@anchrd/intel-contract 0.17.0 → 0.19.0

package/dist/contract/flow-run.d.ts

@@ -130,9 +130,9 @@ export declare const FlowRunStep: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"tool">;
         configuration: z.ZodObject<{
-            toolName: z.ZodString;
+            server: z.ZodString;
+            allow: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
             fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-            arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strict>;
         id: z.ZodString;
         position: z.ZodObject<{

package/dist/contract/flow.d.ts

@@ -106,9 +106,9 @@ export declare const FlowNode: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"tool">;
     configuration: z.ZodObject<{
-        toolName: z.ZodString;
+        server: z.ZodString;
+        allow: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strict>;
     id: z.ZodString;
     position: z.ZodObject<{
@@ -245,9 +245,9 @@ export declare const FlowGraph: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"tool">;
         configuration: z.ZodObject<{
-            toolName: z.ZodString;
+            server: z.ZodString;
+            allow: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
             fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-            arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strict>;
         id: z.ZodString;
         position: z.ZodObject<{
@@ -396,9 +396,9 @@ export declare const FlowVersion: z.ZodObject<{
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"tool">;
             configuration: z.ZodObject<{
-                toolName: z.ZodString;
+                server: z.ZodString;
+                allow: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
                 fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
             }, z.core.$strict>;
             id: z.ZodString;
             position: z.ZodObject<{
@@ -550,9 +550,9 @@ export declare const FlowDocument: z.ZodObject<{
             }, z.core.$strict>, z.ZodObject<{
                 kind: z.ZodLiteral<"tool">;
                 configuration: z.ZodObject<{
-                    toolName: z.ZodString;
+                    server: z.ZodString;
+                    allow: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
                     fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                    arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 }, z.core.$strict>;
                 id: z.ZodString;
                 position: z.ZodObject<{
@@ -673,7 +673,7 @@ export declare const FlowRequirements: z.ZodObject<{
         title: z.ZodString;
     }, z.core.$strict>>;
     hiddenNodes: z.ZodNumber;
-    tools: z.ZodArray<z.ZodString>;
+    servers: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export type FlowRequirements = z.infer<typeof FlowRequirements>;
 export declare const FlowValidation: z.ZodObject<{
@@ -801,9 +801,9 @@ export declare const SaveFlowVersionInput: z.ZodObject<{
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"tool">;
             configuration: z.ZodObject<{
-                toolName: z.ZodString;
+                server: z.ZodString;
+                allow: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
                 fingerprint: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
             }, z.core.$strict>;
             id: z.ZodString;
             position: z.ZodObject<{
@@ -899,6 +899,21 @@ export declare const FlowPublishCall: z.ZodObject<{
     available: z.ZodBoolean;
 }, z.core.$strict>;
 export type FlowPublishCall = z.infer<typeof FlowPublishCall>;
+/**
+ * What a tool step will be allowed to reach once this version is published (#517).
+ *
+ * ⚠️ It is in the preview because publishing FREEZES it: from that moment the step's surface is
+ * pinned, and a function the provider adds later is not inherited. An author who cannot see the
+ * surface before confirming is asked to freeze something they were never shown.
+ */
+export declare const FlowPublishTool: z.ZodObject<{
+    nodeId: z.ZodString;
+    nodeLabel: z.ZodString;
+    server: z.ZodString;
+    allow: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    available: z.ZodBoolean;
+}, z.core.$strict>;
+export type FlowPublishTool = z.infer<typeof FlowPublishTool>;
 export declare const FlowPublishPreview: z.ZodObject<{
     flowId: z.ZodString;
     versionId: z.ZodString;
@@ -917,6 +932,13 @@ export declare const FlowPublishPreview: z.ZodObject<{
         freezes: z.ZodBoolean;
         available: z.ZodBoolean;
     }, z.core.$strict>>;
+    tools: z.ZodArray<z.ZodObject<{
+        nodeId: z.ZodString;
+        nodeLabel: z.ZodString;
+        server: z.ZodString;
+        allow: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        available: z.ZodBoolean;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type FlowPublishPreview = z.infer<typeof FlowPublishPreview>;
 export declare const RelationNodeKind: z.ZodEnum<{

