@anchrd/intel-api 0.20.0 → 0.21.0

package/dist/adapters/db/db.js

@@ -649,16 +649,78 @@ export function createNodeRepository(deps) {
         },
         async countInboundLinks(nodeId) {
             const row = await deps.db
-                .prepare("SELECT COUNT(*) AS n FROM node_links WHERE target_node_id = ?")
+                .prepare(`WITH RECURSIVE tree(id) AS (
+          SELECT id FROM nodes WHERE id = ?
+          UNION ALL SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+        ) SELECT COUNT(*) AS n FROM node_links
+          WHERE target_node_id IN (SELECT id FROM tree)
+            AND source_node_id NOT IN (SELECT id FROM tree)`)
                 .bind(nodeId)
                 .first();
             return row?.n ?? 0;
         },
+        async inspectPurgeTree(nodeId) {
+            const tree = `WITH RECURSIVE tree(id) AS (
+        SELECT id FROM nodes WHERE id = ?
+        UNION ALL SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+      )`;
+            const nodes = await deps.db
+                .prepare(`${tree} SELECT n.id, n.kind FROM nodes n JOIN tree ON tree.id = n.id`)
+                .bind(nodeId)
+                .all();
+            const nodeIds = (nodes.results ?? []).map((row) => row.id);
+            const flows = await deps.db
+                .prepare(`${tree} SELECT f.id FROM flows f WHERE f.parent_id IN (SELECT id FROM tree)`)
+                .bind(nodeId)
+                .all();
+            const keys = await deps.db
+                .prepare(`${tree} SELECT v.content_key FROM node_versions v WHERE v.node_id IN (SELECT id FROM tree)`)
+                .bind(nodeId)
+                .all();
+            const vectors = await deps.db
+                .prepare(`${tree} SELECT v.node_id, v.chunk_key FROM node_vectors v WHERE v.node_id IN (SELECT id FROM tree)`)
+                .bind(nodeId)
+                .all();
+            const grouped = new Map();
+            for (const row of vectors.results ?? []) {
+                const current = grouped.get(row.node_id) ?? [];
+                current.push(row.chunk_key);
+                grouped.set(row.node_id, current);
+            }
+            const counts = { flow: flows.results?.length ?? 0 };
+            for (const row of nodes.results ?? [])
+                counts[row.kind] = (counts[row.kind] ?? 0) + 1;
+            return {
+                nodeIds,
+                flowIds: (flows.results ?? []).map((row) => row.id),
+                contentKeys: [...new Set((keys.results ?? []).map((row) => row.content_key))],
+                vectorKeys: nodeIds.map((id) => ({ nodeId: id, keys: grouped.get(id) ?? [] })),
+                counts,
+            };
+        },
+        async findPurgeReplay(actorId, idempotencyKey) {
+            const row = await deps.db
+                .prepare(`SELECT title, content_keys_json FROM node_purge_receipts
+          WHERE actor_id = ? AND idempotency_key = ?`)
+                .bind(actorId, idempotencyKey)
+                .first();
+            return row ? { title: row.title, contentKeys: JSON.parse(row.content_keys_json) } : null;
+        },
+        async completePurgeReplay(actorId, idempotencyKey, completedAt) {
+            await deps.db
+                .prepare(`UPDATE node_purge_receipts SET completed_at = ?
+          WHERE actor_id = ? AND idempotency_key = ?`)
+                .bind(completedAt, actorId, idempotencyKey)
+                .run();
+        },
         async purgeNode(input) {
             // The keys BEFORE anything falls: after the batch there is no version row left to read them
             // from, and an object nobody can name is an object nobody can delete.
             const keys = await deps.db
-                .prepare("SELECT content_key FROM node_versions WHERE node_id = ?")
+                .prepare(`WITH RECURSIVE tree(id) AS (
+          SELECT id FROM nodes WHERE id = ?
+          UNION ALL SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+        ) SELECT content_key FROM node_versions WHERE node_id IN (SELECT id FROM tree)`)
                 .bind(input.nodeId)
                 .all();
             // ⚠️ The guard belongs on EVERY statement, not only on the last one (found in review). A
@@ -669,6 +731,13 @@ export function createNodeRepository(deps) {
             // reader was told nothing had happened while the content was already gone. The audit row
             // carried the same condition, so it was not even booked.
             const alive = "EXISTS (SELECT 1 FROM nodes n WHERE n.id = ? AND n.archived_at IS NOT NULL)";
+            const tree = `WITH RECURSIVE tree(id) AS (
+        SELECT id FROM nodes WHERE id = ?
+        UNION ALL SELECT child.id FROM nodes child JOIN tree parent ON child.parent_id = parent.id
+      )`;
+            const treeFlows = `${tree}, tree_flows(id) AS (
+        SELECT id FROM flows WHERE parent_id IN (SELECT id FROM tree)
+      )`;
             const deleted = await deps.db.batch([
                 // ⚠️ FIRST, and reading the title out of the row that falls at the end of this batch. Its
                 // `WHERE EXISTS` is what makes it honest: no row, no entry — a purge that hit nothing does
@@ -680,40 +749,71 @@ export function createNodeRepository(deps) {
               json_patch(?, json_object('title', n.title, 'kind', n.kind)), ?
             FROM nodes n WHERE n.id = ? AND n.archived_at IS NOT NULL`)
                     .bind(input.auditId, input.actorId, JSON.stringify(input.metadata), input.occurredAt, input.nodeId),
+                deps.db
+                    .prepare(`INSERT INTO node_purge_receipts (
+            actor_id, idempotency_key, node_id, title, content_keys_json, completed_at
+          ) SELECT ?, ?, n.id, n.title, ?, NULL FROM nodes n
+            WHERE n.id = ? AND n.archived_at IS NOT NULL`)
+                    .bind(input.actorId, input.idempotencyKey, JSON.stringify([...new Set((keys.results ?? []).map((row) => row.content_key))]), input.nodeId),
                 // The derived indexes go with their source. ⚠️ A hit on a deleted document is not a blemish
                 // but a leak: the title stands in the result and the content is gone.
                 deps.db
-                    .prepare(`DELETE FROM node_fts WHERE node_id = ? AND ${alive}`)
+                    .prepare(`${tree} DELETE FROM node_fts WHERE node_id IN (SELECT id FROM tree) AND ${alive}`)
                     .bind(input.nodeId, input.nodeId),
                 deps.db
-                    .prepare(`DELETE FROM node_vectors WHERE node_id = ? AND ${alive}`)
+                    .prepare(`${tree} DELETE FROM node_vectors WHERE node_id IN (SELECT id FROM tree) AND ${alive}`)
                     .bind(input.nodeId, input.nodeId),
                 deps.db
-                    .prepare(`DELETE FROM node_index_state
-            WHERE version_id IN (SELECT id FROM node_versions WHERE node_id = ?) AND ${alive}`)
+                    .prepare(`${tree} DELETE FROM node_index_state
+            WHERE version_id IN (SELECT id FROM node_versions WHERE node_id IN (SELECT id FROM tree)) AND ${alive}`)
                     .bind(input.nodeId, input.nodeId),
                 // Both directions. Outgoing links belong to this node; incoming ones would otherwise point
                 // at a row that is gone, and a foreign key would refuse the delete anyway.
                 deps.db
-                    .prepare(`DELETE FROM node_links
-            WHERE (source_node_id = ? OR target_node_id = ?) AND ${alive}`)
-                    .bind(input.nodeId, input.nodeId, input.nodeId),
+                    .prepare(`${tree} DELETE FROM node_links
+            WHERE (source_node_id IN (SELECT id FROM tree) OR target_node_id IN (SELECT id FROM tree)) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
                 // A permission on a node that does not exist is a dangling permission.
                 deps.db
-                    .prepare(`DELETE FROM node_grants WHERE node_id = ? AND ${alive}`)
+                    .prepare(`${tree} DELETE FROM node_grants WHERE node_id IN (SELECT id FROM tree) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
+                deps.db
+                    .prepare(`${treeFlows} UPDATE flows SET published_version_id = NULL
+            WHERE id NOT IN (SELECT id FROM tree_flows) AND EXISTS (
+              SELECT 1 FROM flow_versions fv, json_tree(fv.graph_json) graph
+              WHERE fv.id IN (flows.current_version_id, flows.published_version_id)
+                AND ((graph.key = 'resourceId' AND graph.value IN (SELECT id FROM tree))
+                  OR (graph.key = 'flowId' AND graph.value IN (SELECT id FROM tree_flows)))
+            ) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
+                deps.db
+                    .prepare(`${treeFlows} DELETE FROM flow_run_steps
+            WHERE run_id IN (SELECT id FROM flow_runs WHERE flow_id IN (SELECT id FROM tree_flows)) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
+                deps.db
+                    .prepare(`${treeFlows} DELETE FROM flow_runs WHERE flow_id IN (SELECT id FROM tree_flows) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
+                deps.db
+                    .prepare(`${treeFlows} DELETE FROM flow_versions WHERE flow_id IN (SELECT id FROM tree_flows) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
+                deps.db
+                    .prepare(`${treeFlows} DELETE FROM idempotency_keys WHERE resource_id IN (SELECT id FROM tree_flows) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
+                deps.db
+                    .prepare(`${treeFlows} DELETE FROM flows WHERE id IN (SELECT id FROM tree_flows) AND ${alive}`)
                     .bind(input.nodeId, input.nodeId),
                 deps.db
-                    .prepare(`DELETE FROM node_versions WHERE node_id = ? AND ${alive}`)
+                    .prepare(`${tree} DELETE FROM node_versions WHERE node_id IN (SELECT id FROM tree) AND ${alive}`)
                     .bind(input.nodeId, input.nodeId),
                 // ⚠️ The replay keys of every earlier write to this node. Left behind, a later write reusing
                 // one of them would be answered with a resource id that no longer resolves.
                 deps.db
-                    .prepare(`DELETE FROM idempotency_keys WHERE resource_id = ? AND ${alive}`)
+                    .prepare(`${tree} DELETE FROM idempotency_keys WHERE resource_id IN (SELECT id FROM tree) AND ${alive}`)
                     .bind(input.nodeId, input.nodeId),
                 // LAST — and its count is what the caller reads as the verdict.
                 deps.db
-                    .prepare("DELETE FROM nodes WHERE id = ? AND archived_at IS NOT NULL")
-                    .bind(input.nodeId),
+                    .prepare(`${tree} DELETE FROM nodes WHERE id IN (SELECT id FROM tree) AND ${alive}`)
+                    .bind(input.nodeId, input.nodeId),
             ]);
             const removed = deleted.at(-1)?.meta?.changes ?? 0;
             if (removed === 0)
@@ -913,6 +1013,42 @@ export function createNodeRepository(deps) {
                 .all();
             return (result.results ?? []).map(mapGrant);
         },
+        async listEffectiveAccess(resourceId) {
+            // Owners and grants come from ONE statement, hence one D1 snapshot. Two parallel SELECTs are
+            // not atomic: a grant mutation between their snapshots can produce a principal list that
+            // never existed as a whole.
+            const row = await deps.db
+                .prepare(`WITH RECURSIVE ancestors(id, parent_id, owner_id) AS (
+            SELECT id, parent_id, owner_id FROM nodes WHERE id = ?
+            UNION
+            SELECT parent.id, parent.parent_id, parent.owner_id
+            FROM nodes parent
+            JOIN ancestors child ON child.parent_id = parent.id
+          )
+          SELECT
+            (SELECT json_group_array(owner_id)
+             FROM (SELECT DISTINCT owner_id FROM ancestors ORDER BY owner_id)) AS owner_ids_json,
+            (SELECT json_group_array(json_object(
+               'id', id, 'node_id', node_id, 'principal_type', principal_type,
+               'principal_id', principal_id, 'verb', verb, 'expires_at', expires_at,
+               'created_by', created_by, 'created_at', created_at
+             ))
+             FROM (
+               SELECT grant_row.id, grant_row.node_id, grant_row.principal_type,
+                 grant_row.principal_id, grant_row.verb, grant_row.expires_at,
+                 grant_row.created_by, grant_row.created_at
+               FROM node_grants grant_row
+               JOIN ancestors ON ancestors.id = grant_row.node_id
+               WHERE grant_row.expires_at IS NULL OR grant_row.expires_at > ?
+               ORDER BY grant_row.principal_type, grant_row.principal_id, grant_row.verb
+             )) AS grants_json`)
+                .bind(resourceId, deps.now().toISOString())
+                .first();
+            return {
+                ownerIds: JSON.parse(row?.owner_ids_json ?? "[]"),
+                items: JSON.parse(row?.grants_json ?? "[]").map(mapGrant),
+            };
+        },
         // ⚠️ `UNION`, never `UNION ALL`: a ring in `parent_id` must end the recursion rather than the
         // database, the same reason every other walk of this tree gives.
         async organizationExecuteReaches(nodeId, exceptGrantId) {

package/dist/http/http.js

@@ -1,6 +1,6 @@
 import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, PurgeFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
 import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
-import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
+import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, PurgeNodePreviewInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
 import { RevokeGrantInput, ShareInput } from "@anchrd/intel-contract/share";
 import { AppendTableRowsInput, DefineTableInput, DeleteTableRowsInput, RedefineTableInput, UpdateTableRowsInput, } from "@anchrd/intel-contract/table";
 import { ExecuteToolInput, TestToolInput } from "@anchrd/intel-contract/tool";
@@ -366,13 +366,25 @@ export function createHttp(deps) {
     // two steps and the first one is reversible.
     app.delete("/nodes/:nodeId", async (context) => {
         const auth = requireCapability(context, "nodes", "write");
-        const input = PurgeNodeInput.parse({ nodeId: context.req.param("nodeId") });
+        const input = PurgeNodeInput.parse(await context.req.json().catch(() => null));
+        if (input.nodeId !== context.req.param("nodeId")) {
+            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
+        }
         return context.json(await deps.nodes.purge(asActor(auth), input));
     });
+    app.get("/nodes/:nodeId/purge-preview", async (context) => {
+        const auth = requireCapability(context, "nodes", "write");
+        const input = PurgeNodePreviewInput.parse({ nodeId: context.req.param("nodeId") });
+        return context.json(await deps.nodes.purgePreview(asActor(auth), input));
+    });
     app.get("/nodes/:nodeId/grants", async (context) => {
         const auth = requireCapability(context, "nodes", "share");
         return context.json(await deps.nodes.listGrants(asActor(auth), context.req.param("nodeId")));
     });
+    app.get("/nodes/:nodeId/effective-access", async (context) => {
+        const auth = requireCapability(context, "nodes", "share");
+        return context.json(await deps.nodes.listEffectiveAccess(asActor(auth), context.req.param("nodeId")));
+    });
     app.post("/nodes/:nodeId/grants", async (context) => {
         const auth = requireCapability(context, "nodes", "share");
         const input = ShareInput.parse(await context.req.json().catch(() => null));

package/dist/nodes/nodes.js

@@ -381,6 +381,20 @@ export function createNodes(deps) {
         async get(actor, nodeId) {
             return await getDocument(await requireVisible(actor, nodeId));
         },
+        async purgePreview(actor, input) {
+            const node = await requireVisible(actor, input.nodeId);
+            if (!(await deps.repository.can(actor, input.nodeId, "write"))) {
+                throw new IntelError(403, "node_forbidden", "This node cannot be edited");
+            }
+            if (!node.archivedAt) {
+                throw new IntelError(409, "node_not_archived", "Only an archived node can be deleted for good. Archive it first.");
+            }
+            const tree = await deps.repository.inspectPurgeTree(node.id);
+            return {
+                inboundLinks: await deps.repository.countInboundLinks(node.id),
+                totalItems: tree.nodeIds.length + tree.flowIds.length,
+            };
+        },
         /**
          * The content of one pinned version (#147). Search citations pin the version they quoted, and
          * without this read a citation could name text no surface can show any more.
@@ -855,6 +869,14 @@ export function createNodes(deps) {
          * chosen to the safer side.
          */
         async purge(actor, input) {
+            const idempotencyKey = `${input.nodeId}:${input.idempotencyKey}`;
+            const replay = await deps.repository.findPurgeReplay(actor.id, idempotencyKey);
+            if (replay) {
+                for (const key of replay.contentKeys)
+                    await deps.content.delete(key);
+                await deps.repository.completePurgeReplay(actor.id, idempotencyKey, deps.now().toISOString());
+                return { purged: true, title: replay.title };
+            }
             const node = await requireVisible(actor, input.nodeId);
             if (!(await deps.repository.can(actor, input.nodeId, "write"))) {
                 throw new IntelError(403, "node_forbidden", "This node cannot be edited");
@@ -866,28 +888,14 @@ export function createNodes(deps) {
             if (!node.archivedAt) {
                 throw new IntelError(409, "node_not_archived", "Only an archived node can be deleted for good. Archive it first.");
             }
-            // A folder is refused while anything is still inside — archived rows included. A cascade
-            // would turn ONE confirmed click into an unknown number of deletions, and the confirmation
-            // could then no longer name what disappears. `folder_execute_in_use` (#448) is the pattern:
-            // an answer with a reason beats an effect that reaches further than the question.
-            if (await deps.repository.hasAnyChild(node.id)) {
-                throw new IntelError(409, "folder_not_empty", "This folder still holds entries. Empty it before deleting it for good.");
-            }
-            // ⚠️ The other class of dependant, and the reason it refuses where a prose link does not: a
-            // flow would break at RUN TIME, in front of somebody who did not order this deletion.
-            //
-            // ⚠️ `flowsUsingNode`, NOT `externalFlowCallers` — the first version asked the second and
-            // therefore never refused anything (found in review). `externalFlowCallers` answers "who calls
-            // a FLOW filed inside this folder" (`kind: "subflow"`); a flow reads a NODE through a
-            // tree-link step (`configuration.resourceId`). Two different graph shapes, and only the second
-            // one is what a deleted document breaks.
-            const users = await deps.flowsUsingNode(actor, node.id);
-            if (users.visible.length || users.hidden) {
-                throw new IntelError(409, "node_in_use_by_flow", callersDetail(users));
-            }
+            // #492 replaces the refusal with owned cleanup. Flows inside the tree disappear with it;
+            // published flows outside it are depublished atomically before their dependency vanishes.
+            const tree = await deps.repository.inspectPurgeTree(node.id);
             // Not a refusal — a fact for the record. A prose reference is a mention, not an operation;
-            // refusing over one would make deleting a lottery, decided by whoever once linked to it. The
-            // surface names the number BEFORE the reader says yes.
+            // refusing over one would make deleting a lottery, decided by whoever once linked to it.
+            //
+            // The same count is exposed by `purgePreview`, so the surface can name the consequence before
+            // confirmation. It is counted again here because the audit records the state at deletion time.
             const inboundLinks = await deps.repository.countInboundLinks(node.id);
             // ⚠️ The vectors go FIRST, and the order is the correction of a wrong claim (found in review).
             // The comment here used to say Vectorize needed no call because archiving had already emptied
@@ -901,11 +909,14 @@ export function createNodes(deps) {
             // the rule behind both is the same: DO THE IRRECOVERABLE THING LAST. A failed batch after the
             // vectors are gone leaves an ARCHIVED node whose index can be rebuilt (`reindex`); a failed
             // removal after the batch leaves orphans nothing can name.
-            const vectorKeys = await deps.repository.listVectorKeys(node.id);
+            const vectorKeys = tree.vectorKeys;
             // The whole-node chunk carries the empty key and is never in the table — the pass writes it
             // and records the rest, so a purge that only sent the recorded ones would leave it behind.
-            if (deps.semantic)
-                await deps.semantic.remove(node.id, ["", ...vectorKeys]);
+            if (deps.semantic) {
+                for (const vector of vectorKeys) {
+                    await deps.semantic.remove(vector.nodeId, ["", ...vector.keys]);
+                }
+            }
             const purged = await deps.repository.purgeNode({
                 nodeId: node.id,
                 actorId: actor.id,
@@ -913,7 +924,8 @@ export function createNodes(deps) {
                 occurredAt: deps.now().toISOString(),
                 // ⚠️ The title travels INTO the record from the row itself (the repository reads it there),
                 // and this is what travels beside it. After the delete nothing can look either up.
-                metadata: { inboundLinks },
+                metadata: { inboundLinks, counts: tree.counts },
+                idempotencyKey,
             });
             // The row was restored or already gone between the check and the statement. Nothing was
             // deleted, and saying so is better than reporting a success that did not happen.
@@ -921,13 +933,13 @@ export function createNodes(deps) {
                 throw new IntelError(409, "update_conflict", "This node was changed by another editor");
             }
             // ⚠️ AFTER the database agreed, never before: it is the truth about what exists, and an object
-            // deleted ahead of a batch that then fails would leave a node whose content is gone.
-            //
-            // ⚠️ Vectorize needs no call here, and that follows from the guard above rather than from
-            // luck: archiving already takes a node's vectors out of the index (see `archive`), and only
-            // an archived node reaches this line. What is emptied above is Intel's own bookkeeping.
