@anchrd/intel-contract 0.19.0 → 0.21.0

package/README.md

@@ -95,10 +95,15 @@ edge and the tool ends up in the chain. The graph is then refused with
 `Node <id> is a link and must be attached to a step` — in `title`, per the first item above. A step
 may hold several links; one link belongs to exactly one step.
 
-### A flow is not a node, and carries no grants of its own
+### A flow is not a node, and has its own grant calls
 
-`node_grant_create` addresses nodes. A flow has no grants; it inherits those of the folder it lives
-in. To change who reaches a flow, share its folder — or move the flow.
+`node_grant_create` addresses nodes; `flow_grant_create` addresses flows. A flow is reached by both:
+the folder it is filed in passes its grants down, and a grant may sit on the flow itself. The two
+add up — the flow grant never replaces what the folder passes down.
+
+⚠️ A grant on one flow reaches **that flow** and nothing else — not the folder, and not the flows it
+calls. `ShareResult` says so: `unrunnable` names the sub-flows the new principal could not start,
+by title where you may see them and by count where you may not.
 
 ### Import takes its idempotency key as a header
 

package/dist/contract/bundle.d.ts

@@ -24,6 +24,19 @@ export declare const BundleEntryKind: z.ZodEnum<{
     flow: "flow";
 }>;
 export type BundleEntryKind = z.infer<typeof BundleEntryKind>;
+/**
+ * Why an entry carries no bytes although its kind normally does (#534).
+ *
+ * `no-content` is a node that has never been given any: a table created but never defined has no
+ * version, and an attachment created but never uploaded has none either, so there is nothing to
+ * write. That is a different sentence from "the content is gone", which the export refuses as
+ * `content_missing` — and a file of zero bytes cannot say which of the two it is, which is exactly
+ * what it used to do.
+ */
+export declare const BundleEntryAbsence: z.ZodEnum<{
+    "no-content": "no-content";
+}>;
+export type BundleEntryAbsence = z.infer<typeof BundleEntryAbsence>;
 export declare const BundleManifestEntry: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodEnum<{
@@ -39,6 +52,9 @@ export declare const BundleManifestEntry: z.ZodObject<{
     description: z.ZodNullable<z.ZodString>;
     mediaType: z.ZodNullable<z.ZodString>;
     path: z.ZodString;
+    absence: z.ZodOptional<z.ZodEnum<{
+        "no-content": "no-content";
+    }>>;
 }, z.core.$strict>;
 export type BundleManifestEntry = z.infer<typeof BundleManifestEntry>;
 export declare const BundleExclusion: z.ZodEnum<{
@@ -67,6 +83,9 @@ export declare const BundleManifest: z.ZodObject<{
         description: z.ZodNullable<z.ZodString>;
         mediaType: z.ZodNullable<z.ZodString>;
         path: z.ZodString;
+        absence: z.ZodOptional<z.ZodEnum<{
+            "no-content": "no-content";
+        }>>;
     }, z.core.$strict>>;
     excluded: z.ZodArray<z.ZodEnum<{
         "version-history": "version-history";

package/dist/contract/bundle.js

@@ -27,17 +27,57 @@ export const BundleEntryKind = z.enum([
     "board",
     "flow",
 ]);
+/**
+ * Why an entry carries no bytes although its kind normally does (#534).
+ *
+ * `no-content` is a node that has never been given any: a table created but never defined has no
+ * version, and an attachment created but never uploaded has none either, so there is nothing to
+ * write. That is a different sentence from "the content is gone", which the export refuses as
+ * `content_missing` — and a file of zero bytes cannot say which of the two it is, which is exactly
+ * what it used to do.
+ */
+export const BundleEntryAbsence = z.enum(["no-content"]);
 // One entry of the manifest: the identity a re-import needs, next to the relative path where the
 // bytes sit in the zip. A folder carries no media type — it has no bytes.
-export const BundleManifestEntry = z.strictObject({
+export const BundleManifestEntry = z
+    .strictObject({
     id: IntelId,
     kind: BundleEntryKind,
     title: z.string().min(1).max(240),
     description: z.string().max(2_000).nullable(),
     mediaType: z.string().min(1).max(160).nullable(),
     // Relative to the zip root, forward slashes, no leading slash. Folders end with a slash so an
-    // empty folder still has an address.
+    // empty folder still has an address. An entry with an `absence` keeps its path even though no
+    // file sits there: the path is what puts the node in the tree on the way back in.
     path: z.string().min(1).max(4_000),
+    // ⚠️ OPTIONAL rather than nullable, and that is about files that already exist. This object is
+    // strict, so a required key would refuse every bundle written before #534 with
+    // `import_invalid_manifest` — a whole format broken over a word that only ever describes a node
+    // with nothing in it. Absent means the entry has its file, which is what every older bundle
+    // means.
+    absence: BundleEntryAbsence.optional(),
+})
+    /**
+     * ⚠️ Only a table or an attachment may declare an absence, and the guard belongs HERE rather
+     * than at the import.
+     *
+     * A bundle is somebody else's file, and the import reads this word as permission to skip the
+     * check that a manifest entry has its file in the zip. Left unrestricted, an entry saying
+     * `kind: "document"` with `absence: "no-content"` would walk past that check even when the file
+     * IS in the zip — and the document would be created empty, silently, with nothing refused.
+     *
+     * The two kinds named here are the ones whose canonical content is the whole of them: a table
+     * IS its CSV and an attachment IS its bytes, so for them "no content" is a state of the node
+     * rather than a claim about a file. A document without a version is a different case and stays
+     * out — an empty markdown file says the same thing about it without ambiguity (#534, #560).
+     *
+     * Refusing at the boundary is the difference between a named refusal and lost content: the
+     * import validates this schema before it plans anything, so a manifest like that fails as
+     * `import_invalid_manifest` instead of importing something the bundle does not say.
+     */
+    .refine((entry) => entry.absence === undefined || entry.kind === "table" || entry.kind === "attachment", {
+    message: "Only a table or attachment entry may declare an absence",
+    path: ["absence"],
 });
 // What an export leaves out on purpose, named so a bundle says it rather than a reader guessing:
 // version history, grants/shares, flow runs, and archived nodes are not in any bundle (#136).

package/dist/contract/contract.d.ts

@@ -2,6 +2,40 @@ import { z } from "zod";
 export declare const IntelId: z.ZodString;
 export declare const IsoDateTime: z.ZodISODateTime;
 export declare const IdempotencyKey: z.ZodString;
+/**
+ * The version a write is made against, in the one form every writer of versioned content takes it.
+ *
+ * ⚠️ It lived beside the two node writers until #459 and moved here when the flow graph became the
+ * third — the point at which the repository stops copying and names the thing. It could not simply
+ * be imported: `flow.ts` may not depend on `node.ts` (the graph is `table → node`, `flow-run →
+ * flow`, and everything → here), and a copy would have been a second place for one sentence to
+ * drift, which is exactly what `IdempotencyKey` above exists to avoid.
+ *
+ * ⚠️ Nullable and required are not the same thing, and here they stand together (#437). `null` is
+ * how something that has no version yet is addressed, and it is the only way to write its first
+ * content; leaving the field out says nothing at all and is refused. Whoever leaves it out is
+ * almost always holding a node or a flow created one call earlier, and the plain type error they
+ * used to get — "expected string, received undefined" — reads as "this field must be an id", about
+ * a field that cannot have one yet. Both refusals therefore name both ways instead.
+ *
+ * ⚠️ It stays required once a version exists, and that is what it is for: a mismatch is answered
+ * with a `409` rather than by overwriting somebody else's newer version. Making it `optional()` to
+ * smooth the first write is the repair that breaks the guard — an absent field would then have to
+ * mean "there is none", and the forgetful caller silently replaces the newest one.
+ *
+ * ⚠️ The bounds remain `IntelId`'s. The repeated `min(1)` adds no rule — it only puts the sentence
+ * on the second value that gets tried after `undefined`, the empty string.
+ *
+ * ⚠️ The sentence says what the field TAKES, not what the caller did wrong. It answers a wrong type
+ * as well as an absent field, and "is required" would be false about the first — which would be
+ * this same ticket one corner further on. A value that is merely too long keeps Zod's own `Too
+ * big`: that one is already a true statement about what was sent.
+ *
+ * ⚠️ The JSON Schema it produces is the one `IntelId.nullable()` produced — an `anyOf` of the
+ * bounded string and `null`, still `required` — so nothing on the MCP surface moves when a field
+ * changes over to it.
+ */
+export declare function baseVersion(rule: string): z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
 export declare const UI_LANGUAGES: readonly ["en", "de", "es"];
 export type UiLanguage = (typeof UI_LANGUAGES)[number];
 export declare const ProblemDetails: z.ZodObject<{

package/dist/contract/contract.js

@@ -13,6 +13,42 @@ export const IdempotencyKey = z
     .min(8)
     .max(200)
     .describe("A caller-chosen key that makes this call safe to retry: repeating the same key returns the first result instead of doing the work twice. Reuse the SAME key when retrying one attempt, and a new one for a genuinely new call.");
+/**
+ * The version a write is made against, in the one form every writer of versioned content takes it.
+ *
+ * ⚠️ It lived beside the two node writers until #459 and moved here when the flow graph became the
+ * third — the point at which the repository stops copying and names the thing. It could not simply
+ * be imported: `flow.ts` may not depend on `node.ts` (the graph is `table → node`, `flow-run →
+ * flow`, and everything → here), and a copy would have been a second place for one sentence to
+ * drift, which is exactly what `IdempotencyKey` above exists to avoid.
+ *
+ * ⚠️ Nullable and required are not the same thing, and here they stand together (#437). `null` is
+ * how something that has no version yet is addressed, and it is the only way to write its first
+ * content; leaving the field out says nothing at all and is refused. Whoever leaves it out is
+ * almost always holding a node or a flow created one call earlier, and the plain type error they
+ * used to get — "expected string, received undefined" — reads as "this field must be an id", about
+ * a field that cannot have one yet. Both refusals therefore name both ways instead.
+ *
+ * ⚠️ It stays required once a version exists, and that is what it is for: a mismatch is answered
+ * with a `409` rather than by overwriting somebody else's newer version. Making it `optional()` to
+ * smooth the first write is the repair that breaks the guard — an absent field would then have to
+ * mean "there is none", and the forgetful caller silently replaces the newest one.
+ *
+ * ⚠️ The bounds remain `IntelId`'s. The repeated `min(1)` adds no rule — it only puts the sentence
+ * on the second value that gets tried after `undefined`, the empty string.
+ *
+ * ⚠️ The sentence says what the field TAKES, not what the caller did wrong. It answers a wrong type
+ * as well as an absent field, and "is required" would be false about the first — which would be
+ * this same ticket one corner further on. A value that is merely too long keeps Zod's own `Too
+ * big`: that one is already a true statement about what was sent.
+ *
+ * ⚠️ The JSON Schema it produces is the one `IntelId.nullable()` produced — an `anyOf` of the
+ * bounded string and `null`, still `required` — so nothing on the MCP surface moves when a field
+ * changes over to it.
+ */
+export function baseVersion(rule) {
+    return z.union([IntelId.min(1, { error: rule }), z.null()], { error: rule });
+}
 // The languages whose UI catalog ships inside intel-ui. They live here rather than only in the UI
 // because `intel build` has to know them: a built-in language may be chosen as `ui.defaultLanguage`
 // without the customer listing a copy under `ui.languages` that would rot at every UI update.

package/dist/contract/flow.d.ts

@@ -672,6 +672,7 @@ export declare const FlowRequirements: z.ZodObject<{
         id: z.ZodString;
         title: z.ZodString;
     }, z.core.$strict>>;
+    invalidNodes: z.ZodArray<z.ZodString>;
     hiddenNodes: z.ZodNumber;
     servers: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
@@ -730,7 +731,7 @@ export declare const GetFlowInput: z.ZodObject<{
 export type GetFlowInput = z.infer<typeof GetFlowInput>;
 export declare const SaveFlowVersionInput: z.ZodObject<{
     flowId: z.ZodString;
-    baseVersionId: z.ZodNullable<z.ZodString>;
+    baseVersionId: z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
     graph: z.ZodObject<{
         nodes: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"trigger">;

package/dist/contract/flow.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { IdempotencyKey, IntelId, IsoDateTime, LinkConfiguration } from "./contract.js";
+import { baseVersion, IdempotencyKey, IntelId, IsoDateTime, LinkConfiguration, } from "./contract.js";
 import { serverOf, ToolName, ToolServerHandle } from "./tool.js";
 export const FlowNodeId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/);
 export const FlowPosition = z.strictObject({ x: z.number().finite(), y: z.number().finite() });
@@ -259,11 +259,24 @@ export const ReferencedNode = z.strictObject({
 // (ADR-0004 §4). For tools it can only ever be the latter, because the catalog is a live query with
 // the requesting user's own token (ADR-0003).
 //
-// ⚠️ `nodes` names only what the asking user may see. The rest is `hiddenNodes`, a count.
+// ⚠️ `nodes` names only what the asking user may see. The rest falls into TWO fields, and keeping
+// them apart is the whole of #509: `invalidNodes` are references that name nothing at all any more,
+// `hiddenNodes` is a count of the ones that exist and are out of this reader's reach.
+//
+// ⚠️ They used to be one number, and the number was read out as "you cannot see it" — a sentence
+// about a PERMISSION, in front of a broken link. The two states suggest opposite actions and only
+// one of them helps: with a permission one asks for access and waits, with a dead reference the step
+// has to be replaced before the flow can run at all. #492 decided that such a reference is marked
+// visibly invalid rather than left silently pointed at an id nothing answers.
+//
+// ⚠️ `invalidNodes` carries IDS, never titles, and that is not the same concession `hiddenNodes`
+// makes. There is nothing left to name — the row is gone — and the id is one the caller sent us out
+// of a graph they may already read, so it discloses nothing they did not write themselves.
 export const FlowRequirements = z.strictObject({
     flowId: IntelId,
     versionId: IntelId.nullable(),
     nodes: z.array(ReferencedNode),
+    invalidNodes: z.array(IntelId),
     hiddenNodes: z.number().int().nonnegative(),
     servers: z.array(ToolServerHandle),
 });
@@ -375,7 +388,12 @@ export const GetFlowInput = z.strictObject({
 });
 export const SaveFlowVersionInput = z.strictObject({
     flowId: IntelId.describe("Flow to append a version to."),
-    baseVersionId: IntelId.nullable().describe("The version this edit was made against, from flow_get, or `null` for a flow that has none yet. If the flow has moved on since, the call is refused rather than overwriting the newer version."),
+    // ⚠️ `baseVersion`, not `IntelId.nullable()` (#459). The field is required-nullable either way;
+    // what changes is what a caller who left it out is told. Zod's own `expected string, received
+    // undefined` reads as "this needs an id" to somebody holding a flow created one call earlier —
+    // whose `currentVersionId` is `null` and can be nothing else. That reading cost a session at
+    // #437, and this was the third field carrying it.
+    baseVersionId: baseVersion("baseVersionId takes the `currentVersionId` from flow_get, or null when the flow has no version yet — and it has to be sent.").describe("The version this edit was made against, from flow_get, or `null` for a flow that has none yet. If the flow has moved on since, the call is refused rather than overwriting the newer version."),
     graph: FlowGraph.describe("The complete graph — nodes and edges — not a patch. It is validated before it is stored, so an unreachable node or a dangling edge is refused here rather than at run time."),
     idempotencyKey: IdempotencyKey,
 });
@@ -438,9 +456,9 @@ export const FlowPublishPreview = z.strictObject({
     calls: z.array(FlowPublishCall),
     tools: z.array(FlowPublishTool),
 });
-// A flow has no share schema of its own. A grant sits on the folder a flow is filed in and inherits
-// down from there (ADR-0004 §2); a narrower grant beside it would destroy the subtree guarantee
-// section 3 rests on, so per-flow grants were removed rather than deprecated.
+// A flow's own sharing schemas live in `share.ts` beside the node's (#530): `ShareFlowInput`,
+// `RevokeFlowGrantInput`, `ListFlowGrantsInput`. They are there rather than here because a grant is
+// one subject with two kinds of target, not two features — and `ShareResult` answers for both.
 // What accesses what, for one level of the shared tree (#19). A folder answers it for its contents,
 // a single flow for itself. Documents and flows are two kinds of thing that share one tree
 // (ADR-0004 §1), so the graph carries both and says which of them it is.

package/dist/contract/node.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { IdempotencyKey, IntelId, IsoDateTime } from "./contract.js";
+import { baseVersion, IdempotencyKey, IntelId, IsoDateTime } from "./contract.js";
 // What this installation is equipped to do — deployment facts, never the caller's permissions
 // (those stay behind each door, where `/session` deliberately does not carry them). `agentRuntime`
 // says whether an agent Worker is bound at all (#190): without it the UI offers no "New agent" and
@@ -95,30 +95,6 @@ export const CreateNodeInput = z.strictObject({
         .describe("Optional sentence about the node, for readers rather than for search ranking."),
     idempotencyKey: IdempotencyKey,
 });
-/**
- * The version a write is made against, in the one form both writers of node content take it.
- *
- * ⚠️ Nullable and required are not the same thing, and here they stand together (#437). `null` is
- * how a node that has no version yet is addressed, and it is the only way to write its first
- * content; leaving the field out says nothing at all and is refused. Whoever leaves it out is
- * almost always holding a node created one call earlier, and the plain type error they used to get
- * — "expected string, received undefined" — reads as "this field must be an id", about a field that
- * cannot have one yet. Both refusals therefore name both ways instead.
- *
- * ⚠️ It stays required once a version exists, and that is what it is for: a mismatch is answered
- * with a `409` rather than by overwriting somebody else's newer version.
- *
- * ⚠️ The bounds remain `IntelId`'s. The repeated `min(1)` adds no rule — it only puts the sentence
- * on the second value that gets tried after `undefined`, the empty string.
- *
- * ⚠️ The sentence says what the field TAKES, not what the caller did wrong. It answers a wrong type
- * as well as an absent field, and "is required" would be false about the first — which would be
- * this same ticket one corner further on. A value that is merely too long keeps Zod's own `Too
- * big`: that one is already a true statement about what was sent.
- */
-function baseVersion(rule) {
-    return z.union([IntelId.min(1, { error: rule }), z.null()], { error: rule });
-}
 export const SaveNodeVersionInput = z.strictObject({
     nodeId: IntelId.describe("Document node to append a version to."),
     baseVersionId: baseVersion("baseVersionId takes the `currentVersionId` from node_get, or null when the node has no version yet — and it has to be sent.").describe("The version this edit was made against — `currentVersionId` from node_get. If the node has moved on since, the call is refused rather than overwriting the newer version; pass `null` only for a node that has no version yet."),

package/dist/contract/share.d.ts

@@ -20,6 +20,10 @@ export declare const ListGrantsInput: z.ZodObject<{
     resourceId: z.ZodString;
 }, z.core.$strict>;
 export type ListGrantsInput = z.infer<typeof ListGrantsInput>;
+export declare const ListFlowGrantsInput: z.ZodObject<{
+    flowId: z.ZodString;
+}, z.core.$strict>;
+export type ListFlowGrantsInput = z.infer<typeof ListFlowGrantsInput>;
 export declare const ResourceGrant: z.ZodObject<{
     id: z.ZodString;
     resourceId: z.ZodString;
@@ -70,6 +74,33 @@ export declare const RevokeGrantInput: z.ZodObject<{
     idempotencyKey: z.ZodString;
 }, z.core.$strict>;
 export type RevokeGrantInput = z.infer<typeof RevokeGrantInput>;
+export declare const ShareFlowInput: z.ZodObject<{
+    flowId: z.ZodString;
+    principal: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        id: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        email: z.ZodEmail;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"organization">;
+    }, z.core.$strict>], "type">;
+    verb: z.ZodEnum<{
+        read: "read";
+        write: "write";
+        execute: "execute";
+        share: "share";
+    }>;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type ShareFlowInput = z.infer<typeof ShareFlowInput>;
+export declare const RevokeFlowGrantInput: z.ZodObject<{
+    flowId: z.ZodString;
+    grantId: z.ZodString;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type RevokeFlowGrantInput = z.infer<typeof RevokeFlowGrantInput>;
 export declare const UnreadableNodes: z.ZodObject<{
     titles: z.ZodArray<z.ZodString>;
     hidden: z.ZodNumber;
@@ -102,6 +133,10 @@ export declare const ShareResult: z.ZodObject<{
         titles: z.ZodArray<z.ZodString>;
         hidden: z.ZodNumber;
     }, z.core.$strict>;
+    unrunnable: z.ZodDefault<z.ZodObject<{
+        titles: z.ZodArray<z.ZodString>;
+        hidden: z.ZodNumber;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ShareResult = z.infer<typeof ShareResult>;
 export declare const ResourceGrantList: z.ZodObject<{

package/dist/contract/share.js

@@ -17,6 +17,12 @@ export const SharePrincipal = z.discriminatedUnion("type", [
 export const ListGrantsInput = z.strictObject({
     resourceId: IntelId.describe("Node whose direct grants to list. Access inherited from a folder above is not a grant on this node and is not listed here."),
 });
+// The same three shapes for a flow (#530). Separate inputs rather than a widened `resourceId`,
+// because the id names a different table and a caller that passes the wrong kind should be told so
+// by the route it called rather than by a lookup that finds nothing.
+export const ListFlowGrantsInput = z.strictObject({
+    flowId: IntelId.describe("Flow whose direct grants to list. Access inherited from the folder it is filed in is not a grant on this flow and is not listed here."),
+});
 export const ResourceGrant = z.strictObject({
     id: IntelId,
     resourceId: IntelId,
@@ -26,13 +32,20 @@ export const ResourceGrant = z.strictObject({
     createdBy: IntelId,
     createdAt: IsoDateTime,
 });
+// The word means exactly the same thing on a node grant and on a flow grant, so it is described
+// once — the rule this package states about `IdempotencyKey`, applied within one file rather than
+// across the package. Two copies are two places to drift, and both of them ship in `tools/list`.
+//
+// ⚠️ What is refused is decided by `deps.now()` in the application layer and cannot be expressed
+// here (#442); this sentence names the answer a caller gets, it does not produce it.
+const GrantExpiresAt = IsoDateTime.nullable()
+    .default(null)
+    .describe("When the grant stops working, or `null` for one that does not expire on its own. A time that is not in the future is refused with `grant_already_expired`: a grant that could never work is not created.");
 export const ShareInput = z.strictObject({
     resourceId: IntelId.describe("Node to grant access to. A grant on a folder is inherited by everything beneath it, which is the usual way to share a whole area."),
     principal: SharePrincipal.describe("Who gets the access: a Gate user by id, someone by verified email address, or the whole organization."),
     verb: ResourceVerb.describe("What they may do. Each verb is granted on its own and none implies another: `read` reads, `write` writes, `execute` runs a flow, `share` passes access on. Seeing a process is deliberately separable from being allowed to start it."),
-    expiresAt: IsoDateTime.nullable()
-        .default(null)
-        .describe("When the grant stops working, or `null` for one that does not expire on its own."),
+    expiresAt: GrantExpiresAt,
     idempotencyKey: IdempotencyKey,
 });
 export const RevokeGrantInput = z.strictObject({
@@ -40,6 +53,18 @@ export const RevokeGrantInput = z.strictObject({
     grantId: IntelId.describe("The grant to withdraw, from node_grant_list."),
     idempotencyKey: IdempotencyKey,
 });
+export const ShareFlowInput = z.strictObject({
+    flowId: IntelId.describe("Flow to grant access to. A grant here reaches this flow and nothing else — not the folder it is filed in, and not the flows it calls."),
+    principal: SharePrincipal.describe("Who gets the access: a Gate user by id, someone by verified email address, or the whole organization."),
+    verb: ResourceVerb.describe("What they may do. Each verb is granted on its own and none implies another: `read` opens the flow, `write` edits it, `execute` runs it, `share` passes access on."),
+    expiresAt: GrantExpiresAt,
+    idempotencyKey: IdempotencyKey,
+});
+export const RevokeFlowGrantInput = z.strictObject({
+    flowId: IntelId.describe("Flow the grant sits on. Named alongside the grant id so access is decided on the flow."),
+    grantId: IntelId.describe("The grant to withdraw, from flow_grant_list."),
+    idempotencyKey: IdempotencyKey,
+});
 // What a grant does not cover, reported to whoever just made it. A flow in the shared folder may
 // read a document outside it, and the run is re-authorized against the person running it — so the
 // grant can be complete and the flow still stop for them (ADR-0004 §4).
@@ -53,9 +78,17 @@ export const UnreadableNodes = z.strictObject({
 // The grant is in the answer, so the warning cannot be mistaken for a refusal: it is written first
 // and described afterwards. Blocking would force everyone who uses a central policy document to
 // duplicate it, which is the opposite of what one tree is for (ADR-0004 §4).
+//
+// ⚠️ `unrunnable` is the second half of the same sentence and belongs to the flow grant (#530). A
+// grant on a folder covered every flow beneath it, so there was nothing to say; a grant on one flow
+// reaches that flow and stops, and the sub-flows it calls are then somebody else's to grant. It
+// carries the shape of `UnreadableNodes` because it answers the same question — what this grant
+// does NOT reach, named where the sharer may see it and counted where they may not — and it is
+// empty for every node grant.
 export const ShareResult = z.strictObject({
     grant: ResourceGrant,
     unreadable: UnreadableNodes,
+    unrunnable: UnreadableNodes.default({ titles: [], hidden: 0 }),
 });
 // `applicableVerbs` travels with the list because the answer is the business layer's, not the
 // screen's: a document has nothing to execute, so `execute` is not offered on one (ADR-0004 §2).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-contract",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {