@letta-ai/dreams 0.0.1

package/dist/local/leases.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Short-lived local process leases.
+ *
+ * Concurrent CLI invocations (a manual `dreams source scan` racing a future
+ * hook-triggered worker) must not both mutate the queue at once. A lease is a
+ * single row keyed by name; acquisition is atomic (one transaction), and a
+ * stale lease past its expiry is reclaimable so a crashed holder never wedges
+ * the CLI forever.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LeaseLostError = exports.SOURCE_LEASE = void 0;
+exports.assertLeaseHeld = assertLeaseHeld;
+exports.renewLease = renewLease;
+exports.acquireLease = acquireLease;
+exports.releaseLease = releaseLease;
+exports.withLease = withLease;
+const crypto = __importStar(require("node:crypto"));
+const db_1 = require("./db");
+const DEFAULT_TTL_MS = 30_000;
+/**
+ * The single per-source mutation lease. Scanning, privacy cancellation, upload
+ * state transitions, acknowledged-cursor collapse, and blob GC all serialize
+ * against this one lease so they never interleave writes.
+ */
+exports.SOURCE_LEASE = "source";
+/** Thrown when a write is attempted after the lease was lost/reclaimed. */
+class LeaseLostError extends Error {
+    constructor(name) {
+        super(`lease "${name}" was lost or reclaimed by another process`);
+        this.name = "LeaseLostError";
+    }
+}
+exports.LeaseLostError = LeaseLostError;
+/**
+ * Fence token check: throws unless we still hold `name`. Call this INSIDE every
+ * write transaction so a process that stalled past its lease cannot commit
+ * state after another process reclaimed the lease.
+ */
+function assertLeaseHeld(db, name, owner) {
+    const row = db.prepare("SELECT owner, expires_at FROM leases WHERE name = ?").get(name);
+    if (!row || row.owner !== owner || row.expires_at <= Date.now())
+        throw new LeaseLostError(name);
+}
+/** Extend our lease; returns false (without extending) if we no longer hold it. */
+function renewLease(db, name, owner, ttlMs = DEFAULT_TTL_MS) {
+    const now = Date.now();
+    return (0, db_1.tx)(db, () => {
+        const row = db.prepare("SELECT owner, expires_at FROM leases WHERE name = ?").get(name);
+        if (!row || row.owner !== owner || row.expires_at <= now)
+            return false;
+        db.prepare("UPDATE leases SET expires_at = ? WHERE name = ? AND owner = ?").run(now + ttlMs, name, owner);
+        return true;
+    });
+}
+/** Atomically take `name` for `ttlMs`. Returns an owner token, or null if held. */
+function acquireLease(db, name, ttlMs = DEFAULT_TTL_MS) {
+    const owner = crypto.randomUUID();
+    const now = Date.now();
+    return (0, db_1.tx)(db, () => {
+        const existing = db.prepare("SELECT owner, expires_at FROM leases WHERE name = ?").get(name);
+        if (existing && existing.expires_at > now)
+            return null;
+        db.prepare("INSERT INTO leases (name, owner, acquired_at, expires_at) VALUES (?, ?, ?, ?) " +
+            "ON CONFLICT(name) DO UPDATE SET owner = excluded.owner, acquired_at = excluded.acquired_at, expires_at = excluded.expires_at").run(name, owner, now, now + ttlMs);
+        return owner;
+    });
+}
+/** Release only if we still hold it (a reclaimed lease must not be released by the old owner). */
+function releaseLease(db, name, owner) {
+    db.prepare("DELETE FROM leases WHERE name = ? AND owner = ?").run(name, owner);
+}
+/** Run `fn` under a lease; returns null without running if the lease is held elsewhere. */
+function withLease(db, name, fn, ttlMs = DEFAULT_TTL_MS) {
+    const owner = acquireLease(db, name, ttlMs);
+    if (owner === null)
+        return { ran: false };
+    try {
+        return { ran: true, result: fn() };
+    }
+    finally {
+        releaseLease(db, name, owner);
+    }
+}

package/dist/local/scan.js

@@ -0,0 +1,475 @@
+"use strict";
+/**
+ * Reconcile discovered Claude Code sessions into a durable local upload queue.
+ * Queue rows, exclusions, and the covered cursor form one contiguous prefix;
+ * accepted bytes remain distinct from pending bytes canceled by later policy.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policyFingerprint = policyFingerprint;
+exports.chunkCompleteLines = chunkCompleteLines;
+exports.addExcludedRange = addExcludedRange;
+exports.isEligible = isEligible;
+exports.reconcile = reconcile;
+exports.listPendingQueue = listPendingQueue;
+const path = __importStar(require("node:path"));
+const blobs_1 = require("./blobs");
+const claude_1 = require("./claude");
+const config_1 = require("./config");
+const db_1 = require("./db");
+const dreamignore_1 = require("./dreamignore");
+const leases_1 = require("./leases");
+const ids_1 = require("./ids");
+/** Raised when privacy policy tightens mid-scan; the affected session is skipped, not committed. */
+class PolicyChangedError extends Error {
+    constructor() {
+        super("privacy policy changed during scan");
+        this.name = "PolicyChangedError";
+    }
+}
+/**
+ * Deterministic fingerprint of the policy that governs a session's root: the full
+ * approved-root set plus that root's `.dreamignore`. Stored on each queued row so
+ * the future uploader ([07]) can refuse to send rows enqueued under stale policy.
+ */
+function policyFingerprint(roots, approvedRoot, ignoreText) {
+    return (0, ids_1.sha256Hex)(Buffer.from(JSON.stringify({ roots: [...roots].sort(), approvedRoot, ignore: ignoreText }), "utf8"));
+}
+const DEFAULT_MAX_SEGMENT_BYTES = 1024 * 1024;
+/** Pure helper retained for unit callers; oversized lines are a hard failure. */
+function chunkCompleteLines(tail, maxSegmentBytes) {
+    const segments = [];
+    let segmentStart = 0;
+    let segmentEnd = 0;
+    let lineStart = 0;
+    for (let i = 0; i < tail.length; i++) {
+        if (tail[i] !== 0x0a)
+            continue;
+        const lineEnd = i + 1;
+        const lineLength = lineEnd - lineStart;
+        if (lineLength > maxSegmentBytes)
+            throw new RangeError(`JSONL record is ${lineLength} bytes; maximum is ${maxSegmentBytes}`);
+        if (segmentEnd > segmentStart && lineEnd - segmentStart > maxSegmentBytes) {
+            segments.push({ relStart: segmentStart, relEnd: segmentEnd });
+            segmentStart = lineStart;
+        }
+        segmentEnd = lineEnd;
+        lineStart = lineEnd;
+    }
+    if (segmentEnd > segmentStart)
+        segments.push({ relStart: segmentStart, relEnd: segmentEnd });
+    return segments;
+}
+function getOrCreateSource(db, owner) {
+    const id = `src_${claude_1.CLAUDE_SOURCE_TYPE}`;
+    return (0, db_1.tx)(db, () => {
+        (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+        const existing = db.prepare("SELECT id FROM sources WHERE id = ?").get(id);
+        if (!existing) {
+            const now = (0, db_1.nowIso)();
+            db.prepare(`INSERT INTO sources (id, source_type, source_key, display_name, adapter_version, status, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`).run(id, claude_1.CLAUDE_SOURCE_TYPE, claude_1.CLAUDE_SOURCE_TYPE, "Claude Code", claude_1.CLAUDE_ADAPTER_VERSION, now, now);
+        }
+        return id;
+    });
+}
+function currentFile(db, sourceId, sessionId) {
+    return db
+        .prepare("SELECT id, generation, size, mtime_ms, inode, first_chunk_fp, prefix_fp FROM source_files WHERE source_id = ? AND session_id = ? AND is_current = 1")
+        .get(sourceId, sessionId);
+}
+function createFileGeneration(db, sourceId, session, generation) {
+    const now = (0, db_1.nowIso)();
+    const info = db
+        .prepare(`INSERT INTO source_files
+         (source_id, session_id, generation, path, cwd, inode, birthtime_ms, size, mtime_ms, first_chunk_fp, prefix_fp, is_current, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', 1, ?, ?)`)
+        .run(sourceId, session.session_id, generation, session.real_path, session.cwd, session.inode, session.birthtime_ms, session.size, session.mtime_ms, session.first_chunk_fp, now, now);
+    const fileId = Number(info.lastInsertRowid);
+    db.prepare("INSERT INTO source_cursors (source_file_id, queued_through_offset, acked_offset, updated_at) VALUES (?, 0, 0, ?)").run(fileId, now);
+    return fileId;
+}
+function readCursor(db, fileId) {
+    return db.prepare("SELECT queued_through_offset, acked_offset FROM source_cursors WHERE source_file_id = ?").get(fileId);
+}
+function isReplacement(stored, cursor, session, onProgress) {
+    if (session.size < cursor.queued_through_offset)
+        return true;
+    if (stored.inode && session.inode && stored.inode !== session.inode)
+        return true;
+    const statChanged = session.size !== stored.size || session.mtime_ms !== stored.mtime_ms;
+    if (statChanged && cursor.queued_through_offset > 0 && stored.prefix_fp) {
+        if ((0, claude_1.prefixFingerprint)(session.real_path, cursor.queued_through_offset, onProgress) !== stored.prefix_fp)
+            return true;
+    }
+    if (stored.first_chunk_fp && session.first_chunk_fp && stored.first_chunk_fp !== session.first_chunk_fp)
+        return true;
+    return false;
+}
+function updateFileMeta(db, fileId, session, verified) {
+    db.prepare(`UPDATE source_files
+     SET path = ?, cwd = ?, size = ?, mtime_ms = ?, inode = ?, first_chunk_fp = ?, prefix_fp = ?, updated_at = ?
