fix(page-data): isolate owner API from public pages

user-data-space-service.mjs

@@ -674,6 +674,18 @@ export function createUserDataSpaceService(options = {}) {
     return { dataset, id, deleted: true };
   }
 
+  async function hardDeleteRowForDataset(dataset, rowId, meta = {}) {
+    assertDatasetAction(dataset, 'hard_delete');
+    const table = assertSafeSqlIdentifier(dataset.table, '表名');
+    const id = Number(rowId);
+    if (!Number.isFinite(id) || id <= 0) {
+      throw Object.assign(new Error('行 id 无效'), { code: 'invalid_row_id' });
+    }
+    const scopeClause = meta.rowScope?.whereClause ? ` AND ${meta.rowScope.whereClause}` : '';
+    await executeSql(`DELETE FROM "${table}" WHERE id = ${id}${scopeClause};`);
+    return { dataset, id, deleted: true, permanentlyDeleted: true };
+  }
+
   async function restoreSoftDeletedRowForDataset(dataset, rowId) {
     const table = assertSafeSqlIdentifier(dataset.table, '表名');
     const id = Number(rowId);
@@ -795,6 +807,7 @@ export function createUserDataSpaceService(options = {}) {
     updateRowForDataset,
     softDeleteDatasetRow,
     softDeleteRowForDataset,
+    hardDeleteRowForDataset,
     restoreSoftDeletedRowForDataset,
     restoreSoftDeletedRow,
     exportDatasetRows,