@runwingman/flightdeck-cli 0.2.0

package/src/sync.js

@@ -0,0 +1,900 @@
+import { getAllWorkspaceKeyMappings, getMeta, getRows, openDb, putMeta, replaceGroupKeys, replaceGroups, upsertAppSchemas, upsertRows, upsertWorkspaceKeyMapping } from './db.js';
+import {
+  decryptAppSchemaManifest,
+  decryptRecordPayload,
+  inboundApproval,
+  inboundAudioNote,
+  inboundChannel,
+  inboundChatMessage,
+  inboundComment,
+  inboundDirectory,
+  inboundDocument,
+  inboundFlow,
+  inboundGroup,
+  inboundReport,
+  inboundReaction,
+  inboundSchedule,
+  inboundScope,
+  inboundTask,
+  loadGroupKeyMap,
+  recordFamilyHash,
+} from './translators.js';
+import { decodeNsec, getSession } from './nostr.js';
+
+export const FAMILY_TABLES = [
+  { collection: 'channel', table: 'channels', mapper: inboundChannel },
+  { collection: 'chat_message', table: 'messages', mapper: inboundChatMessage },
+  { collection: 'directory', table: 'directories', mapper: inboundDirectory },
+  { collection: 'document', table: 'documents', mapper: inboundDocument },
+  { collection: 'report', table: 'reports', mapper: inboundReport },
+  { collection: 'task', table: 'tasks', mapper: inboundTask },
+  { collection: 'comment', table: 'comments', mapper: inboundComment },
+  { collection: 'reaction', table: 'reactions', mapper: inboundReaction },
+  { collection: 'audio_note', table: 'audio_notes', mapper: inboundAudioNote },
+  { collection: 'scope', table: 'scopes', mapper: inboundScope },
+  { collection: 'schedule', table: 'schedules', mapper: inboundSchedule },
+  { collection: 'flow', table: 'flows', mapper: inboundFlow },
+  { collection: 'approval', table: 'approvals', mapper: inboundApproval },
+];
+
+const GROUP_BEARING_TABLES = [
+  'channels',
+  'tasks',
+  'documents',
+  'directories',
+  'reports',
+  'audio_notes',
+  'scopes',
+  'schedules',
+  'flows',
+  'approvals',
+];
+
+const LOCAL_ACCESS_REPAIR_TABLES = [
+  { table: 'channels', hasShares: false, hasBoardGroup: false },
+  { table: 'tasks', hasShares: true, hasBoardGroup: true },
+  { table: 'documents', hasShares: true, hasBoardGroup: false },
+  { table: 'directories', hasShares: true, hasBoardGroup: false },
+  { table: 'reports', hasShares: false, hasBoardGroup: false },
+  { table: 'audio_notes', hasShares: false, hasBoardGroup: false },
+  { table: 'scopes', hasShares: true, hasBoardGroup: false },
+  { table: 'schedules', hasShares: true, hasBoardGroup: false },
+  { table: 'flows', hasShares: true, hasBoardGroup: false },
+  { table: 'approvals', hasShares: true, hasBoardGroup: false },
+];
+
+function json(value) {
+  return JSON.stringify(value ?? null);
+}
+
+function newerIsoTimestamp(current, candidate) {
+  const currentTs = Date.parse(current || '');
+  const candidateTs = Date.parse(candidate || '');
+  if (!Number.isFinite(candidateTs)) return current || null;
+  if (!Number.isFinite(currentTs) || candidateTs > currentTs) return candidate;
+  return current || null;
+}
+
+function parseJsonArray(value) {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+function buildAccessibleGroupRefs(groups, keyRows, viewerNpub, workspaceOwnerNpub) {
+  if (viewerNpub === workspaceOwnerNpub) return null;
+
+  const accessible = new Set();
+  for (const group of groups) {
+    for (const ref of [group.group_id, group.current_group_npub, group.group_npub]) {
+      if (ref) accessible.add(ref);
+    }
+  }
+  for (const key of keyRows) {
+    for (const ref of [key.group_id, key.group_npub]) {
+      if (ref) accessible.add(ref);
+    }
+  }
+  return accessible;
+}
+
+function buildCanonicalGroupMaps(groups, keyRows) {
+  const canonicalGroupIdByRef = new Map();
+  const currentGroupNpubById = new Map();
+
+  for (const group of groups || []) {
+    const stableGroupId = String(group?.group_id || '').trim();
+    const currentGroupNpub = String(group?.current_group_npub || group?.group_npub || '').trim();
+    if (!stableGroupId) continue;
+    canonicalGroupIdByRef.set(stableGroupId, stableGroupId);
+    if (currentGroupNpub) canonicalGroupIdByRef.set(currentGroupNpub, stableGroupId);
+    currentGroupNpubById.set(stableGroupId, currentGroupNpub || null);
+  }
+
+  for (const keyRow of keyRows || []) {
+    const stableGroupId = String(keyRow?.group_id || '').trim();
+    const groupNpub = String(keyRow?.group_npub || '').trim();
+    if (stableGroupId) canonicalGroupIdByRef.set(stableGroupId, stableGroupId);
+    if (groupNpub && stableGroupId) canonicalGroupIdByRef.set(groupNpub, stableGroupId);
+    if (stableGroupId && groupNpub && !currentGroupNpubById.has(stableGroupId)) {
+      currentGroupNpubById.set(stableGroupId, groupNpub);
+    }
+  }
+
+  return {
+    canonicalGroupIdByRef,
+    currentGroupNpubById,
+  };
+}
+
+function sanitizeGroupIds(groupIds, canonicalGroupIdByRef, accessibleGroupRefs) {
+  const sanitized = [];
+  const seen = new Set();
+
+  for (const value of groupIds || []) {
+    const ref = String(value || '').trim();
+    if (!ref) continue;
+    const stableGroupId = canonicalGroupIdByRef.get(ref) || ref;
+    if (accessibleGroupRefs && !accessibleGroupRefs.has(ref) && !accessibleGroupRefs.has(stableGroupId)) {
+      continue;
+    }
+    if (seen.has(stableGroupId)) continue;
+    seen.add(stableGroupId);
+    sanitized.push(stableGroupId);
+  }
+
+  return sanitized;
+}
+
+function sanitizeShares(shares, canonicalGroupIdByRef, currentGroupNpubById, accessibleGroupRefs) {
+  const sanitized = [];
+  const seen = new Set();
+
+  for (const share of shares || []) {
+    if (!share || typeof share !== 'object') continue;
+    const nextShare = { ...share };
+
+    const groupRef = String(
+      nextShare.group_id
+      || nextShare.group_npub
+      || nextShare.key
+      || '',
+    ).trim();
+    if (groupRef) {
+      const stableGroupId = canonicalGroupIdByRef.get(groupRef) || groupRef;
+      if (accessibleGroupRefs && !accessibleGroupRefs.has(groupRef) && !accessibleGroupRefs.has(stableGroupId)) {
+        continue;
+      }
+      nextShare.key = stableGroupId;
+      nextShare.group_id = stableGroupId;
+      nextShare.group_npub = currentGroupNpubById.get(stableGroupId) || nextShare.group_npub || null;
+    }
+
+    const viaGroupRef = String(
+      nextShare.via_group_id
+      || nextShare.via_group_npub
+      || '',
+    ).trim();
+    if (viaGroupRef) {
+      const stableViaGroupId = canonicalGroupIdByRef.get(viaGroupRef) || viaGroupRef;
+      if (accessibleGroupRefs && !accessibleGroupRefs.has(viaGroupRef) && !accessibleGroupRefs.has(stableViaGroupId)) {
+        continue;
+      }
+      nextShare.via_group_id = stableViaGroupId;
+      nextShare.via_group_npub = currentGroupNpubById.get(stableViaGroupId) || nextShare.via_group_npub || null;
+    }
+
+    const signature = JSON.stringify([
+      nextShare.type || '',
+      nextShare.access || '',
+      nextShare.person_npub || '',
+      nextShare.group_id || '',
+      nextShare.via_group_id || '',
+      nextShare.inherited === true,
+      nextShare.inherited_from_directory_id || '',
+    ]);
+    if (seen.has(signature)) continue;
