@anchrd/intel-api 0.24.0 → 0.26.0

package/dist/mcp/mcp.js

@@ -1,8 +1,8 @@
 import { IdempotencyKey, IntelId } from "@anchrd/intel-contract";
 import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, PurgeFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
 import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
-import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
-import { ListFlowGrantsInput, ListGrantsInput, RevokeFlowGrantInput, RevokeGrantInput, ShareFlowInput, ShareInput, } from "@anchrd/intel-contract/share";
+import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, PurgeNodePreviewInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
+import { ListEffectiveAccessInput, ListFlowEffectiveAccessInput, ListFlowGrantsInput, ListGrantsInput, RevokeFlowGrantInput, RevokeGrantInput, ShareFlowInput, ShareInput, } from "@anchrd/intel-contract/share";
 import { AppendTableRowsInput, DefineTableInput, DeleteTableRowsInput, GetTableInput, RedefineTableInput, UpdateTableRowsInput, } from "@anchrd/intel-contract/table";
 import { ExecuteToolInput, TestToolInput } from "@anchrd/intel-contract/tool";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -13,6 +13,44 @@ import { IntelError } from "../shared/intel-error/intel-error.js";
 function text(value) {
     return { content: [{ type: "text", text: JSON.stringify(value) }], isError: false };
 }
+/**
+ * ⚠️ The one thing a tool error loses on its way out, and the whole reason this `catch` exists
+ * (#597).
+ *
+ * A thrown `IntelError` is turned into a tool error by the SDK's `createToolError`, which keeps
+ * `error instanceof Error ? error.message : String(error)` and nothing else — so `callers`, the
+ * structured half of a refusal that NAMES flows (#448, #593), never reaches a model over MCP.
+ *
+ * It arrives here as a SECOND content block. The first one is the sentence, byte for byte what the
+ * SDK would have sent, so a reader that only takes text loses nothing: the machine-readable half
+ * stands beside the prose rather than instead of it.
+ *
+ * ⚠️ It wraps the handlers whose service can refuse WITH data — `node_grant_revoke` and
+ * `flow_purge` today — and deliberately NOT all sixty. For every other refusal there is nothing to
+ * carry, and turning each of their errors into JSON would change every tool for the sake of two.
+ * What keeps that from becoming a place to forget is where the rule is written down: at the field
+ * itself (`IntelError.callers`), in `packages/api/CLAUDE.md`, and as two tests in `mcp.e2e.ts` —
+ * whoever attaches `callers` to a new refusal wraps its handler here.
+ */
+async function refusing(run) {
+    try {
+        return text(await run());
+    }
+    catch (error) {
+        if (!(error instanceof IntelError) || !error.callers)
+            throw error;
+        return {
+            content: [
+                { type: "text", text: error.message },
+                {
+                    type: "text",
+                    text: JSON.stringify({ code: error.code, callers: error.callers }),
+                },
+            ],
+            isError: true,
+        };
+    }
+}
 /**
  * ⚠️ One name per tool, and the second one is gone for good (#149).
  *
@@ -464,6 +502,34 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.archive(actor, input)));
+        /**
+         * ⚠️ The look before the irreversible step, and it is on this surface because the step itself
+         * is (#586). `node_purge` has stood here since #457 for the reason #436 states — a way only the
+         * interface has is a way an agent goes around — but until now the COUNT did not, so an agent
+         * could delete for good without being able to see first what went with it. A person in the
+         * interface is shown both numbers and then confirms.
+         *
+         * That is exactly the state `.claude/rules/destructive.md` refuses in its own words: a cascade
+         * turns one confirmed click into an unknown number of deletions, and "the question can no
+         * longer name what disappears". Here the question could not be ASKED, which is the same gap one
+         * step earlier — and the half that was missing was the safe half.
+         *
+         * ⚠️ It answers about a tree, not about one row: `totalItems` counts the nodes AND the flows
+         * beneath it, the same two tables the purge itself walks. `inboundLinks` is the other kind of
+         * consequence — mentions elsewhere that will break and are deliberately not refused.
+         */
+        server.registerTool("node_purge_preview", {
+            title: "Preview a permanent deletion",
+            description: "Count what deleting one ARCHIVED node for good would take with it: every item in its subtree, documents and flows alike, and how many documents elsewhere link to it. It changes nothing. Ask before node_purge — afterwards there is no row left to count, and the links that break are not refused, only reported.",
+            inputSchema: PurgeNodePreviewInput,
+            annotations: {
+                title: "Preview a permanent deletion",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.nodes.purgePreview(actor, input)));
         // ⚠️ It exists on this surface for the reason #436 states: a way only the interface has is a way
         // an agent goes around, by looking for the row in the database. What it may do is bounded by the
         // same rules the interface obeys — only an archived node, only an empty folder, never one a flow
@@ -498,6 +564,35 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.listGrants(actor, input.resourceId)));
+        /**
+         * ⚠️ The neighbour above answers a NARROWER question, and that is why this one has to be here
+         * (#586). `node_grant_list` reads the rows on this node; this resolves the inheritance — every
+         * grant along the folders above plus the owners, who reach it without a grant row existing at
+         * all. On the everyday node, whose access comes from the folder it sits in, the first answer is
+         * empty and this one is not.
+         *
+         * Two queries with similar names are two different questions, and `.claude/rules/destructive.md`
+         * records what it costs to confuse them: in #457 a refusal asked the one that sounded right and
+         * never fired. Here the cost is the same shape and lands on the sharing path — an agent asked
+         * "who can see this" reaches for the only name it has, is answered `[]`, and reports that
+         * nobody can, about a document the whole organization opens. Silence would not be a missing
+         * answer here, it would be a confident wrong one.
+         *
+         * ⚠️ The list is for reading, never for revoking: only the entries whose `resourceId` is this
+         * node can be revoked here, the rest belong to the folder that granted them.
+         */
+        server.registerTool("node_effective_access_list", {
+            title: "List effective node access",
+            description: "List everybody who reaches one node once inheritance is resolved: the grants on it AND on every folder above it, plus the owners, who need no grant. node_grant_list answers the narrower question — the rows sitting on this node alone — and on a node that inherits its access that answer is empty while this one is not. An entry whose resourceId is another node was granted there and can only be revoked there.",
+            inputSchema: ListEffectiveAccessInput,
+            annotations: {
+                title: "List effective node access",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.nodes.listEffectiveAccess(actor, input.resourceId)));
         server.registerTool("node_grant_create", {
             title: "Grant node access",
             description: "Grant inherited node access to a Gate user, verified email, or the organization.",
@@ -521,7 +616,7 @@ export async function handleMcp(request, deps) {
                 idempotentHint: true,
                 openWorldHint: false,
             },
-        }, async (input) => text(await deps.nodes.revokeGrant(actor, input)));
+        }, async (input) => await refusing(() => deps.nodes.revokeGrant(actor, input)));
     }
     if (permits(deps.authorization, "flows", "read")) {
         server.registerTool("flow_list", {
@@ -681,6 +776,24 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.flows.listGrants(flowActor, input.flowId)));
+        // ⚠️ The flow half of the node tool three groups up, and it is a SECOND tool rather than a
+        // widened one because it is a second question (#586): the answer is assembled from `flow_grants`
+        // and from the node grants of the folders above, and the owners come from the flow itself as
+        // well as from those folders. One tool over a `resourceId` that means either would have to guess
+        // which table to ask, and a caller passing the wrong kind would be answered "nobody" instead of
+        // being told.
+        server.registerTool("flow_effective_access_list", {
+            title: "List effective flow access",
+            description: "List everybody who reaches one flow once inheritance is resolved: the grants on the flow AND on the folders it is filed under, plus the owners, who need no grant. flow_grant_list answers the narrower question — the rows sitting on the flow itself — and for a flow whose access comes from its folder that answer is empty while this one is not. An entry whose resourceId is a folder was granted there and can only be revoked there.",
+            inputSchema: ListFlowEffectiveAccessInput,
+            annotations: {
+                title: "List effective flow access",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.listEffectiveAccess(flowActor, input.flowId)));
         server.registerTool("flow_grant_create", {
             title: "Grant flow access",
             description: "Grant access to one flow for a Gate user, verified email, or the organization. The grant reaches this flow alone — not the folder it is filed in, and not the flows it calls; the answer names what it does not cover.",
@@ -761,7 +874,7 @@ export async function handleMcp(request, deps) {
                 idempotentHint: false,
                 openWorldHint: false,
             },
-        }, async (input) => text(await deps.flows.purge(flowActor, input)));
+        }, async (input) => await refusing(() => deps.flows.purge(flowActor, input)));
         server.registerTool("flow_version_create", {
             title: "Create flow version",
             description: "Append a validated immutable flow graph version with optimistic concurrency.",

package/dist/nodes/nodes.js

@@ -1,5 +1,7 @@
 import { TableMediaType } from "@anchrd/intel-contract/table";
+import { callersPhrase, namedOrCounted } from "../shared/callers/callers.js";
 import { encodeCsv, parseCsv } from "../shared/csv/csv.js";
+import { requireFutureExpiry } from "../shared/grant-expiry/grant-expiry.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { plainTitle } from "../shared/plain-title/plain-title.js";
 import { documentLinkTargets } from "./document-links/document-links.js";
@@ -27,13 +29,15 @@ function applicableVerbs(kind) {
 }
 // ⚠️ The refusal has to be actionable without becoming a directory of the tree. Whoever holds
 // `share` on one folder must not learn the titles of flows they may not see, so the ones they may
-// see are named and the rest are only counted (ADR-0004 §3, and #17's review).
+// see are named and the rest are only counted (ADR-0004 §3, and #17's review) — which is the whole
+// of what `callersPhrase` does, in the one place both refusals read it from.
+//
+// The sentence stays for whoever has nothing to formulate with — a model over MCP reads it as it
+// stands — and `namedOrCounted` carries the same decision as data, so a screen can say it in its
+// own language (#448). Both come out of one place: the split between named and counted is an
+// authorization answer, and a surface that recomputed it would be deciding what it may not.
 function callersDetail(callers) {
-    const named = callers.visible.map((title) => `“${title}”`).join(", ");
-    const rest = callers.hidden === 0
-        ? ""
-        : `${named ? " and " : ""}${callers.hidden} more flow${callers.hidden === 1 ? "" : "s"} you cannot see`;
-    return `Flows outside this folder call into it: ${named}${rest}. Change or unpublish them before narrowing the folder.`;
+    return `Flows outside this folder call into it: ${callersPhrase(callers)}. Change or unpublish them before narrowing the folder.`;
 }
 // The grantee as the ACL sees them, and as nothing else: an identity with no capability of its own,
 // never `isAdmin`. It answers for Intel's resource ACLs only — whether Gate hands this person
@@ -1025,6 +1029,20 @@ export function createNodes(deps) {
                     };
                 }
             }
+            /**
+             * ⚠️ Behind the replay and in front of `setGrant` — both halves matter (#442).
+             *
+             * In front of `setGrant` is the rule itself: nothing that could never work gets written, so
+             * no row, no idempotency key and no audit event. Every path that reaches the write passes
+             * here, including a replay whose grant was revoked in between and falls through.
+             *
+             * Behind the replay because otherwise this refusal would break the promise `IdempotencyKey`
+             * makes. A caller retries with the SAME key and the SAME body; if the retry arrives after the
+             * expiry the first attempt named, the value is no longer in the future — and the second call
+             * would be refused for a grant that is already written. The replay path writes nothing, so
+             * standing behind it costs the rule nothing and keeps the retry answering with what happened.
+             */
+            requireFutureExpiry(input.expiresAt, deps.now());
             const timestamp = deps.now().toISOString();
             const grant = await deps.repository.setGrant({
                 grant: {
@@ -1070,7 +1088,7 @@ export function createNodes(deps) {
                 !(await deps.repository.organizationExecuteReaches(input.resourceId, input.grantId))) {
                 const callers = await deps.externalFlowCallers(actor, input.resourceId);
                 if (callers.visible.length || callers.hidden) {
-                    throw new IntelError(409, "folder_execute_in_use", callersDetail(callers));
+                    throw new IntelError(409, "folder_execute_in_use", callersDetail(callers), namedOrCounted(callers));
                 }
             }
             return {

package/dist/shared/callers/callers.d.ts

@@ -0,0 +1,28 @@
+import type { NamedOrCounted } from "@anchrd/intel-contract";
+type Callers = {
+    visible: string[];
+    hidden: number;
+};
+/**
+ * ⚠️ Named where the reader may see it, counted where they may not (ADR-0004 §3). A refusal has to
+ * be actionable without becoming a way of reading the tree: whoever holds one grant on one folder
+ * must not learn the titles of flows they are refused directly.
+ *
+ * This is the middle of both refusals that ask the question — narrowing a folder (`nodes.ts`) and
+ * deleting a flow for good (`flows.ts`). ⚠️ **The two SENTENCES around it stay two**, because they
+ * say different things to different people: one is about a folder that is about to lose a grant,
+ * the other about a flow that is about to be gone. Folding them into one parameterised sentence
+ * would buy a shared string and cost the reason each one gives.
+ */
+export declare function callersPhrase(callers: Callers): string;
+/**
+ * The same two facts the sentence is built from, in the shape a grant's own warning already uses
+ * (`UnreadableNodes`, #448). One question — what may you see, and of how much — deserves one answer
+ * shape on every surface, and a screen that has to write the sentence itself needs the facts and
+ * not the sentence.
+ *
+ * ⚠️ It reads the SAME argument the phrase above reads. A surface that recomputed the split would
+ * be deciding what it may not, and a second decision here would be the one that drifts.
+ */
+export declare function namedOrCounted(callers: Callers): NamedOrCounted;
+export {};

package/dist/shared/callers/callers.js

@@ -0,0 +1,30 @@
+/**
+ * ⚠️ Named where the reader may see it, counted where they may not (ADR-0004 §3). A refusal has to
+ * be actionable without becoming a way of reading the tree: whoever holds one grant on one folder
+ * must not learn the titles of flows they are refused directly.
+ *
+ * This is the middle of both refusals that ask the question — narrowing a folder (`nodes.ts`) and
+ * deleting a flow for good (`flows.ts`). ⚠️ **The two SENTENCES around it stay two**, because they
+ * say different things to different people: one is about a folder that is about to lose a grant,
+ * the other about a flow that is about to be gone. Folding them into one parameterised sentence
+ * would buy a shared string and cost the reason each one gives.
+ */
+export function callersPhrase(callers) {
+    const named = callers.visible.map((title) => `“${title}”`).join(", ");
+    const rest = callers.hidden === 0
+        ? ""
+        : `${named ? " and " : ""}${callers.hidden} more flow${callers.hidden === 1 ? "" : "s"} you cannot see`;
+    return `${named}${rest}`;
+}
+/**
+ * The same two facts the sentence is built from, in the shape a grant's own warning already uses
+ * (`UnreadableNodes`, #448). One question — what may you see, and of how much — deserves one answer
+ * shape on every surface, and a screen that has to write the sentence itself needs the facts and
+ * not the sentence.
+ *
+ * ⚠️ It reads the SAME argument the phrase above reads. A surface that recomputed the split would
+ * be deciding what it may not, and a second decision here would be the one that drifts.
+ */
+export function namedOrCounted(callers) {
+    return { titles: callers.visible, hidden: callers.hidden };
+}

package/dist/shared/grant-expiry/grant-expiry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * ⚠️ A grant whose expiry has already passed is refused, never written (#442).
+ *
+ * It would otherwise be created, answered with a `201`, and listed — while reaching nobody. The
+ * sharer reads the row as done; the grantee gets no notification and finds out days later, if at
+ * all. That is the failure mode this repository keeps meeting: something that looks like success,
+ * and the only feedback is the wrong one.
+ *
+ * ⚠️ The check cannot live in the Zod schema. That boundary knows nothing about `deps.now()`, and
+ * the rule is decided by the very clock that evaluates the grant afterwards — so it belongs in the
+ * application layer, where every surface passes through it. The `.describe()` on `expiresAt`
+ * documents the rule; this refuses it.
+ *
+ * ⚠️ Equal to `now` is refused too: a grant that expires this instant is spent before the answer
+ * reaches the caller.
+ *
+ * `null` is untouched and stays what it always meant — a grant that does not expire on its own.
+ */
+export declare function requireFutureExpiry(expiresAt: string | null, now: Date): void;

package/dist/shared/grant-expiry/grant-expiry.js

@@ -0,0 +1,26 @@
+import { IntelError } from "../intel-error/intel-error.js";
+/**
+ * ⚠️ A grant whose expiry has already passed is refused, never written (#442).
+ *
+ * It would otherwise be created, answered with a `201`, and listed — while reaching nobody. The
+ * sharer reads the row as done; the grantee gets no notification and finds out days later, if at
+ * all. That is the failure mode this repository keeps meeting: something that looks like success,
+ * and the only feedback is the wrong one.
+ *
+ * ⚠️ The check cannot live in the Zod schema. That boundary knows nothing about `deps.now()`, and
+ * the rule is decided by the very clock that evaluates the grant afterwards — so it belongs in the
+ * application layer, where every surface passes through it. The `.describe()` on `expiresAt`
+ * documents the rule; this refuses it.
+ *
+ * ⚠️ Equal to `now` is refused too: a grant that expires this instant is spent before the answer
+ * reaches the caller.
+ *
+ * `null` is untouched and stays what it always meant — a grant that does not expire on its own.
+ */
+export function requireFutureExpiry(expiresAt, now) {
+    if (expiresAt === null)
+        return;
+    if (Date.parse(expiresAt) > now.getTime())
+        return;
+    throw new IntelError(400, "grant_already_expired", "A grant's expiry has to lie in the future; pass null for one that does not expire on its own");
+}

package/dist/shared/intel-error/intel-error.d.ts

@@ -1,5 +1,22 @@
+import type { NamedOrCounted } from "@anchrd/intel-contract";
 export declare class IntelError extends Error {
     readonly status: number;
     readonly code: string;
-    constructor(status: number, code: string, message: string);
+    readonly callers?: NamedOrCounted | undefined;
+    /**
+     * ⚠️ `callers` is what a refusal that NAMES flows carries beside its sentence — today
+     * `folder_execute_in_use` (#448) and `flow_in_use_by_flow` (#593). It rides on the error rather
+     * than on the route because the split it belongs to is an application-layer one: who may be named
+     * and who may only be counted is an authorization answer, and it must be the same over HTTP, over
+     * MCP and in the browser. A route that assembled it would be a second place for that rule to live.
+     *
+     * `message` still carries the finished English sentence — a reader that only takes text must lose
+     * nothing — and the field is what lets a screen say it in its own language instead.
+     *
+     * ⚠️ **Setting this field is only half of reaching MCP.** The SDK formats a thrown error through
+     * `createToolError`, which keeps `message` and drops everything else, so a tool whose handler is
+     * not wrapped in `refusing()` (`mcp/mcp.ts`) answers prose and nothing more (#597). Whoever
+     * attaches `callers` to a new refusal wraps that tool's handler in the same change.
+     */
+    constructor(status: number, code: string, message: string, callers?: NamedOrCounted | undefined);
 }

package/dist/shared/intel-error/intel-error.js

@@ -1,10 +1,27 @@
 export class IntelError extends Error {
     status;
     code;
-    constructor(status, code, message) {
+    callers;
+    /**
+     * ⚠️ `callers` is what a refusal that NAMES flows carries beside its sentence — today
+     * `folder_execute_in_use` (#448) and `flow_in_use_by_flow` (#593). It rides on the error rather
+     * than on the route because the split it belongs to is an application-layer one: who may be named
+     * and who may only be counted is an authorization answer, and it must be the same over HTTP, over
+     * MCP and in the browser. A route that assembled it would be a second place for that rule to live.
+     *
+     * `message` still carries the finished English sentence — a reader that only takes text must lose
+     * nothing — and the field is what lets a screen say it in its own language instead.
+     *
+     * ⚠️ **Setting this field is only half of reaching MCP.** The SDK formats a thrown error through
+     * `createToolError`, which keeps `message` and drops everything else, so a tool whose handler is
+     * not wrapped in `refusing()` (`mcp/mcp.ts`) answers prose and nothing more (#597). Whoever
+     * attaches `callers` to a new refusal wraps that tool's handler in the same change.
+     */
+    constructor(status, code, message, callers) {
         super(message);
         this.status = status;
         this.code = code;
+        this.callers = callers;
         this.name = "IntelError";
     }
 }

package/dist/shared/problem-details/problem-details.d.ts

@@ -1,3 +1,4 @@
+import type { IntelError } from "../intel-error/intel-error.js";
 export declare function problemDetails(status: number, code: string, title: string, detail?: string): {
     type: string;
     status: number;
@@ -5,4 +6,25 @@ export declare function problemDetails(status: number, code: string, title: stri
     detail?: string | undefined;
     instance?: string | undefined;
     code?: string | undefined;
+    callers?: {
+        titles: string[];
+        hidden: number;
+    } | undefined;
+};
+/**
+ * One refusal, one document — written here rather than at each `onError`, because two apps turn an
+ * `IntelError` into a body and an extension member added at one of them would silently be missing
+ * from the other (#448). Whatever the application layer decided to say travels with it.
+ */
+export declare function intelProblem(error: IntelError): {
+    type: string;
+    status: number;
+    title: string;
+    detail?: string | undefined;
+    instance?: string | undefined;
+    code?: string | undefined;
+    callers?: {
+        titles: string[];
+        hidden: number;
+    } | undefined;
 };

package/dist/shared/problem-details/problem-details.js

@@ -2,3 +2,17 @@ import { ProblemDetails } from "@anchrd/intel-contract";
 export function problemDetails(status, code, title, detail) {
     return ProblemDetails.parse({ type: "about:blank", status, code, title, detail });
 }
+/**
+ * One refusal, one document — written here rather than at each `onError`, because two apps turn an
+ * `IntelError` into a body and an extension member added at one of them would silently be missing
+ * from the other (#448). Whatever the application layer decided to say travels with it.
+ */
+export function intelProblem(error) {
+    return ProblemDetails.parse({
+        type: "about:blank",
+        status: error.status,
+        code: error.code,
+        title: error.message,
+        callers: error.callers,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -42,8 +42,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@anchrd/gate-sdk": "^0.15.0",
-    "@anchrd/intel-contract": "^0.20.0",
+    "@anchrd/gate-sdk": "^0.20.0",
+    "@anchrd/intel-contract": "^0.22.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",