@anchrd/intel-api 0.6.7 → 0.9.0

package/dist/adapters/db/db-grants.js

@@ -26,13 +26,13 @@ function grantBindings(actor, verb, now) {
 function subtreeWalk(name) {
     return `${name}(id, parent_id) AS (
     SELECT seed.id, seed.parent_id
-    FROM knowledge_nodes seed
+    FROM nodes seed
     WHERE ? = 1
        OR seed.owner_id = ?
        OR ${grantExists("seed.id")}
     UNION
     SELECT child.id, child.parent_id
-    FROM knowledge_nodes child
+    FROM nodes child
     JOIN ${name} parent ON child.parent_id = parent.id
   )`;
 }
@@ -42,6 +42,23 @@ export const subtreeCte = `WITH RECURSIVE ${subtreeWalk("allowed")}`;
 export function subtreeBindings(actor, verb, now) {
     return [actor.isAdmin ? 1 : 0, actor.id, ...grantBindings(actor, verb, now)];
 }
+/**
+ * One named folder and everything filed beneath it, appended to a statement that already carries
+ * `subtreeCte`. It answers "where", never "whether": a statement joins `descendants` *in addition
+ * to* `allowed`, so the scope can only take rows away from an answer the actor was already entitled
+ * to. Joining it instead of `allowed` would turn a search argument into a permission, which is
+ * exactly what ADR-0004 forbids — the caller supplies the id, and a caller is not a grant.
+ *
+ * ⚠️ `UNION`, never `UNION ALL`, for the reason `nodeVerbQuery` gives: a cycle in `parent_id` can
+ * reach the table and this walks downwards into it.
+ */
+export const descendantsCte = `descendants(id) AS (
+    SELECT scope.id FROM nodes scope WHERE scope.id = ?
+    UNION
+    SELECT child.id
+    FROM nodes child
+    JOIN descendants parent ON child.parent_id = parent.id
+  )`;
 /**
  * Both walks in one statement: what the actor may open, and what they may run. Its bindings are
  * `subtreeBindings(actor, "read", now)` followed by `subtreeBindings(actor, "execute", now)`, in
@@ -62,7 +79,7 @@ export const flowCallable = `(
   OR flow.parent_id IN (SELECT id FROM runnable)
 )`;
 /**
- * The point check for one Knowledge node: the node itself and every ancestor above it. Cheaper than
+ * The point check for one node: the node itself and every ancestor above it. Cheaper than
  * the subtree walk and the same answer, because a grant reaches down and never sideways.
  *
  * ⚠️ `UNION`, never `UNION ALL`. The service refuses to move a node into its own descendant, but a
@@ -72,10 +89,10 @@ export const flowCallable = `(
  * row away and the recursion stops on its own.
  */
 export const nodeVerbQuery = `WITH RECURSIVE ancestors(id, parent_id, owner_id) AS (
-    SELECT id, parent_id, owner_id FROM knowledge_nodes WHERE id = ?
+    SELECT id, parent_id, owner_id FROM nodes WHERE id = ?
     UNION
     SELECT parent.id, parent.parent_id, parent.owner_id
-    FROM knowledge_nodes parent
+    FROM nodes parent
     JOIN ancestors child ON child.parent_id = parent.id
   )
   SELECT 1 AS allowed
@@ -89,18 +106,18 @@ export function nodeVerbBindings(nodeId, actor, verb, now) {
 }
 /**
  * The same question for a flow. A flow carries no grant of its own any more: what reaches it is the
- * folder it is filed in and that folder's ancestors. Its owner keeps it, the way a Knowledge node's
+ * folder it is filed in and that folder's ancestors. Its owner keeps it, the way a node's
  * owner keeps theirs — otherwise a flow at the root of the tree would be unreachable by the person
  * who created it. `UNION` for the same reason as above.
  */
 export const flowVerbQuery = `WITH RECURSIVE ancestors(id, parent_id) AS (
     SELECT folder.id, folder.parent_id
-    FROM knowledge_nodes folder
+    FROM nodes folder
     JOIN flows flow ON flow.parent_id = folder.id
     WHERE flow.id = ?
     UNION
     SELECT parent.id, parent.parent_id
-    FROM knowledge_nodes parent
+    FROM nodes parent
     JOIN ancestors child ON child.parent_id = parent.id
   )
   SELECT 1 AS allowed

package/dist/adapters/db/db-indexing.d.ts

@@ -1,3 +1,3 @@
-import type { KnowledgeIndexRepository } from "../../knowledge/knowledge.types.js";
+import type { NodeIndexRepository } from "../../nodes/nodes.types.js";
 import type { D1Database } from "./db.types.js";
-export declare function createKnowledgeIndexRepository(db: D1Database): KnowledgeIndexRepository;
+export declare function createNodeIndexRepository(db: D1Database): NodeIndexRepository;

package/dist/adapters/db/db-indexing.js

@@ -3,20 +3,21 @@ function mapTarget(row, contentKeys) {
         nodeId: row.node_id,
         versionId: row.version_id,
         title: row.title,
+        description: row.description,
         contentKeys,
         mediaType: row.media_type,
         kind: row.kind,
         updatedAt: row.updated_at,
     };
 }
-export function createKnowledgeIndexRepository(db) {
+export function createNodeIndexRepository(db) {
     return {
         async getTarget(versionId) {
             const row = await db
-                .prepare(`SELECT n.id AS node_id, v.id AS version_id, n.title, v.content_key,
+                .prepare(`SELECT n.id AS node_id, v.id AS version_id, n.title, n.description, v.content_key,
           v.media_type, n.kind, n.updated_at
-          FROM knowledge_versions v
-          JOIN knowledge_nodes n ON n.id = v.node_id
+          FROM node_versions v
+          JOIN nodes n ON n.id = v.node_id
           WHERE v.id = ? AND n.current_version_id = v.id AND n.archived_at IS NULL`)
                 .bind(versionId)
                 .first();
@@ -24,27 +25,33 @@ export function createKnowledgeIndexRepository(db) {
                 return null;
             if (row.kind !== "table")
                 return mapTarget(row, [row.content_key]);
-            // A table's rows live in every version, so indexing the newest one alone would make a search
-            // find only what the last append added (#40).
+            // A table's rows live in every segment since the newest snapshot, so indexing the newest one
+            // alone would make a search find only what the last append added (#40) — and indexing the
+            // segments before a snapshot would make it find rows a mutation removed (#135). The same
+            // reading rule as `listVersionContentKeys`, because the index must describe what a read sees.
             const segments = await db
-                .prepare(`SELECT content_key FROM knowledge_versions
-          WHERE node_id = ? ORDER BY sequence`)
-                .bind(row.node_id)
+                .prepare(`SELECT content_key FROM node_versions
+          WHERE node_id = ? AND sequence >= COALESCE((
+            SELECT MAX(sequence) FROM node_versions
+            WHERE node_id = ? AND segment = 'snapshot'
+          ), 0)
+          ORDER BY sequence`)
+                .bind(row.node_id, row.node_id)
                 .all();
             return mapTarget(row, (segments.results ?? []).map((segment) => segment.content_key));
         },
         async replace(target, content) {
             await db.batch([
                 db
-                    .prepare(`DELETE FROM knowledge_fts WHERE node_id = ? AND EXISTS (
-            SELECT 1 FROM knowledge_nodes
+                    .prepare(`DELETE FROM node_fts WHERE node_id = ? AND EXISTS (
+            SELECT 1 FROM nodes
             WHERE id = ? AND current_version_id = ? AND archived_at IS NULL
           )`)
                     .bind(target.nodeId, target.nodeId, target.versionId),
                 db
-                    .prepare(`INSERT INTO knowledge_fts (version_id, node_id, title, content)
+                    .prepare(`INSERT INTO node_fts (version_id, node_id, title, content)
             SELECT ?, ?, ?, ? WHERE EXISTS (
-              SELECT 1 FROM knowledge_nodes
+              SELECT 1 FROM nodes
               WHERE id = ? AND current_version_id = ? AND archived_at IS NULL
             )`)
                     .bind(target.versionId, target.nodeId, target.title, content, target.nodeId, target.versionId),
@@ -52,12 +59,12 @@ export function createKnowledgeIndexRepository(db) {
         },
         async markIndexed(versionId, occurredAt) {
             await db
-                .prepare(`UPDATE knowledge_index_state
+                .prepare(`UPDATE node_index_state
           SET status = 'indexed', attempt_count = attempt_count + 1,
             last_error = NULL, updated_at = ?
           WHERE version_id = ? AND EXISTS (
-            SELECT 1 FROM knowledge_versions version
-            JOIN knowledge_nodes node ON node.id = version.node_id
+            SELECT 1 FROM node_versions version
+            JOIN nodes node ON node.id = version.node_id
             WHERE version.id = ? AND node.current_version_id = version.id
               AND node.archived_at IS NULL
           )`)
@@ -66,11 +73,11 @@ export function createKnowledgeIndexRepository(db) {
         },
         async markError(versionId, message, occurredAt) {
             await db
-                .prepare(`UPDATE knowledge_index_state
+                .prepare(`UPDATE node_index_state
           SET status = 'error', attempt_count = attempt_count + 1,
             last_error = ?, updated_at = ? WHERE version_id = ? AND EXISTS (
-              SELECT 1 FROM knowledge_versions version
-              JOIN knowledge_nodes node ON node.id = version.node_id
+              SELECT 1 FROM node_versions version
+              JOIN nodes node ON node.id = version.node_id
               WHERE version.id = ? AND node.current_version_id = version.id
                 AND node.archived_at IS NULL
             )`)

package/dist/adapters/db/db.d.ts

@@ -1,6 +1,6 @@
-import type { KnowledgeRepository } from "../../knowledge/knowledge.types.js";
+import type { NodeRepository } from "../../nodes/nodes.types.js";
 import type { D1Database } from "./db.types.js";
-export declare function createKnowledgeRepository(deps: {
+export declare function createNodeRepository(deps: {
     db: D1Database;
     now(): Date;
-}): KnowledgeRepository;
+}): NodeRepository;