@anchrd/intel-api 0.12.4 → 0.13.0

package/dist/adapters/cloudflare-api/cloudflare-api.js

@@ -19,6 +19,23 @@ const ApiOrigin = "https://api.cloudflare.com/client/v4";
  */
 const MaxPages = 20;
 const PerPage = 50;
+/**
+ * ⚠️ Cloudflare's ceiling on `/ai/models/search`, and a DIFFERENT number from `PerPage` above —
+ * the limit belongs to the endpoint, not to the account. Neither may be copied onto the other's
+ * call: 50 on the model catalog halves it, 100 on the log is refused outright.
+ *
+ * And the two fail in opposite ways, of which this is the worse one. The log endpoint REFUSES with
+ * `HTTP 400 Number must be less than or equal to 50` — loud, and found in a day (#294). This one
+ * IGNORES: measured against the live account (#297), `per_page=200` and `per_page=1000` both answer
+ * `HTTP 200` with no error and `result_info.per_page: 100`.
+ *
+ * ⚠️ `result_info.total_count` cannot be used to notice a short answer either. The same account
+ * reports `total_count: 286` and returns 61 entries on page 1, with page 2 empty — a reader that
+ * paginated on that figure would loop over empty pages and call the result partial. The truthful
+ * signal is a page that came back FULL, which the log reader already uses and this one does not
+ * yet (anchrd/intel#330).
+ */
+const ModelPerPage = 100;
 /**
  * The gateway's log entry, read tolerantly.
  *
@@ -184,7 +201,7 @@ export function createCloudflareApi(deps) {
         },
         async workersAiModels() {
             const body = await get(`/accounts/${encodeURIComponent(deps.accountId)}/ai/models/search`, {
-                per_page: "200",
+                per_page: String(ModelPerPage),
                 hide_experimental: "true",
             });
             const parsed = ModelResponse.safeParse(body);

package/dist/adapters/openid/openid.js

@@ -24,9 +24,56 @@ function metadataCandidates(resourceUrl, challenge) {
 function resourceMetadataChallenge(header) {
     return header?.match(/resource_metadata="([^"]+)"/i)?.[1] ?? null;
 }
+/**
+ * ⚠️ `issuer` is REQUIRED by RFC 8414 §2 and by OpenID Connect Discovery, and it is read here for one
+ * reason: it is the only thing that says WHO a metadata document describes. Two of the URLs below are
+ * bare-root guesses, and a bare root under a multi-tenant authorization server answers for a
+ * different tenant — a perfectly valid document about somebody else.
+ */
 const AuthorizationServerMetadata = z.looseObject({
+    issuer: z.string().nullish(),
     scopes_supported: z.array(z.string()).nullish(),
 });
+/**
+ * Where an authorization server may publish its metadata, in the order worth asking.
+ *
+ * ⚠️ One candidate was never a decision, it was an omission — `metadataCandidates` above tries three
+ * and `withAlgorithmFallback` tries two. A server that publishes only OIDC discovery read as "names
+ * no scopes", which is #97 at a different server class and with the same silent symptom (#303).
+ *
+ * ⚠️ The three spellings are not interchangeable, and the third is the one that is easy to miss.
+ * RFC 8414 §3.1 INSERTS the issuer's path between the well-known prefix and nothing else; OpenID
+ * Connect Discovery 1.0 APPENDS its suffix to the issuer instead. A realm-style issuer
+ * (`https://as.example/realms/x`) publishes at `…/realms/x/.well-known/openid-configuration` and at
+ * neither of the other two — which is exactly the form `client.discovery` asks for further down this
+ * file, so the same server was reachable for registration and invisible here.
+ */
+function authorizationServerCandidates(issuer) {
+    const url = new URL(issuer);
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/+$/, "");
+    return [
+        // RFC 8414 with the path inserted. First, because it is the shape the MCP portals publish.
+        `${url.origin}/.well-known/oauth-authorization-server${path}`,
+        // The same document at the bare root, for an issuer WITH a path that publishes it there anyway.
+        `${url.origin}/.well-known/oauth-authorization-server`,
+        // OpenID Connect Discovery 1.0, appended to the issuer — the realm-style form.
+        `${url.origin}${path}/.well-known/openid-configuration`,
+        // The same document read the RFC 8414 way, and at the bare root.
+        `${url.origin}/.well-known/openid-configuration${path}`,
+        `${url.origin}/.well-known/openid-configuration`,
+    ].filter((value, index, values) => values.indexOf(value) === index);
+}
+/** Two issuer identifiers are the same server, compared the way a URL says so and not as strings. */
+function sameIssuer(published, wanted) {
+    if (!published)
+        return false;
+    try {
+        return new URL(published).href.replace(/\/$/, "") === new URL(wanted).href.replace(/\/$/, "");
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The scopes this authorization server says it understands, or `null` when it names none.
  *
@@ -41,16 +88,29 @@ const AuthorizationServerMetadata = z.looseObject({
  * Intel then asked it for `offline_access`, a scope it never published (#97).
  */
 async function publishedScopes(fetcher, issuer) {
-    const url = new URL(issuer);
-    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/+$/, "");
-    const response = await fetcher(`${url.origin}/.well-known/oauth-authorization-server${path}`, {
-        signal: AbortSignal.timeout(RequestTimeoutMs),
-        headers: { accept: "application/json" },
-    }).catch(() => null);
-    if (!response?.ok)
-        return null;
-    const metadata = AuthorizationServerMetadata.safeParse(await response.json().catch(() => null));
-    return metadata.success ? (metadata.data.scopes_supported ?? null) : null;
+    for (const candidate of authorizationServerCandidates(issuer)) {
+        const response = await fetcher(candidate, {
+            signal: AbortSignal.timeout(RequestTimeoutMs),
+            headers: { accept: "application/json" },
+        }).catch(() => null);
+        if (!response?.ok)
+            continue;
+        const metadata = AuthorizationServerMetadata.safeParse(await response.json().catch(() => null));
+        if (!metadata.success)
+            continue;
+        // ⚠️ The document has to be ABOUT this issuer, and that check is what makes the bare-root
+        // candidates safe to ask at all. Under a multi-tenant server the root answers for a different
+        // tenant, and taking its `scopes_supported` would ask THIS server for a scope it never published
+        // — the very rule this function exists to keep, broken by the fallback added to protect it.
+        // The resource loop further down does the same thing for the same reason.
+        if (!sameIssuer(metadata.data.issuer, issuer))
+            continue;
+        // ⚠️ A document that answered ABOUT THIS SERVER and named no scopes ends the search. Reading on
+        // would let the next candidate answer a question this server has already answered — "I publish
+        // none" — and the documents of one issuer may disagree about a field RFC 8414 makes optional.
+        return metadata.data.scopes_supported ?? null;
+    }
+    return null;
 }
 /**
  * Of the scopes Intel would like, the ones this server published — joined, or absent.

package/dist/adapters/remote-tools/remote-tools.js

@@ -1,6 +1,7 @@
 import { ToolTestResult } from "@anchrd/intel-contract";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
 function responseWithLimit(response, maxBytes) {
     const length = Number(response.headers.get("content-length"));
     if (Number.isFinite(length) && length > maxBytes) {
@@ -28,7 +29,26 @@ function responseWithLimit(response, maxBytes) {
 }
 export function createRemoteTools(deps) {
     async function connected(url, accessToken, signal, maxBytes, work) {
-        const client = new Client({ name: "intel-tools", version: "0.1.0" });
+        /**
+         * ⚠️ The SDK's DEFAULT validator is Ajv, and Ajv cannot run in a Worker.
+         *
+         * `Client.cacheToolMetadata` compiles a validator for every tool that carries an `outputSchema`,
+         * Ajv builds that with `new Function`, and `workerd` answers `EvalError: Code generation from
+         * strings disallowed for this context`. The throw takes the WHOLE `tools/list` with it, so a
+         * single such tool empties the catalog of every other server (#308).
+         *
+         * Nothing announces this. Tools without an `outputSchema` never reach the line, so a portal can
+         * work for months and break the moment somebody adds a server whose tools declare one — which
+         * is exactly how it was found: three servers fine, the fourth took the screen down. And no test
+         * can catch it either: `@cloudflare/vitest-pool-workers` replaces `globalThis.Function` with a
+         * proxy onto an unsafe-eval binding, so code generation WORKS in every test and fails in every
+         * deployment.
+         *
+         * This is #229 one layer down — there Ajv sat in Intel's own schema adapter, here it sits in a
+         * dependency. The SDK offers the way out itself: `CfWorkerJsonSchemaValidator` interprets the
+         * schema instead of compiling it, and it is the same `@cfworker/json-schema` #229 settled on.
+         */
+        const client = new Client({ name: "intel-tools", version: "0.1.0" }, { jsonSchemaValidator: new CfWorkerJsonSchemaValidator() });
         const transport = new StreamableHTTPClientTransport(new URL(url), {
             fetch: async (input, init) => responseWithLimit(await deps.fetch(input, {
                 ...init,

package/dist/bundle/bundle.js

@@ -1,5 +1,6 @@
 import { AgentDefinition, AgentMediaType, BlockNoteMediaType, BoardDocument, BoardMediaType, BundleImportResult, BundleManifest, BundleManifestFilename, DocumentLinkInlineType, FlowGraph, TableMediaType, } from "@anchrd/intel-contract";
 import { Unzip, UnzipInflate, Zip, ZipDeflate, ZipPassThrough } from "fflate";
+import { repeatedBoardId, upgradeStoredBoard } from "../nodes/board/board.js";
 import { documentLinkTargets } from "../nodes/document-links/document-links.js";
 import { parseCsv } from "../shared/csv/csv.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
@@ -935,11 +936,34 @@ export function createBundle(deps) {
                     if (text.trim().length > 0) {
                         let document;
                         try {
-                            document = BoardDocument.parse(JSON.parse(text));
+                            // Same upgrade the stored read does (anchrd/intel#311): a bundle exported before
+                            // `terminal` existed is exactly an old board in a file, and importing it must not be
+                            // the one way to lose a board.
+                            document = BoardDocument.parse(upgradeStoredBoard(JSON.parse(text)));
                         }
                         catch {
                             throw new IntelError(400, "import_invalid_board", `Bundle entry is not a board: ${entry.path}`);
                         }
+                        /**
+                         * ⚠️ Refused by name, and refused rather than folded (anchrd/intel#321).
+                         *
+                         * A board arriving in a file is the ONE place a document somebody else wrote becomes
+                         * truth here — everywhere else a task id is minted by `deps.id()` and a status list
+                         * goes through `ConfigureBoardInput`, which has demanded distinct ids since #285. Two
+                         * tasks under one id threw `graph.addNode` out of the board's graph view, and two
+                         * statuses under one id drew the same cards in two lanes with a drop that had two
+                         * targets meaning one.
+                         *
+                         * Outside the catch above on purpose: swallowed into `import_invalid_board` this would
+                         * read as "that file is not a board", and whoever is holding the file would look for
+                         * the wrong thing. `repeatedBoardId` names the id, which is the line they have to fix.
+                         */
+                        const repeated = repeatedBoardId(document);
+                        if (repeated !== null) {
+                            throw new IntelError(400, "import_duplicate_board_id", repeated.list === "tasks"
+                                ? `Bundle entry names the task “${repeated.id}” twice: ${entry.path}`
+                                : `Bundle entry names the status “${repeated.id}” twice: ${entry.path}`);
+                        }
                         // ⚠️ `references` are remapped the way a document's inline links are, and `dependsOn`
                         // and `parentId` are NOT (#285). A task's references point at NODES, which the import
                         // renumbers; its dependencies and its parent point at tasks inside this very file,

package/dist/indexing/indexing.js

@@ -1,4 +1,5 @@
 import { BlockNoteDocument, BlockNoteMediaType, BoardDocument } from "@anchrd/intel-contract";
+import { upgradeStoredBoard } from "../nodes/board/board.js";
 export class PermanentIndexingError extends Error {
 }
 function indexText(mediaType, content) {
@@ -33,7 +34,17 @@ function boardChunks(content) {
     catch (error) {
         throw new PermanentIndexingError(`Node version content is not valid JSON: ${error instanceof Error ? error.message : "unknown parse failure"}`);
     }
-    const board = BoardDocument.safeParse(parsed);
+    /**
+     * ⚠️ Upgraded first, exactly like `parseStoredBoard` — this is the SECOND place a stored board
+     * body is parsed, and it reads bodies nobody has rewritten since (anchrd/intel#318).
+     *
+     * `reindex` walks every current version in the installation, so an old board arrives here as it
+     * was written: without `terminal` (#311) or with a repeated `dependsOn`. Without the upgrade the
+     * refusal below is PERMANENT — the version is marked failed and never retried — so that board
+     * would simply stop being findable, quietly, while its screen still worked. A rule added at one
+     * parse site and not the other is how a fix looks complete and is not.
+     */
+    const board = BoardDocument.safeParse(upgradeStoredBoard(parsed));
     if (!board.success) {
         throw new PermanentIndexingError("Node version content is not a valid board document");
     }

package/dist/mcp/mcp.js

@@ -540,7 +540,7 @@ export async function handleMcp(request, deps) {
          */
         server.registerTool("board_configure", {
             title: "Configure board statuses",
-            description: 'Write the board\'s whole status list, in the order it should be drawn. Adding, renaming and reordering columns are all this call. The "archived" status is part of every board and cannot be removed, and a status that tasks still sit in cannot be removed either.',
+            description: 'Write the board\'s whole status list, in the order it should be drawn. Adding, renaming and reordering columns are all this call. The "archived" status is part of every board and cannot be removed, and a status that tasks still sit in cannot be removed either. Set "terminal" on a column to say that standing in it means the work is finished — that is what decides whether a task waiting on another is still blocked. Several columns may be terminal; "archived" always is and cannot be set otherwise. Omitting it leaves an ordinary column not terminal.',
             inputSchema: ConfigureBoardInput,
             annotations: {
                 title: "Configure board statuses",
@@ -553,7 +553,7 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.nodes.configureBoard(actor, input)));
         server.registerTool("board_task_add", {
             title: "Add board task",
-            description: "Add one task to a board. The server assigns its id and its place in the order; name afterTaskId or beforeTaskId to put it between two cards, or neither to put it last in its column. parentId makes it a subtask of another task on the same board, dependsOn names tasks of the same board it waits for, and references names Intel nodes. Needs no baseVersionId: tasks are addressed by id, so parallel writers do not collide.",
+            description: "Add one task to a board. The server assigns its id and its place in the order; name afterTaskId or beforeTaskId to put it between two cards, or neither to put it last in its column. parentId makes it a subtask of another task on the same board, dependsOn names tasks of the same board it waits for, and references names Intel nodes. dependsOn, labels and references are sets: naming the same task, word or node twice is refused rather than quietly folded together. Needs no baseVersionId: tasks are addressed by id, so parallel writers do not collide.",
             inputSchema: AddBoardTaskInput,
             annotations: {
                 title: "Add board task",
@@ -565,7 +565,7 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.nodes.addBoardTask(actor, input)));
         server.registerTool("board_task_update", {
             title: "Update board task",
-            description: "Change what a task says: title, assignee, labels, dates, dependencies, description or references. Where a task SITS — its status, its parent, its order — is board_task_move instead. Every named field replaces its current value whole; fields that are not named stay as they are.",
+            description: "Change what a task says: title, assignee, labels, dates, dependencies, description or references. Where a task SITS — its status, its parent, its order — is board_task_move instead. Every named field replaces its current value whole; fields that are not named stay as they are. dependsOn, labels and references are sets: appending to a list this task already holds is refused rather than quietly folded together, so read the current value before you write it back.",
             inputSchema: UpdateBoardTaskInput,
             annotations: {
                 title: "Update board task",

package/dist/nodes/board/board.d.ts

@@ -1,4 +1,48 @@
+import { type BoardDocument } from "@anchrd/intel-contract";
 import type { BoardDeps, BoardOperations } from "./board.types.js";
+/**
+ * A stored board brought up to the current schema, before it is validated.
+ *
+ * ⚠️ It runs before `BoardDocument.parse`, on `unknown`, because after that parse a missing field or
+ * a repeated id is already a refusal — and `parseStoredBoard` is deliberately loud
+ * (`board_unreadable`), so an un-upgraded board would not read as "old", it would read as corrupt.
+ *
+ * The upgrade is persisted by the next write of any kind, because every write serialises the whole
+ * document. Nothing has to be migrated ahead of time and nothing has to be re-migrated.
+ */
+export declare function upgradeStoredBoard(parsed: unknown): unknown;
+/**
+ * The first id a board document uses for two different things (anchrd/intel#321).
+ *
+ * ⚠️ Deliberately NOT a rule on `BoardDocument`, and that is the whole decision. A schema rule would
+ * reach every parse of a stored body — `parseStoredBoard`, `indexing.ts`, the link reader — and a
+ * board imported before this existed would stop answering with `board_unreadable`: the whole board
+ * gone over something that costs one view. It is the trap #311 walked into, and #318 walked into
+ * from the other side.
+ *
+ * ⚠️ And NOT folded in `upgradeStoredBoard` either, which is where the sibling rules of #318 went. A
+ * repeated `dependsOn`, label or reference carries no information, so dropping the second mention
+ * loses nothing. Two tasks under one id are two whole tasks — titles, dates, descriptions — and a
+ * fold on the READ is written back by the next save of any kind, because every write serialises the
+ * whole document. That is one task gone for good, for every board, without anybody having asked.
+ * The UI folds the same pair for a DRAWING (`orderedTasks`), which costs nothing: the document keeps
+ * both, and repairing the pair brings the second card back.
+ *
+ * ⚠️ What this does NOT rescue, and it is worth knowing: `replaced` matches a task by id, so the
+ * first `board_task_update` against such a pair writes the SAME task into both entries. The stored
+ * board is then two identical tasks rather than two different ones. That is a consequence of
+ * addressing a board by task id at all (#285) and predates this rule; the reason the rule is at the
+ * import is to stop the pair from existing, not to make it survivable.
+ *
+ * So it is asked exactly where there is a caller to answer: the bundle import, the one door a board
+ * document written elsewhere comes in through. Everything else mints task ids itself (`deps.id()`)
+ * and takes its status list through `ConfigureBoardInput`, which has demanded distinct ids since
+ * #285.
+ */
+export declare function repeatedBoardId(document: BoardDocument): {
+    list: "statuses" | "tasks";
+    id: string;
+} | null;
 /**
  * Every board operation, applied to the document rather than to the file (#285).
  *

package/dist/nodes/board/board.js

@@ -1,6 +1,170 @@
 import { ArchivedBoardStatusId, BoardDefaultStatuses, BoardMaxTaskDepth, } from "@anchrd/intel-contract";
 import { generateKeyBetween } from "fractional-indexing";
 import { IntelError } from "../../shared/intel-error/intel-error.js";
+/**
+ * Statuses that answer whether standing in them means finished (anchrd/intel#311).
+ *
+ * ⚠️ This is the ONE place the old positional rule survives, and it survives as a data migration
+ * rather than as a reading. A board written before `terminal` existed has no answer to "which
+ * columns mean finished", and the honest answer is the one that board already behaved as: the last
+ * column before `archived`, plus the shelf. Filling `false` everywhere instead would quietly declare
+ * that nothing on any existing board is done — every finished task would become an open blocker
+ * overnight. Filling `true` everywhere would be the same lie the other way round.
+ *
+ * ⚠️ It touches only what is missing. A status that already carries the flag keeps it, whatever the
+ * position rule would have said — otherwise the migration would undo somebody's configuration every
+ * time their board was read.
+ *
+ * `undefined` means "nothing to do", which is what keeps an untouched document identical rather
+ * than merely equal.
+ */
+function upgradedStatuses(statuses) {
+    if (!Array.isArray(statuses))
+        return undefined;
+    const entries = statuses.filter((status) => typeof status === "object" && status !== null);
+    if (entries.every((status) => "terminal" in status))
+        return undefined;
+    // The end of the work as the board behaved before the flag: the last column that is not the shelf,
+    // read in the stored order rather than in array order, because `order` is what a surface draws by.
+    const working = entries
+        .filter((status) => status.id !== ArchivedBoardStatusId)
+        .sort((left, right) => Number(left.order ?? 0) - Number(right.order ?? 0));
+    const lastWorking = working.at(-1)?.id;
+    return statuses.map((status) => {
+        if (typeof status !== "object" || status === null || "terminal" in status)
+            return status;
+        const entry = status;
+        return {
+            ...entry,
+            terminal: entry.id === ArchivedBoardStatusId || entry.id === lastWorking,
+        };
+    });
+}
+/**
+ * The three task lists that have to be distinct, and how a stored entry is recognised again.
+ *
+ * ⚠️ `labels` are compared TRIMMED and the two id lists are not, and that mirrors the schema
+ * exactly: `BoardTaskLabel` carries `.trim()`, `BoardTaskId` and `IntelId` do not. Comparing raw
+ * here would leave `["Bug ", "Bug"]` untouched — and zod, which trims each entry BEFORE the
+ * distinctness check runs on the array, would then see one word twice and refuse the board. That is
+ * precisely the `board_unreadable` this function exists to prevent, arrived at through the fold.
+ */
+const distinctTaskLists = [
+    { field: "dependsOn", identity: (value) => value },
+    {
+        field: "labels",
+        identity: (value) => (typeof value === "string" ? value.trim() : value),
+    },
+    { field: "references", identity: (value) => value },
+];
+/**
+ * Tasks whose lists name nothing twice (anchrd/intel#318).
+ *
+ * ⚠️ `dependsOn`, `labels` and `references` are refused at the write boundary now, and that refusal
+ * reaches nothing already in R2 — boards have been writable since `c29fd12` and `board_task_update`
+ * took a repeat without complaint. A stored board carrying one would meet the strict `BoardTask` and
+ * answer `board_unreadable`: the whole board lost over a value that has no reading, which is the
+ * trap #311 walked into from the other side.
+ *
+ * ⚠️ Folded here and refused there, and the difference is not inconsistency — it is who is being
+ * answered. A caller handed back a shorter list than it sent learns nothing and repeats itself; a
+ * stored document has no caller to tell, and dropping the board instead would punish a reader for
+ * what some writer did months ago.
+ *
+ * ⚠️ The FIRST mention keeps its place. Every surface draws these lists in the order they stand in.
+ */
+function dedupedTaskLists(tasks) {
+    if (!Array.isArray(tasks))
+        return undefined;
+    let folded = false;
+    const next = tasks.map((task) => {
+        if (typeof task !== "object" || task === null)
+            return task;
+        const entry = task;
+        const lists = distinctTaskLists.flatMap(({ field, identity }) => {
+            const list = entry[field];
+            if (!Array.isArray(list))
+                return [];
+            const seen = new Set();
+            const distinct = list.filter((value) => {