+    seen.add(signature);
+    sanitized.push(nextShare);
+  }
+
+  return sanitized;
+}
+
+function repairLocalAccessMetadata(db, { viewerNpub, workspaceOwnerNpub, groups, keyRows }) {
+  const accessibleGroupRefs = buildAccessibleGroupRefs(groups, keyRows, viewerNpub, workspaceOwnerNpub);
+  if (accessibleGroupRefs === null) {
+    return { repaired: 0 };
+  }
+
+  const { canonicalGroupIdByRef, currentGroupNpubById } = buildCanonicalGroupMaps(groups, keyRows);
+  let repaired = 0;
+
+  for (const tableConfig of LOCAL_ACCESS_REPAIR_TABLES) {
+    const rows = getRows(
+      db,
+      `SELECT * FROM ${tableConfig.table} WHERE record_state != 'deleted'`,
+    );
+    if (rows.length === 0) continue;
+
+    const updates = [];
+    for (const row of rows) {
+      const raw = row?.raw_json ? JSON.parse(row.raw_json) : {};
+      const nextRaw = { ...raw };
+      let changed = false;
+
+      const currentGroupIds = Array.isArray(raw?.group_ids)
+        ? raw.group_ids
+        : parseJsonArray(row.group_ids_json);
+      const nextGroupIds = sanitizeGroupIds(currentGroupIds, canonicalGroupIdByRef, accessibleGroupRefs);
+      if (JSON.stringify(nextGroupIds) !== JSON.stringify(currentGroupIds)) changed = true;
+      nextRaw.group_ids = nextGroupIds;
+
+      let nextSharesJson = null;
+      if (tableConfig.hasShares) {
+        const currentShares = Array.isArray(raw?.shares)
+          ? raw.shares
+          : parseJsonArray(row.shares_json);
+        const nextShares = sanitizeShares(currentShares, canonicalGroupIdByRef, currentGroupNpubById, accessibleGroupRefs);
+        if (JSON.stringify(nextShares) !== JSON.stringify(currentShares)) changed = true;
+        nextRaw.shares = nextShares;
+        nextSharesJson = json(nextShares);
+      }
+
+      let nextBoardGroupId = null;
+      if (tableConfig.hasBoardGroup) {
+        const currentBoardGroupId = String(raw?.board_group_id || row.board_group_id || '').trim();
+        const resolvedBoardGroupId = currentBoardGroupId
+          ? (canonicalGroupIdByRef.get(currentBoardGroupId) || currentBoardGroupId)
+          : null;
+        nextBoardGroupId = resolvedBoardGroupId && nextGroupIds.includes(resolvedBoardGroupId)
+          ? resolvedBoardGroupId
+          : (nextGroupIds[0] || null);
+        if ((currentBoardGroupId || null) !== nextBoardGroupId) changed = true;
+        nextRaw.board_group_id = nextBoardGroupId;
+      }
+
+      if (!changed) continue;
+      updates.push({
+        record_id: row.record_id,
+        group_ids_json: json(nextGroupIds),
+        shares_json: nextSharesJson,
+        board_group_id: nextBoardGroupId,
+        raw_json: json(nextRaw),
+      });
+    }
+
+    if (updates.length === 0) continue;
+    repaired += updates.length;
+
+    if (tableConfig.hasShares && tableConfig.hasBoardGroup) {
+      const stmt = db.prepare(`
+        UPDATE ${tableConfig.table}
+        SET group_ids_json = ?,
+            shares_json = ?,
+            board_group_id = ?,
+            raw_json = ?
+        WHERE record_id = ?
+      `);
+      const tx = db.transaction((items) => {
+        for (const item of items) {
+          stmt.run(item.group_ids_json, item.shares_json, item.board_group_id, item.raw_json, item.record_id);
+        }
+      });
+      tx(updates);
+      continue;
+    }
+
+    if (tableConfig.hasShares) {
+      const stmt = db.prepare(`
+        UPDATE ${tableConfig.table}
+        SET group_ids_json = ?,
+            shares_json = ?,
+            raw_json = ?
+        WHERE record_id = ?
+      `);
+      const tx = db.transaction((items) => {
+        for (const item of items) {
+          stmt.run(item.group_ids_json, item.shares_json, item.raw_json, item.record_id);
+        }
+      });
+      tx(updates);
+      continue;
+    }
+
+    if (tableConfig.hasBoardGroup) {
+      const stmt = db.prepare(`
+        UPDATE ${tableConfig.table}
+        SET group_ids_json = ?,
+            board_group_id = ?,
+            raw_json = ?
+        WHERE record_id = ?
+      `);
+      const tx = db.transaction((items) => {
+        for (const item of items) {
+          stmt.run(item.group_ids_json, item.board_group_id, item.raw_json, item.record_id);
+        }
+      });
+      tx(updates);
+      continue;
+    }
+
+    const stmt = db.prepare(`
+      UPDATE ${tableConfig.table}
+      SET group_ids_json = ?,
+          raw_json = ?
+      WHERE record_id = ?
+    `);
+    const tx = db.transaction((items) => {
+      for (const item of items) {
+        stmt.run(item.group_ids_json, item.raw_json, item.record_id);
+      }
+    });
+    tx(updates);
+  }
+
+  return { repaired };
+}
+
+function pruneInaccessibleRows(db, { viewerNpub, workspaceOwnerNpub, groups, keyRows }) {
+  const accessibleGroupRefs = buildAccessibleGroupRefs(groups, keyRows, viewerNpub, workspaceOwnerNpub);
+  if (accessibleGroupRefs === null) {
+    return { pruned: 0 };
+  }
+
+  let totalPruned = 0;
+  const prunedRecordIds = new Set();
+  const prunedChannelIds = new Set();
+
+  for (const tableName of GROUP_BEARING_TABLES) {
+    const rows = getRows(
+      db,
+      `SELECT record_id, group_ids_json FROM ${tableName} WHERE record_state != 'deleted'`,
+    );
+    const toDelete = rows
+      .filter((row) => {
+        const groupIds = parseJsonArray(row.group_ids_json);
+        if (groupIds.length === 0) return false;
+        return !groupIds.some((groupId) => accessibleGroupRefs.has(groupId));
+      })
+      .map((row) => row.record_id)
+      .filter(Boolean);
+
+    if (toDelete.length === 0) continue;
+
+    const stmt = db.prepare(`DELETE FROM ${tableName} WHERE record_id = ?`);
+    const tx = db.transaction((recordIds) => {
+      for (const recordId of recordIds) stmt.run(recordId);
+    });
+    tx(toDelete);
+
+    totalPruned += toDelete.length;
+    for (const recordId of toDelete) {
+      prunedRecordIds.add(recordId);
+      if (tableName === 'channels') prunedChannelIds.add(recordId);
+    }
+  }
+
+  if (prunedChannelIds.size > 0) {
+    const channelLookup = new Set(prunedChannelIds);
+    const toDelete = getRows(
+      db,
+      `SELECT record_id, channel_id FROM messages WHERE record_state != 'deleted'`,
+    )
+      .filter((row) => channelLookup.has(row.channel_id))
+      .map((row) => row.record_id)
+      .filter(Boolean);
+    if (toDelete.length > 0) {
+      const stmt = db.prepare(`DELETE FROM messages WHERE record_id = ?`);
+      const tx = db.transaction((recordIds) => {
+        for (const recordId of recordIds) stmt.run(recordId);
+      });
+      tx(toDelete);
+      totalPruned += toDelete.length;
+      for (const recordId of toDelete) prunedRecordIds.add(recordId);
+    }
+  }
+
+  if (prunedRecordIds.size > 0) {
+    const targetLookup = new Set(prunedRecordIds);
+    const toDelete = getRows(
+      db,
+      `SELECT record_id, target_record_id FROM comments WHERE record_state != 'deleted'`,
+    )
+      .filter((row) => targetLookup.has(row.target_record_id))
+      .map((row) => row.record_id)
+      .filter(Boolean);
+    if (toDelete.length > 0) {
+      const stmt = db.prepare(`DELETE FROM comments WHERE record_id = ?`);
+      const tx = db.transaction((recordIds) => {
+        for (const recordId of recordIds) stmt.run(recordId);
+      });
+      tx(toDelete);
+      totalPruned += toDelete.length;
+      for (const recordId of toDelete) prunedRecordIds.add(recordId);
+    }
+  }
+
+  if (prunedRecordIds.size > 0) {
