@nurix/nustack 0.10.0-dev.10

package/dist/lib/local_store/filebeat_state.js

@@ -0,0 +1,133 @@
+import { withTransaction } from "./database.js";
+function mapFilebeat(row) {
+    return {
+        binaryPath: row.binary_path ?? null,
+        configDir: row.config_dir ?? null,
+        desiredVersion: row.desired_version ?? null,
+        observedVersion: row.observed_version ?? null,
+        desiredConfigHash: row.desired_config_hash ?? null,
+        observedConfigHash: row.observed_config_hash ?? null,
+        processState: row.process_state ?? null,
+        telemetryEnabled: (row.telemetry_enabled ?? 1) !== 0,
+        lastErrorCode: row.last_error_code ?? null,
+        lastHealthAtMs: row.last_health_at_ms ?? null,
+        createdAtMs: row.created_at_ms,
+        updatedAtMs: row.updated_at_ms,
+    };
+}
+export function readFilebeatState(store) {
+    const row = store.db.prepare("SELECT * FROM local_filebeat_state WHERE id = 1").get();
+    return row ? mapFilebeat(row) : null;
+}
+export function upsertFilebeatState(store, patch) {
+    return withTransaction(store, () => {
+        const now = Date.now();
+        const current = readFilebeatState(store);
+        const pick = (key, fallback) => Object.prototype.hasOwnProperty.call(patch, key) ? (patch[key] ?? null) : fallback;
+        const telemetryEnabled = Object.prototype.hasOwnProperty.call(patch, "telemetryEnabled")
+            ? patch.telemetryEnabled
+                ? 1
+                : 0
+            : current?.telemetryEnabled === false
+                ? 0
+                : 1;
+        store.db
+            .prepare(`INSERT INTO local_filebeat_state (
+                    id, binary_path, config_dir, desired_version, observed_version,
+                    desired_config_hash, observed_config_hash, process_state,
+                    telemetry_enabled, last_error_code, last_health_at_ms,
+                    created_at_ms, updated_at_ms
+                ) VALUES (
+                    1, :binary_path, :config_dir, :desired_version, :observed_version,
+                    :desired_config_hash, :observed_config_hash, :process_state,
+                    :telemetry_enabled, :last_error_code, :last_health_at_ms,
+                    :created_at_ms, :updated_at_ms
+                )
+                ON CONFLICT(id) DO UPDATE SET
+                    binary_path = excluded.binary_path,
+                    config_dir = excluded.config_dir,
+                    desired_version = excluded.desired_version,
+                    observed_version = excluded.observed_version,
+                    desired_config_hash = excluded.desired_config_hash,
+                    observed_config_hash = excluded.observed_config_hash,
+                    process_state = excluded.process_state,
+                    telemetry_enabled = excluded.telemetry_enabled,
+                    last_error_code = excluded.last_error_code,
+                    last_health_at_ms = excluded.last_health_at_ms,
+                    updated_at_ms = excluded.updated_at_ms`)
+            .run({
+            binary_path: pick("binaryPath", current?.binaryPath ?? null),
+            config_dir: pick("configDir", current?.configDir ?? null),
+            desired_version: pick("desiredVersion", current?.desiredVersion ?? null),
+            observed_version: pick("observedVersion", current?.observedVersion ?? null),
+            desired_config_hash: pick("desiredConfigHash", current?.desiredConfigHash ?? null),
+            observed_config_hash: pick("observedConfigHash", current?.observedConfigHash ?? null),
+            process_state: pick("processState", current?.processState ?? null),
+            telemetry_enabled: telemetryEnabled,
+            last_error_code: pick("lastErrorCode", current?.lastErrorCode ?? null),
+            last_health_at_ms: pick("lastHealthAtMs", current?.lastHealthAtMs ?? null),
+            created_at_ms: current?.createdAtMs ?? now,
+            updated_at_ms: now,
+        });
+        return readFilebeatState(store);
+    });
+}
+function mapActivity(row) {
+    return {
+        id: row.id,
+        bindingId: row.binding_id,
+        provider: row.provider,
+        providerProjectPath: row.provider_project_path,
+        pathFingerprint: row.path_fingerprint,
+        state: row.state,
+        lastObservedAtMs: row.last_observed_at_ms ?? null,
+        createdAtMs: row.created_at_ms,
+        updatedAtMs: row.updated_at_ms,
+    };
+}
+export function upsertActivityBinding(store, input) {
+    const now = Date.now();
+    store.db
+        .prepare(`INSERT INTO local_activity_bindings (
+                id, binding_id, provider, provider_project_path, path_fingerprint,
+                state, last_observed_at_ms, created_at_ms, updated_at_ms
+            ) VALUES (
+                :id, :binding_id, :provider, :provider_project_path, :path_fingerprint,
+                :state, :last_observed_at_ms, :created_at_ms, :updated_at_ms
+            )
+            ON CONFLICT(binding_id, provider, path_fingerprint) DO UPDATE SET
+                provider_project_path = excluded.provider_project_path,
+                state = excluded.state,
+                last_observed_at_ms = excluded.last_observed_at_ms,
+                updated_at_ms = excluded.updated_at_ms`)
+        .run({
+        id: input.id,
+        binding_id: input.bindingId,
+        provider: input.provider,
+        provider_project_path: input.providerProjectPath,
+        path_fingerprint: input.pathFingerprint,
+        state: input.state ?? "active",
+        last_observed_at_ms: input.lastObservedAtMs ?? null,
+        created_at_ms: now,
+        updated_at_ms: now,
+    });
+    const row = store.db
+        .prepare(`SELECT * FROM local_activity_bindings
+             WHERE binding_id = :binding_id AND provider = :provider AND path_fingerprint = :path_fingerprint`)
+        .get({
+        binding_id: input.bindingId,
+        provider: input.provider,
+        path_fingerprint: input.pathFingerprint,
+    });
+    return mapActivity(row);
+}
+export function listActivityBindings(store, bindingId) {
+    const rows = (bindingId === undefined
+        ? store.db
+            .prepare("SELECT * FROM local_activity_bindings ORDER BY created_at_ms ASC")
+            .all()
+        : store.db
+            .prepare("SELECT * FROM local_activity_bindings WHERE binding_id = :binding_id ORDER BY created_at_ms ASC")
+            .all({ binding_id: bindingId }));
+    return rows.map(mapActivity);
+}

package/dist/lib/local_store/handoff_applications.js

@@ -0,0 +1,166 @@
+import { withTransaction } from "./database.js";
+import { isLegalApplicationTransition } from "./sync_vocabulary.js";
+export class IllegalApplicationTransitionError extends Error {
+    from;
+    to;
+    constructor(from, to) {
+        super(`Illegal inbound-application transition: ${from} → ${to}`);
+        this.name = "IllegalApplicationTransitionError";
+        this.from = from;
+        this.to = to;
+    }
+}
+function mapRow(row) {
+    return {
+        handoffId: row.handoff_id,
+        bindingId: row.binding_id,
+        state: row.state,
+        manifestSha256: row.manifest_sha256 ?? null,
+        baseManifestJson: row.base_manifest_json ?? null,
+        targetManifestJson: row.target_manifest_json ?? null,
+        localStateFingerprint: row.local_state_fingerprint ?? null,
+        technicalWaitReason: row.technical_wait_reason ?? null,
+        decisionState: row.decision_state ?? null,
+        approvedByUserId: row.approved_by_user_id ?? null,
+        generatedCommitId: row.generated_commit_id ?? null,
+        notificationState: row.notification_state ?? null,
+        recoveryBundleId: row.recovery_bundle_id ?? null,
+        revertCommitId: row.revert_commit_id ?? null,
+        supersededByHandoffId: row.superseded_by_handoff_id ?? null,
+        errorCode: row.error_code ?? null,
+        errorDetail: row.error_detail ?? null,
+        createdAtMs: row.created_at_ms,
+        updatedAtMs: row.updated_at_ms,
+    };
+}
+export function getApplication(store, handoffId, bindingId) {
+    const row = store.db
+        .prepare(`SELECT * FROM inbound_handoff_applications
+             WHERE handoff_id = :handoff_id AND binding_id = :binding_id`)
