@outerlayer/cli 0.1.1 → 0.4.0

package/dist/chunk-3YPKXE5L.js

@@ -0,0 +1,1683 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { applyContextProvenance, installScrubContext, prepareSessionForUpload, wholeSessionCounts, sliceTurnIo } from './chunk-HE2D4EY5.js';
+import { LaunchFilter } from './chunk-BCJNHMZT.js';
+import { RepoFilter } from './chunk-TBT347UY.js';
+import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
+import { applyReportedCost } from './chunk-BKO6JEZI.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-6Y63SXFO.js';
+import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-G7FSV7JX.js';
+import { C } from './chunk-YRYMNBGQ.js';
+import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-DVDEBNQJ.js';
+import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
+import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
+import { writeSyncStatus, spoolDir } from './chunk-UFFXNXLQ.js';
+import { removeJournalHooks } from './chunk-XCCLFVXM.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { dirname, basename, join } from 'path';
+import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { createRequire as createRequire$1 } from 'module';
+
+createRequire(import.meta.url);
+var IRRELEVANT = /* @__PURE__ */ new Set(["__tests__", "__mocks__", "node_modules"]);
+function newestSourceMs(dir) {
+  let newest = 0;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IRRELEVANT.has(entry.name)) continue;
+      newest = Math.max(newest, newestSourceMs(join(dir, entry.name)));
+      continue;
+    }
+    if (!entry.name.endsWith(".ts")) continue;
+    if (entry.name.endsWith(".test.ts")) continue;
+    try {
+      newest = Math.max(newest, statSync(join(dir, entry.name)).mtimeMs);
+    } catch {
+    }
+  }
+  return newest;
+}
+function staleBuildWarning(entryPath = fileURLToPath(import.meta.url)) {
+  const distDir = dirname(entryPath);
+  if (basename(distDir) !== "dist") return null;
+  const srcDir = join(dirname(distDir), "src");
+  const sourceMs = newestSourceMs(srcDir);
+  if (sourceMs === 0) return null;
+  let builtMs;
+  try {
+    builtMs = statSync(entryPath).mtimeMs;
+  } catch {
+    return null;
+  }
+  if (sourceMs <= builtMs) return null;
+  const age = Math.round((sourceMs - builtMs) / 1e3);
+  const howOld = age >= 86400 ? `${Math.round(age / 86400)}d` : age >= 3600 ? `${Math.round(age / 3600)}h` : `${age}s`;
+  return `this CLI build is ${howOld} older than its sources \u2014 run \`yarn workspace @outerlayer/cli build\`. Until you do, it may write data the current format cannot read.`;
+}
+var ALLOW_STALE_BUILD_ENV = "OUTERLAYER_ALLOW_STALE_BUILD";
+function staleBuildRefusal(env = process.env, entryPath = fileURLToPath(import.meta.url)) {
+  const warning = staleBuildWarning(entryPath);
+  if (!warning) return null;
+  if (env[ALLOW_STALE_BUILD_ENV] === "1") return null;
+  if (env.CI === "true" || env.CI === "1" || env.JENKINS_URL) return null;
+  return `${warning.replace(/ Until you do,.*$/, "")} Refusing to write with it; set ${ALLOW_STALE_BUILD_ENV}=1 to write anyway.`;
+}
+function watermarkPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "watermarks.json");
+}
+function watermarkKeyFor(url, appId) {
+  return `${new URL(url).host}:${appId}`;
+}
+function readFile(home) {
+  try {
+    const parsed = JSON.parse(readFileSync(watermarkPath(home), "utf8"));
+    if (!parsed || typeof parsed !== "object") return {};
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "number" && Number.isFinite(v)) out[k] = v;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function readWatermark(url, appId, home = homeFromEnv(), migrateFn = readSqliteWatermark) {
+  const key = watermarkKeyFor(url, appId);
+  const file = readFile(home);
+  if (key in file) return file[key];
+  const migrated = migrateFn(url, appId, home);
+  writeWatermark(url, appId, migrated ?? 0, home);
+  return migrated ?? 0;
+}
+function writeWatermark(url, appId, mtimeMs, home = homeFromEnv()) {
+  try {
+    const key = watermarkKeyFor(url, appId);
+    const file = readFile(home);
+    file[key] = mtimeMs;
+    const path = watermarkPath(home);
+    mkdirSync(join(home, ".outerlayer"), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(file, null, 2));
+    renameSync(tmp, path);
+  } catch {
+  }
+}
+function readSqliteWatermark(url, appId, home) {
+  try {
+    const dbPath = join(home, ".outerlayer", "db.sqlite");
+    if (!existsSync(dbPath)) return null;
+    const { DatabaseSync } = createRequire$1(import.meta.url)("node:sqlite");
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    try {
+      const row = db.prepare("SELECT value FROM meta WHERE key = ?").get(`sync_watermark_ms:${new URL(url).host}:${appId}`);
+      if (!row) return null;
+      const ms = parseFloat(row.value);
+      return Number.isFinite(ms) ? ms : null;
+    } finally {
+      db.close();
+    }
+  } catch {
+    return null;
+  }
+}
+var HOOK_TIMEOUT_MS = 6e5;
+var HOOK_INCOMPLETE_SLACK_MS = 6e4;
+var HOOK_INCOMPLETE_AFTER_MS = HOOK_TIMEOUT_MS + HOOK_INCOMPLETE_SLACK_MS;
+function formatDurationApprox(ms) {
+  const totalSeconds = Math.floor(ms / 1e3);
+  if (totalSeconds < 60) return `${totalSeconds}s`;
+  const minutes = Math.floor(totalSeconds / 60);
+  const seconds = totalSeconds % 60;
+  return seconds === 0 ? `${minutes}m` : `${minutes}m${seconds}s`;
+}
+function deriveHookOutcome(group, opts) {
+  const started = group.started;
+  if (!started || !started.sessionId || !started.hookEvent) return void 0;
+  const base = {
+    sessionId: started.sessionId,
+    hookEvent: started.hookEvent,
+    toolUseId: started.toolUseId ?? void 0,
+    command: started.cmd,
+    ts: started.t
+  };
+  if (group.finished) {
+    const exitCode = group.finished.exitCode;
+    return {
+      ...base,
+      durationMs: group.finished.durationMs,
+      ...exitCode !== null ? { exitCode } : {},
+      status: exitCode === 0 ? "ok" : "error"
+    };
+  }
+  if (group.aborted) {
+    return {
+      ...base,
+      durationMs: group.aborted.durationMs,
+      status: "aborted"
+    };
+  }
+  const startedAtMs = Date.parse(started.t);
+  const ageMs = opts.nowMs - startedAtMs;
+  if (!opts.sessionEnded && ageMs < HOOK_INCOMPLETE_AFTER_MS) return "defer";
+  if (opts.spoolDamaged) return void 0;
+  return {
+    ...base,
+    durationMs: ageMs,
+    status: "incomplete",
+    statusMessage: `did not complete (killed or crashed) \u2014 ran \u2265 ${formatDurationApprox(ageMs)}`
+  };
+}
+function hookOutcomeToEvent(outcome) {
+  return {
+    type: EVENT_TYPES.hookExecuted,
+    ts: outcome.ts,
+    data: {
+      hookEvent: outcome.hookEvent,
+      hooks: [
+        {
+          command: outcome.command,
+          durationMs: outcome.durationMs,
+          ...outcome.exitCode !== void 0 ? { exitCode: outcome.exitCode } : {},
+          status: outcome.status,
+          ...outcome.toolUseId ? { toolUseId: outcome.toolUseId } : {},
+          ...outcome.statusMessage ? { statusMessage: outcome.statusMessage } : {}
+        }
+      ]
+    }
+  };
+}
+function appendHookExecEvents(session, events) {
+  let nextSeq = session.events.reduce((max, e) => Math.max(max, e.seq), -1) + 1;
+  for (const event of events) session.events.push({ ...event, seq: nextSeq++ });
+}
+function hookExecWatermarkPath(home = homeFromEnv()) {
+  return join(spoolWatermarkDir(home), "hook-exec.watermark");
+}
+function spoolWatermarkDir(home) {
+  return join(home, ".outerlayer", "spool");
+}
+function readHookExecWatermark(home = homeFromEnv()) {
+  try {
+    const raw = readFileSync(hookExecWatermarkPath(home), "utf8").trim();
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) && n >= 0 ? n : 0;
+  } catch {
+    return 0;
+  }
+}
+function writeHookExecWatermark(offset, home = homeFromEnv()) {
+  try {
+    const path = hookExecWatermarkPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, String(offset));
+    renameSync(tmp, path);
+  } catch {
+  }
+}
+function readSpoolLinesSince(home, sinceOffset) {
+  let buf;
+  try {
+    buf = readFileSync(hookExecSpoolPath(home));
+  } catch {
+    return { lines: [], consumableEnd: sinceOffset, damagedLines: 0 };
+  }
+  const lines = [];
+  let damagedLines = 0;
+  const start = Math.min(Math.max(sinceOffset, 0), buf.length);
+  let pos = start;
+  let consumableEnd = start;
+  while (pos < buf.length) {
+    const nl = buf.indexOf(10, pos);
+    if (nl === -1) break;
+    const text = buf.subarray(pos, nl).toString("utf8").trim();
+    if (text) {
+      try {
+        lines.push({ record: JSON.parse(text), startOffset: pos });
+      } catch {
+        damagedLines += 1;
+      }
+    }
+    pos = nl + 1;
+    consumableEnd = pos;
+  }
+  return { lines, consumableEnd, damagedLines };
+}
+function groupByExecId(lines) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const { record, startOffset } of lines) {
+    const g = groups.get(record.execId) ?? { startOffset };
+    if (record.rec === "started") {
+      g.started = record;
+      g.startOffset = startOffset;
+    } else if (record.rec === "finished") {
+      g.finished = record;
+    } else if (record.rec === "aborted") {
+      g.aborted = record;
+    }
+    groups.set(record.execId, g);
+  }
+  return groups;
+}
+function planHookExecMerge(opts = {}) {
+  const home = opts.home ?? homeFromEnv();
+  const nowMs = opts.nowMs ?? Date.now();
+  const sessionEnded = opts.sessionEnded ?? (() => false);
+  const sinceOffset = opts.fromOffset ?? readHookExecWatermark(home);
+  const { lines, consumableEnd, damagedLines } = readSpoolLinesSince(home, sinceOffset);
+  const groups = groupByExecId(lines);
+  const eventsBySession = /* @__PURE__ */ new Map();
+  const sessionGroupOffsets = /* @__PURE__ */ new Map();
+  const sessionNewestRecordMs = /* @__PURE__ */ new Map();
+  let fullyConsumedOffset = consumableEnd;
+  for (const group of groups.values()) {
+    const outcome = deriveHookOutcome(group, {
+      sessionEnded: group.started?.sessionId ? sessionEnded(group.started.sessionId) : false,
+      nowMs,
+      spoolDamaged: damagedLines > 0
+    });
+    if (outcome === "defer") {
+      fullyConsumedOffset = Math.min(fullyConsumedOffset, group.startOffset);
+      continue;
+    }
+    if (!outcome) continue;
+    const list = eventsBySession.get(outcome.sessionId) ?? [];
+    list.push(hookOutcomeToEvent(outcome));
+    eventsBySession.set(outcome.sessionId, list);
+    const startedMs = Date.parse(outcome.ts);
+    if (Number.isFinite(startedMs)) {
+      sessionNewestRecordMs.set(outcome.sessionId, Math.max(sessionNewestRecordMs.get(outcome.sessionId) ?? 0, startedMs));
+    }
+    const prior = sessionGroupOffsets.get(outcome.sessionId);
+    sessionGroupOffsets.set(outcome.sessionId, prior === void 0 ? group.startOffset : Math.min(prior, group.startOffset));
+  }
+  return {
+    eventsBySession,
+    sessionGroupOffsets,
+    sessionNewestRecordMs,
+    fullyConsumedOffset,
+    recordsRead: lines.length,
+    damagedLines
+  };
+}
+var HOOK_EXEC_SPOOL_RETENTION_MS = 14 * 24 * 60 * 60 * 1e3;
+function spoolLineExpired(text, nowMs, retentionMs) {
+  let record;
+  try {
+    record = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (record.rec !== "started") return void 0;
+  const startedMs = Date.parse(record.t);
+  if (!Number.isFinite(startedMs)) return false;
+  return nowMs - startedMs > retentionMs;
+}
+function pruneHookExecSpool(opts) {
+  const home = opts.home ?? homeFromEnv();
+  const nowMs = opts.nowMs ?? Date.now();
+  const retentionMs = opts.retentionMs ?? HOOK_EXEC_SPOOL_RETENTION_MS;
+  const path = hookExecSpoolPath(home);
+  let buf;
+  try {
+    buf = readFileSync(path);
+  } catch {
+    return 0;
+  }
+  const limit = Math.min(Math.max(opts.consumedOffset, 0), buf.length);
+  let dropTo = 0;
+  let pos = 0;
+  while (pos < limit) {
+    const nl = buf.indexOf(10, pos);
+    if (nl === -1 || nl + 1 > limit) break;
+    const text = buf.subarray(pos, nl).toString("utf8").trim();
+    if (text && spoolLineExpired(text, nowMs, retentionMs) === false) break;
+    pos = nl + 1;
+    dropTo = pos;
+  }
+  if (dropTo === 0) return 0;
+  const tmp = `${path}.prune`;
+  try {
+    writeFileSync(tmp, buf.subarray(dropTo));
+    opts.onSnapshot?.();
+    if (statSync(path).size !== buf.length) {
+      rmSync(tmp);
+      return 0;
+    }
+    writeHookExecWatermark(Math.max(opts.consumedOffset - dropTo, 0), home);
+    renameSync(tmp, path);
+  } catch {
+    try {
+      rmSync(tmp);
+    } catch {
+    }
+    return 0;
+  }
+  return dropTo;
+}
+
+// src/live-upload.ts
+var DEFAULT_DEBOUNCE_MS = 2e3;
+var RETRY_BASE_DELAY_MS = 2e3;
+var RETRY_MAX_DELAY_MS = 6e4;
+function liveUploadStatePath(home) {
+  return join(home, ".outerlayer", "spool", "live-uploads.json");
+}
+function readLiveUploadState(home) {
+  try {
+    const parsed = JSON.parse(readFileSync(liveUploadStatePath(home), "utf8"));
+    if (parsed && typeof parsed === "object" && parsed.v === 1) {
+      const sessions = parsed.sessions;
+      return { v: 1, sessions: sessions && typeof sessions === "object" ? sessions : {} };
+    }
+  } catch {
+  }
+  return { v: 1, sessions: {} };
+}
+function writeLiveUploadState(state, home) {
+  try {
+    const path = liveUploadStatePath(home);
+    mkdirSync(join(home, ".outerlayer", "spool"), { recursive: true });
+    const tmp = `${path}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(state, null, 2));
+    renameSync(tmp, path);
+  } catch {
+  }
+}
+function subagentInfo(mirrorPath) {
+  const segments = mirrorPath.split(/[/\\]/);
+  const subagentsIdx = segments.lastIndexOf("subagents");
+  if (subagentsIdx <= 0) return { isSubagent: false };
+  return {
+    isSubagent: true,
+    parentSessionId: segments[subagentsIdx - 1] || void 0,
+    ownId: sessionIdFromPath(mirrorPath)
+  };
+}
+function sessionKeyFor(mirrorPath) {
+  return sessionIdFromPath(mirrorPath);
+}
+function endSignalKeyFor(mirrorPath) {
+  return subagentInfo(mirrorPath).parentSessionId ?? sessionIdFromPath(mirrorPath);
+}
+function sessionHasEnded(home, sessionKey) {
+  let text;
+  try {
+    text = readFileSync(join(spoolDir(home), "events.jsonl"), "utf8");
+  } catch {
+    return false;
+  }
+  for (const rawLine of text.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (!trimmed) continue;
+    let record;
+    try {
+      record = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (record.event === "SessionEnd" && record.sessionId === sessionKey) return true;
+  }
+  return false;
+}
+function groupTurns(turns, open, wholeCounts) {
+  const groups = [];
+  let current = [];
+  let currentBytes = 0;
+  for (const raw of turns) {
+    let turn = raw;
+    let bytes = JSON.stringify(turn).length + 1;
+    if (bytes > CHUNK_PART_TARGET_BYTES) {
+      turn = sliceTurnIo(raw);
+      bytes = JSON.stringify(turn).length + 1;
+    }
+    if (current.length > 0 && currentBytes + bytes > CHUNK_PART_TARGET_BYTES) {
+      groups.push(current);
+      current = [];
+      currentBytes = 0;
+    }
+    current.push(turn);
+    currentBytes += bytes;
+  }
+  if (current.length > 0) groups.push(current);
+  return groups.map((groupTurnsSlice, i) => {
+    const isLast = i === groups.length - 1;
+    const fromTurn = groupTurnsSlice[0].index;
+    const toTurn = groupTurnsSlice[groupTurnsSlice.length - 1].index;
+    return {
+      turns: groupTurnsSlice,
+      delta: {
+        fromTurn,
+        toTurn,
+        open: isLast ? open : true,
+        counts: wholeCounts
+      }
+    };
+  });
+}
+async function acceptedSessionIds(response) {
+  try {
+    const parsed = await response.json();
+    const accepted = parsed?.data?.accepted;
+    return Array.isArray(accepted) ? accepted : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function retryAfterMs(response) {
+  const raw = response?.headers.get("retry-after");
+  return raw && /^\d+$/.test(raw) ? Number(raw) * 1e3 : 0;
+}
+var LiveUploader = class {
+  constructor(opts) {
+    this.cycles = /* @__PURE__ */ new Map();
+    /** Sessions this sender is done with: ended, or permanently rejected. The
+     * daemon keeps mirroring a transcript after its session closes, and every
+     * one of those events would otherwise open a fresh debounce cycle that
+     * re-reads the state file only to refuse the session again. */
+    this.finished = /* @__PURE__ */ new Set();
+    /** Set on a 401 — the key is unknown/expired/wrong app, which is true for
+     * every session, so the sender stops entirely for the rest of this
+     * process rather than retrying session by session. */
+    this.stopped = false;
+    this.home = opts.home;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.sleepImpl = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.debounceMs = opts.debounceMs ?? DEFAULT_DEBOUNCE_MS;
+    this.env = opts.env ?? process.env;
+    this.stderr = opts.stderr ?? ((s) => void process.stderr.write(s));
+  }
+  /** Called for every daemon `mirrored` event. Cheap and synchronous — the
+   * actual read/send work happens on the debounced cycle. */
+  notify(mirrorPath) {
+    if (this.stopped) return;
+    const key = sessionKeyFor(mirrorPath);
+    if (this.finished.has(key)) return;
+    const existing = this.cycles.get(key);
+    if (existing) {
+      existing.latestFile = mirrorPath;
+      existing.generation += 1;
+      return;
+    }
+    const cycle = { latestFile: mirrorPath, generation: 0, loop: Promise.resolve() };
+    cycle.loop = this.runCycle(key, cycle).finally(() => {
+      if (this.cycles.get(key) === cycle) this.cycles.delete(key);
+    });
+    this.cycles.set(key, cycle);
+  }
+  /** Test-only: drains every debounce/retry cycle currently pending, with no
+   * real timers involved (the injected `sleepImpl` resolves however the
+   * test wants). Loops because a cycle's own outcome (a retry, or a fresh
+   * notify that arrived mid-send) can leave new work queued. */
+  async flush() {
+    while (this.cycles.size > 0) {
+      await Promise.allSettled([...this.cycles.values()].map((c) => c.loop));
+    }
+  }
+  /** Nothing awaits a cycle in the daemon — `notify()` starts it and returns
+   * — so an error that escaped here would be an unhandled rejection, and
+   * Node's default for those is to exit the process, taking the transcript
+   * mirroring down with the sender. A throw ends this session's cycle and
+   * nothing else; the next mirrored event for it starts a fresh one. */
+  async runCycle(key, cycle) {
+    try {
+      let processedGeneration = -1;
+      for (; ; ) {
+        for (; ; ) {
+          const generationAtWaitStart = cycle.generation;
+          await this.sleepImpl(this.debounceMs);
+          if (cycle.generation !== generationAtWaitStart) continue;
+          break;
+        }
+        if (cycle.generation === processedGeneration) return;
+        const generationAtProcess = cycle.generation;
+        const stop = await this.processOnce(key, cycle.latestFile);
+        if (stop) this.finished.add(key);
+        processedGeneration = generationAtProcess;
+        if (stop || cycle.generation === processedGeneration) return;
+      }
+    } catch {
+    }
+  }
+  /** One session's whole eligibility check + (if eligible) send, including
+   * any retries. Returns true when this session's cycle should stop for
+   * good (ended, permanently rejected, or the sender is globally stopped) —
+   * the caller records that, so no later mirrored event reopens a cycle for
+   * it. A hold that could lift on a later fire — no credentials yet,
+   * `autoSync` off, an undecidable launch spool, a misconfigured tier —
+   * returns false instead, because eligibility is re-checked on every fire. */
+  async processOnce(key, mirrorPath) {
+    const state = readLiveUploadState(this.home);
+    const priorEntry = state.sessions[key];
+    if (priorEntry?.ended || priorEntry?.failed) return true;
+    const cloudConfig = readCloudConfig(this.home);
+    if (cloudConfig.autoSync === false) return false;
+    if (!cloudConfig.url || !(cloudConfig.apiKey || cloudConfig.accountToken)) return false;
+    const info = subagentInfo(mirrorPath);
+    const tail = tailTranscript(mirrorPath, void 0, {
+      isSubagent: info.isSubagent,
+      parentSessionId: info.parentSessionId,
+      ownId: info.ownId
+    });
+    if (!tail.session) return false;
+    const session = tail.session;
+    enrichSessionRepo(session);
+    const destination = resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
+    if (!destination.ok) return false;
+    const repoFilter = new RepoFilter(cloudConfig.repos);
+    if (!repoFilter.allows(session.env.gitRepo)) return false;
+    const launchSpool = readLaunchSpoolState(this.home);
+    if (!launchStatusIsDecisive(launchSpool)) return false;
+    const launchFilter = new LaunchFilter(launchSpool.ids);
+    if (!launchFilter.allows(session)) return false;
+    let tier;
+    try {
+      tier = resolveTier(cloudConfig.tier);
+    } catch (err) {
+      if (err instanceof SyncConfigError) return false;
+      throw err;
+    }
+    const hookEvents = planHookExecMerge({ home: this.home, fromOffset: 0 }).eventsBySession.get(session.id);
+    if (hookEvents && hookEvents.length > 0) appendHookExecEvents(session, hookEvents);
+    applyContextProvenance(session, readLatestProvenanceForSession(session.id, this.home));
+    applyReportedCost(session, this.home);
+    installScrubContext(this.home, cloudConfig.scrub);
+    const prepared = prepareSessionForUpload(session, tier, this.env);
+    const ackedTurnIndex = priorEntry?.ackedTurnIndex ?? -1;
+    const fromTurn = ackedTurnIndex + 1;
+    const available = prepared.turns.filter((t) => t.index >= fromTurn);
+    const open = !sessionHasEnded(this.home, endSignalKeyFor(mirrorPath));
+    if (available.length === 0 && open) return false;
+    const wholeCounts = wholeSessionCounts(prepared.turns);
+    const groups = groupTurns(available, open, wholeCounts);
+    const emptyFinalTurn = Math.max(ackedTurnIndex, 0);
+    const toSend = groups.length > 0 ? groups : [{ turns: [], delta: { fromTurn: emptyFinalTurn, toTurn: emptyFinalTurn, open: false, counts: wholeCounts } }];
+    const endpoint = new URL("/v1/agents/sync", destination.url).toString();
+    let currentAcked = ackedTurnIndex;
+    for (const group of toSend) {
+      const payload = {
+        schemaVersion: 1,
+        sessions: [{ ...prepared, turns: group.turns, delta: group.delta }]
+      };
+      const outcome = await this.sendWithRetry(endpoint, destination.credential, destination.appId, prepared.id, payload);
+      if (outcome === "unauthorized") {
+        this.stopped = true;
+        this.stderr(
+          destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`outerlayer login\` and it restarts.
+` : `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
+`
+        );
+        return true;
+      }
+      if (outcome === "rejected") {
+        const reason = "the server refused this delta permanently";
+        this.mergeSessionState(key, {
+          ackedTurnIndex: currentAcked,
+          failed: true,
+          lastError: reason,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        this.stderr(`live upload stopped for session ${prepared.id}: ${reason}. The next \`outerlayer sync\` uploads it whole.
+`);
+        return true;
+      }
+      currentAcked = group.delta.open ? Math.max(currentAcked, group.delta.toTurn - 1) : Math.max(currentAcked, group.delta.toTurn);
+      this.mergeSessionState(key, {
+        ackedTurnIndex: currentAcked,
+        ended: !group.delta.open,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    return !open;
+  }
+  /** Writes one session's entry into the state file, re-reading it first.
