@anchrd/intel-api 0.40.0 → 0.41.0

package/dist/adapters/cloudflare/cloudflare.js

@@ -10,6 +10,7 @@ import { createFlows } from "../../flows/flows.js";
 import { createIndexing, PermanentIndexingError } from "../../indexing/indexing.js";
 import { createIntel } from "../../intel/intel.js";
 import { createNodes } from "../../nodes/nodes.js";
+import { createPrompts } from "../../prompts/prompts.js";
 import { bearer } from "../../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../../shared/intel-error/intel-error.js";
 import { sha256Hex } from "../../shared/sha256/sha256.js";
@@ -22,6 +23,7 @@ import { createFeedRepository } from "../db/db-feed.js";
 import { createFlowRepository } from "../db/db-flows.js";
 import { createNodeIndexRepository } from "../db/db-indexing.js";
 import { createOAuthClientStore } from "../db/db-oauth.js";
+import { createPromptRepository } from "../db/db-prompts.js";
 import { createDocumentConverter } from "../document-converter/document-converter.js";
 import { createFlowRuntime } from "../flow-runtime/flow-runtime.js";
 import { createIndexQueue, IndexMessage } from "../index-queue/index-queue.js";
@@ -265,6 +267,20 @@ export default {
             tools,
             audit: createAudit({ audit: auditRepository }),
             feed: createFeed({ feed: feedRepository }),
+            /**
+             * The slash-command catalogue (#775). It reads its own rows through its own repository and
+             * borrows exactly one thing from the node service: reading one document, with the
+             * authorization walk that service already performs. A second reader into R2 here would be a
+             * second place for that ACL to be applied, and the one that gets it wrong is the one nobody
+             * looks at.
+             */
+            prompts: createPrompts({
+                repository: createPromptRepository({ db: env.DB, now }),
+                // ⚠️ Handed on whole, and nothing is decided here. Turning a stored version into readable
+                // text is business behaviour, and this shell maps bindings — it does not get to know what a
+                // BlockNote payload is.
+                readDocument: async (actor, nodeId) => await nodes.get(actor, nodeId),
+            }),
             boards: createBoards({
                 boards: boardRepository,
                 nodes,

package/dist/adapters/db/db-flows.js

@@ -2,6 +2,7 @@ import { Flow, FlowGraph, FlowVersion, } from "@anchrd/intel-contract/flow";
 import { FlowRun } from "@anchrd/intel-contract/flow-run";
 import { calleeIds, treeLinkKinds } from "../../flows/flows.js";
 import { flowCallable, flowCallableBindings, flowInSubtree, flowInSubtreeBindings, flowVerbBindings, flowVerbQuery, grantColumns, grantInForce, mapGrant, principalColumns, readableOrRunnableCte, subtreeBindings, subtreeCte, } from "./db-grants.js";
+import { promptNameHolder } from "./db-prompts.js";
 const flowColumnNames = [
     "id",
     "parent_id",
@@ -13,6 +14,7 @@ const flowColumnNames = [
     "created_at",
     "updated_at",
     "archived_at",
+    "prompt_name",
 ];
 const flowColumns = flowColumnNames.join(", ");
 const runColumnNames = [
@@ -53,6 +55,7 @@ function mapFlow(row) {
         createdAt: row.created_at,
         updatedAt: row.updated_at,
         archivedAt: row.archived_at,
+        promptName: row.prompt_name,
     });
 }
 function mapVersion(row) {
@@ -904,23 +907,61 @@ export function createFlowRepository(deps) {
                 .first();
             return stored ? "saved" : "conflict";
         },
+        async promptNameHolder(actor, name) {
+            // One question, one implementation, shared with the node repository — see `db-prompts.ts`.
+            return await promptNameHolder(deps, actor, name);
+        },
+        /**
+         * ⚠️ **Two statement forms, not one with a conditional value** (#775). Publishing without
+         * mentioning a prompt name must leave the name alone; `SET prompt_name = ?` with the current
+         * value read back beforehand would work until two publishes race, and then the second one
+         * writes a name the first had just replaced. The form that does not mention the column cannot
+         * do that, and the form that does carries its guard.
+         *
+         * ⚠️ **The guard is on all three statements** (`destructive.md`, `anchrd/intel#457`). A
+         * statement matching zero rows is not an error, so an idempotency row and an audit row written
+         * without the same condition would book a publication that never happened — and the caller's
+         * retry would then be answered out of the replay table.
+         */
         async publish(input) {
+            const setsName = input.promptName !== undefined;
+            const nameAssignment = setsName ? ", prompt_name = ?" : "";
+            const nameBinding = setsName ? [input.promptName] : [];
+            // ⚠️ `other.id <> ?` lets a flow keep the name it already holds: republishing an offered flow
+            // sends the same name again, and without the exclusion it would collide with itself.
+            const nameGuard = setsName
+                ? `AND (
+                ? IS NULL
+                OR (
+                  NOT EXISTS (SELECT 1 FROM nodes holder WHERE holder.prompt_name = ?)
+                  AND NOT EXISTS (
+                    SELECT 1 FROM flows other WHERE other.prompt_name = ? AND other.id <> ?
+                  )
+                )
+              )`
+                : "";
+            const nameGuardBindings = setsName
+                ? [input.promptName, input.promptName, input.promptName, input.flowId]
+                : [];
+            const nameEcho = setsName ? "AND prompt_name IS ?" : "";
+            const nameEchoBinding = setsName ? [input.promptName] : [];
             try {
                 await deps.db.batch([
                     deps.db
-                        .prepare(`UPDATE flows SET published_version_id = ?, updated_at = ?
+                        .prepare(`UPDATE flows SET published_version_id = ?${nameAssignment}, updated_at = ?
               WHERE id = ? AND EXISTS (
                 SELECT 1 FROM flow_versions WHERE id = ? AND flow_id = ?
-              )`)
-                        .bind(input.versionId, input.occurredAt, input.flowId, input.versionId, input.flowId),
+              )
+              ${nameGuard}`)
+                        .bind(input.versionId, ...nameBinding, input.occurredAt, input.flowId, input.versionId, input.flowId, ...nameGuardBindings),
                     deps.db
                         .prepare(`INSERT INTO idempotency_keys (
               actor_id, operation, idempotency_key, resource_id, created_at
             ) SELECT ?, 'flows.publish', ?, ?, ?
             WHERE EXISTS (
-              SELECT 1 FROM flows WHERE id = ? AND published_version_id = ?
+              SELECT 1 FROM flows WHERE id = ? AND published_version_id = ? ${nameEcho}
             )`)
-                        .bind(input.actorId, input.idempotencyKey, input.versionId, input.occurredAt, input.flowId, input.versionId),
+                        .bind(input.actorId, input.idempotencyKey, input.versionId, input.occurredAt, input.flowId, input.versionId, ...nameEchoBinding),
                     deps.db
                         .prepare(`INSERT INTO audit_events (
               id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
@@ -937,7 +978,22 @@ export function createFlowRepository(deps) {
                 if (!replayed)
                     throw error;
             }
-            return ((await this.findIdempotent(input.actorId, "flows.publish", input.idempotencyKey)) !== null);
+            const published = (await this.findIdempotent(input.actorId, "flows.publish", input.idempotencyKey)) !== null;
+            // ⚠️ Which of the two refusals it was, asked only after the write has failed — the same order
+            // `updateNode` uses, and for the same reason: deciding first and writing unguarded is the
+            // shape that loses the race the guard exists for.
+            if (!published && setsName && input.promptName !== null) {
+                const taken = await deps.db
+                    .prepare(`SELECT 1 AS found FROM nodes WHERE prompt_name = ?
+            UNION ALL
+            SELECT 1 AS found FROM flows WHERE prompt_name = ? AND id <> ?
+            LIMIT 1`)
+                    .bind(input.promptName, input.promptName, input.flowId)
+                    .first();
+                if (taken?.found === 1)
+                    return "prompt_name_taken";
+            }
+            return published;
         },
         // The mirror of `publish`, with the same shape of guards: the idempotency row is written only
         // if the UPDATE actually withdrew something, so revoking what was never published leaves no key

package/dist/adapters/db/db-prompts.d.ts

@@ -0,0 +1,46 @@
+import type { Actor } from "../../nodes/nodes.types.js";
+import type { PromptNameHolder, PromptRepository } from "../../prompts/prompts.types.js";
+import type { D1Database } from "./db.types.js";
+/**
+ * The documents this actor may read that are offered as a slash command (#775).
+ *
+ * ⚠️ **Two statements rather than one `UNION`, and the reason is the visibility walk.** A document
+ * is visible through `allowed`; a flow is visible through `flowInSubtree`, which is a different
+ * predicate over different tables and needs its own bindings in its own order. Welded into one
+ * statement the two would share a placeholder sequence that nobody can read back — and the failure
+ * that produces is a shifted binding, which does not throw: it answers the wrong list.
+ *
+ * ⚠️ **`archived_at IS NULL` is part of being offered.** Archiving is what "delete" means here, and
+ * a command that starts an archived document is a command onto something the tree no longer shows.
+ * The name stays taken while it is archived — a restore brings the command back rather than finding
+ * its name given away in the meantime.
+ *
+ * ⚠️ The `kind = 'document'` is redundant against the CHECK in `0028` and stays anyway: it is the
+ * one line that keeps this query honest if that CHECK is ever loosened, and it costs nothing on a
+ * partial index that only holds the offered rows.
+ */
+export declare const offeredDocumentsQuery: string;
+/**
+ * The published flows this actor may read that are offered as a slash command.
+ *
+ * ⚠️ **`published_version_id IS NOT NULL` is the switch, and it is the whole of it** (#775).
+ * Publishing is already the decision that a flow is for other people, so `flow_publish` sets the
+ * name and nothing else asks again. A flow that is withdrawn KEEPS its name and leaves this list:
+ * the name is what makes republishing it the same command rather than a new one, and a client that
+ * stored it is not left pointing at a command that has since become somebody else's.
+ *
+ * ⚠️ `read`, not `execute`, and that is not the obvious choice. A flow in the library — runnable by
+ * people who may not open it (ADR-0004 §2/§3) — is deliberately NOT listed: a catalogue entry
+ * carries a title and a description, and those are the readable half. Somebody who may only run it
+ * still can, through `flow_run_start` with the id they were given; what they do not get is a
+ * listing that names it.
+ */
+export declare const offeredFlowsQuery: string;
+export declare function promptNameHolder(deps: {
+    db: D1Database;
+    now(): Date;
+}, actor: Actor, name: string): Promise<PromptNameHolder | null>;
+export declare function createPromptRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): PromptRepository;

package/dist/adapters/db/db-prompts.js

@@ -0,0 +1,144 @@
+import { flowInSubtree, flowInSubtreeBindings, subtreeBindings, subtreeCte } from "./db-grants.js";
+/**
+ * The documents this actor may read that are offered as a slash command (#775).
+ *
+ * ⚠️ **Two statements rather than one `UNION`, and the reason is the visibility walk.** A document
+ * is visible through `allowed`; a flow is visible through `flowInSubtree`, which is a different
+ * predicate over different tables and needs its own bindings in its own order. Welded into one
+ * statement the two would share a placeholder sequence that nobody can read back — and the failure
+ * that produces is a shifted binding, which does not throw: it answers the wrong list.
+ *
+ * ⚠️ **`archived_at IS NULL` is part of being offered.** Archiving is what "delete" means here, and
+ * a command that starts an archived document is a command onto something the tree no longer shows.
+ * The name stays taken while it is archived — a restore brings the command back rather than finding
+ * its name given away in the meantime.
+ *
+ * ⚠️ The `kind = 'document'` is redundant against the CHECK in `0028` and stays anyway: it is the
+ * one line that keeps this query honest if that CHECK is ever loosened, and it costs nothing on a
+ * partial index that only holds the offered rows.
+ */
+export const offeredDocumentsQuery = `${subtreeCte}
+    SELECT n.prompt_name, n.id, n.title, n.description
+    FROM nodes n
+    JOIN allowed ON allowed.id = n.id
+    WHERE n.prompt_name IS NOT NULL
+      AND n.kind = 'document'
+      AND n.archived_at IS NULL
+    ORDER BY n.prompt_name`;
+/**
+ * The published flows this actor may read that are offered as a slash command.
+ *
+ * ⚠️ **`published_version_id IS NOT NULL` is the switch, and it is the whole of it** (#775).
+ * Publishing is already the decision that a flow is for other people, so `flow_publish` sets the
+ * name and nothing else asks again. A flow that is withdrawn KEEPS its name and leaves this list:
+ * the name is what makes republishing it the same command rather than a new one, and a client that
+ * stored it is not left pointing at a command that has since become somebody else's.
+ *
+ * ⚠️ `read`, not `execute`, and that is not the obvious choice. A flow in the library — runnable by
+ * people who may not open it (ADR-0004 §2/§3) — is deliberately NOT listed: a catalogue entry
+ * carries a title and a description, and those are the readable half. Somebody who may only run it
+ * still can, through `flow_run_start` with the id they were given; what they do not get is a
+ * listing that names it.
+ */
+export const offeredFlowsQuery = `${subtreeCte}
+    SELECT flow.prompt_name, flow.id, flow.title, flow.description
+    FROM flows flow
+    WHERE flow.prompt_name IS NOT NULL
+      AND flow.published_version_id IS NOT NULL
+      AND flow.archived_at IS NULL
+      AND ${flowInSubtree}
+    ORDER BY flow.prompt_name`;
+/**
+ * Who holds one name, asked of both tables at once, for the refusal a taken name gets.
+ *
+ * ⚠️ **Existence is answered to everybody; the TITLE only to those entitled to it.** The question
+ * "is this name free" has to be answered truthfully or the caller can do nothing — they are refused
+ * by an index they cannot see and told the node was changed by another editor. What must not travel
+ * is the title: naming the document that holds `payroll` tells somebody without access that a
+ * document by that title exists, and ADR-0004 §3 is explicit that a refusal must not become a way
+ * of reading the tree. The `CASE` below is where the two halves part.
+ *
+ * ⚠️ **One function, called from both repositories, rather than one query per repository.** A node
+ * write and a flow publish refuse for the same reason and have to say the same sentence; two
+ * spellings of this would drift, and the one that drifts is the one whose surface is used less.
+ * `destructive.md` calls it by name: two queries with similar names are two different questions.
+ */
+const holderQuery = `${subtreeCte}
+    SELECT 'document' AS kind, CASE WHEN allowed.id IS NULL THEN NULL ELSE n.title END AS title
+    FROM nodes n
+    LEFT JOIN allowed ON allowed.id = n.id
+    WHERE n.prompt_name = ?
+    UNION ALL
+    SELECT 'flow' AS kind, CASE WHEN ${flowInSubtree} THEN flow.title ELSE NULL END AS title
+    FROM flows flow
+    WHERE flow.prompt_name = ?`;
+export async function promptNameHolder(deps, actor, name) {
+    const now = deps.now().toISOString();
+    const row = await deps.db
+        .prepare(holderQuery)
+        .bind(...subtreeBindings(actor, "read", now), name, ...flowInSubtreeBindings(actor, "read", now), name)
+        .first();
+    return row === null ? null : { kind: row.kind, title: row.title };
+}
+function mapEntry(row, kind) {
+    return {
+        name: row.prompt_name,
+        kind,
+        targetId: row.id,
+        title: row.title,
+        description: row.description,
+    };
+}
+export function createPromptRepository(deps) {
+    return {
+        async listOffered(actor) {
+            const now = deps.now().toISOString();
+            /**
+             * ⚠️ **A half the actor has no capability for is not asked for at all** (#775, following
+             * #774). Running the statement and discarding its rows would be the same answer at the cost
+             * of a walk over the tree — and worse, it would put the decision in the mapping step, where
+             * the next reader of this function cannot see it.
+             *
+             * ⚠️ **Each statement carries its own kind, rather than the two being read back out of fixed
+             * positions.** With only `flows/read` the flow query is the ONLY element, so it arrives as
+             * result zero: a `const [documents, flows]` here puts the flows in a variable called
+             * `documents`, and the name is then a lie in one of the four branches. It answers correctly
+             * today and mis-binds the moment somebody adds a third conditional query — which is exactly
+             * the kind of edit this list invites.
+             */
+            const asked = [];
+            if (actor.canReadNodes) {
+                asked.push({
+                    kind: "document",
+                    statement: deps.db
+                        .prepare(offeredDocumentsQuery)
+                        .bind(...subtreeBindings(actor, "read", now)),
+                });
+            }
+            if (actor.canReadFlows) {
+                asked.push({
+                    kind: "flow",
+                    statement: deps.db
+                        .prepare(offeredFlowsQuery)
+                        .bind(...subtreeBindings(actor, "read", now), ...flowInSubtreeBindings(actor, "read", now)),
+                });
+            }
+            const results = await deps.db.batch(asked.map((each) => each.statement));
+            return (asked
+                .flatMap((each, index) => (results[index]?.results ?? []).map((row) => mapEntry(row, each.kind)))
+                // ⚠️ Sorted over the MERGED list rather than relying on the two `ORDER BY` clauses. Each
+                // statement orders its own half, and concatenating two ordered halves gives an unordered
+                // whole — `prompts/list` would then be alphabetical within documents and again within
+                // flows, which reads as "unsorted with a pattern" to anybody scrolling it.
+                .sort((left, right) => left.name.localeCompare(right.name)));
+        },
+        async findOffered(actor, name) {
+            // The catalogue is the list this actor may see, so looking one entry up is looking in that
+            // list. A separate statement with its own `WHERE prompt_name = ?` would be a second walk to
+            // keep in step with the first, for a set that is small by construction: the offered rows are
+            // a curated handful, not the tree.
+            const offered = await this.listOffered(actor);
+            return offered.find((entry) => entry.name === name) ?? null;
+        },
+    };
+}

package/dist/adapters/db/db.js

@@ -1,4 +1,5 @@
 import { descendantsCte, flowInSubtree, flowInSubtreeBindings, grantColumns as grantColumnsFor, grantInForce, mapGrant, nodeVerbBindings, nodeVerbQuery, principalColumns, subtreeBindings, subtreeCte, } from "./db-grants.js";
+import { promptNameHolder } from "./db-prompts.js";
 const versionColumns = `id, node_id, sequence, content_key, media_type, content_hash,
   size, segment, created_by, created_at`;
 const grantColumns = grantColumnsFor("node_id");
@@ -17,7 +18,7 @@ function dedupedByNode(rows) {
     });
 }
 const nodeColumns = `n.id, n.parent_id, n.kind, n.title, n.description,
-  n.owner_id, n.current_version_id, n.created_at, n.updated_at, n.archived_at`;
+  n.owner_id, n.current_version_id, n.created_at, n.updated_at, n.archived_at, n.prompt_name`;
 function mapNode(row) {
     return {
         id: row.id,
@@ -30,6 +31,7 @@ function mapNode(row) {
         createdAt: row.created_at,
         updatedAt: row.updated_at,
         archivedAt: row.archived_at,
+        promptName: row.prompt_name,
     };
 }
 function mapVersion(row) {
@@ -529,6 +531,22 @@ export function createNodeRepository(deps) {
                 .all();
             return (result.results ?? []).map(mapVersion);
         },
+        /**
+         * ⚠️ **The prompt name is the one field here whose write can fail for a reason that is not a
+         * conflict, and its guard sits ON the statement rather than in front of it** (#775). A
+         * `SELECT` beforehand decides on a state that may be gone by the time the `UPDATE` lands; the
+         * condition below is evaluated inside the same transaction as the write it guards.
+         *
+         * ⚠️ **And it is on every statement of the batch, not only the first** — `destructive.md`,
+         * `anchrd/intel#457`. A statement matching zero rows is not an error and the batch commits
+         * anyway, so the idempotency row and the audit row carry the same `prompt_name IS ?` the
+         * `UPDATE` carries. Without it a refused rename would still be booked as done, and the replay
+         * path would hand the caller back a node it never wrote.
+         *
+         * ⚠️ `other.id <> ?` is what lets a node keep its OWN name. Writing the name it already holds
+         * is the everyday case — every `node_update` that changes a title sends the current prompt
+         * name along — and without the exclusion the node would be refused for colliding with itself.
+         */
         async updateNode(input) {
             const node = input.node;
             try {
@@ -542,10 +560,19 @@ export function createNodeRepository(deps) {
               JOIN descendants parent ON child.parent_id = parent.id
             )
             UPDATE nodes
-            SET parent_id = ?, title = ?, description = ?, updated_at = ?
+            SET parent_id = ?, title = ?, description = ?, prompt_name = ?, updated_at = ?
             WHERE id = ? AND updated_at = ?
-              AND (? IS NULL OR ? NOT IN (SELECT id FROM descendants))`)
-                        .bind(node.id, node.parentId, node.title, node.description, node.updatedAt, node.id, input.baseUpdatedAt, node.parentId, node.parentId),
+              AND (? IS NULL OR ? NOT IN (SELECT id FROM descendants))
+              AND (
+                ? IS NULL
+                OR (
+                  NOT EXISTS (
+                    SELECT 1 FROM nodes other WHERE other.prompt_name = ? AND other.id <> ?
+                  )
+                  AND NOT EXISTS (SELECT 1 FROM flows holder WHERE holder.prompt_name = ?)
+                )
+              )`)
+                        .bind(node.id, node.parentId, node.title, node.description, node.promptName, node.updatedAt, node.id, input.baseUpdatedAt, node.parentId, node.parentId, node.promptName, node.promptName, node.id, node.promptName),
                     deps.db
                         .prepare(`INSERT INTO idempotency_keys (
               actor_id, operation, idempotency_key, resource_id, created_at
@@ -553,9 +580,9 @@ export function createNodeRepository(deps) {
             WHERE EXISTS (
               SELECT 1 FROM nodes
               WHERE id = ? AND parent_id IS ? AND title = ? AND description IS ?
-                AND updated_at = ?
+                AND prompt_name IS ? AND updated_at = ?
             )`)
-                        .bind(input.actorId, input.idempotencyKey, node.id, node.updatedAt, node.id, node.parentId, node.title, node.description, node.updatedAt),
+                        .bind(input.actorId, input.idempotencyKey, node.id, node.updatedAt, node.id, node.parentId, node.title, node.description, node.promptName, node.updatedAt),
                     deps.db
                         .prepare(`INSERT INTO audit_events (
               id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
@@ -608,8 +635,33 @@ export function createNodeRepository(deps) {
                 if (cycle?.found === 1)
                     return "cycle";
             }
+            /**
+             * ⚠️ **Which of the two refusals it was, asked only once the write has already failed.** The
+             * condition on the statement is what makes the guard hold; this read is what makes the answer
+             * sayable. Doing it the other way round — deciding here and writing unguarded — is the shape
+             * that loses the race it was written for.
+             *
+             * ⚠️ It is asked of BOTH tables, because the name is one catalogue across the two (#775). A
+             * check against `nodes` alone answers "free" for a name a published flow holds, and the write
+             * would then keep failing with a message that says the node was changed by another editor.
+             */
+            if (node.promptName !== null) {
+                const taken = await deps.db
+                    .prepare(`SELECT 1 AS found FROM nodes WHERE prompt_name = ? AND id <> ?
+            UNION ALL
+            SELECT 1 AS found FROM flows WHERE prompt_name = ?
+            LIMIT 1`)
+                    .bind(node.promptName, node.id, node.promptName)
+                    .first();
+                if (taken?.found === 1)
+                    return "prompt_name_taken";
+            }
             return "conflict";
         },
+        async promptNameHolder(actor, name) {
+            // One question, one implementation, shared with the flow repository — see `db-prompts.ts`.
+            return await promptNameHolder(deps, actor, name);
+        },
         async archiveNode(input) {
             const archiving = input.archivedAt !== null;
             /**

package/dist/bundle/bundle.js

@@ -992,6 +992,15 @@ export function createBundle(deps) {
                         });
                     }
                     flows.push({
+                        /**
+                         * ⚠️ **An import never carries a slash command over, and that is not a gap** (#775). A
+                         * prompt name is unique across the whole installation the bundle lands IN, and the
+                         * bundle knows nothing about it: importing a flow offered as `/billing` into a tree
+                         * that already has one would fail the whole import over a name nobody chose here. The
+                         * import brings the content; offering it is a decision somebody makes afterwards, in
+                         * the installation that has to live with the name.
+                         */
+                        promptName: null,
                         id: entry.newId,
                         parentId,
                         title: plainTitle(entry.title),
@@ -1075,6 +1084,9 @@ export function createBundle(deps) {
                 if (version !== null)
                     versions.push(version);
                 nodes.push({
+                    // Not carried over, for the reason the flow half above spells out: the catalogue belongs
+                    // to the installation, not to the bundle (#775).
+                    promptName: null,
                     id: entry.newId,
                     parentId,
                     // Flows took the `continue` above; what reaches here is one of the six node kinds.

package/dist/flows/flows.js

@@ -1321,6 +1321,9 @@ export function createFlows(deps) {
             const occurredAt = deps.now().toISOString();
             return await deps.repository.insertFlow({
                 flow: {
+                    // A flow is offered at `flow_publish` and never at creation: publishing is the decision
+                    // that it is for other people, and an unpublished flow is in nobody's catalogue (#775).
+                    promptName: null,
                     id: deps.id(),
                     parentId: input.parentId,
                     title: plainTitle(input.title),
@@ -1641,7 +1644,26 @@ export function createFlows(deps) {
                 idempotencyKey: input.idempotencyKey,
                 auditId: deps.id(),
                 occurredAt: deps.now().toISOString(),
+                // ⚠️ Spread rather than assigned, and `exactOptionalPropertyTypes` is only half the reason.
+                // The repository distinguishes three states, and "the field is present carrying
+                // `undefined`" is not one of them: it has to be ABSENT for "leave the name alone".
+                ...(input.promptName === undefined ? {} : { promptName: input.promptName }),
             });
+            if (published === "prompt_name_taken") {
+                /**
+                 * ⚠️ **The holder is named only to somebody who may see it** — the same sentence
+                 * `node_update` gives, out of the same query (`db-prompts.ts`). The catalogue is one across
+                 * documents and flows, so the name a flow is refused for may well be held by a document,
+                 * and the refusal has to be able to say so.
+                 */
+                const holder = await deps.repository.promptNameHolder(actor, input.promptName);
+                const held = holder === null
+                    ? "It is already taken."
+                    : holder.title === null
+                        ? `A ${holder.kind} you cannot see already uses it.`
+                        : `The ${holder.kind} "${holder.title}" already uses it.`;
+                throw new IntelError(409, "prompt_name_taken", `The slash command "${input.promptName}" is not free. ${held} Pick another name — names are never changed for you, because the catalogue would then mean a different thing to every reader.`);
+            }
             if (!published)
                 throw new IntelError(409, "flow_publish_conflict", "Flow could not be published");
             return await requireFlow(actor, flow.id);

package/dist/flows/flows.types.d.ts

@@ -2,6 +2,7 @@ import type { ArchiveFlowInput, CreateFlowInput, Flow, FlowDocument, FlowGraph,
 import type { CancelFlowRunInput, CompleteFlowRunStepInput, FlowRun, FlowRunHistory, FlowRunList, FlowRunStep, ListFlowRunsInput, StartFlowRunInput } from "@anchrd/intel-contract/flow-run";
 import type { Node } from "@anchrd/intel-contract/node";
 import type { ResourceAccessList, ResourceGrant, ResourceGrantList, ResourceVerb, RevokeFlowGrantInput, RevokeGrantResult, ShareFlowInput, ShareResult } from "@anchrd/intel-contract/share";
+import type { PromptNameHolder } from "../prompts/prompts.types.js";
 export type FlowPrincipal = Pick<FlowActor, "id" | "email" | "isAdmin">;
 export type FlowCallReach = "subtree" | "library" | "out-of-reach";
 export interface FlowRunChainEntry {
@@ -159,7 +160,20 @@ export interface FlowRepository {
         idempotencyKey: string;
         auditId: string;
         occurredAt: string;
-    }): Promise<boolean>;
+        /**
+         * The slash command this flow is offered under (#775). ⚠️ Three states, and `undefined` is the
+         * one that does nothing: publishing a second version of an already-offered flow must not
+         * withdraw its command, so a caller who says nothing about prompts changes nothing about them.
+         * `null` gives the name up, a string takes one.
+         */
+        promptName?: string | null;
+    }): Promise<boolean | "prompt_name_taken">;
+    /**
+     * Who holds a slash command name, for the sentence a refused publish gets. `title` is `null` when
+     * the holder exists but this actor may not see it — the same one implementation the node
+     * repository answers with (`db-prompts.ts`).
+     */
+    promptNameHolder(actor: FlowActor, name: string): Promise<PromptNameHolder | null>;
     unpublish(input: {
         flowId: string;
         versionId: string;

package/dist/indexing/indexing.js

@@ -1,4 +1,4 @@
-import { BlockNoteDocument, BlockNoteMediaType } from "@anchrd/intel-contract/node";
+import { documentText } from "../shared/document-text/document-text.js";
 export class PermanentIndexingError extends Error {
 }
 // The key under which a node with exactly one vector is filed — since #390 that is every kind. It
@@ -9,16 +9,15 @@ const wholeNodeChunkKey = "";
 // was archived while it worked and the record of them was refused (anchrd/intel#348).
 const writtenKeys = (chunks) => chunks.map((chunk) => chunk.key);
 function indexText(mediaType, content) {
-    if (mediaType !== BlockNoteMediaType)
-        return content;
-    try {
-        return BlockNoteDocument.parse(JSON.parse(content)).markdown;
-    }
-    catch (error) {
-        // Immutable content never becomes parsable on a retry, so treating this as transient would
-        // requeue the version until the queue gives up and would bury the real cause.
-        throw new PermanentIndexingError(`Node version content is not a valid BlockNote document: ${error instanceof Error ? error.message : "unknown parse failure"}`);
+    const text = documentText(mediaType, content);
+    // Immutable content never becomes parsable on a retry, so treating this as transient would
+    // requeue the version until the queue gives up and would bury the real cause. `documentText`
+    // answers `null` rather than throwing, because the other caller — `prompts/get` — owes its reader
+    // a different sentence about the same broken payload (#775).
+    if (text === null) {
+        throw new PermanentIndexingError("Node version content is not a valid BlockNote document");
     }
+    return text;
 }
 /**
  * What one chunk is embedded as (anchrd/intel#301).

package/dist/intel/intel.js

@@ -187,6 +187,7 @@ export function createIntel(deps) {
             audit: deps.audit,
             feed: deps.feed,
             boards: deps.boards,
+            prompts: deps.prompts,
         });
     });
     return app;

package/dist/intel/intel.types.d.ts

@@ -6,6 +6,7 @@ import type { BundleService } from "../bundle/bundle.types.js";
 import type { FeedService } from "../feed/feed.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
+import type { Prompts } from "../prompts/prompts.types.js";
 import type { ToolService } from "../tools/tools.types.js";
 export interface IntelDeps {
     baseUrl: string;
@@ -18,5 +19,6 @@ export interface IntelDeps {
     audit: AuditService;
     feed: FeedService;
     boards: BoardService;
+    prompts: Prompts;
     auth?: BrowserAuth;
 }

package/dist/mcp/mcp.js

@@ -10,6 +10,7 @@ import { AppendTableRowsInput, DefineTableInput, DeleteTableRowsInput, GetTableI
 import { ExecuteToolInput, TestToolInput } from "@anchrd/intel-contract/tool";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { GetPromptRequestSchema, ListPromptsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { permits } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
@@ -1236,6 +1237,55 @@ export async function handleMcp(request, deps) {
             },
         }, async (input) => text(await deps.tools.execute(toolActor, input)));
     }
+    /**
+     * The slash-command surface (#775). A prompt is the one thing on this server the HUMAN chooses:
+     * a tool is called when the model thinks of it, a prompt when somebody types `/name`.
+     *
+     * ⚠️ **Registered through the low-level handlers rather than `registerPrompt`, and the cost is
+     * the reason.** `registerPrompt` takes one name at a time, so a catalogue that lives in D1 would
+     * have to be read and registered while the server is being built — on EVERY request, including
+     * every `tools/call` that will never look at a prompt. These two handlers run the queries only
+     * when a client actually asks for prompts.
+     *
+     * ⚠️ **The capability is declared here because nothing else declares it.** Without
+     * `registerCapabilities` the SDK would answer `prompts/list` while telling clients during
+     * initialization that this server has no prompts, and a client that believes the handshake never
+     * asks. `listChanged: false` is the truthful value: the catalogue changes when somebody edits a
+     * document, and this server sends no notification about it.
+     *
+     * ⚠️ **Offered on EITHER capability, decided per call** — the shape `audit_list` uses one screen
+     * up, for the same reason. Holding one of the two is what makes the surface worth offering at
+     * all; which half of the catalogue it then answers is `listOffered`'s question, and it asks it
+     * per row against the resource ACL underneath.
+     */
+    if (permits(deps.authorization, "nodes", "read") ||
+        permits(deps.authorization, "flows", "read")) {
+        const promptActor = {
+            ...actor,
+            canReadNodes: permits(deps.authorization, "nodes", "read"),
+            canReadFlows: permits(deps.authorization, "flows", "read"),
+        };
+        server.server.registerCapabilities({ prompts: { listChanged: false } });
+        server.server.setRequestHandler(ListPromptsRequestSchema, async () => ({
+            prompts: (await deps.prompts.list(promptActor)).map((entry) => ({
+                name: entry.name,
+                title: entry.title,
+                // ⚠️ No `arguments`, and that is a decision rather than a gap (#775). A prompt without
+                // arguments is completely usable — it is an instruction somebody wrote down — and the
+                // obvious source of an argument schema, a flow's requirements, is a round of its own.
+                // Declaring an empty `arguments` array would tell a client the question was asked and
+                // answered "none", which is a different claim.
+                ...(entry.description === null ? {} : { description: entry.description }),
+            })),
+        }));
+        server.server.setRequestHandler(GetPromptRequestSchema, async (promptRequest) => {
+            const { entry, text } = await deps.prompts.get(promptActor, promptRequest.params.name);
+            return {
+                ...(entry.description === null ? {} : { description: entry.description }),
+                messages: [{ role: "user", content: { type: "text", text } }],
+            };
+        });
+    }
     const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
     await server.connect(transport);
     return await transport.handleRequest(request);

package/dist/mcp/mcp.types.d.ts

@@ -5,6 +5,7 @@ import type { BundleService } from "../bundle/bundle.types.js";
 import type { FeedService } from "../feed/feed.types.js";
 import type { FlowService } from "../flows/flows.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
+import type { Prompts } from "../prompts/prompts.types.js";
 import type { ToolService } from "../tools/tools.types.js";
 export interface McpDeps {
     authorization: Authorized;
@@ -20,4 +21,5 @@ export interface McpDeps {
     audit: AuditService;
     feed: FeedService;
     boards: BoardService;
+    prompts: Prompts;
 }

package/dist/nodes/nodes.js

@@ -637,6 +637,11 @@ export function createNodes(deps) {
             const timestamp = deps.now().toISOString();
             const created = await deps.repository.insertNode({
                 node: {
+                    // ⚠️ A node is never born offered (#775). Naming a slash command is a curation decision
+                    // about a document that already exists, and `node_create` takes no name: a creation that
+                    // could also take the last free name in the catalogue would fail for a reason that has
+                    // nothing to do with creating anything.
+                    promptName: null,
                     id: deps.id(),
                     parentId: input.parentId,
                     kind: input.kind,
@@ -997,6 +1002,22 @@ export function createNodes(deps) {
             if (!(await deps.repository.can(actor, current.id, "write"))) {
                 throw new IntelError(403, "node_forbidden", "This node cannot be edited");
             }
+            /**
+             * ⚠️ **Only a document can be offered as a slash command, and the refusal names the kind**
+             * (#775). A prompt is an instruction; a folder, a table, an attachment, a board or a task is
+             * material, and material is read through `node_get` rather than typed as a command.
+             *
+             * ⚠️ It stands BEFORE the idempotency replay on purpose: a call that is wrong about the kind
+             * is wrong on every attempt, and answering the second one out of the replay table would tell
+             * a caller their refused write had succeeded.
+             *
+             * ⚠️ Clearing it — `null` on a kind that could never have had one — is deliberately allowed.
+             * It changes nothing, and refusing a no-op would make "take the command off everything in
+             * this folder" a call that fails on the folder itself.
+             */
+            if (input.promptName != null && current.kind !== "document") {
+                throw new IntelError(409, "prompt_not_a_document", `Only a document can be offered as a slash command, and this is a ${current.kind}.`);
+            }
             const replayedId = await deps.repository.findIdempotentNode(actor.id, "node.update", input.idempotencyKey);
             if (replayedId)
                 return await requireVisible(actor, replayedId);
@@ -1045,6 +1066,7 @@ export function createNodes(deps) {
                     parentId: input.parentId === undefined ? current.parentId : input.parentId,
                     title: input.title === undefined ? current.title : plainTitle(input.title),
                     description: input.description === undefined ? current.description : input.description,
+                    promptName: input.promptName === undefined ? current.promptName : input.promptName,
                     updatedAt,
                 },
                 baseUpdatedAt: input.baseUpdatedAt,
@@ -1055,6 +1077,22 @@ export function createNodes(deps) {
             if (updated === "cycle") {
                 throw new IntelError(409, "move_cycle", "A node cannot be moved into its descendant");
             }
+            if (updated === "prompt_name_taken") {
+                /**
+                 * ⚠️ **The sentence names the holder only when this actor may see it.** That a name is
+                 * taken has to be said — otherwise the caller retries forever against a wall they cannot
+                 * see — but WHICH document holds it is a fact about the tree, and ADR-0004 §3 does not let
+                 * a refusal become a way of reading it. `promptNameHolder` answers `null` for the title in
+                 * that case, and the second sentence below is what the caller gets instead.
+                 */
+                const holder = await deps.repository.promptNameHolder(actor, input.promptName);
+                const held = holder === null
+                    ? "It is already taken."
+                    : holder.title === null
+                        ? `A ${holder.kind} you cannot see already uses it.`
+                        : `The ${holder.kind} "${holder.title}" already uses it.`;
+                throw new IntelError(409, "prompt_name_taken", `The slash command "${input.promptName}" is not free. ${held} Pick another name — names are never changed for you, because the catalogue would then mean a different thing to every reader.`);
+            }
             if (updated === "conflict") {
                 throw new IntelError(409, "update_conflict", "This node was changed by another editor");
             }

package/dist/nodes/nodes.types.d.ts

@@ -3,6 +3,7 @@ import type { ArchiveNodeInput, CreateNodeInput, ListNodesInput, Node, NodeAttac
 import type { ResourceGrant, ResourceGrantList, ResourceVerb, RevokeGrantInput, ShareInput, ShareResult } from "@anchrd/intel-contract/share";
 import type { AppendTableRowsInput, AppendTableRowsResult, DefineTableInput, DeleteTableRowsInput, DeleteTableRowsResult, RedefineTableInput, UpdateTableRowsInput, UpdateTableRowsResult } from "@anchrd/intel-contract/table";
 import type { SemanticIndex } from "../adapters/semantic-index/semantic-index.types.js";
+import type { PromptNameHolder } from "../prompts/prompts.types.js";
 export interface Actor {
     id: string;
     email: string;
@@ -78,7 +79,13 @@ export interface NodeRepository {
         actorId: string;
         idempotencyKey: string;
         auditId: string;
-    }): Promise<"cycle" | "conflict" | Node>;
+    }): Promise<"cycle" | "conflict" | "prompt_name_taken" | Node>;
+    /**
+     * Who holds a slash command name, for the sentence a refused rename gets (#775). `title` is
+     * `null` when the holder exists but this actor may not see it — the name is taken either way, and
+     * which document it is stays behind the same wall every other read stands behind.
+     */
+    promptNameHolder(actor: Actor, name: string): Promise<PromptNameHolder | null>;
     archiveNode(input: {
         nodeId: string;
         baseUpdatedAt: string;

package/dist/prompts/prompts.d.ts

@@ -0,0 +1,2 @@
+import type { Prompts, PromptsDeps } from "./prompts.types.js";
+export declare function createPrompts(deps: PromptsDeps): Prompts;

package/dist/prompts/prompts.js

@@ -0,0 +1,65 @@
+import { documentText } from "../shared/document-text/document-text.js";
+import { IntelError } from "../shared/intel-error/intel-error.js";
+/**
+ * What a client is handed when it opens the command of a FLOW.
+ *
+ * ⚠️ **This text starts nothing, and that is the point** (D24: the agent acts, Intel does not).
+ * `prompts/get` is a read — a model asked for the wording of a command, not for the command to
+ * happen. Returning instructions rather than performing them keeps the one property that makes
+ * Intel safe to point a model at: nothing in this package moves because something was READ.
+ *
+ * ⚠️ It names the `flowId` rather than the prompt name, because the name is not what the next call
+ * takes. A model handed "run the flow `crm-outreach`" has to translate that back into an id, and
+ * the translation is exactly the step it gets wrong — `flow_run_start` takes an id and refuses a
+ * name with a message about the id being unknown.
+ */
+function flowInstruction(entry) {
+    const description = entry.description === null ? "" : `\n\n${entry.description}`;
+    return `Start the Intel flow "${entry.title}" by calling \`flow_run_start\` with \`flowId: "${entry.targetId}"\`. Do not describe the flow instead of starting it, and do not invent a different id: this one is the flow the command \`/${entry.name}\` stands for.${description}`;
+}
+export function createPrompts(deps) {
+    return {
+        async list(actor) {
+            return await deps.repository.listOffered(actor);
+        },
+        async get(actor, name) {
+            const entry = await deps.repository.findOffered(actor, name);
+            /**
+             * ⚠️ **One refusal for "no such command" and for "not yours to see", and it says the first.**
+             * `findOffered` searches the catalogue as this actor sees it, so a document offered under
+             * this name inside a folder they may not read is simply absent from it. Two different
+             * messages here would make the refusal a way of asking whether a command exists — the same
+             * reading of the tree ADR-0004 §3 refuses everywhere else.
+             */
+            if (entry === null) {
+                throw new IntelError(404, "prompt_not_found", "No command by that name is offered to you. `prompts/list` names the ones that are.");
+            }
+            if (entry.kind === "flow")
+                return { entry, text: flowInstruction(entry) };
+            const document = await deps.readDocument(actor, entry.targetId);
+            /**
+             * ⚠️ **A document with no version yet is an EMPTY command, not a failure.** Somebody offered a
+             * document they have not written in; the honest answer is the empty instruction they have.
+             */
+            if (document.version === null || document.content === null)
+                return { entry, text: "" };
+            /**
+             * ⚠️ **What a document node stores is not its text.** The editor writes a BlockNote payload,
+             * and handing that on gives a model a JSON blob where its instruction should be — for
+             * practically every document written in the app. `documentText` is the same extraction the
+             * search index runs, out of the same function, so the words a model is given and the words
+             * somebody can search for cannot drift apart.
+             */
+            const text = documentText(document.version.mediaType, document.content);
+            /**
+             * ⚠️ And an unreadable payload is REFUSED rather than passed on raw. Half a JSON document as
+             * an instruction is the failure this whole finding is about, one step further along: the
+             * model would act on it rather than report it.
+             */
+            if (text === null) {
+                throw new IntelError(422, "prompt_unreadable", `The document behind /${entry.name} is not stored in a form this command can be read from. Open it once and save it, or offer a document written in the editor.`);
+            }
+            return { entry, text };
+        },
+    };
+}

package/dist/prompts/prompts.types.d.ts

@@ -0,0 +1,71 @@
+import type { NodeDocument } from "@anchrd/intel-contract/node";
+import type { Actor } from "../nodes/nodes.types.js";
+/**
+ * One entry of the slash-command catalogue (#775): a document offered as an instruction, or a
+ * published flow offered as a way to start one.
+ *
+ * ⚠️ `kind` is two values and not `NodeKind`. A flow is not a node, and the five node kinds that
+ * cannot be offered have no business appearing in this union — a widened type here would be a
+ * standing invitation to hand `prompts/list` a folder.
+ */
+export interface PromptEntry {
+    name: string;
+    kind: "document" | "flow";
+    targetId: string;
+    title: string;
+    description: string | null;
+}
+/**
+ * Who holds a name, as much of it as the asking actor is entitled to learn.
+ *
+ * ⚠️ `title` is `null` when the holder exists but this actor may not see it, and that is not the
+ * same as "no holder". ADR-0004 §3 is explicit that a refusal must not become a way of reading the
+ * tree: naming the document that holds `payroll` would tell somebody without access that a document
+ * by that title exists. The caller is told the name is taken — which they must be, or they cannot
+ * proceed — and nothing else.
+ */
+export interface PromptNameHolder {
+    kind: "document" | "flow";
+    title: string | null;
+}
+/**
+ * Who is asking for the catalogue, and which halves of it they are entitled to at all.
+ *
+ * ⚠️ **The capability follows the KIND, exactly as it does for `audit_list`** (#774). A prompt
+ * entry says the same thing its resource says, so listing it asks what reading that resource asks:
+ * `nodes/read` for a document, `flows/read` for a flow. Somebody holding only one of the two gets
+ * the half they hold — not an empty list, and not the other half by accident.
+ *
+ * ⚠️ These are the GATE capabilities and they are the coarse half of the answer. The resource ACL
+ * still runs underneath, per row, in the query itself; a caller with `nodes/read` sees the offered
+ * documents THEY may read and no others.
+ */
+export interface PromptActor extends Actor {
+    canReadNodes: boolean;
+    canReadFlows: boolean;
+}
+export interface PromptRepository {
+    listOffered(actor: PromptActor): Promise<PromptEntry[]>;
+    findOffered(actor: PromptActor, name: string): Promise<PromptEntry | null>;
+}
+export interface PromptsDeps {
+    repository: PromptRepository;
+    /**
+     * One document, as the node service reads it: the same authorization walk, the same content
+     * store. `prompts/get` does not reach into R2 on its own — a second reader would be a second
+     * place for the ACL to be applied, and the one that gets it wrong is the one nobody looks at.
+     *
+     * ⚠️ **The whole document, not a string.** What is stored under a document node is the editor's
+     * payload, and turning that into readable text needs the `mediaType` beside the content. Handing
+     * a string in would put that decision in whatever wired this up — in the Cloudflare shell, which
+     * is the one place in this package that may not hold business behaviour.
+     */
+    readDocument(actor: Actor, nodeId: string): Promise<NodeDocument>;
+}
+export interface Prompts {
+    list(actor: PromptActor): Promise<PromptEntry[]>;
+    get(actor: PromptActor, name: string): Promise<{
+        entry: PromptEntry;
+        text: string;
+    }>;
+}

package/dist/prompts/prompts.types.js

@@ -0,0 +1 @@
+export {};

package/dist/shared/document-text/document-text.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The READABLE text of one stored version, for the two places that need a document as prose rather
+ * than as the editor's own payload.
+ *
+ * ⚠️ **What a document node stores is NOT its text.** The editor writes a BlockNote payload —
+ * `{ blocks, markdown, … }` — and `markdown` beside the blocks is the whole of what anybody outside
+ * the editor can read. `packages/ui/CLAUDE.md` states it for the search: `indexing.ts` pulls that
+ * field and nothing else into full text and vectors, so it is what anyone searching Intel matches
+ * against. A caller who hands the raw content on instead is handing on a JSON blob.
+ *
+ * ⚠️ **Every other media type travels unchanged**, and that is not an oversight: a `text/markdown`
+ * version IS its text, and a table renders its own. Only the editor's payload has a wrapper around
+ * the words.
+ *
+ * ⚠️ **`null` means "this content is not readable as text", not "empty".** Immutable content never
+ * becomes parsable on a retry, so the two callers answer it differently and each is right for its
+ * own surface: the indexer refuses the version permanently rather than requeueing it forever, and
+ * `prompts/get` refuses the call rather than handing a model half a JSON document. Returning `""`
+ * here would collapse both into "there is nothing to say".
+ */
+export declare function documentText(mediaType: string, content: string): string | null;

package/dist/shared/document-text/document-text.js

@@ -0,0 +1,31 @@
+import { BlockNoteDocument, BlockNoteMediaType } from "@anchrd/intel-contract/node";
+/**
+ * The READABLE text of one stored version, for the two places that need a document as prose rather
+ * than as the editor's own payload.
+ *
+ * ⚠️ **What a document node stores is NOT its text.** The editor writes a BlockNote payload —
+ * `{ blocks, markdown, … }` — and `markdown` beside the blocks is the whole of what anybody outside
+ * the editor can read. `packages/ui/CLAUDE.md` states it for the search: `indexing.ts` pulls that
+ * field and nothing else into full text and vectors, so it is what anyone searching Intel matches
+ * against. A caller who hands the raw content on instead is handing on a JSON blob.
+ *
+ * ⚠️ **Every other media type travels unchanged**, and that is not an oversight: a `text/markdown`
+ * version IS its text, and a table renders its own. Only the editor's payload has a wrapper around
+ * the words.
+ *
+ * ⚠️ **`null` means "this content is not readable as text", not "empty".** Immutable content never
+ * becomes parsable on a retry, so the two callers answer it differently and each is right for its
+ * own surface: the indexer refuses the version permanently rather than requeueing it forever, and
+ * `prompts/get` refuses the call rather than handing a model half a JSON document. Returning `""`
+ * here would collapse both into "there is nothing to say".
+ */
+export function documentText(mediaType, content) {
+    if (mediaType !== BlockNoteMediaType)
+        return content;
+    try {
+        return BlockNoteDocument.parse(JSON.parse(content)).markdown;
+    }
+    catch {
+        return null;
+    }
+}

package/migrations/0028_a_prompt_name_over_two_kinds.sql

@@ -0,0 +1,70 @@
+-- A document and a published flow can both be offered as a slash command (#775). What they need is
+-- one short name, and the name has to be unique across BOTH of them: they land in the same
+-- `prompts/list` catalogue, so a document and a flow can take each other's name.
+--
+-- ⚠️ **One field, not two.** `prompt_name` set means offered, `NULL` means not. A boolean beside it
+-- would allow the state "on, without a name", and that is not a thing `prompts/list` could answer.
+--
+-- ⚠️ **No third table, and the choice is deliberate.** A `prompt_names(name PRIMARY KEY, …)`
+-- catalogue would carry the cross-kind uniqueness as a real constraint, and it would cost two
+-- things this schema is not willing to pay: a second truth about the name of one node — every
+-- `SELECT` over `nodes` would have to remember a join, and the one that forgets it answers `NULL`
+-- in silence — and a fourth child table for the `nodes` rebuild recipe to carry (see the package
+-- CLAUDE.md; `node_links` is the one that already has to be carried out and back). The uniqueness
+-- WITHIN one kind is an index here; the uniqueness ACROSS the two is a condition on the write, on
+-- every statement that sets a name, in the same batch that writes it.
+--
+-- ⚠️ The condition on the write is not a nicety. A `SELECT` before an `UPDATE` in a separate call
+-- decides on a state that may be gone by the time the write lands; the check has to be part of the
+-- statement so that the two cannot come apart. What the caller is told — WHICH node or flow holds
+-- the name — is a second, cheap read that only runs once the write has already refused.
+
+-- ⚠️ **This form is MEASURED against real D1, not only against miniflare.** No other file in this
+-- folder adds a `CHECK` through `ALTER TABLE … ADD COLUMN` that reads a DIFFERENT column, and the
+-- package CLAUDE.md is explicit that a green run under the emulator proves nothing about the
+-- deployment — `foreign_keys = OFF` is honoured there and ignored by D1 over its HTTP API. A
+-- migration file is immutable after release, so the failure would surface at the deploy.
+--
+-- Run against a throwaway D1 (`intel-check-0028`, `--remote`) on 2026-08-25 and then deleted. Both
+-- statements applied, `sqlite_master` shows the CHECK on the column, and all six refusals fire with
+-- `SQLITE_CONSTRAINT_CHECK` / `SQLITE_CONSTRAINT_UNIQUE`: a folder and a table with a name, an
+-- uppercase name, a name with a space, a 41-character name, and a second row taking a name that is
+-- already held. A document with a valid name and two rows with none go through.
+--
+-- ⚠️ `kind = 'document'` is in the CHECK, not only in the service. A prompt is an instruction, not
+-- material: a folder, a table, an attachment, a board or a task never carries one (#775). The
+-- service refuses it with a sentence, and this line is what makes that refusal true even for a
+-- write that never passes the service.
+--
+-- ⚠️ `NOT GLOB '*[^a-z0-9-]*'` is the grammar `^[a-z0-9-]{1,40}$` says on the contract, spelled the
+-- one way SQLite can spell it: "no character outside the class anywhere". The obvious
+-- `GLOB '[a-z0-9-]*'` is NOT that check — it constrains the first character and lets every other
+-- one through, so `a_B C` passes it. The hyphen sits last inside the class, where it is a literal
+-- rather than a range.
+ALTER TABLE nodes ADD COLUMN prompt_name TEXT
+  CHECK (
+    prompt_name IS NULL
+    OR (
+      kind = 'document'
+      AND length(prompt_name) BETWEEN 1 AND 40
+      AND prompt_name NOT GLOB '*[^a-z0-9-]*'
+    )
+  );
+
+ALTER TABLE flows ADD COLUMN prompt_name TEXT
+  CHECK (
+    prompt_name IS NULL
+    OR (length(prompt_name) BETWEEN 1 AND 40 AND prompt_name NOT GLOB '*[^a-z0-9-]*')
+  );
+
+-- ⚠️ Partial, and that is the whole reason they work. A plain `UNIQUE` index would let several
+-- rows carry `NULL` too — SQLite treats NULLs as distinct — so the `WHERE` clause buys no
+-- correctness here; it buys the SIZE. Almost every node has no prompt name, and an index over
+-- them all would be one entry per node in the tree to serve a handful of rows.
+--
+-- ⚠️ These two carry the uniqueness WITHIN a kind and nothing more. Two documents cannot share a
+-- name and two flows cannot; a document and a flow can, as far as these indexes are concerned, and
+-- the condition on the write is the only thing that stops them. Reading one of these index names in
+-- a query plan is therefore not evidence that the cross-kind rule held.
+CREATE UNIQUE INDEX nodes_prompt_name_idx ON nodes(prompt_name) WHERE prompt_name IS NOT NULL;
+CREATE UNIQUE INDEX flows_prompt_name_idx ON flows(prompt_name) WHERE prompt_name IS NOT NULL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.26.0",
-    "@anchrd/intel-contract": "^0.32.0",
+    "@anchrd/intel-contract": "^0.33.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",