@anchrd/intel-api 0.27.0 → 0.29.0

package/dist/adapters/cloudflare/cloudflare.js

@@ -1,7 +1,9 @@
 import { createGateClient } from "@anchrd/gate-sdk";
 import { serverOf } from "@anchrd/intel-contract/tool";
 import { ulid } from "ulid";
+import { createAudit } from "../../audit/audit.js";
 import { createBrowserAuth } from "../../auth/auth.js";
+import { createBoards, FIRST_DEFAULT_COLUMN } from "../../boards/boards.js";
 import { createBundle } from "../../bundle/bundle.js";
 import { createFlows } from "../../flows/flows.js";
 import { createIndexing, PermanentIndexingError } from "../../indexing/indexing.js";
@@ -12,6 +14,8 @@ import { sha256Hex } from "../../shared/sha256/sha256.js";
 import { createTools } from "../../tools/tools.js";
 import { createContentStore } from "../content/content.js";
 import { createNodeRepository } from "../db/db.js";
+import { createAuditRepository } from "../db/db-audit.js";
+import { createBoardRepository } from "../db/db-boards.js";
 import { createFlowRepository } from "../db/db-flows.js";
 import { createNodeIndexRepository } from "../db/db-indexing.js";
 import { createOAuthClientStore } from "../db/db-oauth.js";
@@ -63,6 +67,8 @@ export default {
         // from outside it. The repository knows no service, so this stays one direction of dependency.
         const flowRepository = createFlowRepository({ db: env.DB, now });
         const nodeRepository = createNodeRepository({ db: env.DB, now });
+        const auditRepository = createAuditRepository({ db: env.DB, now });
+        const boardRepository = createBoardRepository({ db: env.DB, now });
         const contentStore = createContentStore(env.CONTENT);
         const gate = createGateClient({ url: env.GATE_URL, serviceKey: env.GATE_SERVICE_KEY });
         const oauth = createOpenId({
@@ -114,6 +120,36 @@ export default {
             content: contentStore,
             id: ulid,
             now,
+            // ⚠️ The REPOSITORY, not the board service — that is what keeps this from being a cycle. The
+            // board service needs the node service to create a task; the node service needs only the two
+            // reads below to file one.
+            // ⚠️ `"write"` for the same reason as below: this answers "may this actor file a card here",
+            // not "may they look at it". Reading it with `"read"` would let somebody nest a card under a
+            // task on a board they may only look at.
+            boardOfTask: async (who, taskId) => (await boardRepository.taskRow(who, taskId, "write"))?.boardId ?? null,
+            attachToBoard: async (who, taskId, boardId, occurredAt) => {
+                // ⚠️ `"write"` — the actor is filing a task on this board, and the board's own creation
+                // path is a write too. `"read"` here would put back exactly the hole #649 found.
+                const columns = await boardRepository.columnsOf(who, boardId, "write");
+                // `null` means the parent is not a board this actor may read — then there is nothing to
+                // file the task on, and the node stands on its own. That is the folder case, and it is
+                // silent on purpose: a `task` filed in a plain folder is unusual, not an error.
+                if (columns === null)
+                    return;
+                const status = columns[0] ?? FIRST_DEFAULT_COLUMN;
+                await boardRepository.attach({
+                    nodeId: taskId,
+                    boardId,
+                    status,
+                    assigneeId: null,
+                    labels: [],
+                    startDate: null,
+                    dueDate: null,
+                    dependsOn: null,
+                    position: await boardRepository.nextPosition(boardId, status),
+                    occurredAt,
+                });
+            },
             indexing: createIndexQueue(env.INDEXING),
             semantic,
             externalFlowCallers: async (who, folderId) => await flowRepository.externalCallers(who, folderId),
@@ -219,6 +255,8 @@ export default {
             nodes,
             flows,
             tools,
+            audit: createAudit({ audit: auditRepository }),
+            boards: createBoards({ boards: boardRepository, nodes, now }),
             bundle: createBundle({
                 repository: nodeRepository,
                 flows: flowRepository,