+   * Every session on the machine shares this file and each cycle awaits the
+   * network between its read and its write, so a write built from a snapshot
+   * taken before the request would revert whatever another session recorded
+   * in the meantime — its acked index, its `ended`, or its `failed`. */
+  mergeSessionState(key, entry) {
+    const current = readLiveUploadState(this.home);
+    writeLiveUploadState({ v: 1, sessions: { ...current.sessions, [key]: entry } }, this.home);
+  }
+  /** The headers that sign a request with this host's key, or none when the host has no readable key. A runner
+   * key bound to a host key is refused on every route unless that key signed the request. A login token is
+   * never signed: only the saved factory key is bound to a host key. */
+  async signatureHeaders(endpoint, body, credential) {
+    if (readCloudConfig(this.home).apiKey !== credential) return {};
+    let signer;
+    try {
+      signer = await signerFor(cloudConfigPath(this.home));
+    } catch {
+      return {};
+    }
+    if (signer === void 0) return {};
+    return { ...await signRunnerRequest({ method: "POST", url: endpoint, body: new TextEncoder().encode(body), signer }) };
+  }
+  /** Sends one request, retrying a network error or a retryable 5xx forever
+   * with exponential backoff (2s → 60s cap) — the daemon runs unattended, so
+   * there is no bounded attempt count. A 401 or a permanent 4xx/rejection
+   * returns immediately instead of retrying. */
+  async sendWithRetry(endpoint, apiKey, appId, sessionId, payload) {
+    const body = JSON.stringify(payload);
+    let delayMs = RETRY_BASE_DELAY_MS;
+    for (; ; ) {
+      let response;
+      try {
+        const signature = await this.signatureHeaders(endpoint, body, apiKey);
+        response = await this.fetchImpl(endpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${apiKey}`,
+            "x-outerlayer-app-id": appId,
+            ...signature
+          },
+          body
+        });
+      } catch {
+        response = void 0;
+      }
+      if (response) {
+        if (response.status === 401) return "unauthorized";
+        if (response.ok) {
+          const accepted = await acceptedSessionIds(response);
+          if (accepted) return accepted.includes(sessionId) ? "accepted" : "rejected";
+        } else if (!RETRYABLE_STATUSES.has(response.status)) {
+          return "rejected";
+        }
+      }
+      await this.sleepImpl(Math.max(retryAfterMs(response), delayMs));
+      delayMs = Math.min(delayMs * 2, RETRY_MAX_DELAY_MS);
+    }
+  }
+};
+
+// src/skip-verdict.ts
+var RESUME_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
+function unlaunchedVerdict(opts) {
+  if (!opts.launchStatusDecisive) return "unknown";
+  return opts.idleMs < RESUME_WINDOW_MS ? "reversible" : "final";
+}
+function statusUnknown(verdict) {
+  return verdict === "unknown";
+}
+function mightStillShip(verdict) {
+  return verdict !== "final";
+}
+
+// src/sync-cmd.ts
+var ITEM_KEY_PREFIX = "olitem_";
+function isItemKey(token) {
+  return token.startsWith(ITEM_KEY_PREFIX);
+}
+function isLoopbackUrl(url) {
+  try {
+    const host = new URL(url).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    return host === "localhost" || host.endsWith(".localhost") || host === "::1" || host === "0.0.0.0" || /^127\./.test(host);
+  } catch {
+    return false;
+  }
+}
+var MAX_SESSIONS_PER_BATCH = 25;
+var MAX_BLOBS_PER_BATCH = 64;
+var MAX_BLOB_BYTES_PER_BATCH = 4e6;
+var MAX_SINGLE_BLOB_BYTES = MAX_BLOB_BYTES_PER_BATCH;
+var MAX_BATCH_JSON_BYTES = 35e5;
+var SESSION_CHUNK_TRIGGER_BYTES = 1e6;
+var CHUNK_PART_TARGET_BYTES = 7e5;
+function blobsForTurns(blobs, turns) {
+  const shas = /* @__PURE__ */ new Set();
+  for (const t of turns) for (const img of t.images ?? []) shas.add(img.sha256);
+  return blobs.filter((b) => shas.has(b.sha256));
+}
+function chunkOversizedSession(item) {
+  if (JSON.stringify(item.session).length <= SESSION_CHUNK_TRIGGER_BYTES) return [item];
+  const turns = item.session.turns ?? [];
+  const counts = wholeSessionCounts(turns);
+  const envelopeBytes = JSON.stringify({ ...item.session, turns: [] }).length;
+  const budget = Math.max(CHUNK_PART_TARGET_BYTES - envelopeBytes, 1e5);
+  const parts = [];
+  let cur = [];
+  let curBytes = 0;
+  for (const raw of turns) {
+    let turn = raw;
+    let bytes = JSON.stringify(turn).length + 1;
+    if (bytes > budget) {
+      turn = sliceTurnIo(raw);
+      bytes = JSON.stringify(turn).length + 1;
+    }
+    if (cur.length > 0 && curBytes + bytes > budget) {
+      parts.push(cur);
+      cur = [];
+      curBytes = 0;
+    }
+    cur.push(turn);
+    curBytes += bytes;
+  }
+  if (cur.length > 0) parts.push(cur);
+  return parts.map((partTurns, i) => ({
+    session: {
+      ...item.session,
+      turns: partTurns,
+      chunk: { part: i + 1, of: parts.length, counts }
+    },
+    blobs: blobsForTurns(item.blobs, partTurns),
+    mtimeMs: item.mtimeMs
+  }));
+}
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504]);
+var MAX_BATCH_ATTEMPTS = 6;
+var RETRY_BASE_DELAY_MS2 = 2e3;
+var KNOWN_PERMANENT_ARTIFACT_ERROR_CODES = /* @__PURE__ */ new Set([
+  "invalid_request_body",
+  "invalid_field_value",
+  "session_not_found",
+  "unknown_replaces_target",
+  "nothing_to_attach",
+  "artifact_content_conflict",
+  "payload_too_large"
+]);
+var NEVER_REACHED_SERVER_ERROR_CODES = /* @__PURE__ */ new Set([
+  "invalid_request_body",
+  "invalid_field_value",
+  "session_not_found",
+  "nothing_to_attach",
+  "payload_too_large"
+]);
+function splitPayload(payload) {
+  const mid = Math.ceil(payload.sessions.length / 2);
+  const first = payload.sessions.slice(0, mid);
+  const second = payload.sessions.slice(mid);
+  const shasOf = (sessions) => {
+    const set = /* @__PURE__ */ new Set();
+    for (const s of sessions) {
+      const turns = s.turns ?? [];
+      for (const t of turns) for (const img of t.images ?? []) if (typeof img.sha256 === "string") set.add(img.sha256);
+    }
+    return set;
+  };
+  const firstShas = shasOf(first);
+  const secondShas = shasOf(second);
+  const blobs = payload.blobs ?? [];
+  const firstBlobs = blobs.filter((b) => firstShas.has(b.sha256) || !secondShas.has(b.sha256));
+  const secondBlobs = blobs.filter((b) => secondShas.has(b.sha256));
+  return [
+    { schemaVersion: 1, sessions: first, ...firstBlobs.length > 0 ? { blobs: firstBlobs } : {} },
+    { schemaVersion: 1, sessions: second, ...secondBlobs.length > 0 ? { blobs: secondBlobs } : {} }
+  ];
+}
+var SyncConfigError = class extends Error {
+};
+var SyncTransportError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "SyncTransportError";
+  }
+};
+function resolveTier(raw) {
+  if (raw === void 0) return "full";
+  if (CAPTURE_TIERS.includes(raw)) return raw;
+  throw new SyncConfigError(`unknown tier "${raw}" \u2014 use ${CAPTURE_TIERS.join(" | ")}`);
+}
+function entrySessionId(entry) {
+  return entry.ownId ?? basename(entry.file).replace(/\.jsonl$/, "");
+}
+function sinceAdapters(sinceMs, alsoSessionIds = /* @__PURE__ */ new Set()) {
+  return SOURCE_ADAPTERS.map((adapter) => ({
+    ...adapter,
+    discover: (roots) => {
+      const entries = adapter.discover(roots);
+      if (alsoSessionIds.size === 0) return entries.filter((entry) => entry.mtimeMs > sinceMs);
+      return entries.filter((entry) => entry.mtimeMs > sinceMs || alsoSessionIds.has(entrySessionId(entry)));
+    }
+  }));
+}
+function fmtBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+function fmtAge(ms) {
+  if (!Number.isFinite(ms)) return "?";
+  const minutes = Math.max(0, Math.floor(ms / 6e4));
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 48) return `${hours}h`;
+  return `${Math.floor(hours / 24)}d`;
+}
+async function runSync(opts = {}) {
+  const refusal = staleBuildRefusal(opts.env ?? process.env);
+  if (refusal) throw new SyncConfigError(refusal);
+  const staleBuild = staleBuildWarning();
+  if (staleBuild && !opts.quiet) process.stderr.write(`${C.yellow}!${C.reset} ${staleBuild}
+`);
+  const home = opts.home ?? homeFromEnv(opts.env ?? process.env);
+  const stats = {};
+  try {
+    const result = await runSyncInner(opts, stats);
+    if (!result.dryRun) {
+      writeSyncStatus(
+        {
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          ok: stats.blocked === void 0,
+          contacted: stats.contacted === true,
+          url: result.url,
+          appId: stats.appId,
+          synced: result.synced,
+          pending: 0,
+          ...stats.skippedNotLaunched ? { skippedNotLaunched: stats.skippedNotLaunched } : {},
+          ...stats.held ? { held: stats.held } : {},
+          ...stats.blocked !== void 0 ? { error: { message: stats.blocked } } : {}
+        },
+        home
+      );
+    }
+    return result;
+  } catch (err) {
+    writeSyncStatus(
+      {
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        ok: false,
+        url: stats.url,
+        appId: stats.appId,
+        synced: stats.synced ?? 0,
+        pending: stats.pending,
+        error: {
+          status: err instanceof SyncTransportError ? err.status : void 0,
+          message: err instanceof Error ? err.message : String(err)
+        }
+      },
+      home
+    );
+    throw err;
+  }
+}
+function parseWorkItemNumber(raw) {
+  const match = /^\d+$/.exec(raw ?? "");
+  return match ? Number(match[0]) : void 0;
+}
+async function runSyncInner(opts, stats) {
+  const envVars = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(envVars);
+  const fileConfig = readCloudConfig(home);
+  const resolved = resolveGatewayCredentials({ ...opts, home, env: envVars });
+  stats.url = resolved.url;
+  stats.appId = resolved.appId;
+  const tier = resolveTier(opts.tier ?? envVars.OUTERLAYER_TIER ?? fileConfig.tier);
+  const dryRun = opts.dryRun ?? false;
+  const repoFilter = new RepoFilter(fileConfig.repos);
+  const launchSpool = readLaunchSpoolState(home);
+  const launchedSessionIds = launchSpool.ids;
+  const launchFilter = new LaunchFilter(launchedSessionIds);
+  const itemScope = resolved.credential !== void 0 && isItemKey(resolved.credential) ? { item: parseWorkItemNumber(envVars.OUTERLAYER_WORK), sessionItems: launchedItemsBySession(home) } : void 0;
+  const inItemScope = (sessionId) => itemScope === void 0 || itemScope.item !== void 0 && itemScope.sessionItems.get(sessionId) === itemScope.item;
+  const connectionScoped = resolved.kind === "login" && opts.appId === void 0 && !envVars.OUTERLAYER_APP_ID;
+  const runNowMs = Date.now();
+  const launchSkipVerdict = (mtimeMs) => unlaunchedVerdict({ launchStatusDecisive: launchStatusIsDecisive(launchSpool), idleMs: runNowMs - mtimeMs });
+  const launchSkipReason = () => {
+    if (launchSpool.unreadable !== void 0) return "the launch spool could not be read, so none could be checked";
+    if (launchSpool.malformedLines !== void 0) {
+      return `the launch spool has ${launchSpool.malformedLines} damaged line(s), so these could not be checked`;
+    }
+    return "not launched with OUTERLAYER_WORK";
+  };
+  const artifactHoldReason = (sessionId) => {
+    if (launchedSessionIds.has(sessionId)) {
+      return inItemScope(sessionId) ? void 0 : "its session was launched for another work item";
+    }
+    if (launchSpool.unreadable !== void 0) {
+      return "the launch spool could not be read this run, so no artifact may leave the machine";
+    }
+    if (launchSpool.malformedLines !== void 0) {
+      return "the launch spool has damaged lines, so its session's launch could not be checked";
+    }
+    return "its session was not launched with OUTERLAYER_WORK, so it may not leave the machine";
+  };
+  if (launchSpool.unreadable !== void 0) {
+    stats.blocked = `the launch spool at ${launchesPath(home)} could not be read (${launchSpool.unreadable}) \u2014 no session could be checked for a launch record, so nothing uploaded`;
+    if (!opts.quiet) {
+      process.stderr.write(
+        `${C.yellow}!${C.reset} the launch spool at ${launchesPath(home)} could not be read (${launchSpool.unreadable}) \u2014 nothing uploads this run, and no session is passed over. Fix the file's permissions and sync again.
+`
+      );
+    }
+  } else if (launchSpool.malformedLines !== void 0) {
+    stats.blocked = `${launchSpool.malformedLines} line(s) in the launch spool at ${launchesPath(home)} could not be parsed \u2014 a session with no launch record cannot be told from one those lines named, so any such session is held instead of uploaded`;
+    if (!opts.quiet)
+      process.stderr.write(
+        `${C.yellow}!${C.reset} ${launchSpool.malformedLines} line(s) in the launch spool at ${launchesPath(home)} could not be parsed, so a session with no launch record cannot be told from one those lines named. Nothing is passed over; sessions the spool does name still upload.
+`
+      );
+  }
+  installScrubContext(home, fileConfig.scrub);
+  if (!resolved.ok) throw new SyncConfigError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
+  {
+    const sinceMs = opts.all ? 0 : readWatermark(url, appId, home);
+    const hookPlan = planHookExecMerge({ home });
+    const mergedHookEndKeys = /* @__PURE__ */ new Map();
+    const hookRedeliverySessionIds = new Set(
+      [...hookPlan.eventsBySession.keys()].filter((sessionId) => launchedSessionIds.has(sessionId))
+    );
+    if (hookPlan.damagedLines > 0 && !opts.quiet) {
+      process.stderr.write(
+        `${C.yellow}!${C.reset} ${hookPlan.damagedLines} line(s) in the hook-execution spool at ${hookExecSpoolPath(home)} could not be parsed \u2014 a hook that did not report an outcome is left unrecorded this run rather than reported as a crash.
+`
+      );
+    }
+    if (!dryRun) migrateLegacyArtifactSidecars(home);
+    const artifactPlan = planArtifactUpload({ home });
+    if (!opts.quiet) {
+      if (artifactPlan.corrupt) {
+        process.stderr.write(
+          `${C.yellow}!${C.reset} artifact spool state at ${artifactsStatePath(home)} is corrupt \u2014 treating it as empty; a record's saved disposition may be forgotten (a safe, if wasteful, re-upload for anything already synced)
+`
+        );
+      }
+      for (const { offset, reason } of artifactPlan.skipped) {
+        process.stderr.write(`${C.yellow}!${C.reset} artifact spool line at offset ${offset} skipped \u2014 ${reason}
+`);
+      }
+      for (const { offset, reason } of artifactPlan.held) {
+        process.stderr.write(`${C.yellow}!${C.reset} artifact spool line at offset ${offset} held \u2014 ${reason}
+`);
+      }
+    }
+    const combinedRecords = artifactPlan.candidates;
+    const contextSourceBySessionId = /* @__PURE__ */ new Map();
+    for (const record of readContextProvenance(home)) {
+      contextSourceBySessionId.set(record.sessionId, record);
+    }
+    const liveUploads = readLiveUploadState(home).sessions;
+    const collected = [];
+    const observedRepos = /* @__PURE__ */ new Set();
+    let heldMinMtimeMs = Number.POSITIVE_INFINITY;
+    let passableMaxMtimeMs = 0;
+    const neverShipSessionIds = /* @__PURE__ */ new Set();
+    const noteSkipped = (sessionId, mtimeMs, verdict) => {
+      if (statusUnknown(verdict)) heldMinMtimeMs = Math.min(heldMinMtimeMs, mtimeMs);
+      else passableMaxMtimeMs = Math.max(passableMaxMtimeMs, mtimeMs);
+      if (!mightStillShip(verdict) && typeof sessionId === "string") neverShipSessionIds.add(sessionId);
+    };
+    const { report } = scanAll({
+      root: opts.root,
+      rawRoot: opts.rawRoot,
+      codexRoot: opts.codexRoot,
+      cursorRoot: opts.cursorRoot,
+      cursorProjectsRoot: opts.cursorProjectsRoot,
+      limit: opts.limit,
+      captureTier: tier,
+      adapters: sinceAdapters(sinceMs, hookRedeliverySessionIds),
+      onSession: (session, entry, blobs) => {
+        enrichSessionRepo(session);
+        setRepoRoot(resolveRepoIdentity(session.env.cwd).repoRoot);
+        if (!repoFilter.allows(session.env?.gitRepo)) {
+          noteSkipped(session.id, entry.mtimeMs, "reversible");
+          return;
+        }
+        if (!launchFilter.allows(session)) {
+          noteSkipped(session.id, entry.mtimeMs, launchSkipVerdict(entry.mtimeMs));
+          return;
+        }
+        if (connectionScoped) {
+          const sessionFactory = readRepoConnection(session.env.cwd ?? "/")?.appId;
+          if (sessionFactory !== appId) {
+            const cwd = session.env.cwd ?? "/";
+            const connectable = sessionFactory === void 0 && findGitDirs(cwd) !== void 0;
+            noteSkipped(session.id, entry.mtimeMs, connectable ? "unknown" : "reversible");
+            return;
+          }
+        }
+        const scopeKey = session.subagent?.parentSessionId ?? session.id;
+        if (!inItemScope(scopeKey)) {
+          noteSkipped(session.id, entry.mtimeMs, "unknown");
+          return;
+        }
+        {
+          const identity = resolveRepoIdentity(session.env.cwd);
+          if (identity.repoRoot) observedRepos.add(identity.repoRoot);
+        }
+        const hookEvents = hookPlan.eventsBySession.get(session.id);
+        if (hookEvents && hookEvents.length > 0) {
+          appendHookExecEvents(session, hookEvents);
+          mergedHookEndKeys.set(session.id, session.subagent?.parentSessionId ?? session.id);
+        }
+        applyContextProvenance(session, contextSourceBySessionId.get(session.id));
+        applyReportedCost(session, home);
+        const gated = prepareSessionForUpload(session, tier, envVars);
+        const liveEntry = liveUploads[gated.id];
+        const daemonIsStreaming = liveEntry !== void 0 && !liveEntry.ended && !liveEntry.failed;
+        if (daemonIsStreaming && !sessionHasEnded(home, gated.subagent?.parentSessionId ?? gated.id)) {
+          const gatedTurns = gated.turns ?? [];
+          gated.delta = {
+            fromTurn: 0,
+            toTurn: gatedTurns.reduce((max, t) => Math.max(max, t.index), 0),
+            open: true,
+            counts: wholeSessionCounts(gatedTurns)
+          };
+        }
+        collected.push({
+          session: gated,
+          blobs: tier === "full" ? blobs : [],
+          mtimeMs: entry.mtimeMs
+        });
+      }
+    });
+    if (report.droppedByLimitMinMtimeMs !== void 0) {
+      noteSkipped(void 0, report.droppedByLimitMinMtimeMs, "unknown");
+    }
+    const launchDecisive = launchStatusIsDecisive(launchSpool);
+    const worthHolding = (sessionId) => {
+      if (!launchDecisive) return true;
+      const newestRecordMs = hookPlan.sessionNewestRecordMs.get(sessionId);
+      return newestRecordMs === void 0 || runNowMs - newestRecordMs < RESUME_WINDOW_MS;
+    };
+    const endedByKey = /* @__PURE__ */ new Map();
+    const mergedSessionHasEnded = (sessionId) => {
+      const key = mergedHookEndKeys.get(sessionId);
+      if (key === void 0) return false;
+      let ended = endedByKey.get(key);
+      if (ended === void 0) {
+        ended = sessionHasEnded(home, key);
+        endedByKey.set(key, ended);
+      }
+      return ended;
+    };
+    let hookWatermarkOffset = hookPlan.fullyConsumedOffset;
+    for (const [sessionId, offset] of hookPlan.sessionGroupOffsets) {
+      if (mergedSessionHasEnded(sessionId)) continue;
+      if (neverShipSessionIds.has(sessionId)) continue;
+      if (!worthHolding(sessionId)) continue;
+      hookWatermarkOffset = Math.min(hookWatermarkOffset, offset);
+    }
+    const watermarkCeilingMs = heldMinMtimeMs === Number.POSITIVE_INFINITY ? Number.POSITIVE_INFINITY : heldMinMtimeMs - 1;
+    stats.pending = collected.length;
+    if (launchStatusIsDecisive(launchSpool)) stats.skippedNotLaunched = launchFilter.skippedTotal;
+    else stats.held = launchFilter.skippedTotal;
+    if (!opts.dryRun) {
+      for (const repoRoot of observedRepos) removeJournalHooks(repoRoot);
+    }
+    collected.sort((a, b) => a.mtimeMs - b.mtimeMs);
