@anchrd/intel-api 0.5.0 → 0.6.0

package/dist/adapters/db/db.js

@@ -89,7 +89,15 @@ export function createKnowledgeRepository(deps) {
      * may see and never before them, and `COUNT(*) OVER ()` counts those same rows alone (#30).
      */
     const visibleChildren = (bounded) => `${visibleCte}
-    SELECT ${nodeColumns}${bounded ? ", COUNT(*) OVER () AS total" : ""}
+    SELECT ${nodeColumns}${bounded ? ", COUNT(*) OVER () AS total" : ""},
+      -- Whether this row has children THIS actor may see (#59), asked of the same allowed set one
+      -- level down. A second rule written here would drift from the one above it, and the drift
+      -- would show as a chevron that opens onto nothing.
+      EXISTS (
+        SELECT 1 FROM knowledge_nodes child
+        JOIN allowed AS allowed_child ON allowed_child.id = child.id
+        WHERE child.parent_id = n.id AND child.archived_at IS NULL
+      ) AS has_children
     FROM knowledge_nodes n
     JOIN allowed ON allowed.id = n.id
     WHERE n.parent_id IS ? AND (? = 1 OR n.archived_at IS NULL)
@@ -100,7 +108,11 @@ export function createKnowledgeRepository(deps) {
                 .prepare(visibleChildren(false))
                 .bind(...readBindings(actor), input.parentId, input.includeArchived ? 1 : 0)
                 .all();
-            return (result.results ?? []).map(mapNode);
+            const rows = result.results ?? [];
+            return {
+                items: rows.map(mapNode),
+                withChildren: rows.filter((row) => row.has_children === 1).map((row) => row.id),
+            };
         },
         async listVisibleBounded(actor, input) {
             const result = await deps.db
@@ -151,10 +163,14 @@ export function createKnowledgeRepository(deps) {
             try {
                 await deps.db.batch([
                     deps.db
+                        // ⚠️ `context_policy` is dead and is written anyway (#76). The column is NOT NULL
+                        // without a DEFAULT and D1 will not let it be dropped — migration 0009 carries the
+                        // reason. The fixed value is the price; nothing reads it, and the contract no longer
+                        // knows the field. When the column goes (anchrd/intel#86), this line goes with it.
                         .prepare(`INSERT INTO knowledge_nodes (
-            id, parent_id, kind, title, description, owner_id,
+            id, parent_id, kind, title, description, context_policy, owner_id,
             current_version_id, created_at, updated_at, archived_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+          ) VALUES (?, ?, ?, ?, ?, 'relevant', ?, ?, ?, ?, ?)`)
                         .bind(node.id, node.parentId, node.kind, node.title, node.description, node.ownerId, node.currentVersionId, node.createdAt, node.updatedAt, node.archivedAt),
                     deps.db
                         .prepare(`INSERT INTO idempotency_keys (

package/dist/flows/flows.js

@@ -280,6 +280,46 @@ export function createFlows(deps) {
     // library folder carries `execute` for everyone and nothing else (ADR-0004 §2/§3), so insisting on
     // `read` here would turn every library flow into a 404 for exactly the people it exists for — and
     // the call rule in section 3 would have nothing left to permit.
+    /**
+     * Which of these flows call another one that THIS actor may also see (#59).
+     *
+     * ⚠️ Per reader, and that is the point: a flow whose only call is hidden from this person has
+     * nothing to unfold, so a chevron there would promise what opening cannot deliver. `listCalls`
+     * filters the same way — asking the same question here, rather than reading the graph and hoping,
+     * is the only way the two cannot drift apart.
+     *
+     * ⚠️ Two reads for the whole level, never one per flow (#30): the versions come back together and
+     * the callees go out together.
+     */
+    async function callableCallers(actor, flows) {
+        const versionOf = new Map();
+        for (const flow of flows) {
+            const versionId = flow.currentVersionId ?? flow.publishedVersionId;
+            if (versionId)
+                versionOf.set(flow.id, versionId);
+        }
+        if (versionOf.size === 0)
+            return [];
+        const versions = new Map((await deps.repository.getVersions([...new Set(versionOf.values())])).map((version) => [
+            version.id,
+            version,
+        ]));
+        const wanted = new Map();
+        for (const [flowId, versionId] of versionOf) {
+            const version = versions.get(versionId);
+            if (version)
+                wanted.set(flowId, calleeIds(version.graph));
+        }
+        const everyCallee = [...new Set([...wanted.values()].flat())];
+        if (everyCallee.length === 0)
+            return [];
+        const reachable = new Set((await deps.repository.listCallable(actor, everyCallee))
+            .filter((callee) => !callee.archivedAt)
+            .map((callee) => callee.id));
+        return [...wanted.entries()]
+            .filter(([, callees]) => callees.some((callee) => reachable.has(callee)))
+            .map(([flowId]) => flowId);
+    }
     async function requireRunnableFlow(actor, flowId) {
         const flow = await deps.repository.getCallable(actor, flowId);
         if (!flow || flow.archivedAt)
@@ -720,7 +760,8 @@ export function createFlows(deps) {
     }
     return {
         async list(actor, input = {}) {
-            return { items: await deps.repository.listVisible(actor, input) };
+            const items = await deps.repository.listVisible(actor, input);
+            return { items, withCalls: await callableCallers(actor, items) };
         },
         async get(actor, flowId) {
             const flow = await requireFlow(actor, flowId);
@@ -885,7 +926,7 @@ export function createFlows(deps) {
             const flow = await requireFlow(actor, flowId);
             const versionId = flow.currentVersionId ?? flow.publishedVersionId;
             if (!versionId)
-                return { items: [] };
+                return { items: [], withCalls: [] };
             const version = await requireVersion(versionId, flow.id);
             const wanted = calleeIds(version.graph);
             // One read for every callee rather than one per callee (#30). This is what the sidebar asks
@@ -901,7 +942,8 @@ export function createFlows(deps) {
                 if (callee && !callee.archivedAt)
                     items.push(callee);
             }
-            return { items };
+            // Ein aufgerufener Flow ruft selbst welche: dieselbe Frage, eine Ebene tiefer (#59).
+            return { items, withCalls: await callableCallers(actor, items) };
         },
         // "What this flow needs", straight out of the graph: no arithmetic, nothing that can go stale,
         // and no claim about whether anyone may reach it. A standing "this flow has conflicts" badge

package/dist/flows/flows.types.d.ts

@@ -157,10 +157,12 @@ export type FolderAccess = "ok" | "missing" | "not-a-folder" | "forbidden";
 export interface FlowService {
     list(actor: FlowActor, input?: ListFlowsInput): Promise<{
         items: Flow[];
+        withCalls: string[];
     }>;
     get(actor: FlowActor, flowId: string): Promise<FlowDocument>;
     listCalls(actor: FlowActor, flowId: string): Promise<{
         items: Flow[];
+        withCalls: string[];
     }>;
     validate(actor: FlowActor, flowId: string): Promise<FlowValidation>;
     relationGraph(actor: FlowActor, input: RelationGraphInput): Promise<RelationGraph>;

package/dist/knowledge/knowledge.js

@@ -286,7 +286,7 @@ export function createKnowledge(deps) {
     }
     return {
         async list(actor, input) {
-            return { items: await deps.repository.listVisible(actor, input) };
+            return await deps.repository.listVisible(actor, input);
         },
         // The same level under a bound, for the one caller that draws a bounded picture of it. It goes
         // through the same predicate as `list`, so what is drawn is a prefix of what is listed and never

package/dist/knowledge/knowledge.types.d.ts

@@ -25,7 +25,10 @@ export interface NewKnowledgeTableVersion {
     auditId: string;
 }
 export interface KnowledgeRepository {
-    listVisible(actor: Actor, input: ListKnowledgeNodesInput): Promise<KnowledgeNode[]>;
+    listVisible(actor: Actor, input: ListKnowledgeNodesInput): Promise<{
+        items: KnowledgeNode[];
+        withChildren: string[];
+    }>;
     listVisibleBounded(actor: Actor, input: {
         parentId: string | null;
         limit: number;

package/migrations/0009_no_context_policy.sql

@@ -1,51 +1,33 @@
--- #76. `context_policy` leaves the tree. It was written, stored and handed back, and never once
--- read to decide anything — and it could not have been: it instructed a retrieval Intel does not
--- perform. Intel hands out references and the agent fetches what it needs (D24).
+-- #76. `context_policy` leaves the contract, the UI and every MCP answer. The COLUMN stays.
 --
--- ⚠️ SQLite cannot drop a column that a CHECK constraint names, and this one names itself. The
--- table has to be rebuilt, which for `knowledge_nodes` means six foreign keys pointing at it —
--- including one from itself. The order below is SQLite's own twelve-step recipe, and every line of
--- it is load-bearing:
+-- ⚠️ That is not the intent, it is what D1 permits. SQLite cannot drop a column a CHECK names, and
+-- this one names itself. The way around it is a table rebuild, and `knowledge_nodes` carries six
+-- foreign keys, one of them from itself.
 --
---   * `PRAGMA foreign_keys` is turned off first. Without it the DROP below would either fail or
---     cascade into the rows of every referencing table.
---   * The new table is created under a different name and renamed afterwards, rather than the old
---     one being renamed out of the way. Renaming the OLD table would silently re-point every
---     foreign key in the other five tables at `knowledge_nodes_old` — SQLite updates references to
---     follow a rename, and that is exactly what must not happen here.
---   * The indexes are recreated, because dropping the table drops them with it.
---   * `PRAGMA foreign_key_check` is the proof, not the hope. The integration test asserts it comes
---     back empty.
-PRAGMA foreign_keys = OFF;
-
-CREATE TABLE knowledge_nodes_rebuilt (
-  id TEXT PRIMARY KEY NOT NULL,
-  parent_id TEXT REFERENCES knowledge_nodes(id),
-  kind TEXT NOT NULL CHECK (kind IN ('folder', 'document', 'attachment', 'table')),
-  title TEXT NOT NULL CHECK (length(title) BETWEEN 1 AND 240),
-  description TEXT CHECK (description IS NULL OR length(description) <= 2000),
-  owner_id TEXT NOT NULL,
-  current_version_id TEXT,
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL,
-  archived_at TEXT
-);
-
-INSERT INTO knowledge_nodes_rebuilt (
-  id, parent_id, kind, title, description, owner_id,
-  current_version_id, created_at, updated_at, archived_at
-)
-SELECT id, parent_id, kind, title, description, owner_id,
-       current_version_id, created_at, updated_at, archived_at
-FROM knowledge_nodes;
-
-DROP TABLE knowledge_nodes;
-
-ALTER TABLE knowledge_nodes_rebuilt RENAME TO knowledge_nodes;
-
-CREATE INDEX knowledge_nodes_parent_idx ON knowledge_nodes(parent_id, archived_at, title);
-CREATE INDEX knowledge_nodes_owner_idx ON knowledge_nodes(owner_id, archived_at);
-
-PRAGMA foreign_key_check;
-
-PRAGMA foreign_keys = ON;
+-- Three attempts against the real database, three failures, each with its own lesson:
+--
+--   1. `PRAGMA foreign_keys = OFF` — **ignored** by D1 over its HTTP API. It works locally, because
+--      miniflare honours it, so the integration test was green while production answered
+--      `FOREIGN KEY constraint failed` on the DROP. ⚠️ A green migration test does not prove a D1
+--      migration runs.
+--   2. `PRAGMA defer_foreign_keys = true` — it works, but the self-reference was written as
+--      `REFERENCES knowledge_nodes(id)` and therefore pointed at the table this same migration was
+--      about to drop. SQLite rewrites a self-reference along with the rename, so the temporary name
+--      belongs there.
+--   3. Self-reference fixed → green through `wrangler d1 migrations apply --local`, still red
+--      against `--remote`. The reason is the execution model: D1 commits the statements of a
+--      migration file one at a time, and the deferral only lasts until the next COMMIT. After the
+--      first statement the reprieve is gone and `DROP TABLE` runs unprotected.
+--
+-- A table rebuild with foreign keys is therefore not possible inside a migration file. It needs a
+-- session that drives the transaction itself.
+--
+-- What holds instead: the column sits in D1, nothing reads it, and `db.ts` writes a fixed value on
+-- insert because it is NOT NULL without a DEFAULT. The contract does not know it — for every
+-- consumer it is gone. What remains is one dead column, and that is the price of Intel running.
+--
+-- How it disappears after all is anchrd/intel#86.
+--
+-- This file deliberately does nothing. It is where the above is written down; deleted, it would be
+-- a gap in the numbering that nobody explains.
+SELECT 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.7.0",
-    "@anchrd/intel-contract": "^0.3.0",
+    "@anchrd/intel-contract": "^0.4.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "ajv": "^8.20.0",
     "hono": "^4.12.32",