@aligndottech/cli 0.49.0 → 0.51.0

package/dist/lib/local-db-migrate.js

@@ -0,0 +1,528 @@
+/**
+ * The local graph's schema and its one-time migrations, moved out of local-db.ts verbatim so
+ * that file stays under the 900-line limit. local-db.ts re-exports SCHEMA_VERSION, so every
+ * existing `import { SCHEMA_VERSION } from './local-db.js'` still resolves.
+ */
+import { bumpRowSetEpoch } from './local-db-epoch.js';
+import { repoFromSourceUrl } from './repo-identity.js';
+import { migrateV7 } from './local-db-v7.js';
+import { migrateV8 } from './local-db-v8.js';
+import { migrateV9 } from './local-db-v9.js';
+import { migrateV10, repairPromotions } from './local-db-v10.js';
+import { migrateV11 } from './local-db-v11.js';
+import { hasDetectorVersion, migrateV12 } from './local-db-v12.js';
+export const SCHEMA = `
+CREATE TABLE IF NOT EXISTS decisions (
+  id TEXT PRIMARY KEY,
+  title TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  source_url TEXT,
+  platform TEXT NOT NULL DEFAULT 'cli',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  repo TEXT,
+  decided_at TEXT,
+  decider_kind TEXT,
+  confirmed_by TEXT,
+  confirmed_at TEXT,
+  ratified_by TEXT,
+  ratified_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS decision_audit (
+  id TEXT PRIMARY KEY,
+  decision_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  actor TEXT,
+  detail TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS decision_embeddings (
+  decision_id TEXT PRIMARY KEY REFERENCES decisions(id) ON DELETE CASCADE,
+  embedding BLOB NOT NULL,
+  model TEXT
+);
+
+CREATE TABLE IF NOT EXISTS decision_links (
+  id TEXT PRIMARY KEY,
+  source_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE CASCADE,
+  target_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE CASCADE,
+  relation TEXT NOT NULL,
+  confidence REAL NOT NULL DEFAULT 1.0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS decision_refs (
+  decision_id TEXT NOT NULL REFERENCES decisions(id) ON DELETE CASCADE,
+  ref TEXT NOT NULL,
+  platform TEXT NOT NULL,
+  PRIMARY KEY (decision_id, ref)
+);
+`;
+/**
+ * Schema version this build expects. Bump when adding a step to `migrate`.
+ *
+ * Exported so a test can assert the migration WROTE the version it claims, without hardcoding
+ * the number - a test pinning a literal 1 had to be edited by this change rather than passing
+ * or failing on its own merits. A parity test also derives the highest `version <` branch in
+ * `migrate` from the source and compares it here, because forgetting the bump leaves the new
+ * branch running destructively on every open with nothing to stop it.
+ */
+export const SCHEMA_VERSION = 11;
+/** The title connector-core 0.5.0 gave every Slack thread whose root was deleted. The 0.6.0
+ *  fetcher titles such a thread from its first human message, or drops it; either way this
+ *  row is a duplicate-to-be under the (source_url, title) key, or noise. */
+export const SLACK_TOMBSTONE_TITLE = 'This message was deleted.';
+/** The five ALI-831 columns, named exactly as the shared contract spells them. One list,
+ *  read by the migration; SCHEMA above spells them a second time because a fresh CREATE
+ *  TABLE cannot read a constant, and the provenance test pins both against each other. */
+const PROVENANCE_COLUMNS = ['decider_kind', 'confirmed_by', 'confirmed_at', 'ratified_by', 'ratified_at'];
+/**
+ * ALI-787: the only embedding model this graph has ever written before the `model` column
+ * existed. Verified, not assumed - `git log --all -p` on local-embeddings.ts and
+ * local-embeddings-wasm.ts shows exactly one HF model id was ever hardcoded there, across
+ * every commit. So backfilling every pre-column row with this is a true historical fact,
+ * unlike `decided_at` (step 4 below), which genuinely cannot be derived from an existing row.
+ *
+ * A deliberate LITERAL, not an import of local-embeddings.ts's EMBEDDING_MODEL_ID: this
+ * constant names what was true when the column was added, and must stay that value even
+ * after a future model swap changes EMBEDDING_MODEL_ID. Migrations are a historical record.
+ */
+const LEGACY_EMBEDDING_MODEL = 'Xenova/all-MiniLM-L6-v2';
+/**
+ * One-time data migrations, tracked in SQLite's built-in `user_version`.
+ *
+ * 1. ALI-503: relabel the cosine-similarity links that were written as `conflicts_with`.