+    const targetLookup = new Set(prunedRecordIds);
+    const toDelete = getRows(
+      db,
+      `SELECT record_id, target_record_id FROM reactions WHERE record_state != 'deleted'`,
+    )
+      .filter((row) => targetLookup.has(row.target_record_id))
+      .map((row) => row.record_id)
+      .filter(Boolean);
+    if (toDelete.length > 0) {
+      const stmt = db.prepare(`DELETE FROM reactions WHERE record_id = ?`);
+      const tx = db.transaction((recordIds) => {
+        for (const recordId of recordIds) stmt.run(recordId);
+      });
+      tx(toDelete);
+      totalPruned += toDelete.length;
+    }
+  }
+
+  return { pruned: totalPruned };
+}
+
+function rowForTable(table, mapped, rawRecord) {
+  const common = {
+    raw_json: json(mapped),
+  };
+  switch (table) {
+    case 'channels':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        group_ids_json: json(mapped.group_ids),
+        participant_npubs_json: json(mapped.participant_npubs),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'messages':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        channel_id: mapped.channel_id,
+        parent_message_id: mapped.parent_message_id,
+        body: mapped.body,
+        attachments_json: json(mapped.attachments),
+        sender_npub: mapped.sender_npub,
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'tasks':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        description: mapped.description,
+        state: mapped.state,
+        priority: mapped.priority,
+        assigned_to_npub: mapped.assigned_to_npub,
+        parent_task_id: mapped.parent_task_id,
+        board_group_id: mapped.board_group_id,
+        scheduled_for: mapped.scheduled_for,
+        tags: mapped.tags,
+        scope_id: mapped.scope_id,
+        scope_l1_id: mapped.scope_l1_id,
+        scope_l2_id: mapped.scope_l2_id,
+        scope_l3_id: mapped.scope_l3_id,
+        scope_l4_id: mapped.scope_l4_id,
+        scope_l5_id: mapped.scope_l5_id,
+        predecessor_task_ids_json: json(mapped.predecessor_task_ids),
+        flow_id: mapped.flow_id ?? null,
+        flow_run_id: mapped.flow_run_id ?? null,
+        flow_step: mapped.flow_step ?? null,
+        references_json: json(mapped.references),
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'comments':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        target_record_id: mapped.target_record_id,
+        target_record_family_hash: mapped.target_record_family_hash,
+        parent_comment_id: mapped.parent_comment_id,
+        anchor_line_number: mapped.anchor_line_number,
+        comment_status: mapped.comment_status,
+        body: mapped.body,
+        attachments_json: json(mapped.attachments),
+        sender_npub: mapped.sender_npub,
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'reactions':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        target_record_id: mapped.target_record_id,
+        target_record_family_hash: mapped.target_record_family_hash,
+        emoji: mapped.emoji,
+        emoji_shortcode: mapped.emoji_shortcode,
+        reactor_npub: mapped.reactor_npub,
+        sender_npub: mapped.sender_npub,
+        record_state: mapped.record_state,
+        version: mapped.version,
+        created_at: mapped.created_at,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'documents':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        content: mapped.content,
+        parent_directory_id: mapped.parent_directory_id,
+        scope_id: mapped.scope_id,
+        scope_l1_id: mapped.scope_l1_id,
+        scope_l2_id: mapped.scope_l2_id,
+        scope_l3_id: mapped.scope_l3_id,
+        scope_l4_id: mapped.scope_l4_id,
+        scope_l5_id: mapped.scope_l5_id,
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'directories':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        parent_directory_id: mapped.parent_directory_id,
+        scope_id: mapped.scope_id,
+        scope_l1_id: mapped.scope_l1_id,
+        scope_l2_id: mapped.scope_l2_id,
+        scope_l3_id: mapped.scope_l3_id,
+        scope_l4_id: mapped.scope_l4_id,
+        scope_l5_id: mapped.scope_l5_id,
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'reports':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        declaration_type: mapped.declaration_type,
+        surface: mapped.surface,
+        generated_at: mapped.generated_at,
+        payload_json: json(mapped.payload),
+        scope_id: mapped.scope_id,
+        scope_level: mapped.scope_level,
+        scope_l1_id: mapped.scope_l1_id,
+        scope_l2_id: mapped.scope_l2_id,
+        scope_l3_id: mapped.scope_l3_id,
+        scope_l4_id: mapped.scope_l4_id,
+        scope_l5_id: mapped.scope_l5_id,
+        group_ids_json: json(mapped.group_ids),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'audio_notes':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        target_record_id: mapped.target_record_id,
+        target_record_family_hash: mapped.target_record_family_hash,
+        title: mapped.title,
+        storage_object_id: mapped.storage_object_id,
+        mime_type: mapped.mime_type,
+        duration_seconds: mapped.duration_seconds,
+        size_bytes: mapped.size_bytes ?? 0,
+        media_encryption_json: json(mapped.media_encryption),
+        waveform_preview_json: json(mapped.waveform_preview),
+        transcript_status: mapped.transcript_status,
+        transcript_preview: mapped.transcript_preview,
+        transcript: mapped.transcript,
+        summary: mapped.summary,
+        sender_npub: mapped.sender_npub ?? null,
+        group_ids_json: json(mapped.group_ids),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'scopes':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        level: mapped.level,
+        title: mapped.title,
+        description: mapped.description,
+        parent_id: mapped.parent_id,
+        l1_id: mapped.l1_id,
+        l2_id: mapped.l2_id,
+        l3_id: mapped.l3_id,
+        l4_id: mapped.l4_id,
+        l5_id: mapped.l5_id,
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'schedules':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        description: mapped.description,
+        time_start: mapped.time_start,
+        time_end: mapped.time_end,
+        days_json: json(mapped.days),
+        timezone: mapped.timezone,
+        assigned_group_id: mapped.assigned_group_id,
+        active: mapped.active ? 1 : 0,
+        last_run: mapped.last_run,
+        repeat: mapped.repeat,
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'flows':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        description: mapped.description,
+        steps_json: json(mapped.steps),
+        next_flow_id: mapped.next_flow_id ?? null,
+        scope_id: mapped.scope_id ?? null,
+        scope_l1_id: mapped.scope_l1_id ?? null,
+        scope_l2_id: mapped.scope_l2_id ?? null,
+        scope_l3_id: mapped.scope_l3_id ?? null,
+        scope_l4_id: mapped.scope_l4_id ?? null,
+        scope_l5_id: mapped.scope_l5_id ?? null,
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    case 'approvals':
+      return {
+        record_id: mapped.record_id,
+        owner_npub: mapped.owner_npub,
+        title: mapped.title,
+        description: mapped.description ?? '',
+        flow_id: mapped.flow_id ?? null,
+        flow_run_id: mapped.flow_run_id ?? null,
+        flow_step: mapped.flow_step ?? null,
+        task_ids_json: json(mapped.task_ids),
+        status: mapped.status,
+        approval_mode: mapped.approval_mode,
+        brief: mapped.brief,
+        approver_whitelist_json: json(mapped.approver_whitelist ?? []),
+        confidence_score: mapped.confidence_score ?? null,
+        approved_by: mapped.approved_by ?? null,
+        approved_at: mapped.approved_at ?? null,
+        decision_note: mapped.decision_note ?? null,
+        agent_review_by: mapped.agent_review_by ?? null,
+        agent_review_note: mapped.agent_review_note ?? null,
+        artifact_refs_json: json(mapped.artifact_refs),
+        revision_task_id: mapped.revision_task_id ?? null,
+        scope_id: mapped.scope_id ?? null,
+        scope_l1_id: mapped.scope_l1_id ?? null,
+        scope_l2_id: mapped.scope_l2_id ?? null,
+        scope_l3_id: mapped.scope_l3_id ?? null,
+        scope_l4_id: mapped.scope_l4_id ?? null,
+        scope_l5_id: mapped.scope_l5_id ?? null,
+        group_ids_json: json(mapped.group_ids),
+        shares_json: json(mapped.shares),
+        record_state: mapped.record_state,
+        version: mapped.version,
+        updated_at: mapped.updated_at,
+        ...common,
+      };
+    default:
+      throw new Error(`Unsupported table ${table}`);
+  }
+}
+
+function normalizeAppSchemaPayload(payload, manifest) {
+  const data = payload?.data && typeof payload.data === 'object' ? payload.data : payload;
+  const recordFamilies = Array.isArray(data?.record_families)
+    ? data.record_families
+    : (Array.isArray(manifest?.record_families) ? manifest.record_families : []);
+  const schemas = Array.isArray(data?.schemas) ? data.schemas : [];
+  return {
+    app_npub: String(data?.app_npub || manifest?.app_npub || '').trim(),
+    app_name: String(data?.app_name || manifest?.app_name || '').trim(),
+    schema_hash: String(data?.schema_hash || manifest?.schema_hash || '').trim(),
+    schema_version: Number(data?.schema_version || manifest?.schema_version || 1),
+    record_families: recordFamilies,
+    schemas,
+  };
+}
+
+async function syncAppSchemas({ client, db, session, groupKeyMap, wsSession, quiet }) {
+  if (typeof client.fetchWorkspaceAppSchemas !== 'function') return 0;
+  let result;
+  try {
+    result = await client.fetchWorkspaceAppSchemas({ latest: true });
+  } catch (error) {
+    if (/^API 404\b/.test(error instanceof Error ? error.message : String(error))) {
+      if (!quiet) console.warn('Skipping app schema sync: endpoint is not available on this Tower.');
+      return 0;
+    }
+    throw error;
+  }
+  const rows = [];
+  const syncedAt = new Date().toISOString();
+  for (const manifest of result.schemas || []) {
+    try {
+      const payload = decryptAppSchemaManifest(manifest, session, groupKeyMap, wsSession);
+      const normalized = normalizeAppSchemaPayload(payload, manifest);
+      if (!normalized.app_npub || !normalized.schema_hash) continue;
+      rows.push({
+        id: manifest.id || `${normalized.app_npub}:${normalized.schema_hash}`,
+        workspace_owner_npub: manifest.workspace_owner_npub,
+        app_npub: normalized.app_npub,
+        app_name: normalized.app_name || manifest.app_name || normalized.app_npub,
+        schema_hash: normalized.schema_hash,
+        schema_version: Number.isInteger(normalized.schema_version) ? normalized.schema_version : 1,
+        record_families_json: json(normalized.record_families),
+        schemas_json: json(normalized.schemas),
+        raw_json: json({
+          ...normalized,
+          manifest: {
+            id: manifest.id,
+            updated_at: manifest.updated_at,
+            created_at: manifest.created_at,
+            created_by_npub: manifest.created_by_npub,
+          },
+        }),
+        updated_at: manifest.updated_at || manifest.created_at || syncedAt,
+        synced_at: syncedAt,
+      });
+    } catch (error) {
+      if (!quiet) {
+        const label = manifest.app_npub || manifest.id || 'unknown app';
+        console.warn(`Skipping undecryptable app schema ${label}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  }
+  upsertAppSchemas(db, rows);
+  return rows.length;
+}
+
+export async function syncWorkspace({ client, config, session, wsSession = null, quiet = false }) {
+  const db = openDb();
+  const groupsResult = await client.getGroups();
+  const groups = (groupsResult.groups ?? []).map(inboundGroup);
+  replaceGroups(db, groups.map((group) => ({
+    group_id: group.group_id,
+    current_group_npub: group.current_group_npub ?? group.group_npub ?? null,
+    current_epoch: group.current_epoch ?? 1,
+    owner_npub: group.owner_npub,
+    name: group.name,
+    group_kind: group.group_kind,
+    private_member_npub: group.private_member_npub,
+    member_npubs_json: json(group.member_npubs),
+    raw_json: json(group),
+    synced_at: new Date().toISOString(),
+  })));
+
+  const keysResult = await client.getGroupKeys();
+  const keyRows = (keysResult.keys ?? []).map((entry) => ({
+    group_id: entry.group_id ?? entry.group_npub ?? null,
+    key_version: entry.key_version ?? entry.epoch ?? 1,
+    group_npub: entry.group_npub,
+    wrapped_group_nsec: entry.wrapped_group_nsec,
+    wrapped_by_npub: entry.wrapped_by_npub,
+    raw_json: json(entry),
+    synced_at: new Date().toISOString(),
+  }));
+  replaceGroupKeys(db, keyRows);
+  const groupKeyMap = loadGroupKeyMap(session, keyRows, decodeNsec);
+
+  // Fetch and cache workspace key → user npub mappings
+  try {
+    const mappingsResult = await client.fetchWorkspaceKeyMappings(config.workspaceOwnerNpub);
+    for (const entry of (mappingsResult.mappings ?? [])) {
+      upsertWorkspaceKeyMapping(db, entry.ws_key_npub, entry.user_npub);
+    }
+  } catch {
+    // Non-critical — existing cached mappings still work
+  }
+  const wsKeyMappings = getAllWorkspaceKeyMappings(db);
+  const resolveDisplayNpub = (npub) => wsKeyMappings.get(npub) || npub;
+
+  const counts = { groups: groups.length, group_keys: keyRows.length };
+  counts.app_schemas = await syncAppSchemas({
+    client,
+    db,
+    session,
+    groupKeyMap,
+    wsSession,
+    quiet,
+  });
+
+  for (const family of FAMILY_TABLES) {
+    const hash = recordFamilyHash(config.appNpub, family.collection);
+    const since = getMeta(db, `sync:${family.collection}:at`);
+    const result = await client.fetchRecords(hash, since);
+    const rows = [];
+    let latestAppliedAt = since;
+    for (const record of result.records ?? []) {
+      try {
+        const payload = decryptRecordPayload(record, session, groupKeyMap, wsSession);
+        const mapped = family.mapper(record, payload);
+        // Resolve workspace key npubs to real user npubs for display fields
+        if (mapped.sender_npub) mapped.sender_npub = resolveDisplayNpub(mapped.sender_npub);
+        if (mapped.reactor_npub) mapped.reactor_npub = resolveDisplayNpub(mapped.reactor_npub);
+        if (mapped.assigned_to_npub) mapped.assigned_to_npub = resolveDisplayNpub(mapped.assigned_to_npub);
+        rows.push(rowForTable(family.table, mapped, record));
+        latestAppliedAt = newerIsoTimestamp(
+          latestAppliedAt,
+          record.updated_at ?? mapped.updated_at ?? null,
+        );
+      } catch (error) {
+        if (!quiet) {
+          console.warn(`Skipping undecryptable ${family.collection} record ${record.record_id}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+      }
+    }
+    upsertRows(db, family.table, rows);
+    counts[family.collection] = rows.length;
+    if (latestAppliedAt && latestAppliedAt !== since) {
+      putMeta(db, `sync:${family.collection}:at`, latestAppliedAt);
+    }
+  }
+
+  const pruneResult = pruneInaccessibleRows(db, {
+    viewerNpub: session.npub,
+    workspaceOwnerNpub: config.workspaceOwnerNpub,
+    groups,
+    keyRows,
+  });
+  if (pruneResult.pruned > 0) counts.pruned = pruneResult.pruned;
+  const repairResult = repairLocalAccessMetadata(db, {
+    viewerNpub: session.npub,
+    workspaceOwnerNpub: config.workspaceOwnerNpub,
+    groups,
+    keyRows,
+  });
+  if (repairResult.repaired > 0) counts.repaired = repairResult.repaired;
+
+  putMeta(db, 'sync:last_at', new Date().toISOString());
+  return counts;
+}
+
+export function getSyncStatus(db) {
+  return {
+    lastSyncAt: getMeta(db, 'sync:last_at'),
+  };
+}