tether-sync 0.0.0-stage → 0.2.0

package/bin/daemon-KQ4ZTBYG.js

@@ -0,0 +1,2310 @@
+import {
+  GIT_MODES,
+  VERSION,
+  files,
+  findRepo,
+  gitBusy,
+  installHooks,
+  ipcEndpoint,
+  isNewer,
+  isWindows,
+  latestVersion,
+  listen,
+  removeHooks,
+  tetherHome
+} from "./chunk-NDKBAHAG.js";
+
+// packages/client/src/daemon.js
+import fs8 from "node:fs";
+import path5 from "node:path";
+import http from "node:http";
+import crypto4 from "node:crypto";
+
+// packages/client/src/config.js
+import fs from "node:fs";
+import os from "node:os";
+var DEFAULTS = {
+  server: "https://tether-b10cf.web.app",
+  consoleUrl: "",
+  // defaults to the server URL
+  tickSeconds: 30,
+  graceMs: 2e3,
+  scanRoots: [os.homedir()],
+  notifications: "all"
+  // all | errors | off
+};
+var NUMERIC = /* @__PURE__ */ new Set(["tickSeconds", "graceMs"]);
+var Config = class {
+  constructor(file) {
+    this.file = file;
+    this.values = { ...DEFAULTS };
+    try {
+      Object.assign(this.values, JSON.parse(fs.readFileSync(file, "utf8")));
+    } catch {
+    }
+    if (process.env.TETHER_SERVER) this.values.server = process.env.TETHER_SERVER;
+  }
+  get(key) {
+    return this.values[key];
+  }
+  set(key, value) {
+    if (!(key in DEFAULTS)) throw new Error(`unknown config key "${key}" (known: ${Object.keys(DEFAULTS).join(", ")})`);
+    if (NUMERIC.has(key)) {
+      value = Number(value);
+      if (!Number.isFinite(value) || value <= 0) throw new Error(`${key} must be a positive number`);
+    }
+    if (key === "notifications" && !["all", "errors", "off"].includes(value)) throw new Error("notifications must be all, errors or off");
+    if (key === "scanRoots" && typeof value === "string") value = value.split(/[;,]/).map((s) => s.trim()).filter(Boolean);
+    this.values[key] = value;
+    fs.writeFileSync(this.file, JSON.stringify(this.values, null, 2));
+  }
+  get consoleUrl() {
+    return this.values.consoleUrl || this.values.server;
+  }
+};
+
+// packages/client/src/db.js
+import { DatabaseSync } from "node:sqlite";
+var COLUMNS = {
+  instanceId: "TEXT PRIMARY KEY",
+  artifactId: "TEXT NOT NULL",
+  kind: "TEXT NOT NULL DEFAULT 'file'",
+  folderInstanceId: "TEXT",
+  repoId: "TEXT",
+  name: "TEXT",
+  relPath: "TEXT",
+  // server layout path inside the folder, at baseVersion
+  path: "TEXT NOT NULL",
+  // last known absolute path
+  volumeId: "TEXT",
+  fileId: "TEXT",
+  mode: "TEXT NOT NULL DEFAULT 'normal'",
+  // normal | editing | unmanaged | lost | orphaned
+  prevMode: "TEXT",
+  // mode to return to after `tether locate`
+  baseVersion: "INTEGER NOT NULL DEFAULT 0",
+  baseHash: "TEXT",
+  // canonical sha256 at baseVersion (= server blob)
+  size: "INTEGER",
+  // on-disk size at the last sync, for the quick change check
+  mtimeMs: "REAL",
+  eolMode: "TEXT DEFAULT 'auto'",
+  eolStyle: "TEXT",
+  // line endings this copy uses: lf | crlf (null = platform default)
+  hasBom: "INTEGER DEFAULT 0",
+  exec: "INTEGER DEFAULT 0",
+  role: "TEXT",
+  canDelete: "INTEGER DEFAULT 0",
+  remoteVersion: "INTEGER",
+  // latest server version seen (pending incoming if > baseVersion)
+  missingSince: "REAL",
+  // start of the atomic-save grace window
+  detached: "INTEGER DEFAULT 0",
+  // file in a folder that the user deleted; restored by `tether track`
+  needsRestore: "INTEGER DEFAULT 0",
+  // write a fresh copy at the expected path on the next tick
+  orphanReason: "TEXT",
+  realtime: "INTEGER DEFAULT 0",
+  // this client holds a realtime session and pushes every save
+  remoteRealtime: "TEXT",
+  // JSON { email, since } when someone else edits this file in realtime
+  gitMode: "TEXT",
+  // inside a git repo: keep (Tether reverts git's changes) | follow (git's changes are published)
+  gitRoot: "TEXT",
+  gitDir: "TEXT",
+  gitHooks: "TEXT",
+  lastError: "TEXT",
+  createdAt: "REAL",
+  updatedAt: "REAL"
+};
+var BOOL = /* @__PURE__ */ new Set(["realtime", "hasBom", "exec", "canDelete", "detached", "needsRestore"]);
+var LocalDb = class {
+  constructor(file) {
+    this.db = new DatabaseSync(file);
+    this.db.exec("PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;");
+    const cols = Object.entries(COLUMNS).map(([k, t]) => `"${k}" ${t}`).join(", ");
+    this.db.exec(`CREATE TABLE IF NOT EXISTS instances (${cols})`);
+    const have = new Set(this.db.prepare("PRAGMA table_info(instances)").all().map((c) => c.name));
+    for (const [k, t] of Object.entries(COLUMNS)) {
+      if (!have.has(k)) this.db.exec(`ALTER TABLE instances ADD COLUMN "${k}" ${t.replace("PRIMARY KEY", "").replace("NOT NULL", "")}`);
+    }
+    this.db.exec("CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT)");
+    this.db.exec("CREATE INDEX IF NOT EXISTS instances_folder ON instances(folderInstanceId)");
+  }
+  row(r) {
+    if (!r) return null;
+    const o = { ...r };
+    for (const k of BOOL) o[k] = !!o[k];
+    return o;
+  }
+  get(instanceId) {
+    return this.row(this.db.prepare("SELECT * FROM instances WHERE instanceId = ?").get(instanceId));
+  }
+  all() {
+    return this.db.prepare("SELECT * FROM instances ORDER BY createdAt").all().map((r) => this.row(r));
+  }
+  childrenOf(folderInstanceId) {
+    return this.db.prepare("SELECT * FROM instances WHERE folderInstanceId = ? ORDER BY relPath").all(folderInstanceId).map((r) => this.row(r));
+  }
+  insert(inst) {
+    const now = Date.now();
+    const o = { createdAt: now, updatedAt: now, ...inst };
+    const keys = Object.keys(o).filter((k) => k in COLUMNS);
+    this.db.prepare(`INSERT INTO instances (${keys.map((k) => `"${k}"`).join(",")}) VALUES (${keys.map(() => "?").join(",")})`).run(...keys.map((k) => this.val(o[k])));
+    return this.get(o.instanceId);
+  }
+  update(instanceId, patch) {
+    const keys = Object.keys(patch).filter((k) => k in COLUMNS && k !== "instanceId");
+    if (!keys.length) return this.get(instanceId);
+    keys.push("updatedAt");
+    patch = { ...patch, updatedAt: Date.now() };
+    this.db.prepare(`UPDATE instances SET ${keys.map((k) => `"${k}" = ?`).join(", ")} WHERE instanceId = ?`).run(...keys.map((k) => this.val(patch[k])), instanceId);
+    return this.get(instanceId);
+  }
+  remove(instanceId) {
+    this.db.prepare("DELETE FROM instances WHERE instanceId = ?").run(instanceId);
+  }
+  val(v) {
+    if (v === void 0) return null;
+    if (typeof v === "boolean") return v ? 1 : 0;
+    return v;
+  }
+  getMeta(key) {
+    const r = this.db.prepare("SELECT value FROM meta WHERE key = ?").get(key);
+    return r ? JSON.parse(r.value) : null;
+  }
+  setMeta(key, value) {
+    if (value === null) this.db.prepare("DELETE FROM meta WHERE key = ?").run(key);
+    else this.db.prepare("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, JSON.stringify(value));
+  }
+  close() {
+    this.db.close();
+  }
+};
+
+// packages/client/src/credentials.js
+import fs2 from "node:fs";
+var Credentials = class {
+  constructor(file) {
+    this.file = file;
+  }
+  async load() {
+    try {
+      const raw = fs2.readFileSync(this.file);
+      const json = isWindows ? (await import("./win32-DF53YR5N.js")).unprotect(raw).toString() : raw.toString();
+      return JSON.parse(json);
+    } catch {
+      return null;
+    }
+  }
+  async save(creds) {
+    const json = Buffer.from(JSON.stringify(creds));
+    const data = isWindows ? (await import("./win32-DF53YR5N.js")).protect(json) : json;
+    fs2.writeFileSync(this.file, data, { mode: 384 });
+  }
+  clear() {
+    fs2.rmSync(this.file, { force: true });
+  }
+};
+
+// packages/client/src/api.js
+import fs3 from "node:fs";
+import path from "node:path";
+import crypto3 from "node:crypto";
+
+// packages/shared/src/content.js
+import crypto from "node:crypto";
+var BOM = Buffer.from([239, 187, 191]);
+function isBinary(buf) {
+  const n = Math.min(buf.length, 8192);
+  for (let i = 0; i < n; i++) if (buf[i] === 0) return true;
+  return false;
+}
+function detectStyle(buf) {
+  const bom = buf.length >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191;
+  let eol = null;
+  const i = buf.indexOf(10);
+  if (i >= 0) eol = i > 0 && buf[i - 1] === 13 ? "crlf" : "lf";
+  return { eol, bom };
+}
+function canonicalize(buf, eolMode = "auto") {
+  if (eolMode === "binary" || isBinary(buf)) return { bytes: buf, text: false };
+  let start = 0;
+  if (buf.length >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191) start = 3;
+  const out = Buffer.allocUnsafe(buf.length - start);
+  let j = 0;
+  for (let i = start; i < buf.length; i++) {
+    if (buf[i] === 13 && buf[i + 1] === 10) continue;
+    out[j++] = buf[i];
+  }
+  return { bytes: out.subarray(0, j), text: true };
+}
+function sha256(buf) {
+  return crypto.createHash("sha256").update(buf).digest("hex");
+}
+function renderForLocal(canonical, eolMode, style, platformEol2) {
+  if (eolMode === "binary" || isBinary(canonical)) return canonical;
+  let eol;
+  if (eolMode === "lf" || eolMode === "crlf") eol = eolMode;
+  else eol = style?.eol ?? platformEol2;
+  let body = canonical;
+  if (eol === "crlf") {
+    let count = 0;
+    for (const b of canonical) if (b === 10) count++;
+    body = Buffer.allocUnsafe(canonical.length + count);
+    let j = 0;
+    for (const b of canonical) {
+      if (b === 10) body[j++] = 13;
+      body[j++] = b;
+    }
+  }
+  return style?.bom ? Buffer.concat([BOM, body]) : body;
+}
+function defaultEolFor(name) {
+  const lower = name.toLowerCase();
+  if (/\.(sh|bash|zsh)$/.test(lower)) return "lf";
+  if (/\.(bat|cmd)$/.test(lower)) return "crlf";
+  return "auto";
+}
+function globMatch(glob, relPath) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*" && glob[i + 1] === "*") {
+      re += ".*";
+      i++;
+    } else if (c === "*") re += "[^/]*";
+    else if (c === "?") re += "[^/]";
+    else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  const target = glob.includes("/") ? relPath : relPath.split("/").pop();
+  return new RegExp("^" + re + "$", "i").test(target);
+}
+function resolveEol(relPath, repoRules = {}, explicit) {
+  if (explicit) return explicit;
+  for (const [glob, mode] of Object.entries(repoRules)) if (globMatch(glob, relPath)) return mode;
+  return defaultEolFor(relPath);
+}
+
+// packages/shared/src/names.js
+var RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+var ILLEGAL = /[<>:"/\\|?*\u0000-\u001f]/;
+var MAX_REL_PATH = 200;
+function nameError(name) {
+  if (!name || name === "." || name === "..") return `invalid name "${name}"`;
+  if (ILLEGAL.test(name)) return `"${name}" contains a character not allowed on Windows`;
+  if (/[. ]$/.test(name)) return `"${name}" ends with a dot or space`;
+  if (RESERVED.test(name)) return `"${name}" is a reserved name on Windows`;
+  if (Buffer.byteLength(name) > 255) return `"${name}" is too long`;
+  return null;
+}
+function relPathError(relPath) {
+  if (typeof relPath !== "string" || !relPath) return "empty path";
+  if (relPath.length > MAX_REL_PATH) return `path "${relPath}" is longer than ${MAX_REL_PATH} characters`;
+  if (relPath.startsWith("/")) return `path "${relPath}" must be relative`;
+  for (const seg of relPath.split("/")) {
+    const e = nameError(seg);
+    if (e) return e;
+  }
+  return null;
+}
+function caseCollisionError(relPaths) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const p of relPaths) {
+    const segs = p.split("/");
+    for (let i = 1; i <= segs.length; i++) {
+      const prefix = segs.slice(0, i).join("/");
+      const key = prefix.toLowerCase();
+      const prev = seen.get(key);
+      if (prev !== void 0 && prev !== prefix) return `"${prev}" and "${prefix}" differ only by case`;
