@anchrd/intel-api 0.39.0 → 0.41.0

package/dist/adapters/db/db-prompts.d.ts

@@ -0,0 +1,46 @@
+import type { Actor } from "../../nodes/nodes.types.js";
+import type { PromptNameHolder, PromptRepository } from "../../prompts/prompts.types.js";
+import type { D1Database } from "./db.types.js";
+/**
+ * The documents this actor may read that are offered as a slash command (#775).
+ *
+ * ⚠️ **Two statements rather than one `UNION`, and the reason is the visibility walk.** A document
+ * is visible through `allowed`; a flow is visible through `flowInSubtree`, which is a different
+ * predicate over different tables and needs its own bindings in its own order. Welded into one
+ * statement the two would share a placeholder sequence that nobody can read back — and the failure
+ * that produces is a shifted binding, which does not throw: it answers the wrong list.
+ *
+ * ⚠️ **`archived_at IS NULL` is part of being offered.** Archiving is what "delete" means here, and
+ * a command that starts an archived document is a command onto something the tree no longer shows.
+ * The name stays taken while it is archived — a restore brings the command back rather than finding
+ * its name given away in the meantime.
+ *
+ * ⚠️ The `kind = 'document'` is redundant against the CHECK in `0028` and stays anyway: it is the
+ * one line that keeps this query honest if that CHECK is ever loosened, and it costs nothing on a
+ * partial index that only holds the offered rows.
+ */
+export declare const offeredDocumentsQuery: string;
+/**
+ * The published flows this actor may read that are offered as a slash command.
+ *
+ * ⚠️ **`published_version_id IS NOT NULL` is the switch, and it is the whole of it** (#775).
+ * Publishing is already the decision that a flow is for other people, so `flow_publish` sets the
+ * name and nothing else asks again. A flow that is withdrawn KEEPS its name and leaves this list:
+ * the name is what makes republishing it the same command rather than a new one, and a client that
+ * stored it is not left pointing at a command that has since become somebody else's.
+ *
+ * ⚠️ `read`, not `execute`, and that is not the obvious choice. A flow in the library — runnable by
+ * people who may not open it (ADR-0004 §2/§3) — is deliberately NOT listed: a catalogue entry
+ * carries a title and a description, and those are the readable half. Somebody who may only run it
+ * still can, through `flow_run_start` with the id they were given; what they do not get is a
+ * listing that names it.
+ */
+export declare const offeredFlowsQuery: string;
+export declare function promptNameHolder(deps: {
+    db: D1Database;
+    now(): Date;
+}, actor: Actor, name: string): Promise<PromptNameHolder | null>;
+export declare function createPromptRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): PromptRepository;

package/dist/adapters/db/db-prompts.js

@@ -0,0 +1,144 @@
+import { flowInSubtree, flowInSubtreeBindings, subtreeBindings, subtreeCte } from "./db-grants.js";
+/**
+ * The documents this actor may read that are offered as a slash command (#775).
+ *
+ * ⚠️ **Two statements rather than one `UNION`, and the reason is the visibility walk.** A document
+ * is visible through `allowed`; a flow is visible through `flowInSubtree`, which is a different
+ * predicate over different tables and needs its own bindings in its own order. Welded into one
+ * statement the two would share a placeholder sequence that nobody can read back — and the failure
+ * that produces is a shifted binding, which does not throw: it answers the wrong list.
+ *
+ * ⚠️ **`archived_at IS NULL` is part of being offered.** Archiving is what "delete" means here, and
+ * a command that starts an archived document is a command onto something the tree no longer shows.
+ * The name stays taken while it is archived — a restore brings the command back rather than finding
+ * its name given away in the meantime.
+ *
+ * ⚠️ The `kind = 'document'` is redundant against the CHECK in `0028` and stays anyway: it is the
+ * one line that keeps this query honest if that CHECK is ever loosened, and it costs nothing on a
+ * partial index that only holds the offered rows.
+ */
+export const offeredDocumentsQuery = `${subtreeCte}
+    SELECT n.prompt_name, n.id, n.title, n.description
+    FROM nodes n
+    JOIN allowed ON allowed.id = n.id
+    WHERE n.prompt_name IS NOT NULL
+      AND n.kind = 'document'
+      AND n.archived_at IS NULL
+    ORDER BY n.prompt_name`;
+/**
+ * The published flows this actor may read that are offered as a slash command.
+ *
+ * ⚠️ **`published_version_id IS NOT NULL` is the switch, and it is the whole of it** (#775).
+ * Publishing is already the decision that a flow is for other people, so `flow_publish` sets the
+ * name and nothing else asks again. A flow that is withdrawn KEEPS its name and leaves this list:
+ * the name is what makes republishing it the same command rather than a new one, and a client that
+ * stored it is not left pointing at a command that has since become somebody else's.
+ *
+ * ⚠️ `read`, not `execute`, and that is not the obvious choice. A flow in the library — runnable by
+ * people who may not open it (ADR-0004 §2/§3) — is deliberately NOT listed: a catalogue entry
+ * carries a title and a description, and those are the readable half. Somebody who may only run it
+ * still can, through `flow_run_start` with the id they were given; what they do not get is a
+ * listing that names it.
+ */
+export const offeredFlowsQuery = `${subtreeCte}
+    SELECT flow.prompt_name, flow.id, flow.title, flow.description
+    FROM flows flow
+    WHERE flow.prompt_name IS NOT NULL
+      AND flow.published_version_id IS NOT NULL
+      AND flow.archived_at IS NULL
+      AND ${flowInSubtree}
+    ORDER BY flow.prompt_name`;
+/**
+ * Who holds one name, asked of both tables at once, for the refusal a taken name gets.
+ *
+ * ⚠️ **Existence is answered to everybody; the TITLE only to those entitled to it.** The question
+ * "is this name free" has to be answered truthfully or the caller can do nothing — they are refused
+ * by an index they cannot see and told the node was changed by another editor. What must not travel
+ * is the title: naming the document that holds `payroll` tells somebody without access that a
+ * document by that title exists, and ADR-0004 §3 is explicit that a refusal must not become a way
+ * of reading the tree. The `CASE` below is where the two halves part.
+ *
+ * ⚠️ **One function, called from both repositories, rather than one query per repository.** A node
+ * write and a flow publish refuse for the same reason and have to say the same sentence; two
+ * spellings of this would drift, and the one that drifts is the one whose surface is used less.
+ * `destructive.md` calls it by name: two queries with similar names are two different questions.
+ */
+const holderQuery = `${subtreeCte}