+                const key = identity(value);
+                if (seen.has(key))
+                    return false;
+                seen.add(key);
+                return true;
+            });
+            return distinct.length === list.length ? [] : [[field, distinct]];
+        });
+        if (lists.length === 0)
+            return task;
+        folded = true;
+        return { ...entry, ...Object.fromEntries(lists) };
+    });
+    return folded ? next : undefined;
+}
+/**
+ * A stored board brought up to the current schema, before it is validated.
+ *
+ * ⚠️ It runs before `BoardDocument.parse`, on `unknown`, because after that parse a missing field or
+ * a repeated id is already a refusal — and `parseStoredBoard` is deliberately loud
+ * (`board_unreadable`), so an un-upgraded board would not read as "old", it would read as corrupt.
+ *
+ * The upgrade is persisted by the next write of any kind, because every write serialises the whole
+ * document. Nothing has to be migrated ahead of time and nothing has to be re-migrated.
+ */
+export function upgradeStoredBoard(parsed) {
+    if (typeof parsed !== "object" || parsed === null)
+        return parsed;
+    const document = parsed;
+    const statuses = upgradedStatuses(document.statuses);
+    const tasks = dedupedTaskLists(document.tasks);
+    if (statuses === undefined && tasks === undefined)
+        return parsed;
+    return {
+        ...document,
+        ...(statuses !== undefined && { statuses }),
+        ...(tasks !== undefined && { tasks }),
+    };
+}
+/**
+ * The first id a board document uses for two different things (anchrd/intel#321).
+ *
+ * ⚠️ Deliberately NOT a rule on `BoardDocument`, and that is the whole decision. A schema rule would
+ * reach every parse of a stored body — `parseStoredBoard`, `indexing.ts`, the link reader — and a
+ * board imported before this existed would stop answering with `board_unreadable`: the whole board
+ * gone over something that costs one view. It is the trap #311 walked into, and #318 walked into
+ * from the other side.
+ *
+ * ⚠️ And NOT folded in `upgradeStoredBoard` either, which is where the sibling rules of #318 went. A
+ * repeated `dependsOn`, label or reference carries no information, so dropping the second mention
+ * loses nothing. Two tasks under one id are two whole tasks — titles, dates, descriptions — and a
+ * fold on the READ is written back by the next save of any kind, because every write serialises the
+ * whole document. That is one task gone for good, for every board, without anybody having asked.
+ * The UI folds the same pair for a DRAWING (`orderedTasks`), which costs nothing: the document keeps
+ * both, and repairing the pair brings the second card back.
+ *
+ * ⚠️ What this does NOT rescue, and it is worth knowing: `replaced` matches a task by id, so the
+ * first `board_task_update` against such a pair writes the SAME task into both entries. The stored
+ * board is then two identical tasks rather than two different ones. That is a consequence of
+ * addressing a board by task id at all (#285) and predates this rule; the reason the rule is at the
+ * import is to stop the pair from existing, not to make it survivable.
+ *
+ * So it is asked exactly where there is a caller to answer: the bundle import, the one door a board
+ * document written elsewhere comes in through. Everything else mints task ids itself (`deps.id()`)
+ * and takes its status list through `ConfigureBoardInput`, which has demanded distinct ids since
+ * #285.
+ */
+export function repeatedBoardId(document) {
+    for (const list of ["statuses", "tasks"]) {
+        const seen = new Set();
+        for (const entry of document[list]) {
+            if (seen.has(entry.id))
+                return { list, id: entry.id };
+            seen.add(entry.id);
+        }
+    }
+    return null;
+}
 /**
  * Every board operation, applied to the document rather than to the file (#285).
  *
@@ -260,6 +424,11 @@ export function createBoard(deps) {
                 id: status.id,
                 label: status.label,
                 order: index,
+                // ⚠️ The shelf is always terminal and the boundary refuses an explicit `false` for it, so
+                // this is not a silent correction of something a caller asked for — it is the same fact
+                // stated where the document is built. Everything else defaults to "not finished": a new
+                // column is work, and a column that ends work is a thing somebody says on purpose (#311).
+                terminal: status.id === ArchivedBoardStatusId ? true : (status.terminal ?? false),
             }));
             return { statuses: next, tasks: board.tasks };
         },

package/dist/nodes/document-links/document-links.js

@@ -1,4 +1,5 @@
 import { BlockNoteDocument, BlockNoteMediaType, BoardDocument, BoardMediaType, DocumentLinkInlineType, } from "@anchrd/intel-contract";
+import { upgradeStoredBoard } from "../board/board.js";
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
@@ -52,7 +53,17 @@ export function documentLinkTargets(mediaType, content) {
     }
     const found = new Set();
     if (mediaType === BoardMediaType) {
-        const board = BoardDocument.safeParse(parsed);
+        /**
+         * ⚠️ Upgraded first, like `parseStoredBoard` and `indexing.ts` — this is the FOURTH place a
+         * board body is parsed, and the only one that cannot complain (anchrd/intel#321).
+         *
+         * A board it fails to parse simply has no links, which reads exactly like a board that points
+         * at nothing — and the reconciliation this feeds removes the links a body no longer names, so
+         * an unparsed old board would quietly leave the link graph. Every caller hands it a body written
+         * moments earlier today, so it has never met one; the upgrade is what keeps that from being the
+         * only reason.
+         */
+        const board = BoardDocument.safeParse(upgradeStoredBoard(parsed));
         if (!board.success)
             return [];
         for (const task of board.data.tasks) {

package/dist/nodes/nodes.js

@@ -2,7 +2,7 @@ import { AgentDefinition, AgentMediaType, agentReferenceAccepts, BoardDocument,
 import { encodeCsv, parseCsv } from "../shared/csv/csv.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { plainTitle } from "../shared/plain-title/plain-title.js";
-import { createBoard } from "./board/board.js";
+import { createBoard, upgradeStoredBoard } from "./board/board.js";
 import { documentLinkTargets } from "./document-links/document-links.js";
 // ⚠️ The R2 key of a version written before #125 begins `knowledge/`, and it stays that way. A key
 // is stored in `node_versions.content_key` and read back from there; nothing derives one from ids,
@@ -470,7 +470,11 @@ export function createNodes(deps) {
         catch {
             throw new IntelError(500, "board_unreadable", "The stored board cannot be read");
         }
-        const document = BoardDocument.safeParse(parsed);
+        // ⚠️ Upgraded BEFORE validation, not after. `terminal` is required now (anchrd/intel#311), and
+        // this parse is deliberately loud — so a board written before the flag existed would answer
+        // `board_unreadable` rather than "old", and every board in every installation would break on
+        // deploy. `upgradeStoredBoard` fills only what is missing; the next write persists it.
+        const document = BoardDocument.safeParse(upgradeStoredBoard(parsed));
         // ⚠️ Loud, unlike the tolerant read the share warning makes of an agent definition. A board IS
         // its document: answering with an empty one would show somebody a board with no tasks on it,
         // and the next write would store that as the truth.

package/dist/tools/tools.js

@@ -260,7 +260,13 @@ export function createTools(deps) {
             if (!stored)
                 return { portalConnected: false, items: [] };
             try {
-                return { portalConnected: true, items: (await capabilities(who)).items };
+                const { items, serverOfTool } = await capabilities(who);
+                // ⚠️ Named only for a delegated caller, and it costs nothing there: the attribution had to
+                // be made anyway to cut the list. For an ordinary user it would mean a second portal
+                // request per call — `serverList` is not on their path — and their screen never asks the
+                // question. The runtime's is the one that does (#289).
+                const reached = who.delegation ? [...new Set(serverOfTool.values())].sort() : undefined;
+                return { portalConnected: true, items, ...(reached ? { reached } : {}) };
             }
             catch (error) {
                 if (disconnected(error))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.12.4",
+  "version": "0.13.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.7.0",
-    "@anchrd/intel-contract": "^0.10.0",
+    "@anchrd/intel-contract": "^0.11.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",