+      seen.set(key, prefix);
+    }
+  }
+  const files2 = new Set(relPaths.map((p) => p.toLowerCase()));
+  for (const p of relPaths) {
+    const segs = p.toLowerCase().split("/");
+    for (let i = 1; i < segs.length; i++) {
+      const prefix = segs.slice(0, i).join("/");
+      if (files2.has(prefix)) return `"${prefix}" is both a file and a folder`;
+    }
+  }
+  return null;
+}
+
+// packages/shared/src/ids.js
+import crypto2 from "node:crypto";
+var ALPHABET = "abcdefghijkmnpqrstuvwxyz23456789";
+function randomString(len) {
+  const bytes = crypto2.randomBytes(len);
+  let out = "";
+  for (let i = 0; i < len; i++) out += ALPHABET[bytes[i] % ALPHABET.length];
+  return out;
+}
+var newInstanceId = () => "i_" + randomString(10);
+
+// packages/client/src/api.js
+var ApiError = class extends Error {
+  constructor(status, body) {
+    super(body?.message ?? `HTTP ${status}`);
+    this.status = status;
+    this.code = body?.code;
+    this.body = body;
+  }
+};
+var OfflineError = class extends Error {
+};
+var FIREBASE_ERRORS = {
+  EMAIL_EXISTS: "an account with that email already exists",
+  INVALID_LOGIN_CREDENTIALS: "wrong email or password",
+  INVALID_PASSWORD: "wrong email or password",
+  EMAIL_NOT_FOUND: "wrong email or password",
+  USER_DISABLED: "this account has been disabled",
+  TOKEN_EXPIRED: "session expired, run `tether login`",
+  INVALID_REFRESH_TOKEN: "session expired, run `tether login`",
+  USER_NOT_FOUND: "account no longer exists, run `tether login`",
+  INVALID_EMAIL: "a valid email is required"
+};
+function firebaseMessage(code = "") {
+  const key = code.split(":")[0].split(" ")[0].trim();
+  if (key.startsWith("WEAK_PASSWORD")) return "password must be at least 6 characters";
+  if (key.startsWith("TOO_MANY_ATTEMPTS")) return "too many attempts; try again later";
+  return FIREBASE_ERRORS[key] ?? `sign-in failed (${code || "unknown error"})`;
+}
+var Api = class {
+  constructor({ config, credentials }) {
+    this.config = config;
+    this.credentials = credentials;
+    this.accessToken = null;
+  }
+  get base() {
+    return this.config.get("server").replace(/\/$/, "");
+  }
+  async raw(method, p, body, token) {
+    let res;
+    try {
+      res = await fetch(this.base + "/v1" + p, {
+        method,
+        headers: { "content-type": "application/json", ...token ? { authorization: `Bearer ${token}` } : {} },
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal: AbortSignal.timeout(3e4)
+      });
+    } catch (e) {
+      throw new OfflineError(`cannot reach the Tether server at ${this.base} (${e.cause?.code ?? e.message})`);
+    }
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok) throw new ApiError(res.status, json.error);
+    return json;
+  }
+  /** The server's auth setup: { auth: 'local' } or { auth: 'firebase', apiKey, emulatorHost? }. */
+  async serverConfig() {
+    if (this.cfg?.base === this.base) return this.cfg.value;
+    const value = await this.raw("GET", "/config");
+    this.cfg = { base: this.base, value };
+    return value;
+  }
+  /** Google endpoints (or the Auth emulator) for Firebase sign-in. */
+  googleUrl(service, method, cfg) {
+    const root = cfg.emulatorHost ? `http://${cfg.emulatorHost}/${service}.googleapis.com/v1` : `https://${service}.googleapis.com/v1`;
+    return `${root}/${method}?key=${encodeURIComponent(cfg.apiKey)}`;
+  }
+  async google(service, method, body, form = false) {
+    const cfg = await this.serverConfig();
+    let res;
+    try {
+      res = await fetch(this.googleUrl(service, method, cfg), {
+        method: "POST",
+        headers: { "content-type": form ? "application/x-www-form-urlencoded" : "application/json" },
+        body: form ? new URLSearchParams(body).toString() : JSON.stringify(body),
+        signal: AbortSignal.timeout(3e4)
+      });
+    } catch (e) {
+      throw new OfflineError(`cannot reach Firebase Auth (${e.cause?.code ?? e.message})`);
+    }
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok) throw new ApiError(res.status === 400 ? 401 : res.status, { code: "unauthorized", message: firebaseMessage(json.error?.message) });
+    return json;
+  }
+  async token() {
+    if (this.accessToken && (!this.accessExp || Date.now() < this.accessExp)) return this.accessToken;
+    const creds = await this.credentials.load();
+    if (!creds?.refreshToken) throw new ApiError(401, { code: "unauthorized", message: "not signed in, run `tether login`" });
+    if (creds.firebase) {
+      const r2 = await this.google("securetoken", "token", { grant_type: "refresh_token", refresh_token: creds.refreshToken }, true);
+      this.accessToken = r2.id_token;
+      this.accessExp = Date.now() + (Number(r2.expires_in) - 120) * 1e3;
+      return this.accessToken;
+    }
+    const r = await this.raw("POST", "/auth/refresh", { refreshToken: creds.refreshToken });
+    this.accessToken = r.accessToken;
+    this.accessExp = null;
+    return this.accessToken;
+  }
+  /** Email + password sign-in (or sign-up) against whichever auth system the server uses. */
+  async passwordLogin({ email, password, signup }) {
+    const cfg = await this.serverConfig();
+    if (cfg.auth !== "firebase") return this.signedIn(await this.raw("POST", signup ? "/auth/signup" : "/auth/login", { email, password }));
+    const r = await this.google("identitytoolkit", signup ? "accounts:signUp" : "accounts:signInWithPassword", { email, password, returnSecureToken: true });
+    return this.firebaseSignedIn(r.idToken, r.refreshToken, r.expiresIn);
+  }
+  /** Completes the browser login: the console's one-time code becomes a session. */
+  async exchangeCliCode(code) {
+    const r = await this.raw("POST", "/auth/cli-exchange", { code });
+    if (!r.customToken) return this.signedIn(r);
+    const t = await this.google("identitytoolkit", "accounts:signInWithCustomToken", { token: r.customToken, returnSecureToken: true });
+    return this.firebaseSignedIn(t.idToken, t.refreshToken, t.expiresIn);
+  }
+  async firebaseSignedIn(idToken, refreshToken, expiresIn) {
+    this.accessToken = idToken;
+    this.accessExp = Date.now() + (Number(expiresIn) - 120) * 1e3;
+    const user = await this.raw("GET", "/me", void 0, idToken);
+    await this.credentials.save({ firebase: true, refreshToken, user, server: this.base });
+    return user;
+  }
+  /** Authenticated call; refreshes the access token once on 401. */
+  async call(method, p, body) {
+    try {
+      return await this.raw(method, p, body, await this.token());
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 401 && this.accessToken) {
+        this.accessToken = null;
+        return this.raw(method, p, body, await this.token());
+      }
+      throw e;
+    }
+  }
+  async signedIn(tokens) {
+    await this.credentials.save({ refreshToken: tokens.refreshToken, user: tokens.user, server: this.base });
+    this.accessToken = tokens.accessToken;
+    this.accessExp = null;
+    return tokens.user;
+  }
+  async logout() {
+    const creds = await this.credentials.load();
+    if (creds?.refreshToken && !creds.firebase) await this.raw("POST", "/auth/logout", { refreshToken: creds.refreshToken }).catch(() => {
+    });
+    this.credentials.clear();
+    this.accessToken = null;
+  }
+  /** Uploads canonical blobs the server doesn't have yet. blobs: [{ sha256, bytes }] */
+  async uploadBlobs(blobs) {
+    const unique = [...new Map(blobs.map((b) => [b.sha256, b])).values()];
+    if (!unique.length) return;
+    const { upload } = await this.call("POST", "/blobs/upload", { blobs: unique.map((b) => ({ sha256: b.sha256, size: b.bytes.length })) });
+    const bySha = new Map(unique.map((b) => [b.sha256, b]));
+    for (const u of upload) {
+      const res = await fetch(u.url, { method: "PUT", headers: u.headers ?? {}, body: bySha.get(u.sha256).bytes });
+      if (!res.ok && res.status !== 412) throw new ApiError(res.status, { message: `upload failed (${res.status}): ${(await res.text().catch(() => "")).slice(0, 200)}` });
+    }
+  }
+  /** Downloads blobs for [{ artifactId, version? }] into the cache; skips blobs already cached. */
+  async fetchBlobs(cache, items) {
+    if (!items.length) return [];
+    const { downloads } = await this.call("POST", "/blobs/download", { items });
+    for (const d of downloads) {
+      if (cache.has(d.sha256)) continue;
+      const res = await fetch(d.url);
+      if (!res.ok) throw new ApiError(res.status, { message: `download failed (${res.status})` });
+      const bytes = Buffer.from(await res.arrayBuffer());
+      if (sha256(bytes) !== d.sha256) throw new Error("downloaded content does not match its hash");
+      cache.put(d.sha256, bytes);
+    }
+    return downloads;
+  }
+};
+var BlobCache = class {
+  constructor(dir) {
+    this.dir = dir;
+    fs3.mkdirSync(dir, { recursive: true });
+  }
+  file(sha) {
+    return path.join(this.dir, sha.slice(0, 2), sha);
+  }
+  has(sha) {
+    return !!sha && fs3.existsSync(this.file(sha));
+  }
+  get(sha) {
+    return fs3.readFileSync(this.file(sha));
+  }
+  put(sha, bytes) {
+    const f = this.file(sha);
+    if (fs3.existsSync(f)) return;
+    fs3.mkdirSync(path.dirname(f), { recursive: true });
+    const tmp = f + "." + crypto3.randomBytes(4).toString("hex");
+    fs3.writeFileSync(tmp, bytes);
+    fs3.renameSync(tmp, f);
+  }
+};
+
+// packages/client/src/platform/tracker.js
+import fs4 from "node:fs";
+import path2 from "node:path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".cache", ".npm", ".cargo", ".rustup", "proc", "sys"]);
+var MAX_SCAN_ENTRIES = 3e5;
+var WindowsTracker = class {
+  constructor(win32) {
+    this.w = win32;
+    this.name = "windows-fileid";
+  }
+  identify(p) {
+    return this.w.fileIdentity(p);
+  }
+  isTrash(p) {
+    return this.w.isTrashPath(p);
+  }
+  async findAll(instances) {
+    const out = /* @__PURE__ */ new Map();
+    for (const inst of instances) {
+      if (!inst.fileId) {
+        out.set(inst.instanceId, { status: "gone" });
+        continue;
+      }
+      const here = this.identify(inst.path);
+      if (here && here.fileId === inst.fileId && here.volumeId === inst.volumeId) {
+        let real = inst.path;
+        try {
+          real = fs4.realpathSync.native(inst.path);
+        } catch {
+        }
+        out.set(inst.instanceId, { status: "found", path: real });
+        continue;
+      }
+      const root = path2.parse(inst.path).root;
+      if (!fs4.existsSync(root)) {
+        out.set(inst.instanceId, { status: "unavailable" });
+        continue;
+      }
+      const p = this.w.pathById(inst.volumeId, inst.fileId, inst.path);
+      if (p === null && !this.w.fileIdentity(root)) out.set(inst.instanceId, { status: "unavailable" });
+      else if (p === null || this.isTrash(p)) out.set(inst.instanceId, { status: "gone" });
+      else out.set(inst.instanceId, { status: "found", path: p });
+    }
+    return out;
+  }
+};
+var ScanTracker = class {
+  constructor({ scanRoots }) {
+    this.scanRoots = scanRoots;
+    this.name = "scan";
+  }
+  identify(p) {
+    try {
+      const s = fs4.statSync(p, { bigint: true });
+      return { volumeId: s.dev.toString(16), fileId: s.ino.toString(16) };
+    } catch {
+      return null;
+    }
+  }
+  isTrash(p) {
+    return /[\\/](\.local[\\/]share[\\/]Trash|\.Trash(-\d+)?|\$Recycle\.Bin)[\\/]/i.test(p);
+  }
+  async findAll(instances, hintDirs = []) {
+    const out = /* @__PURE__ */ new Map();
+    const want = /* @__PURE__ */ new Map();
+    for (const inst of instances) {
+      const here = this.identify(inst.path);
+      if (here && here.fileId === inst.fileId && here.volumeId === inst.volumeId) out.set(inst.instanceId, { status: "found", path: inst.path });
+      else if (inst.fileId) want.set(`${inst.volumeId}:${inst.fileId}`, inst);
+      else out.set(inst.instanceId, { status: "gone" });
+    }
+    if (want.size) {
+      const dirs = [.../* @__PURE__ */ new Set([...hintDirs, ...[...want.values()].map((i) => path2.dirname(i.path))])];
+      this.scan(dirs, want, out, 1);
+      if (want.size) this.scan(this.scanRoots, want, out, Infinity);
+    }
+    for (const inst of want.values()) out.set(inst.instanceId, { status: "gone" });
+    return out;
+  }
+  scan(roots, want, out, maxDepth) {
+    let budget = MAX_SCAN_ENTRIES;
+    const queue = roots.filter((r) => fs4.existsSync(r)).map((r) => [r, 0]);
+    const seen = /* @__PURE__ */ new Set();
+    while (queue.length && want.size && budget > 0) {
+      const [dir, depth] = queue.shift();
+      if (seen.has(dir) || this.isTrash(dir + path2.sep)) continue;
+      seen.add(dir);
+      let entries;
+      try {
+        entries = fs4.readdirSync(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const e of entries) {
+        if (--budget <= 0) break;
+        const p = path2.join(dir, e.name);
+        if (e.isSymbolicLink()) continue;
+        const id = this.identify(p);
+        const key = id && `${id.volumeId}:${id.fileId}`;
+        if (key && want.has(key)) {
+          out.set(want.get(key).instanceId, { status: "found", path: p });
+          want.delete(key);
+        }
+        if (e.isDirectory() && depth + 1 < maxDepth && !SKIP_DIRS.has(e.name)) queue.push([p, depth + 1]);
+      }
+    }
+  }
+};
+async function createTracker(config) {
+  const choice = process.env.TETHER_TRACKER || (isWindows ? "windows" : "scan");
+  if (choice === "windows") return new WindowsTracker(await import("./win32-DF53YR5N.js"));
+  return new ScanTracker({ scanRoots: config.get("scanRoots") });
+}
+
+// packages/client/src/engine.js
+import fs6 from "node:fs";
+import path4 from "node:path";
+import { createTwoFilesPatch } from "diff";
+
+// packages/client/src/fsops.js
+import fs5 from "node:fs";
+import path3 from "node:path";
+var platformEol = isWindows ? "crlf" : "lf";
+var LockedError = class extends Error {
+};
+var samePath = (a, b) => isWindows ? a.toLowerCase() === b.toLowerCase() : a === b;
+function isUnder(child, dir) {
+  const rel = path3.relative(dir, child);
+  return rel === "" || !!rel && !rel.startsWith("..") && !path3.isAbsolute(rel);
+}
+function canonicalPath(p) {
+  try {
+    return fs5.realpathSync.native(p);
+  } catch {
+    return path3.resolve(p);
+  }
+}
+function statOrNull(p) {
+  try {
+    return fs5.statSync(p);
+  } catch {
+    return null;
+  }
+}
+function readLocal(p, eolMode) {
+  let bytes, st;
+  try {
+    bytes = fs5.readFileSync(p);
+    st = fs5.statSync(p);
+  } catch (e) {
+    if (e.code === "ENOENT" || e.code === "EISDIR") return null;
+    if (["EBUSY", "EPERM", "EACCES"].includes(e.code)) throw new LockedError(`${p} is locked by another program`);
+    throw e;
+  }
+  const canonical = canonicalize(bytes, eolMode).bytes;
+  return { bytes, canonical, hash: sha256(canonical), style: detectStyle(bytes), size: st.size, mtimeMs: st.mtimeMs };
+}
+function writeLocal(p, canonical, eolMode, { exec = false, style = null } = {}) {
+  let existing = null;
+  try {
+    existing = fs5.readFileSync(p);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw toLocked(e, p);
+  }
+  const useStyle = style ?? (existing ? detectStyle(existing) : null);
+  const bytes = renderForLocal(canonical, eolMode, useStyle, platformEol);
+  try {
+    if (existing) {
+      const fd = fs5.openSync(p, "r+");
+      try {
+        fs5.ftruncateSync(fd, 0);
+        fs5.writeSync(fd, bytes, 0, bytes.length, 0);
+      } finally {
+        fs5.closeSync(fd);
+      }
+    } else {
+      fs5.mkdirSync(path3.dirname(p), { recursive: true });
+      fs5.writeFileSync(p, bytes, { flag: "wx" });
+    }
+    if (!isWindows) fs5.chmodSync(p, exec ? 493 : fs5.statSync(p).mode & ~73 & 511);
+  } catch (e) {
+    throw toLocked(e, p);
+  }
+  const st = fs5.statSync(p);
+  const written = detectStyle(bytes);
+  return { size: st.size, mtimeMs: st.mtimeMs, eolStyle: written.eol ?? useStyle?.eol ?? null, hasBom: written.bom };
+}
+var styleOf = (local) => ({ eolStyle: local.style.eol, hasBom: local.style.bom });
+function toLocked(e, p) {
+  if (["EBUSY", "EPERM", "EACCES"].includes(e.code)) return new LockedError(`${p} is locked or read-only; will retry`);
+  return e;
+}
+function keepBothName(p) {
+  const dir = path3.dirname(p);
+  const ext = path3.extname(p);
+  const stem = path3.basename(p, ext);
+  for (let n = 1; ; n++) {
+    const candidate = path3.join(dir, `${stem} (local copy${n > 1 ? " " + n : ""})${ext}`);
+    if (!fs5.existsSync(candidate)) return candidate;
+  }
+}
+function moveFile(from, to) {
+  fs5.mkdirSync(path3.dirname(to), { recursive: true });
+  fs5.renameSync(from, to);
+}
+function pruneEmptyDirs(dir, stopAt) {
+  while (isUnder(dir, stopAt) && !samePath(dir, stopAt)) {
+    try {
+      fs5.rmdirSync(dir);
+    } catch {
+      return;
+    }
+    dir = path3.dirname(dir);
+  }
+}
+function walkFiles(root) {
+  const files2 = [];
+  const symlinks = [];
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    for (const e of fs5.readdirSync(dir, { withFileTypes: true })) {
+      const abs = path3.join(dir, e.name);
+      const rel = path3.relative(root, abs).split(path3.sep).join("/");
+      if (e.isSymbolicLink()) symlinks.push(rel);
+      else if (e.isDirectory()) stack.push(abs);
+      else if (e.isFile()) files2.push({ abs, rel });
+    }
+  }
+  return { files: files2.sort((a, b) => a.rel.localeCompare(b.rel)), symlinks };
+}
+
+// packages/client/src/engine.js
+var UserError = class extends Error {
+};
+var ACTIVE = (i) => i.mode !== "orphaned";
+var Engine = class {
+  constructor({ db, api, cache, tracker, config, log = () => {
+  }, notify = () => {
+  }, home = null, cliPath = null }) {
+    this.db = db;
+    this.api = api;
+    this.cache = cache;
+    this.tracker = tracker;
+    this.config = config;
+    this.log = log;
+    this.notify = notify;
+    this.home = home;
+    this.cliPath = cliPath;
+    this.gitState = /* @__PURE__ */ new Map();
+    this.busyCache = null;
+    this.offline = null;
+    this.lastTick = null;
+    this.graceDue = null;
+    this.queue = Promise.resolve();
+  }
+  /** Serializes everything that touches instances (ticks, watcher passes, commands). */
+  locked(fn) {
+    const run = this.queue.then(fn, fn);
+    this.queue = run.catch(() => {
+    });
+    return run;
+  }
+  // ---------- helpers ----------
+  folderOf(inst) {
+    return inst.folderInstanceId ? this.db.get(inst.folderInstanceId) : null;
+  }
+  expectedPath(child, folder = this.folderOf(child)) {
+    return path4.join(folder.path, ...child.relPath.split("/"));
+  }
+  /** Current relative path of a child inside its folder, or null if it was moved out. */
+  localRel(child, folder = this.folderOf(child)) {
+    if (!isUnder(child.path, folder.path) || samePath(child.path, folder.path)) return null;
+    return path4.relative(folder.path, child.path).split(path4.sep).join("/");
+  }
+  identity(p) {
+    const id = this.tracker.identify(p);
+    if (!id) throw new Error(`cannot read the file ID of ${p}`);
+    return id;
+  }
+  blobFor(sha) {
+    if (!this.cache.has(sha)) throw new Error(`content ${sha.slice(0, 12)} is not in the local cache`);
+    return this.cache.get(sha);
+  }
+  async ensureBlobs(pairs) {
+    const missing = pairs.filter((p) => p.sha && !this.cache.has(p.sha));
+    if (missing.length) await this.api.fetchBlobs(this.cache, missing.map(({ artifactId, version }) => ({ artifactId, version })));
+  }
+  /** Writes content for an instance at `p`; records the result for the quick change check. */
+  writeInstance(inst, p, sha, eolMode = inst.eolMode, exec = inst.exec) {
+    const style = inst.eolStyle ? { eol: inst.eolStyle, bom: !!inst.hasBom } : null;
+    return writeLocal(p, this.blobFor(sha), eolMode, { exec, style });
+  }
+  // ---------- tick ----------
+  async tick({ remote = true } = {}) {
+    this.busyCache = /* @__PURE__ */ new Map();
+    await this.locateAll();
+    if (remote) await this.gitTransitions();
+    if (remote) {
+      await this.checkRemote();
+      await this.syncRealtime();
+    }
+    await this.enforceLocal();
+    this.lastTick = Date.now();
+  }
+  // ---------- git integration ----------
+  isGitBusy(inst) {
+    if (!inst.gitDir) return false;
+    this.busyCache ??= /* @__PURE__ */ new Map();
+    if (!this.busyCache.has(inst.gitDir)) this.busyCache.set(inst.gitDir, gitBusy(inst.gitDir));
+    return !!this.busyCache.get(inst.gitDir);
+  }
+  /** Sets the git mode on an instance (and a folder's files). Throws if follow is not allowed. */
+  applyGitMode(root, mode) {
+    if (!root) return;
+    if (!GIT_MODES.includes(mode)) throw new UserError(`git mode must be one of ${GIT_MODES.join(", ")}`);
+    if (mode === "follow" && root.role === "viewer") throw new UserError("git follow mode needs editor access");
+    const repo = findRepo(root.path);
+    if (!repo) throw new UserError(`${root.path} is not inside a git repository`);
+    const fields = { gitMode: mode, gitRoot: repo.root, gitDir: repo.gitDir, gitHooks: repo.hooksDir };
+    for (const i of [root, ...root.kind === "folder" ? this.db.childrenOf(root.instanceId) : []]) this.db.update(i.instanceId, fields);
+    this.syncGitHooks();
+  }
+  /** `tether git <path> [--mode]`: show or change the git mode of managed files. */
+  gitMode({ path: p, mode }) {
+    const ts = this.targets(p);
+    const folders = new Set(ts.filter((i) => i.kind === "folder").map((i) => i.instanceId));
+    if (mode) for (const i of ts.filter((x) => !x.folderInstanceId || !folders.has(x.folderInstanceId))) this.applyGitMode(i.folderInstanceId ? this.db.get(i.folderInstanceId) : i, mode);
+    return this.targets(p).map((i) => ({ path: i.path, kind: i.kind, role: i.role, gitMode: this.db.get(i.instanceId)?.gitMode ?? null, gitRoot: this.db.get(i.instanceId)?.gitRoot ?? findRepo(i.path)?.root ?? null }));
+  }
+  /** Installs hooks in repositories with follow-mode files and removes them where none remain. */
+  syncGitHooks() {
+    if (!this.home || !this.cliPath) return;
+    const want = new Set(this.db.all().filter((i) => i.gitMode === "follow" && i.mode !== "orphaned" && i.gitHooks).map((i) => i.gitHooks));
+    const had = new Set(this.db.getMeta("gitHooks") ?? []);
+    for (const dir of want) {
+      try {
+        installHooks(dir, { home: this.home, node: process.execPath, cli: this.cliPath });
+      } catch (e) {
+        this.log(`could not install git hooks in ${dir}: ${e.message}`);
+      }
+    }
+    for (const dir of had) if (!want.has(dir)) removeHooks(dir, this.home);
+    this.db.setMeta("gitHooks", [...want]);
+  }
+  /** Repositories that just finished a git operation (merge resolved, rebase done) get reconciled. */
+  async gitTransitions() {
+    const dirs = /* @__PURE__ */ new Map();
+    for (const i of this.db.all()) if (i.gitMode === "follow" && i.gitDir && i.mode !== "orphaned") dirs.set(i.gitDir, i.gitRoot);
+    for (const [gitDir, root] of dirs) {
+      const busy = gitBusy(gitDir);
+      const was = this.gitState.get(gitDir);
+      this.gitState.set(gitDir, busy);
+      if (was && !busy) await this.gitReconcile(root);
+    }
+  }
+  /**
+   * After git changed files (hook, or the end of a merge/rebase): publish git's version of
+   * follow-mode files. If Tether also moved on, the file stays in editing mode for `tether done`.
