fix(folders): route kb and table cascades through their canonical delete

Review found three ways the generic cascade diverged from the behavior each
resource defines for itself.

- Deleting an already-archived folder stamped its still-active children with
  a fresh timestamp while the folder row kept the original. Restore matches
  the folder's stamp, so those children were stranded permanently. Delete now
  reuses the folder's existing deletedAt.
- A knowledge base is more than its own row: deleteKnowledgeBase also archives
  its documents and pauses its connectors. The generic row update left that
  graph live, so a connector kept syncing into a KB the UI showed as deleted.
  The kb config now delegates to the canonical delete and restore.
- deleteTable refuses to archive a delete-locked table, because archiving
  destroys access to every row. Deleting the folder around it bypassed that
  control entirely. Tables now declare a guardDelete that refuses the whole
  folder up front, so the cascade never archives half a subtree and then stops.

deleteKnowledgeBase and deleteTable gain an optional archivedAt so a bulk
caller can stamp one shared timestamp, matching archiveWorkflow's existing
option; single-resource callers are unchanged. Adds the restoreChildren hook
that pairs with archiveChildren, sequenced after the folder transaction commits
since the canonical restores open their own.

Also: make resourceType a required argument on deduplicateFolderName and
listFoldersForWorkspace so a future caller cannot silently operate on the
workflow tree, and give folder routes one shared status mapper rather than
three copies that already disagreed.

Author: waleedlatif1

apps/sim/app/api/folders/[id]/duplicate/route.ts

@@ -112,7 +112,8 @@ export const POST = withRouteHandler(
           tx,
           targetWorkspaceId,
           targetParentId,
-          name
+          name,
+          'workflow'
         )
 
         await tx.insert(folderTable).values({

apps/sim/app/api/folders/[id]/restore/route.ts

@@ -6,8 +6,8 @@ import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { restoreFolder } from '@/lib/folders/lifecycle'
+import { folderMutationStatus } from '@/lib/folders/status'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { statusForOrchestrationError } from '@/lib/workflows/orchestration/types'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('RestoreFolderAPI')
@@ -41,7 +41,7 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Route
     if (!result.success) {
       return NextResponse.json(
         { error: result.error },
-        { status: statusForOrchestrationError(result.errorCode) }
+        { status: folderMutationStatus(result.errorCode) }
       )
     }
 

apps/sim/app/api/folders/[id]/route.test.ts

@@ -407,6 +407,25 @@ describe('Individual Folder API Route', () => {
       })
     })
 
+    it('surfaces a delete-locked resource as 423, not a generic 500', async () => {
+      mockAuthenticatedUser()
+      queueFolderLookup()
+      mockDeleteFolder.mockResolvedValueOnce({
+        success: false,
+        error: 'Cannot delete folder: table Ledger is delete-locked',
+        errorCode: 'locked',
+      })
+
+      const req = createMockRequest('DELETE')
+      const params = Promise.resolve({ id: 'folder-1' })
+
+      const response = await DELETE(req, { params })
+
+      expect(response.status).toBe(423)
+      const data = await response.json()
+      expect(data.error).toBe('Cannot delete folder: table Ledger is delete-locked')
+    })
+
     it('should return 401 for unauthenticated delete requests', async () => {
       mockUnauthenticated()
 

apps/sim/app/api/folders/[id]/route.ts

@@ -10,17 +10,10 @@ import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { deleteFolder, updateFolder } from '@/lib/folders/lifecycle'
 import { toFolderApi } from '@/lib/folders/queries'
+import { folderMutationStatus } from '@/lib/folders/status'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
-/** Maps an orchestration errorCode to its HTTP status; mirrors the POST /api/folders route. */
-function folderMutationStatus(errorCode: string | undefined): number {
-  if (errorCode === 'validation') return 400
-  if (errorCode === 'conflict') return 409
-  if (errorCode === 'not_found') return 404
-  return 500
-}
-
 const logger = createLogger('FoldersIDAPI')
 
 // PUT - Update a folder
@@ -172,9 +165,10 @@ export const DELETE = withRouteHandler(
       })
 
       if (!result.success) {
-        const status =
-          result.errorCode === 'not_found' ? 404 : result.errorCode === 'validation' ? 400 : 500
-        return NextResponse.json({ error: result.error }, { status })
+        return NextResponse.json(
+          { error: result.error },
+          { status: folderMutationStatus(result.errorCode) }
+        )
       }
 
       captureServerEvent(

apps/sim/app/api/folders/route.ts

@@ -7,18 +7,12 @@ import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { createFolder } from '@/lib/folders/lifecycle'
 import { listFoldersForWorkspace, toFolderApi } from '@/lib/folders/queries'
+import { folderMutationStatus } from '@/lib/folders/status'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('FoldersAPI')
 
-function folderMutationStatus(errorCode: string | undefined): number {
-  if (errorCode === 'validation') return 400
-  if (errorCode === 'conflict') return 409
-  if (errorCode === 'not_found') return 404
-  return 500
-}
-
 // GET - Fetch folders for a workspace
 export const GET = withRouteHandler(async (request: NextRequest) => {
   try {

apps/sim/app/workspace/[workspaceId]/home/prefetch.ts

@@ -28,10 +28,10 @@ export async function prefetchHomeLists(
 ): Promise<void> {
   await Promise.all([
     queryClient.prefetchQuery({
-      queryKey: folderKeys.list(workspaceId, 'active'),
+      queryKey: folderKeys.list(workspaceId, 'active', 'workflow'),
       queryFn: async () => {
         const { folders } = await prefetchInternalJson<{ folders?: FolderApi[] }>(
-          `/api/folders?workspaceId=${workspaceId}&scope=active`
+          `/api/folders?workspaceId=${workspaceId}&scope=active&resourceType=workflow`
         )
         return (folders ?? []).map(mapFolder)
       },

apps/sim/app/workspace/[workspaceId]/lib/prefetch.test.ts

@@ -126,7 +126,7 @@ describe('workspace list prefetches', () => {
       await prefetchHomeLists(client, WORKSPACE_ID)
 
       expect(mockPrefetchInternalJson).toHaveBeenCalledWith(
-        `/api/folders?workspaceId=${WORKSPACE_ID}&scope=active`
+        `/api/folders?workspaceId=${WORKSPACE_ID}&scope=active&resourceType=workflow`
       )
       const cachedFolders = client.getQueryData(folderKeys.list(WORKSPACE_ID, 'active')) as Array<{
         id: string

apps/sim/app/workspace/[workspaceId]/prefetch.ts

@@ -83,9 +83,9 @@ export async function prefetchWorkspaceSidebar(
       staleTime: MOTHERSHIP_CHAT_LIST_STALE_TIME,
     }),
     queryClient.prefetchQuery({
-      queryKey: folderKeys.list(workspaceId, 'active'),
+      queryKey: folderKeys.list(workspaceId, 'active', 'workflow'),
       queryFn: async () => {
-        const rows = await listFoldersForWorkspace(workspaceId, 'active')
+        const rows = await listFoldersForWorkspace(workspaceId, 'active', 'workflow')
         return rows.map(mapFolder)
       },
       staleTime: FOLDER_LIST_STALE_TIME,

apps/sim/lib/folders/cascade.test.ts

@@ -8,9 +8,11 @@ import {
   collectArchivedSubtreeIds,
   type DbOrTx,
   restoreFolderCascade,
+  restoreFolderRows,
   toCascadeCounts,
 } from '@/lib/folders/cascade'
 import { FOLDER_RESOURCES, type FolderResourceConfig } from '@/lib/folders/config'
+import { folderMutationStatus } from '@/lib/folders/status'
 
 interface SelectCall {
   where: unknown
@@ -190,6 +192,18 @@ describe('archiveFolderCascade', () => {
     }
   })
 
+  it('stamps children with the timestamp it is given, not one of its own', async () => {
+    const { tx, updateCalls } = makeTx({ updates: [[{ id: 'child-1' }], []] })
+
+    await archiveFolderCascade(tx, makeConfig(), 'ws-1', ['root'], TIMESTAMP)
+
+    // Regression guard: deleting an already-archived folder reuses that folder's existing
+    // deletedAt. A fresh stamp here would strand the children — the folder row keeps its
+    // original stamp, so restore would never match them.
+    expect(updateCalls[0].set).toEqual({ archivedAt: TIMESTAMP, updatedAt: TIMESTAMP })
+    expect(updateCalls[1].set).toMatchObject({ deletedAt: TIMESTAMP })
+  })
+
   it('delegates to archiveChildren when a resource archives through its own lifecycle', async () => {
     const archiveChildren = vi.fn().mockResolvedValue(7)
     const { tx, updateCalls } = makeTx({ updates: [[{ id: 'root' }]] })
@@ -302,6 +316,39 @@ describe('restoreFolderCascade', () => {
   })
 })
 
+describe('restoreFolderRows', () => {
+  it('restores only folders carrying the cascade timestamp', async () => {
+    const { tx, updateCalls } = makeTx({ updates: [[{ id: 'root' }, { id: 'sub' }]] })
+
+    const folders = await restoreFolderRows(
+      tx,
+      makeConfig(),
+      'ws-1',
+      ['root', 'sub'],
+      TIMESTAMP,
+      NOW
+    )
+
+    expect(folders).toBe(2)
+    expect(updateCalls).toHaveLength(1)
+    expect(hasCondition(updateCalls[0].where, (node) => node.right === TIMESTAMP)).toBe(true)
+  })
+})
+
+describe('folderMutationStatus', () => {
+  it('maps a locked resource to 423, matching the single-resource delete', () => {
+    expect(folderMutationStatus('locked')).toBe(423)
+  })
+
+  it('maps the shared orchestration codes', () => {
+    expect(folderMutationStatus('validation')).toBe(400)
+    expect(folderMutationStatus('not_found')).toBe(404)
+    expect(folderMutationStatus('conflict')).toBe(409)
+    expect(folderMutationStatus('internal')).toBe(500)
+    expect(folderMutationStatus(undefined)).toBe(500)
+  })
+})
+
 describe('toCascadeCounts', () => {
   it('reports the child count under the resource’s own key', () => {
     expect(toCascadeCounts(makeConfig(), { folders: 2, children: 3 })).toEqual({
@@ -319,6 +366,23 @@ describe('FOLDER_RESOURCES', () => {
     vi.clearAllMocks()
   })
 
+  it('pairs every archiveChildren hook with a restoreChildren hook', () => {
+    // An archive hook exists because archiving touches more than the child row. Without the
+    // matching restore hook, a folder restore would revive the resource and strand whatever
+    // the archive hook took down with it.
+    for (const config of Object.values(FOLDER_RESOURCES)) {
+      if (!config.archiveChildren) continue
+      const hasRestorePath = Boolean(config.restoreChildren) || Boolean(config.restoreDependents)
+      expect(hasRestorePath).toBe(true)
+    }
+  })
+
+  it('guards the delete of resources that gate their own deletion', () => {
+    // Tables refuse deletion while delete-locked; deleting the folder around one must not
+    // become a way around that control.
+    expect(FOLDER_RESOURCES.table.guardDelete).toBeDefined()
+  })
+
   it('declares one entry per folder resource type', () => {
     expect(Object.keys(FOLDER_RESOURCES).sort()).toEqual([
       'file',

apps/sim/lib/folders/cascade.ts

@@ -121,21 +121,19 @@ export async function archiveFolderCascade(
 }
 
 /**
- * Restores `folderIds` — the subtree resolved by {@link collectArchivedSubtreeIds} — plus
- * every resource archived at the same `timestamp`, then reactivates the dependent rows
- * (schedules, webhooks, chats) hanging off those resources.
+ * Un-archives the folder rows of a restore cascade — the subtree resolved by
+ * {@link collectArchivedSubtreeIds}, matched on the exact `timestamp`.
  *
- * Fixed query count regardless of subtree depth: one UPDATE for the folders, one for the
- * resources, and one per declared dependent table.
+ * One statement regardless of subtree depth. Returns how many folders came back.
  */
-export async function restoreFolderCascade(
+export async function restoreFolderRows(
   tx: DbOrTx,
   config: FolderResourceConfig,
   workspaceId: string,
   folderIds: string[],
   timestamp: Date,
   now: Date
-): Promise<FolderCascadeCounts> {
+): Promise<number> {
   const restoredFolders = await tx
     .update(folderTable)
     .set({ deletedAt: null, updatedAt: now })
@@ -149,13 +147,33 @@ export async function restoreFolderCascade(
     )
     .returning({ id: folderTable.id })
 
+  return restoredFolders.length
+}
+
+/**
+ * Un-archives the resources a restore cascade covers, plus the dependent rows (schedules,
+ * webhooks, chats) hanging off them — the default path, for resources whose restore is a
+ * plain row update.
+ *
+ * Fixed statement count regardless of subtree depth: one UPDATE for the resources and one
+ * per declared dependent table. Resources whose restore needs more than this declare
+ * {@link FolderResourceConfig.restoreChildren} instead and never reach here.
+ */
+export async function restoreFolderChildren(
+  tx: DbOrTx,
+  config: FolderResourceConfig,
+  workspaceId: string,
+  folderIds: string[],
+  timestamp: Date,
+  now: Date
+): Promise<number> {
   const restoredChildren = await tx
     .update(config.table)
     .set(config.buildSoftDeleteSet(null, now))
     .where(and(childFilter(config, workspaceId, folderIds), eq(config.deletedColumn, timestamp)))
     .returning({ id: config.idColumn })
 
-  const childIds = restoredChildren.map((row) => row.id as string)
+  const childIds = restoredChildren.map((row) => String(row.id))
 
   if (childIds.length > 0) {
     for (const dependent of config.restoreDependents ?? []) {
@@ -168,7 +186,28 @@ export async function restoreFolderCascade(
     }
   }
 
-  return { folders: restoredFolders.length, children: childIds.length }
+  return childIds.length
+}
+
+/**
+ * Restores a folder subtree and the resources inside it, via the default row-update path.
+ *
+ * Only valid for resources without a {@link FolderResourceConfig.restoreChildren} hook —
+ * those hooks call canonical single-resource restores that open their own transactions and
+ * therefore must not run nested inside this one. `restoreFolder` sequences that case itself.
+ */
+export async function restoreFolderCascade(
+  tx: DbOrTx,
+  config: FolderResourceConfig,
+  workspaceId: string,
+  folderIds: string[],
+  timestamp: Date,
+  now: Date
+): Promise<FolderCascadeCounts> {
+  const folders = await restoreFolderRows(tx, config, workspaceId, folderIds, timestamp, now)
+  const children = await restoreFolderChildren(tx, config, workspaceId, folderIds, timestamp, now)
+
+  return { folders, children }
 }
 
 /**