@nurix/nustack 0.10.0-dev.9 → 0.11.1

package/dist/lib/git-sync/inbound/apply_commit.js

@@ -11,12 +11,12 @@ import { readTargetState } from "./content_decision.js";
 import { computeStateFingerprint } from "./state_fingerprint.js";
 import { persistRecoveryBundle } from "../recovery/store.js";
 export const NUSTACK_SYNC_IDENTITY = { name: "NuStack Sync", email: "sync@nustack.local" };
-export function buildCommitMessage(handoffId, workspaceId, approvedByUserId) {
+export function buildCommitMessage(handoffId, projectId, approvedByUserId) {
     const lines = [
         `nustack(sync): apply cloud handoff ${handoffId.slice(0, 12)}`,
         "",
         `NuStack-Handoff: ${handoffId}`,
-        `NuStack-Workspace: ${workspaceId}`,
+        `NuStack-Project: ${projectId}`,
         "NuStack-Origin: cloud",
     ];
     if (approvedByUserId)
@@ -186,7 +186,7 @@ export async function applyCommit(input) {
         if (target.operation === "upsert" && target.blobPath)
             bytesByPath.set(target.path, readFileSync(target.blobPath));
     }
-    const message = buildCommitMessage(handoffId, manifest.workspaceId, approved ? (input.approvedByUserId ?? null) : null);
+    const message = buildCommitMessage(handoffId, manifest.projectId, approved ? (input.approvedByUserId ?? null) : null);
     const built = buildCommit(repo, oldHead, targets, bytesByPath, message, {
         authorName: NUSTACK_SYNC_IDENTITY.name,
         authorEmail: NUSTACK_SYNC_IDENTITY.email,

package/dist/lib/git-sync/inbound/approval.js

@@ -12,7 +12,7 @@ export const APPROVAL_RECOVERY_NOTE = "Approving overwrites the listed paths. Gi
 export function toDownloadBinding(binding) {
     return {
         id: binding.id,
-        workspaceId: binding.workspaceId,
+        projectId: binding.projectId,
         boundBranch: binding.boundBranch,
         repositoryRoot: binding.repositoryRoot,
         etnaProfileJson: binding.etnaProfileJson,

package/dist/lib/git-sync/inbound/download.js

@@ -27,7 +27,7 @@ function recomputeManifestHash(manifest) {
     const core = {
         schemaVersion: 1,
         handoffId: manifest.handoffId,
-        workspaceId: manifest.workspaceId,
+        projectId: manifest.projectId,
         documentSetVersionId: manifest.documentSetVersionId,
         toolkit: {
             name: manifest.toolkit.name,
@@ -62,7 +62,7 @@ function toolkitTechnicalWait(binding, manifest) {
         return "harness_incompatible";
     return null;
 }
-function crossWorkspaceMarker(body, workspaceId) {
+function crossProjectMarker(body, projectId) {
     if (!body.startsWith("---\n"))
         return false;
     const secondLineEnd = body.indexOf("\n", 4);
@@ -71,8 +71,8 @@ function crossWorkspaceMarker(body, workspaceId) {
         return false;
     const fence = body.indexOf("\n---", 4);
     const block = body.slice(0, fence === -1 ? body.length : fence);
-    const match = /\n\s*workspace_id:\s*(\S+)/.exec(block);
-    return match !== null && match[1] !== workspaceId;
+    const match = /\n\s*project_id:\s*(\S+)/.exec(block);
+    return match !== null && match[1] !== projectId;
 }
 function isUnsupportedMedia(bytes) {
     for (const byte of bytes)
@@ -136,8 +136,8 @@ export async function downloadHandoff(deps, binding, handoffId) {
     const downloadContent = deps.downloadContent ?? downloadTargetContent;
     const fetchWhitelist = deps.fetchWhitelist ?? fetchSyncWhitelist;
     const manifest = await fetchManifest(deps.baseUrl, deps.accessToken, { handoffId, bindingId: binding.id });
-    if (manifest.workspaceId !== binding.workspaceId)
-        return reject("workspace_mismatch", "manifest Workspace does not match the binding");
+    if (manifest.projectId !== binding.projectId)
+        return reject("project_mismatch", "manifest Project does not match the binding");
     if (recomputeManifestHash(manifest) !== manifest.manifestSha256) {
         return reject("manifest_hash", "manifest hash does not verify");
     }
@@ -207,8 +207,8 @@ export async function downloadHandoff(deps, binding, handoffId) {
         const actualSha256 = sha256(bytes);
         if (actualSha256 !== target.targetSha256)
             return reject("hash_mismatch", "downloaded body hash does not match the manifest");
-        if (crossWorkspaceMarker(new TextDecoder().decode(bytes), binding.workspaceId)) {
-            return reject("cross_workspace_marker", "target body declares a foreign Workspace id");
+        if (crossProjectMarker(new TextDecoder().decode(bytes), binding.projectId)) {
+            return reject("cross_project_marker", "target body declares a foreign Project id");
         }
         const blobPath = blobCachePath(actualSha256);
         await mkdirSecure(path.dirname(blobPath));

package/dist/lib/git-sync/inbound/event_sync.js

@@ -1,6 +1,6 @@
 import { getBindingById, updateBindingCursor } from "../../local_store/bindings.js";
 import { hasCloudOriginForHandoff } from "../../local_store/commit_origins.js";
-import { cacheWorkspaceEvents, listCachedWorkspaceEvents, pruneWorkspaceEvents, } from "../../local_store/workspace_events_cache.js";
+import { cacheProjectEvents, listCachedProjectEvents, pruneProjectEvents, } from "../../local_store/project_events_cache.js";
 import { getApplication, upsertApplication, transitionApplicationState, listApplicationsForBinding, } from "../../local_store/handoff_applications.js";
 import { fetchBindingEvents, acknowledgeBindingCursor } from "../../nustack_client.js";
 const PENDING_STATES = new Set([
@@ -29,7 +29,7 @@ function supersedeOlderApplications(store, bindingId, newerHandoffId) {
     return flipped;
 }
 function handoffIdOf(event) {
-    return event.type === "version.created" && event.entity.kind === "workspace_document_version" ? event.entity.id : null;
+    return event.type === "version.created" && event.entity.kind === "project_document_version" ? event.entity.id : null;
 }
 export async function syncBindingEvents(store, deps, bindingId) {
     const binding = getBindingById(store, bindingId);
@@ -40,9 +40,9 @@ export async function syncBindingEvents(store, deps, bindingId) {
         createdHandoffs: [],
         supersededHandoffs: [],
         acknowledgedOwnOrigin: [],
-        highestSequence: binding.lastAppliedWorkspaceSequence,
+        highestSequence: binding.lastAppliedProjectSequence,
     };
-    let after = binding.lastAppliedWorkspaceSequence;
+    let after = binding.lastAppliedProjectSequence;
     for (;;) {
         const events = await fetchEvents(deps.baseUrl, deps.accessToken, {
             bindingId,
@@ -51,8 +51,8 @@ export async function syncBindingEvents(store, deps, bindingId) {
         });
         if (events.length === 0)
             break;
-        cacheWorkspaceEvents(store, bindingId, events.map((event) => ({
-            workspaceSequence: event.sequence,
+        cacheProjectEvents(store, bindingId, events.map((event) => ({
+            projectSequence: event.sequence,
             eventType: event.type,
             payloadJson: JSON.stringify({ entity: event.entity, payload: event.payload }),
         })));
@@ -81,7 +81,7 @@ export async function syncBindingEvents(store, deps, bindingId) {
         if (events.length < EVENTS_PAGE_LIMIT)
             break;
     }
-    pruneWorkspaceEvents(store, bindingId);
+    pruneProjectEvents(store, bindingId);
     return result;
 }
 function cachedHandoffId(eventType, payloadJson) {
@@ -100,9 +100,9 @@ export async function advanceContiguousCursor(store, deps, bindingId) {
     if (!binding)
         throw new Error(`No binding "${bindingId}" on this machine.`);
     const acknowledgeCursor = deps.acknowledgeCursor ?? acknowledgeBindingCursor;
-    let cursor = binding.lastAppliedWorkspaceSequence;
-    for (const event of listCachedWorkspaceEvents(store, bindingId)) {
-        if (event.workspaceSequence <= cursor)
+    let cursor = binding.lastAppliedProjectSequence;
+    for (const event of listCachedProjectEvents(store, bindingId)) {
+        if (event.projectSequence <= cursor)
             continue;
         const handoffId = cachedHandoffId(event.eventType, event.payloadJson);
         if (handoffId !== null) {
@@ -110,10 +110,10 @@ export async function advanceContiguousCursor(store, deps, bindingId) {
             if (!application || PENDING_STATES.has(application.state))
                 break;
         }
-        cursor = event.workspaceSequence;
+        cursor = event.projectSequence;
     }
-    if (cursor > binding.lastAppliedWorkspaceSequence) {
-        updateBindingCursor(store, bindingId, { lastAppliedWorkspaceSequence: cursor });
+    if (cursor > binding.lastAppliedProjectSequence) {
+        updateBindingCursor(store, bindingId, { lastAppliedProjectSequence: cursor });
         try {
             await acknowledgeCursor(deps.baseUrl, deps.accessToken, { bindingId, lastAppliedSequence: cursor });
         }