+   */
+  async gitReconcile(root) {
+    if (gitBusy(findRepo(root)?.gitDir)) return { busy: true };
+    const mine = () => this.db.all().filter((i) => i.gitMode === "follow" && i.kind === "file" && i.mode === "normal" && i.gitRoot && samePath(i.gitRoot, root));
+    for (const i of mine().filter((x) => x.detached)) {
+      if (statOrNull(i.path)?.isFile()) {
+        this.db.update(i.instanceId, { ...this.identity(i.path), detached: false, missingSince: null, size: null, mtimeMs: null });
+        this.log(`${i.path}: back (restored by git)`);
+      }
+    }
+    await this.locateAll();
+    const changed = [];
+    for (const i of mine().filter((x) => !x.detached)) {
+      try {
+        const local = readLocal(i.path, i.eolMode);
+        if (local && local.hash !== i.baseHash) changed.push({ inst: i, local });
+      } catch {
+      }
+    }
+    if (!changed.length) return { published: 0 };
+    let results;
+    try {
+      ({ results } = await this.api.call("POST", "/sync/check", { items: changed.map(({ inst }) => ({ artifactId: inst.artifactId, version: inst.baseVersion })) }));
+    } catch (e) {
+      if (!(e instanceof OfflineError)) throw e;
+      for (const { inst } of changed) this.db.update(inst.instanceId, { mode: "editing", lastError: "git changed this file while offline; run `tether done` to publish it" });
+      return { published: 0, offline: true };
+    }
+    let published = 0;
+    for (const [k, { inst, local }] of changed.entries()) {
+      const r = results[k];
+      const name = path4.basename(inst.path);
+      if (r.status === "gone" || r.state?.deleted || r.folderDeleted) {
+        this.orphan(inst, r.reason ?? "deleted");
+        continue;
+      }
+      if (r.role === "viewer") {
+        this.db.update(inst.instanceId, { gitMode: "keep", role: "viewer" });
+        continue;
+      }
+      const conflict = () => {
+        this.db.update(inst.instanceId, { mode: "editing", lastError: "conflict: git changed this file and Tether has a newer version; run `tether done` to resolve" });
+        this.log(`${inst.path}: git changed it but Tether also has a newer version; left in editing mode`);
+        this.notify({ kind: "conflict", level: "warn", title: "Merge conflict (git and Tether)", body: `${name}: git changed it, but someone also pushed a newer version to Tether. Git's version is kept and the file is in editing mode; run "tether done" to choose.`, short: name, artifactId: inst.artifactId });
+      };
+      if (r.status === "changed") {
+        conflict();
+        continue;
+      }
+      try {
+        await this.api.uploadBlobs([{ sha256: local.hash, bytes: local.canonical }]);
+        this.cache.put(local.hash, local.canonical);
+        const c = await this.api.call("POST", `/artifacts/${inst.artifactId}/commit`, { baseVersion: inst.baseVersion, change: { blob: local.hash, size: local.canonical.length } });
+        this.db.update(inst.instanceId, { baseVersion: c.version, remoteVersion: c.version, baseHash: local.hash, size: local.size, mtimeMs: local.mtimeMs, ...styleOf(local), lastError: null });
+        this.log(`${inst.path}: published git's version as v${c.version}`);
+        this.notify({ kind: "git-published", level: "info", title: "Published git's changes", body: `${name} is now v${c.version} for everyone who has it.`, short: name, artifactId: inst.artifactId });
+        published++;
+      } catch (e) {
+        if (e instanceof ApiError && e.status === 409) conflict();
+        else if (e instanceof ApiError) {
+          this.db.update(inst.instanceId, { mode: "editing", lastError: `could not publish git's version: ${e.message}` });
+          this.notify({ kind: "push-failed", level: "error", title: "Push failed", body: `${name}: ${e.message}. Git's version is kept in editing mode.`, short: name, artifactId: inst.artifactId });
+        } else throw e;
+      }
+    }
+    return { published };
+  }
+  // ---------- realtime editing ----------
+  /** Files this client is editing live (every save is pushed). */
+  realtimeInstances() {
+    return this.db.all().filter((i) => i.realtime && i.mode === "editing" && i.kind === "file");
+  }
+  /** True while anything held here is being edited live, so the daemon checks more often. */
+  get realtimeActive() {
+    return this.db.all().some((i) => i.realtime && i.mode === "editing" || i.remoteRealtime && i.mode !== "orphaned");
+  }
+  async releaseRealtime(inst) {
+    this.db.update(inst.instanceId, { realtime: false });
+    await this.api.call("POST", `/artifacts/${inst.artifactId}/realtime`, { action: "stop" }).catch(() => {
+    });
+  }
+  /**
+   * Pushes live edits: renews the session, applies incoming versions when there is no local
+   * change, pushes local changes when the server has not moved, and pauses on a conflict.
+   */
+  async syncRealtime() {
+    const rts = this.realtimeInstances().filter((i) => !i.detached);
+    if (!rts.length) return;
+    let results;
+    try {
+      ({ results } = await this.api.call("POST", "/sync/check", { items: rts.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion, realtime: true })) }));
+    } catch (e) {
+      if (e instanceof OfflineError) return this.offline = e.message;
+      throw e;
+    }
+    for (const [k, inst] of rts.entries()) {
+      const r = results[k];
+      const cur = this.db.get(inst.instanceId);
+      if (!cur || cur.mode !== "editing" || !cur.realtime) continue;
+      if (r.status === "gone" || r.state?.deleted || r.folderDeleted) {
+        this.orphan(cur, r.reason ?? "deleted");
+        continue;
+      }
+      if (!r.realtime?.mine) {
+        const why = r.role === "viewer" ? "you are no longer an editor" : r.realtime ? `taken over by ${r.realtime.email}` : "it ended";
+        this.db.update(cur.instanceId, { realtime: false, lastError: r.role === "viewer" ? null : `realtime session lost (${why}); still editing, run \`tether done\` to push` });
+        this.log(`${cur.path}: realtime session lost (${why})`);
+        this.notify({ kind: "realtime-lost", level: "warn", title: "Live editing stopped", body: `${path4.basename(cur.path)}: your realtime session ${why}. Your changes are kept; run "tether done" to push them.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+        continue;
+      }
+      try {
+        const local = readLocal(cur.path, cur.eolMode);
+        if (r.status === "changed") {
+          if (!local || local.hash === cur.baseHash) {
+            await this.ensureBlobs([{ artifactId: cur.artifactId, version: r.state.version, sha: r.state.blob }]);
+            this.applyIncoming(cur, r.state);
+          } else {
+            if (!cur.lastError?.startsWith("conflict")) {
+              this.log(`${cur.path}: someone else pushed while you were editing live; live pushing paused, run \`tether done\` to resolve`);
+              this.notify({ kind: "conflict", level: "warn", title: "Merge conflict", body: `${path4.basename(cur.path)}: someone else pushed while you were editing live. Live pushing is paused; run "tether done" to choose what to keep.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+            }
+            this.db.update(cur.instanceId, { lastError: "conflict: the server changed; run `tether done` to resolve" });
+          }
+          continue;
+        }
+        if (!local || local.hash === cur.baseHash) continue;
+        await this.api.uploadBlobs([{ sha256: local.hash, bytes: local.canonical }]);
+        this.cache.put(local.hash, local.canonical);
+        try {
+          const c = await this.api.call("POST", `/artifacts/${cur.artifactId}/commit`, { baseVersion: cur.baseVersion, change: { blob: local.hash, size: local.canonical.length } });
+          this.db.update(cur.instanceId, { baseVersion: c.version, remoteVersion: c.version, baseHash: local.hash, size: local.size, mtimeMs: local.mtimeMs, ...styleOf(local), lastError: null });
+          this.log(`${cur.path}: pushed v${c.version} (realtime)`);
+        } catch (e) {
+          if (!(e instanceof ApiError && e.status === 409)) throw e;
+          this.db.update(cur.instanceId, { lastError: "conflict: the server changed; run `tether done` to resolve" });
+        }
+      } catch (e) {
+        if (!(e instanceof LockedError)) throw e;
+        this.db.update(cur.instanceId, { lastError: e.message });
+      }
+    }
+  }
+  /** Refresh path and file ID of every tracked instance (DESIGN §5). */
+  async locateAll() {
+    const graceMs = this.config.get("graceMs");
+    const all = this.db.all().filter((i) => ACTIVE(i) && !i.detached && !i.needsRestore && i.fileId);
+    all.sort((a, b) => (a.kind === "folder" ? -1 : 0) - (b.kind === "folder" ? -1 : 0));
+    const hints = [...new Set(all.map((i) => path4.dirname(i.path)))];
+    const found = await this.tracker.findAll(all, hints);
+    const now = Date.now();
+    this.graceDue = null;
+    for (const inst of all) {
+      const cur = this.db.get(inst.instanceId);
+      if (!cur || cur.mode === "orphaned" || cur.detached) continue;
+      const r = found.get(inst.instanceId);
+      if (r.status === "found") {
+        if (cur.mode === "lost") {
+          this.db.update(cur.instanceId, { mode: cur.prevMode || "normal", prevMode: null, missingSince: null, path: r.path });
+          this.log(`${r.path}: found again`);
+          continue;
+        }
+        if (!samePath(r.path, cur.path) || r.path !== cur.path) {
+          const idAtOld = cur.kind === "file" && path4.dirname(r.path) === path4.dirname(cur.path) && !samePath(r.path, cur.path) ? this.tracker.identify(cur.path) : null;
+          if (idAtOld && idAtOld.fileId !== cur.fileId && statOrNull(cur.path)?.isFile()) {
+            this.db.update(cur.instanceId, { ...idAtOld, missingSince: null });
+            this.log(`${cur.path}: re-linked after an atomic save`);
+          } else {
+            this.db.update(cur.instanceId, { path: r.path, missingSince: null });
+            if (!samePath(r.path, cur.path)) this.log(`${cur.path} -> ${r.path}: followed move`);
+          }
+        } else if (cur.missingSince) this.db.update(cur.instanceId, { missingSince: null });
+        continue;
+      }
+      if (r.status === "unavailable") {
+        if (cur.mode !== "lost") {
+          this.db.update(cur.instanceId, { mode: "lost", prevMode: cur.mode });
+          this.log(`${cur.path}: volume unavailable, instance is lost`);
+        }
+        continue;
+      }
+      const st = statOrNull(cur.path);
+      if (st && (cur.kind === "folder" ? st.isDirectory() : st.isFile())) {
+        this.db.update(cur.instanceId, { ...this.identity(cur.path), missingSince: null });
+        this.log(`${cur.path}: re-linked after an atomic save`);
+        continue;
+      }
+      if (!cur.missingSince) {
+        this.db.update(cur.instanceId, { missingSince: now });
+        this.graceDue = Math.min(this.graceDue ?? Infinity, now + graceMs);
+      } else if (now - cur.missingSince >= graceMs) {
+        this.disappeared(cur);
+      } else {
+        this.graceDue = Math.min(this.graceDue ?? Infinity, cur.missingSince + graceMs);
+      }
+    }
+  }
+  /** The file is gone for good (after the grace window). DESIGN §7. */
+  disappeared(inst) {
+    if (inst.kind === "folder") {
+      for (const c of this.db.childrenOf(inst.instanceId)) this.db.remove(c.instanceId);
+      this.db.remove(inst.instanceId);
+      this.log(`${inst.path}: folder deleted locally; no longer managed here`);
+      return;
+    }
+    if (inst.gitMode === "follow" && inst.mode === "normal" && !inst.folderInstanceId) {
+      this.db.update(inst.instanceId, { detached: true, missingSince: null });
+      this.log(`${inst.path}: removed (by git?); waiting for git to bring it back`);
+    } else if (inst.mode === "editing") {
+      this.db.update(inst.instanceId, { detached: true, missingSince: null });
+      this.log(`${inst.path}: deleted while editing; resolve with \`tether done\``);
+    } else if (inst.folderInstanceId) {
+      this.db.update(inst.instanceId, { detached: true, mode: "unmanaged", missingSince: null });
+      this.log(`${inst.path}: deleted locally; stopped managing it (\`tether track\` restores it)`);
+    } else {
+      this.db.remove(inst.instanceId);
+      this.log(`${inst.path}: deleted locally; forgotten (pull again to get it back)`);
+    }
+  }
+  orphan(inst, reason) {
+    const targets = inst.kind === "folder" ? [inst, ...this.db.childrenOf(inst.instanceId)] : [inst];
+    for (const t of targets) this.db.update(t.instanceId, { mode: "orphaned", orphanReason: reason });
+    const what = reason === "revoked" ? "access revoked" : reason === "deleted" ? "deleted on the server" : "removed from the server";
+    this.log(`${inst.path}: ${what}; file kept, no longer tracked`);
+    this.notify({ kind: "orphaned", level: "warn", title: "No longer synced", body: `${path4.basename(inst.path)}: ${what}. Your copy stays on disk but Tether no longer keeps it up to date.`, short: path4.basename(inst.path) });
+  }
+  /** One batched call for all instances (DESIGN §6.1 step 2). */
+  async checkRemote() {
+    const insts = this.db.all().filter(ACTIVE);
+    if (!insts.length) {
+      this.offline = null;
+      return;
+    }
+    let results;
+    try {
+      ({ results } = await this.api.call("POST", "/sync/check", { items: insts.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion })) }));
+      this.offline = null;
+    } catch (e) {
+      if (e instanceof OfflineError || e instanceof ApiError && e.status === 401) {
+        this.offline = e.message;
+        if (e instanceof ApiError) this.notify({ kind: "auth", level: "error", key: "auth", cooldownMs: 6 * 3600 * 1e3, title: "Tether needs you to sign in", body: `${e.message}. Until then nothing syncs.` });
+        return;
+      }
+      throw e;
+    }
+    const incoming = [];
+    const folders = [];
+    insts.forEach((inst, idx) => {
+      const r = results[idx];
+      const cur = this.db.get(inst.instanceId);
+      if (!cur || cur.mode === "orphaned") return;
+      if (r.status === "gone") return this.orphan(cur, r.reason);
+      if (r.folderDeleted || r.state?.deleted) return this.orphan(cur, "deleted");
+      const patch = {
+        role: r.role,
+        canDelete: r.canDelete,
+        remoteVersion: r.version,
+        remoteRealtime: r.realtime && !r.realtime.mine ? JSON.stringify({ email: r.realtime.email, since: r.realtime.since }) : null
+      };
+      if (cur.role && cur.role !== "viewer" && r.role === "viewer" && cur.mode === "editing") {
+        patch.mode = "normal";
+        patch.realtime = false;
+        this.log(`${cur.path}: you are now a viewer; editing ended and local changes will be reverted`);
+        this.notify({ kind: "demoted", level: "warn", title: "You are now a viewer", body: `${path4.basename(cur.path)}: your editor access was removed, so your unpushed changes are being reverted.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+      }
+      if (cur.gitMode === "follow" && r.role === "viewer") {
+        patch.gitMode = "keep";
+        this.notify({ kind: "demoted", level: "warn", title: "Git follow mode turned off", body: `${path4.basename(cur.path)}: you are no longer an editor, so git's changes to it will be reverted.`, short: path4.basename(cur.path), artifactId: cur.artifactId });
+      }
+      const now = this.db.update(cur.instanceId, patch);
+      if (r.status !== "changed") return;
+      if (now.mode !== "normal") return;
+      if (now.kind === "folder") folders.push({ inst: now, state: r.state, children: r.children });
+      else if (!now.detached) incoming.push({ inst: now, state: r.state });
+    });
+    const newChildren = [];
+    for (const f of folders) {
+      const have = new Set(this.db.childrenOf(f.inst.instanceId).map((c) => c.artifactId));
+      for (const c of f.children) if (!c.deleted && !have.has(c.artifactId)) newChildren.push({ folder: f.inst, child: c });
+    }
+    try {
+      await this.ensureBlobs([
+        ...incoming.map(({ state }) => ({ artifactId: state.artifactId, version: state.version, sha: state.blob })),
+        ...newChildren.map(({ child }) => ({ artifactId: child.artifactId, version: child.version, sha: child.blob }))
+      ]);
+    } catch (e) {
+      if (e instanceof OfflineError) return this.offline = e.message;
+      throw e;
+    }
+    for (const { inst, state } of incoming) if (!this.isGitBusy(inst)) this.applyIncoming(inst, state);
+    for (const { folder, child } of newChildren) {
+      this.db.insert({
+        instanceId: newInstanceId(),
+        artifactId: child.artifactId,
+        kind: "file",
+        folderInstanceId: folder.instanceId,
+        repoId: child.repoId,
+        name: child.name,
+        relPath: child.relPath,
+        path: path4.join(folder.path, ...child.relPath.split("/")),
+        mode: "normal",
+        baseVersion: child.version,
+        baseHash: child.blob,
+        eolMode: child.eol,
+        exec: child.exec,
+        role: folder.role,
+        canDelete: folder.canDelete,
+        needsRestore: true
+      });
+      this.log(`${folder.path}: new file ${child.relPath}`);
+    }
+    for (const f of folders) this.db.update(f.inst.instanceId, { baseVersion: f.state.version });
+  }
+  /** Normal mode: write an incoming version (content and/or layout). */
+  applyIncoming(inst, state) {
+    try {
+      let p = inst.path;
+      if (inst.folderInstanceId && state.relPath !== inst.relPath) {
+        const folder = this.folderOf(inst);
+        const to = path4.join(folder.path, ...state.relPath.split("/"));
+        this.makeRoom(to, inst);
+        moveFile(inst.path, to);
+        pruneEmptyDirs(path4.dirname(inst.path), folder.path);
+        p = to;
+        this.log(`${inst.path} -> ${to}: moved by the server`);
+      }
+      const patch = { path: p, relPath: state.relPath, baseVersion: state.version, baseHash: state.blob, eolMode: state.eol, exec: state.exec, lastError: null };
+      const localEdit = !this.matchesBase(inst, p) && readLocal(p, inst.eolMode)?.hash !== state.blob;
+      if (state.blob !== inst.baseHash || localEdit) {
+        Object.assign(patch, this.writeInstance(inst, p, state.blob, state.eol, state.exec));
+        this.log(`${p}: updated to version ${state.version}${localEdit ? " (local change replaced)" : ""}`);
+        if (localEdit) {
+          const name = path4.basename(p);
+          this.notify({
+            kind: "revert",
+            level: "info",
+            short: name,
+            artifactId: inst.artifactId,
+            title: inst.gitMode === "keep" ? "Tether undid a git change" : "Tether undid your change",
+            body: `${name} is managed by Tether, so your local change was replaced with the shared version (v${state.version}). Run "tether edit ${name}" to change it.`
+          });
+        }
+      }
+      this.db.update(inst.instanceId, patch);
+    } catch (e) {
+      if (!(e instanceof LockedError)) throw e;
+      this.lockedNotice(inst, e);
+    }
+  }
+  lockedNotice(inst, e) {
+    if (!inst.lastError) this.notify({ kind: "locked", level: "warn", key: `locked:${inst.instanceId}`, cooldownMs: 3600 * 1e3, title: "File in use", body: `${path4.basename(inst.path)} is open in another program, so Tether cannot update it yet. It will retry automatically.`, short: path4.basename(inst.path) });
+    this.db.update(inst.instanceId, { lastError: e.message });
+  }
+  /** If `to` is occupied by something that isn't this instance, move it aside (keep both). */
+  makeRoom(to, inst) {
+    const st = statOrNull(to);
+    if (!st) return;
+    const id = this.tracker.identify(to);
+    if (id && id.fileId === inst.fileId) return;
+    const aside = keepBothName(to);
+    fs6.renameSync(to, aside);
+    this.log(`${to}: existing file kept as ${path4.basename(aside)}`);
+  }
+  matchesBase(inst, p) {
+    const st = statOrNull(p);
+    if (!st) return false;
+    if (st.size === inst.size && st.mtimeMs === inst.mtimeMs) return true;
+    const local = readLocal(p, inst.eolMode);
+    return local?.hash === inst.baseHash;
+  }
+  /** Normal mode: restore missing files, put moved files back, revert local edits. */
+  async enforceLocal() {
+    const restores = this.db.all().filter((i) => ACTIVE(i) && i.needsRestore && i.mode === "normal");
+    try {
+      await this.ensureBlobs(restores.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion, sha: i.baseHash })));
+    } catch (e) {
+      if (!(e instanceof OfflineError)) throw e;
+      this.offline = e.message;
+    }
+    for (const inst of this.db.all()) {
+      if (inst.mode !== "normal" || inst.kind !== "file" || inst.detached) continue;
+      if (this.isGitBusy(inst)) continue;
+      try {
+        if (inst.needsRestore) {
+          if (this.cache.has(inst.baseHash)) this.restore(inst);
+          continue;
+        }
+        let cur = inst;
+        if (cur.folderInstanceId) cur = this.enforceLayout(cur);
+        if (!cur) continue;
+        const st = statOrNull(cur.path);
+        if (!st) continue;
+        if (st.size === cur.size && st.mtimeMs === cur.mtimeMs) continue;
+        const local = readLocal(cur.path, cur.eolMode);
+        if (!local) continue;
+        if (local.hash === cur.baseHash) {
+          this.db.update(cur.instanceId, { size: local.size, mtimeMs: local.mtimeMs, lastError: null });
+          continue;
+        }
+        if (!this.cache.has(cur.baseHash)) continue;
+        this.db.update(cur.instanceId, { ...this.writeInstance(cur, cur.path, cur.baseHash), lastError: null });
+        this.log(`${cur.path}: local change reverted (use \`tether edit\` to change it)`);
+        const byGit = cur.gitMode === "keep";
+        this.notify({
+          kind: "revert",
+          level: "info",
+          short: path4.basename(cur.path),
+          artifactId: cur.artifactId,
+          title: byGit ? "Tether undid a git change" : "Tether undid your change",
+          body: `${path4.basename(cur.path)} is managed by Tether, so it was put back to the shared version. Run "tether edit ${path4.basename(cur.path)}" to change it${byGit ? ', or "tether git <path> --mode follow" to accept git updates' : ""}.`
+        });
+      } catch (e) {
+        if (!(e instanceof LockedError)) throw e;
+        this.lockedNotice(inst, e);
+      }
+    }
+  }
+  /** Normal-mode layout inside a folder: moves inside are reverted; a file moved out is left
+   *  where it is as an ordinary file and the folder gets a fresh copy. */
+  enforceLayout(inst) {
+    const folder = this.folderOf(inst);
+    if (!folder || folder.mode === "orphaned") return inst;
+    const rel = this.localRel(inst, folder);
+    const expected = this.expectedPath(inst, folder);
+    if (rel === null) {
+      this.log(`${inst.path}: moved out of ${folder.path}; left there unmanaged, restoring the folder copy`);
+      const next = this.db.update(inst.instanceId, { path: expected, fileId: null, volumeId: null, needsRestore: true });
+      if (this.cache.has(next.baseHash)) this.restore(next);
+      return null;
+    }
+    if (rel === inst.relPath) return inst;
+    this.makeRoom(expected, inst);
+    moveFile(inst.path, expected);
+    pruneEmptyDirs(path4.dirname(inst.path), folder.path);
+    this.log(`${inst.path}: move reverted to ${inst.relPath}`);
+    return this.db.update(inst.instanceId, { path: expected });
+  }
+  /** Writes a fresh copy at the instance's expected path (new folder files, restores). */
+  restore(inst) {
+    const p = inst.folderInstanceId ? this.expectedPath(inst) : inst.path;
+    const existing = readLocal(p, inst.eolMode);
+    if (existing && existing.hash !== inst.baseHash) this.makeRoom(p, inst);
+    const st = existing && existing.hash === inst.baseHash ? { size: existing.size, mtimeMs: existing.mtimeMs, ...styleOf(existing) } : this.writeInstance(inst, p, inst.baseHash);
+    this.db.update(inst.instanceId, { ...st, ...this.identity(p), path: canonicalPath(p), needsRestore: false, detached: false, missingSince: null, lastError: null });
+  }
+  // ---------- commands ----------
+  async findRepo(ref) {
+    const repos = await this.api.call("GET", "/repos");
+    const r = repos.find((x) => x.repoId === ref || x.name === ref);
+    if (!r) throw new UserError(`no repo "${ref}" (create it with \`tether repo create ${ref}\`)`);
+    return r;
+  }
+  instanceAt(p) {
+    return this.db.all().find((i) => ACTIVE(i) && samePath(i.path, p));
+  }
+  checkOverlap(p) {
+    for (const i of this.db.all().filter(ACTIVE)) {
+      if (samePath(i.path, p)) throw new UserError(`${p} is already managed`);
+      if (i.kind === "folder" && isUnder(p, i.path)) throw new UserError(`${p} is inside the managed folder ${i.path}; use \`tether add\``);
+      if (isUnder(i.path, p)) throw new UserError(`${p} contains the managed path ${i.path}`);
+    }
+  }
+  prepareFile(abs, relForEol, rules, eol) {
+    const st = fs6.lstatSync(abs);
+    if (st.isSymbolicLink()) throw new UserError(`${abs} is a symlink; symlinks are not supported`);
+    const bytes = fs6.readFileSync(abs);
+    const eolMode = resolveEol(relForEol, rules, eol);
+    const canonical = canonicalize(bytes, eolMode).bytes;
+    return { abs, bytes: canonical, sha256: sha256(canonical), size: canonical.length, eol: eolMode, exec: process.platform !== "win32" && !!(st.mode & 73), stat: st };
+  }
+  /** `tether manage <path> --repo <repo>`: upload; the caller becomes the owner. */
+  /** `tether manage`, then apply the git mode chosen for a path inside a git repository. */
+  async manage({ gitMode, ...opts }) {
+    const r = await this.manageCore(opts);
+    if (gitMode) this.applyGitMode(this.instanceAt(r.path), gitMode);
+    return r;
+  }
+  async manageCore({ path: target, repo: repoRef, eol }) {
+    const abs = canonicalPath(path4.resolve(target));
+    const st = statOrNull(abs);
+    if (!st) throw new UserError(`${abs} does not exist`);
+    this.checkOverlap(abs);
+    const repo = await this.findRepo(repoRef);
+    const rules = repo.eolDefaults ?? {};
+    const name = path4.basename(abs);
+    const nErr = nameError(name);
+    if (nErr) throw new UserError(nErr);
+    if (st.isFile()) {
+      const f = this.prepareFile(abs, name, rules, eol);
+      await this.api.uploadBlobs([f]);
+      const r2 = await this.api.call("POST", "/artifacts", { repoId: repo.repoId, kind: "file", name, blob: f.sha256, size: f.size, eol: f.eol, exec: f.exec });
+      this.cache.put(f.sha256, f.bytes);
+      const local = readLocal(abs, f.eol);
+      this.db.insert({
+        instanceId: newInstanceId(),
+        artifactId: r2.artifact.artifactId,
+        kind: "file",
+        repoId: repo.repoId,
+        name,
+        path: abs,
+        ...this.identity(abs),
+        mode: "normal",
+        baseVersion: 1,
+        baseHash: f.sha256,
+        size: local.size,
+        mtimeMs: local.mtimeMs,
+        ...styleOf(local),
+        eolMode: f.eol,
+        exec: f.exec,
+        role: "owner",
+        canDelete: true,
+        remoteVersion: 1
+      });
+      return { artifactId: r2.artifact.artifactId, shareId: r2.artifact.shareId, kind: "file", path: abs, files: 1 };
+    }
+    const { files: files2, symlinks } = walkFiles(abs);
+    if (!files2.length) throw new UserError(`${abs} has no files`);
+    for (const f of files2) {
+      const e = relPathError(f.rel);
+      if (e) throw new UserError(e);
+    }
+    const c = caseCollisionError(files2.map((f) => f.rel));
+    if (c) throw new UserError(c);
+    const prepared = files2.map((f) => ({ ...this.prepareFile(f.abs, f.rel, rules), rel: f.rel }));
+    await this.api.uploadBlobs(prepared);
+    const r = await this.api.call("POST", "/artifacts", {
+      repoId: repo.repoId,
+      kind: "folder",
+      name,
+      files: prepared.map((f) => ({ relPath: f.rel, blob: f.sha256, size: f.size, eol: f.eol, exec: f.exec }))
+    });
+    const folderInst = this.db.insert({
+      instanceId: newInstanceId(),
+      artifactId: r.artifact.artifactId,
+      kind: "folder",
+      repoId: repo.repoId,
+      name,
+      path: abs,
+      ...this.identity(abs),
+      mode: "normal",
+      baseVersion: 1,
+      role: "owner",
+      canDelete: true,
+      remoteVersion: 1
+    });
+    const byRel = new Map(r.children.map((ch) => [ch.relPath, ch]));
+    for (const f of prepared) {
+      this.cache.put(f.sha256, f.bytes);
+      const ch = byRel.get(f.rel);
+      const local = readLocal(f.abs, f.eol);
+      this.db.insert({
+        instanceId: newInstanceId(),
+        artifactId: ch.artifactId,
+        kind: "file",
+        folderInstanceId: folderInst.instanceId,
+        repoId: repo.repoId,
+        name: ch.name,
+        relPath: f.rel,
+        path: canonicalPath(f.abs),
+        ...this.identity(f.abs),
+        mode: "normal",
+        baseVersion: 1,
+        baseHash: f.sha256,
+        size: local.size,
+        mtimeMs: local.mtimeMs,
+        ...styleOf(local),
+        eolMode: f.eol,
+        exec: f.exec,
+        role: "owner",
+        canDelete: true,
+        remoteVersion: 1
+      });
+    }
+    return { artifactId: r.artifact.artifactId, shareId: r.artifact.shareId, kind: "folder", path: abs, files: files2.length, skippedSymlinks: symlinks };
+  }
+  /** `tether add <path>`: owner adds a new file inside a managed folder. */
+  async add({ path: target }) {
+    const abs = canonicalPath(path4.resolve(target));
+    if (!statOrNull(abs)?.isFile()) throw new UserError(`${abs} is not a file`);
+    if (this.instanceAt(abs)) throw new UserError(`${abs} is already managed`);
+    const folder = this.db.all().find((i) => ACTIVE(i) && i.kind === "folder" && isUnder(abs, i.path));
+    if (!folder) throw new UserError(`${abs} is not inside a managed folder`);
+    if (folder.role !== "owner") throw new UserError("only the owner can add files to a folder");
+    const rel = path4.relative(folder.path, abs).split(path4.sep).join("/");
+    const e = relPathError(rel);
+    if (e) throw new UserError(e);
+    const repo = (await this.api.call("GET", "/repos")).find((r) => r.repoId === folder.repoId);
+    const f = this.prepareFile(abs, rel, repo?.eolDefaults ?? {});
+    await this.api.uploadBlobs([f]);
+    const child = await this.api.call("POST", `/artifacts/${folder.artifactId}/children`, { relPath: rel, blob: f.sha256, size: f.size, eol: f.eol, exec: f.exec });
+    this.cache.put(f.sha256, f.bytes);
+    const local = readLocal(abs, f.eol);
+    this.db.insert({
+      instanceId: newInstanceId(),
+      artifactId: child.artifactId,
+      kind: "file",
+      folderInstanceId: folder.instanceId,
+      repoId: folder.repoId,
+      name: child.name,
+      relPath: rel,
+      path: abs,
+      ...this.identity(abs),
+      mode: "normal",
+      baseVersion: 1,
+      baseHash: f.sha256,
+      size: local.size,
+      mtimeMs: local.mtimeMs,
+      ...styleOf(local),
+      eolMode: f.eol,
+      exec: f.exec,
+      role: "owner",
+      canDelete: true,
+      remoteVersion: 1
+    });
+    return { artifactId: child.artifactId, relPath: rel, folder: folder.path };
+  }
+  /** `tether pull <shareId> [dest]`. Never overwrites existing user files. */
+  /** `tether pull`; with peek, only report where it would go and the caller's role. */
+  async pull({ gitMode, peek, ...opts }) {
+    if (peek) {
+      const r2 = await this.api.call("POST", "/pull", { shareId: opts.shareId, peek: true });
+      return { role: r2.role, kind: r2.artifact.kind, path: this.pullTarget(r2.artifact, opts) };
+    }
+    const r = await this.pullCore(opts, gitMode);
+    if (gitMode) this.applyGitMode(this.instanceAt(r.path), gitMode);
+    return r;
+  }
+  pullTarget(a, { dest, cwd }) {
+    const target = path4.resolve(cwd, dest ?? a.name);
+    return dest && statOrNull(target)?.isDirectory() && a.kind === "file" ? path4.join(target, a.name) : target;
+  }
+  async pullCore({ shareId, dest, cwd }, gitMode) {
+    const r = await this.api.call("POST", "/pull", { shareId });
+    const a = r.artifact;
+    if (gitMode === "follow" && r.role === "viewer") throw new UserError("git follow mode needs editor access; you are a viewer (use --git keep)");
+    const target = this.pullTarget(a, { dest, cwd });
+    if (this.instanceAt(target)) throw new UserError(`${target} is already a managed copy`);
+    const base = { repoId: a.repoId, role: r.role, canDelete: r.canDelete };
+    if (a.kind === "file") {
+      await this.ensureBlobs([{ artifactId: a.artifactId, version: a.version, sha: a.blob }]);
+      const existing = readLocal(target, a.eol);
+      if (existing && existing.hash !== a.blob) throw new UserError(`${target} already exists with different content; choose another destination`);
+      const st2 = existing ? { size: existing.size, mtimeMs: existing.mtimeMs, ...styleOf(existing) } : writeLocal(target, this.blobFor(a.blob), a.eol, { exec: a.exec });
+      this.db.insert({
+        ...base,
+        instanceId: newInstanceId(),
+        artifactId: a.artifactId,
+        kind: "file",
+        name: a.name,
+        path: canonicalPath(target),
+        ...this.identity(target),
+        mode: "normal",
+        baseVersion: a.version,
+        baseHash: a.blob,
+        ...st2,
+        eolMode: a.eol,
+        exec: a.exec,
+        remoteVersion: a.version
+      });
+      return { kind: "file", path: canonicalPath(target), role: r.role, version: a.version };
+    }
+    const st = statOrNull(target);
+    if (st && !st.isDirectory()) throw new UserError(`${target} exists and is not a folder`);
+    await this.ensureBlobs(r.children.map((c) => ({ artifactId: c.artifactId, version: c.version, sha: c.blob })));
+    const clashes = [];
+    for (const c of r.children) {
+      const p = path4.join(target, ...c.relPath.split("/"));
+      const ex = readLocal(p, c.eol);
+      if (ex && ex.hash !== c.blob) clashes.push(c.relPath);
+    }
+    if (clashes.length) throw new UserError(`${target} already has different files: ${clashes.join(", ")}; choose another destination`);
+    fs6.mkdirSync(target, { recursive: true });
+    const folderInst = this.db.insert({
+      ...base,
+      instanceId: newInstanceId(),
+      artifactId: a.artifactId,
+      kind: "folder",
+      name: a.name,
+      path: canonicalPath(target),
+      ...this.identity(target),
+      mode: "normal",
+      baseVersion: a.version,
+      remoteVersion: a.version
+    });
+    for (const c of r.children) {
+      const p = path4.join(folderInst.path, ...c.relPath.split("/"));
+      const ex = readLocal(p, c.eol);
+      const cst = ex ? { size: ex.size, mtimeMs: ex.mtimeMs, ...styleOf(ex) } : writeLocal(p, this.blobFor(c.blob), c.eol, { exec: c.exec });
+      this.db.insert({
+        ...base,
+        instanceId: newInstanceId(),
+        artifactId: c.artifactId,
+        kind: "file",
+        folderInstanceId: folderInst.instanceId,
+        name: c.name,
+        relPath: c.relPath,
+        path: canonicalPath(p),
+        ...this.identity(p),
+        mode: "normal",
+        baseVersion: c.version,
+        baseHash: c.blob,
+        ...cst,
+        eolMode: c.eol,
+        exec: c.exec,
+        remoteVersion: c.version
+      });
+    }
+    return { kind: "folder", path: folderInst.path, role: r.role, files: r.children.length, version: a.version };
+  }
+  /** Instances addressed by a path: a file, a managed folder (with its files), or any directory. */
+  targets(p) {
+    const abs = canonicalPath(path4.resolve(p));
+    const all = this.db.all().filter(ACTIVE);
+    let hits = all.filter((i) => samePath(i.path, abs) || isUnder(i.path, abs));
+    for (const f of hits.filter((i) => i.kind === "folder")) hits.push(...this.db.childrenOf(f.instanceId).filter(ACTIVE));
+    hits = [...new Map(hits.map((i) => [i.instanceId, i])).values()];
+    if (!hits.length) throw new UserError(`nothing managed at ${abs}`);
+    return hits;
+  }
+  setMode(p, mode, from) {
+    const changed = [];
+    for (const i of this.targets(p)) {
+      if (!from.includes(i.mode)) continue;
+      this.db.update(i.instanceId, { mode, ...mode === "editing" ? {} : {} });
+      changed.push(i.path);
+    }
+    return changed;
+  }
+  /**
+   * `tether edit [--realtime]`. Realtime claims a live session per file (editors only, one
+   * holder per file). A plain edit warns about files someone else is editing live.
+   */
+  async edit({ path: p, realtime = false }) {
+    const ts = this.targets(p);
+    const unmanaged = ts.filter((i) => i.mode === "unmanaged" && !i.detached);
+    if (unmanaged.length === ts.length) throw new UserError("these files are unmanaged; use `tether track` first");
+    const files2 = ts.filter((i) => i.kind === "file" && ["normal", "editing"].includes(i.mode) && !i.detached);
+    if (realtime) {
+      if (!files2.length) throw new UserError("nothing here to edit");
+      const viewerOf = files2.find((i) => i.role === "viewer");
+      if (viewerOf) throw new UserError(`realtime editing needs editor access; you are a viewer of ${viewerOf.path}`);
+      const claimed = [];
+      for (const f of files2) {
+        try {
+          await this.api.call("POST", `/artifacts/${f.artifactId}/realtime`, { action: "start" });
+          claimed.push(f);
+        } catch (e) {
+          for (const c of claimed) await this.releaseRealtime(c);
+          if (e instanceof ApiError && e.status === 409 && e.body?.realtime) {
+            const s = e.body.realtime;
+            throw new UserError(`${f.path} is already being edited in realtime by ${s.email} (since ${new Date(s.since).toLocaleTimeString()}).
+You can still run \`tether edit\` without --realtime, but expect merge conflicts.`);
+          }
+          throw e;
+        }
+      }
+      this.setMode(p, "editing", ["normal", "editing"]);
+      for (const f of files2) this.db.update(f.instanceId, { mode: "editing", realtime: true, lastError: null });
+      return { changed: files2.map((f) => f.path), realtime: true };
+    }
+    const changed = this.setMode(p, "editing", ["normal"]);
+    const warnings = [];
+    if (files2.length) {
+      try {
+        const { results } = await this.api.call("POST", "/sync/check", { items: files2.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion })) });
+        results.forEach((r, k) => {
+          if (r.realtime && !r.realtime.mine) warnings.push({ path: files2[k].path, email: r.realtime.email, since: r.realtime.since });
+        });
+      } catch (e) {
+        if (!(e instanceof OfflineError)) throw e;
+      }
+    }
+    return { changed, warnings };
+  }
+  async unmanage({ path: p }) {
+    for (const i of this.targets(p).filter((x) => x.realtime)) await this.releaseRealtime(i);
+    return { changed: this.setMode(p, "unmanaged", ["normal", "editing"]) };
+  }
+  /**
+   * Plans `tether done` (editing -> normal) or `tether track` (unmanaged -> normal).
+   * Returns items needing a decision (options) or with an automatic action (auto).
