mainflow 0.42.0 → 0.43.0-alpha.2

package/dist/{operation-2wx2ex6x.js → operation-BhBbGauo.js}

@@ -1,4 +1,5 @@
-import { At as WriteError, B as renumberRequest, G as applyOperation, H as renumberPath, Mt as splitFrontMatter, Ot as ConflictError, U as renumberText, V as renumberFiles, W as scopeOfPath, _t as readsAsText, at as nowMinute, ct as nodeStorage, dt as MAX_BLOB_BYTES, ft as MAX_FILE_BYTES, gt as exceedsFileLimit, ht as comparePaths, jt as contentHash, kt as DATA_DIR, lt as ACCESS_HEADERS, mt as SOCKET_MAX_AGE_CLOSE, pt as ROUTES, ut as BLOB_HASH, vt as requestTime, yt as textBytes, z as applyOffline } from "./host-BAMZmRy8.js";
+import { $t as WriteError, B as applyOffline, Bt as registeredName, Ct as readsAsText, G as scopeOfPath, Gt as nodeStorage, H as renumberFiles, J as syncedDir, K as hubDigest, Ot as hubRequirements, St as exceedsFileLimit, Tt as textBytes, U as renumberPath, V as renumberRequest, W as renumberText, X as applyOperation, Y as syncedPath, Zt as ConflictError, _t as MAX_FILE_BYTES, bt as VERSION_HEADER, en as contentHash, ht as MAX_BLOB_BYTES, kt as versionMismatch, mt as BLOB_HASH, pt as ACCESS_HEADERS, q as mayHoldSynced, tn as splitFrontMatter, ut as nowMinute, vt as ROUTES, wt as requestTime, xt as comparePaths, yt as SOCKET_MAX_AGE_CLOSE } from "./host-BJvqZy-i.js";
+import { t as CLI_VERSION } from "./version-Dvv4jwF1.js";
 import { createHash, randomBytes } from "node:crypto";
 import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -15,14 +16,13 @@ import { EventEmitter } from "node:events";
 import { COPYFILE_EXCL } from "node:constants";
 import { appendFile, mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { diff3Merge } from "node-diff3";
-import ignore from "ignore";
 //#region ../sync/dist/paths.js
 /** The sync client's own directory, inside local/ so it is neither synced nor committed. */
 const SYNC_DIR = "local/sync";
 /** The settings a machine keeps instead of the environment variables: { url, clientId, clientSecret }. Never synced or committed. */
 const SETTINGS_FILE = "local/sync.json";
-const syncPaths = (root) => {
-	const data = join(root, DATA_DIR);
+const syncPaths = (dirs) => {
+	const data = dirs.data;
 	const own = join(data, SYNC_DIR);
 	return {
 		data,
@@ -50,27 +50,8 @@ const syncPaths = (root) => {
 		log: join(own, "sync.log")
 	};
 };
-/** Names programs leave behind while writing: editor swap and backup files, temporary files, Finder's. */
-const TRANSIENT = [
-	/\.tmp$/,
-	/\.sw[a-p]$/,
-	/\.swx$/,
-	/~$/,
-	/^\.#/,
-	/^4913$/,
-	/\.crswap$/,
-	/^\.DS_Store$/
-];
-/** Whether a file at `path` (relative to .mainflow/) is synced. */
-function isSynced(path) {
-	const parts = path.split("/");
-	if (parts.some((part) => part === "" || part === "." || part === "..")) return false;
-	if (parts[0] === "local" && !(parts[1] === "sessions" && parts.length === 3)) return false;
-	const name = parts.at(-1);
-	return !TRANSIENT.some((pattern) => pattern.test(name));
-}
-/** Whether the directory at `path` may hold synced files, so a scan walks into it. */
-const mayHoldSynced = (path) => path !== "local" ? !path.startsWith("local/") || path === "local/sessions" : true;
+/** Whether a file at `path` (relative to .mainflow/) is synced (syncedPath in the core package). */
+const isSynced = syncedPath;
 /**
 * Whether the client's file watcher watches inside the directory at `path`: one that may hold synced files, and
 * local/sync/ itself for the outbox; the directories under local/sync/ hold only the client's own files.
@@ -89,22 +70,30 @@ const ENV = {
 	clientSecret: "MAINFLOW_SYNC_CLIENT_SECRET",
 	onDemand: "MAINFLOW_SYNC_ON_DEMAND"
 };
-/** The values of MAINFLOW_SYNC_ON_DEMAND that turn it on; any other value that is not empty turns it off. */
+/** The values of MAINFLOW_SYNC_ON_DEMAND that keep it on; any other value that is not empty (such as 0) turns it off. */
 const ON = /* @__PURE__ */ new Set([
 	"1",
 	"true",
 	"on"
 ]);
-/** The hub's name as config.yaml gives it. */
-function hubName(root) {
-	const config = parse$1(readFileSync(join(root, DATA_DIR, "config.yaml"), "utf8"));
-	if (typeof config?.hub !== "string") throw new Error(`${join(root, DATA_DIR, "config.yaml")} names no hub`);
+/**
+* The hub's name as config.yaml gives it. A hub whose config.yaml is not downloaded yet, as in a new environment before
+* its first `mainflow sync`, has the name it was registered under.
+*/
+function hubName(dirs, env = process.env) {
+	const file = join(dirs.data, "config.yaml");
+	if (!existsSync(file)) {
+		const registered = registeredName(dirs, env);
+		if (registered) return registered;
+	}
+	const config = parse$1(readFileSync(file, "utf8"));
+	if (typeof config?.hub !== "string") throw new Error(`${file} names no hub`);
 	return config.hub;
 }
 const text = (value) => typeof value === "string" ? value : "";
 /** What .mainflow/local/sync.json holds, nothing when there is no such file. */
-function stored(root) {
-	const file = join(root, DATA_DIR, SETTINGS_FILE);
+function stored(dirs) {
+	const file = join(dirs.data, SETTINGS_FILE);
 	if (!existsSync(file)) return {};
 	try {
 		return JSON.parse(readFileSync(file, "utf8")) ?? {};
@@ -115,20 +104,20 @@ function stored(root) {
 /**
 * The sync settings of the hub at `root`, or null when either half of the token is missing. Each value comes from its
 * environment variable, or from sync.json when the variable is unset or empty; the server is DEFAULT_SYNC_URL when
-* neither names one.
+* neither names one, and on-demand download is on unless one of them sets it off.
 */
-function syncSettings(root, env = process.env) {
-	const saved = stored(root);
+function syncSettings(dirs, env = process.env) {
+	const saved = stored(dirs);
 	const url = env[ENV.url] || text(saved.url) || "https://mainflow-sync.carlos209310.space";
 	const clientId = env[ENV.clientId] || text(saved.clientId);
 	const clientSecret = env[ENV.clientSecret] || text(saved.clientSecret);
 	if (!clientId || !clientSecret) return null;
-	const onDemand = env[ENV.onDemand] ? ON.has(env[ENV.onDemand].trim().toLowerCase()) : saved.onDemand === true;
+	const onDemand = env[ENV.onDemand] ? ON.has(env[ENV.onDemand].trim().toLowerCase()) : saved.onDemand !== false;
 	return {
 		url: url.replace(/\/+$/, ""),
 		clientId,
 		clientSecret,
-		hub: hubName(root),
+		hub: hubName(dirs, env),
 		onDemand
 	};
 }
@@ -142,9 +131,9 @@ const EARLIER_TOKEN = {
 * nothing reads now: where that token is and which two values to set instead, never the token itself. Null when the
 * settings are whole or no earlier token is kept, so a hub that never synced writes to its local files without a word.
 */
-function earlierToken(root, env = process.env) {
-	if (syncSettings(root, env)) return null;
-	const where = [...env[EARLIER_TOKEN.env] ? [EARLIER_TOKEN.env] : [], ...text(stored(root)[EARLIER_TOKEN.key]) ? [`the ${EARLIER_TOKEN.key} key of .mainflow/${SETTINGS_FILE}`] : []];
+function earlierToken(dirs, env = process.env) {
+	if (syncSettings(dirs, env)) return null;
+	const where = [...env[EARLIER_TOKEN.env] ? [EARLIER_TOKEN.env] : [], ...text(stored(dirs)[EARLIER_TOKEN.key]) ? [`the ${EARLIER_TOKEN.key} key of .mainflow/${SETTINGS_FILE}`] : []];
 	if (where.length === 0) return null;
 	return `${where.join(" and ")} ${where.length > 1 ? "are" : "is"} no longer read, so mainflow does not write through the sync server; set ${ENV.clientId} and ${ENV.clientSecret}, or clientId and clientSecret in .mainflow/${SETTINGS_FILE}, to a Cloudflare Access service token`;
 }
@@ -172,6 +161,32 @@ var Unreachable = class extends Error {
 		this.broken = broken;
 	}
 };
+/**
+* The hub takes writes only from other mainflow versions than this CLI's (`client-outdated`): nothing of the request was
+* applied or kept. Unreachable as any 5xx, so a write stays in the outbox and goes again after `retryAfter` seconds; the
+* message says which versions the hub takes and the command that installs one.
+*/
+var ClientOutdatedError = class extends Unreachable {
+	retryAfter;
+	constructor(message, retryAfter) {
+		super(message, false);
+		this.retryAfter = retryAfter;
+	}
+};
+/**
+* The hub is being migrated or restored in batches, or such a rewrite stopped partway (`hub-rewriting`): nothing of the
+* request was applied or kept. Unreachable as any 5xx, so a write stays in the outbox and goes again; `rewrite` is the
+* rewrite's state, for a command that waits for it or says what holds the hub.
+*/
+var HubRewritingError = class extends Unreachable {
+	rewrite;
+	retryAfter;
+	constructor(message, rewrite, retryAfter) {
+		super(message, false);
+		this.rewrite = rewrite;
+		this.retryAfter = retryAfter;
+	}
+};
 /** The server refused before the hub (400, 404) or failed (500), or Cloudflare Access in front of it refused (AccessRefused). */
 var ServerError = class extends Error {
 	status;
@@ -261,7 +276,8 @@ var ServerApi = class {
 		wire: 0,
 		body: 0,
 		sent: 0,
-		listed: 0
+		listed: 0,
+		unchanged: 0
 	};
 	constructor(settings, timeoutMs = 3e4) {
 		this.settings = settings;
@@ -283,11 +299,15 @@ var ServerApi = class {
 			maxFreeSockets: 1
 		});
 	}
-	/** The service token's headers, which every request and the WebSocket's upgrade carry. Never logged. */
+	/**
+	* The service token's headers, and the CLI's version when the settings name it (VERSION_HEADER), which every request
+	* and the WebSocket's upgrade carry. Never logged.
+	*/
 	get access() {
 		return {
 			[ACCESS_HEADERS.clientId]: this.settings.clientId,
-			[ACCESS_HEADERS.clientSecret]: this.settings.clientSecret
+			[ACCESS_HEADERS.clientSecret]: this.settings.clientSecret,
+			...this.settings.version === void 0 ? {} : { [VERSION_HEADER]: this.settings.version }
 		};
 	}
 	/** A failure to reach the server or of the connection, as the Unreachable it is. */
@@ -319,8 +339,13 @@ var ServerApi = class {
 		} catch {
 			throw new Unreachable(`the sync server answered ${answer.status} without a readable body`, true);
 		}
-		if (answer.status >= 500) throw new Unreachable(`the sync server failed (${answer.status})`, true);
 		const refused = parsed;
+		if (answer.status === 503 && refused.reason === "client-outdated") throw new ClientOutdatedError(`the sync server refused the write: ${refused.message ?? "this mainflow version may not write to the hub"}`, Math.max(1, Number(answer.retryAfter) || 60));
+		if (answer.status === 503 && refused.reason === "hub-rewriting") {
+			const rewriting = parsed;
+			throw new HubRewritingError(rewriting.message, rewriting.rewrite, Math.max(1, Number(answer.retryAfter) || 10));
+		}
+		if (answer.status >= 500) throw new Unreachable(`the sync server failed (${answer.status})`, true);
 		if (answer.status === 404 || refused.reason === "malformed") throw new ServerError(`the sync server refused: ${refused.message ?? answer.status}`, answer.status);
 		return {
 			status: answer.status,
@@ -543,6 +568,7 @@ var ServerApi = class {
 		this.transfer.batches++;
 		this.transfer.files += body.files.filter((entry) => entry.kind === "file").length;
 		this.transfer.listed += body.files.filter((entry) => entry.kind === "listed").length;
+		if (body.unchanged === true) this.transfer.unchanged++;
 		this.transfer.wire += wire;
 		this.transfer.body += size;
 		this.transfer.sent += sent;
@@ -558,6 +584,9 @@ var ServerApi = class {
 	* `listOnly` asks for the files under those prefixes as `listed`, without their text. A part of the hub alone is taken
 	* from `after` on, and ends with the batch that covers `through`; only the paths of that range are told of. `blobs` takes
 	* the binary files too, each that differs from `have` as `blob`; `have` names a binary file by its sha256 then.
+	* `digest` names the digest of `have` and the directories the client holds (hubDigest), asked on the first batch of a
+	* whole hub's snapshot with `blobs`: a server whose hub it is the digest of answers that nothing differs, and the
+	* snapshot is that one batch, with the client's directories as the entries, as the server would have listed them.
 	*/
 	async snapshot(have = /* @__PURE__ */ new Map(), options = {}) {
 		const paths = [...have.keys()].sort(comparePaths);
@@ -569,14 +598,23 @@ var ServerApi = class {
 			for (;;) {
 				while (after !== void 0 && start < paths.length && comparePaths(paths[start], after) <= 0) start++;
 				const range = Object.fromEntries(paths.slice(start).map((path) => [path, have.get(path)]));
-				const { seq, files, next } = await this.batch({
+				const asking = options.digest !== void 0 && options.blobs === true && after === void 0;
+				const { seq, files, next, unchanged } = await this.batch({
 					protocol: 3,
 					have: range,
 					unknown: true,
 					...after === void 0 ? {} : { after },
+					...asking ? { digest: options.digest.value } : {},
 					...options.listOnly?.length ? { listOnly: options.listOnly } : {},
 					...options.blobs ? { blobs: true } : {}
 				});
+				if (unchanged === true && asking) return [{
+					seq,
+					files: options.digest.dirs.map((path) => ({
+						kind: "dir",
+						path
+					}))
+				}];
 				if (parts.length > 0 && seq < parts.at(-1).seq) break;
 				parts.push({
 					seq,
@@ -613,6 +651,53 @@ var ServerApi = class {
 		return body;
 	}
 	/**
+	* A page of the hub's change log (ROUTES.changes), newest first. A server from before the log has no such route: a
+	* ServerError of status 404, as is any refusal.
+	*/
+	async changes(request = {}) {
+		const { body } = await this.call("POST", ROUTES.changes(this.settings.hub), {
+			protocol: 3,
+			...request
+		}, "read");
+		if (!body.ok) throw new ServerError(`the sync server refused the change log: ${body.message}`, body.status);
+		return body;
+	}
+	/**
+	* Put the hub, or a path of it, back to a seq or a time (ROUTES.restore): the hub's answer, applied, set off in batches
+	* (`started`), or refused. It goes on a connection of its own, as an upload does, and is never sent again, since it has
+	* no requestId: one sent again after its answer was lost finds the hub as it left it only when nothing was written in
+	* between, and else puts that writing back too. A server from before the log has no such route: a ServerError of status
+	* 404. A hub being rewritten throws HubRewritingError.
+	*/
+	async restore(request) {
+		return (await this.call("POST", ROUTES.restore(this.settings.hub), {
+			protocol: 3,
+			...request
+		}, "fresh")).body;
+	}
+	/**
+	* Convert the hub to the server's data format on the server (ROUTES.migrate): the hub's answer, applied, set off in
+	* batches (`started`), or refused. It goes on a connection of its own and is never sent again, as a restore. A server
+	* from before the route answers 404 from its router: a ServerError of status 404. A hub being rewritten throws
+	* HubRewritingError.
+	*/
+	async migrate(request = {}) {
+		return (await this.call("POST", ROUTES.migrate(this.settings.hub), {
+			protocol: 3,
+			...request
+		}, "fresh")).body;
+	}
+	/**
+	* The migration or restore the server runs on the hub in batches, or ran last (ROUTES.rewrite). It goes on a connection
+	* of the reads, so one the server closed meanwhile is asked again. A server from before batches has no such route: a
+	* ServerError of status 404.
+	*/
+	async rewrite() {
+		const { body } = await this.call("POST", ROUTES.rewrite(this.settings.hub), { protocol: 3 }, "read");
+		if (!body.ok) throw new ServerError(`the sync server refused to tell the hub's rewrite: ${body.message}`, body.status);
+		return body;
+	}
+	/**
 	* Open the hub's broadcast connection, taking the binary files too (ROUTES.socket). It opens before the client knows
 	* whether the server keeps binary files (blobRoute), and a server from before them reads nothing of `blobs`.
 	*/
@@ -764,135 +849,6 @@ function mergeThreeWay(current, base, incoming) {
 	};
 }
 //#endregion
-//#region ../sync/dist/scope.js
-/** The name of a file of ignore rules. */
-const GITIGNORE = ".gitignore";
-const decoder$1 = new TextDecoder("utf-8", { fatal: true });
-/** The text of the file at `file`, or null when there is none or it cannot be read. */
-function readText(file) {
-	try {
-		return readFileSync(file, "utf8");
-	} catch {
-		return null;
-	}
-}
-/** The hub's ignore rules, by the directory of each .gitignore, as last read. */
-var SyncScope = class {
-	/** Each .gitignore's text and rules by its directory, relative to .mainflow/ with `/`, '' for .mainflow/ itself */
-	rules = /* @__PURE__ */ new Map();
-	/** Whether each path, a directory's ending in `/`, is ignored under the rules as they are */
-	decided = /* @__PURE__ */ new Map();
-	changes = 0;
-	/** How many times the rules changed: a caller that noted it tells whether they changed since. */
-	get generation() {
-		return this.changes;
-	}
-	/** The text of `dir`'s .gitignore as the rules have it, null for none. */
-	text(dir) {
-		return this.rules.get(dir)?.text ?? null;
-	}
-	/** Take `text` as the .gitignore of `dir`, null for none; true when that changes the rules. */
-	set(dir, text) {
-		if ((this.rules.get(dir)?.text ?? null) === text) return false;
-		if (text === null) this.rules.delete(dir);
-		else this.rules.set(dir, {
-			text,
-			matcher: ignore().add(text)
-		});
-		this.decided.clear();
-		this.changes++;
-		return true;
-	}
-	/** Forget the rules of every directory but `dirs`, as when a scan of the whole hub no longer finds the others. */
-	keepOnly(dirs) {
-		for (const dir of this.rules.keys()) if (!dirs.has(dir)) this.set(dir, null);
-	}
-	/** Whether the file at `path`, relative to .mainflow/, is synced: by the sync client's own rules, and not ignored. */
-	synced(path) {
-		return isSynced(path) && !this.ignored(path, false);
-	}
-	/** Whether a scan walks into the directory at `path`: one that may hold synced files, and not ignored. */
-	walks(path) {
-		return mayHoldSynced(path) && !this.ignored(path, true);
-	}
-	/** Whether git leaves the file or directory (`dir`) at `path` out: it, or a directory above it, is ignored. */
-	ignored(path, dir) {
-		if (path === "local" || path.startsWith("local/")) return false;
-		const parts = path.split("/");
-		if (parts.some((part) => part === "" || part === "." || part === "..")) return true;
-		const key = dir ? `${path}/` : path;
-		const known = this.decided.get(key);
-		if (known !== void 0) return known;
-		let out = false;
-		for (let n = 1; n <= parts.length && !out; n++) out = this.matches(parts, n, n < parts.length || dir);
-		this.decided.set(key, out);
-		return out;
-	}
-	/**
-	* Whether the rules ignore the first `n` parts of a path, a directory's when `dir`: each .gitignore above it in turn,
-	* from .mainflow/ down, the last one with a pattern that matches deciding.
-	*/
-	matches(parts, n, dir) {
-		if (parts[n - 1] === ".git") return true;
-		let out = false;
-		for (let depth = 0; depth < n; depth++) {
-			const rules = this.rules.get(parts.slice(0, depth).join("/"));
-			if (!rules) continue;
-			const test = rules.matcher.test(`${parts.slice(depth, n).join("/")}${dir ? "/" : ""}`);
-			if (test.ignored) out = true;
-			else if (test.unignored) out = false;
-		}
-		return out;
-	}
-	/**
-	* Read every .gitignore under `data`, the hub's .mainflow/, again, and return the synced files there; it walks only into
-	* the directories the rules leave in, as git does. Synchronous, for a start and for `mainflow check`.
-	*/
-	load(data) {
-		const files = [];
-		const dirs = /* @__PURE__ */ new Set();
-		const visit = (dir) => {
-			let entries;
-			try {
-				entries = readdirSync(join(data, dir), { withFileTypes: true });
-			} catch {
-				return;
-			}
-			dirs.add(dir);
-			this.set(dir, entries.some((entry) => entry.name === ".gitignore" && entry.isFile()) ? readText(join(data, dir, GITIGNORE)) : null);
-			for (const entry of entries) {
-				const path = dir ? `${dir}/${entry.name}` : entry.name;
-				if (entry.isDirectory()) {
-					if (this.walks(path)) visit(path);
-				} else if (entry.isFile() && this.synced(path)) files.push(path);
-			}
-		};
-		visit("");
-		this.keepOnly(dirs);
-		return files;
-	}
-};
-/**
-* The synced files of the hub at `root` larger than the sync server keeps (MAX_FILE_BYTES): UTF-8 text the hub's
-* .gitignore files leave in. The sync client leaves them out of sync; `mainflow check` warns of them.
-*/
-function oversizedFiles(root) {
-	const data = join(root, DATA_DIR);
-	const out = [];
-	for (const path of new SyncScope().load(data)) {
-		const file = join(data, path);
-		try {
-			if (statSync(file).size <= 19e5) continue;
-			const bytes = textBytes(decoder$1.decode(readFileSync(file)));
-			if (bytes > 19e5) out.push({
-				path,
-				bytes
-			});
-		} catch {}
-	}
-	return out;
-}
-//#endregion
 //#region ../sync/dist/state.js
 /** The requestId an outbox entry goes under: its id, with the number of the try for a binary file's write sent again. */
 const requestIdOf = (entry) => entry.kind === "blob" && entry.retry ? `${entry.id}-${entry.retry}` : entry.id;
@@ -954,18 +910,18 @@ function writeJson(file, value) {
 	writeFileSync(temp, JSON.stringify(value, null, 1));
 	renameSync(temp, file);
 }
-const readKnown = (root) => readJson(syncPaths(root).known, {}).files ?? {};
+const readKnown = (dirs) => readJson(syncPaths(dirs).known, {}).files ?? {};
 /** The directories known.json names; none from a client before it kept them. */
-const readKnownDirs = (root) => {
-	const dirs = readJson(syncPaths(root).known, {}).dirs;
+const readKnownDirs = (hub) => {
+	const dirs = readJson(syncPaths(hub).known, {}).dirs;
 	return Array.isArray(dirs) ? dirs.filter((dir) => typeof dir === "string") : [];
 };
 /** What known.json writes before a binary file's sha256, apart from a text's content hash. */
 const BLOB_PREFIX = "blob:";
 /** The text of the version known.json names by `hash`; undefined when it was not kept, as by a sync client before known/. */
-function readKnownText(root, hash) {
+function readKnownText(dirs, hash) {
 	try {
-		const text = readFileSync(join(syncPaths(root).knownTexts, hash), "utf8");
+		const text = readFileSync(join(syncPaths(dirs).knownTexts, hash), "utf8");
 		return contentHash(text) === hash ? text : void 0;
 	} catch {
 		return;
@@ -978,8 +934,8 @@ function readKnownText(root, hash) {
 * step leaves a known.json whose every text is in known/. A binary file is given as its sha256 with BLOB_PREFIX, and no text.
 * `dirs` are the directories it names.
 */
-function writeKnown(root, files, dirs = []) {
-	const dir = syncPaths(root).knownTexts;
+function writeKnown(hub, files, dirs = []) {
+	const dir = syncPaths(hub).knownTexts;
 	mkdirSync(dir, { recursive: true });
 	const named = new Set(Object.values(files).map((file) => file.hash));
 	const held = new Set(readdirSync(dir));
@@ -993,25 +949,25 @@ function writeKnown(root, files, dirs = []) {
 		files: Object.fromEntries(Object.entries(files).map(([path, file]) => [path, file.hash])),
 		...dirs.length > 0 ? { dirs } : {}
 	};
-	writeJson(syncPaths(root).known, known);
+	writeJson(syncPaths(hub).known, known);
 	for (const name of held) if (!named.has(name)) rmSync(join(dir, name), { force: true });
 }
-const writeQueue = (root, entries) => writeJson(syncPaths(root).queue, { entries });
-const readRemote = (root) => readJson(syncPaths(root).remote, {}).files ?? {};
-const writeRemote = (root, files) => writeJson(syncPaths(root).remote, { files });
+const writeQueue = (dirs, entries) => writeJson(syncPaths(dirs).queue, { entries });
+const readRemote = (dirs) => readJson(syncPaths(dirs).remote, {}).files ?? {};
+const writeRemote = (dirs, files) => writeJson(syncPaths(dirs).remote, { files });
 /** The queue as queue.json has it; an entry from before entries had ids gets one, written back. Call under the write lock. */
-function readQueue(root) {
-	const entries = readJson(syncPaths(root).queue, {}).entries ?? [];
+function readQueue(dirs) {
+	const entries = readJson(syncPaths(dirs).queue, {}).entries ?? [];
 	if (entries.every((entry) => typeof entry.id === "string")) return entries;
 	const named = entries.map((entry) => ({
 		...entry,
 		id: entry.id ?? entryId()
 	}));
-	writeQueue(root, named);
+	writeQueue(dirs, named);
 	return named;
 }
 /** Run `fn` under the hub's write lock, the one every mainflow writer of this machine takes. */
-const underLock = (root, fn) => nodeStorage(root).lock(fn);
+const underLock = (dirs, fn) => nodeStorage(dirs).lock(fn);
 //#endregion
 //#region ../sync/dist/swap-helper.js
 const HELPER_SOURCE = "mainflow-swap.c";
@@ -1386,14 +1342,14 @@ const SWAP_PAUSE_MS = 6e4;
 /** queue.json, relative to .mainflow/: other writers append to it, and the client sends what they appended */
 const OUTBOX = `${SYNC_DIR}/queue.json`;
 const sleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-const decoder = new TextDecoder("utf-8", { fatal: true });
+const decoder$1 = new TextDecoder("utf-8", { fatal: true });
 const sameLocal = (a, b) => a.kind === b.kind && (a.kind !== "text" || a.text === b.text) && (a.kind !== "binary" || a.hash === b.hash);
 /** What `bytes` read from a file are: a text when they are UTF-8, a binary file otherwise. */
 function contentOf(bytes) {
 	try {
 		return {
 			kind: "text",
-			text: decoder.decode(bytes)
+			text: decoder$1.decode(bytes)
 		};
 	} catch {
 		return {
@@ -1566,7 +1522,7 @@ function holdsFiles(parts, held) {
 }
 var SyncClient = class extends EventEmitter {
 	opts;
-	root;
+	dirs;
 	paths;
 	api;
 	problems = [];
@@ -1664,14 +1620,6 @@ var SyncClient = class extends EventEmitter {
 	uploadWanted = false;
 	/** Why the server refused the upload of this environment's copy, as last reported (snapshotNow); null once it holds the hub */
 	uploadRefusal = null;
-	/** The hub's .gitignore files, which leave a file out of sync as they leave it out of git (src/scope.ts) */
-	scope = new SyncScope();
-	/**
-	* The generation of the rules (SyncScope.generation) the last snapshot was asked for under. A file the rules left out
-	* then was not taken in, whatever the server sent, nor a broadcast of it since; rules changed after it may let such a
-	* file in, so the snapshot is taken again (walk), and a file not taken in from the server waits for it (scopeStale).
-	*/
-	scopeTaken = -1;
 	/**
 	* The paths the server last named `unknown`: it holds no file there and never removed one. A file here at such a path
 	* is new to the server, whatever known.json says, as when another environment uploaded the hub to a new server
@@ -1742,6 +1690,13 @@ var SyncClient = class extends EventEmitter {
 	flushRun = null;
 	resyncing = null;
 	resyncAgain = false;
+	/**
+	* The snapshot the hub held off while the server migrates or restores it in batches (HubRewritingError): taken again
+	* when its reload broadcast comes, or after the Retry-After it came with, whichever is first. The connection stays
+	* open meanwhile, so the client neither reconnects nor asks for the snapshot more often than that.
+	*/
+	snapshotHeld = false;
+	snapshotTimer;
 	/** Whether a snapshot has been taken, after which a path the server never mentioned does not exist there */
 	synced = false;
 	reconnectTimer;
@@ -1767,15 +1722,25 @@ var SyncClient = class extends EventEmitter {
 	backoff = 500;
 	lastPong = 0;
 	knownTimer;
+	/**
+	* Until when the outbox waits, in ms since the epoch, after the hub refused a write for a while: for this CLI's version
+	* (ClientOutdatedError), or while it is migrated or restored in batches (HubRewritingError). The Retry-After it came
+	* with, so an environment left on an older CLI, or one writing during a rewrite, asks once a while, not once a second.
+	* The write stays in the outbox meanwhile, and idle does not wait for it. With the message last told of an outdated
+	* CLI (a `client-outdated` problem), so the same one is told once, until a write goes through again.
+	*/
+	heldUntil = 0;
+	outdatedMessage = null;
 	constructor(opts) {
 		super();
 		this.opts = opts;
-		this.root = opts.root;
-		this.paths = syncPaths(opts.root);
+		this.dirs = opts.dirs;
+		this.paths = syncPaths(opts.dirs);
 		this.api = new ServerApi(opts.settings);
 		this.firstContact = new Promise((resolve) => {
 			this.once("synced", resolve);
 			this.once("offline", resolve);
+			this.once("held", resolve);
 		});
 	}
 	trace(line) {
@@ -1788,26 +1753,13 @@ var SyncClient = class extends EventEmitter {
 	get online() {
 		return this.connected && !this.stopped;
 	}
-	/**
-	* Whether the file at `path` is synced: by the sync client's own rules (src/paths.ts) and the hub's .gitignore files as
-	* last read (src/scope.ts). Anything else is left as it is here, whatever the server holds.
-	*/
+	/** Whether the file at `path` is synced (src/paths.ts). Anything else is left as it is here, whatever the server holds. */
 	syncs(path) {
-		return this.scope.synced(path);
+		return isSynced(path);
 	}
-	/**
-	* Whether the directory at `path` is synced: one that may hold synced files and that the hub's .gitignore files leave
-	* in, apart from local/ itself, which every machine has of its own (src/paths.ts).
-	*/
+	/** Whether the directory at `path` is synced: one that may hold synced files, apart from local/ itself, which every machine has of its own (src/paths.ts). */
 	syncsDir(path) {
-		return path !== "" && path !== "local" && this.scope.walks(path);
-	}
-	/**
-	* Whether the hub's .gitignore files changed since the last snapshot was asked for: a file they let in since may be on
-	* the server although the client took nothing of it in.
-	*/
-	get scopeStale() {
-		return this.scope.generation !== this.scopeTaken;
+		return syncedDir(path);
 	}
 	/** Writes waiting in the outbox for the server: not the ones it refused, which wait for nothing (src/state.ts). */
 	get queued() {
@@ -1860,7 +1812,6 @@ var SyncClient = class extends EventEmitter {
 				this.info("", `atomic exchange unavailable, writing with a rename: ${swapper.reason}`);
 			}
 		}
-		this.scope.load(this.paths.data);
 		await this.restoreKnown();
 		this.restoreRemote();
 		await this.whenFree(() => this.syncQueue());
@@ -1885,8 +1836,8 @@ var SyncClient = class extends EventEmitter {
 	async restoreKnown() {
 		this.copied = !existsSync(this.paths.known);
 		this.blobsCompared = !this.copied && !existsSync(this.paths.copyBlobs);
-		for (const dir of readKnownDirs(this.root)) this.syncedDirs.add(dir);
-		for (const [path, hash] of Object.entries(readKnown(this.root))) {
+		for (const dir of readKnownDirs(this.dirs)) this.syncedDirs.add(dir);
+		for (const [path, hash] of Object.entries(readKnown(this.dirs))) {
 			if (hash.startsWith("blob:")) {
 				const disk = {
 					hash: hash.slice(5),
@@ -1897,7 +1848,7 @@ var SyncClient = class extends EventEmitter {
 				continue;
 			}
 			const local = await this.readLocal(path);
-			const text = local.kind === "text" && contentHash(local.text) === hash ? local.text : readKnownText(this.root, hash);
+			const text = local.kind === "text" && contentHash(local.text) === hash ? local.text : readKnownText(this.dirs, hash);
 			const disk = text === void 0 ? { hash } : {
 				hash,
 				text
@@ -1947,6 +1898,7 @@ var SyncClient = class extends EventEmitter {
 		this.closing = true;
 		this.stopped = true;
 		clearTimeout(this.reconnectTimer);
+		clearTimeout(this.snapshotTimer);
 		clearInterval(this.pingTimer);
 		clearInterval(this.warmTimer);
 		clearInterval(this.rescanTimer);
@@ -1987,6 +1939,7 @@ var SyncClient = class extends EventEmitter {
 		await new Promise((resolve) => {
 			this.once("synced", resolve);
 			this.once("offline", resolve);
+			this.once("held", resolve);
 			this.connect();
 		});
 	}
@@ -2000,7 +1953,8 @@ var SyncClient = class extends EventEmitter {
 		this.outboxChanged();
 		for (;;) {
 			const work = besidesAwaiting ? [...this.work].filter((promise) => !this.awaitingEdit.has(this.workPaths.get(promise) ?? "")) : [...this.work];
-			if (!(work.length > 0 || [...this.inflight.values()].some((n) => n > 0) || this.flushing || this.resyncing !== null || this.online && this.nextEntry(this.queue).entry !== void 0)) return true;
+			const sendable = this.online && this.heldUntil <= Date.now() && this.nextEntry(this.queue).entry !== void 0;
+			if (!(work.length > 0 || [...this.inflight.values()].some((n) => n > 0) || this.flushing || this.resyncing !== null || sendable)) return true;
 			if (Date.now() > deadline) return false;
 			await (work.length > 0 ? Promise.race([Promise.allSettled(work), sleep$1(50)]) : sleep$1(50));
 		}
@@ -2299,8 +2253,7 @@ var SyncClient = class extends EventEmitter {
 	* reconciled: the server broadcasts a change after storing it, so a snapshot asked for later holds it. One that
 	* still does not, and brought nothing newer, is asked for again after a pause; after STALLED_SNAPSHOTS of them the
 	* server is taken to have lost those changes, as when its storage was replaced: the versions the client holds from
-	* after the gap are forgotten and the snapshot is taken once more, as it is. So is it when the hub's .gitignore files
-	* changed after it was asked for (scopeStale): a file they let in since was not taken in. The connection has its
+	* after the gap are forgotten and the snapshot is taken once more, as it is. The connection has its
 	* snapshot once one ends while it is open (I1); one that fails leaves it without, and the client reconnects to take a
 	* fresh one, rather than send on the snapshot of an earlier connection.
 	*/
@@ -2332,11 +2285,17 @@ var SyncClient = class extends EventEmitter {
 					this.log(`missed the hub's changes ${missing} while taking the snapshot; reloading it`);
 					if (stalled > 0) await sleep$1(250 * 2 ** (stalled - 1));
 					this.resyncAgain = true;
-				} while ((this.resyncAgain || this.scopeStale) && !this.closing);
+				} while (this.resyncAgain && !this.closing);
 				this.current = this.connected && !this.closing;
+				if (this.snapshotHeld) {
+					this.snapshotHeld = false;
+					clearTimeout(this.snapshotTimer);
+					if (this.current) this.emit("synced");
+				}
 			} catch (error) {
 				this.current = false;
-				this.ws?.close();
+				if (error instanceof HubRewritingError && this.connected && !this.closing) this.holdSnapshot(error);
+				else this.ws?.close();
 				throw error;
 			} finally {
 				this.resyncing = null;
@@ -2346,6 +2305,19 @@ var SyncClient = class extends EventEmitter {
 		return this.resyncing;
 	}
 	/**
+	* The server held the snapshot off while it migrates or restores the hub in batches: the connection stays open, and
+	* the snapshot is taken again on the reload broadcast that ends the rewrite, or after the Retry-After of the refusal,
+	* whichever is first. Nothing is sent meanwhile, as before any snapshot. A client starting or reconnecting meanwhile
+	* is done waiting for its first contact (`held`).
+	*/
+	holdSnapshot(error) {
+		if (!this.snapshotHeld) this.log(`${error.message}; the snapshot is taken again once it is done`);
+		this.snapshotHeld = true;
+		clearTimeout(this.snapshotTimer);
+		this.snapshotTimer = setTimeout(() => void this.track(this.resync().catch((failed) => this.log(`could not reload the snapshot: ${failed.message}`))), error.retryAfter * 1e3);
+		this.emit("held");
+	}
+	/**
 	* Take the hub as of the snapshot's seq, asking only for what differs from what the client holds (holdings). The
 	* snapshot comes in batches, each as of its own seq; the WebSocket was open before the first, so every change after
 	* it comes as a broadcast, and the first batch's seq is the one the whole snapshot is as of. A file the server sent,
@@ -2353,8 +2325,8 @@ var SyncClient = class extends EventEmitter {
 	* batch's seq; a file neither named nor sent is not on the server. A broadcast arriving meanwhile may be older or
 	* newer than either; each file keeps whichever version has the higher seq. A path the server never held a file at
 	* (`unknown`) is one it has no file at: a file here, even one never synced or one known.json names, is sent as new and
-	* never removed (reconcile, unheld). What the
-	* client does not sync (syncs), as a file the hub's .gitignore leaves out, is not taken in, whatever the server sends.
+	* never removed (reconcile, unheld). What the client does not sync (syncs), as a file in a scratch/ directory, is not
+	* taken in, whatever the server sends.
 	*
 	* A server without the hub first gets the local one. When it refuses the upload and still holds no file, the snapshot
 	* fails without taking anything in: an empty hub would tell a copy without known.json to remove every file it holds.
@@ -2387,8 +2359,6 @@ var SyncClient = class extends EventEmitter {
 		/** Whether the hub was uploaded, and why the server refused the upload; asked again, the snapshot may hold the hub */
 		let uploaded = false;
 		let refusal = null;
-		/** The rules' generation the snapshot is asked for under: what it holds is taken in as they leave it in */
-		let asked;
 		/** Whether the snapshot is asked for with the binary files */
 		let withBlobs = false;
 		if (!this.probed) await this.probeBlobs();
@@ -2399,15 +2369,20 @@ var SyncClient = class extends EventEmitter {
 			have = new Map([...held].map(([path, text]) => [path, this.hashOf(path, text)]));
 			for (const [path, blob] of heldBlobs) have.set(path, blob.hash);
 			for (const [path, hash] of this.remote) have.set(path, hash);
-			asked = this.scope.generation;
 			withBlobs = this.blobSupport === true;
 			if (!withBlobs && !this.blobsCompared && !existsSync(this.paths.copyBlobs)) {
 				mkdirSync(this.paths.own, { recursive: true });
 				writeFileSync(this.paths.copyBlobs, "");
 			}
+			const dirs = this.knownDirs();
+			const digest = withBlobs && have.size > 0 ? {
+				value: hubDigest(have, dirs),
+				dirs
+			} : void 0;
 			parts = await this.api.snapshot(have, {
 				listOnly: this.listOnly(this.copied && !this.synced),
-				blobs: this.blobSupport === true
+				blobs: this.blobSupport === true,
+				...digest ? { digest } : {}
 			});
 			if (uploaded || holdsFiles(parts, have)) break;
 			if (this.opts.settings.onDemand === true) {
@@ -2416,7 +2391,7 @@ var SyncClient = class extends EventEmitter {
 					this.problem({
 						kind: "upload-needed",
 						path: "",
-						message: `the sync server has no copy of hub ${this.opts.settings.hub}; this environment downloads on demand and may lack files, so it does not upload its copy. Run mainflow sync, with on-demand downloads off, in an environment that keeps every file of the hub, such as the one that commits it with git, to upload it; this one waits and syncs once the hub is there`
+						message: `the sync server has no copy of hub ${this.opts.settings.hub}; this environment downloads on demand and may lack files, so it does not upload its copy. Run mainflow sync, with on-demand downloads off, in an environment that keeps every file of the hub (run it there with MAINFLOW_SYNC_ON_DEMAND=0), to upload it; this one waits and syncs once the hub is there`
 					});
 				}
 				throw new Error("the sync server has no copy of the hub, and this environment downloads on demand, so it waits for one that keeps every file to upload it");
@@ -2529,7 +2504,6 @@ var SyncClient = class extends EventEmitter {
 			}, seq);
 		}
 		for (const path of this.syncedDirs) if (!dirs.has(path)) this.receiveDirRemoved(path, seq);
-		this.scopeTaken = asked;
 		this.log(`took the snapshot at seq ${seq} in ${parts.length} batch${parts.length === 1 ? "" : "es"}: ${sent} files sent, ${present.size - sent} already held here${this.remote.size > 0 ? `, ${this.remote.size} only on the server` : ""}`);
 		this.takenUpTo(seq);
 		this.synced = true;
@@ -2707,7 +2681,7 @@ var SyncClient = class extends EventEmitter {
 			if (expected?.blob && expected.hash === disk.hash) this.expected.delete(path);
 			if (isBlob(this.cloud.get(path))) this.cloud.delete(path);
 		}
-		if (forgotten.size > 0) await this.whenFree(() => underLock(this.root, () => writeKnown(this.root, this.knownFiles(), this.knownDirs())));
+		if (forgotten.size > 0) await this.whenFree(() => underLock(this.dirs, () => writeKnown(this.dirs, this.knownFiles(), this.knownDirs())));
 		return forgotten;
 	}
 	/** The server refused the upload, so it holds what it held: the binary files forgetBinaries forgot are known again. */
@@ -2809,7 +2783,7 @@ var SyncClient = class extends EventEmitter {
 			const after = this.expected.get(path);
 			if (after !== seen && after !== void 0 && this.matches(after, local)) return this.schedule(path);
 		}
-		const target = this.cloud.has(path) ? this.cloud.get(path) : this.synced && !this.scopeStale && (this.blobSupport === true || !this.knownBinary(path)) ? null : void 0;
+		const target = this.cloud.has(path) ? this.cloud.get(path) : this.synced && (this.blobSupport === true || !this.knownBinary(path)) ? null : void 0;
 		const disk = this.expected.get(path);
 		const unheld = target === null && this.unheld.has(path);
 		if (disk === void 0) {
@@ -2888,7 +2862,7 @@ var SyncClient = class extends EventEmitter {
 		}
 		if (text === null) return false;
 		try {
-			return decoder.decode(bytes) === text;
+			return decoder$1.decode(bytes) === text;
 		} catch {
 			return false;
 		}
@@ -3000,7 +2974,7 @@ var SyncClient = class extends EventEmitter {
 		this.tellOnce(`large:${path}:${hash}`, {
 			kind: "skipped-large",
 			path,
-			message: `${path} is larger than ${limit}, so it is not synced and not overwritten; other environments do not see it. ${binary ? "Make it smaller" : "Split it"}, or add it to .mainflow/.gitignore`
+			message: `${path} is larger than ${limit}, so it is not synced and not overwritten; other environments do not see it. ${binary ? "Make it smaller" : "Split it"}, or move it into a scratch/ directory, which is never synced`
 		});
 	}
 	/**
@@ -3315,7 +3289,7 @@ var SyncClient = class extends EventEmitter {
 		await this.fetchPaths([path]).catch((error) => this.log(`${path}: could not download it: ${error.message}`));
 	}
 	restoreRemote() {
-		for (const [path, hash] of Object.entries(readRemote(this.root))) if (this.syncs(path) && artifactOf(path) !== null && this.expected.get(path) === void 0) this.remote.set(path, hash);
+		for (const [path, hash] of Object.entries(readRemote(this.dirs))) if (this.syncs(path) && artifactOf(path) !== null && this.expected.get(path) === void 0) this.remote.set(path, hash);
 	}
 	/**
 	* What remote.json lists: the files only on the server, and the artifacts whose download failed and waits for a retry.
@@ -3350,7 +3324,7 @@ var SyncClient = class extends EventEmitter {
 		const listed = this.listedRemote();
 		if (listed.size === 0 && !existsSync(this.paths.remote)) return;
 		try {
-			writeRemote(this.root, Object.fromEntries([...listed].sort(([a], [b]) => comparePaths(a, b))));
+			writeRemote(this.dirs, Object.fromEntries([...listed].sort(([a], [b]) => comparePaths(a, b))));
 		} catch (error) {
 			this.log(`could not save local/sync/remote.json: ${error.message}`);
 		}
@@ -3941,10 +3915,10 @@ var SyncClient = class extends EventEmitter {
 	* goes first, and no file the server holds there that is not written here yet, nor one only on the server. The
 	* deepest go first, so the server finds the ones in each removed already; one holding anything holds the ones above it
 	* too. Each is checked again in the hold of the write lock that queues it, so a directory made again meanwhile stays.
-	* Only once a snapshot was taken under the rules as they are, since what the server holds is unknown before.
+	* Only once a snapshot was taken, since what the server holds is unknown before.