package/dist/lib/git-sync/inbound/notification.js

@@ -7,7 +7,7 @@ export function renderCommitNotification(application, changedPaths) {
         lines.push(`  commit: ${application.generatedCommitId.slice(0, 12)}`);
     if (changedPaths.length > 0)
         lines.push(`  changed: ${changedPaths.join(", ")}`);
-    lines.push(`  View: nustack workspace sync pending    Undo: nustack workspace sync undo ${application.handoffId}`);
+    lines.push(`  View: nustack project sync pending    Undo: nustack project sync undo ${application.handoffId}`);
     if (application.recoveryBundleId) {
         lines.push(`  Recovery bundle ${application.recoveryBundleId} holds your pre-approval content until it expires.`);
     }

package/dist/lib/git-sync/outbound/extraction.js

@@ -43,11 +43,11 @@ function readBlob(repo, blobId) {
 export function isCommitTreeReadable(repo, commitId) {
     return runGit(repo.repositoryRoot, ["cat-file", "-e", `${commitId}^{tree}`], { allowFailure: true }).exitCode === 0;
 }
-export function extractCommitDelta(repo, commitId, whitelist, workspaceId, direction = "local_to_cloud") {
+export function extractCommitDelta(repo, commitId, whitelist, projectId, direction = "local_to_cloud") {
     const parentCommitId = readRefCommit(repo, `${commitId}^1`);
-    return computeTreeDelta(repo, parentCommitId, commitId, whitelist, workspaceId, direction);
+    return computeTreeDelta(repo, parentCommitId, commitId, whitelist, projectId, direction);
 }
-export function computeTreeDelta(repo, baseCommitId, targetCommitId, whitelist, workspaceId, direction = "local_to_cloud") {
+export function computeTreeDelta(repo, baseCommitId, targetCommitId, whitelist, projectId, direction = "local_to_cloud") {
     const diffArgs = ["diff-tree", "-r", "-z", "--no-renames", "--no-commit-id"];
     const args = baseCommitId === null ? [...diffArgs, "--root", targetCommitId] : [...diffArgs, baseCommitId, targetCommitId];
     const { stdout } = runGit(repo.repositoryRoot, args);
@@ -81,7 +81,7 @@ export function computeTreeDelta(repo, baseCommitId, targetCommitId, whitelist,
             bytes: blob.bytes,
             byteSize: blob.byteSize,
             entry: match.entry,
-            workspaceId,
+            projectId,
         });
         if (!validation.ok)
             return { ok: false, code: validation.code, path };