+    const items = collected.flatMap((item) => chunkOversizedSession(item));
+    const batches = [];
+    {
+      let current = { schemaVersion: 1, sessions: [] };
+      let currentBlobs = /* @__PURE__ */ new Map();
+      let currentBytes = 0;
+      let currentBlobBytes = 0;
+      let currentMax = 0;
+      const flush = () => {
+        if (current.sessions.length === 0) return;
+        if (currentBlobs.size > 0) current.blobs = [...currentBlobs.values()];
+        batches.push({ payload: current, maxMtimeMs: currentMax });
+        current = { schemaVersion: 1, sessions: [] };
+        currentBlobs = /* @__PURE__ */ new Map();
+        currentBytes = 0;
+        currentBlobBytes = 0;
+        currentMax = 0;
+      };
+      for (const item of items) {
+        const size = JSON.stringify(item.session).length + item.blobs.reduce((n, b) => n + b.data.length, 0);
+        let newBlobs = item.blobs.filter((b) => !currentBlobs.has(b.sha256));
+        const newBlobBytes = newBlobs.reduce((n, b) => n + b.data.length, 0);
+        if (current.sessions.length >= MAX_SESSIONS_PER_BATCH || currentBytes > 0 && currentBytes + size > MAX_BATCH_JSON_BYTES || current.sessions.length > 0 && currentBlobs.size + newBlobs.length > MAX_BLOBS_PER_BATCH || current.sessions.length > 0 && currentBlobBytes + newBlobBytes > MAX_BLOB_BYTES_PER_BATCH) {
+          flush();
+          newBlobs = item.blobs.filter((b) => !currentBlobs.has(b.sha256));
+        }
+        const packed = [];
+        let packedBytes = currentBlobBytes;
+        for (const blob of newBlobs) {
+          if (currentBlobs.size + packed.length >= MAX_BLOBS_PER_BATCH) break;
+          if (blob.data.length >= MAX_SINGLE_BLOB_BYTES) continue;
+          if (packedBytes + blob.data.length > MAX_BLOB_BYTES_PER_BATCH) continue;
+          packed.push(blob);
+          packedBytes += blob.data.length;
+        }
+        if (packed.length < newBlobs.length) {
+          process.stderr.write(
+            `${C.yellow}!${C.reset} session ${item.session.id ?? "?"} references ${newBlobs.length} images (${Math.round(newBlobBytes / 1024)} KB) \u2014 shipping ${packed.length}, the rest stay local
+`
+          );
+        }
+        current.sessions.push(item.session);
+        for (const blob of packed) if (!currentBlobs.has(blob.sha256)) currentBlobs.set(blob.sha256, blob);
+        currentBytes += size;
+        currentBlobBytes = packedBytes;
+        currentMax = Math.max(currentMax, item.mtimeMs);
+      }
+      flush();
+    }
+    const blobsTotal = batches.reduce((n, b) => n + (b.payload.blobs?.length ?? 0), 0);
+    const blobBytes = batches.reduce(
+      (n, b) => n + (b.payload.blobs?.reduce((m, blob) => m + blob.bytes, 0) ?? 0),
+      0
+    );
+    if (dryRun) {
+      let output2;
+      if (opts.json) {
+        output2 = JSON.stringify(
+          {
+            url,
+            appId,
+            tier,
+            batches: batches.map((b) => b.payload),
+            artifacts: {
+              pending: combinedRecords.length,
+              records: combinedRecords.map(({ record }) => {
+                const holdReason = artifactHoldReason(record.sessionId);
+                return {
+                  filename: record.filename,
+                  kind: inferArtifactKind(record.mediaType),
+                  sessionId: record.sessionId,
+                  emittedAt: record.t,
+                  ...holdReason !== void 0 ? { held: true, heldReason: holdReason } : {}
+                };
+              })
+            }
+          },
+          null,
+          2
+        );
+      } else {
+        const lines = [];
+        lines.push(`${C.yellow}DRY RUN${C.reset} \u2014 nothing left this machine.`);
+        lines.push("");
+        lines.push(`  destination  ${url} ${C.dim}(app ${appId})${C.reset}`);
+        lines.push(`  tier         ${tier}`);
+        const stripped = bannedPathsForTier(tier);
+        lines.push(
+          stripped.length > 0 ? `  stripped     ${C.dim}${stripped.join(", ")}${C.reset}` : `  stripped     ${C.dim}nothing \u2014 full content ships${C.reset}`
+        );
+        lines.push(`  sessions     ${collected.length} (of ${report.scanned} scanned) in ${batches.length} batch(es)`);
+        lines.push(`  images       ${blobsTotal} blob(s), ${fmtBytes(blobBytes)}`);
+        if (combinedRecords.length > 0) {
+          const heldRecords = combinedRecords.filter(({ record }) => artifactHoldReason(record.sessionId) !== void 0);
+          lines.push(
+            `  artifacts    ${combinedRecords.length - heldRecords.length} pending upload` + (heldRecords.length > 0 ? `, ${heldRecords.length} held` : "")
+          );
+          for (const { record } of combinedRecords.slice(0, 10)) {
+            const holdReason = artifactHoldReason(record.sessionId);
+            lines.push(
+              `    ${C.dim}${sanitizeTerminal(record.sessionId).slice(0, 8)}${C.reset}  ${inferArtifactKind(record.mediaType)}  ${sanitizeTerminal(record.filename)}  ${C.dim}${fmtAge(Date.now() - Date.parse(record.t))}${C.reset}` + (holdReason !== void 0 ? `  ${C.yellow}held${C.reset} ${C.dim}\u2014 ${holdReason}${C.reset}` : "")
+            );
+          }
+          if (combinedRecords.length > 10) {
+            lines.push(`    ${C.dim}\u2026 and ${combinedRecords.length - 10} more${C.reset}`);
+          }
+        }
+        const byRepo = /* @__PURE__ */ new Map();
+        for (const item of collected) {
+          const r = item.session.env?.gitRepo || "(no repo)";
+          byRepo.set(r, (byRepo.get(r) ?? 0) + 1);
+        }
+        const repoRows = [...byRepo.entries()].sort((a, b) => b[1] - a[1]);
+        lines.push(`  repos        ${repoRows.length} distinct:`);
+        for (const [r, n] of repoRows.slice(0, 15)) lines.push(`    ${C.dim}${String(n).padStart(6)}${C.reset}  ${r}`);
+        if (repoRows.length > 15) lines.push(`    ${C.dim}\u2026 and ${repoRows.length - 15} more${C.reset}`);
+        if (repoFilter.skippedTotal > 0) {
+          lines.push(`  ${C.yellow}skipped${C.reset}      ${repoFilter.skippedTotal} session(s) by repo filter:`);
+          for (const [r, n] of [...repoFilter.skipped.entries()].sort((a, b) => b[1] - a[1]).slice(0, 10)) {
+            lines.push(`    ${C.dim}${String(n).padStart(6)}${C.reset}  ${r}`);
+          }
+        }
+        if (launchFilter.skippedTotal > 0) {
+          lines.push(
+            `  ${C.yellow}skipped${C.reset}      ${launchFilter.skippedTotal} transcript(s) \u2014 ${launchSkipReason()}`
+          );
+        }
+        lines.push("");
+        for (const item of collected.slice(0, 20)) {
+          const s = item.session;
+          const repo = s.env?.gitRepo ? ` ${s.env.gitRepo}${s.env.gitBranch ? `@${s.env.gitBranch}` : ""}` : "";
+          lines.push(
+            `  ${C.dim}${s.id.slice(0, 8)}${C.reset}  ${s.agent.type}  ${s.startedAt ?? "?"}  ${s.turns.length} turns${repo}`
+          );
+        }
+        if (collected.length > 20) lines.push(`  ${C.dim}\u2026 and ${collected.length - 20} more${C.reset}`);
+        lines.push("");
+        lines.push(`Run again without --dry-run to sync.`);
+        output2 = lines.join("\n");
+      }
+      if (!opts.quiet) process.stdout.write(output2 + "\n");
+      return {
+        scanned: report.scanned,
+        eligible: collected.length,
+        synced: 0,
+        rejected: [],
+        // A dry run reads the spool (artifactPlan, above) to show what would
+        // upload, but never ATTEMPTS an upload — and every drop reason
+        // (missing blob, permanent 4xx, 14-day age-out) is discovered only
+        // by attempting one, so nothing can be dropped this run either way.