 	*/
 	async queueRemovedDirs() {
-		if (!this.synced || this.scopeStale || this.closing) return;
+		if (!this.synced || this.closing) return;
 		const exists = (dir) => existsSync(join(this.paths.data, dir));
 		const gone = [...this.syncedDirs].filter((dir) => this.syncsDir(dir) && !exists(dir));
 		if (gone.length === 0) return;
@@ -4103,7 +4077,7 @@ var SyncClient = class extends EventEmitter {
 	*/
 	locked(fn) {
 		if (this.abandoned) throw new Error("abandoned after stop");
-		return underLock(this.root, fn);
+		return underLock(this.dirs, fn);
 	}
 	/**
 	* Change the outbox: read queue.json, take in the entries other writers appended since it was last read, let `edit`
@@ -4118,7 +4092,7 @@ var SyncClient = class extends EventEmitter {
 	}
 	/** editQueue for a caller that holds the write lock already. */
 	editHeld(edit) {
-		const entries = readQueue(this.root);
+		const entries = readQueue(this.dirs);
 		const known = new Set(this.queue.map((entry) => entry.id));
 		let changed = false;
 		const fresh = [];
@@ -4142,7 +4116,7 @@ var SyncClient = class extends EventEmitter {
 			this.resolveBases(entries);
 		}
 		if (changed) {
-			writeQueue(this.root, entries);
+			writeQueue(this.dirs, entries);
 			this.pruneStaged(entries);
 		}
 		this.queue = entries;
@@ -4340,6 +4314,8 @@ var SyncClient = class extends EventEmitter {
 	async sendOutbox() {
 		this.flushing = true;
 		try {
+			const held = this.heldUntil - Date.now();
+			if (held > 0) return this.retryQueue(held);
 			while (this.caughtUp) {
 				let entry;
 				let wake;
@@ -4664,9 +4640,28 @@ var SyncClient = class extends EventEmitter {
 		} catch (error) {
 			if (!(error instanceof Unreachable)) throw error;
 			this.trace(`send ${entry.id} failed: ${error.message}`);
+			if (error instanceof HubRewritingError) {
+				this.heldUntil = Date.now() + error.retryAfter * 1e3;
+				this.log(`${error.message}; the outbox is sent again in ${error.retryAfter} s`);
+				return null;
+			}
+			if (error instanceof ClientOutdatedError) {
+				this.heldUntil = Date.now() + error.retryAfter * 1e3;
+				if (error.message !== this.outdatedMessage) {
+					const paths = entryPaths(entry);
+					this.problem({
+						kind: "client-outdated",
+						path: paths[0] ?? "",
+						message: `${error.message}. ${request.op}${paths.length ? ` of ${paths.join(", ")}` : ""} and the writes after it wait in the outbox, sent again every ${error.retryAfter} s until then`
+					});
+				}
+				this.outdatedMessage = error.message;
+				return null;
+			}
 			if (error.broken && !fresh && !this.closing) return this.request(entry, request, true, true);
 			return null;
 		}
+		this.outdatedMessage = null;
 		if (!response.ok && response.reason === "uncertain") {
 			const paths = entryPaths(entry);
 			if (entry.kind !== "rmdir") this.problem({
@@ -4966,7 +4961,7 @@ var SyncClient = class extends EventEmitter {
 	*/
 	renumberDisk(paths, renumbered) {
 		const storage = {
-			...nodeStorage(this.root),
+			...nodeStorage(this.dirs),
 			lock: (fn) => fn()
 		};
 		const seen = new Map([...new Set(paths)].filter((path) => this.syncs(path)).map((path) => [path, this.expected.get(path)]));
@@ -5299,16 +5294,9 @@ var SyncClient = class extends EventEmitter {
 		}]);
 		if ("files" in response && response.files.some((f) => f.path === path)) await this.delivery(path, response.seq);
 	}
-	/**
-	* The synced files here, by path. Each directory's .gitignore is read again on the way, before what the directory
-	* holds, so a change to one takes effect from the next scan on; a directory the rules leave out is not walked into.
-	* Rules changed since the last snapshot was asked for take it again: a file they let in that is on the server, as
-	* another environment sent it while the rules here left it out, comes then, not only on the next connection. A walk
-	* of a snapshot being taken leaves that to it (resync).
-	*/
+	/** The synced files here, by path: a walk into the directories that may hold them alone (src/paths.ts). */
 	async walk() {
 		const out = [];
-		const dirs = /* @__PURE__ */ new Set();
 		const visit = async (dir) => {
 			let entries;
 			try {
@@ -5316,44 +5304,23 @@ var SyncClient = class extends EventEmitter {
 			} catch {
 				return;
 			}
-			dirs.add(dir);
-			this.scope.set(dir, entries.some((entry) => entry.name === ".gitignore" && entry.isFile()) ? await this.readRules(dir) : null);
 			for (const entry of entries) {
 				const path = dir ? `${dir}/${entry.name}` : entry.name;
 				if (entry.isDirectory()) {
-					if (this.scope.walks(path)) await visit(path);
+					if (mayHoldSynced(path)) await visit(path);
 				} else if (entry.isFile() && this.syncs(path)) out.push(path);
 			}
 		};
 		await visit("");
-		this.scope.keepOnly(dirs);
-		if (this.scopeStale && this.synced && this.connected && this.resyncing === null && !this.closing) {
-			this.log("the hub's .gitignore changed; reloading the snapshot for the files it lets in");
-			this.track(this.resync().catch((error) => this.log(`could not reload the snapshot: ${error.message}`)));
-		}
 		return out;
 	}
-	/**
-	* The text of the .gitignore in `dir`, which is there, as walk takes it. A text other than the rules have may be one
-	* being written, as `cat >` empties a file before it fills it, and a rule missing for a moment would let its files in,
-	* to be sent: it is read again after EMPTY_RECHECK_MS and taken only when it reads the same, empty too. Until then, and
-	* while the file cannot be read, the rules stay as they were; the next walk reads it again.
-	*/
-	async readRules(dir) {
-		const held = this.scope.text(dir);
-		const read = () => readFile(join(this.paths.data, dir, GITIGNORE), "utf8").catch(() => null);
-		const text = await read();
-		if (text === null || text === held) return held;
-		await sleep$1(EMPTY_RECHECK_MS);
-		return await read() === text ? text : held;
-	}
-	/** The directories an upload holds: every one outside local/ that the hub's .gitignore files leave in. */
+	/** The directories an upload holds: every synced one (syncsDir) outside local/. */
 	async walkDirs(dir = "") {
 		const out = [];
 		const entries = await readdir(join(this.paths.data, dir), { withFileTypes: true }).catch(() => []);
 		for (const entry of entries) {
 			const path = dir ? `${dir}/${entry.name}` : entry.name;
-			if (!entry.isDirectory() || path === "local" || path.startsWith("local/") || this.scope.ignored(path, true)) continue;
+			if (!entry.isDirectory() || path === "local" || !this.syncsDir(path)) continue;
 			out.push(path, ...await this.walkDirs(path));
 		}
 		return out;
@@ -5401,13 +5368,12 @@ var SyncClient = class extends EventEmitter {
 				return;
 			}
 			if (this.syncedDirs.has(path)) this.checkDirs();
-			const rules = path === ".gitignore" || path.endsWith(`/.gitignore`);
-			if (!rules && !this.syncs(path)) return;
+			if (!this.syncs(path)) return;
 			this.trace(`watched ${path}`);
 			clearTimeout(timers.get(path));
 			timers.set(path, setTimeout(() => {
 				timers.delete(path);
-				this.track(this.whenSettled(path).then(() => rules ? this.scan(true) : this.schedule(path)));
+				this.track(this.whenSettled(path).then(() => this.schedule(path)));
 			}, SETTLE_MS));
 		};
 		try {
@@ -5511,7 +5477,7 @@ var SyncClient = class extends EventEmitter {
 		const files = this.knownFiles();
 		const dirs = this.knownDirs();
 		try {
-			underLock(this.root, () => writeKnown(this.root, files, dirs));
+			underLock(this.dirs, () => writeKnown(this.dirs, files, dirs));
 		} catch (error) {
 			this.log(`could not save local/sync/known.json: ${error.message}`);
 		}
@@ -5521,8 +5487,8 @@ var SyncClient = class extends EventEmitter {
 //#region ../sync/dist/ipc.js
 const SECRET_HEADER = "x-mainflow-sync";
 /** The running sync client of the hub at `root`, or null when none runs. */
-function readDaemon(root) {
-	const file = syncPaths(root).daemon;
+function readDaemon(dirs) {
+	const file = syncPaths(dirs).daemon;
 	if (!existsSync(file)) return null;
 	try {
 		const info = JSON.parse(readFileSync(file, "utf8"));
@@ -5575,8 +5541,8 @@ async function callDaemon(daemon, route, body, timeoutMs = 6e4) {
 /** How long a probe waits for the sync client's answer; a client holding the write lock answers after it. */
 const PROBE_MS = 2e3;
 /** The sync client daemon.json names, asked whether it runs; null without daemon.json or a live process at its pid. */
-async function probeDaemon(root, timeoutMs = PROBE_MS) {
-	const daemon = readDaemon(root);
+async function probeDaemon(dirs, timeoutMs = PROBE_MS) {
+	const daemon = readDaemon(dirs);
 	if (!daemon) return null;
 	try {
 		return {
@@ -5602,9 +5568,9 @@ const sameDaemon = (a, b) => a !== null && a.pid === b.pid && a.port === b.port
 * Remove daemon.json when it still says what `gone` said, under the write lock, so a sync client that claimed the hub
 * meanwhile keeps it. Call holding the lock.
