@letta-ai/dreams 0.0.1

package/dist/local/blobs.js

@@ -0,0 +1,190 @@
+"use strict";
+/**
+ * Durable content-addressed storage for immutable queued upload payloads.
+ * Blob publication happens before the SQLite reference commit; reconciliation
+ * removes files that were published by an invocation that died before commit.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.blobsDir = blobsDir;
+exports.blobPath = blobPath;
+exports.hasBlob = hasBlob;
+exports.readBlob = readBlob;
+exports.writeBlob = writeBlob;
+exports.deleteBlob = deleteBlob;
+exports.pruneOrphanBlobs = pruneOrphanBlobs;
+exports.ensureBlobsDir = ensureBlobsDir;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const store_1 = require("../store");
+function blobsDir() {
+    return path.join((0, store_1.dreamsDir)(), "blobs");
+}
+function blobPath(sha256) {
+    return path.join(blobsDir(), sha256.slice(0, 2), sha256.slice(2, 4), sha256);
+}
+function hash(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+function fsyncDirectory(dir) {
+    if (process.platform === "win32")
+        return;
+    const fd = fs.openSync(dir, "r");
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function ensureBlobDirectory(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (process.platform === "win32")
+        return;
+    const stop = (0, store_1.dreamsDir)();
+    let current = dir;
+    while (true) {
+        fsyncDirectory(current);
+        if (current === stop)
+            break;
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+}
+function verifyBlob(file, expected) {
+    const actual = hash(fs.readFileSync(file));
+    if (actual !== expected)
+        throw new Error(`blob hash mismatch at ${file} (expected ${expected}, got ${actual})`);
+}
+function hasBlob(sha256) {
+    return fs.existsSync(blobPath(sha256));
+}
+function readBlob(sha256) {
+    const file = blobPath(sha256);
+    const bytes = fs.readFileSync(file);
+    const actual = hash(bytes);
+    if (actual !== sha256)
+        throw new Error(`blob hash mismatch at ${file} (expected ${sha256}, got ${actual})`);
+    return bytes;
+}
+/** Persist and durably publish bytes before a queue row may reference them. */
+function writeBlob(bytes) {
+    const sha256 = hash(bytes);
+    const finalPath = blobPath(sha256);
+    if (fs.existsSync(finalPath)) {
+        verifyBlob(finalPath, sha256);
+        return sha256;
+    }
+    const dir = path.dirname(finalPath);
+    ensureBlobDirectory(dir);
+    const tmp = path.join(dir, `.tmp-${process.pid}-${crypto.randomUUID()}`);
+    const fd = fs.openSync(tmp, "wx", 0o600);
+    try {
+        fs.writeFileSync(fd, bytes);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    verifyBlob(tmp, sha256);
+    try {
+        fs.renameSync(tmp, finalPath);
+        fsyncDirectory(dir);
+    }
+    catch (error) {
+        fs.rmSync(tmp, { force: true });
+        if (!fs.existsSync(finalPath))
+            throw error;
+        verifyBlob(finalPath, sha256);
+    }
+    return sha256;
+}
+function deleteBlob(sha256) {
+    const file = blobPath(sha256);
+    const dir = path.dirname(file);
+    fs.rmSync(file, { force: true });
+    if (fs.existsSync(dir))
+        fsyncDirectory(dir);
+}
+/** Remove unreferenced final blobs and temp files left by interrupted writers. */
+function pruneOrphanBlobs(liveHashes) {
+    const root = blobsDir();
+    let removed = 0;
+    let firstLevel;
+    try {
+        firstLevel = fs.readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return 0;
+    }
+    for (const first of firstLevel) {
+        if (!first.isDirectory())
+            continue;
+        const firstPath = path.join(root, first.name);
+        for (const second of fs.readdirSync(firstPath, { withFileTypes: true })) {
+            if (!second.isDirectory())
+                continue;
+            const dir = path.join(firstPath, second.name);
+            let removedFromDir = false;
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                if (!entry.isFile())
+                    continue;
+                const file = path.join(dir, entry.name);
+                if (entry.name.startsWith(".tmp-") || (/^[0-9a-f]{64}$/.test(entry.name) && !liveHashes.has(entry.name))) {
+                    fs.rmSync(file, { force: true });
+                    removedFromDir = true;
+                    removed++;
+                }
+            }
+            if (removedFromDir)
+                fsyncDirectory(dir);
+            if (fs.readdirSync(dir).length === 0) {
+                fs.rmdirSync(dir);
+                fsyncDirectory(firstPath);
+            }
+        }
+        if (fs.existsSync(firstPath) && fs.readdirSync(firstPath).length === 0) {
+            fs.rmdirSync(firstPath);
+            fsyncDirectory(root);
+        }
+    }
+    return removed;
+}
+function ensureBlobsDir() {
+    ensureBlobDirectory(blobsDir());
+}

package/dist/local/claude.js

@@ -0,0 +1,315 @@
+"use strict";
+/**
+ * Claude Code source adapter — discovery, file identity, and byte reading.
+ *
+ * Discovery rule (filesystem shape is authoritative for the pilot):
+ *   - only DIRECT children of ~/.claude/projects/<encoded-project>/
+ *   - filename must be a UUID-like `<sessionId>.jsonl`
+ *   - the transcript's own `sessionId` must agree with the filename
+ *   - never recurse; the `subagents/` directory is excluded outright
+ *   - `isSidechain: true` records are a secondary signal to exclude sidechains
+ * `parentUuid` is intentionally NOT used — ordinary main-session records also
+ * carry parent relationships.
+ *
+ * This module never normalizes transcripts; it only reads raw bytes.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OversizedLineError = exports.IdentityChangedError = exports.CLAUDE_ADAPTER_VERSION = exports.CLAUDE_SOURCE_TYPE = void 0;
+exports.claudeProjectsDir = claudeProjectsDir;
+exports.firstChunkFingerprint = firstChunkFingerprint;
+exports.prefixFingerprint = prefixFingerprint;
+exports.scanCompleteLinesVerified = scanCompleteLinesVerified;
+exports.discoverSessions = discoverSessions;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const config_1 = require("./config");
+exports.CLAUDE_SOURCE_TYPE = "claude-code";
+exports.CLAUDE_ADAPTER_VERSION = "claude-code-1";
+const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+const HEAD_READ_BYTES = 256 * 1024;
+const FIRST_CHUNK_BYTES = 4096;
+function claudeProjectsDir() {
+    return path.join(os.homedir(), ".claude", "projects");
+}
+/** Thrown when a file's identity changes between discovery and read (TOCTOU / swap). */
+class IdentityChangedError extends Error {
+    constructor(filePath) {
+        super(`file identity changed under read: ${filePath}`);
+        this.name = "IdentityChangedError";
+    }
+}
+exports.IdentityChangedError = IdentityChangedError;
+function fingerprint(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+/** Read the file head and return the first COMPLETE JSONL record, or null. */
+function readFirstRecord(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        const buf = Buffer.alloc(HEAD_READ_BYTES);
+        const read = fs.readSync(fd, buf, 0, HEAD_READ_BYTES, 0);
+        const head = buf.subarray(0, read);
+        const nl = head.indexOf(0x0a);
+        if (nl === -1)
+            return null; // no complete first line yet
+        const line = head.subarray(0, nl).toString("utf8").trim();
+        if (line === "")
+            return null;
+        return JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/**
+ * Fingerprint the transcript's FIRST LINE (which carries the stable sessionId).
+ * This is invariant under appends — new bytes go after the first line — but
+ * changes when the file is replaced by a different session, so it is a reliable
+ * replacement signal. (Hashing a fixed-size prefix would wrongly change on every
+ * append for files shorter than that prefix.)
+ */
+function firstChunkFingerprint(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        const buf = Buffer.alloc(FIRST_CHUNK_BYTES);
+        const read = fs.readSync(fd, buf, 0, FIRST_CHUNK_BYTES, 0);
+        const head = buf.subarray(0, read);
+        const nl = head.indexOf(0x0a);
+        const firstLine = nl === -1 ? head : head.subarray(0, nl + 1);
+        return fingerprint(firstLine);
+    }
+    catch {
+        return "";
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+const IO_CHUNK_BYTES = 64 * 1024;
+function normalizedMtime(stat) {
+    return Number.isFinite(stat.mtimeMs) ? Math.floor(stat.mtimeMs) : null;
+}
+function inodeOf(stat) {
+    return stat.ino ? String(stat.ino) : null;
+}
+function hashRange(fd, end, digest, onProgress) {
+    let position = 0;
+    while (position < end) {
+        const buf = Buffer.allocUnsafe(Math.min(IO_CHUNK_BYTES, end - position));
+        const read = fs.readSync(fd, buf, 0, buf.length, position);
+        if (read === 0)
+            throw new IdentityChangedError("opened transcript");
+        digest.update(buf.subarray(0, read));
+        position += read;
+        onProgress?.();
+    }
+}
+/** SHA-256 of [0, length), read with bounded memory. */
+function prefixFingerprint(filePath, length, onProgress) {
+    if (length <= 0)
+        return "";
+    const fd = fs.openSync(filePath, "r");
+    try {
+        const digest = crypto.createHash("sha256");
+        hashRange(fd, length, digest, onProgress);
+        return digest.digest("hex");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+class OversizedLineError extends Error {
+    filePath;
+    startOffset;
+    byteLength;
+    maxBytes;
+    constructor(filePath, startOffset, byteLength, maxBytes) {
+        super(`JSONL record at byte ${startOffset} in ${filePath} is ${byteLength} bytes; maximum is ${maxBytes}`);
+        this.filePath = filePath;
+        this.startOffset = startOffset;
+        this.byteLength = byteLength;
+        this.maxBytes = maxBytes;
+        this.name = "OversizedLineError";
+    }
+}
+exports.OversizedLineError = OversizedLineError;
+/**
+ * Read complete JSONL records from one opened handle using bounded memory.
+ * The covered-prefix hash is computed from that same handle, and a final fstat
+ * rejects files that changed while being scanned.
+ */
+function scanCompleteLinesVerified(realPath, start, expectedInode, maxLineBytes, onLine, onProgress) {
+    let fd;
+    try {
+        fd = fs.openSync(realPath, "r");
+        const initial = fs.fstatSync(fd);
+        const inode = inodeOf(initial);
+        if (expectedInode !== null && inode !== null && inode !== expectedInode)
+            throw new IdentityChangedError(realPath);
+        if (start > initial.size)
+            throw new IdentityChangedError(realPath);
+        const digest = crypto.createHash("sha256");
+        hashRange(fd, start, digest, onProgress);
+        let readPosition = start;
+        let carry = Buffer.alloc(0);
+        let carryStart = start;
+        let completeThrough = start;
+        while (readPosition < initial.size) {
+            const chunk = Buffer.allocUnsafe(Math.min(IO_CHUNK_BYTES, initial.size - readPosition));
+            const read = fs.readSync(fd, chunk, 0, chunk.length, readPosition);
+            if (read === 0)
+                break;
+            readPosition += read;
+            onProgress?.();
+            const combined = carry.length === 0 ? chunk.subarray(0, read) : Buffer.concat([carry, chunk.subarray(0, read)]);
+            const combinedStart = carryStart;
+            let consumed = 0;
+            while (consumed < combined.length) {
+                const newline = combined.indexOf(0x0a, consumed);
+                if (newline === -1)
+                    break;
+                const end = newline + 1;
+                const byteLength = end - consumed;
+                const lineStart = combinedStart + consumed;
+                if (byteLength > maxLineBytes)
+                    throw new OversizedLineError(realPath, lineStart, byteLength, maxLineBytes);
+                const bytes = combined.subarray(consumed, end);
+                digest.update(bytes);
+                completeThrough = combinedStart + end;
+                onLine({ bytes, start_offset: lineStart, end_offset: completeThrough });
+                consumed = end;
+            }
+            carry = Buffer.from(combined.subarray(consumed));
+            carryStart = combinedStart + consumed;
+            if (carry.length > maxLineBytes) {
+                throw new OversizedLineError(realPath, carryStart, carry.length, maxLineBytes);
+            }
+        }
+        const final = fs.fstatSync(fd);
+        if (inodeOf(final) !== inode ||
+            final.size !== initial.size ||
+            normalizedMtime(final) !== normalizedMtime(initial)) {
+            throw new IdentityChangedError(realPath);
+        }
+        return {
+            size: initial.size,
+            inode,
+            mtime_ms: normalizedMtime(initial),
+            complete_through_offset: completeThrough,
+            prefix_fp: completeThrough > 0 ? digest.digest("hex") : "",
+        };
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+function statSignals(filePath) {
+    const stat = fs.statSync(filePath);
+    const inode = stat.ino ? String(stat.ino) : null;
+    const birthtime = Number.isFinite(stat.birthtimeMs) && stat.birthtimeMs > 0 ? Math.floor(stat.birthtimeMs) : null;
+    const mtime = Number.isFinite(stat.mtimeMs) ? Math.floor(stat.mtimeMs) : null;
+    return { size: stat.size, inode, birthtime_ms: birthtime, mtime_ms: mtime };
+}
+/**
+ * Enumerate valid top-level Claude Code session files. Malformed, sidechain,
+ * name-mismatched, and not-yet-complete files are skipped rather than failing.
+ */
+function discoverSessions(projectsDir = claudeProjectsDir()) {
+    const sessions = [];
+    let projectEntries;
+    try {
+        projectEntries = fs.readdirSync(projectsDir, { withFileTypes: true });
+    }
+    catch {
+        return sessions;
+    }
+    for (const projectEntry of projectEntries) {
+        if (!projectEntry.isDirectory())
+            continue;
+        if (projectEntry.name === "subagents")
+            continue;
+        const projectDir = path.join(projectsDir, projectEntry.name);
+        let files;
+        try {
+            files = fs.readdirSync(projectDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const file of files) {
+            if (!file.isFile())
+                continue;
+            if (!file.name.endsWith(".jsonl"))
+                continue;
+            const base = file.name.slice(0, -".jsonl".length);
+            if (!UUID_RE.test(base))
+                continue;
+            const filePath = path.join(projectDir, file.name);
+            const record = readFirstRecord(filePath);
+            if (!record)
+                continue;
+            if (record.isSidechain === true)
+                continue;
+            const sessionId = typeof record.sessionId === "string" ? record.sessionId : null;
+            if (sessionId !== base)
+                continue; // filename must agree with the transcript
+            const signals = statSignals(filePath);
+            sessions.push({
+                path: filePath,
+                real_path: (0, config_1.canonicalize)(filePath),
+                session_id: sessionId,
+                cwd: typeof record.cwd === "string" ? (0, config_1.canonicalize)(record.cwd) : null,
+                size: signals.size,
+                inode: signals.inode,
+                birthtime_ms: signals.birthtime_ms,
+                mtime_ms: signals.mtime_ms,
+                first_chunk_fp: firstChunkFingerprint(filePath),
+            });
+        }
+    }
+    sessions.sort((a, b) => a.path.localeCompare(b.path));
+    return sessions;
+}

package/dist/local/commands.js

@@ -0,0 +1,160 @@
+"use strict";
+/**
+ * `dreams source ...` command handlers for the local source subsystem ([06]).
+ *
+ * These are the only entry points that open the local SQLite database, so the
+ * mocked onboarding flow (`init`/`status`) and auth keep working untouched.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSourceScan = commandSourceScan;
+exports.commandUpload = commandUpload;
+exports.commandSourceApproveRoot = commandSourceApproveRoot;
+exports.commandSourceList = commandSourceList;
+exports.commandSource = commandSource;
+const store_1 = require("../store");
+const config_1 = require("./config");
+const db_1 = require("./db");
+const leases_1 = require("./leases");
+const scan_1 = require("./scan");
+const upload_1 = require("../cloud/upload");
+function open() {
+    const installation = (0, store_1.loadOrCreateInstallation)();
+    const db = (0, db_1.openDb)({
+        installationId: installation.installation_id,
+        installationCreatedAt: installation.created_at,
+    });
+    return { db, installationId: installation.installation_id };
+}
+function emit(json, payload, human) {
+    if (json)
+        console.log(JSON.stringify(payload, null, 2));
+    else
+        console.log(human());
+}
+/** Optional override for the per-segment byte cap (advanced/testing); ignored if not a positive integer. */
+function maxSegmentBytesOverride() {
+    const raw = process.env.DREAMS_MAX_SEGMENT_BYTES;
+    if (!raw)
+        return undefined;
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+function commandSourceScan(json) {
+    const { db, installationId } = open();
+    try {
+        const owner = (0, leases_1.acquireLease)(db, leases_1.SOURCE_LEASE);
+        if (owner === null) {
+            emit(json, { status: "busy", reason: "another scan holds the local lease" }, () => "Another dreams scan is in progress; skipping (its work covers this invocation).");
+            return 0;
+        }
+        let summary;
+        try {
+            summary = (0, scan_1.reconcile)(db, { installationId, leaseOwner: owner, maxSegmentBytes: maxSegmentBytesOverride() });
+        }
+        finally {
+            (0, leases_1.releaseLease)(db, leases_1.SOURCE_LEASE, owner);
+        }
+        emit(json, { status: "ok", ...summary }, () => [
+            `Scan complete for source ${summary.source_id}`,
+            ``,
+            `  Sessions discovered:      ${summary.sessions_discovered}`,
+            `  Sessions queued:          ${summary.sessions_queued}`,
+            `  Sessions excluded:        ${summary.sessions_excluded}`,
+            `  Skipped (root unapproved): ${summary.sessions_skipped_unapproved}`,
+            `  Failed (isolated):        ${summary.sessions_failed}`,
+            `  Generations reset:        ${summary.generations_reset}`,
+            `  Objects canceled (privacy): ${summary.objects_canceled}`,
+            `  Segments enqueued:        ${summary.segments_enqueued} (${summary.bytes_enqueued} bytes)`,
+        ].join("\n"));
+        return 0;
+    }
+    finally {
+        (0, db_1.closeDb)();
+    }
+}
+async function commandUpload(json) {
+    const { db, installationId } = open();
+    try {
+        const owner = (0, leases_1.acquireLease)(db, leases_1.SOURCE_LEASE);
+        if (owner === null) {
+            emit(json, { status: "busy", reason: "another source operation holds the local lease" }, () => "Another dreams source operation is in progress; skipping.");
+            return 0;
+        }
+        let summary;
+        try {
+            summary = await (0, upload_1.runUpload)(db, { installationId, leaseOwner: owner });
+        }
+        finally {
+            (0, leases_1.releaseLease)(db, leases_1.SOURCE_LEASE, owner);
+        }
+        emit(json, { status: summary.stopped_reason ? "error" : summary.partial ? "partial" : "ok", ...summary }, () => [
+            `Upload ${summary.stopped_reason ? "stopped" : summary.partial ? "completed with issues" : "complete"}`,
+            ``,
+            `  Due:               ${summary.due}`,
+            `  Accepted:          ${summary.accepted}`,
+            `  Duplicate:         ${summary.duplicate}`,
+            `  Quarantined:       ${summary.quarantined}`,
+            `  Retry scheduled:   ${summary.retry_scheduled}`,
+            `  Canceled (policy): ${summary.canceled_by_policy}`,
+            `  Bytes uploaded:    ${summary.bytes_uploaded}`,
+            summary.stopped_reason ? `  Stopped:           ${summary.stopped_reason}` : ``,
+        ].filter((line) => line !== ``).join("\n"));
+        // Partial failure (quarantines) or a hard stop reports a non-zero exit.
+        if (summary.stopped_reason)
+            return 1;
+        return summary.quarantined > 0 ? 2 : 0;
+    }
+    finally {
+        (0, db_1.closeDb)();
+    }
+}
+function commandSourceApproveRoot(json, root) {
+    if (!root) {
+        process.stderr.write("Usage: dreams source approve-root <path>\n");
+        return 1;
+    }
+    const { db } = open();
+    try {
+        const roots = (0, config_1.approveRoot)(db, root);
+        emit(json, { status: "ok", approved_roots: roots }, () => `Approved roots:\n${roots.map((r) => `  ${r}`).join("\n") || "  (none)"}`);
+        return 0;
+    }
+    finally {
+        (0, db_1.closeDb)();
+    }
+}
+function commandSourceList(json) {
+    const { db } = open();
+    try {
+        const roots = (0, config_1.getApprovedRoots)(db);
+        const sources = db
+            .prepare("SELECT id, source_type, source_key, display_name, status FROM sources ORDER BY id")
+            .all();
+        const queue = (0, scan_1.listPendingQueue)(db);
+        emit(json, { status: "ok", db_path: (0, db_1.dbFilePath)(), approved_roots: roots, sources, pending_uploads: queue }, () => [
+            `Dream local sources`,
+            ``,
+            `  DB:             ${(0, db_1.dbFilePath)()}`,
+            `  Approved roots: ${roots.length ? roots.join(", ") : "(none — deny by default)"}`,
+            `  Sources:        ${sources.length}`,
+            `  Pending uploads: ${queue.length}`,
+        ].join("\n"));
+        return 0;
+    }
+    finally {
+        (0, db_1.closeDb)();
+    }
+}
+function commandSource(subcommand, positional, json) {
+    switch (subcommand) {
+        case "scan":
+            return commandSourceScan(json);
+        case "approve-root":
+            return commandSourceApproveRoot(json, positional);
+        case "list":
+            return commandSourceList(json);
+        default:
+            process.stderr.write(`Unknown source subcommand: ${subcommand ?? "(none)"} — expected scan, approve-root, or list\n`);
+            return 1;
+    }
+}