package/dist/lib/git-sync/outbound/history_decision.js

@@ -49,11 +49,11 @@ export async function publishCurrentState(store, binding, repo, deps) {
             repo,
             client: deps.client,
             whitelistRef: { current: whitelist },
-            workspaceId: binding.workspaceId,
+            projectId: binding.projectId,
             now: deps.now ?? Date.now,
         };
         for (let staleDepth = 0;; staleDepth++) {
-            const delta = computeTreeDelta(repo, base, head, ctx.whitelistRef.current, binding.workspaceId);
+            const delta = computeTreeDelta(repo, base, head, ctx.whitelistRef.current, binding.projectId);
             if (!delta.ok)
                 return { ok: false, code: delta.code, detail: delta.path };
             const result = await pushOperations(ctx, head, base, delta.delta.operations);

package/dist/lib/git-sync/outbound/publisher.js

@@ -19,7 +19,7 @@ export async function runOutboundPublisher(ctx, runtime) {
         repo,
         client: runtime.client,
         whitelistRef: { current: whitelist },
-        workspaceId: binding.workspaceId,
+        projectId: binding.projectId,
         now,
     };
     for (const commitId of commitIds) {
@@ -32,7 +32,7 @@ export async function runOutboundPublisher(ctx, runtime) {
         switch (outcome.kind) {
             case "accepted":
                 updateBindingCursor(store, binding.id, { lastProcessedCommitId: commitId });
-                emit({ event: "upload_result", bindingId: binding.id, commitId, outcome: "accepted", handoffId: outcome.handoffId, workspaceSequence: outcome.workspaceSequence });
+                emit({ event: "upload_result", bindingId: binding.id, commitId, outcome: "accepted", handoffId: outcome.handoffId, projectSequence: outcome.projectSequence });
                 break;
             case "no_op":
                 updateBindingCursor(store, binding.id, { lastProcessedCommitId: commitId });

package/dist/lib/git-sync/outbound/queue.js

@@ -24,7 +24,7 @@ export async function submitHead(ctx, commitId) {
     return attempt(ctx, commitId, 0);
 }
 async function attempt(ctx, commitId, staleDepth) {
-    const extraction = extractCommitDelta(ctx.repo, commitId, ctx.whitelistRef.current, ctx.workspaceId);
+    const extraction = extractCommitDelta(ctx.repo, commitId, ctx.whitelistRef.current, ctx.projectId);
     if (!extraction.ok) {
         return blockBinding(ctx, commitId, extraction.code, { path: extraction.path });
     }
@@ -85,11 +85,11 @@ export async function pushOperations(ctx, commitId, parentCommitId, operations)
         bindingId: ctx.binding.id,
         commitId,
         handoffId: outcome.accepted.handoffId,
-        workspaceSequence: outcome.accepted.workspaceSequence,
+        projectSequence: outcome.accepted.projectSequence,
         manifestSha256: built.manifestSha256,
     });
     deleteUpload(ctx.store, ctx.binding.id, commitId);
-    return { kind: "accepted", handoffId: outcome.accepted.handoffId, workspaceSequence: outcome.accepted.workspaceSequence };
+    return { kind: "accepted", handoffId: outcome.accepted.handoffId, projectSequence: outcome.accepted.projectSequence };
 }
 async function repinWhitelist(ctx) {
     try {