 */
-function forgetDaemon(root, gone) {
-	if (!sameDaemon(readDaemon(root), gone)) return false;
-	rmSync(syncPaths(root).daemon, { force: true });
+function forgetDaemon(dirs, gone) {
+	if (!sameDaemon(readDaemon(dirs), gone)) return false;
+	rmSync(syncPaths(dirs).daemon, { force: true });
 	return true;
 }
 /** The Edit a request's body names, its file and its one replacement, or null. */
@@ -5628,7 +5594,7 @@ function callIn(body) {
 	};
 }
 /** Serve `client` to this machine's mainflow commands until closed. */
-async function serveIpc(root, client) {
+async function serveIpc(dirs, client) {
 	const secret = randomBytes(16).toString("hex");
 	const server = createServer(async (req, res) => {
 		const reply = (status, value) => res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(value));
@@ -5675,13 +5641,13 @@ async function serveIpc(root, client) {
 	});
 	await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
 	const port = server.address().port;
-	const file = syncPaths(root).daemon;
-	const probe = await probeDaemon(root);
-	const other = underLock(root, () => {
-		const running = readDaemon(root);
+	const file = syncPaths(dirs).daemon;
+	const probe = await probeDaemon(dirs);
+	const other = underLock(dirs, () => {
+		const running = readDaemon(dirs);
 		const reused = running !== null && probe?.state === "gone" && sameDaemon(running, probe.daemon);
 		if (running && running.pid !== process.pid && !reused) return running;
-		mkdirSync(syncPaths(root).own, { recursive: true });
+		mkdirSync(syncPaths(dirs).own, { recursive: true });
 		writeFileSync(file, JSON.stringify({
 			pid: process.pid,
 			port,
@@ -5709,7 +5675,7 @@ async function serveIpc(root, client) {
 //#region ../sync/dist/daemon.js
 async function startDaemon(options) {
 	const client = new SyncClient(options);
-	const ipc = await serveIpc(options.root, client);
+	const ipc = await serveIpc(options.dirs, client);
 	try {
 		await client.start();
 	} catch (error) {
@@ -5753,11 +5719,11 @@ const FETCH_TOOLS = /* @__PURE__ */ new Set([
 	"MultiEdit"
 ]);
 /** The file of the hub at `root` that `payload` names in file_path, relative to .mainflow/; null outside it. */
-function hubPath(root, payload) {
+function hubPath(dirs, payload) {
 	const input = payload.tool_input ?? {};
 	if (typeof input.file_path !== "string") return null;
 	const file = isAbsolute(input.file_path) ? input.file_path : resolve(payload.cwd ?? process.cwd(), input.file_path);
-	const path = relative(join(root, DATA_DIR), file).split(sep).join("/");
+	const path = relative(dirs.data, file).split(sep).join("/");
 	if (path.startsWith("../") || path === ".." || isAbsolute(path)) return null;
 	return path;
 }
@@ -5779,11 +5745,11 @@ function editOf(path, payload) {
 * needs nothing; an Edit of one replacement is replayed on the latest version; another file tool names the file it
 * wrote; anything else, such as a Bash command that may have written any file, rescans every file and names none.
 */
-function planFlush(root, payload) {
+function planFlush(dirs, payload) {
 	const tool = payload.tool_name ?? "";
 	if (!FILE_TOOLS.has(tool)) return { skip: false };
 	if (typeof (payload.tool_input ?? {}).file_path !== "string") return { skip: false };
-	const path = hubPath(root, payload);
+	const path = hubPath(dirs, payload);
 	if (path === null || !isSynced(path)) return { skip: true };
 	const edit = editOf(path, payload);
 	return edit ? {
@@ -5811,11 +5777,11 @@ function hookAnswer(result) {
 * What to download before the tool in `payload` runs in the hub at `root`: the artifact it reads or writes, when the file
 * is not here, so it may be only on the sync server. Null for anything else, which needs nothing.
 */
-function planFetch(root, payload) {
+function planFetch(dirs, payload) {
 	const tool = payload.tool_name ?? "";
 	if (!FETCH_TOOLS.has(tool)) return null;
-	const path = hubPath(root, payload);
-	if (path === null || !isSynced(path) || artifactOf(path) === null || existsSync(join(root, ".mainflow", path))) return null;
+	const path = hubPath(dirs, payload);
+	if (path === null || !isSynced(path) || artifactOf(path) === null || existsSync(join(dirs.data, path))) return null;
 	return {
 		path,
 		write: tool !== "Read"
@@ -5826,8 +5792,8 @@ function planFetch(root, payload) {
 * change then waits for the Edit's PostToolUse report (docs/sync.md "等 Edit 的回報"). Null for anything else, which
 * announces nothing: a change no Edit announced is sent at once.
 */
-function planAnnounce(root, payload) {
-	const path = hubPath(root, payload);
+function planAnnounce(dirs, payload) {
+	const path = hubPath(dirs, payload);
 	if (path === null || !isSynced(path)) return null;
 	const edit = editOf(path, payload);
 	return edit && edit.old !== "" ? edit : null;
@@ -5839,10 +5805,53 @@ const fetchDenial = (reason) => JSON.stringify({ hookSpecificOutput: {
 	permissionDecisionReason: `mainflow sync: ${reason}`
 } });
 //#endregion
+//#region ../sync/dist/oversized.js
+const decoder = new TextDecoder("utf-8", { fatal: true });
+/** The synced files under `data`, the hub's .mainflow/, by path: a walk into the directories that may hold them alone. */
+function syncedFiles(data) {
+	const files = [];
+	const visit = (dir) => {
+		let entries;
+		try {
+			entries = readdirSync(join(data, dir), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const path = dir ? `${dir}/${entry.name}` : entry.name;
+			if (entry.isDirectory()) {
+				if (mayHoldSynced(path)) visit(path);
+			} else if (entry.isFile() && isSynced(path)) files.push(path);
+		}
+	};
+	visit("");
+	return files;
+}
+/**
+* The synced files of the hub at `root` larger than the sync server keeps (MAX_FILE_BYTES): UTF-8 text of the sync
+* scope. The sync client leaves them out of sync; `mainflow check` warns of them.
+*/
+function oversizedFiles(dirs) {
+	const data = dirs.data;
+	const out = [];
+	for (const path of syncedFiles(data)) {
+		const file = join(data, path);
+		try {
+			if (statSync(file).size <= 19e5) continue;
+			const bytes = textBytes(decoder.decode(readFileSync(file)));
+			if (bytes > 19e5) out.push({
+				path,
+				bytes
+			});
+		} catch {}
+	}
+	return out;
+}
+//#endregion
 //#region ../sync/dist/outbox.js
 /** Whether the hub at `root` writes through the sync server. */
-function remoteMode(root, env = process.env) {
-	return readDaemon(root) !== null || syncSettings(root, env) !== null;
+function remoteMode(dirs, env = process.env) {
+	return readDaemon(dirs) !== null || syncSettings(dirs, env) !== null;
 }
 /** Refusals of an operation by the local files, as opposed to a write lock held too long; thrown as they are. */
 const refusals = /* @__PURE__ */ new WeakSet();
@@ -5853,8 +5862,8 @@ const refusedHere = (error) => error instanceof Error && refusals.has(error);
 * client reads the outbox under the same lock, so it never sees the files this changed without the entry that
 * explains them, and never takes them for an edit to send. A refusal here is thrown, and nothing is queued.
 */
-function queueOperation(root, request) {
-	const storage = nodeStorage(root);
+function queueOperation(dirs, request) {
+	const storage = nodeStorage(dirs);
 	return storage.lock(() => {
 		const before = {};
 		const keep = (path) => {
@@ -5878,7 +5887,7 @@ function queueOperation(root, request) {
 		const written = {};
 		for (const change of result.changes) if (change.kind !== "makeDir" && isSynced(change.path)) written[change.path] = held.read(change.path);
 		const id = entryId();
-		writeQueue(root, [...readQueue(root), {
+		writeQueue(dirs, [...readQueue(dirs), {
 			id,
 			kind: "op",
 			request: pending,
@@ -5892,8 +5901,8 @@ function queueOperation(root, request) {
 	});
 }
 /** How many writes wait in the outbox for the server, as queue.json says: not the ones it refused (src/state.ts). */
-function queuedCount(root) {
-	const file = syncPaths(root).queue;
+function queuedCount(dirs) {
+	const file = syncPaths(dirs).queue;
 	if (!existsSync(file)) return 0;
 	try {
 		return (JSON.parse(readFileSync(file, "utf8")).entries ?? []).filter(waiting).length;
@@ -5909,8 +5918,8 @@ const NOTIFY_MS = 200;
 * the server's answer, such as a hook or the interface. Without a sync client, or one that does not answer, nothing
 * happens: the client's watcher of queue.json and its rescan find the entry, a moment later.
 */
-async function notifyQueued(root) {
-	const daemon = readDaemon(root);
+async function notifyQueued(dirs) {
+	const daemon = readDaemon(dirs);
 	if (!daemon) return;
 	try {
 		await callDaemon(daemon, "/send", {}, NOTIFY_MS);
@@ -5920,12 +5929,12 @@ async function notifyQueued(root) {
 * Ask the sync client what became of entry `id`, giving it up to `timeoutMs`. A sync client that is still starting is
 * waited for. `waiting` when it is offline, or the time ran out first.