+        .get({ handoff_id: handoffId, binding_id: bindingId });
+    return row ? mapRow(row) : null;
+}
+export function listApplicationsForBinding(store, bindingId, states) {
+    if (!states || states.length === 0) {
+        const rows = store.db
+            .prepare(`SELECT * FROM inbound_handoff_applications
+                 WHERE binding_id = :binding_id ORDER BY created_at_ms ASC`)
+            .all({ binding_id: bindingId });
+        return rows.map(mapRow);
+    }
+    const placeholders = states.map((_, i) => `:st${i}`).join(", ");
+    const params = { binding_id: bindingId };
+    states.forEach((s, i) => {
+        params[`st${i}`] = s;
+    });
+    const rows = store.db
+        .prepare(`SELECT * FROM inbound_handoff_applications
+             WHERE binding_id = :binding_id AND state IN (${placeholders})
+             ORDER BY created_at_ms ASC`)
+        .all(params);
+    return rows.map(mapRow);
+}
+export function upsertApplication(store, input) {
+    return withTransaction(store, () => {
+        const now = Date.now();
+        const existing = getApplication(store, input.handoffId, input.bindingId);
+        if (!existing) {
+            store.db
+                .prepare(`INSERT INTO inbound_handoff_applications (
+                        handoff_id, binding_id, state, manifest_sha256, base_manifest_json,
+                        target_manifest_json, local_state_fingerprint, technical_wait_reason,
+                        decision_state, approved_by_user_id, generated_commit_id,
+                        notification_state, recovery_bundle_id, revert_commit_id,
+                        superseded_by_handoff_id, error_code, error_detail,
+                        created_at_ms, updated_at_ms
+                    ) VALUES (
+                        :handoff_id, :binding_id, :state, :manifest_sha256, :base_manifest_json,
+                        :target_manifest_json, :local_state_fingerprint, :technical_wait_reason,
+                        :decision_state, :approved_by_user_id, :generated_commit_id,
+                        :notification_state, :recovery_bundle_id, :revert_commit_id,
+                        :superseded_by_handoff_id, :error_code, :error_detail,
+                        :created_at_ms, :updated_at_ms
+                    )`)
+                .run({
+                handoff_id: input.handoffId,
+                binding_id: input.bindingId,
+                state: input.state ?? "received",
+                manifest_sha256: input.manifestSha256 ?? null,
+                base_manifest_json: input.baseManifestJson ?? null,
+                target_manifest_json: input.targetManifestJson ?? null,
+                local_state_fingerprint: input.localStateFingerprint ?? null,
+                technical_wait_reason: input.technicalWaitReason ?? null,
+                decision_state: input.decisionState ?? null,
+                approved_by_user_id: input.approvedByUserId ?? null,
+                generated_commit_id: input.generatedCommitId ?? null,
+                notification_state: input.notificationState ?? null,
+                recovery_bundle_id: input.recoveryBundleId ?? null,
+                revert_commit_id: input.revertCommitId ?? null,
+                superseded_by_handoff_id: input.supersededByHandoffId ?? null,
+                error_code: input.errorCode ?? null,
+                error_detail: input.errorDetail ?? null,
+                created_at_ms: now,
+                updated_at_ms: now,
+            });
+            return getApplication(store, input.handoffId, input.bindingId);
+        }
+        const pick = (key, fallback) => Object.prototype.hasOwnProperty.call(input, key)
+            ? (input[key] ?? null)
+            : fallback;
+        store.db
+            .prepare(`UPDATE inbound_handoff_applications SET
+                    manifest_sha256 = :manifest_sha256,
+                    base_manifest_json = :base_manifest_json,
+                    target_manifest_json = :target_manifest_json,
+                    local_state_fingerprint = :local_state_fingerprint,
+                    technical_wait_reason = :technical_wait_reason,
+                    decision_state = :decision_state,
+                    approved_by_user_id = :approved_by_user_id,
+                    generated_commit_id = :generated_commit_id,
+                    notification_state = :notification_state,
+                    recovery_bundle_id = :recovery_bundle_id,
+                    revert_commit_id = :revert_commit_id,
+                    superseded_by_handoff_id = :superseded_by_handoff_id,
+                    error_code = :error_code,
+                    error_detail = :error_detail,
+                    updated_at_ms = :updated_at_ms
+                 WHERE handoff_id = :handoff_id AND binding_id = :binding_id`)
+            .run({
+            manifest_sha256: pick("manifestSha256", existing.manifestSha256),
+            base_manifest_json: pick("baseManifestJson", existing.baseManifestJson),
+            target_manifest_json: pick("targetManifestJson", existing.targetManifestJson),
+            local_state_fingerprint: pick("localStateFingerprint", existing.localStateFingerprint),
+            technical_wait_reason: pick("technicalWaitReason", existing.technicalWaitReason),
+            decision_state: pick("decisionState", existing.decisionState),
+            approved_by_user_id: pick("approvedByUserId", existing.approvedByUserId),
+            generated_commit_id: pick("generatedCommitId", existing.generatedCommitId),
+            notification_state: pick("notificationState", existing.notificationState),
+            recovery_bundle_id: pick("recoveryBundleId", existing.recoveryBundleId),
+            revert_commit_id: pick("revertCommitId", existing.revertCommitId),
+            superseded_by_handoff_id: pick("supersededByHandoffId", existing.supersededByHandoffId),
+            error_code: pick("errorCode", existing.errorCode),
+            error_detail: pick("errorDetail", existing.errorDetail),
+            updated_at_ms: now,
+            handoff_id: input.handoffId,
+            binding_id: input.bindingId,
+        });
+        return getApplication(store, input.handoffId, input.bindingId);
+    });
+}
+export function transitionApplicationState(store, handoffId, bindingId, toState) {
+    return withTransaction(store, () => {
+        const existing = getApplication(store, handoffId, bindingId);
+        if (!existing) {
+            throw new Error(`No inbound application for (handoff ${handoffId}, binding ${bindingId})`);
+        }
+        if (!isLegalApplicationTransition(existing.state, toState)) {
+            throw new IllegalApplicationTransitionError(existing.state, toState);
+        }
+        store.db
+            .prepare(`UPDATE inbound_handoff_applications
+                 SET state = :state, updated_at_ms = :now
+                 WHERE handoff_id = :handoff_id AND binding_id = :binding_id`)
+            .run({ state: toState, now: Date.now(), handoff_id: handoffId, binding_id: bindingId });
+        return getApplication(store, handoffId, bindingId);
+    });
+}

package/dist/lib/local_store/history_decisions.js

@@ -0,0 +1,48 @@
+function mapRow(row) {
+    return {
+        id: row.id,
+        bindingId: row.binding_id,
+        decision: row.decision,
+        oldBaselineCommitId: row.old_baseline_commit_id ?? null,
+        newBaselineCommitId: row.new_baseline_commit_id,
+        handoffId: row.handoff_id ?? null,
+        createdAtMs: row.created_at_ms,
+    };
+}
+export function insertHistoryDecision(store, input) {
+    store.db
+        .prepare(`INSERT INTO local_history_decisions (
+                id, binding_id, decision, old_baseline_commit_id,
+                new_baseline_commit_id, handoff_id, created_at_ms
+            ) VALUES (
+                :id, :binding_id, :decision, :old_baseline_commit_id,
+                :new_baseline_commit_id, :handoff_id, :created_at_ms
+            )`)
+        .run({
+        id: input.id,
+        binding_id: input.bindingId,
+        decision: input.decision,
+        old_baseline_commit_id: input.oldBaselineCommitId ?? null,
+        new_baseline_commit_id: input.newBaselineCommitId,
+        handoff_id: input.handoffId ?? null,
+        created_at_ms: Date.now(),
+    });
+    return getHistoryDecision(store, input.id);
+}
+export function getHistoryDecision(store, id) {
+    const row = store.db
+        .prepare("SELECT * FROM local_history_decisions WHERE id = :id")
+        .get({ id });
+    return row ? mapRow(row) : null;
+}
+export function listHistoryDecisions(store, bindingId) {
+    const rows = store.db
+        .prepare(`SELECT * FROM local_history_decisions
+             WHERE binding_id = :binding_id
+             ORDER BY created_at_ms DESC, id DESC`)
+        .all({ binding_id: bindingId });
+    return rows.map(mapRow);
+}
+export function latestHistoryDecision(store, bindingId) {
+    return listHistoryDecisions(store, bindingId)[0] ?? null;
+}

package/dist/lib/local_store/index.js

@@ -0,0 +1,14 @@
+export { openLocalStore, withTransaction, } from "./database.js";
+export { nustackHomeDir, stateDbPath, locksDir, cacheDir, recoveryDir, ensureNuStackLayout, } from "./paths.js";
+export { MIGRATIONS, LATEST_SCHEMA_VERSION, LocalSchemaTooNewError, migrateToLatest, } from "./migrations.js";
+export { INBOUND_APPLICATION_STATES, BINDING_STATUSES, LIVE_BINDING_STATUSES, INBOUND_APPLICATION_TRANSITIONS, isLegalApplicationTransition, } from "./sync_vocabulary.js";
+export * from "./device_state.js";
+export * from "./bindings.js";
+export * from "./commit_origins.js";
+export * from "./handoff_applications.js";
+export * from "./recovery_bundles.js";
+export * from "./pending_uploads.js";
+export * from "./history_decisions.js";
+export * from "./accepted_uploads.js";
+export * from "./workspace_events_cache.js";
+export * from "./filebeat_state.js";

package/dist/lib/local_store/migrations.js

@@ -0,0 +1,240 @@
+const MIGRATION_V1 = {
+    version: 1,
+    statements: [
+        `CREATE TABLE local_device_state (
+            id INTEGER PRIMARY KEY CHECK (id = 1),
+            device_ref TEXT,
+            api_base_url TEXT,
+            active_user_id TEXT,
+            active_user_email TEXT,
+            keychain_service TEXT,
+            keychain_account TEXT,
+            schema_version INTEGER NOT NULL DEFAULT 1,
+            last_auth_refresh_at_ms INTEGER,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE TABLE local_bindings (
+            id TEXT PRIMARY KEY,
+            app_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            repository_root TEXT NOT NULL,
+            git_dir TEXT NOT NULL,
+            git_common_dir TEXT NOT NULL,
+            repository_fingerprint TEXT NOT NULL,
+            bound_branch TEXT NOT NULL,
+            last_processed_commit_id TEXT,
+            last_applied_app_sequence INTEGER NOT NULL DEFAULT 0,
+            whitelist_manifest_id TEXT,
+            whitelist_manifest_sha256 TEXT,
+            whitelist_cache_path TEXT,
+            etna_profile_json TEXT CHECK (etna_profile_json IS NULL OR json_valid(etna_profile_json)),
+            status TEXT NOT NULL CHECK (status IN ('creating','active','paused','failed','removed')),
+            last_error_code TEXT,
+            last_error_detail TEXT,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE UNIQUE INDEX local_bindings_repository_root_live_unique
+            ON local_bindings (repository_root)
+            WHERE status IN ('creating','active','paused')`,
+        `CREATE INDEX local_bindings_app_idx ON local_bindings (app_id)`,
+        `CREATE TABLE local_commit_origins (
+            binding_id TEXT NOT NULL REFERENCES local_bindings(id),
+            commit_id TEXT NOT NULL,
+            handoff_id TEXT NOT NULL,
+            origin TEXT NOT NULL CHECK (origin = 'cloud_handoff'),
+            created_at_ms INTEGER NOT NULL,
+            PRIMARY KEY (binding_id, commit_id)
+        )`,
+        `CREATE TABLE inbound_handoff_applications (
+            handoff_id TEXT NOT NULL,
+            binding_id TEXT NOT NULL REFERENCES local_bindings(id),
+            state TEXT NOT NULL CHECK (state IN (
+                'received','evaluating','no_op','technical_wait','decision_required',
+                'approved','applying','committed','undo_requested','reverted',
+                'revert_conflict','superseded'
+            )),
+            manifest_sha256 TEXT,
+            base_manifest_json TEXT CHECK (base_manifest_json IS NULL OR json_valid(base_manifest_json)),
+            target_manifest_json TEXT CHECK (target_manifest_json IS NULL OR json_valid(target_manifest_json)),
+            local_state_fingerprint TEXT,
+            technical_wait_reason TEXT,
+            decision_state TEXT,
+            approved_by_user_id TEXT,
+            generated_commit_id TEXT,
+            notification_state TEXT,
+            recovery_bundle_id TEXT,
+            revert_commit_id TEXT,
+            superseded_by_handoff_id TEXT,
+            error_code TEXT,
+            error_detail TEXT,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL,
+            PRIMARY KEY (handoff_id, binding_id)
+        )`,
+        `CREATE TABLE local_recovery_bundles (
+            id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL,
+            handoff_id TEXT NOT NULL,
+            bundle_path TEXT NOT NULL,
+            manifest_sha256 TEXT NOT NULL,
+            state TEXT NOT NULL CHECK (state IN ('active','restored','expired','deleted')),
+            created_at_ms INTEGER NOT NULL,
+            expires_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE INDEX local_recovery_bundles_binding_idx ON local_recovery_bundles (binding_id)`,
+        `CREATE TABLE pending_uploads (
+            binding_id TEXT NOT NULL,
+            commit_id TEXT NOT NULL,
+            manifest_sha256 TEXT,
+            whitelist_manifest_sha256 TEXT,
+            idempotency_key TEXT NOT NULL,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            next_retry_at_ms INTEGER,
+            last_error_code TEXT,
+            last_error_detail TEXT,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL,
+            PRIMARY KEY (binding_id, commit_id)
+        )`,
+        `CREATE UNIQUE INDEX pending_uploads_idempotency_key_unique
+            ON pending_uploads (idempotency_key)`,
+        `CREATE TABLE cached_app_events (
+            binding_id TEXT NOT NULL,
+            app_sequence INTEGER NOT NULL,
+            event_type TEXT NOT NULL,
+            payload_json TEXT CHECK (payload_json IS NULL OR json_valid(payload_json)),
+            applied_at_ms INTEGER,
+            created_at_ms INTEGER NOT NULL,
+            PRIMARY KEY (binding_id, app_sequence)
+        )`,
+        `CREATE TABLE local_filebeat_state (
+            id INTEGER PRIMARY KEY CHECK (id = 1),
+            binary_path TEXT,
+            config_dir TEXT,
+            desired_version TEXT,
+            observed_version TEXT,
+            desired_config_hash TEXT,
+            observed_config_hash TEXT,
+            process_state TEXT,
+            last_health_at_ms INTEGER,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE TABLE local_activity_bindings (
+            id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL,
+            provider TEXT NOT NULL CHECK (provider IN ('claude_code','codex')),
+            provider_project_path TEXT NOT NULL,
+            path_fingerprint TEXT NOT NULL,
+            state TEXT NOT NULL CHECK (state IN ('active','missing','disabled')),
+            last_observed_at_ms INTEGER,
+            created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE UNIQUE INDEX local_activity_bindings_binding_provider_path_unique
+            ON local_activity_bindings (binding_id, provider, path_fingerprint)`,
+    ],
+};
+const MIGRATION_V2 = {
+    version: 2,
+    statements: [
+        `ALTER TABLE local_filebeat_state ADD COLUMN telemetry_enabled INTEGER NOT NULL DEFAULT 1`,
+        `ALTER TABLE local_filebeat_state ADD COLUMN last_error_code TEXT`,
+    ],
+};
+const MIGRATION_V3 = {
+    version: 3,
+    statements: [
+        `CREATE TABLE local_history_decisions (
+            id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL REFERENCES local_bindings(id),
+            decision TEXT NOT NULL CHECK (decision IN ('publish_current_state','adopt_without_publishing')),
+            old_baseline_commit_id TEXT,
+            new_baseline_commit_id TEXT NOT NULL,
+            handoff_id TEXT,
+            created_at_ms INTEGER NOT NULL
+        )`,
+        `CREATE INDEX local_history_decisions_binding_idx
+            ON local_history_decisions (binding_id, created_at_ms)`,
+        `CREATE TABLE local_accepted_uploads (
+            binding_id TEXT NOT NULL REFERENCES local_bindings(id),
+            commit_id TEXT NOT NULL,
+            handoff_id TEXT NOT NULL,
+            app_sequence INTEGER NOT NULL,
+            manifest_sha256 TEXT NOT NULL,
+            created_at_ms INTEGER NOT NULL,
+            PRIMARY KEY (binding_id, commit_id)
+        )`,
+        `CREATE INDEX local_accepted_uploads_handoff_idx
+            ON local_accepted_uploads (handoff_id)`,
+    ],
+};
+const MIGRATION_V4 = {
+    version: 4,
+    statements: [`ALTER TABLE local_device_state ADD COLUMN active_workspace_id TEXT`],
+};
+const MIGRATION_V5 = {
+    version: 5,
+    statements: [`ALTER TABLE local_bindings ADD COLUMN telemetry_enabled INTEGER NOT NULL DEFAULT 1`],
+};
+const MIGRATION_V6 = {
+    version: 6,
+    statements: [
+        `ALTER TABLE local_bindings RENAME COLUMN workspace_id TO organization_id`,
+        `ALTER TABLE local_device_state RENAME COLUMN active_workspace_id TO active_organization_id`,
+        `ALTER TABLE local_bindings RENAME COLUMN app_id TO workspace_id`,
+        `ALTER TABLE local_bindings RENAME COLUMN last_applied_app_sequence TO last_applied_workspace_sequence`,
+        `ALTER TABLE cached_app_events RENAME COLUMN app_sequence TO workspace_sequence`,
+        `ALTER TABLE local_accepted_uploads RENAME COLUMN app_sequence TO workspace_sequence`,
+        `ALTER TABLE cached_app_events RENAME TO cached_workspace_events`,
+        `DROP INDEX IF EXISTS local_bindings_app_idx`,
+        `CREATE INDEX local_bindings_workspace_idx ON local_bindings (workspace_id)`,
+    ],
+};
+export const MIGRATIONS = [
+    MIGRATION_V1,
+    MIGRATION_V2,
+    MIGRATION_V3,
+    MIGRATION_V4,
+    MIGRATION_V5,
+    MIGRATION_V6,
+];
+export const LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;
+export class LocalSchemaTooNewError extends Error {
+    foundVersion;
+    supportedVersion;
+    constructor(foundVersion, supportedVersion) {
+        super(`This machine's NuStack local store is at schema version ${foundVersion}, but this CLI only supports up to ${supportedVersion}. Update the nustack CLI to continue.`);
+        this.name = "LocalSchemaTooNewError";
+        this.foundVersion = foundVersion;
+        this.supportedVersion = supportedVersion;
+    }
+}
+function readUserVersion(db) {
+    const row = db.prepare("PRAGMA user_version").get();
+    return typeof row?.user_version === "number" ? row.user_version : 0;
+}
+export function migrateToLatest(db) {
+    const current = readUserVersion(db);
+    if (current > LATEST_SCHEMA_VERSION) {
+        throw new LocalSchemaTooNewError(current, LATEST_SCHEMA_VERSION);
+    }
+    for (const migration of MIGRATIONS) {
+        if (migration.version <= current)
+            continue;
+        db.exec("BEGIN IMMEDIATE");
+        try {
+            for (const statement of migration.statements) {
+                db.exec(statement);
+            }
+            db.exec(`PRAGMA user_version = ${migration.version}`);
+            db.exec("COMMIT");
+        }
+        catch (error) {
+            db.exec("ROLLBACK");
+            throw error;
+        }
+    }
+}

package/dist/lib/local_store/paths.js

@@ -0,0 +1,24 @@
+import os from "node:os";
+import path from "node:path";
+import { mkdirSecure } from "../secure_file.js";
+export function nustackHomeDir() {
+    return path.join(os.homedir(), ".nustack");
+}
+export function stateDbPath() {
+    return path.join(nustackHomeDir(), "state.db");
+}
+export function locksDir() {
+    return path.join(nustackHomeDir(), "locks");
+}
+export function cacheDir() {
+    return path.join(nustackHomeDir(), "cache");
+}
+export function recoveryDir() {
+    return path.join(nustackHomeDir(), "recovery");
+}
+export async function ensureNuStackLayout() {
+    await mkdirSecure(nustackHomeDir());
+    await mkdirSecure(locksDir());
+    await mkdirSecure(cacheDir());
+    await mkdirSecure(recoveryDir());
+}