+     WHERE id = ?`).run(session.real_path, session.cwd, verified.size, verified.mtime_ms, verified.inode, session.first_chunk_fp, verified.prefix_fp, (0, db_1.nowIso)(), fileId);
+}
+function addExcludedRange(db, fileId, start, end, reason) {
+    if (end <= start)
+        return;
+    const overlaps = db
+        .prepare(`SELECT id, start_offset, end_offset, reason FROM excluded_ranges
+       WHERE source_file_id = ? AND end_offset >= ? AND start_offset <= ? ORDER BY start_offset`)
+        .all(fileId, start, end);
+    let mergedStart = start;
+    let mergedEnd = end;
+    let mergedReason = reason;
+    for (const row of overlaps) {
+        mergedStart = Math.min(mergedStart, row.start_offset);
+        mergedEnd = Math.max(mergedEnd, row.end_offset);
+        if (row.reason !== reason)
+            mergedReason = "privacy";
+        db.prepare("DELETE FROM excluded_ranges WHERE id = ?").run(row.id);
+    }
+    db.prepare("INSERT INTO excluded_ranges (source_file_id, start_offset, end_offset, reason, created_at) VALUES (?, ?, ?, ?, ?)").run(fileId, mergedStart, mergedEnd, mergedReason, (0, db_1.nowIso)());
+}
+function isEligible(roots, cwd, rulesByRoot) {
+    const approvedRoot = cwd ? (0, config_1.isUnderApprovedRoot)(roots, cwd) : null;
+    if (approvedRoot === null || cwd === null)
+        return { eligible: false, approvedRoot: null, ignored: false };
+    let rules = rulesByRoot.get(approvedRoot);
+    if (!rules) {
+        rules = (0, dreamignore_1.loadDreamignore)(approvedRoot);
+        rulesByRoot.set(approvedRoot, rules);
+    }
+    const ignored = (0, dreamignore_1.isIgnored)(rules, path.relative(approvedRoot, cwd), true);
+    return { eligible: !ignored, approvedRoot, ignored };
+}
+function deleteBlobIfUnreferenced(db, contentSha, owner) {
+    // Hold the SQLite writer lock while checking and deleting so a reclaimed
+    // process cannot commit a new reference between the query and unlink.
+    (0, db_1.tx)(db, () => {
+        (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+        const row = db
+            .prepare("SELECT count(*) c FROM upload_queue WHERE content_sha256 = ? AND state IN ('pending','quarantined')")
+            .get(contentSha);
+        if (row.c === 0)
+            (0, blobs_1.deleteBlob)(contentSha);
+    });
+}
+function cleanupUnreferencedBlobs(db, hashes, owner) {
+    for (const contentSha of new Set(hashes)) {
+        try {
+            deleteBlobIfUnreferenced(db, contentSha, owner);
+        }
+        catch (error) {
+            if (error instanceof leases_1.LeaseLostError)
+                return; // The next holder will sweep it.
+            throw error;
+        }
+    }
+}
+function cancelPendingRows(db, rows, owner) {
+    if (rows.length === 0)
+        return 0;
+    const canceledHashes = [];
+    const count = (0, db_1.tx)(db, () => {
+        (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+        let changed = 0;
+        for (const row of rows) {
+            const info = db
+                .prepare("UPDATE upload_queue SET state = 'canceled', updated_at = ? WHERE id = ? AND state = 'pending'")
+                .run((0, db_1.nowIso)(), row.id);
+            if (info.changes === 0)
+                continue;
+            addExcludedRange(db, row.source_file_id, row.start_offset, row.end_offset, "privacy");
+            canceledHashes.push(row.content_sha256);
+            changed++;
+        }
+        return changed;
+    });
+    // Filesystem deletion is intentionally after commit. A crash before this point
+    // leaves an orphan that the next lease holder removes; it never loses live data.
+    cleanupUnreferencedBlobs(db, canceledHashes, owner);
+    return count;
+}
+function pendingRows(db, sourceId, sessionId) {
+    const suffix = sessionId === undefined ? "" : " AND q.session_id = ?";
+    const params = sessionId === undefined ? [sourceId] : [sourceId, sessionId];
+    return db
+        .prepare(`SELECT q.id, q.source_file_id, q.session_id, q.start_offset, q.end_offset, q.content_sha256, sf.cwd
+       FROM upload_queue q JOIN source_files sf ON sf.id = q.source_file_id
+       WHERE q.source_id = ? AND q.state = 'pending'${suffix}`)
+        .all(...params);
+}
+function reconcilePendingPrivacy(db, sourceId, roots, rulesByRoot, owner) {
+    const disallowed = pendingRows(db, sourceId).filter((row) => !isEligible(roots, row.cwd, rulesByRoot).eligible);
+    return cancelPendingRows(db, disallowed, owner);
+}
+function reconcileOrphanBlobs(db, owner) {
+    return (0, db_1.tx)(db, () => {
+        (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+        const rows = db
+            .prepare("SELECT DISTINCT content_sha256 FROM upload_queue WHERE state IN ('pending','quarantined')")
+            .all();
+        // The write lock fences lease reclamation until the filesystem sweep ends.
+        return (0, blobs_1.pruneOrphanBlobs)(new Set(rows.map((row) => row.content_sha256)));
+    });
+}
+function excludedRangesAfter(db, fileId, offset) {
+    return db
+        .prepare("SELECT start_offset, end_offset FROM excluded_ranges WHERE source_file_id = ? AND end_offset > ? ORDER BY start_offset, end_offset")
+        .all(fileId, offset);
+}
+function coalesceRange(ranges, start, end) {
+    const last = ranges[ranges.length - 1];
+    if (last && last.end_offset >= start)
+        last.end_offset = Math.max(last.end_offset, end);
+    else
+        ranges.push({ start_offset: start, end_offset: end });
+}
+function isFilesystemError(error) {
+    return error instanceof Error && typeof error.code === "string";
+}
+/** Record a per-file failure without advancing its cursor, so one poisoned session cannot abort the scan. */
+function recordSessionFailure(db, fileId, code, message, owner) {
+    (0, db_1.tx)(db, () => {
+        (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+        db.prepare("UPDATE source_files SET last_error_code = ?, last_error_message = ?, last_error_at = ?, updated_at = ? WHERE id = ?").run(code, message.slice(0, 500), (0, db_1.nowIso)(), (0, db_1.nowIso)(), fileId);
+    });
+}
+function reconcile(db, options) {
+    const maxSegmentBytes = options.maxSegmentBytes ?? DEFAULT_MAX_SEGMENT_BYTES;
+    if (!Number.isSafeInteger(maxSegmentBytes) || maxSegmentBytes <= 0)
+        throw new Error("maxSegmentBytes must be a positive integer");
+    const priority = options.priority ?? "live";
+    const owner = options.leaseOwner;
+    const sourceId = getOrCreateSource(db, owner);
+    const roots = (0, config_1.getApprovedRoots)(db);
+    const rulesByRoot = new Map();
+    reconcileOrphanBlobs(db, owner);
+    const objectsCanceled = reconcilePendingPrivacy(db, sourceId, roots, rulesByRoot, owner);
+    const sessions = (0, claude_1.discoverSessions)(options.projectsDir);
+    const summary = {
+        source_id: sourceId,
+        sessions_discovered: sessions.length,
+        sessions_queued: 0,
+        sessions_excluded: 0,
+        sessions_skipped_unapproved: 0,
+        sessions_failed: 0,
+        generations_reset: 0,
+        objects_canceled: objectsCanceled,
+        segments_enqueued: 0,
+        bytes_enqueued: 0,
+        queued: [],
+    };
+    for (const session of sessions) {
+        if (!(0, leases_1.renewLease)(db, leases_1.SOURCE_LEASE, owner))
+            throw new leases_1.LeaseLostError(leases_1.SOURCE_LEASE);
+        let lastRenewedAt = Date.now();
+        const keepLeaseAlive = () => {
+            if (Date.now() - lastRenewedAt < 5_000)
+                return;
+            if (!(0, leases_1.renewLease)(db, leases_1.SOURCE_LEASE, owner))
+                throw new leases_1.LeaseLostError(leases_1.SOURCE_LEASE);
+            lastRenewedAt = Date.now();
+        };
+        let fileId;
+        let generation;
+        const stored = currentFile(db, sourceId, session.session_id);
+        if (!stored) {
+            ({ fileId, generation } = (0, db_1.tx)(db, () => {
+                (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+                return { fileId: createFileGeneration(db, sourceId, session, 1), generation: 1 };
+            }));
+        }
+        else {
+            const cursor = readCursor(db, stored.id);
+            if (isReplacement(stored, cursor, session, keepLeaseAlive)) {
+                ({ fileId, generation } = (0, db_1.tx)(db, () => {
+                    (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+                    db.prepare("UPDATE source_files SET is_current = 0, updated_at = ? WHERE id = ?").run((0, db_1.nowIso)(), stored.id);
+                    return {
+                        fileId: createFileGeneration(db, sourceId, session, stored.generation + 1),
+                        generation: stored.generation + 1,
+                    };
+                }));
+                summary.generations_reset++;
+            }
+            else {
+                fileId = stored.id;
+                generation = stored.generation;
+            }
+        }
+        const policy = isEligible(roots, session.cwd, rulesByRoot);
+        // Pre-existing pending rows that are no longer eligible were already canceled
+        // by reconcilePendingPrivacy using each row's OWN persisted cwd. Do NOT cancel
+        // by session id here: a still-eligible older generation must not be dropped
+        // because a newer generation's cwd is disallowed.
+        if (policy.approvedRoot === null) {
+            summary.sessions_skipped_unapproved++;
+            continue;
+        }
+        const prepared = [];
+        try {
+            const cursor = readCursor(db, fileId);
+            const scanStart = cursor.queued_through_offset;
+            const explicitExclusions = excludedRangesAfter(db, fileId, scanStart);
+            let exclusionIndex = 0;
+            const excludedLines = [];
+            let segmentLines = [];
+            let segmentLength = 0;
+            let segmentStart = 0;
+            let segmentEnd = 0;
+            const flushSegment = () => {
+                if (segmentLength === 0)
+                    return;
+                const bytes = Buffer.concat(segmentLines, segmentLength);
+                const contentSha = (0, blobs_1.writeBlob)(bytes);
+                prepared.push({
+                    upload_id: (0, ids_1.segmentId)({
+                        installation_id: options.installationId,
+                        source_key: claude_1.CLAUDE_SOURCE_TYPE,
+                        file_identity: session.session_id,
+                        generation,
+                        start_offset: segmentStart,
+                        end_offset: segmentEnd,
+                    }),
+                    source_file_id: fileId,
+                    session_id: session.session_id,
+                    generation,
+                    start_offset: segmentStart,
+                    end_offset: segmentEnd,
+                    byte_length: segmentLength,
+                    content_sha256: contentSha,
+                });
+                segmentLines = [];
+                segmentLength = 0;
+            };
+            const verified = (0, claude_1.scanCompleteLinesVerified)(session.real_path, scanStart, session.inode, maxSegmentBytes, (line) => {
+                while (exclusionIndex < explicitExclusions.length && explicitExclusions[exclusionIndex].end_offset <= line.start_offset) {
+                    exclusionIndex++;
+                }
+                const explicit = exclusionIndex < explicitExclusions.length &&
+                    explicitExclusions[exclusionIndex].start_offset < line.end_offset &&
+                    explicitExclusions[exclusionIndex].end_offset > line.start_offset;
+                if (policy.ignored || explicit) {
+                    flushSegment();
+                    coalesceRange(excludedLines, line.start_offset, line.end_offset);
+                    return;
+                }
+                if (segmentLength > 0 && segmentLength + line.bytes.length > maxSegmentBytes)
+                    flushSegment();
+                if (segmentLength === 0)
+                    segmentStart = line.start_offset;
+                segmentLines.push(line.bytes);
+                segmentLength += line.bytes.length;
+                segmentEnd = line.end_offset;
+            }, keepLeaseAlive);
+            flushSegment();
+            const newOffset = verified.complete_through_offset;
+            if (newOffset === scanStart) {
+                (0, db_1.tx)(db, () => {
+                    (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+                    updateFileMeta(db, fileId, session, verified);
+                });
+                continue;
+            }
+            const enqueued = [];
+            (0, db_1.tx)(db, () => {
+                (0, leases_1.assertLeaseHeld)(db, leases_1.SOURCE_LEASE, owner);
+                // Re-read policy at the durable commit boundary. Approved roots are
+                // transactional (kv); .dreamignore is reloaded from disk. If a tightening
+                // raced this scan, abort rather than commit now-disallowed pending rows;
+                // the fingerprint stored on each row lets the uploader ([07]) re-gate.
+                let policyFp = null;
+                if (prepared.length > 0) {
+                    const freshRoots = (0, config_1.getApprovedRoots)(db);
+                    const fresh = isEligible(freshRoots, session.cwd, new Map());
+                    if (!fresh.eligible || fresh.approvedRoot === null)
+                        throw new PolicyChangedError();
+                    policyFp = policyFingerprint(freshRoots, fresh.approvedRoot, (0, dreamignore_1.loadDreamignoreText)(fresh.approvedRoot));
+                }
+                for (const range of excludedLines)
+                    addExcludedRange(db, fileId, range.start_offset, range.end_offset, policy.ignored ? "dreamignore" : "privacy");
+                for (const entry of prepared) {
+                    const now = (0, db_1.nowIso)();
+                    const info = db
+                        .prepare(`INSERT OR IGNORE INTO upload_queue
+                 (upload_id, source_id, source_file_id, session_id, generation, start_offset, end_offset, byte_length, content_sha256, priority, state, policy_fingerprint, created_at, updated_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)`)
+                        .run(entry.upload_id, sourceId, fileId, session.session_id, generation, entry.start_offset, entry.end_offset, entry.byte_length, entry.content_sha256, priority, policyFp, now, now);
+                    if (info.changes > 0) {
+                        const { source_file_id: _sourceFileId, ...queued } = entry;
+                        enqueued.push(queued);
+                    }
+                }
+                db.prepare("UPDATE source_cursors SET queued_through_offset = ?, updated_at = ? WHERE source_file_id = ?").run(newOffset, (0, db_1.nowIso)(), fileId);
+                updateFileMeta(db, fileId, session, verified);
+            });
+            cleanupUnreferencedBlobs(db, prepared.map((entry) => entry.content_sha256), owner);
+            if (excludedLines.length > 0)
+                summary.sessions_excluded++;
+            if (enqueued.length > 0) {
+                summary.sessions_queued++;
+                summary.segments_enqueued += enqueued.length;
+                for (const segment of enqueued) {
+                    summary.bytes_enqueued += segment.byte_length;
+                    summary.queued.push(segment);
+                }
+            }
+        }
+        catch (error) {
+            // Blobs published before an aborted commit become orphans; remove the ones
+            // no committed row references (safe even on partial failure).
+            cleanupUnreferencedBlobs(db, prepared.map((entry) => entry.content_sha256), owner);
+            if (error instanceof leases_1.LeaseLostError)
+                throw error;
+            if (error instanceof claude_1.IdentityChangedError || error instanceof PolicyChangedError)
+                continue;
+            if (error instanceof claude_1.OversizedLineError || isFilesystemError(error)) {
+                const code = error instanceof claude_1.OversizedLineError ? "oversized_record" : error.code ?? "fs_error";
+                recordSessionFailure(db, fileId, code, error.message, owner);
+                summary.sessions_failed++;
+                continue;
+            }
+            throw error;
+        }
+    }
+    return summary;
+}
+function listPendingQueue(db) {
+    return db
+        .prepare(`SELECT upload_id, source_id, session_id, generation, start_offset, end_offset, byte_length, content_sha256, priority, state
+       FROM upload_queue WHERE state = 'pending' ORDER BY session_id, generation, start_offset`)
+        .all();
+}