@anchrd/intel-ui 0.23.0 → 0.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-ui",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -33,7 +33,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@anchrd/intel-contract": "^0.16.0",
+    "@anchrd/intel-contract": "^0.17.0",
     "@blocknote/core": "^0.52.1",
     "@blocknote/react": "^0.52.1",
     "@blocknote/shadcn": "^0.52.1",

package/src/access-summary/access-summary.tsx

@@ -0,0 +1,282 @@
+import type { ResourceGrant } from "@anchrd/intel-contract/share";
+import { useQuery } from "@tanstack/react-query";
+import { useId, useState } from "react";
+import { createPortal } from "react-dom";
+import { AppLogo } from "@/branding/branding.tsx";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipProvider,
+  TooltipTrigger,
+} from "@/components/ui/tooltip.tsx";
+import { useI18n } from "@/i18n/i18n-context.tsx";
+import { useIntelRouterContext } from "@/router/router-context.ts";
+import { useUserName } from "@/user-name/user-name.ts";
+
+type Principal = ResourceGrant["principal"];
+
+type GrantGroup = {
+  key: string;
+  principal: Principal;
+  grants: ResourceGrant[];
+  owner: boolean;
+};
+
+function principalKey(principal: Principal): string {
+  if (principal.type === "organization") return "organization";
+  if (principal.type === "email") return `email:${principal.email.toLowerCase()}`;
+  return `user:${principal.id}`;
+}
+
+function groupGrants(grants: ResourceGrant[], ownerIds: string[] = []): GrantGroup[] {
+  const grouped = new Map<string, GrantGroup>();
+  for (const ownerId of ownerIds) {
+    grouped.set(`user:${ownerId}`, {
+      key: `user:${ownerId}`,
+      principal: { type: "user", id: ownerId },
+      grants: [],
+      owner: true,
+    });
+  }
+  for (const grant of grants) {
+    const key = principalKey(grant.principal);
+    const group = grouped.get(key);
+    if (group) group.grants.push(grant);
+    else grouped.set(key, { key, principal: grant.principal, grants: [grant], owner: false });
+  }
+  return [...grouped.values()];
+}
+
+function initials(value: string): string {
+  const parts = value
+    .replace(/@.*$/, "")
+    .split(/[\s._+-]+/)
+    .filter(Boolean);
+  if (parts.length === 0) return "?";
+  if (parts.length === 1) return (parts[0]?.slice(0, 2) ?? "?").toUpperCase();
+  return `${parts[0]?.[0] ?? ""}${parts.at(-1)?.[0] ?? ""}`.toUpperCase();
+}
+
+function usePrincipalLabel(principal: Principal): string {
+  const i18n = useI18n();
+  const userName = useUserName(principal.type === "user" ? principal.id : null);
+  if (principal.type === "organization") return i18n.t("node.organization");
+  if (principal.type === "email") return principal.email;
+  return userName ?? i18n.t("node.someUser");
+}
+
+const circleTones = [
+  "bg-muted text-muted-foreground",
+  "bg-accent text-accent-foreground",
+  "bg-secondary text-secondary-foreground",
+] as const;
+
+function AccessCircle({
+  group,
+  position,
+  count,
+  expanded,
+  controls,
+  activate,
+}: {
+  group: GrantGroup;
+  position: number;
+  count: number;
+  expanded: boolean;
+  controls: string;
+  activate(element: HTMLButtonElement): void;
+}) {
+  const i18n = useI18n();
+  const label = usePrincipalLabel(group.principal);
+  const circle = (
+    <button
+      type="button"
+      aria-label={position === 0 ? `${i18n.t("node.accessDetails", { count })}: ${label}` : label}
+      aria-expanded={expanded}
+      aria-controls={controls}
+      data-organization-access={group.principal.type === "organization" ? "" : undefined}
+      onClick={(event) => activate(event.currentTarget)}
+      className={`relative flex size-7 items-center justify-center rounded-full text-xs font-medium ring-2 ring-background outline-none transition hover:z-10 hover:scale-105 focus-visible:z-10 focus-visible:ring-ring ${circleTones[position % circleTones.length]}`}
+    >
+      {group.principal.type === "organization" ? (
+        <AppLogo className="size-4 rounded-none bg-transparent text-current [&_svg]:size-3" />
+      ) : (
+        initials(label)
+      )}
+    </button>
+  );
+  return (
+    <TooltipProvider delayDuration={300}>
+      <Tooltip>
+        <TooltipTrigger asChild>{circle}</TooltipTrigger>
+        <TooltipContent>
+          {group.principal.type === "organization" ? i18n.t("node.organizationAccess") : label}
+        </TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
+}
+
+function AccessDetail({
+  group,
+  onRevoke,
+}: {
+  group: GrantGroup;
+  onRevoke?(grantId: string): void;
+}) {
+  const i18n = useI18n();
+  const label = usePrincipalLabel(group.principal);
+  return (
+    <li className="flex items-start justify-between gap-3 text-sm">
+      <span className="min-w-0">
+        <span className="block truncate font-medium">{label}</span>
+        <span className="text-xs text-muted-foreground">
+          {[
+            ...(group.owner ? [i18n.t("node.owner")] : []),
+            ...group.grants.map((grant) => i18n.t(`node.verb.${grant.verb}`)),
+          ].join(", ")}
+        </span>
+      </span>
+      {onRevoke ? (
+        <span className="flex flex-wrap justify-end gap-1">
+          {group.grants.map((grant) => (
+            <button
+              key={grant.id}
+              type="button"
+              onClick={() => onRevoke(grant.id)}
+              aria-label={i18n.t("node.revokeVerbFor", {
+                verb: i18n.t(`node.verb.${grant.verb}`),
+                recipient: label,
+              })}
+              className="rounded px-2 py-1 text-xs text-destructive outline-none hover:bg-muted focus-visible:ring-2 focus-visible:ring-ring"
+            >
+              {i18n.t("node.revokeVerb", { verb: i18n.t(`node.verb.${grant.verb}`) })}
+            </button>
+          ))}
+        </span>
+      ) : null}
+    </li>
+  );
+}
+
+export function AccessSummary({
+  grants,
+  ownerId,
+  ownerIds,
+  onRevoke,
+}: {
+  grants: ResourceGrant[];
+  ownerId?: string;
+  ownerIds?: string[];
+  onRevoke?(grantId: string): void;
+}) {
+  const i18n = useI18n();
+  const groups = groupGrants(grants, ownerIds ?? (ownerId ? [ownerId] : []));
+  const [open, setOpen] = useState(false);
+  const [position, setPosition] = useState({ top: 8, left: 8 });
+  const detailsId = useId();
+  const organizationDescriptionId = useId();
+  if (groups.length === 0) return null;
+  const visible = groups.slice(0, 3);
+  const overflow = groups.length - visible.length;
+  const toggle = (element: HTMLButtonElement) => {
+    setOpen((current) => {
+      if (!current) {
+        const rect = element.getBoundingClientRect();
+        const panelHeight = Math.min(320, window.innerHeight - 16);
+        const below = window.innerHeight - rect.bottom;
+        setPosition({
+          top: below >= panelHeight ? rect.bottom + 4 : Math.max(8, rect.top - panelHeight - 4),
+          left: Math.max(8, Math.min(rect.left, window.innerWidth - 328)),
+        });
+      }
+      return !current;
+    });
+  };
+
+  return (
+    <div className="relative flex w-fit items-center -space-x-2" data-access-summary="">
+      {visible.map((group, position) => (
+        <AccessCircle
+          key={group.key}
+          group={group}
+          position={position}
+          count={groups.length}
+          expanded={open}
+          controls={detailsId}
+          activate={toggle}
+        />
+      ))}
+      {overflow > 0 ? (
+        <button
+          type="button"
+          aria-label={i18n.t("node.accessDetails", { count: groups.length })}
+          aria-expanded={open}
+          aria-controls={detailsId}
+          onClick={(event) => toggle(event.currentTarget)}
+          className="relative flex size-7 items-center justify-center rounded-full bg-muted text-xs font-medium text-muted-foreground ring-2 ring-background outline-none transition hover:z-10 hover:scale-105 focus-visible:z-10 focus-visible:ring-ring"
+        >
+          +{overflow}
+        </button>
+      ) : null}
+      {groups.some((group) => group.principal.type === "organization") ? (
+        <span id={organizationDescriptionId} className="sr-only">
+          {i18n.t("node.organizationAccess")}
+        </span>
+      ) : null}
+      {open
+        ? createPortal(
+            <div
+              id={detailsId}
+              data-access-details=""
+              className="fixed z-50 max-h-[calc(100dvh-1rem)] w-80 overflow-y-auto rounded-md border bg-popover p-4 text-popover-foreground shadow-md"
+              style={position}
+            >
+              <ul className="space-y-3">
+                {groups.map((group) => (
+                  <AccessDetail key={group.key} group={group} {...(onRevoke ? { onRevoke } : {})} />
+                ))}
+              </ul>
+            </div>,
+            document.querySelector('[role="dialog"]') ?? document.body,
+          )
+        : null}
+    </div>
+  );
+}
+
+/**
+ * The compact access view for a resource the reader can manage.
+ *
+ * `node_grant_list` is itself authorized: a reader who may see the node but may not inspect its
+ * grants gets no names here. Treating that refusal as an empty summary is deliberate; rendering an
+ * error or retry would disclose that there are grants to ask about (#484).
+ */
+export function ResourceAccessSummary({
+  resourceId,
+  ownerId,
+}: {
+  resourceId: string;
+  ownerId: string;
+}) {
+  const { data } = useIntelRouterContext();
+  const grants = useQuery({
+    queryKey: ["effective-node-grants", resourceId],
+    queryFn: () => data.listEffectiveAccess(resourceId),
+    retry: false,
+    // Time cannot change this answer locally. Share mutations invalidate the whole effective prefix
+    // because changing one folder also changes every descendant summary already on screen.
+    staleTime: Number.POSITIVE_INFINITY,
+  });
+  if (!grants.data) return null;
+  return (
+    <AccessSummary
+      grants={grants.data.items}
+      ownerIds={
+        grants.data.ownerIds.includes(ownerId)
+          ? grants.data.ownerIds
+          : [ownerId, ...grants.data.ownerIds]
+      }
+    />
+  );
+}

package/src/archive/archive.tsx

@@ -1,8 +1,9 @@
 import type { Flow } from "@anchrd/intel-contract/flow";
 import type { Node } from "@anchrd/intel-contract/node";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { ArchiveRestore, Trash2 } from "lucide-react";
+import { ArchiveRestore, LoaderCircle, Trash2 } from "lucide-react";
 import { useState } from "react";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
 import { useI18n } from "@/i18n/i18n-context.tsx";
 import { kindIcons } from "@/kind-icon.ts";
 import { Modal } from "@/modal/modal.tsx";
@@ -22,6 +23,7 @@ interface ArchivedEntry {
   // Both sides of the tree can be purged (#457) — each through its own door, because node and flow
   // stay separate everywhere else (ADR-0004).
   purge(): Promise<{ purged: true; title: string }>;
+  previewPurge?(): Promise<{ inboundLinks: number; totalItems: number }>;
 }
 
 export function Archive() {
@@ -38,8 +40,10 @@ export function Archive() {
         data.listFlows({ archivedOnly: true }),
       ]);
       const entries: ArchivedEntry[] = [
-        ...nodes.items.flatMap((node) =>
-          node.archivedAt
+        ...nodes.items.flatMap((node) => {
+          // Stable across reloads: after D1 commits, only this key can reach an R2 cleanup receipt.
+          const purgeKey = `purge-${node.id}`;
+          return node.archivedAt
             ? [
                 {
                   id: node.id,
@@ -54,11 +58,12 @@ export function Archive() {
                       archived: false,
                       idempotencyKey: crypto.randomUUID(),
                     }),
-                  purge: () => data.purgeNode({ nodeId: node.id }),
+                  purge: () => data.purgeNode({ nodeId: node.id, idempotencyKey: purgeKey }),
+                  previewPurge: () => data.previewNodePurge({ nodeId: node.id }),
                 } satisfies ArchivedEntry,
               ]
-            : [],
-        ),
+            : [];
+        }),
         ...flows.items.flatMap((flow: Flow) =>
           flow.archivedAt
             ? [
@@ -108,6 +113,12 @@ export function Archive() {
   // that it does not come back. The state lives here because the row underneath disappears the
   // moment the purge goes through.
   const [confirming, setConfirming] = useState<ArchivedEntry | null>(null);
+  const preview = useQuery({
+    queryKey: ["purge-preview", confirming?.id],
+    queryFn: async () => await confirming?.previewPurge?.(),
+    enabled: Boolean(confirming?.previewPurge),
+    retry: false,
+  });
   const purge = useMutation({
     mutationFn: async (entry: ArchivedEntry) => await entry.purge(),
     onSuccess: async () => {
@@ -173,21 +184,43 @@ export function Archive() {
                   {i18n.t("archive.archivedAt", { when: dateTime.at(entry.archivedAt) })}
                 </span>
               </span>
-              {/* ⚠️ Both icons stand PERMANENTLY, not only on hover — a deliberate exception to the
-                  row convention (#457). There are two of them, both rare, and this list is the only
-                  place they occur: the wall of icons anchrd/gate#237 was written against does not
-                  arise here. The way back keeps its text; the purge is a bare icon, so that the two
-                  do not weigh the same. */}
-              <button
-                type="button"
-                disabled={restore.isPending}
-                onClick={() => restore.mutate(entry)}
-                aria-label={i18n.t("archive.restore", { title: entry.title })}
-                className="inline-flex h-8 shrink-0 items-center gap-2 rounded-md border px-3 text-sm font-medium outline-none hover:bg-muted focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-60"
-              >
-                <ArchiveRestore aria-hidden="true" className="size-4" />
-                {i18n.t("archive.restoreAction")}
-              </button>
+              {/* Both actions stay permanently visible: the archive is the one place where getting
+                  an item back must never depend on discovering a hover-only control. */}
+              <TooltipProvider delayDuration={300}>
+                <Tooltip>
+                  {/* The wrapper keeps the tooltip available while the button is disabled. */}
+                  <TooltipTrigger asChild>
+                    <span className="inline-flex shrink-0">
+                      <button
+                        type="button"
+                        disabled={restore.isPending}
+                        onClick={() => restore.mutate(entry)}
+                        aria-label={i18n.t(
+                          restore.isPending && restore.variables?.id === entry.id
+                            ? "archive.restoring"
+                            : "archive.restore",
+                          { title: entry.title },
+                        )}
+                        aria-busy={restore.isPending && restore.variables?.id === entry.id}
+                        className="inline-flex size-8 shrink-0 items-center justify-center rounded-md border outline-none hover:bg-muted focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-60"
+                      >
+                        {restore.isPending && restore.variables?.id === entry.id ? (
+                          <LoaderCircle aria-hidden="true" className="size-4 animate-spin" />
+                        ) : (
+                          <ArchiveRestore aria-hidden="true" className="size-4" />
+                        )}
+                      </button>
+                    </span>
+                  </TooltipTrigger>
+                  <TooltipContent>
+                    {i18n.t(
+                      restore.isPending && restore.variables?.id === entry.id
+                        ? "archive.restoringAction"
+                        : "archive.restoreAction",
+                    )}
+                  </TooltipContent>
+                </Tooltip>
+              </TooltipProvider>
               <button
                 type="button"
                 disabled={purge.isPending}
@@ -206,6 +239,29 @@ export function Archive() {
           <p className="text-sm text-muted-foreground">
             {i18n.t("archive.purge.body", { title: confirming.title })}
           </p>
+          {confirming.previewPurge && preview.data ? (
+            <div className="mt-2 space-y-2 text-sm text-muted-foreground">
+              <p>{i18n.t("archive.purge.items", { count: preview.data.totalItems })}</p>
+              <p>
+                {preview.data.inboundLinks === 0
+                  ? i18n.t("archive.purge.links.none")
+                  : preview.data.inboundLinks === 1
+                    ? i18n.t("archive.purge.links.one")
+                    : i18n.t("archive.purge.links.many", { count: preview.data.inboundLinks })}
+              </p>
+            </div>
+          ) : null}
+          {confirming.previewPurge && preview.isPending ? (
+            <p className="mt-2 text-sm text-muted-foreground">
+              {i18n.t("archive.purge.previewLoading")}
+            </p>
+          ) : null}
+          {confirming.previewPurge && preview.isError ? (
+            <p role="alert" className="mt-2 text-sm text-destructive">
+              {i18n.t("archive.purge.previewFailed")}
+            </p>
+          ) : null}
+          <p className="mt-2 text-sm text-muted-foreground">{i18n.t("archive.purge.grants")}</p>
           <div className="mt-6 flex justify-end gap-2">
             <button
               type="button"
@@ -216,7 +272,10 @@ export function Archive() {
             </button>
             <button
               type="button"
-              disabled={purge.isPending}
+              disabled={
+                purge.isPending ||
+                (Boolean(confirming.previewPurge) && (preview.isPending || preview.isError))
+              }
               onClick={() => purge.mutate(confirming)}
               className="inline-flex h-8 items-center gap-2 rounded-md bg-destructive px-3 text-sm font-medium text-destructive-foreground outline-none hover:bg-destructive/90 focus-visible:ring-2 focus-visible:ring-ring disabled:opacity-60"
             >

package/src/data/intel-data-provider/intel-data-provider.ts

@@ -39,6 +39,8 @@ import {
   NodeTable,
   NodeVersionList,
   PurgeNodeInput,
+  PurgeNodePreview,
+  PurgeNodePreviewInput,
   PurgeNodeResult,
   ReindexResult,
   ResolveNodeLinksInput,
@@ -50,6 +52,7 @@ import {
   UpdateNodeInput,
 } from "@anchrd/intel-contract/node";
 import {
+  ResourceAccessList,
   ResourceGrantList,
   RevokeGrantInput,
   RevokeGrantResult,
@@ -334,8 +337,16 @@ export function createIntelDataProvider(
       const parsed = PurgeNodeInput.parse(input);
       return await request(`/nodes/${encodeURIComponent(parsed.nodeId)}`, PurgeNodeResult, {
         method: "DELETE",
+        body: JSON.stringify(parsed),
       });
     },
+    async previewNodePurge(input) {
+      const parsed = PurgeNodePreviewInput.parse(input);
+      return await request(
+        `/nodes/${encodeURIComponent(parsed.nodeId)}/purge-preview`,
+        PurgeNodePreview,
+      );
+    },
     async purgeFlow(input) {
       const parsed = PurgeFlowInput.parse(input);
       return await request(`/flows/${encodeURIComponent(parsed.flowId)}`, PurgeFlowResult, {
@@ -351,6 +362,12 @@ export function createIntelDataProvider(
     async listGrants(resourceId) {
       return await request(`/nodes/${encodeURIComponent(resourceId)}/grants`, ResourceGrantList);
     },
+    async listEffectiveAccess(resourceId) {
+      return await request(
+        `/nodes/${encodeURIComponent(resourceId)}/effective-access`,
+        ResourceAccessList,
+      );
+    },
     async shareNode(input) {
       const parsed = ShareInput.parse(input);
       return await request(`/nodes/${encodeURIComponent(parsed.resourceId)}/grants`, ShareResult, {

package/src/data/intel-data-provider/intel-data-provider.types.ts

@@ -40,6 +40,7 @@ import type {
   NodeTable,
   NodeVersionList,
   PurgeNodeInput,
+  PurgeNodePreviewInput,
   PurgeNodeResult,
   ReindexResult,
   ResolveNodeLinksInput,
@@ -132,9 +133,15 @@ export interface IntelDataProvider {
   // ⚠️ The one way across this seam after which nothing is really left (#457). The title comes back
   // because nothing can look it up afterwards.
   purgeNode(input: PurgeNodeInput): Promise<PurgeNodeResult>;
+  previewNodePurge(
+    input: PurgeNodePreviewInput,
+  ): Promise<import("@anchrd/intel-contract/node").PurgeNodePreview>;
   purgeFlow(input: PurgeFlowInput): Promise<PurgeFlowResult>;
   searchNodes(input: SearchInput): Promise<SearchResult>;
   listGrants(resourceId: string): Promise<ResourceGrantList>;
+  listEffectiveAccess(
+    resourceId: string,
+  ): Promise<import("@anchrd/intel-contract/share").ResourceAccessList>;
   // The grant, and what the grant does not cover: the documents the flows in this folder read that
   // the new principal still cannot. A warning, never a refusal (ADR-0004 §4).
   shareNode(input: ShareInput): Promise<ShareResult>;

package/src/folder-contents/folder-contents.tsx

@@ -1,5 +1,6 @@
 import { useQuery } from "@tanstack/react-query";
 import { useNavigate } from "@tanstack/react-router";
+import { ResourceAccessSummary } from "@/access-summary/access-summary.tsx";
 import { treeLevelKey } from "@/app/tree-move/tree-move.tsx";
 import {
   Table,
@@ -84,6 +85,9 @@ export function FolderContents({ folderId }: { folderId: string }) {
               <TableHead className="h-9 px-4 text-right text-xs tracking-wide uppercase">
                 {i18n.t("node.changed")}
               </TableHead>
+              <TableHead className="h-9 px-4 text-xs tracking-wide uppercase">
+                {i18n.t("node.access")}
+              </TableHead>
               {/* A `<th>` with nothing in it leaves the column unnamed for anyone reading the table
                   by its headers. The word is there; only the eye is spared it. */}
               <TableHead className="h-9 w-14">
@@ -130,6 +134,14 @@ export function FolderContents({ folderId }: { folderId: string }) {
                   <TableCell className="px-4 text-right text-sm text-muted-foreground tabular-nums">
                     {dateTime.on(changed)}
                   </TableCell>
+                  <TableCell className="px-4">
+                    <ResourceAccessSummary
+                      resourceId={
+                        entry.type === "flow" ? (entry.flow.parentId ?? folderId) : entry.id
+                      }
+                      ownerId={entry.type === "flow" ? entry.flow.ownerId : entry.node.ownerId}
+                    />
+                  </TableCell>
                   {/* ⚠️ The same menu as the title line of the open thing, not a shorter one built
                       for here. #58 collected every action in one place so that place is always the
                       same; a folder listing offering three of the six would be a second place. */}

package/src/i18n/de.json

@@ -85,15 +85,24 @@
   "archive.description": "Alles, was du archiviert hast, das Neueste zuerst. Beim Wiederherstellen kommt ein Eintrag dorthin zurück, wo er lag.",
   "archive.restore": "{title} wiederherstellen",
   "archive.restoreAction": "Wiederherstellen",
+  "archive.restoring": "{title} wird wiederhergestellt",
+  "archive.restoringAction": "Wird wiederhergestellt",
   "archive.empty": "Es ist nichts archiviert.",
   "archive.failed": "Das Archiv konnte nicht gelesen werden. Prüfe deinen Zugriff und versuche es erneut.",
   "archive.restoreFailed": "Es wurde nicht wiederhergestellt. Vielleicht hat jemand anderes es geändert — lade neu und versuche es erneut.",
   "archive.purge": "{title} endgültig löschen",
   "archive.purge.title": "Endgültig löschen?",
   "archive.purge.body": "„{title}\u201c und alles, was dazugehört — jede Version, der Inhalt und die Einträge im Suchindex — ist danach weg. Das lässt sich nicht rückgängig machen.",
+  "archive.purge.links.none": "Keine anderen Dokumente verweisen darauf.",
+  "archive.purge.links.one": "Ein anderes Dokument verweist darauf; dieser Verweis wird brechen.",
+  "archive.purge.links.many": "{count} andere Dokumente verweisen darauf; diese Verweise werden brechen.",
+  "archive.purge.grants": "Die Freigaben werden ebenfalls gelöscht.",
+  "archive.purge.items": "Damit werden insgesamt {count} Elemente endgültig gelöscht.",
+  "archive.purge.previewLoading": "Verweise werden geprüft …",
+  "archive.purge.previewFailed": "Die Verweise konnten nicht geprüft werden. Lade neu und versuche es vor dem Löschen erneut.",
   "archive.purge.confirm": "Endgültig löschen",
   "archive.purge.cancel": "Abbrechen",
-  "archive.purgeFailed": "Es konnte nicht gelöscht werden. Ein Ordner muss zuerst leer sein, und was ein publizierter Flow noch benutzt, kann gar nicht weg.",
+  "archive.purgeFailed": "Es konnte nicht vollständig gelöscht werden. Lade neu und versuche es erneut.",
   "archive.archivedAt": "Archiviert {when}",
   "resource.conflict": "Nicht geändert: Jemand anderes hat diesen Eintrag zuerst geändert. Lade ihn neu und versuche es erneut.",
   "resource.forbidden": "Nicht geändert: Du darfst diesen Eintrag nicht ändern.",
@@ -119,7 +128,6 @@
   "node.share": "Freigeben",
   "node.shareAction": "Zugriff geben",
   "node.email": "E-Mail-Adresse",
-  "node.emailHint": "Intel kann nicht prüfen, ob hinter dieser Adresse ein Konto steht. Die Freigabe greift, sobald sich jemand damit anmeldet — auch nach einer späteren Registrierung.",
   "node.shareWith": "Wer Zugriff bekommt",
   "node.shareWithEmail": "Eine E-Mail-Adresse",
   "node.shareWithOrganization": "Alle in der Organisation",
@@ -137,8 +145,13 @@
   "node.verbHint.execute": "Die Flows hier drin starten",
   "node.verbHint.share": "Anderen Zugriff geben",
   "node.organization": "Alle in der Organisation",
+  "node.owner": "Besitzer",
+  "node.access": "Zugriff",
+  "node.organizationAccess": "Alle in der Organisation haben Zugriff",
+  "node.accessDetails": "Zugriffsdetails anzeigen ({count})",
+  "node.revokeVerb": "{verb} entziehen",
+  "node.revokeVerbFor": "{verb} für {recipient} entziehen",
   "node.revokeShare": "Zugriff entziehen",
-  "node.noGrants": "Außer der Besitzerin oder dem Besitzer hat noch niemand Zugriff.",
   "node.shareFailed": "Der Zugriff wurde nicht geändert. Prüfe deine Berechtigung und versuche es erneut.",
   "node.shareUnreadable": "Flows in diesem Ordner lesen Dokumente, die diese Freigabe nicht abdeckt: {titles}.",
   "node.shareUnreadableMore": "{count} weitere liegen ebenfalls außer Reichweite, und du kannst sie nicht sehen.",

package/src/i18n/en.json

@@ -85,15 +85,24 @@
   "archive.description": "Everything you archived, newest first. Restoring puts an entry back where it was filed.",
   "archive.restore": "Restore {title}",
   "archive.restoreAction": "Restore",
+  "archive.restoring": "Restoring {title}",
+  "archive.restoringAction": "Restoring",
   "archive.empty": "Nothing is archived.",
   "archive.failed": "The archive could not be read. Check your access and try again.",
   "archive.restoreFailed": "It was not restored. Somebody else may have changed it — reload and try again.",
   "archive.purge": "Delete {title} for good",
   "archive.purge.title": "Delete this for good?",
   "archive.purge.body": "“{title}” and everything belonging to it — every version, its content and its entries in the search index — will be gone. This cannot be undone.",
+  "archive.purge.links.none": "No other documents link to it.",
+  "archive.purge.links.one": "One other document links to it and that link will break.",
+  "archive.purge.links.many": "{count} other documents link to it and those links will break.",
+  "archive.purge.grants": "Its shares will also be deleted.",
+  "archive.purge.items": "This permanently deletes {count} items in total.",
+  "archive.purge.previewLoading": "Checking links…",
+  "archive.purge.previewFailed": "The links could not be checked. Reload and try again before deleting.",
   "archive.purge.confirm": "Delete for good",
   "archive.purge.cancel": "Cancel",
-  "archive.purgeFailed": "It could not be deleted. A folder has to be empty first, and a node a published flow still uses cannot go at all.",
+  "archive.purgeFailed": "It could not be deleted completely. Reload and try again.",
   "archive.archivedAt": "Archived {when}",
   "resource.conflict": "It was not changed: somebody else changed this entry first. Reload it and try again.",
   "resource.forbidden": "It was not changed: you may not change this entry.",
@@ -119,7 +128,6 @@
   "node.share": "Share",
   "node.shareAction": "Grant access",
   "node.email": "Email address",
-  "node.emailHint": "Intel cannot check whether an account exists behind this address. The grant takes effect as soon as somebody signs in with it — including after they register.",
   "node.shareWith": "Who gets access",
   "node.shareWithEmail": "One email address",
   "node.shareWithOrganization": "Everyone in the organization",
@@ -137,8 +145,13 @@
   "node.verbHint.execute": "Start the flows in here",
   "node.verbHint.share": "Give others access",
   "node.organization": "Everyone in the organization",
+  "node.owner": "Owner",
+  "node.access": "Access",
+  "node.organizationAccess": "Everyone in the organization has access",
+  "node.accessDetails": "Show access details ({count})",
+  "node.revokeVerb": "Revoke {verb}",
+  "node.revokeVerbFor": "Revoke {verb} for {recipient}",
   "node.revokeShare": "Revoke access",
-  "node.noGrants": "Nobody outside the owner has access yet.",
   "node.shareFailed": "Access was not changed. Check your permission and try again.",
   "node.shareUnreadable": "Flows in this folder read documents this grant does not cover: {titles}.",
   "node.shareUnreadableMore": "{count} more are out of reach too, and you cannot see them.",

package/src/i18n/es.json

@@ -85,15 +85,24 @@
   "archive.description": "Todo lo que has archivado, lo más reciente primero. Al restaurar, una entrada vuelve al sitio donde estaba.",
   "archive.restore": "Restaurar {title}",
   "archive.restoreAction": "Restaurar",
+  "archive.restoring": "Restaurando {title}",
+  "archive.restoringAction": "Restaurando",
   "archive.empty": "No hay nada archivado.",
   "archive.failed": "El archivo no se ha podido leer. Comprueba tu acceso e inténtalo de nuevo.",
   "archive.restoreFailed": "No se ha restaurado. Puede que otra persona lo haya cambiado — recarga e inténtalo de nuevo.",
   "archive.purge": "Eliminar «{title}» definitivamente",
   "archive.purge.title": "¿Eliminar definitivamente?",
   "archive.purge.body": "«{title}» y todo lo que le pertenece — cada versión, su contenido y sus entradas en el índice de búsqueda — desaparecerá. Esto no se puede deshacer.",
+  "archive.purge.links.none": "Ningún otro documento contiene un enlace a este elemento.",
+  "archive.purge.links.one": "Otro documento contiene un enlace a este elemento y ese enlace dejará de funcionar.",
+  "archive.purge.links.many": "Otros {count} documentos contienen enlaces a este elemento y dejarán de funcionar.",
+  "archive.purge.grants": "Sus permisos compartidos también se eliminarán.",
+  "archive.purge.items": "Esto elimina definitivamente {count} elementos en total.",
+  "archive.purge.previewLoading": "Comprobando enlaces…",
+  "archive.purge.previewFailed": "No se pudieron comprobar los enlaces. Recarga e inténtalo de nuevo antes de eliminar.",
   "archive.purge.confirm": "Eliminar definitivamente",
   "archive.purge.cancel": "Cancelar",
-  "archive.purgeFailed": "No se pudo eliminar. Una carpeta debe estar vacía primero, y lo que un flujo publicado todavía usa no puede eliminarse.",
+  "archive.purgeFailed": "No se pudo eliminar por completo. Recarga e inténtalo de nuevo.",
   "archive.archivedAt": "Archivado {when}",
   "resource.conflict": "No se ha cambiado: otra persona ha cambiado esta entrada antes. Recárgala e inténtalo de nuevo.",
   "resource.forbidden": "No se ha cambiado: no puedes cambiar esta entrada.",
@@ -119,7 +128,6 @@
   "node.share": "Compartir",
   "node.shareAction": "Conceder acceso",
   "node.email": "Dirección de correo",
-  "node.emailHint": "Intel no puede comprobar si existe una cuenta detrás de esta dirección. El permiso surte efecto en cuanto alguien inicie sesión con ella, incluso si se registra más tarde.",
   "node.shareWith": "Quién obtiene acceso",
   "node.shareWithEmail": "Una dirección de correo",
   "node.shareWithOrganization": "Todos en la organización",
@@ -137,8 +145,13 @@
   "node.verbHint.execute": "Iniciar los flujos que hay aquí dentro",
   "node.verbHint.share": "Dar acceso a otras personas",
   "node.organization": "Todas las personas de la organización",
+  "node.owner": "Propietario",
+  "node.access": "Acceso",
+  "node.organizationAccess": "Toda la organización tiene acceso",
+  "node.accessDetails": "Mostrar detalles de acceso ({count})",
+  "node.revokeVerb": "Retirar {verb}",
+  "node.revokeVerbFor": "Retirar {verb} a {recipient}",
   "node.revokeShare": "Retirar el acceso",
-  "node.noGrants": "Fuera de quien lo posee, todavía no tiene acceso nadie.",
   "node.shareFailed": "El acceso no se ha cambiado. Comprueba tu permiso e inténtalo de nuevo.",
   "node.shareUnreadable": "Los flujos de esta carpeta leen documentos que este acceso no cubre: {titles}.",
   "node.shareUnreadableMore": "{count} más también quedan fuera de alcance, y no puedes verlos.",

package/src/resource-menu/resource-menu.tsx

@@ -1,6 +1,6 @@
 import type { Flow, FlowValidation } from "@anchrd/intel-contract/flow";
 import type { Node } from "@anchrd/intel-contract/node";
-import type { ResourceGrant, ResourceVerb, UnreadableNodes } from "@anchrd/intel-contract/share";
+import type { ResourceVerb, UnreadableNodes } from "@anchrd/intel-contract/share";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useNavigate, useRouterState } from "@tanstack/react-router";
 import {
@@ -15,10 +15,10 @@ import {
   Pencil,
   Share2,
   ShieldCheck,
-  Trash2,
 } from "lucide-react";
 import type * as React from "react";
 import { useState } from "react";
+import { AccessSummary } from "@/access-summary/access-summary.tsx";
 import { moveErrorKey, useTreeMove } from "@/app/tree-move/tree-move.tsx";
 import {
   DropdownMenu,
@@ -38,7 +38,6 @@ import { Modal } from "@/modal/modal.tsx";
 import { useIntelRouterContext } from "@/router/router-context.ts";
 import { selectedFrom } from "@/router/selection-search.ts";
 import { useDateTime } from "@/time/time-context.tsx";
-import { useUserName } from "@/user-name/user-name.ts";
 
 /**
  * What a resource's own actions are, at the place the resource stands (#24).
@@ -638,54 +637,6 @@ function NodeLinksPanel({ node, close }: { node: Node; close(): void }) {
 // flows, which is where a permission decision belongs (ADR-0004 §2). Which verbs it offers is the
 // server's answer, not this component's: `execute` never appears on a document, because a document
 // has nothing to run.
-/**
- * One row of the grant list.
- *
- * ⚠️ It is a component rather than a line inside the `map` because of `useUserName`, and that hook
- * is the point: until #431 a `user` grant printed its raw id — `2C9lEhT82upO82abPjHFAvs24a7Vdd3J`
- * beside the word "Read" — which tells the reader nothing about who they let in and puts an
- * identifier on a screen that has no reason to carry one. `user-name.ts` already had the rule
- * ("never fall back to the id, show nothing instead", #258); this row was the last place breaking it.
- *
- * ⚠️ Intel can resolve exactly ONE id today: the signed-in person's. A foreign one is not "a name we
- * could probably guess" but genuinely unanswerable — Intel has no user directory (#261) — so what
- * stands there is what is true: an account, unnamed. The day #261 lands, `useUserName` starts
- * answering and this row needs no change.
- */
-function GrantRow({ grant, onRevoke }: { grant: ResourceGrant; onRevoke(grantId: string): void }) {
-  const i18n = useI18n();
-  const userName = useUserName(grant.principal.type === "user" ? grant.principal.id : null);
-  // ⚠️ An `email` grant keeps showing the ADDRESS, even where a name is known, and that is a
-  // decision rather than an oversight (#431, review finding). The grant is bound to the address —
-  // `db-grants.ts` matches `lower(principal_id)` against whoever signs in — not to an account.
-  // Putting a name there would claim a binding that does not exist, and it would be wrong the moment
-  // somebody else verifies that address.
-  const who =
-    grant.principal.type === "email"
-      ? grant.principal.email
-      : grant.principal.type === "user"
-        ? (userName ?? i18n.t("node.someUser"))
-        : i18n.t("node.organization");
-  return (
-    <li className="flex items-center justify-between gap-3 rounded-md border p-3 text-sm">
-      <span className="min-w-0 truncate">
-        {who}
-        <span className="ml-2 text-xs text-muted-foreground">
-          {i18n.t(`node.verb.${grant.verb}`)}
-        </span>
-      </span>
-      <button
-        type="button"
-        onClick={() => onRevoke(grant.id)}
-        aria-label={i18n.t("node.revokeShare")}
-        className="rounded-md p-2 text-destructive outline-none hover:bg-muted focus-visible:ring-2 focus-visible:ring-ring"
-      >
-        <Trash2 aria-hidden="true" className="size-4" />
-      </button>
-    </li>
-  );
-}
-
 /**
  * Which of the three principals the dialog can SET (#431).
  *
@@ -753,7 +704,10 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
     // before, and the user would read a permission picture that is not the one in force. Of all the
     // things to be silently wrong about, access is the worst.
     onSettled: async () => {
-      await queryClient.invalidateQueries({ queryKey: ["node-grants", node.id] });
+      await Promise.all([
+        queryClient.invalidateQueries({ queryKey: ["node-grants", node.id] }),
+        queryClient.invalidateQueries({ queryKey: ["effective-node-grants"] }),
+      ]);
     },
   });
   const revoke = useMutation({
@@ -764,7 +718,10 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
         idempotencyKey: crypto.randomUUID(),
       }),
     onSettled: async () => {
-      await queryClient.invalidateQueries({ queryKey: ["node-grants", node.id] });
+      await Promise.all([
+        queryClient.invalidateQueries({ queryKey: ["node-grants", node.id] }),
+        queryClient.invalidateQueries({ queryKey: ["effective-node-grants"] }),
+      ]);
     },
   });
 
@@ -820,21 +777,17 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
           <p className="mt-1 text-xs text-muted-foreground">{i18n.t("node.shareUnreadableHint")}</p>
         </div>
       )}
-      <ul className="mb-5 max-h-44 space-y-2 overflow-y-auto">
-        {grants.data?.items.map((grant) => (
-          <GrantRow
-            key={grant.id}
-            grant={grant}
+      {grants.data && grants.data.items.length > 0 ? (
+        <div className="mb-5">
+          <AccessSummary
+            grants={grants.data.items}
             onRevoke={(grantId) => {
               share.reset();
               revoke.mutate(grantId);
             }}
           />
-        ))}
-        {grants.data?.items.length === 0 && (
-          <li className="text-sm text-muted-foreground">{i18n.t("node.noGrants")}</li>
-        )}
-      </ul>
+        </div>
+      ) : null}
       <form
         onSubmit={(event) => {
           event.preventDefault();
@@ -860,7 +813,7 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
                 name="share-principal"
                 checked={principalKind === kind}
                 onChange={() => setPrincipalKind(kind)}
-                aria-describedby={kind === "email" ? "share-email-hint" : "share-organization-hint"}
+                aria-describedby={kind === "organization" ? "share-organization-hint" : undefined}
                 className="size-4 border outline-none focus-visible:ring-2 focus-visible:ring-ring"
               />
               <span>
@@ -882,19 +835,9 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
                 required
                 value={email}
                 onChange={(event) => setEmail(event.target.value)}
-                aria-describedby="share-email-hint"
                 className="mt-2 w-full rounded-md border bg-background px-3 py-2 outline-none focus-visible:ring-2 focus-visible:ring-ring"
               />
             </label>
-            {/* ⚠️ What this says is what Intel knows, and no more (#431). It cannot check whether an
-                address belongs to anybody — Gate owns identity and offers Intel no lookup (#261) —
-                and a dialog that stayed silent about that let a typo become a grant that is valid,
-                permanent and completely without effect, with nobody on either side to notice. Naming
-                the uncertainty is the honest half of what the ticket asks for; the other half needs
-                Gate. */}
-            <p id="share-email-hint" className="mt-1 text-xs text-muted-foreground">
-              {i18n.t("node.emailHint")}
-            </p>
           </div>
         ) : (
           /* ⚠️ `aria-live` on the CONTAINER, which is already mounted whenever this branch is on

package/src/title-row/title-row.tsx

@@ -1,4 +1,5 @@
 import type * as React from "react";
+import { ResourceAccessSummary } from "@/access-summary/access-summary.tsx";
 import { ResourceMenu, type ResourceTarget } from "@/resource-menu/resource-menu.tsx";
 
 /**
@@ -33,6 +34,9 @@ export function TitleRow({
         <div className="min-w-0">
           <div className="flex min-w-0 flex-wrap items-baseline gap-x-3">
             <h2 className="truncate text-lg font-semibold">{title}</h2>
+            {target.type === "node" && target.node.kind === "folder" ? (
+              <ResourceAccessSummary resourceId={target.node.id} ownerId={target.node.ownerId} />
+            ) : null}
             <span data-slot="title-meta" className="text-sm text-muted-foreground" />
           </div>
           {description ? <p className="mt-1 text-sm text-muted-foreground">{description}</p> : null}