@anchrd/intel-api 0.32.0 → 0.34.0

package/dist/adapters/cloudflare/cloudflare.js

@@ -5,6 +5,7 @@ import { createAudit } from "../../audit/audit.js";
 import { createBrowserAuth } from "../../auth/auth.js";
 import { createBoards, FIRST_DEFAULT_COLUMN } from "../../boards/boards.js";
 import { createBundle } from "../../bundle/bundle.js";
+import { createFeed } from "../../feed/feed.js";
 import { createFlows } from "../../flows/flows.js";
 import { createIndexing, PermanentIndexingError } from "../../indexing/indexing.js";
 import { createIntel } from "../../intel/intel.js";
@@ -17,6 +18,7 @@ import { createContentStore } from "../content/content.js";
 import { createNodeRepository } from "../db/db.js";
 import { createAuditRepository } from "../db/db-audit.js";
 import { createBoardRepository } from "../db/db-boards.js";
+import { createFeedRepository } from "../db/db-feed.js";
 import { createFlowRepository } from "../db/db-flows.js";
 import { createNodeIndexRepository } from "../db/db-indexing.js";
 import { createOAuthClientStore } from "../db/db-oauth.js";
@@ -69,6 +71,7 @@ export default {
         const flowRepository = createFlowRepository({ db: env.DB, now });
         const nodeRepository = createNodeRepository({ db: env.DB, now });
         const auditRepository = createAuditRepository({ db: env.DB, now });
+        const feedRepository = createFeedRepository({ db: env.DB, now });
         const boardRepository = createBoardRepository({ db: env.DB, now });
         const contentStore = createContentStore(env.CONTENT);
         const gate = createGateClient({ url: env.GATE_URL, serviceKey: env.GATE_SERVICE_KEY });
@@ -257,6 +260,7 @@ export default {
             flows,
             tools,
             audit: createAudit({ audit: auditRepository }),
+            feed: createFeed({ feed: feedRepository }),
             boards: createBoards({
                 boards: boardRepository,
                 nodes,

package/dist/adapters/db/db-feed.d.ts

@@ -0,0 +1,40 @@
+import type { FeedRepository } from "../../feed/feed.types.js";
+import type { D1Database } from "./db.types.js";
+/**
+ * One page of the journal, newest first, cut down to the rows this actor may see.
+ *
+ * ⚠️ **The visibility check is the same JOIN against `allowed` that `audit_list` uses**, which is
+ * the same tree walk `nodes` reads through (`db-grants.ts`). An event about a node is visible
+ * exactly when the node is. A second, similar-looking query beside the first is the drift that
+ * `anchrd/intel#457` was built out of: two queries with similar names are two different questions.
+ *
+ * ⚠️ **`ORDER BY` and the cursor comparison name BOTH columns, in the same direction.** Two events
+ * in the same millisecond are the normal case inside a batch, not the exception; on `occurred_at`
+ * alone the second one is skipped in silence. SQLite has no row-value comparison here, so the
+ * tuple comparison is written out: "earlier timestamp, OR same timestamp and smaller id".
+ *
+ * ⚠️ **Both columns descend, and that is what lets the index carry this.** `audit_events_feed_idx`
+ * is `(resource_type, occurred_at, id)` ascending; SQLite reads an index backwards only when every
+ * sort column is reversed together. Reversing one would cost a sort over the whole table, and that
+ * is invisible on the first pages and only hurts far down.
+ */
+export declare const feedPageQuery: string;
+/**
+ * The folders above each of a page's nodes, and only the ones the actor may open.
+ *
+ * ⚠️ **The walk upwards is filtered too, and leaving that out would be a leak.** Grants inherit
+ * DOWNWARDS: a grant handed out on a deep node says nothing about the folders above it. Without the
+ * join against `allowed`, a breadcrumb would spell out the names of folders the reader may not
+ * open — on a surface whose entire premise is that it shows nothing one is not entitled to. A
+ * segment that fails the check drops out, and the trail is simply shorter.
+ *
+ * ⚠️ `UNION` and not `UNION ALL`, and no depth column. A cycle in `parent_id` can reach this table,
+ * and `UNION` ends the walk because the row repeats — a depth counter would make every row unique
+ * and turn the same cycle into a query that never returns. The order is rebuilt in TypeScript from
+ * `parent_id`, where a visited-set makes the cycle harmless.
+ */
+export declare const feedAncestorsQuery: (seeds: number) => string;
+export declare function createFeedRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): FeedRepository;

package/dist/adapters/db/db-feed.js

@@ -0,0 +1,154 @@
+import { FeedAction } from "@anchrd/intel-contract/feed";
+import { subtreeBindings, subtreeCte } from "./db-grants.js";
+// Built once from the contract enum rather than written out here: two lists of actions that have to
+// agree would eventually stop agreeing, and the one that silently wins is the SQL.
+const ACTIONS = FeedAction.options;
+const ACTION_PLACEHOLDERS = ACTIONS.map(() => "?").join(", ");
+function parseMetadata(raw) {
+    // The column is `NOT NULL DEFAULT '{}'` but it is written by eleven call sites over
+    // `JSON.stringify` on whatever each had at hand. A row that cannot be parsed must not take the
+    // page down with it: the reader would be stuck at that position with no way past. An unreadable
+    // payload becomes `{}` and the event still arrives — that something happened is the part a feed
+    // cannot afford to lose.
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        return {};
+    }
+    return {};
+}
+/**
+ * One page of the journal, newest first, cut down to the rows this actor may see.
+ *
+ * ⚠️ **The visibility check is the same JOIN against `allowed` that `audit_list` uses**, which is
+ * the same tree walk `nodes` reads through (`db-grants.ts`). An event about a node is visible
+ * exactly when the node is. A second, similar-looking query beside the first is the drift that
+ * `anchrd/intel#457` was built out of: two queries with similar names are two different questions.
+ *
+ * ⚠️ **`ORDER BY` and the cursor comparison name BOTH columns, in the same direction.** Two events
+ * in the same millisecond are the normal case inside a batch, not the exception; on `occurred_at`
+ * alone the second one is skipped in silence. SQLite has no row-value comparison here, so the
+ * tuple comparison is written out: "earlier timestamp, OR same timestamp and smaller id".
+ *
+ * ⚠️ **Both columns descend, and that is what lets the index carry this.** `audit_events_feed_idx`
+ * is `(resource_type, occurred_at, id)` ascending; SQLite reads an index backwards only when every
+ * sort column is reversed together. Reversing one would cost a sort over the whole table, and that
+ * is invisible on the first pages and only hurts far down.
+ */
+export const feedPageQuery = `${subtreeCte}
+    SELECT e.id, e.actor_id, e.action, e.resource_id, n.title AS node_title,
+           n.parent_id AS node_parent_id, e.metadata_json, e.occurred_at
+    FROM audit_events e
+    JOIN allowed ON allowed.id = e.resource_id
+    JOIN nodes n ON n.id = e.resource_id
+    WHERE e.resource_type = 'node'
+      AND e.action IN (${ACTION_PLACEHOLDERS})
+      AND (? IS NULL OR e.actor_id = ?)
+      AND (
+        ? IS NULL
+        OR e.occurred_at < ?
+        OR (e.occurred_at = ? AND e.id < ?)
+      )
+    ORDER BY e.occurred_at DESC, e.id DESC
+    LIMIT ?`;
+/**
+ * The folders above each of a page's nodes, and only the ones the actor may open.
+ *
+ * ⚠️ **The walk upwards is filtered too, and leaving that out would be a leak.** Grants inherit
+ * DOWNWARDS: a grant handed out on a deep node says nothing about the folders above it. Without the
+ * join against `allowed`, a breadcrumb would spell out the names of folders the reader may not
+ * open — on a surface whose entire premise is that it shows nothing one is not entitled to. A
+ * segment that fails the check drops out, and the trail is simply shorter.
+ *
+ * ⚠️ `UNION` and not `UNION ALL`, and no depth column. A cycle in `parent_id` can reach this table,
+ * and `UNION` ends the walk because the row repeats — a depth counter would make every row unique
+ * and turn the same cycle into a query that never returns. The order is rebuilt in TypeScript from
+ * `parent_id`, where a visited-set makes the cycle harmless.
+ */
+export const feedAncestorsQuery = (seeds) => `${subtreeCte},
+  ancestry(seed, id, parent_id, title) AS (
+    SELECT child.id, parent.id, parent.parent_id, parent.title
+    FROM nodes child
+    JOIN nodes parent ON parent.id = child.parent_id
+    WHERE child.id IN (${Array.from({ length: seeds }, () => "?").join(", ")})
+    UNION
+    SELECT a.seed, grandparent.id, grandparent.parent_id, grandparent.title
+    FROM nodes grandparent
+    JOIN ancestry a ON a.parent_id = grandparent.id
+  )
+  SELECT a.seed, a.id, a.parent_id, a.title
+  FROM ancestry a
+  JOIN allowed ON allowed.id = a.id`;
+/**
+ * The chain from the root down to (but not including) the node itself.
+ *
+ * Built here rather than in SQL because ordering it there would need a depth counter, and a depth
+ * counter is what turns a cycle into a hang. `seen` is the same guard on this side.
+ *
+ * ⚠️ It starts at the node's OWN `parent_id` and not at "some row with this seed": every ancestor
+ * of a node carries the same seed, and the order rows come back in is not promised. Picking the
+ * first one would put a random grandparent at the near end of the trail.
+ *
+ * ⚠️ The chain stops where visibility stops. If the actor may read a node but not the folder above
+ * it — grants inherit downwards, so a deep grant says nothing about the folders over it — that
+ * folder is absent from `rows`, the walk ends, and the trail is short. Short is the honest answer;
+ * skipping the gap and carrying on with the grandparent would spell out a place the reader cannot
+ * reach.
+ */
+function trailFor(parentId, rows) {
+    const byId = new Map(rows.map((row) => [row.id, row]));
+    const trail = [];
+    const seen = new Set();
+    let current = parentId === null ? undefined : byId.get(parentId);
+    while (current !== undefined && !seen.has(current.id)) {
+        seen.add(current.id);
+        trail.push({ id: current.id, title: current.title });
+        current = current.parent_id === null ? undefined : byId.get(current.parent_id);
+    }
+    return trail.reverse();
+}
+export function createFeedRepository(deps) {
+    return {
+        async listEvents(actor, query) {
+            const before = query.before ?? null;
+            const page = await deps.db
+                .prepare(feedPageQuery)
+                .bind(...subtreeBindings(actor, "read", deps.now().toISOString()), ...ACTIONS, query.actor, query.actor, before === null ? null : before.occurredAt, before === null ? null : before.occurredAt, before === null ? null : before.occurredAt, before === null ? null : before.id, query.limit)
+                .all();
+            const rows = page.results ?? [];
+            if (rows.length === 0)
+                return { events: [] };
+            // One walk for the whole page rather than one per row. The set is at most the page size, and
+            // it is deduplicated because a busy morning on one document is exactly the case the feed
+            // shows unsummarised today.
+            const nodeIds = [...new Set(rows.map((row) => row.resource_id))];
+            const ancestors = await deps.db
+                .prepare(feedAncestorsQuery(nodeIds.length))
+                .bind(...subtreeBindings(actor, "read", deps.now().toISOString()), ...nodeIds)
+                .all();
+            const ancestorRows = ancestors.results ?? [];
+            const parentOf = new Map(rows.map((row) => [row.resource_id, row.node_parent_id]));
+            const trails = new Map(nodeIds.map((id) => [
+                id,
+                trailFor(parentOf.get(id) ?? null, ancestorRows.filter((row) => row.seed === id)),
+            ]));
+            const events = rows.map((row) => ({
+                id: row.id,
+                actorId: row.actor_id,
+                // Narrowed at the door by the SQL `IN`, so the cast names what the query already
+                // guarantees rather than trusting the column.
+                action: row.action,
+                nodeId: row.resource_id,
+                nodeTitle: row.node_title,
+                path: trails.get(row.resource_id) ?? [],
+                metadata: parseMetadata(row.metadata_json),
+                occurredAt: row.occurred_at,
+            }));
+            return { events };
+        },
+    };
+}

package/dist/feed/feed.d.ts

@@ -0,0 +1,2 @@
+import type { FeedDeps, FeedService } from "./feed.types.js";
+export declare function createFeed(deps: FeedDeps): FeedService;

package/dist/feed/feed.js

@@ -0,0 +1,77 @@
+import { IntelError } from "../shared/intel-error/intel-error.js";
+// The separator inside the encoded cursor. `\0` cannot occur in either half: an ISO timestamp is
+// digits and punctuation, an Intel id is Crockford base32.
+const SEPARATOR = "\0";
+// ⚠️ The marker is what keeps an audit cursor out of this door and a feed cursor out of that one.
+// Both encode the same pair, and without it each would decode the other's position happily — then
+// read on from the wrong END of the journal. The damage would not look like an error: the feed
+// would simply start somewhere in the past and quietly leave out everything since.
+const MARKER = "f1";
+/**
+ * The pair, made into one string a reader cannot take apart by accident.
+ *
+ * ⚠️ This is not encryption and does not pretend to be. Anyone determined can decode base64url and
+ * read a timestamp. The point is the accident, not the attacker: a cursor that LOOKS like a
+ * timestamp invites a caller to send a timestamp, and a timestamp alone loses every second event
+ * written in the same millisecond.
+ */
+function encodeCursor(position) {
+    const raw = `${MARKER}${SEPARATOR}${position.occurredAt}${SEPARATOR}${position.id}`;
+    return btoa(String.fromCharCode(...new TextEncoder().encode(raw)))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replaceAll("=", "");
+}
+function decodeCursor(cursor) {
+    // A cursor comes back from a consumer that stored it, possibly weeks ago, possibly truncated by
+    // whatever stored it, possibly meant for the other door. Every failure below is the same answer:
+    // this is not a cursor this door handed out. Guessing a position from a damaged one would move
+    // the reader in silence — past unread events, or back into ones already shown.
+    const refuse = () => new IntelError(400, "invalid_cursor", "The cursor is not one the feed issued. Pass back the nextCursor from a previous feed response unchanged, or omit it to start at the most recent event. A cursor from audit_list is not one of these.");
+    let raw;
+    try {
+        const padded = cursor.replaceAll("-", "+").replaceAll("_", "/");
+        const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+        raw = new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+    }
+    catch {
+        throw refuse();
+    }
+    const parts = raw.split(SEPARATOR);
+    if (parts.length !== 3)
+        throw refuse();
+    const [marker, occurredAt, id] = parts;
+    if (marker !== MARKER)
+        throw refuse();
+    // ⚠️ Both halves are checked, not just the split. A cursor whose timestamp decoded to an empty
+    // string would compare as "before everything" and answer with an empty page forever.
+    if (occurredAt === undefined || occurredAt.length === 0)
+        throw refuse();
+    if (id === undefined || id.length === 0)
+        throw refuse();
+    return { occurredAt, id };
+}
+export function createFeed(deps) {
+    return {
+        async list(actor, input) {
+            const before = input.before === undefined ? null : decodeCursor(input.before);
+            // One more than asked for, so "is there another page" is answered by the same authorized
+            // query instead of a second one that could disagree with it.
+            const page = await deps.feed.listEvents(actor, {
+                before,
+                actor: input.actor ?? null,
+                limit: input.limit + 1,
+            });
+            const hasMore = page.events.length > input.limit;
+            const events = hasMore ? page.events.slice(0, input.limit) : page.events;
+            const last = events.at(-1);
+            return {
+                events,
+                // ⚠️ The cursor is the LAST DELIVERED row, never the probe row that was dropped. Taking it
+                // from the probe would skip exactly one event per page — the off-by-one that shows up as a
+                // change nobody saw, not as an error.
+                nextCursor: hasMore && last !== undefined ? encodeCursor(last) : null,
+            };
+        },
+    };
+}

package/dist/feed/feed.types.d.ts

@@ -0,0 +1,23 @@
+import type { FeedEvent, FeedListRequest, FeedListResponse } from "@anchrd/intel-contract/feed";
+import type { Actor } from "../nodes/nodes.types.js";
+export interface FeedPosition {
+    occurredAt: string;
+    id: string;
+}
+export interface FeedQuery {
+    before: FeedPosition | null;
+    actor: string | null;
+    limit: number;
+}
+export interface FeedPage {
+    events: FeedEvent[];
+}
+export interface FeedRepository {
+    listEvents(actor: Actor, query: FeedQuery): Promise<FeedPage>;
+}
+export interface FeedDeps {
+    feed: FeedRepository;
+}
+export interface FeedService {
+    list(actor: Actor, input: FeedListRequest): Promise<FeedListResponse>;
+}