 */
-async function awaitOutcome(root, id, timeoutMs) {
+async function awaitOutcome(dirs, id, timeoutMs) {
 	const deadline = Date.now() + timeoutMs;
 	for (;;) {
 		const left = deadline - Date.now();
 		if (left <= 0) return { state: "waiting" };
-		const daemon = readDaemon(root);
+		const daemon = readDaemon(dirs);
 		if (daemon) try {
 			return await callDaemon(daemon, "/wait", {
 				id,
@@ -5938,6 +5947,54 @@ async function awaitOutcome(root, id, timeoutMs) {
 	}
 }
 //#endregion
+//#region src/version-gate.ts
+const INVALID_RANGE = "mainflow in .mainflow/config.yaml is not a valid semver range, so the mainflow version is not checked; run \"mainflow check\" for details";
+const READ_ENDING = "; writes will be refused until then";
+/**
+* Compare this CLI's version with the mainflow versions the hub's config.yaml takes writes from. A write outside the
+* range is refused; a read is warned about. A `mainflow` that is no range is only warned about, whatever the command,
+* since core reads it as no limit so that a typo does not shut every writer out. A hub that names no range, has no
+* readable config.yaml or takes this version is not checked. The comparison is core's versionMismatch, the one the
+* sync server makes, and its message carries upgradeCommand.
+*/
+function versionGate(dirs, version, command) {
+	let requirements;
+	try {
+		requirements = hubRequirements(nodeStorage(dirs));
+	} catch {
+		return { kind: "run" };
+	}
+	if (requirements?.mainflowInvalid) return {
+		kind: "warn",
+		message: INVALID_RANGE
+	};
+	if (!requirements?.mainflow) return { kind: "run" };
+	if (command.writes) {
+		const message = versionMismatch(requirements.mainflow, version);
+		return message === null ? { kind: "run" } : {
+			kind: "refuse",
+			message
+		};
+	}
+	const message = versionMismatch(requirements.mainflow, version, READ_ENDING);
+	return message === null ? { kind: "run" } : {
+		kind: "warn",
+		message
+	};
+}
+/**
+* The checkpoint of every write that goes through the writer (the commands, the interface, the hooks): throws a
+* WriteError when `version` is outside the range the hub takes writes from, and warns on stderr about a range that is
+* no range. A hook's write is not checked (`hook`), since a hook has to answer the host whatever the version; the
+* `hook` command itself warns once before it runs.
+*/
+function requireWritableVersion(dirs, version, options = {}) {
+	if (options.hook) return;
+	const verdict = versionGate(dirs, version, { writes: true });
+	if (verdict.kind === "refuse") throw new WriteError(`refusing to write: ${verdict.message}`);
+	if (verdict.kind === "warn") console.error(`! ${verdict.message}`);
+}
+//#endregion
 //#region src/remote/start.ts
 /** How long a sync client started in the background may take to claim the hub, its first request to the server included. */
 const STARTING_MS = 6e4;
@@ -5954,10 +6011,10 @@ const alive = (pid) => {
 * none. `env` gives the sync server and service token as the environment variables do; for a hub other than the one this
 * process was started in it is `{}`, so the process started reads that hub's own .mainflow/local/sync.json.
 */
-async function startSyncInBackground(root, env = process.env) {
-	const probe = await probeDaemon(root);
+async function startSyncInBackground(dirs, env = process.env) {
+	const probe = await probeDaemon(dirs);
 	if (probe && probe.state !== "gone") return { state: "running" };
-	const paths = syncPaths(root);
+	const paths = syncPaths(dirs);
 	const cli = process.argv[1];
 	if (process.env.MAINFLOW_NO_BACKGROUND_SYNC === "1") return {
 		state: "failed",
@@ -5967,10 +6024,10 @@ async function startSyncInBackground(root, env = process.env) {
 		state: "failed",
 		reason: "this process cannot tell where the mainflow CLI is"
 	};
-	const log = relative(root, paths.log);
-	return nodeStorage(root).lock(() => {
-		const reused = probe?.state === "gone" && forgetDaemon(root, probe.daemon) ? probe.daemon.pid : void 0;
-		if (reused === void 0 && readDaemon(root)) return { state: "starting" };
+	const log = paths.log;
+	return nodeStorage(dirs).lock(() => {
+		const reused = probe?.state === "gone" && forgetDaemon(dirs, probe.daemon) ? probe.daemon.pid : void 0;
+		if (reused === void 0 && readDaemon(dirs)) return { state: "starting" };
 		let previous = null;
 		try {
 			previous = existsSync(paths.started) ? JSON.parse(readFileSync(paths.started, "utf8")) : null;
@@ -5984,7 +6041,7 @@ async function startSyncInBackground(root, env = process.env) {
 		let pid;
 		try {
 			const child = spawn(process.execPath, [cli, "sync"], {
-				cwd: root,
+				cwd: dirs.root,
 				detached: true,
 				stdio: [
 					"ignore",
@@ -6026,8 +6083,8 @@ async function startSyncInBackground(root, env = process.env) {
 /** Added to a write the local files refused, unless the sync client runs with the server's latest state. */
 const STALE_COPY = "the local copy may not have caught up with the sync server yet; retry once mainflow sync has caught up (mainflow sync status)";
 /** Whether the hub's sync client runs and has the server's latest state, asked with a short wait. */
-async function caughtUp(root) {
-	const daemon = readDaemon(root);
+async function caughtUp(dirs) {
+	const daemon = readDaemon(dirs);
 	if (!daemon) return false;
 	try {
 		return (await callDaemon(daemon, "/status", void 0, 2e3)).caughtUp === true;
@@ -6053,29 +6110,30 @@ function writtenLines(written) {
 * other than the one this process was started in, such as another hub the interface shows, passes `{}`, so only its
 * own .mainflow/local/sync.json and sync client count.
 */
-function hubWriter(root, env = process.env, options = {}) {
+function hubWriter(dirs, env = process.env, options = {}) {
 	const startSync = options.startSync ?? startSyncInBackground;
 	return async (op, input) => {
-		if (!remoteMode(root, env)) return {
-			value: applyOperation(nodeStorage(root), op, input, { now: nowMinute() }).value,
+		requireWritableVersion(dirs, CLI_VERSION, { hook: options.hook });
+		if (!remoteMode(dirs, env)) return {
+			value: applyOperation(nodeStorage(dirs), op, input, { now: nowMinute() }).value,
 			queued: false,
 			renumbered: [],
 			notices: []
 		};
 		let queuedOp;
 		try {
-			queuedOp = queueOperation(root, {
+			queuedOp = queueOperation(dirs, {
 				protocol: 3,
 				op,
 				input,
 				now: requestTime()
 			});
 		} catch (error) {
-			if (refusedHere(error) && !await caughtUp(root)) error.message += `; ${STALE_COPY}`;
+			if (refusedHere(error) && !await caughtUp(dirs)) error.message += `; ${STALE_COPY}`;
 			throw error;
 		}
 		const { id, result } = queuedOp;
-		const start = await startSync(root, env);
+		const start = await startSync(dirs, env);
 		const queued = {
 			value: result.value,
 			queued: true,
@@ -6088,10 +6146,10 @@ function hubWriter(root, env = process.env, options = {}) {
 			stopped: `mainflow sync is not running (${start.reason}); the write waits in .mainflow/local/sync/queue.json until it runs`
 		};
 		if (options.confirmMs === void 0) {
-			await notifyQueued(root);
+			await notifyQueued(dirs);
 			return queued;
 		}
-		const outcome = await awaitOutcome(root, id, options.confirmMs);
+		const outcome = await awaitOutcome(dirs, id, options.confirmMs);
 		if (outcome.state === "applied") {
 			const { response } = outcome;
 			return {
@@ -6111,4 +6169,4 @@ function hubWriter(root, env = process.env, options = {}) {
 	};
 }
 //#endregion
-export { isSynced as A, ServerError as C, syncSettings as D, hubName as E, SETTINGS_FILE as O, ServerApi as S, earlierToken as T, readDaemon as _, remoteMode as a, readRemote as b, planAnnounce as c, toolCallOf as d, startDaemon as f, probeDaemon as g, callDaemon as h, queuedCount as i, syncPaths as j, SYNC_DIR as k, planFetch as l, DaemonUnavailable as m, hubWriter as n, fetchDenial as o, DaemonRunning as p, writtenLines as r, hookAnswer as s, CONFIRM_MS as t, planFlush as u, silentHint as v, ENV as w, oversizedFiles as x, watchTree as y };
+export { hubName as A, readRemote as C, Unreachable as D, ServerError as E, syncPaths as F, SETTINGS_FILE as M, SYNC_DIR as N, ENV as O, isSynced as P, watchTree as S, ServerApi as T, DaemonUnavailable as _, versionGate as a, readDaemon as b, oversizedFiles as c, planAnnounce as d, planFetch as f, DaemonRunning as g, startDaemon as h, requireWritableVersion as i, syncSettings as j, earlierToken as k, fetchDenial as l, toolCallOf as m, hubWriter as n, queuedCount as o, planFlush as p, writtenLines as r, remoteMode as s, CONFIRM_MS as t, hookAnswer as u, callDaemon as v, HubRewritingError as w, silentHint as x, probeDaemon as y };