+            // deleted ahead of a batch that then fails would leave a node whose content is gone. This is
+            // the same rule the vectors follow in the other direction — do the irrecoverable thing last —
+            // and the directions differ because only one of the two can be rebuilt: an index can, an
+            // object cannot.
             for (const key of purged.contentKeys)
                 await deps.content.delete(key);
+            await deps.repository.completePurgeReplay(actor.id, idempotencyKey, deps.now().toISOString());
             return { purged: true, title: node.title };
         },
         async listGrants(actor, resourceId) {
@@ -941,6 +953,14 @@ export function createNodes(deps) {
                 items: await deps.repository.listGrants(resourceId),
             };
         },
+        async listEffectiveAccess(actor, resourceId) {
+            const node = await requireVisible(actor, resourceId);
+            if (!(await deps.repository.can(actor, resourceId, "share"))) {
+                throw new IntelError(403, "node_forbidden", "Sharing of this node cannot be managed");
+            }
+            const effective = await deps.repository.listEffectiveAccess(resourceId);
+            return { resourceId: node.id, ...effective };
+        },
         async listLinks(actor, nodeId) {
             await requireVisible(actor, nodeId);
             return { items: await deps.repository.listLinksVisible(actor, nodeId) };

package/dist/nodes/nodes.types.d.ts

@@ -87,16 +87,36 @@ export interface NodeRepository {
     hasAnyChild(nodeId: string): Promise<boolean>;
     listVectorKeys(nodeId: string): Promise<string[]>;
     countInboundLinks(nodeId: string): Promise<number>;
+    inspectPurgeTree(nodeId: string): Promise<{
+        nodeIds: string[];
+        flowIds: string[];
+        contentKeys: string[];
+        vectorKeys: Array<{
+            nodeId: string;
+            keys: string[];
+        }>;
+        counts: Record<string, number>;
+    }>;
+    findPurgeReplay(actorId: string, idempotencyKey: string): Promise<{
+        title: string;
+        contentKeys: string[];
+    } | null>;
+    completePurgeReplay(actorId: string, idempotencyKey: string, completedAt: string): Promise<void>;
     purgeNode(input: {
         nodeId: string;
         actorId: string;
         auditId: string;
         occurredAt: string;
         metadata: Record<string, unknown>;
+        idempotencyKey: string;
     }): Promise<"missing" | {
         contentKeys: string[];
     }>;
     listGrants(resourceId: string): Promise<ResourceGrant[]>;
+    listEffectiveAccess(resourceId: string): Promise<{
+        ownerIds: string[];
+        items: ResourceGrant[];
+    }>;
     organizationExecuteReaches(nodeId: string, exceptGrantId: string): Promise<boolean>;
     listLinksVisible(actor: Actor, nodeId: string): Promise<NodeLink[]>;
     resolveVisibleTitles(actor: Actor, nodeIds: string[]): Promise<Array<{
@@ -287,11 +307,19 @@ export interface NodeService {
     archive(actor: Actor, input: ArchiveNodeInput): Promise<Node>;
     purge(actor: Actor, input: {
         nodeId: string;
+        idempotencyKey: string;
     }): Promise<{
         purged: true;
         title: string;
     }>;
+    purgePreview(actor: Actor, input: {
+        nodeId: string;
+    }): Promise<{
+        inboundLinks: number;
+        totalItems: number;
+    }>;
     listGrants(actor: Actor, resourceId: string): Promise<ResourceGrantList>;
+    listEffectiveAccess(actor: Actor, resourceId: string): Promise<import("@anchrd/intel-contract/share").ResourceAccessList>;
     listLinks(actor: Actor, nodeId: string): Promise<{
         items: NodeLink[];
     }>;

package/migrations/0020_cascade_purge_replay.sql

@@ -0,0 +1,11 @@
+-- #492: D1 commits before irreversible R2 deletion. This receipt keeps every object key reachable
+-- when an R2 call fails, and also makes a repeated purge key return the original result.
+CREATE TABLE node_purge_receipts (
+  actor_id TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  node_id TEXT NOT NULL,
+  title TEXT NOT NULL,
+  content_keys_json TEXT NOT NULL,
+  completed_at TEXT,
+  PRIMARY KEY (actor_id, idempotency_key)
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.15.0",
-    "@anchrd/intel-contract": "^0.16.0",
+    "@anchrd/intel-contract": "^0.17.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",