package/dist/feed/feed.types.js

@@ -0,0 +1 @@
+export {};

package/dist/http/http.js

@@ -1,5 +1,6 @@
 import { AuditListRequest } from "@anchrd/intel-contract/audit";
 import { BoardAssigneeResolveInput, BoardAssigneeSearchInput, BoardGetInput, BoardTaskCreateInput, BoardTaskUpdateInput, BoardUpdateInput, } from "@anchrd/intel-contract/board";
+import { FeedListRequest } from "@anchrd/intel-contract/feed";
 import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, PurgeFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
 import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
 import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, PurgeNodePreviewInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
@@ -225,6 +226,24 @@ export function createHttp(deps) {
         });
         return context.json(await deps.audit.list(asActor(auth), input));
     });
+    // The same journal read the other way round: newest first, for a person rather than for a
+    // consumer catching up (#740). `nodes/read` and nothing new, for the reason `/audit` gives.
+    //
+    // ⚠️ A SECOND door and not an option on `/audit`. That one is the contract `anchrd/signals` will
+    // build on, cursor and direction included; a shared signature would put both readers on one
+    // shape, and the next change to it would reach a consumer nobody had in mind.
+    app.get("/feed", async (context) => {
+        const auth = requireCapability(context, "nodes", "read");
+        const limit = context.req.query("limit");
+        const before = context.req.query("before");
+        const actor = context.req.query("actor");
+        const input = FeedListRequest.parse({
+            ...(actor === undefined ? {} : { actor }),
+            ...(before === undefined ? {} : { before }),
+            ...(limit === undefined ? {} : { limit: Number(limit) }),
+        });
+        return context.json(await deps.feed.list(asActor(auth), input));
+    });
     // The whole board in one answer (#648). `nodes/read` and nothing new: a board is a node, and a
     // card is a node — a second capability would be a second answer to one question.
     //

package/dist/http/http.types.d.ts

@@ -3,6 +3,7 @@ import type { AuditService } from "../audit/audit.types.js";
 import type { BrowserAuth } from "../auth/auth.types.js";
 import type { BoardService } from "../boards/boards.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
+import type { FeedService } from "../feed/feed.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
 import type { ToolService } from "../tools/tools.types.js";
@@ -13,6 +14,7 @@ export interface HttpDeps {
     tools: ToolService;
     bundle: BundleService;
     audit: AuditService;
+    feed: FeedService;
     boards: BoardService;
     resource: string;
     resourceMetadataUrl: string;

package/dist/intel/intel.js

@@ -135,6 +135,7 @@ export function createIntel(deps) {
         tools: deps.tools,
         bundle: deps.bundle,
         audit: deps.audit,
+        feed: deps.feed,
         boards: deps.boards,
         resource,
         resourceMetadataUrl,
@@ -184,6 +185,7 @@ export function createIntel(deps) {
             tools: deps.tools,
             bundle: deps.bundle,
             audit: deps.audit,
+            feed: deps.feed,
             boards: deps.boards,
         });
     });

package/dist/intel/intel.types.d.ts

@@ -3,6 +3,7 @@ import type { AuditService } from "../audit/audit.types.js";
 import type { BrowserAuth } from "../auth/auth.types.js";
 import type { BoardService } from "../boards/boards.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
+import type { FeedService } from "../feed/feed.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
 import type { ToolService } from "../tools/tools.types.js";
@@ -15,6 +16,7 @@ export interface IntelDeps {
     tools: ToolService;
     bundle: BundleService;
     audit: AuditService;
+    feed: FeedService;
     boards: BoardService;
     auth?: BrowserAuth;
 }

package/dist/mcp/mcp.js

@@ -1,6 +1,7 @@
 import { IdempotencyKey, IntelId } from "@anchrd/intel-contract";
 import { AuditListRequest } from "@anchrd/intel-contract/audit";
 import { BoardAssigneeResolveInput, BoardAssigneeSearchInput, BoardGetInput, BoardTaskCreateInput, BoardTaskUpdateInput, BoardUpdateInput, } from "@anchrd/intel-contract/board";
+import { FeedListRequest } from "@anchrd/intel-contract/feed";
 import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, PurgeFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
 import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
 import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, PurgeNodePreviewInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
@@ -263,6 +264,18 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.audit.list(actor, input)));
+        server.registerTool("feed_list", {
+            title: "List recent activity",
+            description: "Read the change journal backwards: what most recently happened to the nodes you may read, newest first, one entry per event. Each entry carries the node's current title and the folders above it, and only the folders you may open. Pass `nextCursor` back as `before` to keep going further into the past; a null `nextCursor` means you have reached the beginning. Pass `actor` to see one person's or one agent's work alone. This is the human-facing view — for catching up on everything in order, use audit_list, and do not mix the two cursors.",
+            inputSchema: FeedListRequest,
+            annotations: {
+                title: "List recent activity",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.feed.list(actor, input)));
         server.registerTool("node_list", {
             title: "List nodes",
             description: "List authorized folders, documents, attachments, and tables under one parent.",

package/dist/mcp/mcp.types.d.ts

@@ -2,6 +2,7 @@ import type { Authorized } from "@anchrd/gate-sdk";
 import type { AuditService } from "../audit/audit.types.js";
 import type { BoardService } from "../boards/boards.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
+import type { FeedService } from "../feed/feed.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
 import type { ToolService } from "../tools/tools.types.js";
@@ -17,5 +18,6 @@ export interface McpDeps {
     tools: ToolService;
     bundle: BundleService;
     audit: AuditService;
+    feed: FeedService;
     boards: BoardService;
 }

package/dist/nodes/nodes.js

@@ -120,16 +120,17 @@ async function boardFor(deps, actor, parent) {
         return null;
     return (await deps.boardOfTask?.(actor, parent.id)) ?? null;
 }
-function refuseArchivedParent(childKind, parent) {
-    // ⚠️ Tasks only, and the narrowness is deliberate. The same hole exists for a folder — archive an
-    // empty one, file a document in it, purge — but it is OLDER than this ticket and fixing it here
-    // would change the behaviour of the whole tree out of a board ticket, with no test outside
-    // `boards.int.ts` covering it. It is #679, which also asks what such data already exists.
+function refuseArchivedParent(parent) {
+    // ⚠️ EVERY kind, not just tasks (#679). It was narrowed to tasks in #677 because widening it out
+    // of a board ticket would have changed the whole tree with no test outside `boards.int.ts`; the
+    // hole it left is older than that ticket and is what this one closes.
     //
-    // ⚠️ A reference without its number is not a reference: the review of #677 searched for this
-    // ticket and could not find it, because this comment did not name it.
-    if (childKind !== "task")
-        return;
+    // ⚠️ **This asks the DIRECT parent only, and the hole one level up stays open** (#733). Archiving a
+    // folder that still holds something live is allowed for every kind but `task`, so `Aussen`
+    // archived over a live `Innen` still takes anything filed under `Innen` when it is purged:
+    // `inspectPurgeTree` walks the whole subtree and `purge` checks `archived_at` on the root alone.
+    // Closing that needs a decision (refuse the archive, cascade it, refuse the purge, or name the
+    // live nodes in the preview) and #733 carries it with the count of what already exists.
     if (parent === null || parent.archivedAt === null)
         return;
     throw new IntelError(409, "parent_archived", `This ${parent.kind} is archived, so nothing new can be filed under it. Restore it first.`);
@@ -597,7 +598,7 @@ export function createNodes(deps) {
             // reason — a task lives on a board — and saying "restore the folder first" would send the
             // reader to do something that changes nothing: restored, the folder still cannot hold a task.
             refuseWrongParent(input.kind, destinationParent, { destination: destinationBoard });
-            refuseArchivedParent(input.kind, destinationParent);
+            refuseArchivedParent(destinationParent);
             const timestamp = deps.now().toISOString();
             const created = await deps.repository.insertNode({
                 node: {
@@ -983,7 +984,7 @@ export function createNodes(deps) {
                     destination: destinationBoard,
                     current: currentBoard,
                 });
-                refuseArchivedParent(current.kind, parent);
+                refuseArchivedParent(parent);
             }
             const updatedAt = deps.now().toISOString();
             const updated = await deps.repository.updateNode({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.25.0",
-    "@anchrd/intel-contract": "^0.25.0",
+    "@anchrd/intel-contract": "^0.26.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",