package/dist/lib/git-sync/outbound/upload_client.js

@@ -18,7 +18,7 @@ const TERMINAL_CODES = new Set([
     "INVALID_STATE",
     "IDEMPOTENCY_CONFLICT",
     "HANDOFF_SUPERSEDED",
-    "WORKSPACE_NOT_FOUND",
+    "PROJECT_NOT_FOUND",
     "DOCUMENT_NOT_FOUND",
 ]);
 const AUTH_CODES = new Set(["AUTH_REQUIRED", "ACCESS_TOKEN_EXPIRED", "DEVICE_CREDENTIAL_INVALID"]);
@@ -120,11 +120,11 @@ export function createUploadClient(deps) {
                 const data = (response.body?.data ?? {});
                 if (data.noOp)
                     return { ok: true, value: { noOp: true } };
-                const workspaceSequence = data.workspaceSequence ?? response.body?.meta?.workspaceSequence;
-                if (!data.handoffId || typeof workspaceSequence !== "number") {
+                const projectSequence = data.projectSequence ?? response.body?.meta?.projectSequence;
+                if (!data.handoffId || typeof projectSequence !== "number") {
                     return { ok: false, error: { kind: "terminal", code: "MALFORMED_ACCEPTANCE" } };
                 }
-                return { ok: true, value: { accepted: { handoffId: data.handoffId, workspaceSequence } } };
+                return { ok: true, value: { accepted: { handoffId: data.handoffId, projectSequence } } };
             });
         },
         reportHealth(bindingId, report) {

package/dist/lib/git-sync/whitelist/index.js

@@ -1,4 +1,4 @@
 export { SYNC_PROTOCOL_VERSION, isWhitelistManifest, } from "./types.js";
 export { matchPath, isProtectedPath, globMatch } from "./matcher.js";
-export { validateOperationContent, mediaTypeForPath, frontmatterWorkspaceId, } from "./validation.js";
+export { validateOperationContent, mediaTypeForPath, frontmatterProjectId, } from "./validation.js";
 export { fetchWhitelist, pinWhitelist, loadPinnedWhitelist, canonicalWhitelistSha256, whitelistCacheFile, WhitelistError, } from "./store.js";

package/dist/lib/git-sync/whitelist/types.js

@@ -36,7 +36,7 @@ export function isWhitelistManifest(value) {
     return (manifest.schemaVersion === 1 &&
         typeof manifest.manifestId === "string" &&
         typeof manifest.version === "number" &&
-        typeof manifest.workspaceId === "string" &&
+        typeof manifest.projectId === "string" &&
         typeof manifest.protocolVersion === "string" &&
         Array.isArray(manifest.entries) &&
         manifest.entries.every(isEntry) &&

package/dist/lib/git-sync/whitelist/validation.js

@@ -14,7 +14,7 @@ export function mediaTypeForPath(path) {
     const ext = path.slice(dot + 1).toLowerCase();
     return MEDIA_TYPE_BY_EXTENSION[ext] ?? null;
 }
-export function frontmatterWorkspaceId(text) {
+export function frontmatterProjectId(text) {
     if (!text.startsWith("---"))
         return null;
     const firstNewline = text.indexOf("\n");
@@ -26,7 +26,7 @@ export function frontmatterWorkspaceId(text) {
     const closeIndex = rest.search(/\n---\s*(\n|$)/);
     const block = closeIndex < 0 ? rest : rest.slice(0, closeIndex);
     for (const line of block.split("\n")) {
-        const match = /^\s*(?:workspace_id|workspaceId|app_id|appId)\s*:\s*(.+?)\s*$/.exec(line);
+        const match = /^\s*(?:project_id|projectId|app_id|appId)\s*:\s*(.+?)\s*$/.exec(line);
         if (match)
             return match[1].replace(/^["']|["']$/g, "");
     }
@@ -52,9 +52,9 @@ export function validateOperationContent(input) {
     }
     if (text.includes(NUL))
         return { ok: false, code: "invalid_encoding" };
-    const declaredWorkspace = frontmatterWorkspaceId(text);
-    if (declaredWorkspace !== null && declaredWorkspace !== input.workspaceId) {
-        return { ok: false, code: "cross_workspace_marker" };
+    const declaredProject = frontmatterProjectId(text);
+    if (declaredProject !== null && declaredProject !== input.projectId) {
+        return { ok: false, code: "cross_project_marker" };
     }
     return { ok: true };
 }

package/dist/lib/libsecret_store.js

@@ -0,0 +1,47 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { promisify } from "node:util";
+const runFile = promisify(execFile);
+const DEFAULT_SECRET_TOOL_BIN = "/usr/bin/secret-tool";
+const SERVICE = "nustack-device";
+const LABEL = "NuStack device credential";
+function secretToolBin() {
+    return process.env.NUSTACK_SECRET_TOOL_BIN?.trim() || DEFAULT_SECRET_TOOL_BIN;
+}
+export function isLibsecretAvailable() {
+    if (process.env.NUSTACK_SECRET_TOOL_BIN)
+        return true;
+    return process.platform === "linux" && existsSync(DEFAULT_SECRET_TOOL_BIN);
+}
+function attributes(account) {
+    return ["service", SERVICE, "account", account];
+}
+export const libsecretStore = {
+    name: "libsecret",
+    async readRaw(account) {
+        try {
+            const { stdout } = await runFile(secretToolBin(), ["lookup", ...attributes(account)]);
+            return stdout.trim() || null;
+        }
+        catch {
+            return null;
+        }
+    },
+    writeRaw(account, payload) {
+        return new Promise((resolve, reject) => {
+            const child = execFile(secretToolBin(), ["store", `--label=${LABEL}`, ...attributes(account)], (error) => error ? reject(error) : resolve());
+            child.stdin?.end(payload);
+        });
+    },
+    async deleteRaw(account) {
+        if (!(await this.readRaw(account)))
+            return false;
+        try {
+            await runFile(secretToolBin(), ["clear", ...attributes(account)]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+};

package/dist/lib/local_store/accepted_uploads.js

@@ -3,7 +3,7 @@ function mapRow(row) {
         bindingId: row.binding_id,
         commitId: row.commit_id,
         handoffId: row.handoff_id,
-        workspaceSequence: row.workspace_sequence,
+        projectSequence: row.project_sequence,
         manifestSha256: row.manifest_sha256,
         createdAtMs: row.created_at_ms,
     };
@@ -11,16 +11,16 @@ function mapRow(row) {
 export function recordAcceptedUpload(store, input) {
     store.db
         .prepare(`INSERT INTO local_accepted_uploads (
-                binding_id, commit_id, handoff_id, workspace_sequence, manifest_sha256, created_at_ms
+                binding_id, commit_id, handoff_id, project_sequence, manifest_sha256, created_at_ms
             ) VALUES (
-                :binding_id, :commit_id, :handoff_id, :workspace_sequence, :manifest_sha256, :created_at_ms
+                :binding_id, :commit_id, :handoff_id, :project_sequence, :manifest_sha256, :created_at_ms
             )
             ON CONFLICT(binding_id, commit_id) DO NOTHING`)
         .run({
         binding_id: input.bindingId,
         commit_id: input.commitId,
         handoff_id: input.handoffId,
-        workspace_sequence: input.workspaceSequence,
+        project_sequence: input.projectSequence,
         manifest_sha256: input.manifestSha256,
         created_at_ms: Date.now(),
     });
@@ -42,7 +42,7 @@ export function latestAcceptedUpload(store, bindingId) {
     const row = store.db
         .prepare(`SELECT * FROM local_accepted_uploads
              WHERE binding_id = :binding_id
-             ORDER BY workspace_sequence DESC, created_at_ms DESC
+             ORDER BY project_sequence DESC, created_at_ms DESC
              LIMIT 1`)
         .get({ binding_id: bindingId });
     return row ? mapRow(row) : null;

package/dist/lib/local_store/bindings.js

@@ -3,7 +3,7 @@ import { LIVE_BINDING_STATUSES } from "./sync_vocabulary.js";
 function mapRow(row) {
     return {
         id: row.id,
-        workspaceId: row.workspace_id,
+        projectId: row.project_id,
         organizationId: row.organization_id,
         repositoryRoot: row.repository_root,
         gitDir: row.git_dir,
@@ -11,7 +11,7 @@ function mapRow(row) {
         repositoryFingerprint: row.repository_fingerprint,
         boundBranch: row.bound_branch,
         lastProcessedCommitId: row.last_processed_commit_id ?? null,
-        lastAppliedWorkspaceSequence: row.last_applied_workspace_sequence,
+        lastAppliedProjectSequence: row.last_applied_project_sequence,
         whitelistManifestId: row.whitelist_manifest_id ?? null,
         whitelistManifestSha256: row.whitelist_manifest_sha256 ?? null,
         whitelistCachePath: row.whitelist_cache_path ?? null,
@@ -28,21 +28,21 @@ export function insertBinding(store, input) {
     const now = Date.now();
     store.db
         .prepare(`INSERT INTO local_bindings (
-                id, workspace_id, organization_id, repository_root, git_dir, git_common_dir,
+                id, project_id, organization_id, repository_root, git_dir, git_common_dir,
                 repository_fingerprint, bound_branch, last_processed_commit_id,
-                last_applied_workspace_sequence, whitelist_manifest_id, whitelist_manifest_sha256,
+                last_applied_project_sequence, whitelist_manifest_id, whitelist_manifest_sha256,
                 whitelist_cache_path, etna_profile_json, status, last_error_code,
                 last_error_detail, created_at_ms, updated_at_ms
             ) VALUES (
-                :id, :workspace_id, :organization_id, :repository_root, :git_dir, :git_common_dir,
+                :id, :project_id, :organization_id, :repository_root, :git_dir, :git_common_dir,
                 :repository_fingerprint, :bound_branch, :last_processed_commit_id,
-                :last_applied_workspace_sequence, :whitelist_manifest_id, :whitelist_manifest_sha256,
+                :last_applied_project_sequence, :whitelist_manifest_id, :whitelist_manifest_sha256,
                 :whitelist_cache_path, :etna_profile_json, :status, NULL,
                 NULL, :created_at_ms, :updated_at_ms
             )`)
         .run({
         id: input.id,
-        workspace_id: input.workspaceId,
+        project_id: input.projectId,
         organization_id: input.organizationId,
         repository_root: input.repositoryRoot,
         git_dir: input.gitDir,
@@ -50,7 +50,7 @@ export function insertBinding(store, input) {
         repository_fingerprint: input.repositoryFingerprint,
         bound_branch: input.boundBranch,
         last_processed_commit_id: input.lastProcessedCommitId ?? null,
-        last_applied_workspace_sequence: input.lastAppliedWorkspaceSequence ?? 0,
+        last_applied_project_sequence: input.lastAppliedProjectSequence ?? 0,
         whitelist_manifest_id: input.whitelistManifestId ?? null,
         whitelist_manifest_sha256: input.whitelistManifestSha256 ?? null,
         whitelist_cache_path: input.whitelistCachePath ?? null,
@@ -103,12 +103,12 @@ export function updateBindingCursor(store, bindingId, patch) {
                      WHERE id = :id`)
                 .run({ commit: patch.lastProcessedCommitId ?? null, now, id: bindingId });
         }
-        if (patch.lastAppliedWorkspaceSequence !== undefined) {
+        if (patch.lastAppliedProjectSequence !== undefined) {
             store.db
                 .prepare(`UPDATE local_bindings
-                     SET last_applied_workspace_sequence = :seq, updated_at_ms = :now
+                     SET last_applied_project_sequence = :seq, updated_at_ms = :now
                      WHERE id = :id`)
-                .run({ seq: patch.lastAppliedWorkspaceSequence, now, id: bindingId });
+                .run({ seq: patch.lastAppliedProjectSequence, now, id: bindingId });
         }
         return getBindingById(store, bindingId);
     });

package/dist/lib/local_store/index.js

@@ -10,5 +10,5 @@ export * from "./recovery_bundles.js";
 export * from "./pending_uploads.js";
 export * from "./history_decisions.js";
 export * from "./accepted_uploads.js";
-export * from "./workspace_events_cache.js";
+export * from "./project_events_cache.js";
 export * from "./filebeat_state.js";

package/dist/lib/local_store/migrations.js

@@ -193,6 +193,18 @@ const MIGRATION_V6 = {
         `CREATE INDEX local_bindings_workspace_idx ON local_bindings (workspace_id)`,
     ],
 };
+const MIGRATION_V7 = {
+    version: 7,
+    statements: [
+        `ALTER TABLE local_bindings RENAME COLUMN workspace_id TO project_id`,
+        `ALTER TABLE local_bindings RENAME COLUMN last_applied_workspace_sequence TO last_applied_project_sequence`,
+        `ALTER TABLE cached_workspace_events RENAME COLUMN workspace_sequence TO project_sequence`,
+        `ALTER TABLE local_accepted_uploads RENAME COLUMN workspace_sequence TO project_sequence`,
+        `ALTER TABLE cached_workspace_events RENAME TO cached_project_events`,
+        `DROP INDEX IF EXISTS local_bindings_workspace_idx`,
+        `CREATE INDEX local_bindings_project_idx ON local_bindings (project_id)`,
+    ],
+};
 export const MIGRATIONS = [
     MIGRATION_V1,
     MIGRATION_V2,
@@ -200,6 +212,7 @@ export const MIGRATIONS = [
     MIGRATION_V4,
     MIGRATION_V5,
     MIGRATION_V6,
+    MIGRATION_V7,
 ];
 export const LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;
 export class LocalSchemaTooNewError extends Error {

package/dist/lib/local_store/project_events_cache.js

@@ -0,0 +1,54 @@
+export const DEFAULT_PROJECT_EVENT_KEEP_COUNT = 500;
+function mapRow(row) {
+    return {
+        bindingId: row.binding_id,
+        projectSequence: row.project_sequence,
+        eventType: row.event_type,
+        payloadJson: row.payload_json ?? null,
+        appliedAtMs: row.applied_at_ms ?? null,
+        createdAtMs: row.created_at_ms,
+    };
+}
+export function cacheProjectEvents(store, bindingId, events) {
+    const now = Date.now();
+    const insert = store.db.prepare(`INSERT INTO cached_project_events (
+            binding_id, project_sequence, event_type, payload_json, applied_at_ms, created_at_ms
+        ) VALUES (
+            :binding_id, :project_sequence, :event_type, :payload_json, :applied_at_ms, :created_at_ms
+        )
+        ON CONFLICT(binding_id, project_sequence) DO NOTHING`);
+    for (const event of events) {
+        insert.run({
+            binding_id: bindingId,
+            project_sequence: event.projectSequence,
+            event_type: event.eventType,
+            payload_json: event.payloadJson ?? null,
+            applied_at_ms: event.appliedAtMs ?? null,
+            created_at_ms: now,
+        });
+    }
+}
+export function latestCachedSequence(store, bindingId) {
+    const row = store.db
+        .prepare("SELECT MAX(project_sequence) AS latest FROM cached_project_events WHERE binding_id = :binding_id")
+        .get({ binding_id: bindingId });
+    return row?.latest ?? null;
+}
+export function listCachedProjectEvents(store, bindingId) {
+    const rows = store.db
+        .prepare("SELECT * FROM cached_project_events WHERE binding_id = :binding_id ORDER BY project_sequence ASC")
+        .all({ binding_id: bindingId });
+    return rows.map(mapRow);
+}
+export function pruneProjectEvents(store, bindingId, keepCount = DEFAULT_PROJECT_EVENT_KEEP_COUNT) {
+    store.db
+        .prepare(`DELETE FROM cached_project_events
+             WHERE binding_id = :binding_id
+               AND project_sequence NOT IN (
+                   SELECT project_sequence FROM cached_project_events
+                   WHERE binding_id = :binding_id
+                   ORDER BY project_sequence DESC
+                   LIMIT :keep
+               )`)
+        .run({ binding_id: bindingId, keep: keepCount });
+}