+   */
+  async plan({ path: p, from }) {
+    await this.locateAll();
+    const ts = this.targets(p).filter((i) => i.mode === from || from === "unmanaged" && i.mode === "normal" && i.kind === "folder");
+    if (!ts.length) throw new UserError(from === "editing" ? "nothing here is in editing mode" : "nothing here is unmanaged");
+    const files2 = ts.filter((i) => i.kind === "file");
+    const { results } = files2.length ? await this.api.call("POST", "/sync/check", { items: files2.map((i) => ({ artifactId: i.artifactId, version: i.baseVersion })) }) : { results: [] };
+    const items = [];
+    files2.forEach((inst, idx) => {
+      const r = results[idx];
+      const item = { instanceId: inst.instanceId, path: inst.path, relPath: inst.relPath, folder: inst.folderInstanceId ? this.folderOf(inst).path : null };
+      if (r.status === "gone" || r.state?.deleted || r.folderDeleted) {
+        items.push({ ...item, auto: "orphan", reason: r.reason ?? "deleted" });
+        return;
+      }
+      const role = r.role;
+      const canPush = role === "owner" || role === "editor";
+      const incoming = r.status === "changed";
+      item.serverVersion = r.version;
+      item.incoming = incoming;
+      item.role = role;
+      if (inst.detached) {
+        if (from === "unmanaged") items.push({ ...item, change: "missing", auto: "restore" });
+        else if (canPush && r.canDelete) items.push({ ...item, change: "deleted", options: ["delete", "stop"] });
+        else items.push({ ...item, change: "deleted", auto: "stop" });
+        return;
+      }
+      const folder = this.folderOf(inst);
+      const rel = folder ? this.localRel(inst, folder) : void 0;
+      if (folder && rel === null) {
+        if (canPush && r.canDelete) items.push({ ...item, change: "moved-out", options: ["delete", "stop"] });
+        else if (canPush) items.push({ ...item, change: "moved-out", auto: "stop" });
+        else items.push({ ...item, change: "moved-out", options: ["accept", "keep-both", "cancel"] });
+        return;
+      }
+      const local = readLocal(inst.path, inst.eolMode);
+      const contentChanged = !!local && local.hash !== inst.baseHash;
+      const moved = folder ? rel !== inst.relPath : false;
+      const changes = [contentChanged && "content", moved && `moved to ${rel}`].filter(Boolean);
+      if (!changes.length) {
+        items.push({ ...item, auto: incoming ? "accept" : "clean" });
+        return;
+      }
+      item.change = changes.join(", ");
+      if (local && r.state && local.hash === r.state.blob && (!folder || rel === r.state.relPath)) {
+        items.push({ ...item, auto: "adopt", state: r.state });
+      } else if (!canPush) {
+        items.push({ ...item, options: ["accept", "keep-both", "diff", "cancel"] });
+      } else if (!incoming && from === "editing") {
+        items.push({ ...item, auto: "push" });
+      } else {
+        items.push({ ...item, conflict: incoming, options: ["push", "accept", "keep-both", "diff", "cancel"] });
+      }
+    });
+    return { from, items };
+  }
+  /** Applies a plan with the user's choices: { instanceId: option }. */
+  async resolve({ path: p, from, items, choices = {} }) {
+    const out = [];
+    for (const item of items) {
+      const choice = item.auto ?? choices[item.instanceId];
+      if (!choice) throw new UserError(`no choice for ${item.path}`);
+      const inst = this.db.get(item.instanceId);
+      if (!inst) continue;
+      try {
+        out.push({ path: item.path, action: choice, ...await this.applyChoice(inst, item, choice) });
+      } catch (e) {
+        if (e instanceof ApiError && e.status === 409) {
+          out.push({ path: item.path, action: choice, error: "the server changed again; run the command again to resolve" });
+        } else if (e instanceof ApiError || e instanceof LockedError || e instanceof UserError) {
+          out.push({ path: item.path, action: choice, error: e.message });
+        } else throw e;
+      }
+    }
+    for (const f of this.targets(p).filter((i) => i.kind === "folder" && i.mode === from)) {
+      if (!this.db.childrenOf(f.instanceId).some((c) => c.mode === from && !c.detached)) this.db.update(f.instanceId, { mode: "normal" });
+    }
+    for (const i of this.db.all().filter((x) => x.realtime && x.mode !== "editing")) await this.releaseRealtime(i);
+    await this.tick();
+    return { results: out };
+  }
+  async applyChoice(inst, item, choice) {
+    const folder = this.folderOf(inst);
+    switch (choice) {
+      case "clean":
+        this.db.update(inst.instanceId, { mode: "normal" });
+        return {};
+      case "orphan":
+        this.orphan(inst, item.reason);
+        return {};
+      case "adopt":
+        this.db.update(inst.instanceId, { mode: "normal", baseVersion: item.state.version, baseHash: item.state.blob, relPath: item.state.relPath ?? inst.relPath, size: null, mtimeMs: null });
+        return {};
+      case "restore":
+        this.db.update(inst.instanceId, { mode: "normal", detached: false, needsRestore: true });
+        return {};
+      case "cancel":
+        return { kept: inst.mode };
+      case "accept": {
+        if (folder && item.change === "moved-out") {
+          const to = this.expectedPath(inst, folder);
+          this.makeRoom(to, inst);
+          moveFile(inst.path, to);
+          this.db.update(inst.instanceId, { path: to, mode: "normal" });
+          return {};
+        }
+        this.db.update(inst.instanceId, { mode: "normal", size: null, mtimeMs: null });
+        return {};
+      }
+      case "keep-both": {
+        if (folder && item.change === "moved-out") {
+          this.db.update(inst.instanceId, { mode: "normal", path: this.expectedPath(inst, folder), fileId: null, volumeId: null, needsRestore: true });
+          return { keptAs: inst.path };
+        }
+        const copy = keepBothName(inst.path);
+        fs6.copyFileSync(inst.path, copy);
+        this.db.update(inst.instanceId, { mode: "normal", size: null, mtimeMs: null });
+        return { keptAs: copy };
+      }
+      case "push": {
+        const local = readLocal(inst.path, inst.eolMode);
+        const change = {};
+        if (local && local.hash !== inst.baseHash) {
+          await this.api.uploadBlobs([{ sha256: local.hash, bytes: local.canonical }]);
+          this.cache.put(local.hash, local.canonical);
+          Object.assign(change, { blob: local.hash, size: local.canonical.length });
+        }
+        if (folder) {
+          const rel = this.localRel(inst, folder);
+          if (rel && rel !== inst.relPath) change.relPath = rel;
+        }
+        const baseVersion = item.incoming ? item.serverVersion : inst.baseVersion;
+        const r = await this.api.call("POST", `/artifacts/${inst.artifactId}/commit`, { baseVersion, change });
+        const state = r.state;
+        this.db.update(inst.instanceId, {
+          mode: "normal",
+          baseVersion: r.version,
+          remoteVersion: r.version,
+          baseHash: state?.blob ?? inst.baseHash,
+          relPath: state?.relPath ?? inst.relPath,
+          size: local?.size ?? null,
+          mtimeMs: local?.mtimeMs ?? null,
+          ...local ? styleOf(local) : {}
+        });
+        return { version: r.version };
+      }
+      case "delete": {
+        await this.api.call("POST", `/artifacts/${inst.artifactId}/commit`, { baseVersion: item.serverVersion, change: { deleted: true } });
+        this.db.remove(inst.instanceId);
+        return { deletedForEveryone: true };
+      }
+      case "stop": {
+        if (item.change === "moved-out") {
+          this.db.update(inst.instanceId, { mode: "normal", path: this.expectedPath(inst, folder), fileId: null, volumeId: null, needsRestore: true });
+          return { released: inst.path };
+        }
+        if (folder) this.db.update(inst.instanceId, { mode: "unmanaged", detached: true });
+        else this.db.remove(inst.instanceId);
+        return {};
+      }
+      default:
+        throw new UserError(`unknown choice "${choice}"`);
+    }
+  }
+  /** Unified diff between the server's current version and the local file. */
+  async diff({ path: p, instanceId }) {
+    const inst = instanceId ? this.db.get(instanceId) : this.targets(p).find((i) => i.kind === "file" && samePath(i.path, canonicalPath(path4.resolve(p))));
+    if (!inst || inst.kind !== "file") throw new UserError("diff needs a managed file");
+    const { artifact } = await this.api.call("GET", `/artifacts/${inst.artifactId}`);
+    if (artifact.deleted) throw new UserError("the artifact has been deleted on the server");
+    await this.ensureBlobs([{ artifactId: inst.artifactId, version: artifact.version, sha: artifact.blob }]);
+    const server = this.cache.get(artifact.blob);
+    const local = inst.detached ? null : readLocal(inst.path, inst.eolMode);
+    const label = path4.basename(inst.path);
+    if (isBinary(server) || local && isBinary(local.canonical)) {
+      return { text: local?.hash === artifact.blob ? "" : `Binary files differ (server v${artifact.version} vs local)
+` };
+    }
+    return {
+      text: createTwoFilesPatch(`${label} (server v${artifact.version})`, `${label} (local)`, server.toString("utf8"), local ? local.canonical.toString("utf8") : "", "", "", { context: 3 }),
+      serverVersion: artifact.version
+    };
+  }
+  status({ path: p } = {}) {
+    let list = this.db.all();
+    if (p) list = this.targets(p).concat(list.filter((i) => i.mode === "orphaned" && isUnder(i.path, canonicalPath(path4.resolve(p)))));
+    return list.map((i) => {
+      const flags = [];
+      if (i.remoteVersion && i.remoteVersion > i.baseVersion && i.kind === "file") flags.push(`incoming v${i.remoteVersion}`);
+      if (i.detached) flags.push("deleted locally");
+      if (i.needsRestore) flags.push("restoring");
+      if (i.missingSince) flags.push("missing");
+      if (i.lastError) flags.push(i.lastError);
+      if (i.kind === "file" && ["editing", "unmanaged"].includes(i.mode) && !i.detached) {
+        try {
+          const local = readLocal(i.path, i.eolMode);
+          if (local && local.hash !== i.baseHash) flags.push("modified");
+        } catch {
+          flags.push("locked");
+        }
+      }
+      if (i.orphanReason) flags.push(i.orphanReason);
+      if (i.realtime && i.mode === "editing") flags.push("realtime: your saves are pushed live");
+      if (i.gitMode) flags.push(`git: ${i.gitMode}`);
+      if (i.remoteRealtime && i.mode !== "orphaned") flags.push(`realtime edits by ${JSON.parse(i.remoteRealtime).email}`);
+      return {
+        instanceId: i.instanceId,
+        artifactId: i.artifactId,
+        kind: i.kind,
+        path: i.path,
+        relPath: i.relPath,
+        mode: i.mode,
+        role: i.role,
+        version: i.baseVersion,
+        folderInstanceId: i.folderInstanceId,
+        flags
+      };
+    });
+  }
+  /** `tether locate`: re-link a lost instance by explicit path, or search folders by content. */
+  async locate({ instanceId, dirs = [], file }) {
+    const inst = this.db.get(instanceId) ?? this.db.all().find((i) => i.instanceId.startsWith(instanceId));
+    if (!inst) throw new UserError(`no instance ${instanceId}`);
+    if (file) {
+      const abs = canonicalPath(path4.resolve(file));
+      const st = statOrNull(abs);
+      if (!st || inst.kind === "folder" !== st.isDirectory()) throw new UserError(`${abs} is not a ${inst.kind}`);
+      this.db.update(inst.instanceId, { path: abs, ...this.identity(abs), mode: inst.mode === "lost" ? inst.prevMode || "normal" : inst.mode, prevMode: null, missingSince: null, detached: false });
+      return { linked: abs };
+    }
+    if (inst.kind !== "file") throw new UserError("pass the folder with --file");
+    const candidates = [];
+    for (const dir of dirs) {
+      if (!statOrNull(dir)?.isDirectory()) continue;
+      for (const f of walkFiles(path4.resolve(dir)).files) {
+        try {
+          if (readLocal(f.abs, inst.eolMode)?.hash === inst.baseHash) candidates.push(f.abs);
+        } catch {
+        }
+        if (candidates.length >= 20) break;
+      }
+    }
+    return { candidates };
+  }
+  async resolveArtifact(ref) {
+    if (/^a_/.test(ref)) return ref;
+    const abs = canonicalPath(path4.resolve(ref));
+    const inst = this.instanceAt(abs) ?? this.db.all().find((i) => samePath(i.path, abs));
+    if (inst) return inst.artifactId;
+    throw new UserError(`"${ref}" is not a managed path or an artifact ID`);
+  }
+};
+
+// packages/client/src/notifier.js
+import fs7 from "node:fs";
+import { spawn } from "node:child_process";
+var AUMID = "Tether.Sync";
+var FLUSH_MS = 3e3;
+var LEVELS = { info: 0, warn: 1, error: 2 };
+var Notifier = class {
+  /** setting: 'all' | 'errors' | 'off' (config key `notifications`). */
+  constructor({ setting = () => "all", consoleUrl = () => "", log = () => {
+  } } = {}) {
+    this.setting = setting;
+    this.consoleUrl = consoleUrl;
+    this.log = log;
+    this.pending = /* @__PURE__ */ new Map();
+    this.cooldown = /* @__PURE__ */ new Map();
+    this.timer = null;
+    this.registered = false;
+  }
+  /**
+   * event: { kind, level: 'info'|'warn'|'error', title, body, path?, artifactId?, key?, cooldownMs? }
+   * Events sharing `key` are suppressed for cooldownMs (default: no cooldown).
+   */
+  notify(event) {
+    const s = this.setting();
+    if (s === "off" || s === "errors" && LEVELS[event.level] < LEVELS.warn) return;
+    if (event.key) {
+      if ((this.cooldown.get(event.key) ?? 0) > Date.now()) return;
+      if (event.cooldownMs) this.cooldown.set(event.key, Date.now() + event.cooldownMs);
+    }
+    if (!this.pending.has(event.kind)) this.pending.set(event.kind, []);
+    this.pending.get(event.kind).push(event);
+    this.timer ??= setTimeout(() => this.flush(), FLUSH_MS);
+  }
+  flush() {
+    this.timer = null;
+    for (const events of this.pending.values()) {
+      const first = events[0];
+      const more = events.length - 1;
+      const title = more ? `${first.title} (+${more} more)` : first.title;
+      const body = more ? `${first.body}
+Also: ${events.slice(1, 4).map((e) => e.short ?? e.title).join("; ")}${more > 3 ? "\u2026" : ""}` : first.body;
+      const base = this.consoleUrl().replace(/\/$/, "");
+      const url = base ? first.artifactId && !more ? `${base}/artifacts/${first.artifactId}` : base : "";
+      this.show({ title, body, url, level: first.level });
+    }
+    this.pending.clear();
+  }
+  show(n) {
+    this.log(`notify [${n.level}] ${n.title}: ${n.body.replace(/\n/g, " ")}`);
+    if (process.env.TETHER_NOTIFY_LOG) {
+      fs7.appendFileSync(process.env.TETHER_NOTIFY_LOG, JSON.stringify(n) + "\n");
+      return;
+    }
+    try {
+      if (isWindows) this.toast(n);
+      else spawn("notify-send", ["--app-name=Tether", n.level === "info" ? "--urgency=low" : "--urgency=normal", n.title, n.body], { stdio: "ignore" }).on("error", () => {
+      });
+    } catch (e) {
+      this.log(`notification failed: ${e.message}`);
+    }
+  }
+  toast({ title, body, url }) {
+    const esc = (s) => s.replace(/[<>&"']/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c]);
+    const launch = url ? ` activationType="protocol" launch="${esc(url)}"` : "";
+    const xml = `<toast${launch}><visual><binding template="ToastGeneric"><text>${esc(title)}</text><text>${esc(body)}</text></binding></visual></toast>`;
+    const register = this.registered ? "" : `$k='HKCU:\\Software\\Classes\\AppUserModelId\\${AUMID}'; if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }; Set-ItemProperty -Path $k -Name DisplayName -Value 'Tether';`;
+    this.registered = true;
+    const script = `${register}
+[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
+[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null
+$x = New-Object Windows.Data.Xml.Dom.XmlDocument; $x.LoadXml('${xml.replace(/'/g, "''")}')
+[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('${AUMID}').Show((New-Object Windows.UI.Notifications.ToastNotification $x))`;
+    const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { stdio: "ignore", windowsHide: true });
+    child.on("error", (e) => this.log(`notification failed: ${e.message}`));
+  }
+};
+
+// packages/client/src/daemon.js
+import { fileURLToPath } from "node:url";
+var REALTIME_TICK_SECONDS = 3;
+var UPDATE_CHECK_MS = 24 * 60 * 60 * 1e3;
+async function runDaemon() {
+  const home = tetherHome();
+  fs8.mkdirSync(home, { recursive: true });
+  process.chdir(home);
+  const f = files(home);
+  const recent = [];
+  const logStream = fs8.createWriteStream(f.log, { flags: "a" });
+  const log = (msg) => {
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}`;
+    recent.push(line);
+    if (recent.length > 500) recent.shift();
+    logStream.write(line + "\n");
+  };
+  const config = new Config(f.config);
+  const db = new LocalDb(f.db);
+  const credentials = new Credentials(f.credentials);
+  const api = new Api({ config, credentials });
+  const cache = new BlobCache(f.blobs);
+  const tracker = await createTracker(config);
+  const notifier = new Notifier({ setting: () => config.get("notifications"), consoleUrl: () => config.consoleUrl, log });
+  const engine = new Engine({
+    db,
+    api,
+    cache,
+    tracker,
+    config,
+    log,
+    home,
+    notify: (e) => notifier.notify(e),
+    cliPath: fileURLToPath(new URL("../bin/tether.js", import.meta.url))
+  });
+  let timer = null;
+  let quickTimer = null;
+  let realtimeTimer = null;
+  let stopping = false;
+  let latest = null;
+  async function runTick(opts) {
+    try {
+      await engine.locked(() => engine.tick(opts));
+    } catch (e) {
+      log(`tick failed: ${e.stack || e.message}`);
+      notifier.notify({ kind: "error", level: "error", key: "tick-failed", cooldownMs: 3600 * 1e3, title: "Tether hit an error", body: `${e.message}. Run "tether log" for details.` });
+    }
+    refreshWatchers();
+    scheduleGrace();
+    schedule();
+  }
+  function schedule() {
+    clearTimeout(timer);
+    if (stopping) return;
+    const seconds = engine.realtimeActive ? Math.min(config.get("tickSeconds"), REALTIME_TICK_SECONDS) : config.get("tickSeconds");
+    timer = setTimeout(() => runTick(), seconds * 1e3);
+  }
+  function realtimePass(delay = 1e3) {
+    if (stopping || !engine.realtimeInstances().length) return;
+    clearTimeout(realtimeTimer);
+    realtimeTimer = setTimeout(async () => {
+      realtimeTimer = null;
+      try {
+        await engine.locked(async () => {
+          await engine.locateAll();
+          await engine.syncRealtime();
+        });
+      } catch (e) {
+        log(`realtime push failed: ${e.message}`);
+      }
+    }, delay);
+  }
+  let notifiedVersion = null;
+  async function checkForUpdate() {
+    latest = await latestVersion() ?? latest;
+    if (isNewer(latest, VERSION) && notifiedVersion !== latest) {
+      notifiedVersion = latest;
+      notifier.notify({ kind: "update", level: "info", title: "Tether update available", body: `Version ${latest} is available (you have ${VERSION}). Run "tether update".` });
+    }
+  }
+  function quickPass(delay) {
+    if (quickTimer || stopping) return;
+    quickTimer = setTimeout(async () => {
+      quickTimer = null;
+      try {
+        await engine.locked(() => engine.locateAll());
+      } catch (e) {
+        log(`locate failed: ${e.message}`);
+      }
+      refreshWatchers();
+      scheduleGrace();
+    }, delay);
+  }
+  function scheduleGrace() {
+    if (engine.graceDue) quickPass(Math.max(50, engine.graceDue - Date.now() + 50));
+  }
+  const watchers = /* @__PURE__ */ new Map();
+  function refreshWatchers() {
+    const want = /* @__PURE__ */ new Map();
+    for (const i of db.all()) {
+      if (i.mode === "orphaned" || i.detached) continue;
+      if (i.kind === "folder") want.set(i.path, true);
+      else if (!i.folderInstanceId) want.set(path5.dirname(i.path), false);
+    }
+    for (const [dir, w] of watchers) {
+      if (!want.has(dir)) {
+        w.close();
+        watchers.delete(dir);
+      }
+    }
+    for (const [dir, recursive] of want) {
+      if (watchers.has(dir)) continue;
+      try {
+        const w = fs8.watch(dir, { recursive, persistent: false }, () => {
+          quickPass(250);
+          realtimePass();
+        });
+        w.on("error", () => {
+          w.close();
+          watchers.delete(dir);
+        });
+        watchers.set(dir, w);
+      } catch {
+      }
+    }
+  }
+  const logins = /* @__PURE__ */ new Map();
+  async function startLogin() {
+    const state = crypto4.randomBytes(16).toString("hex");
+    let settle;
+    const done = new Promise((resolve, reject) => settle = { resolve, reject });
+    const srv = http.createServer(async (req, res) => {
+      const u = new URL(req.url, "http://127.0.0.1");
+      if (u.pathname !== "/callback") return res.writeHead(404).end();
+      if (u.searchParams.get("state") !== state) return res.writeHead(400).end("state mismatch");
+      try {
+        const user = await api.exchangeCliCode(u.searchParams.get("code"));
+        res.writeHead(200, { "content-type": "text/html" }).end('<!doctype html><title>Tether</title><body style="font-family:sans-serif;padding:2rem"><h2>Tether CLI signed in</h2><p>You can close this tab.</p>');
+        settle.resolve(user);
+      } catch (e) {
+        res.writeHead(400).end(e.message);
+        settle.reject(e);
+      } finally {
+        setTimeout(() => srv.close(), 100);
+      }
+    });
+    await new Promise((r) => srv.listen(0, "127.0.0.1", r));
+    const port = srv.address().port;
+    const timeout = setTimeout(() => {
+      srv.close();
+      settle.reject(new UserError("login timed out"));
+    }, 5 * 60 * 1e3);
+    done.finally(() => clearTimeout(timeout)).catch(() => {
+    });
+    logins.set(state, done);
+    return { state, url: `${config.consoleUrl.replace(/\/$/, "")}/cli-login?port=${port}&state=${state}` };
+  }
+  const L = (fn) => (params) => engine.locked(() => fn(params));
+  const soon = () => setTimeout(() => runTick(), 10);
+  const handlers = {
+    ping: () => ({ pid: process.pid, version: VERSION, home, tracker: tracker.name, server: config.get("server") }),
+    async status(p) {
+      const creds = await credentials.load();
+      return {
+        user: creds?.user ?? null,
+        server: config.get("server"),
+        offline: engine.offline,
+        lastTick: engine.lastTick,
+        version: VERSION,
+        latest,
+        instances: await L((x) => engine.status(x))(p)
+      };
+    },
+    sync: async () => {
+      await runTick();
+      return { offline: engine.offline };
+    },
+    async "login.password"({ email, password, signup }) {
+      const user = await api.passwordLogin({ email, password, signup });
+      soon();
+      return user;
+    },
+    "login.start": () => startLogin(),
+    async "login.wait"({ state }) {
+      const p = logins.get(state);
+      if (!p) throw new UserError("no login in progress");
+      try {
+        const user = await p;
+        soon();
+        return user;
+      } finally {
+        logins.delete(state);
+      }
+    },
+    logout: async () => api.logout(),
+    whoami: () => api.call("GET", "/me"),
+    manage: L((p) => engine.manage(p)),
+    add: L((p) => engine.add(p)),
+    pull: L((p) => engine.pull(p)),
+    edit: async (p) => {
+      const r = await L((x) => engine.edit(x))(p);
+      schedule();
+      return r;
+    },
+    unmanage: L((p) => engine.unmanage(p)),
+    "git.mode": L((p) => engine.gitMode(p)),
+    // Called by git hooks: answer at once so git is not held up; reconcile in the background.
+    "git.sync": ({ repo }) => {
+      engine.locked(() => engine.gitReconcile(path5.resolve(repo))).catch((e) => log(`git sync failed: ${e.message}`));
+      return { queued: true };
+    },
+    plan: L((p) => engine.plan(p)),
+    resolve: L((p) => engine.resolve(p)),
+    diff: L((p) => engine.diff(p)),
+    locate: L((p) => engine.locate(p)),
+    async history({ ref }) {
+      return api.call("GET", `/artifacts/${await engine.resolveArtifact(ref)}/history`);
+    },
+    async rollback({ ref, toVersion }) {
+      const r = await api.call("POST", `/artifacts/${await engine.resolveArtifact(ref)}/rollback`, { toVersion });
+      soon();
+      return r;
+    },
+    async delete({ ref }) {
+      const r = await api.call("POST", `/artifacts/${await engine.resolveArtifact(ref)}/delete`);
+      soon();
+      return r;
+    },
+    async share({ ref, op }) {
+      const id = await engine.resolveArtifact(ref);
+      return op ? api.call("POST", `/artifacts/${id}/share`, op) : api.call("GET", `/artifacts/${id}/sharing`);
+    },
+    async info({ ref }) {
+      return api.call("GET", `/artifacts/${await engine.resolveArtifact(ref)}`);
+    },
+    "repo.create": ({ name }) => api.call("POST", "/repos", { name }),
+    "repo.list": () => api.call("GET", "/repos"),
+    "repo.show": async ({ ref }) => api.call("GET", `/repos/${(await engine.findRepo(ref)).repoId}`),
+    "repo.delete": async ({ ref }) => {
+      const r = await api.call("DELETE", `/repos/${(await engine.findRepo(ref)).repoId}`);
+      soon();
+      return r;
+    },
+    "repo.transfer": async ({ ref, to }) => api.call("POST", `/repos/${(await engine.findRepo(ref)).repoId}/transfer`, { to }),
+    "repo.eol": async ({ ref, glob, mode }) => {
+      const repo = await engine.findRepo(ref);
+      const rules = { ...repo.eolDefaults };
+      if (mode === "unset") delete rules[glob];
+      else rules[glob] = mode;
+      return api.call("PATCH", `/repos/${repo.repoId}`, { eolDefaults: rules });
+    },
+    "config.get": ({ key }) => key ? { [key]: config.get(key) } : config.values,
+    "config.set": ({ key, value }) => {
+      config.set(key, value);
+      if (key === "tickSeconds") schedule();
+      return { [key]: config.get(key) };
+    },
+    log: ({ lines = 50 }) => recent.slice(-lines),
+    shutdown: () => {
+      setTimeout(() => shutdown(0), 50);
+      return { stopping: true };
+    }
+  };
+  async function handle(method, params) {
+    const h = handlers[method];
+    if (!h) throw new UserError(`unknown command ${method}`);
+    try {
+      return await h(params);
+    } catch (e) {
+      if (e instanceof ApiError || e instanceof UserError) throw e;
+      if (e.name === "OfflineError") throw e;
+      log(`${method} failed: ${e.stack || e.message}`);
+      throw e;
+    }
+  }
+  const server = await listen(ipcEndpoint(home), handle);
+  fs8.writeFileSync(f.pid, String(process.pid));
+  log(`tetherd ${VERSION} started (pid ${process.pid}, tracker ${tracker.name}, server ${config.get("server")})`);
+  function shutdown(code) {
+    if (stopping) return;
+    stopping = true;
+    clearTimeout(timer);
+    clearTimeout(quickTimer);
+    clearTimeout(realtimeTimer);
+    clearInterval(updateTimer);
+    for (const w of watchers.values()) w.close();
+    server.close();
+    engine.locked(() => db.close()).finally(() => {
+      fs8.rmSync(f.pid, { force: true });
+      log("tetherd stopped");
+      logStream.end(() => process.exit(code));
+    });
+  }
+  process.on("SIGINT", () => shutdown(0));
+  process.on("SIGTERM", () => shutdown(0));
+  await engine.locked(() => engine.syncGitHooks()).catch((e) => log(`git hooks: ${e.message}`));
+  const updateTimer = setInterval(checkForUpdate, UPDATE_CHECK_MS);
+  setTimeout(checkForUpdate, 5e3);
+  await runTick();
+}
+export {
+  VERSION,
+  runDaemon
+};