+    SELECT 'document' AS kind, CASE WHEN allowed.id IS NULL THEN NULL ELSE n.title END AS title
+    FROM nodes n
+    LEFT JOIN allowed ON allowed.id = n.id
+    WHERE n.prompt_name = ?
+    UNION ALL
+    SELECT 'flow' AS kind, CASE WHEN ${flowInSubtree} THEN flow.title ELSE NULL END AS title
+    FROM flows flow
+    WHERE flow.prompt_name = ?`;
+export async function promptNameHolder(deps, actor, name) {
+    const now = deps.now().toISOString();
+    const row = await deps.db
+        .prepare(holderQuery)
+        .bind(...subtreeBindings(actor, "read", now), name, ...flowInSubtreeBindings(actor, "read", now), name)
+        .first();
+    return row === null ? null : { kind: row.kind, title: row.title };
+}
+function mapEntry(row, kind) {
+    return {
+        name: row.prompt_name,
+        kind,
+        targetId: row.id,
+        title: row.title,
+        description: row.description,
+    };
+}
+export function createPromptRepository(deps) {
+    return {
+        async listOffered(actor) {
+            const now = deps.now().toISOString();
+            /**
+             * ⚠️ **A half the actor has no capability for is not asked for at all** (#775, following
+             * #774). Running the statement and discarding its rows would be the same answer at the cost
+             * of a walk over the tree — and worse, it would put the decision in the mapping step, where
+             * the next reader of this function cannot see it.
+             *
+             * ⚠️ **Each statement carries its own kind, rather than the two being read back out of fixed
+             * positions.** With only `flows/read` the flow query is the ONLY element, so it arrives as
+             * result zero: a `const [documents, flows]` here puts the flows in a variable called
+             * `documents`, and the name is then a lie in one of the four branches. It answers correctly
+             * today and mis-binds the moment somebody adds a third conditional query — which is exactly
+             * the kind of edit this list invites.
+             */
+            const asked = [];
+            if (actor.canReadNodes) {
+                asked.push({
+                    kind: "document",
+                    statement: deps.db
+                        .prepare(offeredDocumentsQuery)
+                        .bind(...subtreeBindings(actor, "read", now)),
+                });
+            }
+            if (actor.canReadFlows) {
+                asked.push({
+                    kind: "flow",
+                    statement: deps.db
+                        .prepare(offeredFlowsQuery)
+                        .bind(...subtreeBindings(actor, "read", now), ...flowInSubtreeBindings(actor, "read", now)),
+                });
+            }
+            const results = await deps.db.batch(asked.map((each) => each.statement));
+            return (asked
+                .flatMap((each, index) => (results[index]?.results ?? []).map((row) => mapEntry(row, each.kind)))
+                // ⚠️ Sorted over the MERGED list rather than relying on the two `ORDER BY` clauses. Each
+                // statement orders its own half, and concatenating two ordered halves gives an unordered
+                // whole — `prompts/list` would then be alphabetical within documents and again within
+                // flows, which reads as "unsorted with a pattern" to anybody scrolling it.
+                .sort((left, right) => left.name.localeCompare(right.name)));
+        },
+        async findOffered(actor, name) {
+            // The catalogue is the list this actor may see, so looking one entry up is looking in that
+            // list. A separate statement with its own `WHERE prompt_name = ?` would be a second walk to
+            // keep in step with the first, for a set that is small by construction: the offered rows are
+            // a curated handful, not the tree.
+            const offered = await this.listOffered(actor);
+            return offered.find((entry) => entry.name === name) ?? null;
+        },
+    };
+}

package/dist/adapters/db/db.js

@@ -1,4 +1,5 @@
 import { descendantsCte, flowInSubtree, flowInSubtreeBindings, grantColumns as grantColumnsFor, grantInForce, mapGrant, nodeVerbBindings, nodeVerbQuery, principalColumns, subtreeBindings, subtreeCte, } from "./db-grants.js";
+import { promptNameHolder } from "./db-prompts.js";
 const versionColumns = `id, node_id, sequence, content_key, media_type, content_hash,
   size, segment, created_by, created_at`;
 const grantColumns = grantColumnsFor("node_id");
@@ -17,7 +18,7 @@ function dedupedByNode(rows) {
     });
 }
 const nodeColumns = `n.id, n.parent_id, n.kind, n.title, n.description,
-  n.owner_id, n.current_version_id, n.created_at, n.updated_at, n.archived_at`;
+  n.owner_id, n.current_version_id, n.created_at, n.updated_at, n.archived_at, n.prompt_name`;
 function mapNode(row) {
     return {
         id: row.id,
@@ -30,6 +31,7 @@ function mapNode(row) {
         createdAt: row.created_at,
         updatedAt: row.updated_at,
         archivedAt: row.archived_at,
+        promptName: row.prompt_name,
     };
 }
 function mapVersion(row) {
@@ -529,6 +531,22 @@ export function createNodeRepository(deps) {
                 .all();
             return (result.results ?? []).map(mapVersion);
         },
+        /**
+         * ⚠️ **The prompt name is the one field here whose write can fail for a reason that is not a
+         * conflict, and its guard sits ON the statement rather than in front of it** (#775). A
+         * `SELECT` beforehand decides on a state that may be gone by the time the `UPDATE` lands; the
+         * condition below is evaluated inside the same transaction as the write it guards.
+         *
+         * ⚠️ **And it is on every statement of the batch, not only the first** — `destructive.md`,
+         * `anchrd/intel#457`. A statement matching zero rows is not an error and the batch commits
+         * anyway, so the idempotency row and the audit row carry the same `prompt_name IS ?` the
+         * `UPDATE` carries. Without it a refused rename would still be booked as done, and the replay
+         * path would hand the caller back a node it never wrote.
+         *
+         * ⚠️ `other.id <> ?` is what lets a node keep its OWN name. Writing the name it already holds
+         * is the everyday case — every `node_update` that changes a title sends the current prompt
+         * name along — and without the exclusion the node would be refused for colliding with itself.
+         */
         async updateNode(input) {
             const node = input.node;
             try {
@@ -542,10 +560,19 @@ export function createNodeRepository(deps) {
               JOIN descendants parent ON child.parent_id = parent.id
             )
             UPDATE nodes
-            SET parent_id = ?, title = ?, description = ?, updated_at = ?
+            SET parent_id = ?, title = ?, description = ?, prompt_name = ?, updated_at = ?
             WHERE id = ? AND updated_at = ?
-              AND (? IS NULL OR ? NOT IN (SELECT id FROM descendants))`)
-                        .bind(node.id, node.parentId, node.title, node.description, node.updatedAt, node.id, input.baseUpdatedAt, node.parentId, node.parentId),
+              AND (? IS NULL OR ? NOT IN (SELECT id FROM descendants))
+              AND (
+                ? IS NULL
+                OR (
+                  NOT EXISTS (
+                    SELECT 1 FROM nodes other WHERE other.prompt_name = ? AND other.id <> ?
+                  )
+                  AND NOT EXISTS (SELECT 1 FROM flows holder WHERE holder.prompt_name = ?)
+                )
+              )`)
+                        .bind(node.id, node.parentId, node.title, node.description, node.promptName, node.updatedAt, node.id, input.baseUpdatedAt, node.parentId, node.parentId, node.promptName, node.promptName, node.id, node.promptName),
                     deps.db
                         .prepare(`INSERT INTO idempotency_keys (
               actor_id, operation, idempotency_key, resource_id, created_at
@@ -553,9 +580,9 @@ export function createNodeRepository(deps) {
             WHERE EXISTS (
               SELECT 1 FROM nodes
               WHERE id = ? AND parent_id IS ? AND title = ? AND description IS ?
-                AND updated_at = ?
+                AND prompt_name IS ? AND updated_at = ?
             )`)
-                        .bind(input.actorId, input.idempotencyKey, node.id, node.updatedAt, node.id, node.parentId, node.title, node.description, node.updatedAt),
+                        .bind(input.actorId, input.idempotencyKey, node.id, node.updatedAt, node.id, node.parentId, node.title, node.description, node.promptName, node.updatedAt),
                     deps.db
                         .prepare(`INSERT INTO audit_events (
               id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
@@ -608,8 +635,33 @@ export function createNodeRepository(deps) {
                 if (cycle?.found === 1)
                     return "cycle";
             }
+            /**
+             * ⚠️ **Which of the two refusals it was, asked only once the write has already failed.** The
+             * condition on the statement is what makes the guard hold; this read is what makes the answer
+             * sayable. Doing it the other way round — deciding here and writing unguarded — is the shape
+             * that loses the race it was written for.
+             *
+             * ⚠️ It is asked of BOTH tables, because the name is one catalogue across the two (#775). A
+             * check against `nodes` alone answers "free" for a name a published flow holds, and the write
+             * would then keep failing with a message that says the node was changed by another editor.
+             */
+            if (node.promptName !== null) {
+                const taken = await deps.db
+                    .prepare(`SELECT 1 AS found FROM nodes WHERE prompt_name = ? AND id <> ?
+            UNION ALL
+            SELECT 1 AS found FROM flows WHERE prompt_name = ?
+            LIMIT 1`)
+                    .bind(node.promptName, node.id, node.promptName)
+                    .first();
+                if (taken?.found === 1)
+                    return "prompt_name_taken";
+            }
             return "conflict";
         },
+        async promptNameHolder(actor, name) {
+            // One question, one implementation, shared with the flow repository — see `db-prompts.ts`.
+            return await promptNameHolder(deps, actor, name);
+        },
         async archiveNode(input) {
             const archiving = input.archivedAt !== null;
             /**