package/dist/contract/flow.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { IdempotencyKey, IntelId, IsoDateTime, LinkConfiguration } from "./contract.js";
-import { ToolName } from "./tool.js";
+import { serverOf, ToolName, ToolServerHandle } from "./tool.js";
 export const FlowNodeId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/);
 export const FlowPosition = z.strictObject({ x: z.number().finite(), y: z.number().finite() });
 // A node has a title and nothing else to write in prose (#39). A second free text beside it was
@@ -77,17 +77,60 @@ export const FlowNode = z.discriminatedUnion("kind", [
     }),
     z.strictObject({ ...FlowNodeBase, kind: z.literal("upload"), configuration: LinkConfiguration }),
     z.strictObject({ ...FlowNodeBase, kind: z.literal("table"), configuration: LinkConfiguration }),
+    /**
+     * A tool step names a SERVER, and optionally the functions of it that this step may use.
+     *
+     * ⚠️ It named a single function until #489, together with a raw argument object the author had to
+     * write as JSON. That modelled the protocol instead of the intent: an author gives a step access
+     * to Notion; WHICH of Notion's 28 functions runs, and with which arguments, follows from the
+     * step's instruction and can only be known while the flow runs.
+     *
+     * `allow: null` means every function of that server. A list narrows it, and every entry has to
+     * belong to `server` — checked below, because a name from another server would make the step ask
+     * for something the portal routes somewhere else entirely.
+     *
+     * ⚠️ `allow` is an INSTRUCTION to the agent, not a boundary Intel enforces (#518). Intel is a
+     * library: it says what is to be done, it does not execute. A flow is carried out by an agent
+     * that reaches the portal with its OWN token, and that agent may call the portal directly —
+     * Intel never sees the call. What bounds it is the agent's own portal grant, checked by the
+     * portal on every call; what `allow` does is tell the agent which of those functions this step
+     * is meant to use, the same way an instruction step tells it what to write.
+     *
+     * That is not a gap to be closed by adding a check here. Enforcing it would mean routing every
+     * call through Intel and making it the executor — the one thing this product is not.
+     *
+     * ⚠️ There is deliberately no `arguments` field any more. Arguments are produced at run time and
+     * validated against the tool's own `inputSchema` from a live `tools/list`; a stored copy would be
+     * a second source for something the far side already defines, and it would go stale silently.
+     */
     z.strictObject({
         ...FlowNodeBase,
         kind: z.literal("tool"),
-        configuration: z.strictObject({
-            toolName: ToolName,
+        configuration: z
+            .strictObject({
+            server: ToolServerHandle,
+            allow: z.array(ToolName).nullable().default(null),
             fingerprint: z
                 .string()
                 .regex(/^[a-f0-9]{64}$/)
                 .nullable()
                 .default(null),
-            arguments: z.record(z.string(), z.unknown()).default({}),
+        })
+            .check((ctx) => {
+            const { server, allow } = ctx.value;
+            if (allow === null)
+                return;
+            // The prefix rule is the contract's own (`serverOf`), so a step cannot claim a function
+            // that the portal would route somewhere else entirely.
+            for (const name of allow) {
+                if (serverOf(name, [server]) === null) {
+                    ctx.issues.push({
+                        code: "custom",
+                        input: name,
+                        message: `An allowed function has to belong to the step's server: ${name} is not a function of ${server}`,
+                    });
+                }
+            }
         }),
     }),
     z.strictObject({
@@ -222,7 +265,7 @@ export const FlowRequirements = z.strictObject({
     versionId: IntelId.nullable(),
     nodes: z.array(ReferencedNode),
     hiddenNodes: z.number().int().nonnegative(),
-    tools: z.array(ToolName),
+    servers: z.array(ToolServerHandle),
 });
 // What stands between this flow and a run, asked on demand and answered for the person asking.
 //
@@ -372,10 +415,28 @@ export const FlowPublishCall = z.strictObject({
     // The callee has a published version to be called at all. `false` is what publishing will refuse.
     available: z.boolean(),
 });
+/**
+ * What a tool step will be allowed to reach once this version is published (#517).
+ *
+ * ⚠️ It is in the preview because publishing FREEZES it: from that moment the step's surface is
+ * pinned, and a function the provider adds later is not inherited. An author who cannot see the
+ * surface before confirming is asked to freeze something they were never shown.
+ */
+export const FlowPublishTool = z.strictObject({
+    nodeId: FlowNodeId,
+    nodeLabel: z.string().min(1).max(160),
+    server: ToolServerHandle,
+    // `null` is "every function of that server". A list is what the step narrowed itself to, and it
+    // is spelled out rather than counted: the whole point of the preview is that a human can read it.
+    allow: z.array(ToolName).nullable(),
+    // The server is reachable for the person publishing. `false` is what publishing will refuse.
+    available: z.boolean(),
+});
 export const FlowPublishPreview = z.strictObject({
     flowId: IntelId,
     versionId: IntelId,
     calls: z.array(FlowPublishCall),
+    tools: z.array(FlowPublishTool),
 });
 // A flow has no share schema of its own. A grant sits on the folder a flow is filed in and inherits
 // down from there (ADR-0004 §2); a narrower grant beside it would destroy the subtree guarantee

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-contract",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {