@anchrd/intel-api 0.2.0

package/dist/adapters/db/db.js

@@ -0,0 +1,755 @@
+const nodeColumns = `n.id, n.parent_id, n.kind, n.title, n.description, n.context_policy,
+  n.owner_id, n.current_version_id, n.created_at, n.updated_at, n.archived_at`;
+function mapNode(row) {
+    return {
+        id: row.id,
+        parentId: row.parent_id,
+        kind: row.kind,
+        title: row.title,
+        description: row.description,
+        contextPolicy: row.context_policy,
+        ownerId: row.owner_id,
+        currentVersionId: row.current_version_id,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        archivedAt: row.archived_at,
+    };
+}
+function mapVersion(row) {
+    return {
+        id: row.id,
+        nodeId: row.node_id,
+        sequence: row.sequence,
+        contentKey: row.content_key,
+        mediaType: row.media_type,
+        contentHash: row.content_hash,
+        size: row.size,
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+    };
+}
+function mapGrant(row) {
+    let principal;
+    switch (row.principal_type) {
+        case "user":
+            principal = { type: "user", id: row.principal_id };
+            break;
+        case "email":
+            principal = { type: "email", email: row.principal_id };
+            break;
+        case "organization":
+            principal = { type: "organization" };
+            break;
+        default:
+            throw new Error("Unsupported knowledge grant principal type");
+    }
+    return {
+        id: row.id,
+        resourceId: row.resource_id,
+        principal,
+        role: row.role,
+        expiresAt: row.expires_at,
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+    };
+}
+function mapLink(row) {
+    return {
+        id: row.id,
+        sourceNodeId: row.source_node_id,
+        targetNodeId: row.target_node_id,
+        relation: row.relation,
+        label: row.label,
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+    };
+}
+function toFtsQuery(query) {
+    return query
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((token) => `"${token.replaceAll('"', '""')}"`)
+        .join(" AND ");
+}
+export function createKnowledgeRepository(deps) {
+    const visibleCte = `WITH RECURSIVE allowed(id, parent_id) AS (
+    SELECT seed.id, seed.parent_id
+    FROM knowledge_nodes seed
+    WHERE seed.owner_id = ?
+       OR EXISTS (
+         SELECT 1 FROM resource_grants grant_row
+         WHERE grant_row.resource_type = 'knowledge'
+           AND grant_row.resource_id = seed.id
+           AND (
+             (grant_row.principal_type = 'user' AND grant_row.principal_id = ?)
+             OR (grant_row.principal_type = 'email' AND lower(grant_row.principal_id) = lower(?))
+             OR (grant_row.principal_type = 'organization' AND grant_row.principal_id = '*')
+           )
+           AND (grant_row.expires_at IS NULL OR grant_row.expires_at > ?)
+       )
+    UNION
+    SELECT child.id, child.parent_id
+    FROM knowledge_nodes child
+    JOIN allowed parent ON child.parent_id = parent.id
+  )`;
+    return {
+        async listVisible(actor, input) {
+            const now = deps.now().toISOString();
+            const result = await deps.db
+                .prepare(`${visibleCte}
+          SELECT ${nodeColumns}
+          FROM knowledge_nodes n
+          JOIN allowed ON allowed.id = n.id
+          WHERE n.parent_id IS ? AND (? = 1 OR n.archived_at IS NULL)
+          ORDER BY CASE n.kind WHEN 'folder' THEN 0 ELSE 1 END, lower(n.title), n.id`)
+                .bind(actor.id, actor.id, actor.email, now, input.parentId, input.includeArchived ? 1 : 0)
+                .all();
+            return (result.results ?? []).map(mapNode);
+        },
+        async getVisible(actor, nodeId) {
+            const row = await deps.db
+                .prepare(`${visibleCte}
+          SELECT ${nodeColumns}
+          FROM knowledge_nodes n
+          JOIN allowed ON allowed.id = n.id
+          WHERE n.id = ?`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), nodeId)
+                .first();
+            return row ? mapNode(row) : null;
+        },
+        async canEdit(actor, nodeId) {
+            const row = await deps.db
+                .prepare(`WITH RECURSIVE ancestors(id, parent_id, owner_id) AS (
+          SELECT id, parent_id, owner_id FROM knowledge_nodes WHERE id = ?
+          UNION ALL
+          SELECT parent.id, parent.parent_id, parent.owner_id
+          FROM knowledge_nodes parent
+          JOIN ancestors child ON child.parent_id = parent.id
+        )
+        SELECT 1 AS allowed
+        FROM ancestors
+        WHERE owner_id = ?
+           OR EXISTS (
+             SELECT 1 FROM resource_grants grant_row
+             WHERE grant_row.resource_type = 'knowledge'
+               AND grant_row.resource_id = ancestors.id
+               AND (
+                 (grant_row.principal_type = 'user' AND grant_row.principal_id = ?)
+                 OR (grant_row.principal_type = 'email' AND lower(grant_row.principal_id) = lower(?))
+                 OR (grant_row.principal_type = 'organization' AND grant_row.principal_id = '*')
+               )
+               AND grant_row.role IN ('editor', 'manager')
+               AND (grant_row.expires_at IS NULL OR grant_row.expires_at > ?)
+           )
+        LIMIT 1`)
+                .bind(nodeId, actor.id, actor.id, actor.email, deps.now().toISOString())
+                .first();
+            return row?.allowed === 1;
+        },
+        async canManage(actor, nodeId) {
+            const row = await deps.db
+                .prepare(`WITH RECURSIVE ancestors(id, parent_id, owner_id) AS (
+          SELECT id, parent_id, owner_id FROM knowledge_nodes WHERE id = ?
+          UNION ALL
+          SELECT parent.id, parent.parent_id, parent.owner_id
+          FROM knowledge_nodes parent
+          JOIN ancestors child ON child.parent_id = parent.id
+        )
+        SELECT 1 AS allowed
+        FROM ancestors
+        WHERE owner_id = ?
+           OR EXISTS (
+             SELECT 1 FROM resource_grants grant_row
+             WHERE grant_row.resource_type = 'knowledge'
+               AND grant_row.resource_id = ancestors.id
+               AND (
+                 (grant_row.principal_type = 'user' AND grant_row.principal_id = ?)
+                 OR (grant_row.principal_type = 'email' AND lower(grant_row.principal_id) = lower(?))
+                 OR (grant_row.principal_type = 'organization' AND grant_row.principal_id = '*')
+               )
+               AND grant_row.role = 'manager'
+               AND (grant_row.expires_at IS NULL OR grant_row.expires_at > ?)
+           )
+        LIMIT 1`)
+                .bind(nodeId, actor.id, actor.id, actor.email, deps.now().toISOString())
+                .first();
+            return row?.allowed === 1;
+        },
+        async findIdempotentNode(actorId, operation, idempotencyKey) {
+            const row = await deps.db
+                .prepare(`SELECT resource_id FROM idempotency_keys
+          WHERE actor_id = ? AND operation = ? AND idempotency_key = ?`)
+                .bind(actorId, operation, idempotencyKey)
+                .first();
+            return row?.resource_id ?? null;
+        },
+        async findIdempotentRevocation(actorId, idempotencyKey) {
+            const row = await deps.db
+                .prepare(`SELECT resource_id FROM idempotency_keys
+          WHERE actor_id = ? AND operation = 'knowledge.revoke' AND idempotency_key = ?`)
+                .bind(actorId, idempotencyKey)
+                .first();
+            if (!row)
+                return null;
+            return row.resource_id.startsWith("1:");
+        },
+        async insertNode(input) {
+            const node = input.node;
+            try {
+                await deps.db.batch([
+                    deps.db
+                        .prepare(`INSERT INTO knowledge_nodes (
+            id, parent_id, kind, title, description, context_policy, owner_id,
+            current_version_id, created_at, updated_at, archived_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                        .bind(node.id, node.parentId, node.kind, node.title, node.description, node.contextPolicy, node.ownerId, node.currentVersionId, node.createdAt, node.updatedAt, node.archivedAt),
+                    deps.db
+                        .prepare(`INSERT INTO idempotency_keys (
+            actor_id, operation, idempotency_key, resource_id, created_at
+          ) VALUES (?, 'knowledge.create', ?, ?, ?)`)
+                        .bind(input.actorId, input.idempotencyKey, node.id, node.createdAt),
+                    deps.db
+                        .prepare(`INSERT INTO audit_events (
+            id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+          ) VALUES (?, ?, 'knowledge.create', 'knowledge', ?, ?, ?)`)
+                        .bind(input.auditId, input.actorId, node.id, JSON.stringify({ kind: node.kind, parentId: node.parentId }), node.createdAt),
+                ]);
+            }
+            catch (error) {
+                const replayedKey = await deps.db
+                    .prepare(`SELECT resource_id FROM idempotency_keys
+            WHERE actor_id = ? AND operation = 'knowledge.create' AND idempotency_key = ?`)
+                    .bind(input.actorId, input.idempotencyKey)
+                    .first();
+                if (replayedKey) {
+                    const replayed = await deps.db
+                        .prepare(`${visibleCte}
+              SELECT ${nodeColumns}
+              FROM knowledge_nodes n
+              JOIN allowed ON allowed.id = n.id
+              WHERE n.id = ?`)
+                        .bind(input.actorId, input.actorId, "", deps.now().toISOString(), replayedKey.resource_id)
+                        .first();
+                    if (replayed)
+                        return mapNode(replayed);
+                }
+                throw error;
+            }
+            return node;
+        },
+        async getVersion(versionId) {
+            const row = await deps.db
+                .prepare(`SELECT id, node_id, sequence, content_key, media_type, content_hash,
+          size, created_by, created_at FROM knowledge_versions WHERE id = ?`)
+                .bind(versionId)
+                .first();
+            return row ? mapVersion(row) : null;
+        },
+        async listVersions(nodeId) {
+            const result = await deps.db
+                .prepare(`SELECT id, node_id, sequence, content_key, media_type, content_hash,
+          size, created_by, created_at
+          FROM knowledge_versions
+          WHERE node_id = ?
+          ORDER BY sequence DESC`)
+                .bind(nodeId)
+                .all();
+            return (result.results ?? []).map(mapVersion);
+        },
+        async updateNode(input) {
+            const node = input.node;
+            try {
+                await deps.db.batch([
+                    deps.db
+                        .prepare(`WITH RECURSIVE descendants(id) AS (
+              SELECT id FROM knowledge_nodes WHERE id = ?
+              UNION ALL
+              SELECT child.id
+              FROM knowledge_nodes child
+              JOIN descendants parent ON child.parent_id = parent.id
+            )
+            UPDATE knowledge_nodes
+            SET parent_id = ?, title = ?, description = ?, context_policy = ?, updated_at = ?
+            WHERE id = ? AND updated_at = ?
+              AND (? IS NULL OR ? NOT IN (SELECT id FROM descendants))`)
+                        .bind(node.id, node.parentId, node.title, node.description, node.contextPolicy, node.updatedAt, node.id, input.baseUpdatedAt, node.parentId, node.parentId),
+                    deps.db
+                        .prepare(`INSERT INTO idempotency_keys (
+              actor_id, operation, idempotency_key, resource_id, created_at
+            ) SELECT ?, 'knowledge.update', ?, ?, ?
+            WHERE EXISTS (
+              SELECT 1 FROM knowledge_nodes
+              WHERE id = ? AND parent_id IS ? AND title = ? AND description IS ?
+                AND context_policy = ? AND updated_at = ?
+            )`)
+                        .bind(input.actorId, input.idempotencyKey, node.id, node.updatedAt, node.id, node.parentId, node.title, node.description, node.contextPolicy, node.updatedAt),
+                    deps.db
+                        .prepare(`INSERT INTO audit_events (
+              id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+            ) SELECT ?, ?, 'knowledge.update', 'knowledge', ?, ?, ?
+            WHERE EXISTS (
+              SELECT 1 FROM idempotency_keys
+              WHERE actor_id = ? AND operation = 'knowledge.update'
+                AND idempotency_key = ? AND resource_id = ?
+            )`)
+                        .bind(input.auditId, input.actorId, node.id, JSON.stringify({
+                        parentId: node.parentId,
+                        title: node.title,
+                        contextPolicy: node.contextPolicy,
+                    }), node.updatedAt, input.actorId, input.idempotencyKey, node.id),
+                ]);
+            }
+            catch (error) {
+                const replayed = await deps.db
+                    .prepare(`SELECT resource_id FROM idempotency_keys
+            WHERE actor_id = ? AND operation = 'knowledge.update' AND idempotency_key = ?`)
+                    .bind(input.actorId, input.idempotencyKey)
+                    .first();
+                if (!replayed)
+                    throw error;
+            }
+            const replayed = await deps.db
+                .prepare(`SELECT resource_id FROM idempotency_keys
+          WHERE actor_id = ? AND operation = 'knowledge.update' AND idempotency_key = ?`)
+                .bind(input.actorId, input.idempotencyKey)
+                .first();
+            if (replayed) {
+                const row = await deps.db
+                    .prepare(`SELECT ${nodeColumns} FROM knowledge_nodes n WHERE n.id = ?`)
+                    .bind(replayed.resource_id)
+                    .first();
+                if (row)
+                    return mapNode(row);
+            }
+            if (node.parentId !== null) {
+                const cycle = await deps.db
+                    .prepare(`WITH RECURSIVE descendants(id) AS (
+            SELECT id FROM knowledge_nodes WHERE id = ?
+            UNION ALL
+            SELECT child.id
+            FROM knowledge_nodes child
+            JOIN descendants parent ON child.parent_id = parent.id
+          )
+          SELECT 1 AS found FROM descendants WHERE id = ? LIMIT 1`)
+                    .bind(node.id, node.parentId)
+                    .first();
+                if (cycle?.found === 1)
+                    return "cycle";
+            }
+            return "conflict";
+        },
+        async archiveNode(input) {
+            try {
+                await deps.db.batch([
+                    deps.db
+                        .prepare(`UPDATE knowledge_nodes
+              SET archived_at = ?, updated_at = ?
+              WHERE id = ? AND updated_at = ?`)
+                        .bind(input.archivedAt, input.updatedAt, input.nodeId, input.baseUpdatedAt),
+                    deps.db
+                        .prepare(`INSERT INTO idempotency_keys (
+              actor_id, operation, idempotency_key, resource_id, created_at
+            ) SELECT ?, 'knowledge.archive', ?, ?, ?
+            WHERE EXISTS (
+              SELECT 1 FROM knowledge_nodes
+              WHERE id = ? AND archived_at IS ? AND updated_at = ?
+            )`)
+                        .bind(input.actorId, input.idempotencyKey, input.nodeId, input.updatedAt, input.nodeId, input.archivedAt, input.updatedAt),
+                    deps.db
+                        .prepare(`INSERT INTO audit_events (
+              id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+            ) SELECT ?, ?, 'knowledge.archive', 'knowledge', ?, ?, ?
+            WHERE EXISTS (
+              SELECT 1 FROM idempotency_keys
+              WHERE actor_id = ? AND operation = 'knowledge.archive'
+                AND idempotency_key = ? AND resource_id = ?
+            )`)
+                        .bind(input.auditId, input.actorId, input.nodeId, JSON.stringify({ archived: input.archivedAt !== null }), input.updatedAt, input.actorId, input.idempotencyKey, input.nodeId),
+                ]);
+            }
+            catch (error) {
+                const replayed = await deps.db
+                    .prepare(`SELECT resource_id FROM idempotency_keys
+            WHERE actor_id = ? AND operation = 'knowledge.archive' AND idempotency_key = ?`)
+                    .bind(input.actorId, input.idempotencyKey)
+                    .first();
+                if (!replayed)
+                    throw error;
+            }
+            const replayed = await deps.db
+                .prepare(`SELECT resource_id FROM idempotency_keys
+          WHERE actor_id = ? AND operation = 'knowledge.archive' AND idempotency_key = ?`)
+                .bind(input.actorId, input.idempotencyKey)
+                .first();
+            if (!replayed)
+                return "conflict";
+            const row = await deps.db
+                .prepare(`SELECT ${nodeColumns} FROM knowledge_nodes n WHERE n.id = ?`)
+                .bind(replayed.resource_id)
+                .first();
+            return row ? mapNode(row) : "conflict";
+        },
+        async appendVersion(input) {
+            const version = input.version;
+            await deps.db.batch([
+                deps.db
+                    .prepare(`INSERT INTO knowledge_versions (
+            id, node_id, sequence, content_key, media_type, content_hash, size, created_by, created_at
+          ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?
+          FROM knowledge_nodes
+          WHERE id = ? AND current_version_id IS ?`)
+                    .bind(version.id, version.nodeId, version.sequence, version.contentKey, version.mediaType, version.contentHash, version.size, version.createdBy, version.createdAt, version.nodeId, input.baseVersionId),
+                deps.db
+                    .prepare(`UPDATE knowledge_nodes
+            SET current_version_id = ?, updated_at = ?
+            WHERE id = ? AND EXISTS (SELECT 1 FROM knowledge_versions WHERE id = ?)`)
+                    .bind(version.id, version.createdAt, version.nodeId, version.id),
+                deps.db
+                    .prepare(`INSERT INTO idempotency_keys (
+            actor_id, operation, idempotency_key, resource_id, created_at
+          ) SELECT ?, 'knowledge.save', ?, ?, ?
+          WHERE EXISTS (SELECT 1 FROM knowledge_versions WHERE id = ?)`)
+                    .bind(input.actorId, input.idempotencyKey, version.id, version.createdAt, version.id),
+                deps.db
+                    .prepare(`INSERT INTO knowledge_index_state (
+            version_id, status, attempt_count, last_error, updated_at
+          ) SELECT ?, 'pending', 0, NULL, ?
+          WHERE EXISTS (SELECT 1 FROM knowledge_versions WHERE id = ?)`)
+                    .bind(version.id, version.createdAt, version.id),
+                deps.db
+                    .prepare(`INSERT INTO audit_events (
+            id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+          ) SELECT ?, ?, 'knowledge.save', 'knowledge', ?, ?, ?
+          WHERE EXISTS (SELECT 1 FROM knowledge_versions WHERE id = ?)`)
+                    .bind(input.auditId, input.actorId, version.nodeId, JSON.stringify({ versionId: version.id, sequence: version.sequence }), version.createdAt, version.id),
+            ]);
+            const row = await deps.db
+                .prepare("SELECT current_version_id FROM knowledge_nodes WHERE id = ?")
+                .bind(version.nodeId)
+                .first();
+            return row?.current_version_id === version.id ? "saved" : "conflict";
+        },
+        async listGrants(resourceId) {
+            const result = await deps.db
+                .prepare(`SELECT id, resource_id, principal_type, principal_id, role, expires_at,
+          created_by, created_at
+          FROM resource_grants
+          WHERE resource_type = 'knowledge' AND resource_id = ?
+          ORDER BY created_at, id`)
+                .bind(resourceId)
+                .all();
+            return (result.results ?? []).map(mapGrant);
+        },
+        async listLinksVisible(actor, nodeId) {
+            const result = await deps.db
+                .prepare(`${visibleCte}
+          SELECT link.id, link.source_node_id, link.target_node_id, link.relation, link.label,
+            link.created_by, link.created_at
+          FROM knowledge_links link
+          JOIN allowed source_access ON source_access.id = link.source_node_id
+          JOIN allowed target_access ON target_access.id = link.target_node_id
+          WHERE link.source_node_id = ? OR link.target_node_id = ?
+          ORDER BY link.created_at, link.id`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), nodeId, nodeId)
+                .all();
+            return (result.results ?? []).map(mapLink);
+        },
+        async getLinkVisible(actor, linkId) {
+            const row = await deps.db
+                .prepare(`${visibleCte}
+          SELECT link.id, link.source_node_id, link.target_node_id, link.relation, link.label,
+            link.created_by, link.created_at
+          FROM knowledge_links link
+          JOIN allowed source_access ON source_access.id = link.source_node_id
+          JOIN allowed target_access ON target_access.id = link.target_node_id
+          WHERE link.id = ?`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), linkId)
+                .first();
+            return row ? mapLink(row) : null;
+        },
+        async findLinkVisible(actor, input) {
+            const row = await deps.db
+                .prepare(`${visibleCte}
+          SELECT link.id, link.source_node_id, link.target_node_id, link.relation, link.label,
+            link.created_by, link.created_at
+          FROM knowledge_links link
+          JOIN allowed source_access ON source_access.id = link.source_node_id
+          JOIN allowed target_access ON target_access.id = link.target_node_id
+          WHERE link.source_node_id = ? AND link.target_node_id = ? AND link.relation = ?`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), input.sourceNodeId, input.targetNodeId, input.relation)
+                .first();
+            return row ? mapLink(row) : null;
+        },
+        async insertLink(input) {
+            const link = input.link;
+            try {
+                await deps.db.batch([
+                    deps.db
+                        .prepare(`INSERT INTO knowledge_links (
+              id, source_node_id, target_node_id, relation, label, created_by, created_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+                        .bind(link.id, link.sourceNodeId, link.targetNodeId, link.relation, link.label, link.createdBy, link.createdAt),
+                    deps.db
+                        .prepare(`INSERT INTO idempotency_keys (
+              actor_id, operation, idempotency_key, resource_id, created_at
+            ) VALUES (?, 'knowledge.link', ?, ?, ?)`)
+                        .bind(input.actorId, input.idempotencyKey, link.id, link.createdAt),
+                    deps.db
+                        .prepare(`INSERT INTO audit_events (
+              id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+            ) VALUES (?, ?, 'knowledge.link', 'knowledge', ?, ?, ?)`)
+                        .bind(input.auditId, input.actorId, link.sourceNodeId, JSON.stringify({
+                        linkId: link.id,
+                        targetNodeId: link.targetNodeId,
+                        relation: link.relation,
+                    }), link.createdAt),
+                ]);
+                return link;
+            }
+            catch (error) {
+                const replayed = await deps.db
+                    .prepare(`SELECT resource_id FROM idempotency_keys
+            WHERE actor_id = ? AND operation = 'knowledge.link' AND idempotency_key = ?`)
+                    .bind(input.actorId, input.idempotencyKey)
+                    .first();
+                const row = await deps.db
+                    .prepare(`SELECT id, source_node_id, target_node_id, relation, label,
+            created_by, created_at FROM knowledge_links
+            WHERE id = ? OR (source_node_id = ? AND target_node_id = ? AND relation = ?)`)
+                    .bind(replayed?.resource_id ?? link.id, link.sourceNodeId, link.targetNodeId, link.relation)
+                    .first();
+                if (row)
+                    return mapLink(row);
+                throw error;
+            }
+        },
+        async deleteLink(input) {
+            const existing = await deps.db
+                .prepare("SELECT id FROM knowledge_links WHERE id = ? AND source_node_id = ?")
+                .bind(input.linkId, input.sourceNodeId)
+                .first();
+            const deleted = existing !== null;
+            await deps.db.batch([
+                deps.db
+                    .prepare("DELETE FROM knowledge_links WHERE id = ? AND source_node_id = ?")
+                    .bind(input.linkId, input.sourceNodeId),
+                deps.db
+                    .prepare(`INSERT INTO idempotency_keys (
+            actor_id, operation, idempotency_key, resource_id, created_at
+          ) VALUES (?, 'knowledge.unlink', ?, ?, ?)`)
+                    .bind(input.actorId, input.idempotencyKey, `${deleted ? "1" : "0"}:${input.linkId}`, input.occurredAt),
+                deps.db
+                    .prepare(`INSERT INTO audit_events (
+            id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+          ) VALUES (?, ?, 'knowledge.unlink', 'knowledge', ?, ?, ?)`)
+                    .bind(input.auditId, input.actorId, input.sourceNodeId, JSON.stringify({ linkId: input.linkId, deleted }), input.occurredAt),
+            ]);
+            return deleted;
+        },
+        async graphVisible(actor, input) {
+            const nodeResult = await deps.db
+                .prepare(`${visibleCte}
+          SELECT ${nodeColumns}
+          FROM knowledge_nodes n
+          JOIN allowed ON allowed.id = n.id
+          WHERE n.archived_at IS NULL
+          ORDER BY lower(n.title), n.id
+          LIMIT ?`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), input.limit)
+                .all();
+            const nodes = (nodeResult.results ?? []).map(mapNode);
+            if (nodes.length === 0)
+                return { nodes, links: [] };
+            const linkResult = await deps.db
+                .prepare(`${visibleCte}, graph_nodes(id) AS (
+          SELECT n.id FROM knowledge_nodes n
+          JOIN allowed ON allowed.id = n.id
+          WHERE n.archived_at IS NULL
+          ORDER BY lower(n.title), n.id
+          LIMIT ?
+        )
+          SELECT link.id, link.source_node_id, link.target_node_id, link.relation, link.label,
+            link.created_by, link.created_at
+          FROM knowledge_links link
+          JOIN graph_nodes source_node ON source_node.id = link.source_node_id
+          JOIN graph_nodes target_node ON target_node.id = link.target_node_id
+          ORDER BY link.created_at, link.id`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), input.limit)
+                .all();
+            return { nodes, links: (linkResult.results ?? []).map(mapLink) };
+        },
+        async setGrant(input) {
+            const grant = input.grant;
+            const principalType = grant.principal.type;
+            const principalId = grant.principal.type === "user"
+                ? grant.principal.id
+                : grant.principal.type === "email"
+                    ? grant.principal.email.toLowerCase()
+                    : "*";
+            try {
+                await deps.db.batch([
+                    deps.db
+                        .prepare(`INSERT INTO resource_grants (
+              id, resource_type, resource_id, principal_type, principal_id, role,
+              expires_at, created_by, created_at
+            ) VALUES (?, 'knowledge', ?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT (resource_type, resource_id, principal_type, principal_id)
+            DO UPDATE SET role = excluded.role, expires_at = excluded.expires_at`)
+                        .bind(grant.id, grant.resourceId, principalType, principalId, grant.role, grant.expiresAt, grant.createdBy, grant.createdAt),
+                    deps.db
+                        .prepare(`INSERT INTO idempotency_keys (
+              actor_id, operation, idempotency_key, resource_id, created_at
+            ) SELECT ?, 'knowledge.share', ?, id, ? FROM resource_grants
+              WHERE resource_type = 'knowledge' AND resource_id = ?
+                AND principal_type = ? AND principal_id = ?`)
+                        .bind(input.actorId, input.idempotencyKey, grant.createdAt, grant.resourceId, principalType, principalId),
+                    deps.db
+                        .prepare(`INSERT INTO audit_events (
+              id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+            ) VALUES (?, ?, 'knowledge.share', 'knowledge', ?, ?, ?)`)
+                        .bind(input.auditId, input.actorId, grant.resourceId, JSON.stringify({ principalType, role: grant.role }), grant.createdAt),
+                ]);
+                const stored = await deps.db
+                    .prepare(`SELECT id, resource_id, principal_type, principal_id, role, expires_at,
+            created_by, created_at FROM resource_grants
+            WHERE resource_type = 'knowledge' AND resource_id = ?
+              AND principal_type = ? AND principal_id = ?`)
+                    .bind(grant.resourceId, principalType, principalId)
+                    .first();
+                if (!stored)
+                    throw new Error("Knowledge grant disappeared after upsert");
+                return mapGrant(stored);
+            }
+            catch (error) {
+                const replayed = await deps.db
+                    .prepare(`SELECT resource_id FROM idempotency_keys
+            WHERE actor_id = ? AND operation = 'knowledge.share' AND idempotency_key = ?`)
+                    .bind(input.actorId, input.idempotencyKey)
+                    .first();
+                if (replayed) {
+                    const row = await deps.db
+                        .prepare(`SELECT id, resource_id, principal_type, principal_id, role, expires_at,
+              created_by, created_at FROM resource_grants WHERE id = ?`)
+                        .bind(replayed.resource_id)
+                        .first();
+                    if (row)
+                        return mapGrant(row);
+                }
+                throw error;
+            }
+        },
+        async revokeGrant(input) {
+            try {
+                await deps.db.batch([
+                    deps.db
+                        .prepare(`INSERT INTO idempotency_keys (
+              actor_id, operation, idempotency_key, resource_id, created_at
+            ) SELECT ?, 'knowledge.revoke', ?,
+              (CASE WHEN EXISTS (
+                SELECT 1 FROM resource_grants
+                WHERE id = ? AND resource_type = 'knowledge' AND resource_id = ?
+              ) THEN '1:' ELSE '0:' END) || ?, ?`)
+                        .bind(input.actorId, input.idempotencyKey, input.grantId, input.resourceId, input.grantId, input.occurredAt),
+                    deps.db
+                        .prepare(`DELETE FROM resource_grants
+              WHERE id = ? AND resource_type = 'knowledge' AND resource_id = ?`)
+                        .bind(input.grantId, input.resourceId),
+                    deps.db
+                        .prepare(`INSERT INTO audit_events (
+              id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+            ) SELECT ?, ?, 'knowledge.revoke', 'knowledge', ?,
+              json_object(
+                'grantId', ?,
+                'revoked', json(CASE WHEN substr(resource_id, 1, 2) = '1:' THEN 'true' ELSE 'false' END)
+              ), ?
+              FROM idempotency_keys
+              WHERE actor_id = ? AND operation = 'knowledge.revoke' AND idempotency_key = ?`)
+                        .bind(input.auditId, input.actorId, input.resourceId, input.grantId, input.occurredAt, input.actorId, input.idempotencyKey),
+                ]);
+            }
+            catch (error) {
+                const replayed = await this.findIdempotentRevocation(input.actorId, input.idempotencyKey);
+                if (replayed === null)
+                    throw error;
+                return replayed;
+            }
+            return (await this.findIdempotentRevocation(input.actorId, input.idempotencyKey)) ?? false;
+        },
+        async searchVisible(actor, input) {
+            const query = toFtsQuery(input.query);
+            if (!query)
+                return [];
+            const result = await deps.db
+                .prepare(`${visibleCte}
+          SELECT n.id AS node_id, v.id AS version_id, n.title,
+            snippet(knowledge_fts, 3, '', '', ' … ', 32) AS passage,
+            n.updated_at AS freshness, bm25(knowledge_fts, 0.0, 0.0, 4.0, 1.0) AS rank
+          FROM knowledge_fts
+          JOIN knowledge_nodes n ON n.id = knowledge_fts.node_id
+          JOIN knowledge_versions v ON v.id = knowledge_fts.version_id
+          JOIN allowed ON allowed.id = n.id
+          WHERE knowledge_fts MATCH ?
+            AND n.current_version_id = v.id
+            AND n.archived_at IS NULL
+          ORDER BY rank, n.updated_at DESC
+          LIMIT ?`)
+                .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), query, input.limit)
+                .all();
+            return (result.results ?? []).map((row) => ({
+                nodeId: row.node_id,
+                versionId: row.version_id,
+                title: row.title,
+                passage: row.passage,
+                source: `intel://knowledge/${encodeURIComponent(row.node_id)}?version=${encodeURIComponent(row.version_id)}`,
+                freshness: row.freshness,
+                score: 1 / (1 + Math.abs(row.rank)),
+                match: "lexical",
+            }));
+        },
+        async hydrateVisibleCitations(actor, nodeIds) {
+            const uniqueIds = [...new Set(nodeIds)].slice(0, 100);
+            if (uniqueIds.length === 0)
+                return [];
+            const rows = [];
+            for (let offset = 0; offset < uniqueIds.length; offset += 96) {
+                const ids = uniqueIds.slice(offset, offset + 96);
+                const placeholders = ids.map(() => "?").join(", ");
+                const result = await deps.db
+                    .prepare(`${visibleCte}
+            SELECT n.id AS node_id, v.id AS version_id, n.title,
+              substr(knowledge_fts.content, 1, 480) AS passage,
+              n.updated_at AS freshness
+            FROM knowledge_nodes n
+            JOIN knowledge_versions v ON v.id = n.current_version_id
+            JOIN knowledge_fts ON knowledge_fts.version_id = v.id
+            JOIN allowed ON allowed.id = n.id
+            WHERE n.id IN (${placeholders}) AND n.archived_at IS NULL`)
+                    .bind(actor.id, actor.id, actor.email, deps.now().toISOString(), ...ids)
+                    .all();
+                rows.push(...(result.results ?? []));
+            }
+            const order = new Map(uniqueIds.map((id, index) => [id, index]));
+            rows.sort((left, right) => (order.get(left.node_id) ?? 0) - (order.get(right.node_id) ?? 0));
+            return rows.map((row) => ({
+                nodeId: row.node_id,
+                versionId: row.version_id,
+                title: row.title,
+                passage: row.passage,
+                source: `intel://knowledge/${encodeURIComponent(row.node_id)}?version=${encodeURIComponent(row.version_id)}`,
+                freshness: row.freshness,
+                score: 0,
+                match: "semantic",
+            }));
+        },
+        async listCurrentVersionIds(input) {
+            const result = await deps.db
+                .prepare(`SELECT current_version_id AS id FROM knowledge_nodes
+          WHERE current_version_id IS NOT NULL AND archived_at IS NULL
+            AND (? IS NULL OR current_version_id > ?)
+          ORDER BY id LIMIT ?`)
+                .bind(input.after, input.after, input.limit)
+                .all();
+            return (result.results ?? []).map((row) => row.id);
+        },
+    };
+}