@anchrd/intel-api 0.5.1 → 0.6.1

package/dist/adapters/db/db.js

@@ -89,7 +89,15 @@ export function createKnowledgeRepository(deps) {
      * may see and never before them, and `COUNT(*) OVER ()` counts those same rows alone (#30).
      */
     const visibleChildren = (bounded) => `${visibleCte}
-    SELECT ${nodeColumns}${bounded ? ", COUNT(*) OVER () AS total" : ""}
+    SELECT ${nodeColumns}${bounded ? ", COUNT(*) OVER () AS total" : ""},
+      -- Whether this row has children THIS actor may see (#59), asked of the same allowed set one
+      -- level down. A second rule written here would drift from the one above it, and the drift
+      -- would show as a chevron that opens onto nothing.
+      EXISTS (
+        SELECT 1 FROM knowledge_nodes child
+        JOIN allowed AS allowed_child ON allowed_child.id = child.id
+        WHERE child.parent_id = n.id AND child.archived_at IS NULL
+      ) AS has_children
     FROM knowledge_nodes n
     JOIN allowed ON allowed.id = n.id
     WHERE n.parent_id IS ? AND (? = 1 OR n.archived_at IS NULL)
@@ -100,7 +108,11 @@ export function createKnowledgeRepository(deps) {
                 .prepare(visibleChildren(false))
                 .bind(...readBindings(actor), input.parentId, input.includeArchived ? 1 : 0)
                 .all();
-            return (result.results ?? []).map(mapNode);
+            const rows = result.results ?? [];
+            return {
+                items: rows.map(mapNode),
+                withChildren: rows.filter((row) => row.has_children === 1).map((row) => row.id),
+            };
         },
         async listVisibleBounded(actor, input) {
             const result = await deps.db

package/dist/adapters/openid/openid.js

@@ -59,11 +59,25 @@ export function createOpenId(deps) {
             ...(insecure ? { execute: [client.allowInsecureRequests] } : {}),
         };
     }
+    // openid-client resolves issuer metadata via OIDC discovery unless told otherwise. Gate serves
+    // that document, but a plain OAuth 2.0 authorization server — the MCP portal on its custom
+    // domain is one — publishes only RFC 8414's oauth-authorization-server path and answers the OIDC
+    // one with a 404, which surfaced as a bare 500 on /auth/connect (#93). The fallback repeats the
+    // operation once with the OAuth document; when both fail, the second error is thrown because it
+    // belongs to the attempt that got further for the issuer that needed the fallback at all.
+    async function withAlgorithmFallback(run) {
+        try {
+            return await run();
+        }
+        catch {
+            return await run("oauth2");
+        }
+    }
     async function discover(issuer, clientId) {
         const key = `${issuer}#${clientId}`;
         let configuration = configurations.get(key);
         if (!configuration) {
-            configuration = client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), options(issuer));
+            configuration = withAlgorithmFallback((algorithm) => client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), { ...options(issuer), ...(algorithm ? { algorithm } : {}) }));
             configurations.set(key, configuration);
             void configuration.catch(() => configurations.delete(key));
         }
@@ -118,7 +132,7 @@ export function createOpenId(deps) {
             throw new Error("MCP resource did not publish valid OAuth metadata");
         },
         async register(input) {
-            const configuration = await client.dynamicClientRegistration(new URL(input.issuer), {
+            const configuration = await withAlgorithmFallback((algorithm) => client.dynamicClientRegistration(new URL(input.issuer), {
                 client_name: input.clientName,
                 redirect_uris: [input.redirectUri],
                 response_types: ["code"],
@@ -128,7 +142,7 @@ export function createOpenId(deps) {
                     : { scope: "openid profile email offline_access" }),
                 token_endpoint_auth_method: "none",
                 ...(isCloudflareAccess(input.issuer) ? { resource: input.resource } : {}),
-            }, client.None(), options(input.issuer));
+            }, client.None(), { ...options(input.issuer), ...(algorithm ? { algorithm } : {}) }));
             return configuration.clientMetadata().client_id;
         },
         async authorizationUrl(input) {

package/dist/auth/auth.js

@@ -1,5 +1,6 @@
 import { calculatePKCECodeChallenge, randomPKCECodeVerifier, randomState } from "openid-client";
 import { IntelError } from "../shared/intel-error/intel-error.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 import { SafeReturnPath } from "../shared/safe-return-path/safe-return-path.js";
 const cookieName = "intel_session";
 // What an authorization server answers when `prompt=none` would have worked, but only with somebody
@@ -54,11 +55,19 @@ export function createBrowserAuth(deps) {
         const stored = await deps.clients.get(registrationKey, redirectUri);
         if (stored)
             return stored;
-        const registered = await deps.oauth.register({
+        // A refused registration becomes a named state instead of a bare 500 (#93). The conversion
+        // must not eat the reason: an IntelError is an expected refusal nobody logs, so the library's
+        // own exception is written here — it is the only place that still holds it.
+        const registered = await deps.oauth
+            .register({
             issuer,
             redirectUri,
             clientName: "Intel",
             resource,
+        })
+            .catch((error) => {
+            reportUnexpectedError(error);
+            throw new IntelError(502, "client_registration_failed", "The authorization server refused the client registration");
         });
         return await deps.clients.put({
             issuer: registrationKey,

package/dist/flows/flows.js

@@ -280,6 +280,46 @@ export function createFlows(deps) {
     // library folder carries `execute` for everyone and nothing else (ADR-0004 §2/§3), so insisting on
     // `read` here would turn every library flow into a 404 for exactly the people it exists for — and
     // the call rule in section 3 would have nothing left to permit.
+    /**
+     * Which of these flows call another one that THIS actor may also see (#59).
+     *
+     * ⚠️ Per reader, and that is the point: a flow whose only call is hidden from this person has
+     * nothing to unfold, so a chevron there would promise what opening cannot deliver. `listCalls`
+     * filters the same way — asking the same question here, rather than reading the graph and hoping,
+     * is the only way the two cannot drift apart.
+     *
+     * ⚠️ Two reads for the whole level, never one per flow (#30): the versions come back together and
+     * the callees go out together.
+     */
+    async function callableCallers(actor, flows) {
+        const versionOf = new Map();
+        for (const flow of flows) {
+            const versionId = flow.currentVersionId ?? flow.publishedVersionId;
+            if (versionId)
+                versionOf.set(flow.id, versionId);
+        }
+        if (versionOf.size === 0)
+            return [];
+        const versions = new Map((await deps.repository.getVersions([...new Set(versionOf.values())])).map((version) => [
+            version.id,
+            version,
+        ]));
+        const wanted = new Map();
+        for (const [flowId, versionId] of versionOf) {
+            const version = versions.get(versionId);
+            if (version)
+                wanted.set(flowId, calleeIds(version.graph));
+        }
+        const everyCallee = [...new Set([...wanted.values()].flat())];
+        if (everyCallee.length === 0)
+            return [];
+        const reachable = new Set((await deps.repository.listCallable(actor, everyCallee))
+            .filter((callee) => !callee.archivedAt)
+            .map((callee) => callee.id));
+        return [...wanted.entries()]
+            .filter(([, callees]) => callees.some((callee) => reachable.has(callee)))
+            .map(([flowId]) => flowId);
+    }
     async function requireRunnableFlow(actor, flowId) {
         const flow = await deps.repository.getCallable(actor, flowId);
         if (!flow || flow.archivedAt)
@@ -720,7 +760,8 @@ export function createFlows(deps) {
     }
     return {
         async list(actor, input = {}) {
-            return { items: await deps.repository.listVisible(actor, input) };
+            const items = await deps.repository.listVisible(actor, input);
+            return { items, withCalls: await callableCallers(actor, items) };
         },
         async get(actor, flowId) {
             const flow = await requireFlow(actor, flowId);
@@ -885,7 +926,7 @@ export function createFlows(deps) {
             const flow = await requireFlow(actor, flowId);
             const versionId = flow.currentVersionId ?? flow.publishedVersionId;
             if (!versionId)
-                return { items: [] };
+                return { items: [], withCalls: [] };
             const version = await requireVersion(versionId, flow.id);
             const wanted = calleeIds(version.graph);
             // One read for every callee rather than one per callee (#30). This is what the sidebar asks
@@ -901,7 +942,8 @@ export function createFlows(deps) {
                 if (callee && !callee.archivedAt)
                     items.push(callee);
             }
-            return { items };
+            // Ein aufgerufener Flow ruft selbst welche: dieselbe Frage, eine Ebene tiefer (#59).
+            return { items, withCalls: await callableCallers(actor, items) };
         },
         // "What this flow needs", straight out of the graph: no arithmetic, nothing that can go stale,
         // and no claim about whether anyone may reach it. A standing "this flow has conflicts" badge

package/dist/flows/flows.types.d.ts

@@ -157,10 +157,12 @@ export type FolderAccess = "ok" | "missing" | "not-a-folder" | "forbidden";
 export interface FlowService {
     list(actor: FlowActor, input?: ListFlowsInput): Promise<{
         items: Flow[];
+        withCalls: string[];
     }>;
     get(actor: FlowActor, flowId: string): Promise<FlowDocument>;
     listCalls(actor: FlowActor, flowId: string): Promise<{
         items: Flow[];
+        withCalls: string[];
     }>;
     validate(actor: FlowActor, flowId: string): Promise<FlowValidation>;
     relationGraph(actor: FlowActor, input: RelationGraphInput): Promise<RelationGraph>;

package/dist/http/http.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { authorizeBearer, bearer, permits, } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { problemDetails as problem } from "../shared/problem-details/problem-details.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 // A query string is a door to the outside like a body is, so what arrives through it is closed
 // rather than tolerated: `z.strictObject` refuses an unknown field, and this is that refusal for the
 // half of the input Zod never sees. A silently ignored parameter is how a caller believes it asked
@@ -64,6 +65,9 @@ export function createHttp(deps) {
         if (error instanceof z.ZodError) {
             return context.json(problem(400, "invalid_request", "Request validation failed", z.prettifyError(error)), 400);
         }
+        // Same rule as the outer app: an expected refusal explains itself, an unknown exception must
+        // leave a trace — otherwise the 500 is a fact without a reason anywhere (#93).
+        reportUnexpectedError(error);
         return context.json(problem(500, "internal_error", "Internal server error"), 500);
     });
     app.use("*", async (context, next) => {

package/dist/intel/intel.js

@@ -4,6 +4,7 @@ import { handleMcp } from "../mcp/mcp.js";
 import { authorize, authorizeBearer } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { problemDetails } from "../shared/problem-details/problem-details.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 export function createIntel(deps) {
     const baseUrl = deps.baseUrl.replace(/\/+$/, "");
     const resource = `${baseUrl}/mcp`;
@@ -17,6 +18,10 @@ export function createIntel(deps) {
         if (error instanceof IntelError) {
             return context.json(problemDetails(error.status, error.code, error.message), error.status);
         }
+        // An IntelError is an expected refusal and explains itself; the unknown exception must leave a
+        // trace, or the 500 is undiagnosable — the worker answered, so the platform records no
+        // exception of its own (#93). The body stays generic: the log is the operator's channel.
+        reportUnexpectedError(error);
         return context.json(problemDetails(500, "internal_error", "Internal server error"), 500);
     });
     app.get("/health", (context) => context.json({ status: "ok" }));

package/dist/knowledge/knowledge.js

@@ -286,7 +286,7 @@ export function createKnowledge(deps) {
     }
     return {
         async list(actor, input) {
-            return { items: await deps.repository.listVisible(actor, input) };
+            return await deps.repository.listVisible(actor, input);
         },
         // The same level under a bound, for the one caller that draws a bounded picture of it. It goes
         // through the same predicate as `list`, so what is drawn is a prefix of what is listed and never

package/dist/knowledge/knowledge.types.d.ts

@@ -25,7 +25,10 @@ export interface NewKnowledgeTableVersion {
     auditId: string;
 }
 export interface KnowledgeRepository {
-    listVisible(actor: Actor, input: ListKnowledgeNodesInput): Promise<KnowledgeNode[]>;
+    listVisible(actor: Actor, input: ListKnowledgeNodesInput): Promise<{
+        items: KnowledgeNode[];
+        withChildren: string[];
+    }>;
     listVisibleBounded(actor: Actor, input: {
         parentId: string | null;
         limit: number;

package/dist/shared/report-unexpected-error/report-unexpected-error.d.ts

@@ -0,0 +1 @@
+export declare function reportUnexpectedError(error: unknown): void;

package/dist/shared/report-unexpected-error/report-unexpected-error.js

@@ -0,0 +1,37 @@
+// A library error can quote whatever the peer sent — an echoed Authorization header, a token in a
+// URL, a response body. The log must show the failure and never the credential, so everything
+// shaped like one is cut before the line is written. The patterns match shapes, not sources: a JWT
+// is recognizable on its own, and other tokens only ever appear behind their label.
+function redact(text) {
+    // ⚠️ The order is load-bearing: "Authorization: Bearer x" must hit the bearer rule first — a
+    // combined alternation would let the label rule win the leftmost match, swallow the word
+    // "Bearer" as the value, and leave the token itself standing.
+    return text
+        .replace(/\beyJ[\w-]{4,}\.[\w-]+\.[\w-]*/g, "[redacted]")
+        .replace(/\b(bearer\s+)[\w.~+/-]+=*/gi, "$1[redacted]")
+        .replace(/\b((?:access_token|refresh_token|id_token|client_secret|api_key|authorization)"?\s*[:=]\s*"?)[\w.~+/-]+=*/gi, "$1[redacted]");
+}
+function describe(error) {
+    if (error instanceof Error)
+        return error.stack ?? `${error.name}: ${error.message}`;
+    if (typeof error === "string")
+        return error;
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+// openid-client wraps the informative part — the HTTP response, the OAuth error body — into
+// `cause`, so a log line without the cause chain would name the wrapper and hide the reason (#93).
+const MaxCauseDepth = 5;
+export function reportUnexpectedError(error) {
+    const parts = [];
+    let current = error;
+    for (let depth = 0; depth < MaxCauseDepth && current !== undefined; depth += 1) {
+        parts.push(describe(current));
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    console.error(redact(parts.join("\ncaused by: ")));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.7.0",
-    "@anchrd/intel-contract": "^0.3.0",
+    "@anchrd/intel-contract": "^0.4.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "ajv": "^8.20.0",
     "hono": "^4.12.32",