@anchrd/intel-contract 0.18.0 → 0.19.0

package/dist/contract/flow.d.ts

@@ -899,6 +899,21 @@ export declare const FlowPublishCall: z.ZodObject<{
     available: z.ZodBoolean;
 }, z.core.$strict>;
 export type FlowPublishCall = z.infer<typeof FlowPublishCall>;
+/**
+ * What a tool step will be allowed to reach once this version is published (#517).
+ *
+ * ⚠️ It is in the preview because publishing FREEZES it: from that moment the step's surface is
+ * pinned, and a function the provider adds later is not inherited. An author who cannot see the
+ * surface before confirming is asked to freeze something they were never shown.
+ */
+export declare const FlowPublishTool: z.ZodObject<{
+    nodeId: z.ZodString;
+    nodeLabel: z.ZodString;
+    server: z.ZodString;
+    allow: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    available: z.ZodBoolean;
+}, z.core.$strict>;
+export type FlowPublishTool = z.infer<typeof FlowPublishTool>;
 export declare const FlowPublishPreview: z.ZodObject<{
     flowId: z.ZodString;
     versionId: z.ZodString;
@@ -917,6 +932,13 @@ export declare const FlowPublishPreview: z.ZodObject<{
         freezes: z.ZodBoolean;
         available: z.ZodBoolean;
     }, z.core.$strict>>;
+    tools: z.ZodArray<z.ZodObject<{
+        nodeId: z.ZodString;
+        nodeLabel: z.ZodString;
+        server: z.ZodString;
+        allow: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        available: z.ZodBoolean;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type FlowPublishPreview = z.infer<typeof FlowPublishPreview>;
 export declare const RelationNodeKind: z.ZodEnum<{

package/dist/contract/flow.js

@@ -86,8 +86,18 @@ export const FlowNode = z.discriminatedUnion("kind", [
      * step's instruction and can only be known while the flow runs.
      *
      * `allow: null` means every function of that server. A list narrows it, and every entry has to
-     * belong to `server` — checked below, because a name from another server would silently widen
-     * the step past the one thing this configuration is supposed to bound.
+     * belong to `server` — checked below, because a name from another server would make the step ask
+     * for something the portal routes somewhere else entirely.
+     *
+     * ⚠️ `allow` is an INSTRUCTION to the agent, not a boundary Intel enforces (#518). Intel is a
+     * library: it says what is to be done, it does not execute. A flow is carried out by an agent
+     * that reaches the portal with its OWN token, and that agent may call the portal directly —
+     * Intel never sees the call. What bounds it is the agent's own portal grant, checked by the
+     * portal on every call; what `allow` does is tell the agent which of those functions this step
+     * is meant to use, the same way an instruction step tells it what to write.
+     *
+     * That is not a gap to be closed by adding a check here. Enforcing it would mean routing every
+     * call through Intel and making it the executor — the one thing this product is not.
      *
      * ⚠️ There is deliberately no `arguments` field any more. Arguments are produced at run time and
      * validated against the tool's own `inputSchema` from a live `tools/list`; a stored copy would be
@@ -405,10 +415,28 @@ export const FlowPublishCall = z.strictObject({
     // The callee has a published version to be called at all. `false` is what publishing will refuse.
     available: z.boolean(),
 });
+/**
+ * What a tool step will be allowed to reach once this version is published (#517).
+ *
+ * ⚠️ It is in the preview because publishing FREEZES it: from that moment the step's surface is
+ * pinned, and a function the provider adds later is not inherited. An author who cannot see the
+ * surface before confirming is asked to freeze something they were never shown.
+ */
+export const FlowPublishTool = z.strictObject({
+    nodeId: FlowNodeId,
+    nodeLabel: z.string().min(1).max(160),
+    server: ToolServerHandle,
+    // `null` is "every function of that server". A list is what the step narrowed itself to, and it
+    // is spelled out rather than counted: the whole point of the preview is that a human can read it.
+    allow: z.array(ToolName).nullable(),
+    // The server is reachable for the person publishing. `false` is what publishing will refuse.
+    available: z.boolean(),
+});
 export const FlowPublishPreview = z.strictObject({
     flowId: IntelId,
     versionId: IntelId,
     calls: z.array(FlowPublishCall),
+    tools: z.array(FlowPublishTool),
 });
 // A flow has no share schema of its own. A grant sits on the folder a flow is filed in and inherits
 // down from there (ADR-0004 §2); a narrower grant beside it would destroy the subtree guarantee

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-contract",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {