines as r, remoteMode as s, CONFIRM_MS as t, hookAnswer as u, callDaemon as v, HubRewritingError as w, silentHint as x, probeDaemon as y };