@nurix/nustack 0.24.0 → 0.25.1

package/dist/lib/records/recordsTable.js

@@ -1,33 +1,33 @@
 import { randomUUID } from "node:crypto";
 import { withTransaction } from "../local_store/database.js";
-import { readMountDoor } from "./door.js";
 import { AGENT_DEFINITION_ID_VARIABLE, readVariable } from "./environment.js";
 export const SYNC_STATES = ["pending", "synced", "refused", "local"];
 export const PLACEMENTS = ["device", "server"];
 export const CREDENTIALS = ["device"];
-export const SYNCED_RETENTION_DAYS = 30;
 export const RECORDS_LIST_LIMIT = 200;
 export const OBLIGATION_AGENT_OWNED = "OBLIGATION_AGENT_OWNED";
+export const UNBOUND_PROJECT_PREFIX = "unbound:";
+export function unboundProjectId(root) {
+    return `${UNBOUND_PROJECT_PREFIX}${root}`;
+}
+export function rootOfUnbound(projectId) {
+    return projectId.startsWith(UNBOUND_PROJECT_PREFIX) ? projectId.slice(UNBOUND_PROJECT_PREFIX.length) : null;
+}
 function recordOf(row) {
+    const occurredAt = row.occurred_at;
     return {
         id: row.id,
         kind: row.kind,
         schemaVersion: row.schema_version,
-        projectId: row.project_id ?? null,
+        projectId: row.project_id,
         sessionId: row.session_id ?? null,
         planAnchor: row.plan_anchor ?? null,
         naturalKey: row.natural_key,
         idempotencyKey: row.idempotency_key,
         payloadJson: row.payload_json,
-        syncState: row.sync_state,
-        attempts: row.attempts,
-        nextAttemptAt: row.next_attempt_at ?? null,
-        lastError: row.last_error ?? null,
-        createdAt: row.created_at,
-        repositoryRoot: row.repository_root ?? null,
-        doorUrl: row.door_url ?? null,
-        placement: row.placement ?? null,
-        credential: row.credential ?? null,
+        writtenByKind: row.written_by_kind,
+        occurredAt,
+        createdAt: Date.parse(occurredAt),
     };
 }
 export function canonicalJson(value) {
@@ -50,6 +50,13 @@ export function syncStateFor(kind, payload, placement) {
         return "local";
     return "pending";
 }
+export function placementStateName(id) {
+    return `placement:${id}`;
+}
+export function storedPlacementOf(db, id) {
+    return db.prepare("SELECT 1 FROM sync_state WHERE name = ?").get(placementStateName(id)) !== undefined ? "device" : "server";
+}
+export const REFUSED_ERROR_PREFIX = "refused: ";
 export class AgentOwnedError extends Error {
     ownerAgentDefinitionId;
     naturalKey;
@@ -61,7 +68,7 @@ export class AgentOwnedError extends Error {
     }
 }
 export function findRecordByKey(db, idempotencyKey) {
-    const row = db.prepare("SELECT * FROM records WHERE idempotency_key = ?").get(idempotencyKey);
+    const row = db.prepare("SELECT * FROM harness_records WHERE idempotency_key = ?").get(idempotencyKey);
     return row ? recordOf(row) : null;
 }
 function checkAgentOwned(stored, write, env) {
@@ -77,190 +84,134 @@ function checkAgentOwned(stored, write, env) {
         return;
     throw new AgentOwnedError(write.naturalKey, owner);
 }
-function upsert(db, write, placement, syncState) {
-    db.prepare(`INSERT INTO records (id, kind, schema_version, project_id, session_id, plan_anchor, natural_key, idempotency_key,
-            payload_json, sync_state, attempts, next_attempt_at, last_error, created_at, repository_root, door_url,
-            placement, credential)
-         VALUES (:id, :kind, :schema_version, :project_id, :session_id, :plan_anchor, :natural_key, :idempotency_key,
-            :payload_json, :sync_state, 0, NULL, NULL, :created_at, :repository_root, NULL, :placement, :credential)
-         ON CONFLICT(idempotency_key) DO UPDATE SET
-            kind = excluded.kind, schema_version = excluded.schema_version, project_id = excluded.project_id,
-            session_id = excluded.session_id, plan_anchor = excluded.plan_anchor, natural_key = excluded.natural_key,
-            payload_json = excluded.payload_json, sync_state = excluded.sync_state, attempts = 0,
-            next_attempt_at = NULL, last_error = NULL, created_at = excluded.created_at,
-            repository_root = excluded.repository_root, door_url = excluded.door_url,
-            placement = records.placement, credential = excluded.credential`).run({
+function writtenByKindOf(write) {
+    return write.credential === "device" ? "agent" : "person";
+}
+function upsert(db, write) {
+    const row = db
+        .prepare(`INSERT INTO harness_records (id, project_id, kind, schema_version, natural_key, idempotency_key, session_id,
+                plan_anchor, payload_json, written_by_kind, occurred_at, created_at, updated_at)
+             VALUES (:id, :project_id, :kind, :schema_version, :natural_key, :idempotency_key, :session_id,
+                :plan_anchor, :payload_json, :written_by_kind, :occurred_at, datetime('now'), datetime('now'))
+             ON CONFLICT (project_id, idempotency_key) DO UPDATE SET
+                kind = excluded.kind, schema_version = excluded.schema_version, natural_key = excluded.natural_key,
+                session_id = excluded.session_id, plan_anchor = excluded.plan_anchor, payload_json = excluded.payload_json,
+                written_by_kind = excluded.written_by_kind, occurred_at = excluded.occurred_at, updated_at = datetime('now')
+             RETURNING id`)
+        .get({
         id: randomUUID(),
+        project_id: write.projectId ?? unboundProjectId(write.repositoryRoot ?? ""),
         kind: write.kind,
         schema_version: write.schemaVersion,
-        project_id: write.projectId,
-        session_id: write.sessionId,
-        plan_anchor: write.planAnchor,
         natural_key: write.naturalKey,
         idempotency_key: write.idempotencyKey,
+        session_id: write.sessionId,
+        plan_anchor: write.planAnchor,
         payload_json: JSON.stringify(write.payload),
-        sync_state: syncState,
-        created_at: write.createdAt,
-        repository_root: write.repositoryRoot,
-        placement,
-        credential: write.credential,
+        written_by_kind: writtenByKindOf(write),
+        occurred_at: new Date(write.createdAt).toISOString(),
     });
+    return row.id;
 }
 export function writeRecords(store, writes, env = process.env) {
     return withTransaction(store, (db) => writes.map((write) => {
         const stored = findRecordByKey(db, write.idempotencyKey);
         checkAgentOwned(stored, write, env);
-        const placement = stored ? stored.placement : write.placement;
+        const id = upsert(db, write);
+        const placement = stored ? storedPlacementOf(db, id) : write.placement;
+        if (!stored && placement === "device")
+            db.prepare("INSERT OR REPLACE INTO sync_state (name, value) VALUES (?, 'device')").run(placementStateName(id));
         const syncState = syncStateFor(write.kind, write.payload, placement);
-        upsert(db, write, placement, syncState);
+        if (syncState === "local")
+            db.prepare("DELETE FROM sync_outbox WHERE table_name = 'harness_records' AND row_key = ?").run(id);
         return { idempotencyKey: write.idempotencyKey, syncState };
     }));
 }
 export function releaseUnboundRows(store, root) {
     store.db
-        .prepare(`UPDATE records SET next_attempt_at = NULL
-             WHERE project_id IS NULL AND repository_root = ? AND sync_state = 'pending' AND next_attempt_at IS NOT NULL`)
-        .run(root);
-}
-export function selectDueRecords(store, now, canSendDevice) {
-    const rows = store.db
-        .prepare(`SELECT * FROM records
-             WHERE sync_state = 'pending' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-               AND (credential IS NULL OR ?)
-             ORDER BY created_at ASC, rowid ASC`)
-        .all(now, canSendDevice ? 1 : 0);
-    return rows.map(recordOf);
+        .prepare(`UPDATE sync_outbox SET next_attempt_at = NULL
+             WHERE table_name = 'harness_records' AND next_attempt_at IS NOT NULL
+               AND row_key IN (SELECT id FROM harness_records WHERE project_id = ?)`)
+        .run(unboundProjectId(root));
 }
-export function hasDueRecord(db, now, canSendDevice) {
-    return (db
-        .prepare(`SELECT 1 FROM records
-                 WHERE sync_state = 'pending' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-                   AND (credential IS NULL OR ?) LIMIT 1`)
-        .get(now, canSendDevice ? 1 : 0) !== undefined);
-}
-const CAS = `id = :id AND sync_state = 'pending' AND payload_json = :payload_json AND session_id IS :session_id
-    AND plan_anchor IS :plan_anchor AND created_at = :created_at`;
-function casParameters(row) {
-    return {
-        id: row.id,
-        payload_json: row.payloadJson,
-        session_id: row.sessionId,
-        plan_anchor: row.planAnchor,
-        created_at: row.createdAt,
-    };
-}
-export function markSynced(store, row) {
-    const result = store.db
-        .prepare(`UPDATE records SET sync_state = 'synced', last_error = NULL, next_attempt_at = NULL WHERE ${CAS}`)
-        .run(casParameters(row));
-    return Number(result.changes) > 0;
-}
-export function markRefused(store, row, error) {
-    const result = store.db
-        .prepare(`UPDATE records SET sync_state = 'refused', last_error = :last_error, next_attempt_at = NULL WHERE ${CAS}`)
-        .run({ ...casParameters(row), last_error: error });
-    return Number(result.changes) > 0;
-}
-export function markBackoff(store, row, error, nextAttemptAt) {
-    const result = store.db
-        .prepare(`UPDATE records SET attempts = attempts + 1, next_attempt_at = :next_attempt_at, last_error = :last_error WHERE ${CAS}`)
-        .run({ ...casParameters(row), last_error: error, next_attempt_at: nextAttemptAt });
-    return Number(result.changes) > 0;
-}
-export function markDeferred(store, row, nextAttemptAt) {
-    const result = store.db
-        .prepare(`UPDATE records SET next_attempt_at = :next_attempt_at WHERE ${CAS}`)
-        .run({ ...casParameters(row), next_attempt_at: nextAttemptAt });
-    return Number(result.changes) > 0;
+function dropUnpushed(db, id) {
+    db.prepare("DELETE FROM harness_records WHERE id = ?").run(id);
+    db.prepare("DELETE FROM sync_outbox WHERE table_name = 'harness_records' AND row_key = ?").run(id);
 }
 export function rekeyRecord(store, row, projectId) {
     const key = `${projectId}:${row.kind}:${row.naturalKey}`;
     return withTransaction(store, (db) => {
-        const current = db.prepare("SELECT * FROM records WHERE id = ?").get(row.id);
+        const current = db.prepare("SELECT * FROM harness_records WHERE id = ?").get(row.id);
         if (!current)
             return null;
-        const existing = findRecordByKey(db, key);
-        if (existing && existing.id !== row.id) {
-            if (existing.createdAt >= row.createdAt) {
-                db.prepare("DELETE FROM records WHERE id = ?").run(row.id);
+        const existing = db.prepare("SELECT * FROM harness_records WHERE project_id = ? AND idempotency_key = ?").get(projectId, key);
+        if (existing) {
+            const stored = recordOf(existing);
+            dropUnpushed(db, row.id);
+            if (stored.createdAt >= row.createdAt)
                 return null;
-            }
-            db.prepare("DELETE FROM records WHERE id = ?").run(existing.id);
+            db.prepare(`UPDATE harness_records SET kind = ?, schema_version = ?, natural_key = ?, session_id = ?, plan_anchor = ?,