package/dist/adapters/db/db-audit.d.ts

@@ -0,0 +1,34 @@
+import type { AuditRepository } from "../../audit/audit.types.js";
+import type { D1Database } from "./db.types.js";
+/**
+ * The journal, cut down to the rows this actor may see, continued from a stable position.
+ *
+ * ⚠️ **The visibility check is a JOIN against `allowed`, evaluated on every call.** `allowed` is
+ * the same tree walk `nodes` reads through (`db-grants.ts`), so an event about a node is visible
+ * exactly when the node is — no second rule that could drift from the first. It runs per row and
+ * per request; nothing here is cached, so a grant revoked a second ago is gone from the next
+ * answer.
+ *
+ * ⚠️ It filters the EXISTENCE of the row, not only its contents. That is deliberate and it is
+ * the stricter reading: that something is moving inside a customer's folder is itself
+ * information, so an actor who may not read the node learns nothing at all — not an id, not a
+ * count, not a timestamp.
+ *
+ * ⚠️ **An event about a purged node is therefore unreachable, for everybody.** `allowed` walks
+ * `nodes`, and after `node.purge` that row is gone, so the join finds nothing. This is not an
+ * oversight and it cannot be fixed without giving up the check: at a deleted row there is no
+ * longer anything against which a claim to have been allowed to read it could be tested. Hiding
+ * is the safe direction. A consumer learns about creation, change, moves and archiving — never
+ * about final deletion (#620).
+ *
+ * ⚠️ **`ORDER BY` and the cursor comparison must name BOTH columns, in the same order.** Two
+ * events in the same millisecond are the normal case in a batch, not the exception; on
+ * `occurred_at` alone the second one is skipped in silence — no error, no log, just an event
+ * that never arrived. The tuple comparison below is written out by hand because SQLite has no
+ * row-value comparison here: "later timestamp, OR same timestamp and larger id".
+ */
+export declare const auditFeedQuery: string;
+export declare function createAuditRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): AuditRepository;

package/dist/adapters/db/db-audit.js

@@ -0,0 +1,89 @@
+import { subtreeBindings, subtreeCte } from "./db-grants.js";
+function mapEvent(row) {
+    let metadata = {};
+    // The column is `NOT NULL DEFAULT '{}'`, but it is written by 11 call sites over
+    // `JSON.stringify` on whatever each one had at hand. A row that cannot be parsed, or that parses
+    // to something other than an object, must not take the whole page down with it: the reader would
+    // then be stuck at that cursor forever with no way past. An unreadable payload becomes `{}` and
+    // the event itself still arrives — the fact that something happened is the part a change feed
+    // cannot afford to lose.
+    try {
+        const parsed = JSON.parse(row.metadata_json);
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+            metadata = parsed;
+        }
+    }
+    catch {
+        metadata = {};
+    }
+    return {
+        id: row.id,
+        actorId: row.actor_id,
+        action: row.action,
+        resourceType: "node",
+        resourceId: row.resource_id,
+        metadata,
+        occurredAt: row.occurred_at,
+    };
+}
+/**
+ * The journal, cut down to the rows this actor may see, continued from a stable position.
+ *
+ * ⚠️ **The visibility check is a JOIN against `allowed`, evaluated on every call.** `allowed` is
+ * the same tree walk `nodes` reads through (`db-grants.ts`), so an event about a node is visible
+ * exactly when the node is — no second rule that could drift from the first. It runs per row and
+ * per request; nothing here is cached, so a grant revoked a second ago is gone from the next
+ * answer.
+ *
+ * ⚠️ It filters the EXISTENCE of the row, not only its contents. That is deliberate and it is
+ * the stricter reading: that something is moving inside a customer's folder is itself
+ * information, so an actor who may not read the node learns nothing at all — not an id, not a
+ * count, not a timestamp.
+ *
+ * ⚠️ **An event about a purged node is therefore unreachable, for everybody.** `allowed` walks
+ * `nodes`, and after `node.purge` that row is gone, so the join finds nothing. This is not an
+ * oversight and it cannot be fixed without giving up the check: at a deleted row there is no
+ * longer anything against which a claim to have been allowed to read it could be tested. Hiding
+ * is the safe direction. A consumer learns about creation, change, moves and archiving — never
+ * about final deletion (#620).
+ *
+ * ⚠️ **`ORDER BY` and the cursor comparison must name BOTH columns, in the same order.** Two
+ * events in the same millisecond are the normal case in a batch, not the exception; on
+ * `occurred_at` alone the second one is skipped in silence — no error, no log, just an event
+ * that never arrived. The tuple comparison below is written out by hand because SQLite has no
+ * row-value comparison here: "later timestamp, OR same timestamp and larger id".
+ */
+export const auditFeedQuery = `${subtreeCte}
+    SELECT e.id, e.actor_id, e.action, e.resource_id, e.metadata_json, e.occurred_at
+    FROM audit_events e
+    JOIN allowed ON allowed.id = e.resource_id
+    WHERE e.resource_type = 'node'
+      AND (
+        ? IS NULL
+        OR e.occurred_at > ?
+        OR (e.occurred_at = ? AND e.id > ?)
+      )
+    ORDER BY e.occurred_at ASC, e.id ASC
+    LIMIT ?`;
+export function createAuditRepository(deps) {
+    const page = auditFeedQuery;
+    return {
+        async listNodeEvents(actor, query) {
+            const after = query.after ?? null;
+            const bindings = [
+                ...subtreeBindings(actor, "read", deps.now().toISOString()),
+                after === null ? null : after.occurredAt,
+                after === null ? null : after.occurredAt,
+                after === null ? null : after.occurredAt,
+                after === null ? null : after.id,
+                query.limit,
+            ];
+            const result = await deps.db
+                .prepare(page)
+                .bind(...bindings)
+                .all();
+            const rows = result.results ?? [];
+            return { events: rows.map(mapEvent) };
+        },
+    };
+}

package/dist/adapters/db/db-boards.d.ts

@@ -0,0 +1,6 @@
+import type { BoardRepository } from "../../boards/boards.types.js";
+import type { D1Database } from "./db.types.js";
+export declare function createBoardRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): BoardRepository;

package/dist/adapters/db/db-boards.js

@@ -0,0 +1,239 @@
+import { ARCHIVE_COLUMN_ID, BoardColumn } from "@anchrd/intel-contract/board";
+import { subtreeBindings, subtreeCte } from "./db-grants.js";
+function parseList(raw, of) {
+    // The column is `NOT NULL DEFAULT '[]'`, but it is JSON written by this repository and read back
+    // by it — a value that cannot be parsed is a defect, not a caller's mistake. It must still not
+    // take the whole board down: one unreadable row would make the board unopenable, and there would
+    // be no way in to repair it.
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        void of;
+        return [];
+    }
+}
+function mapTask(row, boardId) {
+    return {
+        id: row.id,
+        title: row.title,
+        /**
+         * ⚠️ **An archived card reports the ARCHIVE column, not the one it came from** — that is what
+         * makes the column real instead of a label. `board_tasks.status` keeps naming the working
+         * column underneath, untouched, and that is what a card pulled back out returns to.
+         *
+         * A card archived over `node_archive`, without anybody dragging it, therefore appears here too.
+         * That is the test which tells this design apart from a second stored status (D68).
+         */
+        status: row.archived_at === null ? row.status : ARCHIVE_COLUMN_ID,
+        assigneeId: row.assignee_id,
+        labels: parseList(row.labels_json, "labels").filter((entry) => typeof entry === "string"),
+        startDate: row.start_date,
+        dueDate: row.due_date,
+        dependsOn: row.depends_on,
+        // ⚠️ The board itself is not a parent TASK. A card filed directly on the board has
+        // `parent_id = boardId`, and handing that back as `parentTaskId` would make every top-level
+        // card claim to be a subtask of the board — a tree one level too deep, in every view.
+        parentTaskId: row.parent_id === boardId ? null : row.parent_id,
+        position: row.position,
+        archivedAt: row.archived_at,
+    };
+}
+export function createBoardRepository(deps) {
+    /**
+     * ⚠️ **The VERB is a parameter, and every caller has to name it.** It was hard-wired to `"read"`
+     * once, and the consequence was not a missing check but the WRONG one: `columnsOf` and `taskRow`
+     * are the only gates the board service passes before it writes, so a board shared read-only could
+     * have its columns replaced and its cards moved. The refusal was there, it simply asked whether
+     * the actor may LOOK (ADR-0004 §2).
+     */
+    const walkBindings = (actor, verb) => subtreeBindings(actor, verb, deps.now().toISOString());
+    return {
+        /**
+         * The whole board in ONE answer: the node, its columns, and every card the actor may see.
+         *
+         * ⚠️ **`JOIN allowed` on the TASK, not only on the board.** Reaching the board is not the same
+         * question as reaching a card in it — a grant can sit on a single task, and one on the board
+         * does not make its tasks readable by a different rule than the tree uses. Asking once at the
+         * top would be a second authorization model beside `allowed`, and the two would drift.
+         *
+         * ⚠️ **Every filter is a WHERE, never a pass over the result.** A filter applied after reading
+         * has already carried the rows over the wire — which for `assigneeId` means titles of other
+         * people's cards in an answer that was supposed to exclude them.
+         */
+        async read(actor, input) {
+            const board = await deps.db
+                .prepare(`${subtreeCte}
+          SELECT n.id, n.title, COALESCE(b.statuses_json, '[]') AS statuses_json,
+                 COALESCE(b.archive_visible, 1) AS archive_visible
+          FROM nodes n
+          JOIN allowed ON allowed.id = n.id
+          LEFT JOIN boards b ON b.node_id = n.id
+          WHERE n.id = ? AND n.kind = 'board'`)
+                .bind(...walkBindings(actor, "read"), input.boardId)
+                .first();
+            if (board === null)
+                return null;
+            const conditions = ["t.board_id = ?"];
+            const bindings = [input.boardId];
+            if (input.status === ARCHIVE_COLUMN_ID) {
+                // ⚠️ The archive column is not a stored status — `board_tasks.status` keeps naming the
+                // working column underneath (D68). Matched against `t.status` the filter would answer
+                // "nothing here" on a board full of visibly archived cards, and the column would look
+                // broken rather than empty.
+                conditions.push("n.archived_at IS NOT NULL");
+            }
+            else if (input.status !== undefined) {
+                conditions.push("t.status = ?");
+                bindings.push(input.status);
+            }
+            if (input.assigneeId !== undefined) {
+                conditions.push("t.assignee_id = ?");
+                bindings.push(input.assigneeId);
+            }
+            if (input.dueBefore !== undefined) {
+                // ⚠️ `t.due_date IS NOT NULL` is not redundant beside `<`: in SQLite `NULL < 'x'` is NULL,
+                // which is not true, so the rows would be dropped anyway — but writing it out says that
+                // dropping them is the DECISION. A task with no due date is not "due before" anything.
+                conditions.push("t.due_date IS NOT NULL AND t.due_date < ?");
+                bindings.push(input.dueBefore);
+            }
+            if (input.dependsOn !== undefined) {
+                conditions.push("t.depends_on = ?");
+                bindings.push(input.dependsOn);
+            }
+            /**
+             * ⚠️ **The archive column IS the archived cards** (D68, #674). While it is drawn they belong
+             * in the answer, or the column would always be empty and nobody could pull anything back out
+             * of it. `includeArchived` stays for the other direction: a caller — an agent, a report —
+             * that wants them even on a board where the column is hidden.
+             */
+            const archiveVisible = board.archive_visible !== 0;
+            if (!input.includeArchived && !archiveVisible)
+                conditions.push("n.archived_at IS NULL");
+            const tasks = await deps.db
+                .prepare(`${subtreeCte}
+          SELECT n.id, n.title, n.parent_id, t.status, t.assignee_id, t.labels_json,
+                 t.start_date, t.due_date, t.depends_on, t.position, n.archived_at
+          FROM board_tasks t
+          JOIN nodes n ON n.id = t.node_id
+          JOIN allowed ON allowed.id = n.id
+          WHERE ${conditions.join(" AND ")}
+          ORDER BY t.status, t.position, n.id`)
+                .bind(...walkBindings(actor, "read"), ...bindings)
+                .all();
+            // ⚠️ The CONFIGURED columns only. The archive column is appended by the service, after the
+            // fallback for an unconfigured board has been applied — appended here it would make every
+            // board look configured, and a board with no columns of its own would answer with the
+            // archive and nothing else.
+            const columns = parseList(board.statuses_json, "columns")
+                .map((entry) => BoardColumn.safeParse(entry))
+                .filter((parsed) => parsed.success)
+                .map((parsed) => parsed.data);
+            return {
+                boardId: board.id,
+                title: board.title,
+                archiveVisible,
+                columns,
+                tasks: (tasks.results ?? []).map((row) => mapTask(row, board.id)),
+            };
+        },
+        async columnsOf(actor, boardId, verb) {
+            const row = await deps.db
+                .prepare(`${subtreeCte}
+          SELECT COALESCE(b.statuses_json, '[]') AS statuses_json
+          FROM nodes n
+          JOIN allowed ON allowed.id = n.id
+          LEFT JOIN boards b ON b.node_id = n.id
+          WHERE n.id = ? AND n.kind = 'board'`)
+                .bind(...walkBindings(actor, verb), boardId)
+                .first();
+            if (row === null)
+                return null;
+            return parseList(row.statuses_json, "columns")
+                .map((entry) => BoardColumn.safeParse(entry))
+                .filter((parsed) => parsed.success)
+                .map((parsed) => parsed.data.id);
+        },
+        async setColumns(boardId, columnsJson, occurredAt, archiveVisible) {
+            // ⚠️ `COALESCE(?, archive_visible)` rather than a second statement: an absent flag means
+            // "leave it", and writing a default here would un-hide an archive somebody put away every
+            // time the columns are reordered.
+            await deps.db
+                .prepare(`INSERT INTO boards (node_id, statuses_json, archive_visible, created_at, updated_at)
+          VALUES (?, ?, COALESCE(?, 1), ?, ?)
+          ON CONFLICT(node_id) DO UPDATE SET statuses_json = excluded.statuses_json,
+                                             archive_visible = COALESCE(?, boards.archive_visible),
+                                             updated_at = excluded.updated_at`)
+                .bind(boardId, columnsJson, archiveVisible === undefined ? null : Number(archiveVisible), occurredAt, occurredAt, archiveVisible === undefined ? null : Number(archiveVisible))
+                .run();
+        },
+        /**
+         * The row that makes a node a card.
+         *
+         * ⚠️ `INSERT … ON CONFLICT DO NOTHING`, because this runs on a path that may already have run:
+         * `nodes.create` under a board writes it, and so does `board_task_create`. Two rows are
+         * impossible (the primary key), and a second call must not overwrite a status somebody has
+         * since changed.
+         */
+        async attach(write) {
+            await deps.db
+                .prepare(`INSERT INTO board_tasks (
+            node_id, board_id, status, assignee_id, labels_json,
+            start_date, due_date, depends_on, position, created_at, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(node_id) DO NOTHING`)
+                .bind(write.nodeId, write.boardId, write.status, write.assigneeId, JSON.stringify(write.labels), write.startDate, write.dueDate, write.dependsOn, write.position, write.occurredAt, write.occurredAt)
+                .run();
+        },
+        async taskRow(actor, taskId, verb) {
+            const row = await deps.db
+                .prepare(`${subtreeCte}
+          SELECT t.node_id, t.board_id, t.status, t.position, n.archived_at, n.updated_at
+          FROM board_tasks t
+          JOIN nodes n ON n.id = t.node_id
+          JOIN allowed ON allowed.id = n.id
+          WHERE t.node_id = ?`)
+                .bind(...walkBindings(actor, verb), taskId)
+                .first();
+            if (row === null)
+                return null;
+            return {
+                nodeId: row.node_id,
+                boardId: row.board_id,
+                status: row.status,
+                position: row.position,
+                archivedAt: row.archived_at,
+                updatedAt: row.updated_at,
+            };
+        },
+        /**
+         * ⚠️ Only the named columns are written, and the statement is built from the fields that
+         * arrived. A full-row `UPDATE` would turn "move this card" into "write every field I happen to
+         * be holding" — and two people editing two different fields of one task would overwrite each
+         * other with values neither of them touched.
+         */
+        async updateTask(taskId, fields, occurredAt) {
+            const sets = ["updated_at = ?"];
+            const bindings = [occurredAt];
+            for (const [column, value] of Object.entries(fields)) {
+                sets.push(`${column} = ?`);
+                bindings.push(value);
+            }
+            await deps.db
+                .prepare(`UPDATE board_tasks SET ${sets.join(", ")} WHERE node_id = ?`)
+                .bind(...bindings, taskId)
+                .run();
+        },
+        async nextPosition(boardId, status) {
+            const row = await deps.db
+                .prepare("SELECT MAX(position) AS top FROM board_tasks WHERE board_id = ? AND status = ?")
+                .bind(boardId, status)
+                .first();
+            // A whole number apart, so the first drop between two cards has room for a midpoint without
+            // needing fractions immediately.
+            return (row?.top ?? 0) + 1;
+        },
+    };
+}

package/dist/adapters/db/db.js

@@ -112,19 +112,39 @@ export function createNodeRepository(deps) {
      * ⚠️ In the bounded form `LIMIT` follows the `WHERE`, so the cut falls among the rows this actor
      * may see and never before them, and `COUNT(*) OVER ()` counts those same rows alone (#30).
      */
+    /**
+     * The kinds the FOLDER TREE does not show. A task belongs to its board and is reached there
+     * (D66, #376); the tree would otherwise flood with three hundred cards, which is the objection
+     * that sank the node-per-task idea the first time it was proposed.
+     *
+     * ⚠️ It is a cut in the STATEMENT, not a filter in the interface. Filtered later, the rows have
+     * already crossed the wire — titles of other people's tasks inside an answer that was not
+     * supposed to carry them.
+     *
+     * ⚠️ It says nothing about reachability. A task keeps its own address, its own grants and its own
+     * place in search and in the relation graph; only this one level query looks away. Hiding it
+     * everywhere would make a link to a task a dead end.
+     */
+    const notInTree = (alias) => `${alias}.kind <> 'task'`;
     const visibleChildren = (bounded) => `${visibleCte}
     SELECT ${nodeColumns}${bounded ? ", COUNT(*) OVER () AS total" : ""},
       -- Whether this row has children THIS actor may see (#59), asked of the same allowed set one
       -- level down. A second rule written here would drift from the one above it, and the drift
       -- would show as a chevron that opens onto nothing.
+      --
+      -- ⚠️ The same cut here as below, and it is the SAME rule read twice rather
+      -- than a second one: a board's children are all tasks, so with them hidden it has none this
+      -- actor can see, and the chevron falls away by itself (D66, #376). Leaving it out here would
+      -- draw a chevron that opens onto an empty level — exactly the drift the comment above warns
+      -- about, arriving through the door it was written for.
       EXISTS (
         SELECT 1 FROM nodes child
         JOIN allowed AS allowed_child ON allowed_child.id = child.id
-        WHERE child.parent_id = n.id AND child.archived_at IS NULL
+        WHERE child.parent_id = n.id AND child.archived_at IS NULL AND ${notInTree("child")}
       ) AS has_children
     FROM nodes n
     JOIN allowed ON allowed.id = n.id
-    WHERE ${levelPredicate} AND (? = 1 OR n.archived_at IS NULL)
+    WHERE ${levelPredicate} AND (? = 1 OR n.archived_at IS NULL) AND ${notInTree("n")}
     ORDER BY CASE n.kind WHEN 'folder' THEN 0 ELSE 1 END, lower(n.title), n.id${bounded ? " LIMIT ?" : ""}`;
     /**
      * Everything archived that this actor may see, wherever it sits (#113).
@@ -156,6 +176,22 @@ export function createNodeRepository(deps) {
                 withChildren: rows.filter((row) => row.has_children === 1).map((row) => row.id),
             };
         },
+        /**
+         * ⚠️ Deliberately NOT `visibleChildren`: that builder cuts tasks out of every level, so it
+         * answers `0` for a task with any number of subtasks. This one asks the question the guard
+         * actually has — "is anything still hanging under this node".
+         */
+        async countLiveChildren(nodeId) {
+            // ⚠️ No `allowed` join, deliberately: a grant can sit on a single node, so a child may be
+            // invisible to whoever archives its parent. Filtered by visibility this answers `0`, the
+            // refusal does not fire, and the child is later purged without being named. A count leaks a
+            // number and nothing else; the alternative leaks the child itself, permanently.
+            const result = await deps.db
+                .prepare("SELECT COUNT(*) AS total FROM nodes WHERE parent_id = ? AND archived_at IS NULL")
+                .bind(nodeId)
+                .first();
+            return result?.total ?? 0;
+        },
         async listVisibleBounded(actor, input) {
             const result = await deps.db
                 .prepare(visibleChildren(true))

package/dist/audit/audit.d.ts

@@ -0,0 +1,2 @@
+import type { AuditDeps, AuditService } from "./audit.types.js";
+export declare function createAudit(deps: AuditDeps): AuditService;

package/dist/audit/audit.js

@@ -0,0 +1,72 @@
+import { IntelError } from "../shared/intel-error/intel-error.js";
+// The separator inside the encoded cursor. `\0` cannot occur in either half: an ISO timestamp
+// is digits and punctuation, an Intel id is Crockford base32. Splitting on the FIRST occurrence
+// would still be safe, but there is no occurrence to split on.
+const SEPARATOR = "\0";
+/**
+ * The pair, made into one string a reader cannot take apart by accident.
+ *
+ * ⚠️ This is not encryption and does not pretend to be. Anyone determined can decode base64url and
+ * read a timestamp. The point is the accident, not the attacker: a cursor that LOOKS like a
+ * timestamp invites a caller to send a timestamp, and a timestamp alone loses every second event
+ * written in the same millisecond. Making the shape unusable by hand is what keeps the pair whole.
+ */
+function encodeCursor(position) {
+    const raw = `${position.occurredAt}${SEPARATOR}${position.id}`;
+    return btoa(String.fromCharCode(...new TextEncoder().encode(raw)))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replaceAll("=", "");
+}
+function decodeCursor(cursor) {
+    // A cursor comes back from a consumer that stored it, possibly weeks ago, possibly truncated by
+    // whatever stored it. Every failure below is the same answer: this is not a cursor this service
+    // handed out. Guessing a position from a damaged one would silently move the reader — forward
+    // past unread events, or backward into duplicates.
+    const refuse = () => new IntelError(400, "invalid_cursor", "The cursor is not one this service issued. Pass back the nextCursor from a previous response unchanged, or omit it to start from the beginning.");
+    let raw;
+    try {
+        const padded = cursor.replaceAll("-", "+").replaceAll("_", "/");
+        const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+        raw = new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+    }
+    catch {
+        throw refuse();
+    }
+    const separator = raw.indexOf(SEPARATOR);
+    if (separator <= 0 || separator === raw.length - 1)
+        throw refuse();
+    const occurredAt = raw.slice(0, separator);
+    const id = raw.slice(separator + 1);
+    // ⚠️ Both halves are checked, not just the split. A cursor whose timestamp decoded to an empty
+    // string would compare as "before everything" and quietly replay the whole journal.
+    if (occurredAt.length === 0 || id.length === 0)
+        throw refuse();
+    return { occurredAt, id };
+}
+export function createAudit(deps) {
+    return {
+        async list(actor, input) {
+            // `resourceType` is validated by the contract enum before it reaches here; the value is
+            // named again rather than assumed, so adding `flow` to the enum later cannot silently route
+            // flow events through the node visibility walk.
+            if (input.resourceType !== "node") {
+                throw new IntelError(400, "unsupported_resource_type", "Only node events can be listed today. Flow and flow-run events need their own visibility check and are refused rather than omitted, so that an empty answer never has to mean two different things.");
+            }
+            const after = input.after === undefined ? null : decodeCursor(input.after);
+            // One more than asked for, so "is there another page" is answered by the same authorized
+            // query instead of a second one that could disagree with it.
+            const page = await deps.audit.listNodeEvents(actor, { after, limit: input.limit + 1 });
+            const hasMore = page.events.length > input.limit;
+            const events = hasMore ? page.events.slice(0, input.limit) : page.events;
+            const last = events.at(-1);
+            return {
+                events,
+                // ⚠️ The cursor is the LAST DELIVERED row, never the probe row that was dropped. Taking it
+                // from the probe would skip exactly one event per page — the classic off-by-one that shows
+                // up as a lead nobody contacted, not as an error.
+                nextCursor: hasMore && last !== undefined ? encodeCursor(last) : null,
+            };
+        },
+    };
+}

package/dist/audit/audit.types.d.ts

@@ -0,0 +1,22 @@
+import type { AuditEvent, AuditListRequest, AuditListResponse } from "@anchrd/intel-contract/audit";
+import type { Actor } from "../nodes/nodes.types.js";
+export interface AuditPosition {
+    occurredAt: string;
+    id: string;
+}
+export interface AuditQuery {
+    after: AuditPosition | null;
+    limit: number;
+}
+export interface AuditPage {
+    events: AuditEvent[];
+}
+export interface AuditRepository {
+    listNodeEvents(actor: Actor, query: AuditQuery): Promise<AuditPage>;
+}
+export interface AuditDeps {
+    audit: AuditRepository;
+}
+export interface AuditService {
+    list(actor: Actor, input: AuditListRequest): Promise<AuditListResponse>;
+}

package/dist/audit/audit.types.js

@@ -0,0 +1 @@
+export {};

package/dist/boards/boards.d.ts

@@ -0,0 +1,30 @@
+import type { BoardDeps, BoardService } from "./boards.types.js";
+/**
+ * What a board with no configuration answers with. A board is usable the moment it is created, and
+ * nothing asks whoever made it to define columns before filing the first card.
+ *
+ * ⚠️ **This is the FALLBACK, not what a board made through the application gets.** Columns are
+ * shared data: two people on one board must read the same names, and the settings dialog edits one
+ * list. So the application writes them at creation, in the language of whoever created it (#675),
+ * and from then on they are data anybody can rename. This list only answers for a board nobody
+ * configured — one made over MCP, or one whose seeding did not land.
+ */
+export declare const DEFAULT_COLUMNS: readonly [{
+    readonly id: "backlog";
+    readonly title: "Backlog";
+    readonly terminal: false;
+}, {
+    readonly id: "todo";
+    readonly title: "Offen";
+    readonly terminal: false;
+}, {
+    readonly id: "doing";
+    readonly title: "Läuft";
+    readonly terminal: false;
+}, {
+    readonly id: "done";
+    readonly title: "Fertig";
+    readonly terminal: true;
+}];
+export declare const FIRST_DEFAULT_COLUMN: "backlog";
+export declare function createBoards(deps: BoardDeps): BoardService;