@taskforcehq/taskforce 0.3.327 → 0.3.328

package/dist/service/localServiceCli.js

@@ -1,9 +1,10 @@
 import * as fs from 'fs';
 import * as path from 'path';
+import { applyLocalServiceCloudTarget, localServiceCloudTargetsEqual, parseLocalServiceCloudTarget, resolveLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
 import { createStandaloneServer } from '../server/index.js';
 import { inspectLocalServiceDescriptor, redactLocalServiceDescriptor, } from '../server/localServiceLease.js';
 import { acquireLocalServiceOwnershipForRuntime, } from '../server/localServiceOwnershipBootstrap.js';
-import { LOCAL_SERVICE_API_BASE_PATH, LOCAL_SERVICE_PROTOCOL_VERSION, resolveLocalServiceLeaseInput, spawnDetachedLocalService, waitForLocalServiceDescriptor, } from './localServiceClientLifecycle.js';
+import { discoverOrStartLocalService, LOCAL_SERVICE_API_BASE_PATH, LOCAL_SERVICE_PROTOCOL_VERSION, resolveLocalServiceLeaseInput, spawnDetachedLocalService, waitForLocalServiceDescriptor, } from './localServiceClientLifecycle.js';
 import { listSqliteWalHolders } from '../storage/sqliteWalHealth.js';
 const STARTUP_TIMEOUT_MS = 15_000;
 export { LOCAL_SERVICE_PROTOCOL_VERSION } from './localServiceClientLifecycle.js';
@@ -58,6 +59,13 @@ function reportIncompatibleDescriptor(inspection, error) {
     error(`Taskforce service protocol ${inspection.descriptor.protocolVersion} is incompatible with client protocol ${LOCAL_SERVICE_PROTOCOL_VERSION}.`);
     return true;
 }
+function reportCloudTargetMismatch(descriptorTarget, requestedTarget, error) {
+    if (localServiceCloudTargetsEqual(descriptorTarget, requestedTarget))
+        return false;
+    error('Taskforce service is running for a different or unverified cloud target. '
+        + 'Stop it with `taskforce service stop --drain`, then retry.');
+    return true;
+}
 function defaultRegisterShutdownSignals(handler) {
     process.once('SIGINT', handler);
     process.once('SIGTERM', handler);
@@ -75,6 +83,8 @@ async function waitForDescriptor(input, expected, options) {
     });
 }
 async function runForeground(command, options) {
+    const requestedCloudTarget = resolveLocalServiceCloudTarget(options.env);
+    applyLocalServiceCloudTarget(options.env, requestedCloudTarget);
     const ownership = await options.acquireOwnership(command.projectRoot, options.env);
     if (!ownership)
         throw new Error('The shared local service requires local runtime mode.');
@@ -84,6 +94,8 @@ async function runForeground(command, options) {
         if (inspection.status === 'live' && inspection.descriptor) {
             if (reportIncompatibleDescriptor(inspection, options.error))
                 return 2;
+            if (reportCloudTargetMismatch(inspection.descriptor.cloudTarget, requestedCloudTarget, options.error))
+                return 2;
             options.log(`Taskforce service is already running at ${inspection.descriptor.endpoint}.`);
             return 0;
         }
@@ -116,6 +128,7 @@ async function runForeground(command, options) {
                 ownerPid: process.pid,
                 bootstrapCapability: ownership.lease.bootstrapCapability,
                 ownershipKey: ownership.lease.identity.ownershipKey,
+                cloudTarget: requestedCloudTarget,
             },
             afterShutdown: async () => {
                 removeSignals();
@@ -138,6 +151,7 @@ async function runForeground(command, options) {
             endpoint: `http://127.0.0.1:${address.port}`,
             protocolVersion: LOCAL_SERVICE_PROTOCOL_VERSION,
             appVersion: options.appVersion,
+            cloudTarget: requestedCloudTarget,
         });
         removeSignals = options.registerShutdownSignals(shutdown);
         server.once('error', (error) => {
@@ -164,34 +178,28 @@ async function runForeground(command, options) {
     }
 }
 async function runStart(command, options) {
-    const leaseInput = resolveLocalServiceLeaseInput(command.projectRoot, options.env);
-    const current = await options.inspectDescriptor(leaseInput);
-    if (current.status === 'live' && current.descriptor) {
-        if (reportIncompatibleDescriptor(current, options.error))
-            return 2;
-        options.log(`Taskforce service is already running at ${current.descriptor.endpoint}.`);
+    const requestedCloudTarget = resolveLocalServiceCloudTarget(options.env);
+    applyLocalServiceCloudTarget(options.env, requestedCloudTarget);
+    try {
+        const descriptor = await discoverOrStartLocalService({
+            projectRoot: command.projectRoot,
+            env: options.env,
+            executablePath: options.executablePath,
+            cliEntryPath: options.cliEntryPath,
+            execArgv: options.execArgv,
+            inspectDescriptor: options.inspectDescriptor,
+            spawnDetached: options.spawnDetached,
+            fetch: options.fetch,
+            sleep: options.sleep,
+            nowMs: options.nowMs,
+        });
+        options.log(`Taskforce service is ready at ${descriptor.endpoint}.`);
         return 0;
     }
-    if (current.status === 'indeterminate') {
-        options.error('Taskforce service state is indeterminate; refusing to start a competing owner.');
-        return 2;
-    }
-    options.spawnDetached(options.executablePath, [
-        ...options.execArgv,
-        options.cliEntryPath,
-        'service',
-        command.projectRoot,
-        '--detached-child',
-    ], options.env);
-    const inspection = await waitForDescriptor(leaseInput, 'live', options);
-    if (inspection.status !== 'live' || !inspection.descriptor) {
-        options.error('Taskforce service did not become ready before the startup deadline.');
+    catch (startError) {
+        options.error(String(startError?.message || startError));
         return 2;
     }
-    if (reportIncompatibleDescriptor(inspection, options.error))
-        return 2;
-    options.log(`Taskforce service started at ${inspection.descriptor.endpoint}.`);
-    return 0;
 }
 async function runStatus(command, options) {
     const leaseInput = resolveLocalServiceLeaseInput(command.projectRoot, options.env);
@@ -222,9 +230,12 @@ async function runStatus(command, options) {
                 throw new Error(`HTTP ${response.status}`);
             const payload = await response.json();
             const coordinatorPayload = payload.coordinator;
+            const diagnosticCloudTarget = parseLocalServiceCloudTarget(payload.cloudTarget);
             if (payload.ownerPid !== inspection.descriptor.pid
                 || payload.generation !== inspection.descriptor.generation
                 || payload.protocolVersion !== inspection.descriptor.protocolVersion
+                || (inspection.descriptor.cloudTarget
+                    && !localServiceCloudTargetsEqual(diagnosticCloudTarget, inspection.descriptor.cloudTarget))
                 || !Array.isArray(payload.sessions)
                 || !coordinatorPayload
                 || typeof coordinatorPayload !== 'object'

package/dist/service/localServiceClientLifecycle.js

@@ -1,6 +1,7 @@
 import { spawn } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
+import { applyLocalServiceCloudTarget, localServiceCloudTargetsEqual, parseLocalServiceCloudTarget, resolveLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
 import { inspectLocalServiceDescriptor, } from '../server/localServiceLease.js';
 import { resolveLocalDatabaseIdentity } from '../server/localDatabaseIdentity.js';
 export const LOCAL_SERVICE_PROTOCOL_VERSION = '1';
@@ -39,10 +40,11 @@ export function spawnDetachedLocalService(executablePath, args, env) {
     });
     child.unref();
 }
-function buildLocalServiceProcessEnv(env) {
+function buildLocalServiceProcessEnv(env, cloudTarget) {
     const serviceEnv = { ...env };
     for (const key of LOCAL_MCP_CLIENT_ENV_KEYS)
         delete serviceEnv[key];
+    applyLocalServiceCloudTarget(serviceEnv, cloudTarget);
     return serviceEnv;
 }
 export async function waitForLocalServiceDescriptor(input, expected, options = {}) {
@@ -78,15 +80,59 @@ async function validateLocalServiceReadiness(descriptor, fetchFn) {
     catch {
         throw new Error('Taskforce shared local service readiness returned invalid JSON.');
     }
+    const readinessHasCloudTarget = Object.prototype.hasOwnProperty.call(readiness, 'cloudTarget');
+    const readinessCloudTarget = readinessHasCloudTarget
+        ? parseLocalServiceCloudTarget(readiness.cloudTarget)
+        : null;
+    const descriptorCloudTarget = descriptor.cloudTarget || null;
+    const cloudTargetsMatch = descriptorCloudTarget || readinessCloudTarget
+        ? localServiceCloudTargetsEqual(descriptorCloudTarget, readinessCloudTarget)
+        : true;
     if (readiness.ready !== true
         || readiness.protocolVersion !== LOCAL_SERVICE_PROTOCOL_VERSION
         || readiness.protocolVersion !== descriptor.protocolVersion
         || readiness.generation !== descriptor.generation
         || readiness.pid !== descriptor.pid
         || readiness.endpoint !== descriptor.endpoint
-        || readiness.dataIdentity !== descriptor.ownershipKey) {
+        || readiness.dataIdentity !== descriptor.ownershipKey
+        || (readinessHasCloudTarget && !readinessCloudTarget)
+        || !cloudTargetsMatch) {
         throw new Error('Taskforce shared local service readiness does not match its descriptor.');
     }
+    return descriptorCloudTarget;
+}
+async function requestIdleLocalServiceShutdown(descriptor, fetchFn) {
+    let response;
+    try {
+        response = await fetchFn(`${descriptor.endpoint}${LOCAL_SERVICE_API_BASE_PATH}/shutdown`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-taskforce-local-service-capability': descriptor.bootstrapCapability,
+            },
+            body: JSON.stringify({
+                intent: 'administrative-stop',
+                mode: 'refuse',
+                pid: descriptor.pid,
+                generation: descriptor.generation,
+            }),
+            redirect: 'error',
+            signal: AbortSignal.timeout(LOCAL_SERVICE_STARTUP_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new Error('Taskforce service uses a different cloud target and could not be stopped safely. '
+            + `No replacement was started. ${String(error?.message || error)}`);
+    }
+    if (!response.ok) {
+        const detail = (await response.text()).slice(0, 500);
+        const activeClientHint = response.status === 409
+            ? ' It may have active MCP clients; close them or run `taskforce service stop --drain`, then retry.'
+            : '';
+        throw new Error(`Taskforce service uses a different cloud target and refused safe idle replacement (${response.status}).`
+            + activeClientHint
+            + (detail ? ` ${detail}` : ''));
+    }
 }
 export async function discoverOrStartLocalService(input) {
     const requestedRoot = path.resolve(input.projectRoot);
@@ -94,13 +140,25 @@ export async function discoverOrStartLocalService(input) {
     const leaseInput = resolveLocalServiceLeaseInput(projectRoot, input.env);
     const inspectDescriptor = input.inspectDescriptor || inspectLocalServiceDescriptor;
     const fetchFn = input.fetch || fetch;
+    const requestedCloudTarget = resolveLocalServiceCloudTarget(input.env);
     const current = await inspectDescriptor(leaseInput);
     if (current.status === 'live' && current.descriptor) {
         if (current.descriptor.protocolVersion !== LOCAL_SERVICE_PROTOCOL_VERSION) {
             throw new Error(`Taskforce service protocol ${current.descriptor.protocolVersion} is incompatible with client protocol ${LOCAL_SERVICE_PROTOCOL_VERSION}.`);
         }
-        await validateLocalServiceReadiness(current.descriptor, fetchFn);
-        return current.descriptor;
+        const runningCloudTarget = await validateLocalServiceReadiness(current.descriptor, fetchFn);
+        if (localServiceCloudTargetsEqual(runningCloudTarget, requestedCloudTarget)) {
+            return current.descriptor;
+        }
+        await requestIdleLocalServiceShutdown(current.descriptor, fetchFn);
+        const stopped = await waitForLocalServiceDescriptor(leaseInput, 'stale', {
+            inspectDescriptor,
+            sleep: input.sleep,
+            nowMs: input.nowMs,
+        });
+        if (stopped.status !== 'stale') {
+            throw new Error('Taskforce service accepted cloud-target replacement but did not release its owner lease. No replacement was started.');
+        }
     }
     if (current.status === 'indeterminate') {
         throw new Error('Taskforce service state is indeterminate; refusing to start a competing owner.');
@@ -111,7 +169,7 @@ export async function discoverOrStartLocalService(input) {
         'service',
         projectRoot,
         '--detached-child',
-    ], buildLocalServiceProcessEnv(input.env));
+    ], buildLocalServiceProcessEnv(input.env, requestedCloudTarget));
     const inspection = await waitForLocalServiceDescriptor(leaseInput, 'live', {
         inspectDescriptor,
         sleep: input.sleep,
@@ -123,6 +181,9 @@ export async function discoverOrStartLocalService(input) {
     if (inspection.descriptor.protocolVersion !== LOCAL_SERVICE_PROTOCOL_VERSION) {
         throw new Error(`Taskforce service protocol ${inspection.descriptor.protocolVersion} is incompatible with client protocol ${LOCAL_SERVICE_PROTOCOL_VERSION}.`);
     }
-    await validateLocalServiceReadiness(inspection.descriptor, fetchFn);
+    const startedCloudTarget = await validateLocalServiceReadiness(inspection.descriptor, fetchFn);
+    if (!localServiceCloudTargetsEqual(startedCloudTarget, requestedCloudTarget)) {
+        throw new Error('Taskforce service started with a different or unverified cloud target; refusing to attach.');
+    }
     return inspection.descriptor;
 }

package/dist/shared/planningIdentity.d.ts

@@ -0,0 +1,20 @@
+export type PlanningIdentityEntityType = 'initiative' | 'workstream';
+export declare const PLANNING_IDENTITY_ICONS: readonly ["Target", "Route", "Flag", "Rocket", "Briefcase", "Folder", "Layers", "Map", "Compass", "Landmark", "BookOpen", "Lightbulb", "Wrench", "Shield", "Bug", "Palette", "Camera", "Music", "Heart", "Globe", "Users", "Sparkles", "FlaskConical", "Code"];
+export type PlanningIdentityIcon = typeof PLANNING_IDENTITY_ICONS[number];
+export declare const PLANNING_IDENTITY_COLORS: readonly ["red", "orange", "amber", "green", "teal", "sky", "blue", "indigo", "violet"];
+export type PlanningIdentityColor = typeof PLANNING_IDENTITY_COLORS[number];
+export declare function normalizePlanningIdentityIcon(value: unknown): PlanningIdentityIcon | null;
+export declare function normalizePlanningIdentityColor(value: unknown): PlanningIdentityColor | null;
+export declare function assertPlanningIdentityIcon(value: unknown): PlanningIdentityIcon | null;
+export declare function assertPlanningIdentityColor(value: unknown): PlanningIdentityColor | null;
+export declare function resolvePlanningIdentity(input: {
+    entityType: PlanningIdentityEntityType;
+    entityId: string;
+    icon?: unknown;
+    color?: unknown;
+}): {
+    icon: PlanningIdentityIcon;
+    color: PlanningIdentityColor | null;
+    customized: boolean;
+};
+export declare function planningIdentityColorToken(color?: PlanningIdentityColor | null): string;

package/dist/shared/planningIdentity.js

@@ -0,0 +1,79 @@
+export const PLANNING_IDENTITY_ICONS = Object.freeze([
+    'Target',
+    'Route',
+    'Flag',
+    'Rocket',
+    'Briefcase',
+    'Folder',
+    'Layers',
+    'Map',
+    'Compass',
+    'Landmark',
+    'BookOpen',
+    'Lightbulb',
+    'Wrench',
+    'Shield',
+    'Bug',
+    'Palette',
+    'Camera',
+    'Music',
+    'Heart',
+    'Globe',
+    'Users',
+    'Sparkles',
+    'FlaskConical',
+    'Code',
+]);
+export const PLANNING_IDENTITY_COLORS = Object.freeze([
+    'red',
+    'orange',
+    'amber',
+    'green',
+    'teal',
+    'sky',
+    'blue',
+    'indigo',
+    'violet',
+]);
+const ICON_SET = new Set(PLANNING_IDENTITY_ICONS);
+const COLOR_SET = new Set(PLANNING_IDENTITY_COLORS);
+export function normalizePlanningIdentityIcon(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    return ICON_SET.has(normalized) ? normalized : null;
+}
+export function normalizePlanningIdentityColor(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    const normalized = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    return COLOR_SET.has(normalized) ? normalized : null;
+}
+export function assertPlanningIdentityIcon(value) {
+    const normalized = normalizePlanningIdentityIcon(value);
+    if (value !== null && value !== undefined && value !== '' && !normalized) {
+        throw new Error('Planning identity icon is not supported.');
+    }
+    return normalized;
+}
+export function assertPlanningIdentityColor(value) {
+    const normalized = normalizePlanningIdentityColor(value);
+    if (value !== null && value !== undefined && value !== '' && !normalized) {
+        throw new Error('Planning identity color is not supported.');
+    }
+    return normalized;
+}
+export function resolvePlanningIdentity(input) {
+    const explicitIcon = normalizePlanningIdentityIcon(input.icon);
+    const explicitColor = normalizePlanningIdentityColor(input.color);
+    return {
+        icon: explicitIcon || (input.entityType === 'initiative' ? 'Target' : 'Route'),
+        color: explicitColor,
+        customized: Boolean(explicitIcon || explicitColor),
+    };
+}
+export function planningIdentityColorToken(color) {
+    return color
+        ? `var(--planning-identity-${color})`
+        : 'var(--planning-progress-empty)';
+}

package/dist/storage/postgresAdapter.js

@@ -1,6 +1,8 @@
 import { TextDecoder, TextEncoder } from 'util';
 import { Worker } from 'worker_threads';
+import { performance } from 'node:perf_hooks';
 import { assertSynchronousTransactionResult, } from './databaseAdapter.js';
+import { recordPostgresWorkerWait } from './postgresRequestDiagnostics.js';
 const RESPONSE_STATUS_INDEX = 0;
 const RESPONSE_LENGTH_INDEX = 1;
 const RESPONSE_READY = 1;
@@ -88,7 +90,9 @@ export class PostgresAdapter {
             statusBuffer,
             responseBuffer
         });
+        const waitStartedAt = performance.now();
         const waitResult = Atomics.wait(status, RESPONSE_STATUS_INDEX, RESPONSE_INITIAL, RESPONSE_TIMEOUT_MS);
+        recordPostgresWorkerWait(payload.op, performance.now() - waitStartedAt);
         if (waitResult === 'timed-out') {
             throw new Error('[Taskforce] Postgres worker timed out.');
         }

package/dist/storage/postgresRequestDiagnostics.d.ts

@@ -0,0 +1,8 @@
+export type RequestPerformanceDiagnostics = {
+    postgresQueryCount: number;
+    postgresWorkerCallCount: number;
+    postgresWorkerWaitMs: number;
+};
+export declare function runWithRequestPerformanceDiagnostics<T>(enabled: boolean, callback: () => T): T;
+export declare function recordPostgresWorkerWait(operation: string, durationMs: number): void;
+export declare function getRequestPerformanceDiagnostics(): RequestPerformanceDiagnostics | null;

package/dist/storage/postgresRequestDiagnostics.js

@@ -0,0 +1,24 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+const requestPerformanceStorage = new AsyncLocalStorage();
+export function runWithRequestPerformanceDiagnostics(enabled, callback) {
+    if (!enabled)
+        return callback();
+    return requestPerformanceStorage.run({
+        postgresQueryCount: 0,
+        postgresWorkerCallCount: 0,
+        postgresWorkerWaitMs: 0,
+    }, callback);
+}
+export function recordPostgresWorkerWait(operation, durationMs) {
+    const diagnostics = requestPerformanceStorage.getStore();
+    if (!diagnostics)
+        return;
+    diagnostics.postgresWorkerCallCount += 1;
+    if (operation === 'query')
+        diagnostics.postgresQueryCount += 1;
+    diagnostics.postgresWorkerWaitMs += Math.max(0, durationMs);
+}
+export function getRequestPerformanceDiagnostics() {
+    const diagnostics = requestPerformanceStorage.getStore();
+    return diagnostics ? { ...diagnostics } : null;
+}

package/dist/storage/workspaceAssetStore.d.ts

@@ -67,11 +67,43 @@ export interface WorkspaceAssetLinkEntry {
     updatedAt: string;
     deletedAt: string | null;
 }
+export interface WorkspaceAssetUploadDraftEntry {
+    workspaceId: string;
+    draftId: string;
+    assetId: string;
+    storageKey: string;
+    purpose: string;
+    createdByUserId: string;
+    createdAt: string;
+    retiredAt: string | null;
+}
 export declare class WorkspaceAssetStore {
     private readonly db;
     private readonly tenantId;
     private supportsTargetTypeCache;
     constructor(db: DatabaseAdapter, tenantId: string);
+    recordUploadDraft(input: {
+        workspaceId: string;
+        draftId: string;
+        assetId: string;
+        storageKey: string;
+        purpose: string;
+        createdByUserId: string;
+        createdAt?: string;
+    }): WorkspaceAssetUploadDraftEntry;
+    listUploadDrafts(input: {
+        workspaceId: string;
+        draftId?: string;
+        createdByUserId?: string;
+        createdBefore?: string;
+        includeRetired?: boolean;
+    }): WorkspaceAssetUploadDraftEntry[];
+    retireUploadDraft(input: {
+        workspaceId: string;
+        draftId: string;
+        assetId: string;
+        retiredAt?: string;
+    }): boolean;
     private isPlanningTargetDurablyOwned;
     assertAssetDeletionAllowed(assetIdRaw: string, workspaceIdRaw: string): void;
     private runDurableAssetMutation;

package/dist/storage/workspaceAssetStore.js

@@ -114,6 +114,76 @@ export class WorkspaceAssetStore {
         this.db = db;
         this.tenantId = tenantId;
     }
+    recordUploadDraft(input) {
+        const workspaceId = normalizeWorkspaceId(input.workspaceId);
+        const draftId = normalizeId(input.draftId);
+        const assetId = normalizeId(input.assetId);
+        const storageKey = normalizeId(input.storageKey);
+        const purpose = normalizeId(input.purpose);
+        const createdByUserId = normalizeId(input.createdByUserId, 'anonymous');
+        const createdAt = normalizeId(input.createdAt, new Date().toISOString());
+        if (!draftId || !assetId || !storageKey || !purpose) {
+            throw new Error('Draft upload identity, asset, storage key, and purpose are required.');
+        }
+        this.db.prepare(`
+            INSERT INTO workspace_asset_upload_drafts (
+                tenant_id, workspace_id, draft_id, asset_id, storage_key,
+                purpose, created_by_user_id, created_at, retired_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)
+            ON CONFLICT (tenant_id, workspace_id, draft_id, asset_id) DO UPDATE SET
+                storage_key = EXCLUDED.storage_key,
+                purpose = EXCLUDED.purpose,
+                created_by_user_id = EXCLUDED.created_by_user_id
+        `).run(this.tenantId, workspaceId, draftId, assetId, storageKey, purpose, createdByUserId, createdAt);
+        return {
+            workspaceId, draftId, assetId, storageKey, purpose,
+            createdByUserId, createdAt, retiredAt: null,
+        };
+    }
+    listUploadDrafts(input) {
+        const workspaceId = normalizeWorkspaceId(input.workspaceId);
+        const clauses = ['tenant_id = ?', 'workspace_id = ?'];
+        const values = [this.tenantId, workspaceId];
+        if (input.draftId) {
+            clauses.push('draft_id = ?');
+            values.push(normalizeId(input.draftId));
+        }
+        if (input.createdByUserId) {
+            clauses.push('created_by_user_id = ?');
+            values.push(normalizeId(input.createdByUserId));
+        }
+        if (input.createdBefore) {
+            clauses.push('created_at <= ?');
+            values.push(normalizeId(input.createdBefore));
+        }
+        if (!input.includeRetired)
+            clauses.push('retired_at IS NULL');
+        const rows = this.db.prepare(`
+            SELECT workspace_id, draft_id, asset_id, storage_key, purpose,
+                   created_by_user_id, created_at, retired_at
+            FROM workspace_asset_upload_drafts
+            WHERE ${clauses.join(' AND ')}
+            ORDER BY created_at ASC, asset_id ASC
+        `).all(...values);
+        return rows.map((row) => ({
+            workspaceId: String(row.workspace_id || ''),
+            draftId: String(row.draft_id || ''),
+            assetId: String(row.asset_id || ''),
+            storageKey: String(row.storage_key || ''),
+            purpose: String(row.purpose || ''),
+            createdByUserId: String(row.created_by_user_id || ''),
+            createdAt: String(row.created_at || ''),
+            retiredAt: row.retired_at == null ? null : String(row.retired_at),
+        }));
+    }
+    retireUploadDraft(input) {
+        const result = this.db.prepare(`
+            UPDATE workspace_asset_upload_drafts
+            SET retired_at = COALESCE(retired_at, ?)
+            WHERE tenant_id = ? AND workspace_id = ? AND draft_id = ? AND asset_id = ?
+        `).run(normalizeId(input.retiredAt, new Date().toISOString()), this.tenantId, normalizeWorkspaceId(input.workspaceId), normalizeId(input.draftId), normalizeId(input.assetId));
+        return Number(result.changes || 0) > 0;
+    }
     isPlanningTargetDurablyOwned(workspaceId, targetType, targetId) {
         if (targetType !== 'initiative' && targetType !== 'workstream')
             return false;

package/dist/sync/coordinator/localSyncExecutionPermitStore.d.ts

@@ -4,6 +4,8 @@ import type { WorkspaceSyncEngineV2PushBoundary } from '../engine/workspaceSyncE
 import { type LocalSyncExecutionPermitCleanAbandonResult, type LocalSyncExecutionPermitDrainSnapshot, type LocalSyncExecutionPermit, type LocalSyncExecutionPermitOwnerMode, type LocalSyncExecutionPermitState, type LocalSyncGatewayOperationClass, type LocalSyncRecoveryObligation, type LocalSyncUpstreamDisposition } from './localSyncExecutionPermitTypes.js';
 export declare const LOCAL_SYNC_PERMIT_RETENTION_MIN_AGE_MS: number;
 export declare const LOCAL_SYNC_PERMIT_RETENTION_SOFT_LIMIT = 1000;
+export declare const LOCAL_SYNC_PERMIT_RETENTION_HARD_LIMIT = 10000;
+export declare const LOCAL_SYNC_OBLIGATION_RETENTION_HARD_LIMIT = 2000;
 export declare const LOCAL_SYNC_PERMIT_RETENTION_DELETE_BATCH = 250;
 export declare const LOCAL_SYNC_PERMIT_RETENTION_SWEEP_LIMIT = 5000;
 type LocalSyncPermitCompletionGroupFence = {
@@ -60,6 +62,12 @@ export declare class LocalSyncExecutionPermitStore {
         byState: Partial<Record<LocalSyncExecutionPermitState, number>>;
         recoveryObligations: number;
         localCommitInvariantViolation: boolean;
+        history: {
+            terminalPermits: number;
+            oldestTerminalPermitAt: string | null;
+            resolvedRecoveryObligations: number;
+            oldestResolvedRecoveryObligationAt: string | null;
+        };
     };
     inspectGenerationDrain(input: {
         workspaceId: string;
@@ -110,6 +118,14 @@ export declare class LocalSyncExecutionPermitStore {
         ownerMode: LocalSyncExecutionPermitOwnerMode;
         serverInstanceId: string;
     }): LocalSyncExecutionPermit;
+    renewAcceptedApplyCompletion(input: {
+        permitId: string;
+        workspaceId: string;
+        coordinatorGeneration: number;
+        serverInstanceId: string;
+        ownerMode: LocalSyncExecutionPermitOwnerMode;
+        deadlineAt: string;
+    }): LocalSyncExecutionPermit;
     completeAcceptedV3Dispatch<T>(input: {
         permitId: string;
         workspaceId: string;