@promptowl/contextnest-community 1.16.1 → 1.18.0

package/dist/{chunk-QJVRZT6M.js → chunk-HGN45I5P.js}

@@ -1,20 +1,22 @@
+import {
+  canUserAccess,
+  canUserApprove,
+  resolveNestWideRoles,
+  resolveStewardsForNode,
+  stewardCoverageForUser
+} from "./chunk-TQACHVVA.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-OTGZQZKK.js";
+} from "./chunk-QUZXRLUA.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-D6HICFVW.js";
-import {
-  canUserAccess,
-  canUserApprove,
-  resolveStewardsForNode
-} from "./chunk-CLKZZZS2.js";
+} from "./chunk-34UXRZXD.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -28,10 +30,12 @@ import {
   notifyEmailForNest,
   nowExpr,
   opContext,
+  permissionLabel,
   prettyFolderPath,
+  resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-FUUJG6XP.js";
 import {
   ConflictError,
   NotFoundError,
@@ -40,7 +44,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -168,7 +172,7 @@ async function notifyNestInvite(params) {
         nestId,
         inviteeEmail.toLowerCase(),
         nestId,
-        `You were added to "${nestName2}" as ${permission}`,
+        `You were added to "${nestName2}" as ${permissionLabel(permission)}`,
         (/* @__PURE__ */ new Date()).toISOString()
       ]
     );
@@ -179,10 +183,16 @@ async function notifyNestInvite(params) {
 async function listNotifications(userEmail, opts = {}) {
   const limit = Math.min(opts.limit ?? 50, 200);
   return await getDb().all(
-    `SELECT id, nest_id, kind, subject_id, message, created_at, read_at
-       FROM notifications
-      WHERE LOWER(user_email) = LOWER(?)${opts.unreadOnly ? " AND read_at IS NULL" : ""}
-      ORDER BY created_at DESC LIMIT ${limit}`,
+    `SELECT n.id, n.nest_id, n.kind, n.subject_id, n.message, n.created_at, n.read_at,
+            COALESCE(
+              rr.node_id,
+              CASE WHEN dr.target_type = 'document' THEN dr.node_id END
+            ) AS node_id
+       FROM notifications n
+       LEFT JOIN review_requests rr ON rr.id = n.subject_id
+       LEFT JOIN deletion_requests dr ON dr.id = n.subject_id
+      WHERE LOWER(n.user_email) = LOWER(?)${opts.unreadOnly ? " AND n.read_at IS NULL" : ""}
+      ORDER BY n.created_at DESC LIMIT ${limit}`,
     [userEmail]
   );
 }
@@ -225,20 +235,37 @@ async function canReadNode(nestId, nodeId, userId, userEmail) {
   if ((await canUserAccess(nestId, nodeId, userEmail)).allowed) return true;
   return await resolveNodeGrant(nestId, userId, nodeId) !== null;
 }
+async function canRequestDeletion(params) {
+  const { nestId, userId, userEmail, nodeId } = params;
+  const permission = params.permission ?? await resolveNestPermission(nestId, userId);
+  if (permission === "owner" || permission === "admin" || permission === "write") {
+    return true;
+  }
+  const resolved = await resolveStewardsForNode(nestId, nodeId);
+  const isEditorSteward = resolved.some(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && (nodeId !== "" || r.steward.scope === "nest")
+  );
+  if (isEditorSteward) return true;
+  if (nodeId === "") return false;
+  return await resolveNodeGrant(nestId, userId, nodeId) === "write";
+}
 async function filterAccessible(nestId, userId, userEmail, nodes, approvedVersions) {
   if (await isPublicReader(nestId, userId)) {
     const approved = approvedVersions ?? await getApprovedVersions(nestId);
     return nodes.filter((n) => approved.has(n.id));
   }
-  if (!await isStewardshipEnabled(nestId)) return nodes;
   const grants = await listUserGrants(nestId, userId);
-  const accessible = [];
-  for (const n of nodes) {
-    if ((await canUserAccess(nestId, n.id, userEmail)).allowed || grantCoversNode(grants, n.id)) {
-      accessible.push(n);
-    }
+  if (!await isStewardshipEnabled(nestId)) {
+    if (grants.length === 0) return nodes;
+    if (await resolveNestPermission(nestId, userId) !== "none") return nodes;
+    return nodes.filter((n) => grantCoversNode(grants, n.id));
   }
-  return accessible;
+  if ((await resolveNestWideRoles(nestId, userEmail)).length > 0) return nodes;
+  const coverage = await stewardCoverageForUser(nestId, userEmail);
+  if (coverage.nestWide) return nodes;
+  return nodes.filter(
+    (n) => coverage.nodeIds.has(n.id) || grantCoversNode(grants, n.id)
+  );
 }
 
 // src/workflow/edge-type-routes.ts
@@ -1477,6 +1504,15 @@ async function listDeletionRequests(params) {
 async function dropDeletionRequest(id) {
   await getDb().run("DELETE FROM deletion_requests WHERE id = ?", [id]);
 }
+async function withdrawDeletionRequest(params) {
+  const db = getDb();
+  const pending = await getDeletionRequest(params.id);
+  if (!pending || pending.nestId !== params.nestId || pending.status !== "pending" || pending.requestedBy.toLowerCase() !== params.withdrawnBy.toLowerCase()) {
+    return null;
+  }
+  await db.run("DELETE FROM deletion_requests WHERE id = ?", [params.id]);
+  return pending;
+}
 async function declineDeletion(params) {
   const db = getDb();
   const pending = await getDeletionRequest(params.id);
@@ -1556,6 +1592,7 @@ export {
   markNotificationsRead,
   resolveCallerEmail,
   canReadNode,
+  canRequestDeletion,
   filterAccessible,
   safeJson,
   requireWorkflowPlane,
@@ -1586,5 +1623,6 @@ export {
   getDeletionRequest,
   listDeletionRequests,
   dropDeletionRequest,
+  withdrawDeletionRequest,
   declineDeletion
 };

package/dist/{chunk-JMJLNEXE.js → chunk-HYSTFMFG.js}

@@ -1,6 +1,6 @@
 import {
   ANON_USER_ID
-} from "./chunk-SLTQACJW.js";
+} from "./chunk-YB3LKF7U.js";
 
 // src/db/client.ts
 import Database from "better-sqlite3";
@@ -741,6 +741,9 @@ function runMigrations(db) {
   if (!nestCols.includes("prime_tags")) {
     db.exec("ALTER TABLE nests ADD COLUMN prime_tags TEXT NOT NULL DEFAULT 'prime-document'");
   }
+  if (!nestCols.includes("index_synced_at")) {
+    db.exec("ALTER TABLE nests ADD COLUMN index_synced_at TEXT");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -1531,6 +1534,44 @@ function runMigrations(db) {
     `);
     recordMigration("034_versions_author_status_index");
   }
+  if (!hasMigration("035_multiple_api_keys_per_user")) {
+    db.exec(`DROP INDEX IF EXISTS idx_api_keys_user_unique;`);
+    recordMigration("035_multiple_api_keys_per_user");
+  }
+  if (!hasMigration("036_node_index")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS node_index (
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          folder TEXT NOT NULL DEFAULT '',
+          title TEXT NOT NULL DEFAULT '',
+          type TEXT NOT NULL DEFAULT 'document',
+          status TEXT NOT NULL DEFAULT 'draft',
+          updated_at TEXT,
+          frontmatter_json TEXT NOT NULL,
+          PRIMARY KEY (nest_id, node_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_node_index_folder
+          ON node_index(nest_id, folder);
+
+        -- Which documents have an external edit staged against them.
+        --
+        -- Its own table rather than a node_index column: node_index rows are
+        -- upserted with INSERT OR REPLACE on every document write, which
+        -- resets any column the write does not carry \u2014 and a suggestion's
+        -- existence has nothing to do with the document write that would
+        -- clobber it. Kept in step at the three points that stage, approve or
+        -- reject a suggestion, and refreshed wholesale by a rebuild.
+        CREATE TABLE IF NOT EXISTS node_suggestions (
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          PRIMARY KEY (nest_id, node_id)
+        );
+      `);
+    })();
+    recordMigration("036_node_index");
+  }
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1748,7 +1789,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-CYKO5CFV.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-5VI4RDTS.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/chunk-OOBZG6BW.js

@@ -0,0 +1,379 @@
+import {
+  engineCache,
+  indexedNodeIds,
+  markIndexStale,
+  resolveNestPath,
+  setSuggestionFlag
+} from "./chunk-FUUJG6XP.js";
+import {
+  getDb
+} from "./chunk-HYSTFMFG.js";
+
+// src/governance/external-edit-service.ts
+import { readFile, readdir } from "fs/promises";
+import { join, relative, sep } from "path";
+import {
+  detectDrift,
+  stageSuggestion,
+  ChainEventLog,
+  approveSuggestion,
+  rejectSuggestion,
+  listSuggestions,
+  readSuggestion,
+  parseDocument,
+  VersionManager,
+  computeContentHash,
+  getChecksumContent
+} from "@promptowl/contextnest-engine";
+var communityRbac = {
+  isCzar: () => false,
+  canIngest: () => true,
+  isDocOwner: () => true
+};
+function docPath(nestId, documentId) {
+  return join(resolveNestPath(nestId), `${documentId}.md`);
+}
+async function readRaw(nestId, documentId) {
+  try {
+    return await readFile(docPath(nestId, documentId), "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function loadChainHead(storage, documentId) {
+  const history = await storage.readHistory(documentId);
+  if (!history || history.versions.length === 0) return null;
+  const latest = history.versions[history.versions.length - 1];
+  try {
+    const content = await new VersionManager(storage).reconstructVersion(
+      documentId,
+      latest.version
+    );
+    return { version: latest.version, content };
+  } catch {
+    return null;
+  }
+}
+async function loadLatestApprovedNode(nestId, documentId) {
+  const { storage } = await engineCache.get(nestId);
+  const head = await loadChainHead(storage, documentId);
+  if (!head) return null;
+  return parseDocument(docPath(nestId, documentId), head.content, documentId);
+}
+async function bodyMatchesLatestVersion(storage, documentId, liveBodyHash) {
+  const head = await loadChainHead(storage, documentId);
+  if (!head) return false;
+  const headBodyHash = computeContentHash(getChecksumContent(head.content));
+  return headBodyHash === liveBodyHash;
+}
+async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner") {
+  const res = await scanDocumentForDriftInternal(nestId, documentId, actor);
+  return res?.meta ?? null;
+}
+async function scanDocumentForDriftInternal(nestId, documentId, actor) {
+  const { storage } = await engineCache.get(nestId);
+  const node = await storage.readDocument(documentId).catch(() => null);
+  if (!node) return null;
+  const raw = await readRaw(nestId, documentId);
+  if (raw == null) return null;
+  const drift = detectDrift(raw, node.frontmatter.checksum);
+  if (!drift.drifted) return null;
+  if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
+    return null;
+  }
+  const approved = await loadChainHead(storage, documentId);
+  if (!approved) return null;
+  const existing = await listSuggestions(storage, documentId);
+  const dup = existing.find((s) => s.proposed_hash === drift.actualHash);
+  if (dup) {
+    await setSuggestionFlag(nestId, documentId, true);
+    return { meta: dup, created: false };
+  }
+  const result = await stageSuggestion({
+    storage,
+    documentId,
+    approvedRawContent: approved.content,
+    proposedRawContent: raw,
+    source: "out-of-band-edit",
+    actor,
+    docTier: "standard"
+  });
+  await setSuggestionFlag(nestId, documentId, true);
+  return { meta: result.meta, created: true };
+}
+async function refreshSuggestionFlag(nestId, storage, documentId) {
+  try {
+    const remaining = await listSuggestions(storage, documentId);
+    await setSuggestionFlag(nestId, documentId, remaining.length > 0);
+  } catch (err) {
+    console.error("[external-edit] flag refresh failed", nestId, documentId, err);
+  }
+}
+async function scanNestForDrift(nestId, actor = "system:scanner") {
+  const { storage, dropDiscoveryCache } = await engineCache.get(nestId);
+  dropDiscoveryCache();
+  const docs = await storage.discoverDocuments();
+  const results = await Promise.all(
+    docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
+  );
+  const staged = results.filter((r) => r?.created).length;
+  const onDisk = await storage.discoverDocuments({ includeRetired: true });
+  const indexed = await indexedNodeIds(nestId);
+  const membershipMoved = indexed.size !== onDisk.length || onDisk.some((d) => !indexed.has(d.id));
+  if (staged > 0 || membershipMoved) await markIndexStale(nestId);
+  return { scanned: docs.length, staged };
+}
+async function documentsWithSuggestions(nestId) {
+  const root = resolveNestPath(nestId);
+  const ids = /* @__PURE__ */ new Set();
+  let entries;
+  try {
+    entries = await readdir(root, { recursive: true, withFileTypes: true });
+  } catch (err) {
+    if (err?.code !== "ENOENT") {
+      console.error("[external-edit] suggestion scan failed", nestId, err);
+    }
+    return ids;
+  }
+  for (const e of entries) {
+    if (!e.isFile() || !e.name.endsWith(".meta.yaml")) continue;
+    const dir = e.parentPath ?? e.path ?? root;
+    const rel = relative(root, dir).split(sep).join("/");
+    const segs = rel.split("/");
+    const marker = segs.lastIndexOf("_suggestions");
+    if (marker === -1 || segs.length !== marker + 2) continue;
+    ids.add([...segs.slice(0, marker), segs[marker + 1]].filter(Boolean).join("/"));
+  }
+  return ids;
+}
+async function getPendingChange(nestId, documentId) {
+  const { storage } = await engineCache.get(nestId);
+  const list = await listSuggestions(storage, documentId);
+  for (let i = list.length - 1; i >= 0; i--) {
+    const meta = list[i];
+    if (await bodyMatchesLatestVersion(storage, documentId, meta.proposed_hash)) {
+      continue;
+    }
+    return {
+      suggestion_id: meta.suggestion_id,
+      detected_at: meta.detected_at,
+      source: meta.source,
+      proposed_hash: meta.proposed_hash
+    };
+  }
+  return null;
+}
+async function listNestExternalEdits(nestId) {
+  const { storage } = await engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const lists = await Promise.all(
+    docs.map(async (doc) => {
+      const metas = await listSuggestions(storage, doc.id);
+      const fresh = [];
+      for (const meta of metas) {
+        if (await bodyMatchesLatestVersion(storage, doc.id, meta.proposed_hash)) {
+          continue;
+        }
+        fresh.push(meta);
+      }
+      return fresh;
+    })
+  );
+  const entries = lists.flat().map((meta) => ({
+    suggestion_id: meta.suggestion_id,
+    nest_id: nestId,
+    document_id: meta.document_id,
+    source: meta.source,
+    detected_at: meta.detected_at,
+    actor: meta.actor,
+    target_hash: meta.target_hash,
+    proposed_hash: meta.proposed_hash,
+    note: meta.note
+  }));
+  return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
+}
+async function getExternalEditDetail(nestId, documentId, suggestionId) {
+  const { storage } = await engineCache.get(nestId);
+  const found = await readSuggestion(storage, documentId, suggestionId);
+  if (!found) return null;
+  return {
+    suggestion_id: found.meta.suggestion_id,
+    nest_id: nestId,
+    document_id: found.meta.document_id,
+    source: found.meta.source,
+    detected_at: found.meta.detected_at,
+    actor: found.meta.actor,
+    target_hash: found.meta.target_hash,
+    proposed_hash: found.meta.proposed_hash,
+    note: found.meta.note,
+    patch: found.patch
+  };
+}
+async function recordVerdict(nestId, event) {
+  try {
+    const { storage } = await engineCache.get(nestId);
+    await new ChainEventLog(storage).append(event);
+    return true;
+  } catch (err) {
+    console.error(
+      `[external-edit] failed to record verdict ${event.event_id} for nest ${nestId}:`,
+      err
+    );
+    return false;
+  }
+}
+async function listExternalEditVerdicts(nestId, documentId) {
+  try {
+    const { storage } = await engineCache.get(nestId);
+    const events = await new ChainEventLog(storage).readByDocument(documentId);
+    return events.flatMap((e) => {
+      const meta = e.action_metadata || {};
+      if (typeof meta.suggestion_id !== "string") return [];
+      const reason = meta.rejection_reason;
+      const comment = meta.approval_comment;
+      return [
+        {
+          suggestion_id: meta.suggestion_id,
+          status: typeof reason === "string" ? "rejected" : "approved",
+          actor: e.actor,
+          at: e.timestamp,
+          note: typeof reason === "string" ? reason : typeof comment === "string" ? comment : void 0,
+          source: typeof meta.source === "string" ? meta.source : void 0
+        }
+      ];
+    });
+  } catch (err) {
+    console.error(
+      `[external-edit] failed to read verdicts for ${nestId}/${documentId}:`,
+      err
+    );
+    return [];
+  }
+}
+async function mirrorVersion(input) {
+  const { storage } = await engineCache.get(input.nestId);
+  const node = await storage.readDocument(input.documentId);
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-JWEN5UUW.js");
+  await upsertVersion({
+    nestId: input.nestId,
+    nodeId: input.documentId,
+    version: input.version,
+    content: node.body || "",
+    author: input.actor,
+    status: "published",
+    tags: node.frontmatter.tags || [],
+    changeNote: input.note
+  });
+  await setApprovedVersion(
+    input.nestId,
+    input.documentId,
+    input.version,
+    input.actor
+  );
+}
+async function approveExternalEdit(input) {
+  const { storage } = await engineCache.get(input.nestId);
+  let result;
+  try {
+    result = await approveSuggestion({
+      storage,
+      rbac: communityRbac,
+      documentId: input.documentId,
+      suggestionId: input.suggestionId,
+      actor: input.actor,
+      zone: "default",
+      comment: input.comment
+    });
+  } catch (err) {
+    console.error(
+      `[external-edit] approveSuggestion failed for ${input.nestId}/${input.documentId} suggestion=${input.suggestionId}:`,
+      err
+    );
+    throw err;
+  }
+  try {
+    await mirrorVersion({
+      nestId: input.nestId,
+      documentId: input.documentId,
+      version: result.versionEntry.version,
+      actor: input.actor,
+      note: input.comment ? `External edit approved: ${input.comment}` : "External edit approved"
+    });
+  } catch (err) {
+    console.error(
+      `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  const historyRecorded = await recordVerdict(input.nestId, result.chainEvent);
+  await refreshSuggestionFlag(input.nestId, storage, input.documentId);
+  return { ...result, historyRecorded };
+}
+async function rejectExternalEdit(input) {
+  const { storage } = await engineCache.get(input.nestId);
+  const result = await rejectSuggestion({
+    storage,
+    rbac: communityRbac,
+    documentId: input.documentId,
+    suggestionId: input.suggestionId,
+    actor: input.actor,
+    zone: "default",
+    reason: input.reason
+  });
+  const historyRecorded = await recordVerdict(input.nestId, result.chainEvent);
+  try {
+    const approved = await loadChainHead(storage, input.documentId);
+    if (approved) {
+      await storage.writeDocument(input.documentId, approved.content);
+    }
+  } catch (err) {
+    console.error(
+      `[external-edit] revert-on-reject failed for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  await refreshSuggestionFlag(input.nestId, storage, input.documentId);
+  return { ...result, historyRecorded };
+}
+var scannerTimer = null;
+async function scanAllNests() {
+  const db = getDb();
+  const rows = await db.all("SELECT id FROM nests");
+  await Promise.all(
+    rows.map(
+      ({ id }) => scanNestForDrift(id).catch(
+        (err) => console.error(`[external-edit] scan failed for nest ${id}:`, err)
+      )
+    )
+  );
+}
+function startDriftScanner(intervalMs = 3e4) {
+  if (scannerTimer) return;
+  scannerTimer = setInterval(() => {
+    scanAllNests().catch(
+      (err) => console.error("[external-edit] scanner tick failed:", err)
+    );
+  }, intervalMs);
+  scannerTimer.unref?.();
+}
+function stopDriftScanner() {
+  if (scannerTimer) {
+    clearInterval(scannerTimer);
+    scannerTimer = null;
+  }
+}
+
+export {
+  loadLatestApprovedNode,
+  scanDocumentForDrift,
+  scanNestForDrift,
+  documentsWithSuggestions,
+  getPendingChange,
+  listNestExternalEdits,
+  getExternalEditDetail,
+  listExternalEditVerdicts,
+  approveExternalEdit,
+  rejectExternalEdit,
+  startDriftScanner,
+  stopDriftScanner
+};

package/dist/{chunk-OTGZQZKK.js → chunk-QUZXRLUA.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GUNJTORH.js";
 import {
   getDb
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";
@@ -22,14 +22,6 @@ async function resolveNodeGrant(nestId, userId, nodeId) {
   }
   return best;
 }
-async function hasAnyGrant(nestId, userId) {
-  if (!userId) return false;
-  const row = await getDb().get(
-    "SELECT 1 AS x FROM grants WHERE nest_id = ? AND user_id = ? LIMIT 1",
-    [nestId, userId]
-  );
-  return !!row;
-}
 async function listUserGrants(nestId, userId) {
   if (!userId) return [];
   return await getDb().all(
@@ -42,6 +34,15 @@ function grantCoversNode(grants, nodeId) {
     (g) => nodeId === g.target || nodeId.startsWith(g.target + "/")
   );
 }
+function grantRoleForNode(grants, nodeId) {
+  let best = null;
+  for (const g of grants) {
+    if (nodeId === g.target || nodeId.startsWith(g.target + "/")) {
+      if (!best || rank(g.role) > rank(best)) best = g.role;
+    }
+  }
+  return best;
+}
 async function createGrant(params) {
   const { nestId, targetType, target, userId, role, grantedBy } = params;
   if (!["document", "folder"].includes(targetType)) {
@@ -94,9 +95,9 @@ async function deleteGrant(nestId, id) {
 
 export {
   resolveNodeGrant,
-  hasAnyGrant,
   listUserGrants,
   grantCoversNode,
+  grantRoleForNode,
   createGrant,
   listGrants,
   deleteGrant