@fabiofiorita/porcelain 0.63.4 → 0.65.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabio Fiorita
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,46 +1,52 @@
-# @fabiofiorita/porcelain (0.63.4)
+# @fabiofiorita/porcelain (0.65.0)
 
-The Electron-free Porcelain daemon and browser client, packaged for plain Node. Run it on the
-machine that owns the repositories and terminals you want to review.
+The Porcelain review server and bundled web app for a plain Node installation.
 
-## Start and pair
+## Quick start
 
-The host needs Node 22+, Git, and a C toolchain for the first `node-pty` build:
+The host needs Node 24+, Git, and the file watcher supported on its platform:
 
 ```sh
 npx @fabiofiorita/porcelain@latest serve
-npx @fabiofiorita/porcelain@latest access issue --name "My device"
-```
 
-Porcelain always binds loopback and never `0.0.0.0`. Add `--lan`, `--tailnet`, or
-`--cloudflare` only for the route you intend to expose. Every client uses its own one-time pairing
-link; the host administrator token is never shared. Manage paired devices on the host:
+# Permit other devices on the local network to connect:
+npx @fabiofiorita/porcelain@latest serve --lan
 
-```sh
-npx @fabiofiorita/porcelain@latest access list
-npx @fabiofiorita/porcelain@latest access revoke <id>
-npx @fabiofiorita/porcelain@latest share status
+# Install this exact CLI version as a user service:
+npx @fabiofiorita/porcelain@latest service install --lan
 ```
 
-For exposure flags, browser origins, systemd, updates, and troubleshooting, use the current
-[remote-access guide](https://github.com/FabioFiorita/porcelain/blob/main/docs/remote-access.md) and
-`porcelain --help` rather than copying a service file from an older package version.
+State lives in `~/.porcelain/`; pass `--data-directory` to keep it somewhere
+else. Use `porcelain serve --help` for all options.
 
-## Agent connection
+Nothing can reach the server until you pair a device. On the machine running
+it, `porcelain pair "Phone" --address <the address serve printed>` prints a
+link that works once; open it on the device itself. The address must be one
+this server answers at, and the not-paired screen in the browser shows the
+whole command with that device's own origin already filled in. `porcelain devices` lists what is paired and
+`porcelain revoke <id>` ends it. Coding agents connect over MCP with
+`porcelain mcp`, which needs no credential: it reaches a local socket only a
+process on this machine can open.
 
-Install the Porcelain plugin through the agent's plugin manager. Its bundled stdio connector
-forwards MCP to the matching daemon's profile-scoped local OS socket; it is not exposed through the
-daemon's LAN, Tailscale, Cloudflare, or renderer HTTP routes. Claude Code can install it with:
+## Background service
 
-```text
-/plugin marketplace add FabioFiorita/porcelain
-/plugin install porcelain@porcelain
-```
+`porcelain service install|status|update|uninstall` manages a systemd user
+service on Linux. Install and update persist the
+invoked package version outside the npx cache. Updates stop the service and
+back up SQLite before the new runtime can migrate it. An older CLI refuses to
+replace a newer runtime unless `service update --allow-downgrade` is explicit.
+Uninstall removes the service and runtime while retaining data, configuration,
+logs and database backups. Run service commands as the regular user, never
+with sudo.
 
-## Repository packaging
+## Repository development
 
 ```sh
-pnpm build && pnpm daemon:dist
+pnpm build:package
+
+# Inspect the exact publishable archive:
+cd dist-porcelain && npm pack
 ```
 
-`dist-daemon/` is generated from the completed product build; do not edit it by hand.
+`dist-porcelain/` is generated from a completed web and server build. Do not
+edit it by hand.

package/bin/porcelain.js

@@ -1,405 +1,2 @@
 #!/usr/bin/env node
-// Narrow host launcher for the published @fabiofiorita/porcelain package.
-// Copied into dist-daemon/bin/ by scripts/build-daemon-dist.mjs — not run from
-// the monorepo root (paths resolve relative to the installed package layout).
-//
-// Goal: t3-style one-liner on a remote box —
-//   npx @fabiofiorita/porcelain@latest serve --tailnet
-// instead of scp'ing a dist tarball and wiring systemd.
-
-const { randomBytes } = require('node:crypto')
-const {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  writeFileSync,
-} = require('node:fs')
-const { homedir } = require('node:os')
-const { dirname, join } = require('node:path')
-const { createTRPCUntypedClient, httpLink } = require('@trpc/client')
-
-const DEFAULT_PORT = 43117
-const DEFAULT_USER_DATA = join(homedir(), '.local', 'share', 'porcelain')
-// PORCELAIN_HOME redirects token + channels (dev stack uses ~/.porcelain-dev).
-const porcelainHome = () => process.env.PORCELAIN_HOME ?? join(homedir(), '.porcelain')
-const ADMIN_TOKEN_PATH = () =>
-  process.env.PORCELAIN_ADMIN_TOKEN_FILE ?? join(porcelainHome(), 'admin-token')
-
-const HELP = `porcelain — headless Porcelain backend (plain Node, no Electron)
-
-Usage:
-  porcelain serve [options]
-  porcelain [options]              (same as serve)
-  porcelain access issue --name <device> [--base-url <url>]
-  porcelain access list
-  porcelain access revoke <id>
-  porcelain share status
-
-Options:
-  --port <n>           Listen port for loopback AND LAN/tailnet (default ${DEFAULT_PORT})
-  --user-data <path>   Config dir (default ${DEFAULT_USER_DATA})
-  --lan                Also bind RFC1918 LAN addresses (same --port)
-  --tailnet            Also bind the Tailscale interface (same --port)
-  --cloudflare         Publish loopback over Cloudflare (named tunnel if
-                       PORCELAIN_CLOUDFLARE_TOKEN is set, else a quick tunnel)
-  --cloudflare-hostname <host>
-                       Public https hostname of a named tunnel
-  --allowed-origin <origin>
-                       Trust a browser Hub origin for cross-origin API/WS (repeatable)
-  --no-watchdog        Disable stdin parent-death watchdog (required under systemd)
-  -h, --help           Show this help
-
-Host-management options:
-  --daemon-url <url>   Loopback daemon URL when not using the default port
-  --base-url <url>     Reachable URL to embed in a new connection link
-
-Examples:
-  npx @fabiofiorita/porcelain@latest serve --lan
-  npx @fabiofiorita/porcelain@latest serve --lan --tailnet
-  npx @fabiofiorita/porcelain@latest serve --lan --cloudflare --cloudflare-hostname review.example.com
-  npx @fabiofiorita/porcelain@latest access issue --name "My phone"
-  npx @fabiofiorita/porcelain@latest serve --port 43118 --lan
-
-Env (same as the raw daemon; flags set these when passed):
-  PORCELAIN_USER_DATA, PORCELAIN_DAEMON_PORT, PORCELAIN_ADMIN_TOKEN,
-  PORCELAIN_ALLOWED_ORIGIN (comma-separated), PORCELAIN_ALLOWED_ORIGINS (comma-separated),
-  PORCELAIN_TAILNET_BIND, PORCELAIN_LAN_BIND, PORCELAIN_CLOUDFLARE_BIND,
-  PORCELAIN_CLOUDFLARE_HOSTNAME, PORCELAIN_CLOUDFLARE_TOKEN,
-  PORCELAIN_NO_STDIN_WATCHDOG
-
-Notes:
-  • Always binds 127.0.0.1; --tailnet / --lan add private interfaces only
-    (never 0.0.0.0). Cloudflare uses a separate loopback ingress without MCP.
-  • Named tunnels: set PORCELAIN_CLOUDFLARE_TOKEN (never a flag) and
-    --cloudflare-hostname. Without a token, --cloudflare is a quick tunnel
-    whose URL changes every start.
-  • --tailnet and --cloudflare are mutually exclusive. LAN can combine with either.
-  • Host administration lives at ~/.porcelain/admin-token (0600) and is never shared.
-  • Pairing links are one-time credentials; clients receive individually revocable access.
-  • Use @latest so each invoke can pick up a newer published package.
-  • First install compiles node-pty for this host (needs a C toolchain).
-`
-
-function fail(message) {
-  console.error(`[porcelain] ${message}`)
-  process.exit(1)
-}
-
-/**
- * Minimal argv parse — no deps in the published package beyond the daemon's.
- * Unknown flags / missing values exit non-zero with a short message.
- */
-function parseArgs(argv) {
-  const opts = {
-    command: 'serve',
-    port: DEFAULT_PORT,
-    userData: DEFAULT_USER_DATA,
-    tailnet: false,
-    lan: false,
-    cloudflare: false,
-    cloudflareHostname: null,
-    noWatchdog: false,
-    allowedOrigins: [],
-    help: false,
-  }
-
-  let i = 0
-  // Bare invocation and explicit `serve` both mean serve (t3-compatible).
-  if (argv[0] === 'serve') {
-    i = 1
-  } else if (argv[0] === 'help' || argv[0] === '--help' || argv[0] === '-h') {
-    opts.help = true
-    return opts
-  }
-
-  while (i < argv.length) {
-    const arg = argv[i]
-    if (arg === '-h' || arg === '--help') {
-      opts.help = true
-      i += 1
-      continue
-    }
-    if (arg === '--tailnet') {
-      opts.tailnet = true
-      i += 1
-      continue
-    }
-    if (arg === '--lan') {
-      opts.lan = true
-      i += 1
-      continue
-    }
-    if (arg === '--cloudflare') {
-      opts.cloudflare = true
-      i += 1
-      continue
-    }
-    if (arg === '--cloudflare-hostname') {
-      const raw = argv[i + 1]
-      if (raw === undefined) fail('--cloudflare-hostname requires a hostname')
-      opts.cloudflareHostname = raw
-      opts.cloudflare = true
-      i += 2
-      continue
-    }
-    if (arg === '--funnel') {
-      fail('Tailscale Funnel was removed. Use --cloudflare for public HTTPS.')
-    }
-    if (arg === '--no-watchdog') {
-      opts.noWatchdog = true
-      i += 1
-      continue
-    }
-    if (arg === '--allowed-origin' || arg === '--allowed-origins') {
-      const raw = argv[i + 1]
-      if (raw === undefined) fail(`${arg} requires a value`)
-      opts.allowedOrigins.push(raw)
-      i += 2
-      continue
-    }
-    if (arg === '--port') {
-      const raw = argv[i + 1]
-      if (raw === undefined) fail('--port requires a value')
-      const port = Number(raw)
-      if (!Number.isInteger(port) || port < 1 || port > 65535) {
-        fail(`--port must be an integer 1–65535 (got ${raw})`)
-      }
-      opts.port = port
-      i += 2
-      continue
-    }
-    if (arg === '--user-data') {
-      const raw = argv[i + 1]
-      if (raw === undefined) fail('--user-data requires a path')
-      opts.userData = raw
-      i += 2
-      continue
-    }
-    fail(`unknown argument: ${arg}\n\n${HELP}`)
-  }
-
-  return opts
-}
-
-/** Same semantics as apps/daemon/src/net/admin-token.ts (plain CJS copy). */
-function ensureAdminToken(path = ADMIN_TOKEN_PATH()) {
-  try {
-    const existing = readFileSync(path, 'utf8').trim()
-    if (existing !== '') {
-      chmodSync(path, 0o600)
-      return existing
-    }
-  } catch {
-    // absent — mint
-  }
-  const token = randomBytes(32).toString('hex')
-  mkdirSync(dirname(path), { recursive: true })
-  const tmp = `${path}.tmp`
-  writeFileSync(tmp, token, { encoding: 'utf8', mode: 0o600 })
-  renameSync(tmp, path)
-  return token
-}
-
-// The built contracts module (scripts/build-node.mjs), in the two layouts this script
-// ships in: the installed package (bin/ beside main/) and the monorepo checkout (scripts/
-// beside apps/desktop/out/main/). Same relative-resolution mechanism the serve path already
-// uses for main/daemon/server.js.
-const PROTOCOL_MODULES = [
-  join(__dirname, '..', 'main', 'contracts', 'protocol.js'),
-  join(__dirname, '..', 'apps', 'desktop', 'out', 'main', 'contracts', 'protocol.js'),
-]
-
-/**
- * The daemon refuses any request that does not announce its exact wire protocol, so this
- * CLI announces it too — read from the built contracts, never a literal copied here, which
- * would silently become a lie the day the protocol moves.
- */
-function protocolHeaders() {
-  const modulePath = PROTOCOL_MODULES.find((candidate) => existsSync(candidate))
-  if (modulePath === undefined) {
-    fail('protocol contracts missing — run `pnpm build` in the monorepo, or reinstall the package')
-  }
-  const { PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER } = require(modulePath)
-  return { [PROTOCOL_VERSION_HEADER]: String(PROTOCOL_VERSION) }
-}
-
-function adminClient(daemonUrl, token) {
-  return createTRPCUntypedClient({
-    links: [
-      httpLink({
-        url: `${daemonUrl}/trpc`,
-        headers: { authorization: `Bearer ${token}`, ...protocolHeaders() },
-      }),
-    ],
-  })
-}
-
-function adminCommandOptions(argv) {
-  const result = {
-    args: [],
-    daemonUrl: `http://127.0.0.1:${process.env.PORCELAIN_DAEMON_PORT || DEFAULT_PORT}`,
-    baseUrl: null,
-    name: null,
-  }
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i]
-    if (arg === '--daemon-url' || arg === '--base-url' || arg === '--name') {
-      const value = argv[i + 1]
-      if (!value) fail(`${arg} requires a value`)
-      if (arg === '--daemon-url') result.daemonUrl = value.replace(/\/+$/, '')
-      else if (arg === '--base-url') result.baseUrl = value
-      else result.name = value
-      i += 1
-    } else {
-      result.args.push(arg)
-    }
-  }
-  return result
-}
-
-async function suggestedBaseUrl(client) {
-  const lan = await client.query('lanStatus').catch(() => null)
-  if (lan?.numericUrl || lan?.url) return lan.numericUrl || lan.url
-  const tailnet = await client.query('tailnetStatus').catch(() => null)
-  if (tailnet?.url) return tailnet.url
-  const cloudflare = await client.query('cloudflareStatus').catch(() => null)
-  return cloudflare?.url || null
-}
-
-async function runAccessCommand(argv) {
-  const options = adminCommandOptions(argv)
-  const [action, id] = options.args
-  const client = adminClient(options.daemonUrl, ensureAdminToken())
-  if (action === 'issue') {
-    if (!options.name) fail('access issue requires --name <device>')
-    const baseUrl = options.baseUrl || (await suggestedBaseUrl(client))
-    if (!baseUrl) fail('no reachable endpoint is enabled; pass --base-url explicitly')
-    const result = await client.mutation('issuePairingLink', {
