@anchrd/intel-api 0.27.0 → 0.29.0

package/dist/boards/boards.js

@@ -0,0 +1,288 @@
+import { ARCHIVE_COLUMN_ID } from "@anchrd/intel-contract/board";
+import { IntelError } from "../shared/intel-error/intel-error.js";
+/**
+ * What a board with no configuration answers with. A board is usable the moment it is created, and
+ * nothing asks whoever made it to define columns before filing the first card.
+ *
+ * ⚠️ **This is the FALLBACK, not what a board made through the application gets.** Columns are
+ * shared data: two people on one board must read the same names, and the settings dialog edits one
+ * list. So the application writes them at creation, in the language of whoever created it (#675),
+ * and from then on they are data anybody can rename. This list only answers for a board nobody
+ * configured — one made over MCP, or one whose seeding did not land.
+ */
+export const DEFAULT_COLUMNS = [
+    { id: "backlog", title: "Backlog", terminal: false },
+    { id: "todo", title: "Offen", terminal: false },
+    { id: "doing", title: "Läuft", terminal: false },
+    { id: "done", title: "Fertig", terminal: true },
+];
+// The column a card lands in when nobody said and the board has none configured. One export rather
+// than the literal `"todo"` in three places: the fallback exists FOR the unconfigured board, so a
+// copy of it would drift exactly where it is the only thing deciding.
+export const FIRST_DEFAULT_COLUMN = DEFAULT_COLUMNS[0].id;
+export function createBoards(deps) {
+    /**
+     * ⚠️ The one place "which board, and may this actor DO THIS to it" is answered — and the verb is
+     * the whole question. It asked `read` for every caller once, including the three that were about
+     * to write: a board shared read-only could have its columns replaced and its cards moved. The
+     * refusal existed and asked the wrong thing, which is the harder failure to see.
+     *
+     * A `404` rather than a `403`, on purpose: "this board exists but you may not touch it" is itself
+     * information about somebody else's tree.
+     */
+    const columnsOrRefuse = async (actor, boardId, verb) => {
+        const columns = await deps.boards.columnsOf(actor, boardId, verb);
+        if (columns === null) {
+            throw new IntelError(404, "board_not_found", "No board with this id is readable for you.");
+        }
+        return columns.length > 0 ? columns : DEFAULT_COLUMNS.map((column) => column.id);
+    };
+    const viewOrRefuse = async (actor, input) => {
+        const view = await deps.boards.read(actor, input);
+        if (view === null) {
+            throw new IntelError(404, "board_not_found", "No board with this id is readable for you.");
+        }
+        // A board that was never configured answers with the default columns rather than none. An empty
+        // column list would render as a board with no columns at all — a screen with nowhere to put a
+        // card, which looks broken rather than new.
+        /**
+         * ⚠️ **A stored column may not claim the archive id, and the migration is not the only guard.**
+         * `0024` renames the ones that existed before the id was reserved, and `update` refuses new
+         * ones — but a row written straight into D1, or a migration that did not reach an installation,
+         * would still put two columns with one id in front of a reader. Dropping it here means the
+         * derived one always wins, which is the answer that cannot produce two.
+         */
+        const configured = (view.columns.length > 0 ? view.columns : [...DEFAULT_COLUMNS]).filter((column) => column.id !== ARCHIVE_COLUMN_ID);
+        /**
+         * ⚠️ **The archive column is appended here, after the fallback, and it is never stored.** A
+         * card is in it because `nodes.archived_at` is set; `board_tasks.status` keeps naming the
+         * working column underneath, which is what a card pulled back out returns to (D68).
+         *
+         * Always last, and not part of the list `board_update` writes: the archive is the same place on
+         * every board. A shelf that could be dragged between the working columns would be a shelf
+         * pretending to be a stage.
+         *
+         * ⚠️ **The title here is a fallback, not the label a reader sees.** Configured columns are
+         * shared data and are therefore written once in the creator's language (#675); this one is
+         * derived and identical on every board, so the browser says it in the reader's own words
+         * (`useBoard`). What travels is English, for everything without a catalog — MCP, an export, a
+         * report.
+         */
+        return {
+            ...view,
+            columns: view.archiveVisible
+                ? [...configured, { id: ARCHIVE_COLUMN_ID, title: "Archive", terminal: true }]
+                : configured,
+        };
+    };
+    const requireColumn = (columns, status) => {
+        if (columns.includes(status))
+            return;
+        throw new IntelError(400, "unknown_column", `This board has no column \`${status}\`. Its columns are: ${columns.join(", ")}.`);
+    };
+    return {
+        async get(actor, input) {
+            return await viewOrRefuse(actor, input);
+        },
+        async update(actor, input) {
+            await columnsOrRefuse(actor, input.boardId, "write");
+            // ⚠️ Duplicate ids are refused rather than deduplicated. Two columns with one id means every
+            // card in them lands in whichever the view draws first, and silently dropping one would
+            // discard a column somebody just wrote.
+            const ids = input.columns.map((column) => column.id);
+            const duplicate = ids.find((id, index) => ids.indexOf(id) !== index);
+            if (duplicate !== undefined) {
+                throw new IntelError(400, "duplicate_column", `The column id \`${duplicate}\` appears more than once.`);
+            }
+            /**
+             * ⚠️ **The archive id cannot be claimed by a configured column.** It is derived — a card is in
+             * it because `archived_at` is set — so a stored column of the same id would give a board two
+             * columns with one id: every card in them lands in whichever the view draws first, and one of
+             * the two can never receive a card at all.
+             */
+            /**
+             * ⚠️ **Duplicate NAMES are refused here, not only in the dialog.** An id nobody sees may
+             * repeat without confusing anybody; a name is what a person reads, and two columns called the
+             * same thing cannot be told apart on the board, in the filter, or in the settings. Checked in
+             * the service because an agent calling `board_update` reaches no dialog — root `CLAUDE.md`:
+             * validation does not vary by surface.
+             */
+            const titles = input.columns.map((column) => column.title.trim());
+            const duplicateTitle = titles.find((title, index) => titles.indexOf(title) !== index);
+            if (duplicateTitle !== undefined) {
+                throw new IntelError(400, "duplicate_column_name", `Two columns are called \`${duplicateTitle}\`. A name is what tells them apart.`);
+            }
+            if (ids.includes(ARCHIVE_COLUMN_ID)) {
+                throw new IntelError(400, "reserved_column", `\`${ARCHIVE_COLUMN_ID}\` is the archive column, which every board has. Show or hide it instead of configuring it.`);
+            }
+            await deps.boards.setColumns(input.boardId, JSON.stringify(input.columns), deps.now().toISOString(), input.archiveVisible);
+            return await viewOrRefuse(actor, { boardId: input.boardId, includeArchived: false });
+        },
+        async createTask(actor, input) {
+            const columns = await columnsOrRefuse(actor, input.boardId, "write");
+            // Absent means the first column — a caller who does not care where a task starts should not
+            // have to read the board first. A named one is checked, because a typo would otherwise create
+            // a card in a column no view draws.
+            const status = input.status ?? columns[0] ?? DEFAULT_COLUMNS[0].id;
+            if (input.status !== undefined)
+                requireColumn(columns, status);
+            /**
+             * ⚠️ **The parent's board must BE the board that was asked for**, checked here rather than
+             * left to the node path. `nodes.create` resolves the destination board from the parent, and
+             * on creation there is no previous board to compare it with — so a call naming board B with a
+             * parent on board A files the card on **A**, answers with the view of **B**, and the caller
+             * gets neither an error nor their card. The position would have been counted against B too.
+             */
+            if (input.parentTaskId !== null) {
+                // ⚠️ `"write"` for the same reason `attachToBoard` uses it — filing a card here is a write
+                // to that board. It is defence in depth rather than the only guard: `nodes.create` checks
+                // `write` on the parent node itself and answers 403 first, which is why a behaviour test
+                // cannot tell `"read"` from `"write"` here. Named so the next reader does not go looking
+                // for the test that proves it.
+                const parentRow = await deps.boards.taskRow(actor, input.parentTaskId, "write");
+                /**
+                 * ⚠️ **Only the wrong BOARD is refused here.** `taskRow` answers `null` for three different
+                 * things — the node does not exist, it is not a task, or this actor may not write it — and
+                 * each of those already has a precise answer further in: `404 node_not_found` from
+                 * `requireVisible`, `task_belongs_to_a_board` from `refuseWrongParent`, `403` from the
+                 * write check. Catching them here would answer "that parent card is not on this board" for
+                 * a card that does not exist, which claims it does.
+                 */
+                if (parentRow !== null && parentRow.boardId !== input.boardId) {
+                    throw new IntelError(409, "task_cannot_change_board", "That parent card is not on this board. A subtask belongs to the same board as the card it hangs under.");
+                }
+            }
+            // ⚠️ Through the node service, not a second insert. The task gets the same authorization
+            // check, the same audit row and the same version chain every other node gets — and that audit
+            // row is what `anchrd/signals` reads (#620).
+            const node = await deps.nodes.create(actor, {
+                // ⚠️ A subtask's parent is the TASK, not the board — the hierarchy is the node tree (#669).
+                // The node service resolves which board that lands on and files the row there, so nothing
+                // here has to know: naming the board as parent would flatten every subtask on creation.
+                parentId: input.parentTaskId ?? input.boardId,
+                kind: "task",
+                title: input.title,
+                description: null,
+                idempotencyKey: input.idempotencyKey,
+            });
+            /**
+             * ⚠️ **`update`, not `attach` — the row already exists by the time this line runs**, and
+             * getting that wrong is silent. `nodes.create` files every new task through `attachToBoard`,
+             * with the board's first column and no fields; a second `INSERT` here is refused by the
+             * primary key, `ON CONFLICT DO NOTHING` swallows the refusal, and the caller's `status`,
+             * assignee and dates are **discarded without an error**. The card lands in the wrong column
+             * and nothing anywhere says why.
+             *
+             * It was written as an insert first, and three tests caught it: a card created in `doing`
+             * came back in `todo`. The lesson is the shape rather than the line — one row, one writer,
+             * and the writer is the node path.
+             */
+            /**
+             * ⚠️ **The position is computed only when the card is not already in that column**, and that
+             * is what makes a retry safe. `deps.nodes.create` honours the idempotency key and answers with
+             * the SAME node on a replay; recomputing here would push the card one place further on every
+             * attempt — a client retrying a timeout would watch its card walk down the column, with every
+             * call succeeding.
+             *
+             * The other fields are rewritten with the same values, which is idempotent by construction.
+             */
+            const filed = await deps.boards.taskRow(actor, node.id, "write");
+            await deps.boards.updateTask(node.id, {
+                status,
+                assignee_id: input.assigneeId,
+                labels_json: JSON.stringify(input.labels),
+                start_date: input.startDate,
+                due_date: input.dueDate,
+                depends_on: input.dependsOn,
+                ...(filed?.status === status
+                    ? {}
+                    : { position: await deps.boards.nextPosition(input.boardId, status) }),
+            }, deps.now().toISOString());
+            return await viewOrRefuse(actor, { boardId: input.boardId, includeArchived: false });
+        },
+        async updateTask(actor, input) {
+            const row = await deps.boards.taskRow(actor, input.taskId, "write");
+            if (row === null) {
+                throw new IntelError(404, "task_not_found", "No task with this id is readable for you.");
+            }
+            /**
+             * ⚠️ **Dropping a card on the archive column archives it; pulling it out restores it** (D68).
+             * Neither writes `board_tasks.status`: the working column underneath is what a restored card
+             * returns to, and overwriting it with `archived` would be the second stored truth this
+             * design exists against.
+             *
+             * `nodes.archive` is the same door `node_archive` uses — one path, one audit row, one set of
+             * refusals (a card with live subtasks is still refused, #669).
+             */
+            const intoArchive = input.status === ARCHIVE_COLUMN_ID;
+            const outOfArchive = input.status !== undefined && !intoArchive && row.archivedAt !== null;
+            if (intoArchive || outOfArchive) {
+                await deps.nodes.archive(actor, {
+                    nodeId: input.taskId,
+                    baseUpdatedAt: row.updatedAt,
+                    archived: intoArchive,
+                    idempotencyKey: `${input.idempotencyKey}:archive`,
+                });
+            }
+            if (input.status !== undefined && !intoArchive) {
+                requireColumn(await columnsOrRefuse(actor, row.boardId, "write"), input.status);
+            }
+            // Only what arrived. An absent field means "leave it"; `null` where the column is nullable
+            // means "clear it", which is why the check is against `undefined` and not against falsiness —
+            // `dueDate: null` and `position: 0` both have to get through.
+            const fields = {};
+            if (input.title !== undefined) {
+                // ⚠️ The title lives on the NODE, not here. `board_tasks` has no title column, and adding
+                // one would make two rows disagree about what a card is called.
+                throw new IntelError(400, "title_belongs_to_the_node", "Rename a task with `node_update`; the board row carries no title.");
+            }
+            // ⚠️ Not for a drop into the archive: the working column stays as it is, so the card knows
+            // where to go back to.
+            if (input.status !== undefined && !intoArchive)
+                fields.status = input.status;
+            // ⚠️ Not for a drop into the archive either. The kanban sends a position with EVERY drop,
+            // computed from the neighbours inside the column it was dropped on — and inside the archive
+            // those are cards from all over the board. Taken, it would overwrite the card's place in the
+            // working column with a number that means nothing there. The status is guarded one line up;
+            // without this line the guard only covered half the write.
+            if (input.position !== undefined && !intoArchive)
+                fields.position = input.position;
+            if (input.assigneeId !== undefined)
+                fields.assignee_id = input.assigneeId;
+            if (input.labels !== undefined)
+                fields.labels_json = JSON.stringify(input.labels);
+            if (input.startDate !== undefined)
+                fields.start_date = input.startDate;
+            if (input.dueDate !== undefined)
+                fields.due_date = input.dueDate;
+            if (input.dependsOn !== undefined)
+                fields.depends_on = input.dependsOn;
+            /**
+             * A move that names a new column but no position lands at the end of it — otherwise the card
+             * would keep the number it had in its old column and appear at an arbitrary place.
+             *
+             * ⚠️ **Only when the column actually CHANGES.** Asking again for the column a card is already
+             * in is what a retry looks like, and recomputing there would move the card one place further
+             * on every attempt while every call reported success. That is the idempotency the tool
+             * promises with `idempotentHint: true`, kept by construction rather than by a key lookup.
+             */
+            /**
+             * ⚠️ **Never for a drop into the archive**, and the reason is the same one that keeps
+             * `fields.status` unset there: `board_tasks.status` never holds `archived`, so
+             * `nextPosition(board, "archived")` counts zero rows and answers `1` — every time. The card
+             * keeps its working column but silently loses its place IN it, landing first among cards it
+             * used to sit behind. Nothing reports that, and the reader only sees it after restoring.
+             */
+            if (input.status !== undefined &&
+                input.position === undefined &&
+                row.status !== input.status &&
+                !intoArchive) {
+                fields.position = await deps.boards.nextPosition(row.boardId, input.status);
+            }
+            if (Object.keys(fields).length > 0) {
+                await deps.boards.updateTask(input.taskId, fields, deps.now().toISOString());
+            }
+            return await viewOrRefuse(actor, { boardId: row.boardId, includeArchived: false });
+        },
+    };
+}

package/dist/boards/boards.types.d.ts

@@ -0,0 +1,76 @@
+import type { BoardGetInput, BoardTaskCreateInput, BoardTaskUpdateInput, BoardUpdateInput, BoardView } from "@anchrd/intel-contract/board";
+import type { Node } from "@anchrd/intel-contract/node";
+import type { Actor } from "../nodes/nodes.types.js";
+export type { BoardView };
+export interface BoardTaskRow {
+    nodeId: string;
+    boardId: string;
+    status: string;
+    position: number;
+    /**
+     * From the NODE, not from `board_tasks` (D68, #674).
+     *
+     * ⚠️ Whether a card is archived is `nodes.archived_at` and nothing else. The row carries it so
+     * that a move can tell "into the archive" from "out of it" without a second read — and so that
+     * nobody is tempted to store the answer here, which would be the two truths D68 exists against.
+     */
+    archivedAt: string | null;
+    updatedAt: string;
+}
+export interface BoardTaskWrite {
+    nodeId: string;
+    boardId: string;
+    status: string;
+    assigneeId: string | null;
+    labels: string[];
+    startDate: string | null;
+    dueDate: string | null;
+    dependsOn: string | null;
+    position: number;
+    occurredAt: string;
+}
+export interface BoardRepository {
+    read(actor: Actor, input: BoardGetInput): Promise<BoardView | null>;
+    columnsOf(actor: Actor, boardId: string, verb: "read" | "write"): Promise<string[] | null>;
+    /**
+     * ⚠️ `archiveVisible` is `undefined` for "leave it as it is" — the dialog that writes the columns
+     * and the switch that hides the archive are the same call, and a caller who only reorders columns
+     * must not silently un-hide an archive somebody put away.
+     */
+    setColumns(boardId: string, columnsJson: string, occurredAt: string, archiveVisible?: boolean): Promise<void>;
+    attach(write: BoardTaskWrite): Promise<void>;
+    taskRow(actor: Actor, taskId: string, verb: "read" | "write"): Promise<BoardTaskRow | null>;
+    updateTask(taskId: string, fields: Record<string, string | number | null>, occurredAt: string): Promise<void>;
+    nextPosition(boardId: string, status: string): Promise<number>;
+}
+export interface BoardNodePort {
+    create(actor: Actor, input: {
+        parentId: string;
+        kind: "task";
+        title: string;
+        description: null;
+        idempotencyKey: string;
+    }): Promise<Node>;
+    /**
+     * ⚠️ The same door `node_archive` uses. Dropping a card on the archive column must not become a
+     * second way to archive: one path means one audit row, one set of refusals — a card with live
+     * subtasks stays refused (#669) — and one answer to "what does archived mean".
+     */
+    archive(actor: Actor, input: {
+        nodeId: string;
+        baseUpdatedAt: string;
+        archived: boolean;
+        idempotencyKey: string;
+    }): Promise<Node>;
+}
+export interface BoardDeps {
+    boards: BoardRepository;
+    nodes: BoardNodePort;
+    now(): Date;
+}
+export interface BoardService {
+    get(actor: Actor, input: BoardGetInput): Promise<BoardView>;
+    update(actor: Actor, input: BoardUpdateInput): Promise<BoardView>;
+    createTask(actor: Actor, input: BoardTaskCreateInput): Promise<BoardView>;
+    updateTask(actor: Actor, input: BoardTaskUpdateInput): Promise<BoardView>;
+}

package/dist/boards/boards.types.js

@@ -0,0 +1 @@
+export {};

package/dist/http/http.js

@@ -1,3 +1,5 @@
+import { AuditListRequest } from "@anchrd/intel-contract/audit";
+import { BoardGetInput, BoardTaskCreateInput, BoardTaskUpdateInput, BoardUpdateInput, } from "@anchrd/intel-contract/board";
 import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, PurgeFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
 import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
 import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, PurgeNodePreviewInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
@@ -204,6 +206,71 @@ export function createHttp(deps) {
         const input = GetNodeInput.parse({ nodeId: context.req.param("nodeId") });
         return zipResponse(await deps.bundle.exportSubtree(asBundleActor(auth), input.nodeId));
     });
+    // The change journal, read forward from a stable position (#620). `nodes/read` and nothing new:
+    // an audit row about a node says the same thing the node says, so a second capability would be a
+    // second answer to one question. The per-row check is the service's, and it is the same tree walk
+    // the node reads go through.
+    //
+    // ⚠️ GET with the cursor in the query string, because the verb is one of the four in the grammar
+    // and the method carries it. `limit` arrives as a string and is coerced here — the contract
+    // wants a number, and a query string has none.
+    app.get("/audit", async (context) => {
+        const auth = requireCapability(context, "nodes", "read");
+        const limit = context.req.query("limit");
+        const after = context.req.query("after");
+        const input = AuditListRequest.parse({
+            resourceType: context.req.query("resourceType"),
+            ...(after === undefined ? {} : { after }),
+            ...(limit === undefined ? {} : { limit: Number(limit) }),
+        });
+        return context.json(await deps.audit.list(asActor(auth), input));
+    });
+    // The whole board in one answer (#648). `nodes/read` and nothing new: a board is a node, and a
+    // card is a node — a second capability would be a second answer to one question.
+    //
+    // ⚠️ Every filter is a query parameter and every one of them reaches the WHERE. Filtering after
+    // the read would have carried other people's cards over the wire first.
+    app.get("/boards/:boardId", async (context) => {
+        const auth = requireCapability(context, "nodes", "read");
+        const query = context.req.query();
+        const input = BoardGetInput.parse({
+            boardId: context.req.param("boardId"),
+            ...(query.status === undefined ? {} : { status: query.status }),
+            ...(query.assigneeId === undefined ? {} : { assigneeId: query.assigneeId }),
+            ...(query.dueBefore === undefined ? {} : { dueBefore: query.dueBefore }),
+            ...(query.dependsOn === undefined ? {} : { dependsOn: query.dependsOn }),
+            ...(query.includeArchived === undefined
+                ? {}
+                : { includeArchived: query.includeArchived === "true" }),
+        });
+        return context.json(await deps.boards.get(asActor(auth), input));
+    });
+    app.patch("/boards/:boardId", async (context) => {
+        const auth = requireCapability(context, "nodes", "write");
+        const input = BoardUpdateInput.parse(await context.req.json().catch(() => null));
+        if (input.boardId !== context.req.param("boardId")) {
+            throw new IntelError(400, "board_id_mismatch", "Path and body board IDs differ");
+        }
+        return context.json(await deps.boards.update(asActor(auth), input));
+    });
+    app.post("/boards/:boardId/tasks", async (context) => {
+        const auth = requireCapability(context, "nodes", "create");
+        const input = BoardTaskCreateInput.parse(await context.req.json().catch(() => null));
+        if (input.boardId !== context.req.param("boardId")) {
+            throw new IntelError(400, "board_id_mismatch", "Path and body board IDs differ");
+        }
+        return context.json(await deps.boards.createTask(asActor(auth), input), 201);
+    });
+    // ⚠️ `PATCH` on the task, not `POST …/move`. Moving a card IS an update of `status` and
+    // `position`; a second address for it would be a second way to write one row.
+    app.patch("/boards/:boardId/tasks/:taskId", async (context) => {
+        const auth = requireCapability(context, "nodes", "write");
+        const input = BoardTaskUpdateInput.parse(await context.req.json().catch(() => null));
+        if (input.taskId !== context.req.param("taskId")) {
+            throw new IntelError(400, "task_id_mismatch", "Path and body task IDs differ");
+        }
+        return context.json(await deps.boards.updateTask(asActor(auth), input));
+    });
     app.get("/nodes/:nodeId/versions", async (context) => {
         const auth = requireCapability(context, "nodes", "read");
         return context.json(await deps.nodes.listVersions(asActor(auth), context.req.param("nodeId")));

package/dist/http/http.types.d.ts

@@ -1,5 +1,7 @@
 import type { GateClient } from "@anchrd/gate-sdk";
+import type { AuditService } from "../audit/audit.types.js";
 import type { BrowserAuth } from "../auth/auth.types.js";
+import type { BoardService } from "../boards/boards.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
@@ -10,6 +12,8 @@ export interface HttpDeps {
     flows: FlowService;
     tools: ToolService;
     bundle: BundleService;
+    audit: AuditService;
+    boards: BoardService;
     resource: string;
     resourceMetadataUrl: string;
     auth?: Pick<BrowserAuth, "resolve">;

package/dist/intel/intel.js

@@ -134,6 +134,8 @@ export function createIntel(deps) {
         flows: deps.flows,
         tools: deps.tools,
         bundle: deps.bundle,
+        audit: deps.audit,
+        boards: deps.boards,
         resource,
         resourceMetadataUrl,
         ...(deps.auth ? { auth: deps.auth } : {}),
@@ -181,6 +183,8 @@ export function createIntel(deps) {
             nodes: deps.nodes,
             tools: deps.tools,
             bundle: deps.bundle,
+            audit: deps.audit,
+            boards: deps.boards,
         });
     });
     return app;

package/dist/intel/intel.types.d.ts

@@ -1,5 +1,7 @@
 import type { GateClient } from "@anchrd/gate-sdk";
+import type { AuditService } from "../audit/audit.types.js";
 import type { BrowserAuth } from "../auth/auth.types.js";
+import type { BoardService } from "../boards/boards.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
@@ -12,5 +14,7 @@ export interface IntelDeps {
     flows: FlowService;
     tools: ToolService;
     bundle: BundleService;
+    audit: AuditService;
+    boards: BoardService;
     auth?: BrowserAuth;
 }

package/dist/mcp/mcp.js

@@ -1,4 +1,6 @@
 import { IdempotencyKey, IntelId } from "@anchrd/intel-contract";
+import { AuditListRequest } from "@anchrd/intel-contract/audit";
+import { BoardGetInput, BoardTaskCreateInput, BoardTaskUpdateInput, BoardUpdateInput, } from "@anchrd/intel-contract/board";
 import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, PurgeFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
 import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
 import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, PurgeNodeInput, PurgeNodePreviewInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
@@ -156,6 +158,76 @@ export async function handleMcp(request, deps) {
         name: deps.authorization.identity.name ?? null,
     }));
     if (permits(deps.authorization, "nodes", "read")) {
+        // The change journal, read forward from a stable position (#620). It is what makes Intel the
+        // simplest of all signal sources: a consumer keeps its own cursor and asks what happened since,
+        // and Intel never learns that the consumer exists. That is the D24 test passed rather than
+        // argued — remove every reader and nothing piles up here.
+        //
+        // ⚠️ `nodes/read`, not a capability of its own. An audit row about a node says the same thing
+        // the node says; a second capability would be a second answer to one question, and the two
+        // would drift.
+        // The board as one answer (#648). Four tools, not five: a move is an update of `status` and
+        // `position`, and deleting a task is `node_archive` — nothing here removes a `nodes` row.
+        server.registerTool("board_get", {
+            title: "Read a board",
+            description: "Read one board in a single answer: its columns and every card you may see, without the card bodies. Filter by column, assignee, due date or what a card waits for — each filter narrows the query itself. Open a card's text with node_version_get.",
+            inputSchema: BoardGetInput,
+            annotations: {
+                title: "Read a board",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.boards.get(actor, input)));
+        server.registerTool("board_task_create", {
+            title: "Add a card to a board",
+            description: "File a new card on a board. Omit the status to put it in the first column. Name a parent task to make it a subtask — it lands on the same board, and moving an existing card under another one is `node_update` with a new parent. The card is a node like any other: its own address, its own permissions, its own history.",
+            inputSchema: BoardTaskCreateInput,
+            annotations: {
+                title: "Add a card to a board",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: false,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.boards.createTask(actor, input)));
+        server.registerTool("board_task_update", {
+            title: "Change a card",
+            description: "Change a card's column, order, assignee, labels or dates. Moving a card is this call with a new status — send a position to place it, or leave it out to put it at the end of the column. An absent field is left alone; null clears one. Rename a card with node_update. To move a card UNDER another card, use `node_update` with the other card as its parent — this tool changes what a card is, not where it hangs.",
+            inputSchema: BoardTaskUpdateInput,
+            annotations: {
+                title: "Change a card",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.boards.updateTask(actor, input)));
+        server.registerTool("board_update", {
+            title: "Set a board's columns",
+            description: "Replace a board's column list, in order. Columns are replaced rather than merged, so send the complete list. A column marked terminal is one where a card counts as finished.",
+            inputSchema: BoardUpdateInput,
+            annotations: {
+                title: "Set a board's columns",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.boards.update(actor, input)));
+        server.registerTool("audit_list", {
+            title: "List change events",
+            description: "Read the change journal forward from a stable position: what happened to the nodes you may read, oldest first. Pass `nextCursor` back as `after` to continue where you stopped; a null `nextCursor` means you have caught up. Only node events can be listed — flow events need their own visibility check and are refused rather than left out. Events about permanently deleted nodes are never returned, to anybody.",
+            inputSchema: AuditListRequest,
+            annotations: {
+                title: "List change events",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.audit.list(actor, input)));
         server.registerTool("node_list", {
             title: "List nodes",
             description: "List authorized folders, documents, attachments, and tables under one parent.",

package/dist/mcp/mcp.types.d.ts

@@ -1,4 +1,6 @@
 import type { Authorized } from "@anchrd/gate-sdk";
+import type { AuditService } from "../audit/audit.types.js";
+import type { BoardService } from "../boards/boards.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
@@ -14,4 +16,6 @@ export interface McpDeps {
     flows: FlowService;
     tools: ToolService;
     bundle: BundleService;
+    audit: AuditService;
+    boards: BoardService;
 }