+                    payload_json = ?, written_by_kind = ?, occurred_at = ?, updated_at = datetime('now') WHERE id = ?`).run(row.kind, row.schemaVersion, row.naturalKey, row.sessionId, row.planAnchor, row.payloadJson, row.writtenByKind, row.occurredAt, stored.id);
+            return recordOf(db.prepare("SELECT * FROM harness_records WHERE id = ?").get(stored.id));
         }
-        db.prepare("UPDATE records SET project_id = ?, idempotency_key = ? WHERE id = ?").run(projectId, key, row.id);
-        return recordOf(db.prepare("SELECT * FROM records WHERE id = ?").get(row.id));
+        db.prepare("UPDATE harness_records SET project_id = ?, idempotency_key = ?, updated_at = datetime('now') WHERE id = ?").run(projectId, key, row.id);
+        return recordOf(db.prepare("SELECT * FROM harness_records WHERE id = ?").get(row.id));
     });
 }
-export function pruneSynced(store, now) {
-    store.db
-        .prepare(`DELETE FROM records WHERE sync_state = 'synced' AND created_at < ?
-               AND NOT (kind = 'obligation' AND json_extract(payload_json, '$.state') = 'open')`)
-        .run(now - SYNCED_RETENTION_DAYS * 24 * 60 * 60 * 1000);
-}
+const VIEW_SELECT = `SELECT r.*, o.row_key AS outbox_key, o.attempts AS outbox_attempts, o.next_attempt_at AS outbox_next_attempt_at,
+    o.last_error AS outbox_last_error
+    FROM harness_records r LEFT JOIN sync_outbox o ON o.table_name = 'harness_records' AND o.row_key = r.id`;
 function viewOf(row) {
+    const stored = recordOf(row);
     let payload;
     try {
-        payload = JSON.parse(row.payloadJson);
+        payload = JSON.parse(stored.payloadJson);
     }
     catch {
-        payload = row.payloadJson;
+        payload = stored.payloadJson;
     }
+    const lastError = row.outbox_last_error ?? null;
+    const syncState = row.outbox_key !== null && row.outbox_key !== undefined
+        ? lastError?.startsWith(REFUSED_ERROR_PREFIX)
+            ? "refused"
+            : "pending"
+        : row.sync_seq !== null
+            ? "synced"
+            : "local";
+    const root = rootOfUnbound(stored.projectId);
     return {
-        id: row.id,
-        kind: row.kind,
-        projectId: row.projectId,
-        sessionId: row.sessionId,
-        planAnchor: row.planAnchor,
-        naturalKey: row.naturalKey,
-        idempotencyKey: row.idempotencyKey,
+        id: stored.id,
+        kind: stored.kind,
+        projectId: root === null ? stored.projectId : null,
+        sessionId: stored.sessionId,
+        planAnchor: stored.planAnchor,
+        naturalKey: stored.naturalKey,
+        idempotencyKey: stored.idempotencyKey,
         payload,
-        syncState: row.syncState,
-        attempts: row.attempts,
-        nextAttemptAt: row.nextAttemptAt,
-        lastError: row.lastError,
-        createdAt: row.createdAt,
-        repositoryRoot: row.repositoryRoot,
-        placement: row.placement,
-        credential: row.credential,
+        syncState,
+        attempts: Number(row.outbox_attempts ?? 0),
+        nextAttemptAt: row.outbox_next_attempt_at ?? null,
+        lastError,
+        createdAt: stored.createdAt,
+        repositoryRoot: root,
+        credential: stored.writtenByKind === "agent" ? "device" : null,
     };
 }
-export async function countRecords(store, projectId) {
-    const rows = (projectId
-        ? store.db.prepare("SELECT * FROM records WHERE sync_state <> 'synced' AND project_id = ?").all(projectId)
-        : store.db.prepare("SELECT * FROM records WHERE sync_state <> 'synced'").all());
-    const records = rows.map(recordOf);
-    const doorOff = new Map();
-    for (const row of records) {
-        if (row.syncState !== "pending" || row.projectId === null || row.doorUrl !== null || row.repositoryRoot === null)
-            continue;
-        if (!doorOff.has(row.repositoryRoot))
-            doorOff.set(row.repositoryRoot, (await readMountDoor(row.repositoryRoot)) === null);
-    }
-    const isDoorOff = (row) => row.doorUrl === null && row.repositoryRoot !== null && doorOff.get(row.repositoryRoot) === true;
-    let waitingCount = 0;
-    let refusedWithProject = 0;
-    let storeCount = 0;
-    for (const row of records) {
-        if (row.syncState === "refused" && row.projectId !== null)
-            refusedWithProject += 1;
-        if (row.syncState !== "pending")
-            continue;
-        if (row.projectId === null || isDoorOff(row))
-            storeCount += 1;
-        else
-            waitingCount += 1;
-    }
-    const outboxCount = waitingCount + refusedWithProject;
-    const newest = records
-        .filter((row) => (row.syncState === "pending" || row.syncState === "refused") && row.lastError !== null)
-        .sort((a, b) => b.createdAt - a.createdAt)[0];
+export function countRecords(store, projectId) {
+    const where = `WHERE (o.row_key IS NOT NULL OR r.sync_seq IS NULL)${projectId ? " AND r.project_id = ?" : ""}`;
+    const rows = (projectId ? store.db.prepare(`${VIEW_SELECT} ${where}`).all(projectId) : store.db.prepare(`${VIEW_SELECT} ${where}`).all());
+    const views = rows.map(viewOf);
+    const isBound = (view) => view.repositoryRoot === null;
+    const waitingCount = views.filter((view) => view.syncState === "pending" && isBound(view)).length;
+    const refusedWithProject = views.filter((view) => view.syncState === "refused" && isBound(view)).length;
+    const newest = views.filter((view) => view.lastError !== null).sort((a, b) => b.createdAt - a.createdAt)[0];
     return {
-        outboxCount,
-        storeCount,
+        outboxCount: waitingCount + refusedWithProject,
+        storeCount: views.filter((view) => view.syncState === "pending" && !isBound(view)).length,
         lastError: newest?.lastError ?? null,
-        pendingCount: records.filter((row) => row.syncState === "pending").length,
-        refusedCount: records.filter((row) => row.syncState === "refused").length,
-        localCount: records.filter((row) => row.syncState === "local").length,
+        pendingCount: views.filter((view) => view.syncState === "pending").length,
+        refusedCount: views.filter((view) => view.syncState === "refused").length,
+        localCount: views.filter((view) => view.syncState === "local").length,
         waitingCount,
     };
 }
@@ -268,20 +219,27 @@ export function listRecords(store, filter = {}) {
     const clauses = [];
     const parameters = [];
     if (filter.projectId) {
-        clauses.push("project_id = ?");
+        clauses.push("r.project_id = ?");
         parameters.push(filter.projectId);
     }
     if (filter.kind) {
-        clauses.push("kind = ?");
+        clauses.push("r.kind = ?");
         parameters.push(filter.kind);
     }
     if (filter.planAnchor) {
-        clauses.push("plan_anchor = ?");
+        clauses.push("r.plan_anchor = ?");
         parameters.push(filter.planAnchor);
     }
     const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
     const rows = store.db
-        .prepare(`SELECT * FROM records ${where} ORDER BY created_at DESC, rowid DESC LIMIT ${RECORDS_LIST_LIMIT}`)
+        .prepare(`${VIEW_SELECT} ${where} ORDER BY r.occurred_at DESC, r.rowid DESC LIMIT ${RECORDS_LIST_LIMIT}`)
         .all(...parameters);
-    return rows.map(recordOf).map(viewOf);
+    return rows.map(viewOf);
+}
+export function selectUnboundRecords(db) {
+    const rows = db
+        .prepare(`SELECT r.* FROM harness_records r JOIN sync_outbox o ON o.table_name = 'harness_records' AND o.row_key = r.id
+             WHERE r.project_id LIKE '${UNBOUND_PROJECT_PREFIX}%' ORDER BY r.occurred_at, r.rowid`)
+        .all();
+    return rows.map(recordOf);
 }

package/dist/lib/records/refusalLog.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { RECORD_SCHEMA_VERSION } from "./door.js";
+import { RECORD_SCHEMA_VERSION } from "./kinds.js";
 import { idempotencyKeyOf } from "./naturalKey.js";
-import { writeRecords } from "./recordsTable.js";
+import { UNBOUND_PROJECT_PREFIX, writeRecords } from "./recordsTable.js";
 export const REFUSAL_GATE_IDS = [
     "records-validation",
     "records-unknown-kind",
@@ -69,19 +69,19 @@ export function countRefusals(store, filter) {
     const ids = REFUSAL_GATE_IDS.map(() => "?").join(", ");
     const clauses = [
         "kind = 'gate_event'",
-        "project_id IS ?",
+        filter.projectId === null ? `project_id LIKE '${UNBOUND_PROJECT_PREFIX}%'` : "project_id = ?",
         `json_extract(payload_json, '$.gate') IN (${ids})`,
         "json_extract(payload_json, '$.verdict') = ?",
     ];
-    const parameters = [filter.projectId, ...REFUSAL_GATE_IDS, filter.verdict ?? "block"];
+    const parameters = [...(filter.projectId === null ? [] : [filter.projectId]), ...REFUSAL_GATE_IDS, filter.verdict ?? "block"];
     if (filter.sessionId !== undefined) {
         clauses.push("session_id = ?");
         parameters.push(filter.sessionId);
     }
     if (filter.since !== undefined) {
-        clauses.push("created_at >= ?");
-        parameters.push(filter.since);
+        clauses.push("occurred_at >= ?");
+        parameters.push(new Date(filter.since).toISOString());
     }
-    const row = store.db.prepare(`SELECT count(*) AS n FROM records WHERE ${clauses.join(" AND ")}`).get(...parameters);
+    const row = store.db.prepare(`SELECT count(*) AS n FROM harness_records WHERE ${clauses.join(" AND ")}`).get(...parameters);
     return Number(row.n);
 }

package/dist/lib/sessions/brief.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { ensureAccessToken } from "../auth_grant.js";
 import { briefCachePath } from "../local_store/paths.js";
 import { assertCredentialOrigin } from "../nustack_client.js";
-import { resolveDoor } from "../records/door.js";
+import { resolveDoor } from "../sync/endpoint.js";
 export const BRIEF_FETCH_TIMEOUT_MS = 3_000;
 export const BRIEF_CONTEXT_CAP = 4_000;
 export const BRIEF_CONTEXT_OBLIGATIONS = 20;

package/dist/lib/sessions/sessionEvents.js

@@ -2,8 +2,8 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSyn
 import path from "node:path";
 import { ensureAccessToken } from "../auth_grant.js";
 import { sessionEventsDir } from "../local_store/paths.js";
-import { labelRowWire, listPendingLabelRows, markLabelRowsRefused, markLabelRowsSynced } from "../local_store/routing.js";
-import { RECORDS_BATCH_CAP, resolveDoor } from "../records/door.js";
+import { RECORDS_BATCH_CAP } from "../records/kinds.js";
+import { resolveDoor } from "../sync/endpoint.js";
 import { makeSessionsClient, postSessionEvents } from "./client.js";
 export const SESSION_SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 const SESSION_DRAIN_PASSES = 3;
@@ -120,52 +120,9 @@ export async function drainSessionEvents(globals, result, bearers = new Map()) {
         }
     }
 }
-function spoolOf(sessionId, spools) {
+export function spoolOf(sessionId, spools) {
     return spools.find((spool) => spool.rowId === sessionId) ?? spools.find((spool) => spool.runtimeSessionId === sessionId) ?? null;
 }
-export async function drainLabelRows(store, globals, result, bearers = new Map(), now = Date.now()) {
-    const rows = listPendingLabelRows(store, RECORDS_BATCH_CAP);
-    if (rows.length === 0)
-        return;
-    const spools = listSpools();
-    const groups = new Map();
-    const stale = [];
-    for (const record of rows) {
-        const spool = spoolOf(record.session_id, spools);
-        if (!spool) {
-            if (now - record.created_at > SESSION_SPOOL_RETENTION_MS)
-                stale.push(record.id);
-            continue;
-        }
-        const key = `${spool.root}\u0000${spool.projectId}`;
-        const group = groups.get(key) ?? { spool, rows: [] };
-        group.rows.push({ record, wire: { ...labelRowWire(record), sessionId: spool.rowId } });
-        groups.set(key, group);
-    }
-    if (stale.length > 0)
-        result.labelRowsRefused += markLabelRowsRefused(store, stale);
-    for (const { spool, rows: batch } of groups.values()) {
-        const door = await doorFor(spool.root, globals, bearers);
-        if (!door)
-            continue;
-        const request = { events: [], labelRows: batch.map((row) => row.wire) };
-        const outcome = await postSessionEvents(door.doorUrl, door.bearer, spool.projectId, request);
-        if (outcome.ok) {
-            result.labelRowsSynced += markLabelRowsSynced(store, batch.map((row) => row.record.id));
-            continue;
-        }
-        result.lastError = outcome.message;
-        if (!isRefusal(outcome))
-            continue;
-        for (const row of batch) {
-            const alone = await postSessionEvents(door.doorUrl, door.bearer, spool.projectId, { events: [], labelRows: [row.wire] });
-            if (alone.ok)
-                result.labelRowsSynced += markLabelRowsSynced(store, [row.record.id]);
-            else if (isRefusal(alone))
-                result.labelRowsRefused += markLabelRowsRefused(store, [row.record.id]);
-        }
-    }
-}
 export function pruneSpools(now = Date.now()) {
     let pruned = 0;
     for (const spool of listSpools()) {
@@ -182,8 +139,8 @@ export function pruneSpools(now = Date.now()) {
     }
     return pruned;
 }
-export async function drainSessionLegs(store, globals) {
-    const result = { eventsSent: 0, eventsDropped: 0, closed: 0, labelRowsSynced: 0, labelRowsRefused: 0, lastError: null };
+export async function drainSessionLegs(globals) {
+    const result = { eventsSent: 0, eventsDropped: 0, closed: 0, lastError: null };
     const bearers = new Map();
     try {
         for (let pass = 0; pass < SESSION_DRAIN_PASSES; pass += 1) {
@@ -193,7 +150,6 @@ export async function drainSessionLegs(store, globals) {
             if (isIdle || result.eventsSent + result.eventsDropped + result.closed === before)
                 break;
         }
-        await drainLabelRows(store, globals, result, bearers);
         pruneSpools();
     }
     catch (error) {

package/dist/lib/store/open.js

@@ -0,0 +1,136 @@
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { chmod } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { mkdirSecure } from "../secure_file.js";
+import { nustackHomeDir } from "../local_store/paths.js";
+import { StoreTooNewError, versionVerdict, wipeStaleStore } from "./wipe.js";
+export function machineStorePath(home = os.homedir()) {
+    return path.join(home, ".nustack", "nustack.db");
+}
+export function databaseFiles(dbFile) {
+    return [dbFile, `${dbFile}-wal`, `${dbFile}-shm`];
+}
+export function storeStampOf(version) {
+    const match = /^v?(\d+)\.(\d+)/.exec(version.trim());
+    if (!match)
+        throw new Error(`not a release number: ${version}`);
+    return Number(match[1]) * 1000 + Number(match[2]);
+}
+let cliVersionCache;
+export function cliVersion() {
+    cliVersionCache ??= JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf8")).version;
+    return cliVersionCache;
+}
+let schemaCache;
+function machineSchemaSql() {
+    schemaCache ??= readFileSync(new URL("../../../dist/machine.sql", import.meta.url), "utf8");
+    return schemaCache;
+}
+let sqliteModulePromise;
+export async function withSuppressedSqliteWarning(fn) {
+    const original = process.emitWarning;
+    const filtered = (warning, ...args) => {
+        const name = warning instanceof Error
+            ? warning.name
+            : typeof args[0] === "string"
+                ? args[0]
+                : args[0]?.type;
+        const message = warning instanceof Error ? warning.message : String(warning);
+        if (name === "ExperimentalWarning" && /sqlite/i.test(message))
+            return;
+        original(warning, ...args);
+    };
+    process.emitWarning = filtered;
+    try {
+        return await fn();
+    }
+    finally {
+        process.emitWarning = original;
+    }
+}
+export async function openSqliteFile(dbFile, options = {}) {
+    sqliteModulePromise ??= withSuppressedSqliteWarning(() => import("node:sqlite"));
+    const { DatabaseSync } = await sqliteModulePromise;
+    return new DatabaseSync(dbFile, options.readOnly ? { readOnly: true } : {});
+}
+function userVersionOf(db) {
+    const row = db.prepare("PRAGMA user_version").get();
+    return Number(row?.user_version ?? 0);
+}
+function retireReplacedStores() {
+    for (const file of databaseFiles(path.join(nustackHomeDir(), "state.db"))) {
+        try {
+            rmSync(file, { force: true });
+        }
+        catch {
+        }
+    }
+}
+function settleSchema(db, stamp) {
+    if (userVersionOf(db) === stamp)
+        return true;
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        const found = userVersionOf(db);
+        const tableCount = Number(db.prepare("SELECT count(*) AS n FROM sqlite_master").get().n);
+        if (found === 0 && tableCount === 0) {
+            db.exec(machineSchemaSql());
+            db.exec(`PRAGMA user_version = ${stamp}`);
+            db.exec("COMMIT");
+            return true;
+        }
+        db.exec("ROLLBACK");
+        const verdict = versionVerdict(found, stamp);
+        if (verdict === "same")
+            return true;
+        if (verdict === "newer")
+            throw new StoreTooNewError(found, stamp);
+        return false;
+    }
+    catch (error) {
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+        }
+        throw error;
+    }
+}
+export async function openMachineDatabase(dbFile = machineStorePath()) {
+    retireReplacedStores();
+    await mkdirSecure(path.dirname(dbFile));
+    const stamp = storeStampOf(cliVersion());
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const db = await withSuppressedSqliteWarning(() => openSqliteFile(dbFile));
+        try {
+            db.exec("PRAGMA busy_timeout = 5000");
+            db.exec("PRAGMA journal_mode = WAL");
+            db.exec("PRAGMA foreign_keys = OFF");
+            if (settleSchema(db, stamp)) {
+                await chmod(dbFile, 0o600).catch(() => { });
+                return db;
+            }
+        }
+        catch (error) {
+            db.close();
+            throw error;
+        }
+        await wipeStaleStore(db, dbFile);
+    }
+    throw new Error(`the machine store at ${dbFile} could not be recreated`);
+}
+export async function openMachineDatabaseReadOnly(dbFile = machineStorePath()) {
+    if (!existsSync(dbFile))
+        return null;
+    const db = await withSuppressedSqliteWarning(() => openSqliteFile(dbFile, { readOnly: true }));
+    try {
+        db.exec("PRAGMA busy_timeout = 2000");
+        if (userVersionOf(db) === storeStampOf(cliVersion()))
+            return db;
+    }
+    catch {
+    }
+    db.close();
+    return null;
+}