-      label: options.name,
-      baseUrl,
-    })
-    process.stdout.write(`${result.url}\n`)
-    return
-  }
-  if (action === 'list') {
-    const status = await client.query('accessStatus')
-    process.stdout.write(`${JSON.stringify(status, null, 2)}\n`)
-    return
-  }
-  if (action === 'revoke' && id) {
-    const status = await client.query('accessStatus')
-    if (status.clients.some((entry) => entry.id === id)) {
-      await client.mutation('revokeAuthorizedClient', id)
-    } else if (status.pairings.some((entry) => entry.id === id)) {
-      await client.mutation('revokePairingLink', id)
-    } else {
-      fail(`no device or pairing link has id ${id}`)
-    }
-    process.stdout.write(`Revoked ${id}\n`)
-    return
-  }
-  fail('usage: porcelain access issue --name <device> | list | revoke <id>')
-}
-
-async function runShareCommand(argv) {
-  const options = adminCommandOptions(argv)
-  const [target] = options.args
-  const client = adminClient(options.daemonUrl, ensureAdminToken())
-  if (target === 'status') {
-    const [lan, tailnet, cloudflare] = await Promise.all([
-      client.query('lanStatus'),
-      client.query('tailnetStatus'),
-      client.query('cloudflareStatus'),
-    ])
-    process.stdout.write(`${JSON.stringify({ lan, tailnet, cloudflare }, null, 2)}\n`)
-    return
-  }
-  fail('usage: porcelain share status')
-}
-
-async function main() {
-  const argv = process.argv.slice(2)
-  if (argv[0] === 'access') {
-    await runAccessCommand(argv.slice(1))
-    return
-  }
-  if (argv[0] === 'share') {
-    await runShareCommand(argv.slice(1))
-    return
-  }
-  const opts = parseArgs(argv)
-  if (opts.help) {
-    process.stdout.write(HELP)
-    process.exit(0)
-  }
-
-  // Prefer an already-set env (systemd unit, shell export) over flag defaults.
-  if (!process.env.PORCELAIN_USER_DATA) {
-    process.env.PORCELAIN_USER_DATA = opts.userData
-  }
-  if (!process.env.PORCELAIN_DAEMON_PORT) {
-    process.env.PORCELAIN_DAEMON_PORT = String(opts.port)
-  }
-  // Preserve an explicitly supplied service environment. A flag supplies the same
-  // comma-separated format as PORCELAIN_ALLOWED_ORIGIN and is repeated for several Hubs.
-  if (
-    opts.allowedOrigins.length > 0 &&
-    !process.env.PORCELAIN_ALLOWED_ORIGIN &&
-    !process.env.PORCELAIN_ALLOWED_ORIGINS
-  ) {
-    process.env.PORCELAIN_ALLOWED_ORIGIN = opts.allowedOrigins.join(',')
-  }
-  if (opts.tailnet && opts.cloudflare) {
-    fail('--tailnet and --cloudflare cannot be used together. Pick one off-network route.')
-  }
-  if (opts.tailnet) process.env.PORCELAIN_TAILNET_BIND = '1'
-  if (opts.lan) process.env.PORCELAIN_LAN_BIND = '1'
-  if (opts.cloudflare) process.env.PORCELAIN_CLOUDFLARE_BIND = '1'
-  if (opts.cloudflareHostname && !process.env.PORCELAIN_CLOUDFLARE_HOSTNAME) {
-    process.env.PORCELAIN_CLOUDFLARE_HOSTNAME = opts.cloudflareHostname
-  }
-  if (opts.noWatchdog) process.env.PORCELAIN_NO_STDIN_WATCHDOG = '1'
-
-  const token = process.env.PORCELAIN_ADMIN_TOKEN || ensureAdminToken()
-  process.env.PORCELAIN_ADMIN_TOKEN = token
-
-  const userData = process.env.PORCELAIN_USER_DATA
-  const port = process.env.PORCELAIN_DAEMON_PORT
-  const binds = ['127.0.0.1']
-  if (process.env.PORCELAIN_TAILNET_BIND === '1') binds.push('tailnet')
-  if (process.env.PORCELAIN_LAN_BIND === '1') binds.push('lan')
-  if (process.env.PORCELAIN_CLOUDFLARE_BIND === '1') binds.push('cloudflare')
-  const allowedOriginValue =
-    process.env.PORCELAIN_ALLOWED_ORIGINS || process.env.PORCELAIN_ALLOWED_ORIGIN || ''
-  const allowedOriginCount = allowedOriginValue
-    .split(',')
-    .map((origin) => origin.trim())
-    .filter(Boolean).length
-
-  // Human-facing status on stderr; the daemon still owns the one stdout port line.
-  console.error(`[porcelain] user data  ${userData}`)
-  console.error(`[porcelain] port       ${port}`)
-  console.error(`[porcelain] binds      ${binds.join(', ')}`)
-  console.error(
-    `[porcelain] cors       ${allowedOriginCount === 0 ? 'same-origin only' : `${allowedOriginCount} trusted Hub origin(s) configured`}`,
-  )
-  console.error(`[porcelain] admin file ${ADMIN_TOKEN_PATH()}`)
-  console.error('[porcelain] pair with: porcelain access issue --name <device>')
-  console.error('[porcelain] starting…  Ctrl+C to stop')
-
-  const serverEntry = [
-    join(__dirname, '..', 'main', 'daemon', 'server.js'),
-    // Monorepo fallback used by the composed proof; the published package uses
-    // the first layout above after `daemon:dist` assembles it.
-    join(__dirname, '..', 'apps', 'desktop', 'out', 'main', 'daemon', 'server.js'),
-  ].find((candidate) => existsSync(candidate))
-  if (serverEntry === undefined) {
-    fail('daemon entry missing — package is corrupt; reinstall')
-  }
-  // Side-effect entry: boots the HTTP/WS listeners (same as `node main/daemon/server.js`).
-  require(serverEntry)
-}
-
-main().catch((error) => fail(error instanceof Error ? error.message : String(error)))
+import '../server/src/cli/main.mjs';

package/package.json

@@ -1,42 +1,36 @@
 {
   "name": "@fabiofiorita/porcelain",
-  "version": "0.63.4",
-  "description": "Headless Porcelain daemon — plain Node backend for remote machines (npx @fabiofiorita/porcelain@latest serve)",
+  "version": "0.65.0",
+  "description": "Review coding agents’ changes from a browser, Mac or phone",
   "license": "MIT",
-  "author": "Fabio Fiorita <fabiolfp@gmail.com>",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/FabioFiorita/porcelain.git"
   },
   "homepage": "https://github.com/FabioFiorita/porcelain",
+  "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=24.20.0 <25"
   },
   "bin": {
     "porcelain": "bin/porcelain.js"
   },
   "files": [
     "bin",
-    "main",
-    "renderer",
-    "README.md"
+    "server",
+    "web",
+    "README.md",
+    "LICENSE"
   ],
   "dependencies": {
-    "@trpc/client": "^11.17.0",
-    "@trpc/server": "^11.17.0",
-    "node-pty": "^1.1.0",
-    "trash": "^10.1.1",
-    "ws": "^8.21.0",
-    "zod": "^4.4.3"
+    "@effect/platform-node": "4.0.1",
+    "@parcel/watcher": "2.6.0",
+    "effect": "4.0.1",
+    "qrcode-terminal": "0.12.0",
+    "trash": "10.1.1",
+    "ws": "8.21.3"
   },
   "publishConfig": {
     "access": "public"
-  },
-  "keywords": [
-    "porcelain",
-    "daemon",
-    "code-review",
-    "remote",
-    "tailscale"
-  ]
+  }
 }

package/server/drizzle/0000_current-schema.sql

@@ -0,0 +1,98 @@
+CREATE TABLE `artifacts` (
+	`id` text PRIMARY KEY NOT NULL,
+	`worktree_id` text NOT NULL,
+	`name` text NOT NULL,
+	`content` text NOT NULL,
+	`size_bytes` integer NOT NULL,
+	`created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `artifacts_worktree` ON `artifacts` (`worktree_id`);--> statement-breakpoint
+CREATE TABLE `comment_threads` (
+	`sequence` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`id` text NOT NULL,
+	`worktree_id` text NOT NULL,
+	`data` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `comment_threads_id_unique` ON `comment_threads` (`id`);--> statement-breakpoint
+CREATE TABLE `commit_review_layer_sets` (
+	`project_id` text NOT NULL,
+	`commit_oid` text NOT NULL,
+	`data` text NOT NULL,
+	PRIMARY KEY(`project_id`, `commit_oid`),
+	FOREIGN KEY (`project_id`) REFERENCES `inventory_projects`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE TABLE `environment` (
+	`singleton` integer PRIMARY KEY NOT NULL,
+	`id` text NOT NULL,
+	CONSTRAINT "environment_singleton" CHECK("environment"."singleton" = 1)
+);
+--> statement-breakpoint
+CREATE TABLE `project_file_preferences` (
+	`project_id` text NOT NULL,
+	`path` text NOT NULL,
+	`pinned` integer NOT NULL,
+	`hidden` integer NOT NULL,
+	PRIMARY KEY(`project_id`, `path`),
+	CONSTRAINT "project_preference_pinned" CHECK("project_file_preferences"."pinned" IN (0, 1)),
+	CONSTRAINT "project_preference_hidden" CHECK("project_file_preferences"."hidden" IN (0, 1))
+);
+--> statement-breakpoint
+CREATE TABLE `git_action_blocks` (
+	`project_id` text PRIMARY KEY NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `git_action_preparations` (
+	`id` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL,
+	`consumed` integer DEFAULT false NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `git_action_receipts` (
+	`request_id` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `project_worktrees` (
+	`worktree_id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	FOREIGN KEY (`project_id`) REFERENCES `inventory_projects`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `project_worktrees_project` ON `project_worktrees` (`project_id`);--> statement-breakpoint
+CREATE TABLE `inventory_projects` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`common_directory` text NOT NULL,
+	`repository_identity` text NOT NULL,
+	`available` integer NOT NULL,
+	`position` integer NOT NULL,
+	CONSTRAINT "project_id_present" CHECK("inventory_projects"."id" IS NOT NULL),
+	CONSTRAINT "project_available" CHECK("inventory_projects"."available" IN (0, 1))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `inventory_projects_repository_identity_unique` ON `inventory_projects` (`repository_identity`);--> statement-breakpoint
+CREATE TABLE `review_layer_sets` (
+	`worktree_id` text PRIMARY KEY NOT NULL,
+	`revision` integer NOT NULL,
+	`layers` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `worktrees` (
+	`id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	`path` text NOT NULL,
+	`metadata_identity` text,
+	`main` integer NOT NULL,
+	`branch` text,
+	`available` integer NOT NULL,
+	`position` integer NOT NULL,
+	FOREIGN KEY (`project_id`) REFERENCES `inventory_projects`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT "worktree_id_present" CHECK("worktrees"."id" IS NOT NULL),
+	CONSTRAINT "worktree_main" CHECK("worktrees"."main" IN (0, 1)),
+	CONSTRAINT "worktree_available" CHECK("worktrees"."available" IN (0, 1))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `worktree_order` ON `worktrees` (`project_id`,`position`);

package/server/drizzle/0001_light_iceman.sql

@@ -0,0 +1,9 @@
+CREATE TABLE `reviewed_files` (
+	`worktree_id` text NOT NULL,
+	`path` text NOT NULL,
+	`fingerprint` text NOT NULL,
+	`reviewed_at` text NOT NULL,
+	PRIMARY KEY(`worktree_id`, `path`)
+);
+--> statement-breakpoint
+CREATE INDEX `reviewed_files_worktree` ON `reviewed_files` (`worktree_id`);