+        artifactsDropped: 0,
+        blobsSent: 0,
+        batches: batches.length,
+        tier,
+        url,
+        dryRun: true,
+        output: output2
+      };
+    }
+    const fetchImpl = opts.fetchImpl ?? defaultFetch;
+    const endpoint = new URL("/v1/agents/sync", url).toString();
+    let synced = 0;
+    let blobsSent = 0;
+    let artifactsDropped = 0;
+    const rejected = [];
+    let watermarkMs = sinceMs;
+    let shippedBatches = 0;
+    const progress = (final = false) => {
+      if (opts.quiet || opts.json || batches.length <= 1) return;
+      const msg = `  batch ${shippedBatches}/${batches.length} \xB7 ${synced} session(s) synced`;
+      if (process.stderr.isTTY) {
+        process.stderr.write(`\r${msg}${final ? "\n" : ""}`);
+      } else if (final || shippedBatches % 25 === 0) {
+        process.stderr.write(`${msg}
+`);
+      }
+    };
+    const failureContext = () => {
+      if (opts.quiet || shippedBatches === 0) return;
+      process.stderr.write(
+        `
+${C.yellow}!${C.reset} progress saved: ${synced} session(s) in ${shippedBatches}/${batches.length} batch(es) shipped before the failure \u2014 re-run ${C.dim}outerlayer sync${C.reset} to resume from there.
+`
+      );
+    };
+    const sleepImpl = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const queue = batches.map(
+      (b) => ({ payload: b.payload, maxMtimeMs: b.maxMtimeMs, advance: true })
+    );
+    let requestSessionCap = Number.POSITIVE_INFINITY;
+    while (queue.length > 0) {
+      const batch = queue.shift();
+      if (batch.payload.sessions.length > requestSessionCap) {
+        const [a, b] = splitPayload(batch.payload);
+        queue.unshift(
+          { payload: a, maxMtimeMs: batch.maxMtimeMs, advance: false },
+          { payload: b, maxMtimeMs: batch.maxMtimeMs, advance: batch.advance }
+        );
+        continue;
+      }
+      let response;
+      let networkErr = "";
+      for (let attempt = 1; attempt <= MAX_BATCH_ATTEMPTS; attempt += 1) {
+        try {
+          response = await fetchImpl(endpoint, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              authorization: `Bearer ${apiKey}`,
+              "x-outerlayer-app-id": appId
+            },
+            body: JSON.stringify(batch.payload)
+          });
+          networkErr = "";
+          stats.contacted = true;
+        } catch (err) {
+          response = void 0;
+          networkErr = String(err);
+        }
+        if (response && !RETRYABLE_STATUSES.has(response.status)) break;
+        if (attempt === MAX_BATCH_ATTEMPTS) break;
+        const retryAfterRaw = response?.headers.get("retry-after");
+        const retryAfterMs2 = retryAfterRaw && /^\d+$/.test(retryAfterRaw) ? Number(retryAfterRaw) * 1e3 : 0;
+        const delayMs = Math.max(retryAfterMs2, RETRY_BASE_DELAY_MS2 * 2 ** (attempt - 1));
+        if (!opts.quiet) {
+          const cause = response ? `HTTP ${response.status}` : "network error";
+          process.stderr.write(
+            `
+${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} hit ${cause} \u2014 retrying in ${Math.round(delayMs / 1e3)}s (attempt ${attempt}/${MAX_BATCH_ATTEMPTS})
+`
+          );
+        }
+        await sleepImpl(delayMs);
+      }
+      if (!response) {
+        failureContext();
+        throw new SyncTransportError(`network error reaching ${endpoint}: ${networkErr}`);
+      }
+      if (response.status === 401) {
+        failureContext();
+        throw new SyncTransportError(
+          unauthorizedMessage(apiKey),
+          401
+        );
+      }
+      if ((RETRYABLE_STATUSES.has(response.status) || response.status === 413) && batch.payload.sessions.length > 1) {
+        const [a, b] = splitPayload(batch.payload);
+        requestSessionCap = Math.min(requestSessionCap, Math.max(a.sessions.length, b.sessions.length));
+        if (!opts.quiet) {
+          process.stderr.write(
+            `
+${C.yellow}!${C.reset} batch keeps failing (HTTP ${response.status}) \u2014 splitting into ${a.sessions.length}+${b.sessions.length} session request(s)
+`
+          );
+        }
+        queue.unshift(
+          { payload: a, maxMtimeMs: batch.maxMtimeMs, advance: false },
+          { payload: b, maxMtimeMs: batch.maxMtimeMs, advance: batch.advance }
+        );
+        continue;
+      }
+      if (!response.ok) {
+        let detail = "";
+        try {
+          const text = await response.text();
+          try {
+            const body2 = JSON.parse(text);
+            detail = body2.error?.message ?? "";
+            const usage = body2.error?.details ?? body2.error;
+            if (response.status === 429 && typeof usage?.currentCount === "number" && typeof usage?.limit === "number") {
+              detail += ` (${usage.currentCount.toLocaleString()}/${usage.limit.toLocaleString()} units used this month)`;
+            }
+          } catch {
+            detail = text.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim().slice(0, 160);
+          }
+        } catch {
+        }
+        failureContext();
+        throw new SyncTransportError(`sync failed (${response.status})${detail ? `: ${detail}` : ""}`, response.status);
+      }
+      const body = await response.json();
+      const sentCount = batch.payload.sessions.length;
+      const sessionRejectedCount = body.data.rejected.filter((r) => r.index >= 0).length;
+      const accountedCount = body.data.accepted.length + sessionRejectedCount;
+      if (accountedCount !== sentCount && !opts.quiet) {
+        process.stderr.write(
+          `
+${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting mismatch: sent ${sentCount}, accepted ${body.data.accepted.length}, rejected ${sessionRejectedCount}
+`
+        );
+      }
+      synced += body.data.accepted.length;
+      blobsSent += body.data.blobsStored;
+      rejected.push(...body.data.rejected);
+      stats.synced = synced;
+      stats.pending = Math.max(0, collected.length - synced);
+      if (batch.advance) {
+        watermarkMs = Math.max(watermarkMs, Math.min(batch.maxMtimeMs, watermarkCeilingMs));
+        writeWatermark(url, appId, watermarkMs, home);
+        shippedBatches += 1;
+        progress(shippedBatches === batches.length);
+      }
+    }
+    const foldMs = Math.min(passableMaxMtimeMs, watermarkCeilingMs);
+    if (foldMs > watermarkMs) {
+      watermarkMs = foldMs;
+      writeWatermark(url, appId, watermarkMs, home);
+    }
+    let artifactsUploaded;
+    let artifactsHeld;
+    if (combinedRecords.length > 0 || artifactPlan.held.length > 0) {
+      const artifactEndpoint = new URL("/v1/artifacts", url).toString();
+      const nowMs = Date.now();
+      const state = artifactPlan.state;
+      const failedOrDroppedThisRun = /* @__PURE__ */ new Set();
+      let uploadedCount = 0;
+      let heldCount = artifactPlan.held.length;
+      let droppedCount = 0;
+      const warn = (message) => {
+        if (!opts.quiet) process.stderr.write(`${C.yellow}!${C.reset} ${message}
+`);
+      };
+      let unauthorized;
+      for (const { record } of combinedRecords) {
+        const name = sanitizeTerminal(record.filename);
+        const holdReason = artifactHoldReason(record.sessionId);
+        if (holdReason !== void 0) {
+          heldCount += 1;
+          warn(`artifact ${name}: held \u2014 ${holdReason}`);
+          continue;
+        }
+        const existing = state.get(record.artifactId);
+        const parsedEmittedMs = Date.parse(record.t);
+        const emittedMsUsable = Number.isFinite(parsedEmittedMs) && parsedEmittedMs <= nowMs;
+        const priorFirstSeenMs = existing !== void 0 ? Date.parse(existing.firstSeen) : NaN;
+        const firstSeenMs = emittedMsUsable ? parsedEmittedMs : Number.isFinite(priorFirstSeenMs) ? priorFirstSeenMs : nowMs;
+        const firstSeenIso = new Date(firstSeenMs).toISOString();
+        if (unauthorized) {
+          heldCount += 1;
+          failedOrDroppedThisRun.add(record.artifactId);
+          continue;
+        }
+        let blobData;
+        try {
+          blobData = readFileSync(join(artifactBlobsDir(home), record.sha256));
+        } catch {
+          state.set(record.artifactId, {
+            state: "dropped",
+            attempts: existing?.attempts ?? 0,
+            firstSeen: firstSeenIso,
+            sha256: record.sha256,
+            reachedServer: true
+          });
+          failedOrDroppedThisRun.add(record.artifactId);
+          warn(`artifact ${name}: blob missing from the spool \u2014 dropping the record`);
+          droppedCount += 1;
+          continue;
+        }
+        const owner = collected.find((c) => c.session.id === record.sessionId);
+        const turnIndex = owner ? resolveArtifactTurnIndex(owner.session.turns ?? [], record.filename) : void 0;
+        let replaces = record.replaces;
+        if (record.replacesTargets === void 0 && replaces !== void 0) {