+ *    Every such row at version 0 is provably an artefact, because `insertLink` had exactly
+ *    one caller and it hardcoded that relation for any pair over 0.65 cosine. No classifier
+ *    verdict was ever persisted, so there is no earned row to damage.
+ *
+ * 2. A decision's `source_url` identifies it, and nothing enforced that: `insertDecision` minted
+ *    a fresh UUID per call, so re-importing the same commit added a second copy. The documented
+ *    first run does exactly that - `setup --local` seeds from git, then its own outro tells you
+ *    to run `align connect git` - so a graph goes from 2 decisions to 4 by following the tips.
+ *    Collapse the existing duplicates, then make them unrepresentable with a unique index.
+ *
+ * 3. ALI-798: add the `repo` column (missing on any graph that predates it) and backfill it
+ *    for every existing row from `source_url`, via the same `repoFromSourceUrl` the importer
+ *    now stamps new rows with - one reader of the URL shape, used for both. A row whose
+ *    source is not code (Jira, Slack, a bare capture) stays NULL, which is "unattributed",
+ *    not "wrong": `--repo` scoping always includes unattributed rows alongside the named
+ *    repo (see local-gateway-client.ts), so nothing existing becomes invisible.
+ *
+ * 4. ALI-829: add `decided_at` - when the decision was MADE, from the source's own
+ *    timestamp, as distinct from `created_at`, the minute this CLI imported it. Every one
+ *    of the 684 rows in the 2026-09-02 measurement carried the ingest minute and nothing
+ *    else, so "what changed since March" was unanswerable offline. No backfill, unlike
+ *    `repo`: a repo is derivable from a stored source_url, and a decision date is not
+ *    derivable from anything already in the row. A re-import fills it in; inventing one
+ *    from created_at would write the exact wrong fact this column exists to correct.
+ *
+ *    Same bump, second step: drop the Slack rows titled by a deleted root. The 0.6.0
+ *    fetcher titles a thread from its first human message, and the dedup key is
+ *    (source_url, title), so each of those rows would otherwise be re-inserted BESIDE its
+ *    tombstone twin on the next import (35 of 39 on the 2026-09-02 graph). The next import
+ *    recreates the real ones with real titles; the ones that were only bot output on a
+ *    deleted root do not come back, which is the point. Foreign keys are off in this
+ *    database (see step 2), so the dependent rows are deleted explicitly - including any
+ *    link a human adjudicated on such a row. That is a real loss, accepted: the row's
+ *    identity is changing under it, and the re-import classifies the retitled thread
+ *    afresh. Scoped to platform = 'slack': a git commit or a captured note that happens to
+ *    carry the same words is not a tombstone and is left alone.
+ *
+ * 5. ALI-831: add the decider/ratified columns (`decider_kind`, `confirmed_by`,
+ *    `confirmed_at`, `ratified_by`, `ratified_at`) so an agent-made decision can enter as a
+ *    CLAIM a human later stands behind, and the `decision_audit` table the human act is
+ *    recorded in. No backfill, on purpose: a row captured before the column reads as
+ *    'unknown', and stamping 'human' on it from its platform would be the retroactive
+ *    guess align-stack's migration 113 refuses. The columns are added here rather than only
+ *    in SCHEMA because CREATE TABLE IF NOT EXISTS never alters an existing table.
+ *
+ * 6. ALI-787: tag each embedding with the model that produced it (see LEGACY_EMBEDDING_MODEL).
+ *
+ * 7. L2: per-source sync state, `source_key` identity with a backed-up twin merge,
+ *    `detail_pending`, `enriched_at` (NULL on every existing row) and `local_judgements`.
+ *    See local-db-v7.ts.
+ *
+ * The version guard is load-bearing rather than tidiness. The same UPDATE run on every open
+ * is indistinguishable from this one today, and starts silently eating genuine conflicts the
+ * moment anything writes one.
+ */
+/**
+ * Remove a decision and everything hanging off it. Foreign keys are off in this database
+ * (see migrate, step 2), so the dependents are named explicitly rather than cascaded. One
+ * writer for the v4 tombstone sweep and the ingest-time twin removal (ALI-829).
+ */
+export function deleteDecisionWithDependents(db, id) {
+    bumpRowSetEpoch(db);
+    db.prepare('DELETE FROM decision_links WHERE source_id = ? OR target_id = ?').run(id, id);
+    db.prepare('DELETE FROM decision_refs WHERE decision_id = ?').run(id);
+    db.prepare('DELETE FROM decision_embeddings WHERE decision_id = ?').run(id);
+    db.prepare('DELETE FROM decision_audit WHERE decision_id = ?').run(id);
+    db.prepare('DELETE FROM decisions WHERE id = ?').run(id);
+}
+/** The one downgrade guard: migrate() and every other writer of this file (the sync state, purge) call it. */
+export function assertSchemaSupported(version, db) {
+    // R4: an early-branch 12 that differs only by the additive column is not newer (see restampEarlyV12).
+    if (version === 12 && db !== undefined && hasDetectorVersion(db))
+        return;
+    if (version > SCHEMA_VERSION) {
+        throw new Error(`This local graph was written by a newer Align CLI (schema v${version}; this CLI supports up to v${SCHEMA_VERSION}). ` +
+            'Upgrade the CLI (npm install -g @aligndottech/cli@latest) before opening it.');
+    }
+}
+/**
+ * Re-review R4: an unreleased build of the detector branch (68cc596) stamped user_version 12 for
+ * the detector_version column, which is now an additive step. A 12 whose only difference is that
+ * column is put back to 11, inside a write lock, so this CLI and older ones open it. A 12 without
+ * the column came from somewhere else and is still refused. The day a real numbered step 12 lands,
+ * this must go, or it would hide that step.
+ */
+function restampEarlyV12(db) {
+    if (db.prepare('PRAGMA user_version').get().user_version !== 12)
+        return;
+    db.exec('BEGIN IMMEDIATE');
+    try {
+        const current = db.prepare('PRAGMA user_version').get().user_version;
+        if (current === 12 && hasDetectorVersion(db))
+            db.exec('PRAGMA user_version = 11');
+        db.exec('COMMIT');
+    }
+    catch (err) {
+        if (db.isTransaction)
+            db.exec('ROLLBACK');
+        throw err;
+    }
+}
+export function migrate(db) {
+    restampEarlyV12(db);
+    const version = db.prepare('PRAGMA user_version').get().user_version;
+    // A newer CLI migrated this file. Running this build's older code against the newer tables
+    // (a v6 binary inserting rows without a source_key beside keyed ones) corrupts identity, so
+    // refuse before touching anything.
+    assertSchemaSupported(version);
+    if (version < 1) {
+        db.exec(`UPDATE decision_links SET relation = 'relates' WHERE relation = 'conflicts_with'`);
+    }
+    if (version < 2) {
+        // IMMEDIATE, not the default DEFERRED: this transaction reads (the survivor scan) before it
+        // writes, and under WAL another writer arriving in between makes the first write fail with
+        // SQLITE_BUSY_SNAPSHOT, which busy_timeout does not retry. Every local command opens the DB
+        // and the advisory hook fires on every agent edit, so a concurrent open is the normal case.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            // The survivor is the row inserted FIRST. `rowid` rather than `id` breaks a created_at
+            // tie: created_at has one-second granularity so rows written in one import tie routinely,
+            // and ordering by a random UUID would keep an arbitrary one while this comment claimed to
+            // keep the long-standing id. rowid is insertion order (the table is not WITHOUT ROWID).
+            //
+            // Keyed on (source_url, title), not source_url alone. Some fetchers emit a CONSTANT
+            // source_url when the per-item link is missing - connector-core's Teams fallback is
+            // literally 'https://teams.microsoft.com' - and collapsing on the URL alone deleted every
+            // such message but one. Two rows sharing a URL AND a title are duplicates by any reading;
+            // two sharing only the URL are not.
+            db.exec(`
+        CREATE TEMP TABLE dedup_survivor AS
+        SELECT source_url, title, id FROM (
+          SELECT source_url, title, id,
+                 ROW_NUMBER() OVER (PARTITION BY source_url, title ORDER BY created_at, rowid) AS rn
+          FROM decisions WHERE source_url IS NOT NULL
+        ) WHERE rn = 1;
+
+        CREATE TEMP TABLE dedup_dropped AS
+        SELECT d.id AS id, s.id AS survivor_id
+        FROM decisions d JOIN dedup_survivor s
+          ON d.source_url = s.source_url AND d.title = s.title
+        WHERE d.id <> s.id;
+      `);
+            // Repoint edges rather than dropping them: an edge naming a duplicate is a real edge that
+            // happened to name the copy. Dropping it would lose a relationship the user earned.
+            db.exec(`
+        UPDATE decision_links SET source_id = (
+          SELECT survivor_id FROM dedup_dropped WHERE id = decision_links.source_id
+        ) WHERE source_id IN (SELECT id FROM dedup_dropped);
+        UPDATE decision_links SET target_id = (
+          SELECT survivor_id FROM dedup_dropped WHERE id = decision_links.target_id
+        ) WHERE target_id IN (SELECT id FROM dedup_dropped);
+      `);
+            // Both cleanups are scoped to the pairs repointing actually touched. An earlier version
+            // deduplicated decision_links table-wide, which deleted user-earned edges that had nothing
+            // to do with duplication - and kept the lowest UUID rather than the highest confidence.
+            db.exec(`
+        DELETE FROM decision_links
+        WHERE source_id = target_id
+          AND (source_id IN (SELECT survivor_id FROM dedup_dropped)
+            OR target_id IN (SELECT survivor_id FROM dedup_dropped));
+      `);
+            // Explicitly, not by CASCADE: SQLite leaves foreign_keys OFF unless asked, so the
+            // ON DELETE CASCADE in the schema does not fire and these would be orphaned.
+            if (db.prepare('SELECT COUNT(*) AS n FROM dedup_dropped').get().n > 0)
+                bumpRowSetEpoch(db);
+            db.exec(`DELETE FROM decision_embeddings WHERE decision_id IN (SELECT id FROM dedup_dropped)`);
+            db.exec(`DELETE FROM decisions WHERE id IN (SELECT id FROM dedup_dropped)`);
+            db.exec(`DROP TABLE dedup_dropped; DROP TABLE dedup_survivor;`);
+            // Created here rather than in SCHEMA on purpose: SCHEMA runs before this function, so on
+            // any already-duplicated graph the index would fail to build before the collapse could
+            // run. A fresh database passes through the same path with nothing to collapse.
+            //
+            // A distinct name from any previous attempt, because IF NOT EXISTS matches on the NAME
+            // only: an index of the same name with different columns would be silently kept, and
+            // every later insert would then fail with "ON CONFLICT clause does not match".
+            db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS decisions_source_title_unique ON decisions(source_url, title)`);
+            // Same story for edges: insertLink's `OR IGNORE` was decorative without a unique index, so
+            // a re-import stacked an identical relates row every time. Collapse, then constrain.
+            //
+            // This one IS table-wide, unavoidably: the index cannot be created while any duplicate
+            // triple remains anywhere. Every row it removes duplicates another by definition - same
+            // source, same target, same relation. It keeps the HIGHEST confidence rather than the
+            // lowest uuid, so the survivor is the best score rather than an arbitrary one.
+            db.exec(`
+        DELETE FROM decision_links WHERE id NOT IN (
+          SELECT id FROM (
+            SELECT id, ROW_NUMBER() OVER (
+              PARTITION BY source_id, target_id, relation ORDER BY confidence DESC, rowid
+            ) AS rn FROM decision_links
+          ) WHERE rn = 1
+        );
+      `);
+            db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS decision_links_triple_unique ON decision_links(source_id, target_id, relation)`);
+            // Stamped INSIDE the transaction. Outside it, a process killed between COMMIT and the
+            // pragma replays the version-1 relabel on the next open, which turns an adjudicated
+            // conflicts_with edge into relates - the exact silent loss the docstring above warns of.
+            //
+            // Stamps this step's OWN number (2), not SCHEMA_VERSION: a later step (3, below) runs
+            // after this one commits, and if a crash lands between the two, `user_version` must
+            // still read 2 so the version-3 step is not skipped on the next open.
+            db.exec('PRAGMA user_version = 2');
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            // Guarded: SQLITE_FULL, IOERR, BUSY, NOMEM and INTERRUPT auto-roll-back, and an
+            // unconditional ROLLBACK then throws "no transaction is active" and buries the real
+            // cause - so a user whose disk filled mid-migration would be told the wrong thing.
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 3) {
+        // The column may already exist: a brand-new database's CREATE TABLE (SCHEMA, above)
+        // declares `repo` directly, so on a fresh install this ALTER would fail with "duplicate
+        // column name" if run unconditionally. A legacy database predates the column entirely.
+        const hasRepoColumn = db.prepare('PRAGMA table_info(decisions)').all()
+            .some((c) => c.name === 'repo');
+        if (!hasRepoColumn) {
+            db.exec('ALTER TABLE decisions ADD COLUMN repo TEXT');
+        }
+        // Backfill every row with no repo yet. JS-side because SQLite has no regex function to
+        // apply `repoFromSourceUrl`'s pattern in SQL - and it must be the SAME function the
+        // importer stamps new rows with, or a backfilled row and a freshly-imported one for the
+        // same URL could disagree about which repo they belong to.
+        const rows = db.prepare('SELECT id, source_url FROM decisions WHERE repo IS NULL')
+            .all();
+        if (rows.length) {
+            db.exec('BEGIN IMMEDIATE');
+            try {
+                const update = db.prepare('UPDATE decisions SET repo = ? WHERE id = ?');
+                for (const row of rows) {
+                    const repo = repoFromSourceUrl(row.source_url);
+                    // Only WRITE when a repo was found: leaving a non-code row NULL is the correct
+                    // outcome (unattributed, not "wrong"), and writing NULL over NULL is a no-op
+                    // this loop can just skip.
+                    if (repo)
+                        update.run(repo, row.id);
+                }
+                db.exec('PRAGMA user_version = 3');
+                db.exec('COMMIT');
+            }
+            catch (err) {
+                if (db.isTransaction)
+                    db.exec('ROLLBACK');
+                throw err;
+            }
+        }
+        else {
+            db.exec('PRAGMA user_version = 3');
+        }
+    }
+    if (version < 4) {
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            // Same shape as the `repo` step: a fresh database's CREATE TABLE already declares the
+            // column, and a legacy one predates it, so the ALTER is conditional. Checked INSIDE
+            // the write lock, unlike step 3: two processes opening a v3 file at once (the
+            // advisory hook is the normal concurrent case) could otherwise both read "no column"
+            // and the second would die on "duplicate column name". SQLite DDL is transactional.
+            const hasDecidedAt = db.prepare('PRAGMA table_info(decisions)').all()
+                .some((c) => c.name === 'decided_at');
+            if (!hasDecidedAt) {
+                db.exec('ALTER TABLE decisions ADD COLUMN decided_at TEXT');
+            }
+            const tombstones = db.prepare(`SELECT id FROM decisions WHERE platform = 'slack' AND title = ?`).all(SLACK_TOMBSTONE_TITLE);
+            for (const { id } of tombstones)
+                deleteDecisionWithDependents(db, id);
+            // Stamped inside the transaction, for the reason step 2 gives.
+            db.exec('PRAGMA user_version = 4');
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 5) {
+        // Inside the write lock, for the reason step 4 gives: two concurrent opens of a v4
+        // file must not both read "no column" and race the ALTER.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const existing = new Set(db.prepare('PRAGMA table_info(decisions)').all().map((c) => c.name));
+            for (const column of PROVENANCE_COLUMNS) {
+                if (!existing.has(column))
+                    db.exec(`ALTER TABLE decisions ADD COLUMN ${column} TEXT`);
+            }
+            db.exec('PRAGMA user_version = 5');
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 6) {
+        // Inside the write lock, for the reason step 4/5 give: two concurrent opens of a v5
+        // file must not both read "no column" and race the ALTER.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const hasModel = db.prepare('PRAGMA table_info(decision_embeddings)').all()
+                .some((c) => c.name === 'model');
+            if (!hasModel) {
+                db.exec('ALTER TABLE decision_embeddings ADD COLUMN model TEXT');
+            }
+            // Every row that predates the column was written by LEGACY_EMBEDDING_MODEL - see its
+            // doc comment for how that is verified rather than assumed. Only rows with no tag yet
+            // are touched, so re-running this on an already-migrated database is a no-op.
+            db.prepare('UPDATE decision_embeddings SET model = ? WHERE model IS NULL').run(LEGACY_EMBEDDING_MODEL);
+            db.exec('PRAGMA user_version = 6');
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 7) {
+        // L2: sync state, source_key with the twin merge, enriched_at, local_judgements. One
+        // transaction, IMMEDIATE and stamped inside, for the reasons steps 2 and 4 give. The step
+        // itself, and why each part is shaped as it is, lives in local-db-v7.ts.
+        //
+        // `version` was read BEFORE this lock: a second opener of a v6 file waits here (busy_timeout)
+        // while the first migrates, and must then find the work done. Re-read it inside the lock.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const current = db.prepare('PRAGMA user_version').get().user_version;
+            if (current < 7) {
+                migrateV7(db);
+                db.exec('PRAGMA user_version = 7');
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 8) {
+        // L5 review: sync cycle state, last_attempt_at, sync_item_state and the purge backups.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const current = db.prepare('PRAGMA user_version').get().user_version;
+            if (current < 8) {
+                migrateV8(db);
+                db.exec('PRAGMA user_version = 8');
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 9) {
+        // L5 second review: hole_sig and hole_streak on source_sync.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const current = db.prepare('PRAGMA user_version').get().user_version;
+            if (current < 9) {
+                migrateV9(db);
+                db.exec('PRAGMA user_version = 9');
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 10) {
+        // L9: the promotions ledger, and the old `align push` audit rows carried across as legacy rows.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const current = db.prepare('PRAGMA user_version').get().user_version;
+            if (current < 10) {
+                migrateV10(db);
+                db.exec('PRAGMA user_version = 10');
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < 11) {
+        // ALI-1527: re-key zoom rows after connector-core changed the zoom source key. See local-db-v11.ts.
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const current = db.prepare('PRAGMA user_version').get().user_version;
+            if (current < 11) {
+                migrateV11(db);
+                db.exec('PRAGMA user_version = 11');
+            }
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    // A graph an earlier build of this branch stamped v10 (see repairPromotions): runs on every open.
+    repairPromotions(db);
+    // ADDITIVE steps (review F7): a change an older CLI can live with does not bump user_version,
+    // because every older CLI refuses a graph whose user_version is above what it knows. A column
+    // with a DEFAULT an older CLI's INSERTs fill correctly is additive; anything an older CLI would
+    // write wrongly, or misread, is not, and still takes a numbered step and the refusal.
+    if (!hasDetectorVersion(db)) {
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            migrateV12(db); // re-checks the column inside the lock
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            if (db.isTransaction)
+                db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    if (version < SCHEMA_VERSION) {
+        db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+    }
+}
+//# sourceMappingURL=local-db-migrate.js.map

package/dist/lib/local-db-migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-db-migrate.js","sourceRoot":"","sources":["../../src/lib/local-db-migrate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,CAAC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CrB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE;;0FAE0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,CAAU,CAAC;AAEnH;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAAgB,EAAE,EAAU;IACvE,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtE,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,EAAiB;IACtE,sGAAsG;IACtG,IAAI,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,EAAE,CAAC;QAAE,OAAO;IACzE,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8DAA8D,OAAO,8BAA8B,cAAc,KAAK;YACtH,8EAA8E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,EAAgB;IACvC,IAAK,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,KAAK,EAAE;QAAE,OAAO;IACtG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;QACnG,IAAI,OAAO,KAAK,EAAE,IAAI,kBAAkB,CAAC,EAAE,CAAC;YAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,EAAE,CAAC,aAAa;YAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,EAAgB;IACtC,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;IACnG,2FAA2F;IAC3F,4FAA4F;IAC5F,mCAAmC;IACnC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,4FAA4F;QAC5F,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,uFAAuF;YACvF,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,EAAE;YACF,oFAAoF;YACpF,oFAAoF;YACpF,0FAA0F;YAC1F,0FAA0F;YAC1F,oCAAoC;YACpC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;OAaP,CAAC,CAAC;YACH,0FAA0F;YAC1F,oFAAoF;YACpF,EAAE,CAAC,IAAI,CAAC;;;;;;;OAOP,CAAC,CAAC;YACH,wFAAwF;YACxF,2FAA2F;YAC3F,wFAAwF;YACxF,EAAE,CAAC,IAAI,CAAC;;;;;OAKP,CAAC,CAAC;YACH,kFAAkF;YAClF,6EAA6E;YAC7E,IAAK,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,GAAG,CAAC;gBAAE,eAAe,CAAC,EAAE,CAAC,CAAC;YAC9G,EAAE,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;YAC/F,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAC5E,EAAE,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAChE,yFAAyF;YACzF,uFAAuF;YACvF,+EAA+E;YAC/E,EAAE;YACF,uFAAuF;YACvF,qFAAqF;YACrF,+EAA+E;YAC/E,EAAE,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;YAC3G,2FAA2F;YAC3F,qFAAqF;YACrF,EAAE;YACF,uFAAuF;YACvF,wFAAwF;YACxF,sFAAsF;YACtF,+EAA+E;YAC/E,EAAE,CAAC,IAAI,CAAC;;;;;;;;OAQP,CAAC,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,kHAAkH,CAAC,CAAC;YAC5H,sFAAsF;YACtF,oFAAoF;YACpF,yFAAyF;YACzF,EAAE;YACF,sFAAsF;YACtF,oFAAoF;YACpF,sEAAsE;YACtE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gFAAgF;YAChF,oFAAoF;YACpF,mFAAmF;YACnF,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,oFAAoF;QACpF,wFAAwF;QACxF,uFAAuF;QACvF,MAAM,aAAa,GAAI,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA8B;aAChG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACxD,CAAC;QACD,uFAAuF;QACvF,oFAAoF;QACpF,wFAAwF;QACxF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC;aAC/E,GAAG,EAAsD,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;gBACxE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC/C,+EAA+E;oBAC/E,6EAA6E;oBAC7E,2BAA2B;oBAC3B,IAAI,IAAI;wBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrC,CAAC;gBACD,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBACnC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,EAAE,CAAC,aAAa;oBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,sFAAsF;YACtF,oFAAoF;YACpF,8EAA8E;YAC9E,qFAAqF;YACrF,oFAAoF;YACpF,MAAM,YAAY,GAAI,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA8B;iBAC/F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;YACxC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,EAAE,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,iEAAiE,CAClE,CAAC,GAAG,CAAC,qBAAqB,CAA0B,CAAC;YACtD,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,UAAU;gBAAE,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,+DAA+D;YAC/D,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,mFAAmF;QACnF,0DAA0D;QAC1D,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CACrB,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACjG,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,EAAE,CAAC,IAAI,CAAC,oCAAoC,MAAM,OAAO,CAAC,CAAC;YACxF,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,oFAAoF;QACpF,0DAA0D;QAC1D,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAI,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAA8B;iBACrG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,EAAE,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YACnE,CAAC;YACD,qFAAqF;YACrF,sFAAsF;YACtF,8EAA8E;YAC9E,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvG,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,qFAAqF;QACrF,0FAA0F;QAC1F,yEAAyE;QACzE,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;YACnG,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACrC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,uFAAuF;QACvF,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;YACnG,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACrC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,6DAA6D;QAC7D,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;YACnG,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACrC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;QACjB,gGAAgG;QAChG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;YACnG,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;gBACjB,UAAU,CAAC,EAAE,CAAC,CAAC;gBACf,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACtC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;QACjB,oGAAoG;QACpG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA+B,CAAC,YAAY,CAAC;YACnG,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;gBACjB,UAAU,CAAC,EAAE,CAAC,CAAC;gBACf,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACtC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrB,8FAA8F;IAC9F,8FAA8F;IAC9F,gGAAgG;IAChG,sFAAsF;IACtF,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,uCAAuC;YACvD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,aAAa;gBAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;QAC7B,EAAE,CAAC,IAAI,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/lib/local-db-v10.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Schema v10 (L9): the promotions ledger - what this machine has shared to which team workspace.
+ *
+ * One row per (local decision, environment, workspace). It holds the remote id (to retract), the
+ * hash of the payload that was sent (to say "already shared" and to notice an edit), and whether
+ * the share MATCHED a decision the team already held (`matched`: a retract must never archive
+ * somebody else's decision).
+ *
+ * There is deliberately NO foreign key to `decisions`: `align local forget` must not erase the only
+ * record that lets a person retract a copy that is on the team graph.
+ *
+ * Old `align push` rows (audit action 'pushed', detail `<env>:<cloudId>`) become 'legacy' rows: they
+ * carry no workspace, so a second share of the same decision warns that it may create a second copy
+ * instead of pretending the first never happened. Replay-safe: CREATE IF NOT EXISTS, INSERT OR IGNORE.
+ */
+import type { DatabaseSync } from 'node:sqlite';
+export declare const PROMOTIONS_TABLE = "\nCREATE TABLE IF NOT EXISTS promotions (\n  local_id     TEXT NOT NULL,\n  env          TEXT NOT NULL,\n  tenant_id    TEXT NOT NULL,\n  remote_id    TEXT NOT NULL,\n  content_hash TEXT NOT NULL,\n  matched      INTEGER NOT NULL DEFAULT 0,\n  client_key   TEXT NOT NULL DEFAULT '',\n  sent         TEXT NOT NULL DEFAULT '[]',\n  confirm_pending INTEGER NOT NULL DEFAULT 0,\n  shared_at    TEXT NOT NULL DEFAULT (datetime('now')),\n  retracted_at TEXT,\n  PRIMARY KEY (local_id, env, tenant_id)\n);\n";
+export declare function migrateV10(db: DatabaseSync): void;
+/**
+ * A graph an EARLIER build of this branch already stamped v10 has `promotions` without the columns v10 grew
+ * (`client_key`, `sent`, `confirm_pending`), and the `version < 10` step will never run for it. This repair
+ * runs on every open: guarded by table_info, so it is idempotent and a no-op on a current graph. Existing
+ * rows keep their values (the defaults say "no key yet, nothing recorded as sent, nothing pending").
+ */
+export declare function repairPromotions(db: DatabaseSync): void;
+/** The columns the ledger code reads and writes, in one place so the share can refuse BEFORE any request. */
+export declare const LEDGER_COLUMNS: readonly ["local_id", "env", "tenant_id", "remote_id", "content_hash", "matched", "client_key", "sent", "confirm_pending", "shared_at", "retracted_at"];
+//# sourceMappingURL=local-db-v10.d.ts.map

package/dist/lib/local-db-v10.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-db-v10.d.ts","sourceRoot":"","sources":["../../src/lib/local-db-v10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,eAAO,MAAM,gBAAgB,yfAe5B,CAAC;AAEF,wBAAgB,UAAU,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAWjD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAMvD;AAED,6GAA6G;AAC7G,eAAO,MAAM,cAAc,yJAA0J,CAAC"}

package/dist/lib/local-db-v10.js

@@ -0,0 +1,49 @@
+export const PROMOTIONS_TABLE = `
+CREATE TABLE IF NOT EXISTS promotions (
+  local_id     TEXT NOT NULL,
+  env          TEXT NOT NULL,
+  tenant_id    TEXT NOT NULL,
+  remote_id    TEXT NOT NULL,
+  content_hash TEXT NOT NULL,
+  matched      INTEGER NOT NULL DEFAULT 0,
+  client_key   TEXT NOT NULL DEFAULT '',
+  sent         TEXT NOT NULL DEFAULT '[]',
+  confirm_pending INTEGER NOT NULL DEFAULT 0,
+  shared_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  retracted_at TEXT,
+  PRIMARY KEY (local_id, env, tenant_id)
+);
+`;
+export function migrateV10(db) {
+    db.exec(PROMOTIONS_TABLE);
+    const pushes = db.prepare(`SELECT decision_id, detail FROM decision_audit WHERE action = 'pushed' AND detail IS NOT NULL ORDER BY created_at, rowid`).all();
+    const insert = db.prepare(`INSERT OR IGNORE INTO promotions (local_id, env, tenant_id, remote_id, content_hash) VALUES (?, ?, 'legacy', ?, '')`);
+    for (const p of pushes) {
+        const cut = p.detail.indexOf(':');
+        const env = cut > 0 ? p.detail.slice(0, cut) : '';
+        const remote = cut > 0 ? p.detail.slice(cut + 1) : '';
+        if (env === '' || remote === '')
+            continue; // no cloud id recorded: nothing a retract could name
+        insert.run(p.decision_id, env, remote);
+    }
+}
+/**
+ * A graph an EARLIER build of this branch already stamped v10 has `promotions` without the columns v10 grew
+ * (`client_key`, `sent`, `confirm_pending`), and the `version < 10` step will never run for it. This repair
+ * runs on every open: guarded by table_info, so it is idempotent and a no-op on a current graph. Existing
+ * rows keep their values (the defaults say "no key yet, nothing recorded as sent, nothing pending").
+ */
+export function repairPromotions(db) {
+    const cols = new Set(db.prepare('PRAGMA table_info(promotions)').all().map((c) => c.name));
+    if (cols.size === 0)
+        return; // pre-v10: the step itself creates it
+    if (!cols.has('client_key'))
+        db.exec("ALTER TABLE promotions ADD COLUMN client_key TEXT NOT NULL DEFAULT ''");
+    if (!cols.has('sent'))
+        db.exec("ALTER TABLE promotions ADD COLUMN sent TEXT NOT NULL DEFAULT '[]'");
+    if (!cols.has('confirm_pending'))
+        db.exec('ALTER TABLE promotions ADD COLUMN confirm_pending INTEGER NOT NULL DEFAULT 0');
+}
+/** The columns the ledger code reads and writes, in one place so the share can refuse BEFORE any request. */
+export const LEDGER_COLUMNS = ['local_id', 'env', 'tenant_id', 'remote_id', 'content_hash', 'matched', 'client_key', 'sent', 'confirm_pending', 'shared_at', 'retracted_at'];
+//# sourceMappingURL=local-db-v10.js.map

package/dist/lib/local-db-v10.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-db-v10.js","sourceRoot":"","sources":["../../src/lib/local-db-v10.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;CAe/B,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,EAAgB;IACzC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,0HAA0H,CAAC,CAAC,GAAG,EAAoD,CAAC;IAC9M,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,qHAAqH,CAAC,CAAC;IACjJ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE;YAAE,SAAS,CAAC,qDAAqD;QAChG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAgB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAE,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,sCAAsC;IACnE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,EAAE,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IAC9G,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,EAAE,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACpG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,EAAE,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;AAC5H,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,CAAU,CAAC"}