package/dist/audit/audit.js

@@ -47,25 +47,40 @@ function decodeCursor(cursor) {
 export function createAudit(deps) {
     return {
         async list(actor, input) {
-            // `resourceType` is validated by the contract enum before it reaches here; the value is
-            // named again rather than assumed, so adding `flow` to the enum later cannot silently route
-            // flow events through the node visibility walk.
-            if (input.resourceType !== "node") {
-                throw new IntelError(400, "unsupported_resource_type", "Only node events can be listed today. Flow and flow-run events need their own visibility check and are refused rather than omitted, so that an empty answer never has to mean two different things.");
-            }
             const after = input.after === undefined ? null : decodeCursor(input.after);
-            // One more than asked for, so "is there another page" is answered by the same authorized
+            // ⚠️ The refusal that stood here until #774 is GONE, and it was doing real work: it named
+            // `node` explicitly so that widening the contract enum could not silently route flow events
+            // through the node visibility walk. What replaces it is not trust but a repository that takes
+            // the kind as an argument and picks a statement per kind — each with its own walk, none able
+            // to answer for another. Adding a fourth kind to the enum is now a type error there rather
+            // than a wrong answer here, which is the stronger version of the same guard.
+            //
+            // One more row than asked for, so "is there another page" is answered by the same authorized
             // query instead of a second one that could disagree with it.
-            const page = await deps.audit.listNodeEvents(actor, { after, limit: input.limit + 1 });
+            const page = await deps.audit.listEvents(actor, {
+                after,
+                resourceType: input.resourceType,
+                limit: input.limit + 1,
+            });
             const hasMore = page.events.length > input.limit;
             const events = hasMore ? page.events.slice(0, input.limit) : page.events;
             const last = events.at(-1);
             return {
                 events,
-                // ⚠️ The cursor is the LAST DELIVERED row, never the probe row that was dropped. Taking it
-                // from the probe would skip exactly one event per page — the classic off-by-one that shows
-                // up as a lead nobody contacted, not as an error.
-                nextCursor: hasMore && last !== undefined ? encodeCursor(last) : null,
+                /**
+                 * ⚠️ The cursor is the LAST DELIVERED row, never the probe row that was dropped. Taking it
+                 * from the probe would skip exactly one event per page — the classic off-by-one that shows
+                 * up as a lead nobody contacted, not as an error.
+                 *
+                 * ⚠️ **And it is returned whenever rows were delivered, not only when more follows.** It
+                 * used to carry `hasMore &&`, which meant a reader catching up received fifty events and no
+                 * position: it started over on its next run and would have delivered the same fifty for
+                 * ever. A reader paging through never sees it, because it always asks for a full page —
+                 * which is why this survived until `anchrd/signals` read the journal for real (`#793`).
+                 */
+                nextCursor: last === undefined ? null : encodeCursor(last),
+                // Whether another page may follow. Its own field, because it is its own question.
+                hasMore,
             };
         },
     };

package/dist/audit/audit.types.d.ts

@@ -1,4 +1,4 @@
-import type { AuditEvent, AuditListRequest, AuditListResponse } from "@anchrd/intel-contract/audit";
+import type { AuditEvent, AuditListRequest, AuditListResponse, AuditResourceType } from "@anchrd/intel-contract/audit";
 import type { Actor } from "../nodes/nodes.types.js";
 export interface AuditPosition {
     occurredAt: string;
@@ -6,13 +6,14 @@ export interface AuditPosition {
 }
 export interface AuditQuery {
     after: AuditPosition | null;
+    resourceType: AuditResourceType;
     limit: number;
 }
 export interface AuditPage {
     events: AuditEvent[];
 }
 export interface AuditRepository {
-    listNodeEvents(actor: Actor, query: AuditQuery): Promise<AuditPage>;
+    listEvents(actor: Actor, query: AuditQuery): Promise<AuditPage>;
 }
 export interface AuditDeps {
     audit: AuditRepository;

package/dist/bundle/bundle.js

@@ -992,6 +992,15 @@ export function createBundle(deps) {
                         });
                     }
                     flows.push({
+                        /**
+                         * ⚠️ **An import never carries a slash command over, and that is not a gap** (#775). A
+                         * prompt name is unique across the whole installation the bundle lands IN, and the
+                         * bundle knows nothing about it: importing a flow offered as `/billing` into a tree
+                         * that already has one would fail the whole import over a name nobody chose here. The
+                         * import brings the content; offering it is a decision somebody makes afterwards, in
+                         * the installation that has to live with the name.
+                         */
+                        promptName: null,
                         id: entry.newId,
                         parentId,
                         title: plainTitle(entry.title),
@@ -1075,6 +1084,9 @@ export function createBundle(deps) {
                 if (version !== null)
                     versions.push(version);
                 nodes.push({
+                    // Not carried over, for the reason the flow half above spells out: the catalogue belongs
+                    // to the installation, not to the bundle (#775).
+                    promptName: null,
                     id: entry.newId,
                     parentId,
                     // Flows took the `continue` above; what reaches here is one of the six node kinds.

package/dist/flows/flows.js

@@ -1321,6 +1321,9 @@ export function createFlows(deps) {
             const occurredAt = deps.now().toISOString();
             return await deps.repository.insertFlow({
                 flow: {
+                    // A flow is offered at `flow_publish` and never at creation: publishing is the decision
+                    // that it is for other people, and an unpublished flow is in nobody's catalogue (#775).
+                    promptName: null,
                     id: deps.id(),
                     parentId: input.parentId,
                     title: plainTitle(input.title),
@@ -1641,7 +1644,26 @@ export function createFlows(deps) {
                 idempotencyKey: input.idempotencyKey,
                 auditId: deps.id(),
                 occurredAt: deps.now().toISOString(),
+                // ⚠️ Spread rather than assigned, and `exactOptionalPropertyTypes` is only half the reason.
+                // The repository distinguishes three states, and "the field is present carrying
+                // `undefined`" is not one of them: it has to be ABSENT for "leave the name alone".
+                ...(input.promptName === undefined ? {} : { promptName: input.promptName }),
             });
+            if (published === "prompt_name_taken") {
+                /**
+                 * ⚠️ **The holder is named only to somebody who may see it** — the same sentence
+                 * `node_update` gives, out of the same query (`db-prompts.ts`). The catalogue is one across
+                 * documents and flows, so the name a flow is refused for may well be held by a document,
+                 * and the refusal has to be able to say so.
+                 */
+                const holder = await deps.repository.promptNameHolder(actor, input.promptName);
+                const held = holder === null
+                    ? "It is already taken."
+                    : holder.title === null
+                        ? `A ${holder.kind} you cannot see already uses it.`
+                        : `The ${holder.kind} "${holder.title}" already uses it.`;
+                throw new IntelError(409, "prompt_name_taken", `The slash command "${input.promptName}" is not free. ${held} Pick another name — names are never changed for you, because the catalogue would then mean a different thing to every reader.`);
+            }
             if (!published)
                 throw new IntelError(409, "flow_publish_conflict", "Flow could not be published");
             return await requireFlow(actor, flow.id);
@@ -1776,11 +1798,16 @@ export function createFlows(deps) {
         async listRuns(actor, input) {
             // The history of a flow that has since been archived stays readable — the runs happened, and
             // archiving is about what may start next (#112).
-            const flow = await requireStartedFlow(actor, input.flowId);
+            //
+            // ⚠️ Without a flow there is nothing to require, and skipping the check does NOT widen the
+            // answer (#774): `requireStartedFlow` decides whether one named flow exists FOR this actor,
+            // while which runs appear is decided per row in the repository — their own, plus every run of
+            // a flow they may read. Asking it for a flow nobody named would mean inventing one.
+            const flowId = input.flowId === null ? null : (await requireStartedFlow(actor, input.flowId)).id;
             // One row beyond the page: it answers "is there more" and is dropped rather than shown, so a
             // count over the whole table is never needed to draw a "next" affordance.
             const rows = await deps.repository.listRunsVisible(actor, {
-                flowId: flow.id,
+                flowId,
                 failedOnly: input.failedOnly,
                 limit: input.limit + 1,
                 cursor: decodeCursor(input.cursor),

package/dist/flows/flows.types.d.ts

@@ -2,6 +2,7 @@ import type { ArchiveFlowInput, CreateFlowInput, Flow, FlowDocument, FlowGraph,
 import type { CancelFlowRunInput, CompleteFlowRunStepInput, FlowRun, FlowRunHistory, FlowRunList, FlowRunStep, ListFlowRunsInput, StartFlowRunInput } from "@anchrd/intel-contract/flow-run";
 import type { Node } from "@anchrd/intel-contract/node";
 import type { ResourceAccessList, ResourceGrant, ResourceGrantList, ResourceVerb, RevokeFlowGrantInput, RevokeGrantResult, ShareFlowInput, ShareResult } from "@anchrd/intel-contract/share";
+import type { PromptNameHolder } from "../prompts/prompts.types.js";
 export type FlowPrincipal = Pick<FlowActor, "id" | "email" | "isAdmin">;
 export type FlowCallReach = "subtree" | "library" | "out-of-reach";
 export interface FlowRunChainEntry {
@@ -13,7 +14,7 @@ export interface FlowRunChainEntry {
     currentNodeId: string | null;
 }
 export interface ListRunsQuery {
-    flowId: string;
+    flowId: string | null;
     failedOnly: boolean;
     limit: number;
     cursor: {
@@ -159,7 +160,20 @@ export interface FlowRepository {
         idempotencyKey: string;
         auditId: string;
         occurredAt: string;
-    }): Promise<boolean>;
+        /**
+         * The slash command this flow is offered under (#775). ⚠️ Three states, and `undefined` is the
+         * one that does nothing: publishing a second version of an already-offered flow must not
+         * withdraw its command, so a caller who says nothing about prompts changes nothing about them.
+         * `null` gives the name up, a string takes one.
+         */
+        promptName?: string | null;
+    }): Promise<boolean | "prompt_name_taken">;
+    /**
+     * Who holds a slash command name, for the sentence a refused publish gets. `title` is `null` when
+     * the holder exists but this actor may not see it — the same one implementation the node
+     * repository answers with (`db-prompts.ts`).
+     */
+    promptNameHolder(actor: FlowActor, name: string): Promise<PromptNameHolder | null>;
     unpublish(input: {
         flowId: string;
         versionId: string;

package/dist/http/http.js

@@ -207,16 +207,25 @@ export function createHttp(deps) {
         const input = GetNodeInput.parse({ nodeId: context.req.param("nodeId") });
         return zipResponse(await deps.bundle.exportSubtree(asBundleActor(auth), input.nodeId));
     });
-    // The change journal, read forward from a stable position (#620). `nodes/read` and nothing new:
-    // an audit row about a node says the same thing the node says, so a second capability would be a
-    // second answer to one question. The per-row check is the service's, and it is the same tree walk
-    // the node reads go through.
+    // The change journal, read forward from a stable position (#620).
+    //
+    // ⚠️ **The capability follows the KIND asked for** (#774). An audit row says the same thing its
+    // resource says, so the journal asks what reading that resource asks: `nodes/read` for `node`,
+    // `flows/read` for `flow` and `flow-run` — which is what every other flow-delivering route in
+    // this file requires. Until the enum was widened one capability covered the one kind there was;
+    // leaving it at `nodes/read` afterwards would have dropped the first of the three checks for
+    // exactly the two kinds this ticket opened, and left the Intel ACL as the only filter.
+    //
+    // ⚠️ The parse therefore runs BEFORE the capability check, which is the one place in this file
+    // where it does. That is not a loosening of "capability first, so a refusal costs no storage
+    // read": parsing touches the query string and nothing else, and the kind cannot be known any
+    // earlier than this. What it costs is that a malformed `resourceType` answers 400 rather than
+    // 403 — a sentence about the caller's own parameter, which names nothing of Intel's.
     //
     // ⚠️ GET with the cursor in the query string, because the verb is one of the four in the grammar
     // and the method carries it. `limit` arrives as a string and is coerced here — the contract
     // wants a number, and a query string has none.
     app.get("/audit", async (context) => {
-        const auth = requireCapability(context, "nodes", "read");
         const limit = context.req.query("limit");
         const after = context.req.query("after");
         const input = AuditListRequest.parse({
@@ -224,10 +233,19 @@ export function createHttp(deps) {
             ...(after === undefined ? {} : { after }),
             ...(limit === undefined ? {} : { limit: Number(limit) }),
         });
+        const auth = requireCapability(context, input.resourceType === "node" ? "nodes" : "flows", "read");
         return context.json(await deps.audit.list(asActor(auth), input));
     });
     // The same journal read the other way round: newest first, for a person rather than for a
-    // consumer catching up (#740). `nodes/read` and nothing new, for the reason `/audit` gives.
+    // consumer catching up (#740).
+    //
+    // ⚠️ `nodes/read` for the whole answer, and here that CANNOT follow the kind the way `/audit`
+    // above does: one page mixes node and flow cards on purpose, so there is no single kind to pick a
+    // capability from. It has been that way since flow cards existed and #767 only added two actions
+    // to them, so nothing about it is new — but it does mean somebody holding `nodes/read` without
+    // `flows/read` still sees flow activity here, filtered by the Intel ACL alone. Narrowing it means
+    // filtering cards by capability inside the feed service, which is a change to the answer rather
+    // than to the door: #790.
     //
     // ⚠️ A SECOND door and not an option on `/audit`. That one is the contract `anchrd/signals` will
     // build on, cursor and direction included; a shared signature would put both readers on one
@@ -736,6 +754,28 @@ export function createHttp(deps) {
         });
         return context.json(await deps.flows.listRuns(asFlowActor(auth), input));
     });
+    /**
+     * The same list across every flow (#774) — "did anything run", which used to take one call per
+     * flow and therefore went unasked.
+     *
+     * ⚠️ It sits at the root beside the other three run routes rather than under a flow, and the
+     * reason is the one already written for them in `packages/api/CLAUDE.md`: reading, cancelling and
+     * completing a run do not need the flow, and a run outlives it. Naming no flow is exactly that
+     * case. One tool answers both addresses — `flow_run_list` with `flowId: null` — which is the same
+     * many-to-one the attachment routes have.
+     */
+    app.get("/flow-runs", async (context) => {
+        const auth = requireCapability(context, "flows", "read");
+        const url = new URL(context.req.url);
+        requireKnownQuery(url, ["failedOnly", "limit", "cursor"]);
+        const input = ListFlowRunsInput.parse({
+            flowId: null,
+            ...(url.searchParams.has("failedOnly") ? { failedOnly: true } : {}),
+            ...(url.searchParams.has("limit") ? { limit: Number(url.searchParams.get("limit")) } : {}),
+            ...(url.searchParams.has("cursor") ? { cursor: url.searchParams.get("cursor") } : {}),
+        });
+        return context.json(await deps.flows.listRuns(asFlowActor(auth), input));
+    });
     app.get("/flow-runs/:runId", async (context) => {
         const auth = requireCapability(context, "flows", "read");
         const input = GetFlowRunInput.parse({ runId: context.req.param("runId") });

package/dist/indexing/indexing.js

@@ -1,4 +1,4 @@
-import { BlockNoteDocument, BlockNoteMediaType } from "@anchrd/intel-contract/node";
+import { documentText } from "../shared/document-text/document-text.js";
 export class PermanentIndexingError extends Error {
 }
 // The key under which a node with exactly one vector is filed — since #390 that is every kind. It
@@ -9,16 +9,15 @@ const wholeNodeChunkKey = "";
 // was archived while it worked and the record of them was refused (anchrd/intel#348).
 const writtenKeys = (chunks) => chunks.map((chunk) => chunk.key);
 function indexText(mediaType, content) {
-    if (mediaType !== BlockNoteMediaType)
-        return content;
-    try {
-        return BlockNoteDocument.parse(JSON.parse(content)).markdown;
-    }
-    catch (error) {
-        // Immutable content never becomes parsable on a retry, so treating this as transient would
-        // requeue the version until the queue gives up and would bury the real cause.
-        throw new PermanentIndexingError(`Node version content is not a valid BlockNote document: ${error instanceof Error ? error.message : "unknown parse failure"}`);
+    const text = documentText(mediaType, content);
+    // Immutable content never becomes parsable on a retry, so treating this as transient would
+    // requeue the version until the queue gives up and would bury the real cause. `documentText`
+    // answers `null` rather than throwing, because the other caller — `prompts/get` — owes its reader
+    // a different sentence about the same broken payload (#775).
+    if (text === null) {
+        throw new PermanentIndexingError("Node version content is not a valid BlockNote document");
     }
+    return text;
 }
 /**
  * What one chunk is embedded as (anchrd/intel#301).

package/dist/intel/intel.js

@@ -187,6 +187,7 @@ export function createIntel(deps) {
             audit: deps.audit,
             feed: deps.feed,
             boards: deps.boards,
+            prompts: deps.prompts,
         });
     });
     return app;

package/dist/intel/intel.types.d.ts

@@ -6,6 +6,7 @@ import type { BundleService } from "../bundle/bundle.types.js";
 import type { FeedService } from "../feed/feed.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
+import type { Prompts } from "../prompts/prompts.types.js";
 import type { ToolService } from "../tools/tools.types.js";
 export interface IntelDeps {
     baseUrl: string;
@@ -18,5 +19,6 @@ export interface IntelDeps {
     audit: AuditService;
     feed: FeedService;
     boards: BoardService;
+    prompts: Prompts;
     auth?: BrowserAuth;
 }