+          const targetKnownUploaded = state.get(replaces)?.state === "uploaded";
+          const targetTombstonedUnconfirmed = !targetKnownUploaded && isArtifactTombstoned(replaces, home);
+          if (targetTombstonedUnconfirmed || failedOrDroppedThisRun.has(replaces)) replaces = void 0;
+        }
+        const request = {
+          schemaVersion: 1,
+          artifact: {
+            clientArtifactId: record.artifactId,
+            filename: record.filename,
+            mediaType: record.mediaType,
+            bytes: record.bytes,
+            sha256: record.sha256,
+            caption: record.caption,
+            ...record.criterionId !== void 0 ? { criterionId: record.criterionId } : {},
+            emittedAt: record.t,
+            ...record.prNumber !== void 0 ? { prNumber: record.prNumber } : {},
+            ...record.gitRepo !== void 0 ? { gitRepo: record.gitRepo } : {},
+            ...record.gitBranch !== void 0 ? { gitBranch: record.gitBranch } : {},
+            ...record.commitSha !== void 0 ? { commitSha: record.commitSha } : {},
+            ...replaces !== void 0 ? { replaces } : {},
+            ...record.replacesTargets !== void 0 ? { replacesTargets: record.replacesTargets } : {},
+            session: { sessionId: record.sessionId, ...turnIndex !== void 0 ? { turnIndex } : {} }
+          },
+          blob: { data: blobData.toString("base64") }
+        };
+        let failure = "";
+        let status;
+        let errorCode = "";
+        let serverMessage = "";
+        try {
+          const response = await fetchImpl(artifactEndpoint, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              authorization: `Bearer ${apiKey}`,
+              "x-outerlayer-app-id": appId
+            },
+            body: JSON.stringify(request)
+          });
+          if (!response.ok) {
+            failure = `HTTP ${response.status}`;
+            status = response.status;
+            try {
+              const body = JSON.parse(await response.text());
+              if (typeof body.error?.code === "string") errorCode = body.error.code;
+              if (typeof body.error?.message === "string") serverMessage = body.error.message;
+            } catch {
+            }
+          }
+        } catch (err) {
+          failure = String(err);
+        }
+        if (!failure) {
+          state.set(record.artifactId, {
+            state: "uploaded",
+            attempts: (existing?.attempts ?? 0) + 1,
+            firstSeen: firstSeenIso,
+            sha256: record.sha256,
+            reachedServer: true
+          });
+          uploadedCount += 1;
+          continue;
+        }
+        if (status === 401) {
+          unauthorized = new SyncTransportError(
+            unauthorizedMessage(apiKey),
+            401
+          );
+          heldCount += 1;
+          failedOrDroppedThisRun.add(record.artifactId);
+          continue;
+        }
+        if (status !== void 0 && status >= 400 && status < 500 && status !== 408 && status !== 429 && KNOWN_PERMANENT_ARTIFACT_ERROR_CODES.has(errorCode)) {
+          const detail = serverMessage ? `: ${sanitizeTerminal(serverMessage)}` : "";
+          const hint = errorCode === "unknown_replaces_target" ? " \u2014 re-emit with a corrected --replaces id, or without --replaces" : "";
+          warn(`artifact ${name} rejected permanently (${failure}${detail})${hint} \u2014 dropping the record`);
+          state.set(record.artifactId, {
+            state: "dropped",
+            attempts: (existing?.attempts ?? 0) + 1,
+            firstSeen: firstSeenIso,
+            sha256: record.sha256,
+            reachedServer: !NEVER_REACHED_SERVER_ERROR_CODES.has(errorCode)
+          });
+          failedOrDroppedThisRun.add(record.artifactId);
+          droppedCount += 1;
+          continue;
+        }
+        const ageMs = nowMs - firstSeenMs;
+        if (ageMs > ARTIFACT_RETRY_MAX_AGE_MS) {
+          warn(`artifact ${name} (${failure}) is older than 14 days and still failing \u2014 dropping it`);
+          state.set(record.artifactId, {
+            state: "dropped",
+            attempts: (existing?.attempts ?? 0) + 1,
+            firstSeen: firstSeenIso,
+            sha256: record.sha256,
+            reachedServer: false
+          });
+          failedOrDroppedThisRun.add(record.artifactId);
+          droppedCount += 1;
+          continue;
+        }
+        warn(`artifact ${name} upload failed (${failure}) \u2014 will retry on the next sync`);
+        state.set(record.artifactId, {
+          state: "held",
+          attempts: (existing?.attempts ?? 0) + 1,
+          firstSeen: firstSeenIso,
+          sha256: record.sha256,
+          reachedServer: false
+        });
+        failedOrDroppedThisRun.add(record.artifactId);
+        heldCount += 1;
+      }
+      if (uploadedCount + heldCount + droppedCount > 0) {
+        if (uploadedCount > 0) stats.contacted = true;
+        artifactsUploaded = uploadedCount;
+        artifactsHeld = heldCount;
+        artifactsDropped = droppedCount;
+        if (!opts.quiet) {
+          process.stderr.write(
+            `${C.dim}artifacts${C.reset} ${uploadedCount} uploaded \xB7 ${heldCount} held \xB7 ${droppedCount} dropped
+`
+          );
+        }
+      }
+      const persisted = writeArtifactSpoolState(state, home);
+      if (!persisted && !opts.quiet) {
+        process.stderr.write(
+          `${C.yellow}!${C.reset} failed to persist ${artifactsStatePath(home)} \u2014 this run's artifact progress may be re-attempted next sync (safe: uploads are idempotent on the client artifact id)
+`
+        );
+      }
+      reclaimUnneededArtifactBlobs(home, neededArtifactShas(home, state));
+      if (unauthorized) {
+        failureContext();
+        throw unauthorized;
+      }
+    }
+    if (shippedBatches === batches.length && (opts.url || opts.apiKey || opts.appId)) {
+      if (isLoopbackUrl(url)) {
+        if (!opts.quiet) {
+          process.stderr.write(
+            `${C.dim}  not saving ${new URL(url).host} as the default destination \u2014 pass the flags again next time, or edit ${cloudConfigPath(home)}${C.reset}
+`
+          );
+        }
+      } else {
+        writeCloudConfig(
+          { url, apiKey: resolved.kind === "key" ? apiKey : void 0, appId: resolved.kind === "key" ? appId : void 0 },
+          home
+        );
+      }
+    }
+    let output;
+    if (opts.json) {
+      output = JSON.stringify({
+        scanned: report.scanned,
+        eligible: collected.length,
+        synced,
+        rejected,
+        blobsSent,
+        artifactsDropped,
+        tier,
+        url,
+        ...artifactsUploaded !== void 0 ? { artifactsUploaded, artifactsHeld } : {}
+      });
+    } else {
+      const lines = [];
+      const icon = rejected.length === 0 && artifactsDropped === 0 && launchStatusIsDecisive(launchSpool) ? `${C.green}\u2713${C.reset}` : `${C.yellow}!${C.reset}`;
+      lines.push(
+        `${icon} synced ${synced}/${collected.length} session(s) \u2192 ${new URL(url).host} ${C.dim}(tier ${tier}${blobsSent ? `, ${blobsSent} image(s)` : ""}${repoFilter.skippedTotal > 0 ? `, ${repoFilter.skippedTotal} skipped by repo filter` : ""}${launchFilter.skippedTotal > 0 ? `, ${launchFilter.skippedTotal} skipped \u2014 ${launchSkipReason()}` : ""})${C.reset}`
+      );
+      if (artifactsDropped > 0) {
+        lines.push(
+          `${C.yellow}  ${artifactsDropped} artifact(s) dropped \u2014 bytes missing from the spool, refused permanently, or too old to keep retrying, so the evidence they were emitted for is NOT attached${C.reset}`
+        );
+      }
+      if (collected.length === 0) {
+        lines.push(
+          launchSpool.unreadable === void 0 ? `${C.dim}  nothing new since the last sync \u2014 use --all to re-send everything${C.reset}` : `${C.dim}  fix the launch spool's permissions and sync again \u2014 nothing was passed over${C.reset}`
+        );
+      }
+      for (const r of rejected.slice(0, 10)) {
+        lines.push(`  ${C.red}\u2717${C.reset} ${r.id ?? `#${r.index}`} ${C.dim}${r.reason}${C.reset}`);
+      }
+      if (rejected.length > 10) lines.push(`  ${C.dim}\u2026 and ${rejected.length - 10} more rejects${C.reset}`);
+      output = lines.join("\n");
+    }
+    if (!opts.quiet) process.stdout.write(output + "\n");
+    writeHookExecWatermark(hookWatermarkOffset, home);
+    pruneHookExecSpool({ home, consumedOffset: hookWatermarkOffset });
+    return {
+      scanned: report.scanned,
+      eligible: collected.length,
+      synced,
+      rejected,
+      blobsSent,
+      artifactsDropped,
+      batches: batches.length,
+      tier,
+      url,
+      dryRun: false,
+      watermarkMs,
+      ...artifactsUploaded !== void 0 ? { artifactsUploaded, artifactsHeld } : {},
+      output
+    };
+  }
+}
+
+export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, isLoopbackUrl, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };