daemon

type Config struct {
	// Dir is the directory to synchronize (required).
	Dir string
	// StateDir holds the index and, when NetMode is NetModeTSNet, tsnet state.
	// Defaults to Dir/.tailsync.
	StateDir string
	// Hostname is the protocol / tsnet node name.
	//   - NetModeTSNet: advertised tsnet hostname (default tailsync-<os-hostname>).
	//   - NetModeHost: always overwritten from LocalAPI Self (MagicDNS → HostName →
	//     StableID); any configured value is ignored for protocol identity.
	//   - NetModePlain: wire-protocol node id when set.
	Hostname string
	// Port is the UDP port for QUIC peer sessions over the tailnet (or localhost in plain mode).
	Port int
	// AuthKey is an optional Tailscale auth key for NetModeTSNet
	// (else interactive login / existing tsnet state). Unused in host mode.
	AuthKey string
	// ScanInterval is the safety-net full rescan period. When filesystem
	// watching is active, local edits are reconciled via debounced FS events;
	// this interval still walks the tree to catch missed events.
	ScanInterval time.Duration
	// SyncInterval is the backup peer pull period for catch-up (offline peers,
	// missed notifies). Local index changes fan out best-effort notifies; peers
	// pull on their own. Correctness does not depend on notify delivery.
	SyncInterval time.Duration
	// WatchDebounce is how long to wait after an FS event before reconciling
	// (0 = DefaultWatchDebounce). Ignored when DisableWatch is set or watch
	// fails to start.
	WatchDebounce time.Duration
	// DisableWatch skips filesystem watching and relies on ScanInterval only.
	// Useful in tests and on platforms where watching is unavailable.
	DisableWatch bool
	// BlockSize for rsync-style signatures.
	BlockSize int
	// MaxFileBytes rejects local files larger than this for serve/pull (0 = default).
	MaxFileBytes int64
	// DialTimeout is the max wait for an outbound peer QUIC dial+handshake
	// during discovery (0 = DefaultDialTimeout).
	DialTimeout time.Duration
	// DiscoveryConcurrency caps concurrent discovery dials (0 = default 32).
	// The semaphore is in-flight only (released before backoff sleep).
	DiscoveryConcurrency int
	// PullStreamConcurrency caps concurrent content pull streams across all
	// peers (0 = default 8). Separate from discovery concurrency.
	PullStreamConcurrency int
	// HeartbeatInterval is the app-level ping period on each peer session
	// (0 = DefaultHeartbeatInterval). QUIC also has its own keep-alive.
	HeartbeatInterval time.Duration
	// TombstoneTTL drops old deletion tombstones from the index (0 = DefaultTombstoneTTL).
	TombstoneTTL time.Duration
	// Logger defaults to slog.Default().
	Logger *slog.Logger
	// NetMode selects networking: host (default), tsnet, or plain. See NetMode constants.
	NetMode NetMode
	// ListenHost is used when NetMode is NetModePlain (default 127.0.0.1).
	ListenHost string
	// Peers is an optional explicit list of peer addresses (host:port) for tests
	// and overrides. When empty, discovery uses mesh trust on Online status
	// peers: untagged Self → same UserID; tagged Self → peer must carry MeshTag
	// (excludes self, sharees, Mullvad, and identity mismatches). When set,
	// status discovery is skipped (test determinism), but host/tsnet handshakes
	// still enforce WhoIs + the same trust policy. Soft dial failures and
	// backoff handle nodes that are Online but not running tailsync.
	Peers []string
	// MeshTag is the ACL tag peers must share when this machine is tagged
	// (for example "tag:tailsync"). Required at listen when Self is tagged
	// and must appear on Self. Must be empty when Self is untagged. Non-empty
	// values are trimmed, lowercased, and checked with Tailscale's tag rules
	// at [New] (tag:<letter…>, letters/digits/dashes only).
	MeshTag string
	// OnReady, if non-nil, is called once after the daemon is listening and before
	// the main loop. Used by library hosts so Start/lifecycle wrappers can wait
	// for listen success or a fast failure. Must not block indefinitely.
	OnReady func()
	// OnAuthURL, if non-nil, is called when interactive Tailscale login is needed
	// during NetModeTSNet bring-up and an auth/login URL is available (for example
	// browser login when AuthKey is empty and no enrolled tsnet state exists).
	// Invoked from a background goroutine while Up is still waiting. Called at
	// most once per distinct URL per listen attempt. Must return quickly.
	// Not used for host or plain modes. Never receives AuthKey material.
	OnAuthURL func(url string)
	// AfterReconcile, if non-nil, is called after each successful reconcile with
	// whether peer-visible local index content changed.
	//
	// Unstable / test-only: not a supported production API; may change or be
	// removed without notice. Must return quickly and must not call back into
	// the daemon.
	AfterReconcile func(changed bool)
	// AfterSyncPeers, if non-nil, is called after each pullPeers batch completes
	// (including empty peer lists).
	//
	// Unstable / test-only: not a supported production API; may change or be
	// removed without notice. Must return quickly and must not call back into
	// the daemon.
	AfterSyncPeers func()
	// AfterNotify, if non-nil, is called when scheduleNotify actually schedules
	// at least one notify goroutine (not when deduped or no candidates; not
	// after each peer dial finishes).
	//
	// Unstable / test-only: not a supported production API; may change or be
	// removed without notice. Must return quickly and must not call back into
	// the daemon.
	AfterNotify func()
}

type Daemon struct {
	// contains filtered or unexported fields
}

type NetMode int