@anchrd/intel-contract 0.21.0 → 0.23.0

package/dist/contract/audit.d.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+export declare const AuditResourceType: z.ZodEnum<{
+    node: "node";
+}>;
+export type AuditResourceType = z.infer<typeof AuditResourceType>;
+export declare const AuditEvent: z.ZodObject<{
+    id: z.ZodString;
+    actorId: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodEnum<{
+        node: "node";
+    }>;
+    resourceId: z.ZodString;
+    metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    occurredAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type AuditEvent = z.infer<typeof AuditEvent>;
+export declare const AuditCursor: z.ZodString;
+export declare const AuditListRequest: z.ZodObject<{
+    resourceType: z.ZodEnum<{
+        node: "node";
+    }>;
+    after: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type AuditListRequest = z.infer<typeof AuditListRequest>;
+export declare const AuditListResponse: z.ZodObject<{
+    events: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        actorId: z.ZodString;
+        action: z.ZodString;
+        resourceType: z.ZodEnum<{
+            node: "node";
+        }>;
+        resourceId: z.ZodString;
+        metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        occurredAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type AuditListResponse = z.infer<typeof AuditListResponse>;

package/dist/contract/audit.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+import { IntelId, IsoDateTime } from "./contract.js";
+// Which kind of resource an event is about. The column already carries three values — `node`,
+// `flow` and `flow-run` — but each needs a DIFFERENT visibility check, and only the node one
+// exists as a reusable walk today (`subtreeCte`).
+//
+// ⚠️ This enum is deliberately narrower than the column (#620). It is the boundary of what the
+// reader is allowed to ask for, not a mirror of what is stored. Asking for `flow` is REFUSED
+// rather than answered with an empty list: an empty list reads as "nothing happened", and a
+// consumer building on that would miss every flow event without ever learning they exist. Widening
+// this enum later is an extension; answering silently would have been a change of meaning.
+export const AuditResourceType = z.enum(["node"]);
+// One line of the change journal. `resourceId` is the node the event is about; `actorId` is who
+// caused it. `metadata` is whatever the write site recorded — its shape belongs to `action` and is
+// deliberately not typed here, because a schema per action would have to be kept in step with 11
+// write sites and would go stale in silence.
+export const AuditEvent = z.strictObject({
+    id: IntelId,
+    actorId: z.string().min(1),
+    action: z.string().min(1),
+    resourceType: AuditResourceType,
+    resourceId: IntelId,
+    metadata: z.record(z.string(), z.unknown()),
+    occurredAt: IsoDateTime,
+});
+// ⚠️ Opaque BY CONTRACT, not merely by encoding. The reader gets a string back and hands the same
+// string in again; it must not take it apart, and it must not build one.
+//
+// The reason is that the cursor is a PAIR — `(occurredAt, id)` — and the pair is the whole point.
+// A timestamp alone cannot separate two events written in the same millisecond, which for a batch
+// is the normal case rather than the exception; a reader continuing on `occurredAt > X` skips the
+// second one silently. If the cursor were two fields, a caller would eventually send only the
+// timestamp, and the loss would look like nothing at all: no error, no log, just an event that
+// never arrived.
+export const AuditCursor = z.string().min(1).max(400);
+export const AuditListRequest = z.strictObject({
+    resourceType: AuditResourceType.describe("Which kind of resource to read events about. Only `node` can be listed today; asking for anything else is refused rather than answered with an empty list."),
+    after: AuditCursor.optional().describe("Where to continue: the `nextCursor` of a previous answer, passed back unchanged. Omit it to start at the oldest event you may see. Do not build one — it is opaque on purpose."),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(200)
+        .default(50)
+        .describe("How many events to return at most. The answer may be shorter."),
+});
+// `nextCursor` is present exactly when another page may exist, and it is the cursor of the LAST
+// returned row — not a page number. A reader stores it and sends it back as `after`.
+//
+// ⚠️ `nextCursor` being present does not promise the next page is non-empty. The journal is a live
+// table and the rows a reader may see can shrink between calls; treating "cursor present" as
+// "more data" is a fair reading, treating an empty answer as "the feed ended" is not.
+export const AuditListResponse = z.strictObject({
+    events: z.array(AuditEvent),
+    nextCursor: AuditCursor.nullable(),
+});

package/dist/contract/board.d.ts

@@ -0,0 +1,94 @@
+import { z } from "zod";
+export declare const BoardColumn: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    terminal: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type BoardColumn = z.infer<typeof BoardColumn>;
+export declare const BoardTask: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    status: z.ZodString;
+    assigneeId: z.ZodNullable<z.ZodString>;
+    labels: z.ZodArray<z.ZodString>;
+    startDate: z.ZodNullable<z.ZodISODateTime>;
+    dueDate: z.ZodNullable<z.ZodISODateTime>;
+    dependsOn: z.ZodNullable<z.ZodString>;
+    position: z.ZodNumber;
+    archivedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type BoardTask = z.infer<typeof BoardTask>;
+export declare const BoardTaskFilter: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+    assigneeId: z.ZodOptional<z.ZodString>;
+    dueBefore: z.ZodOptional<z.ZodISODateTime>;
+    dependsOn: z.ZodOptional<z.ZodString>;
+    includeArchived: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type BoardTaskFilter = z.infer<typeof BoardTaskFilter>;
+export declare const BoardGetInput: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+    assigneeId: z.ZodOptional<z.ZodString>;
+    dueBefore: z.ZodOptional<z.ZodISODateTime>;
+    dependsOn: z.ZodOptional<z.ZodString>;
+    includeArchived: z.ZodDefault<z.ZodBoolean>;
+    boardId: z.ZodString;
+}, z.core.$strict>;
+export type BoardGetInput = z.infer<typeof BoardGetInput>;
+export declare const BoardView: z.ZodObject<{
+    boardId: z.ZodString;
+    title: z.ZodString;
+    columns: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        terminal: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    tasks: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        status: z.ZodString;
+        assigneeId: z.ZodNullable<z.ZodString>;
+        labels: z.ZodArray<z.ZodString>;
+        startDate: z.ZodNullable<z.ZodISODateTime>;
+        dueDate: z.ZodNullable<z.ZodISODateTime>;
+        dependsOn: z.ZodNullable<z.ZodString>;
+        position: z.ZodNumber;
+        archivedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type BoardView = z.infer<typeof BoardView>;
+export declare const BoardUpdateInput: z.ZodObject<{
+    boardId: z.ZodString;
+    columns: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        terminal: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type BoardUpdateInput = z.infer<typeof BoardUpdateInput>;
+export declare const BoardTaskCreateInput: z.ZodObject<{
+    boardId: z.ZodString;
+    title: z.ZodString;
+    status: z.ZodOptional<z.ZodString>;
+    assigneeId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    labels: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    startDate: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    dueDate: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    dependsOn: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type BoardTaskCreateInput = z.infer<typeof BoardTaskCreateInput>;
+export declare const BoardTaskUpdateInput: z.ZodObject<{
+    taskId: z.ZodString;
+    title: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodString>;
+    position: z.ZodOptional<z.ZodNumber>;
+    assigneeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    startDate: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    dueDate: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    dependsOn: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type BoardTaskUpdateInput = z.infer<typeof BoardTaskUpdateInput>;

package/dist/contract/board.js

@@ -0,0 +1,143 @@
+import { z } from "zod";
+import { IdempotencyKey, IntelId, IsoDateTime } from "./contract.js";
+// One column of a board. `terminal` is what "done" means here — a rule about the column rather than
+// a magic status name, so an installation may call it "Shipped" or "Abgerechnet" without anything
+// downstream having to know the word.
+export const BoardColumn = z.strictObject({
+    id: z.string().min(1).max(60).describe("Stable key stored on every task in this column."),
+    title: z.string().min(1).max(80).describe("What the column is called on screen."),
+    terminal: z
+        .boolean()
+        .default(false)
+        .describe("Whether a task in this column counts as finished. More than one column may be."),
+});
+// One card, as the board view needs it: everything to draw and sort by, and NOTHING from R2. The
+// body is fetched per task through `node_version_get` when somebody opens one.
+//
+// ⚠️ `position` is a float, not an index. Dropping a card between two neighbours is then the
+// midpoint of the two, and no other row is written. With integers every drop would renumber
+// everything below it, and two people dropping at once would fight over rows neither touched.
+export const BoardTask = z.strictObject({
+    id: IntelId.describe("The card's node id — its address everywhere else in Intel."),
+    title: z.string().min(1).max(240).describe("What the card says."),
+    status: z.string().min(1).max(60).describe("Which column it sits in."),
+    assigneeId: z.string().min(1).nullable(),
+    labels: z.array(z.string().min(1).max(40)),
+    startDate: IsoDateTime.nullable(),
+    dueDate: IsoDateTime.nullable(),
+    dependsOn: IntelId.nullable(),
+    position: z.number(),
+    archivedAt: IsoDateTime.nullable(),
+});
+// ⚠️ Every filter here is a COLUMN in `board_tasks`, and that is the whole reason the fields are not
+// in the body. A filter the application applies after reading has already fetched the rows — over
+// the wire, into memory, past the point where leaving them out would have helped.
+export const BoardTaskFilter = z.strictObject({
+    status: z
+        .string()
+        .min(1)
+        .max(60)
+        .optional()
+        .describe("Only tasks in this column. Omit for every column."),
+    assigneeId: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Only tasks assigned to this Gate principal. An agent is not a special case here."),
+    dueBefore: IsoDateTime.optional().describe("Only tasks due strictly before this moment. Tasks without a due date never match."),
+    dependsOn: IntelId.optional().describe("Only tasks waiting for this node — what `board_get` answers when you ask what one thing blocks."),
+    includeArchived: z
+        .boolean()
+        .default(false)
+        .describe("Include archived tasks beside the live ones instead of hiding them."),
+});
+export const BoardGetInput = BoardTaskFilter.extend({
+    boardId: IntelId.describe("The board node to read. Must be a node of kind `board`."),
+});
+// One answer for the whole board, not one per card.
+export const BoardView = z.strictObject({
+    boardId: IntelId,
+    title: z.string().min(1).max(240),
+    columns: z.array(BoardColumn),
+    tasks: z.array(BoardTask),
+});
+export const BoardUpdateInput = z.strictObject({
+    boardId: IntelId.describe("The board node whose columns are being set."),
+    columns: z
+        .array(BoardColumn)
+        .min(1)
+        .describe("The complete new column list, in order. Columns are replaced, not merged."),
+    idempotencyKey: IdempotencyKey,
+});
+export const BoardTaskCreateInput = z.strictObject({
+    boardId: IntelId.describe("The board the task is filed under. It becomes the task's parent."),
+    title: z.string().min(1).max(240).describe("What the card says on the board."),
+    // ⚠️ Optional, and absent means the FIRST column rather than an error. A caller who does not care
+    // where a task starts should not have to read the board first — and a task with no status would
+    // be a card no view can draw.
+    status: z
+        .string()
+        .min(1)
+        .max(60)
+        .optional()
+        .describe("Which column to file it in. Omit for the board's first column."),
+    assigneeId: z
+        .string()
+        .min(1)
+        .nullable()
+        .default(null)
+        .describe("Who it is for, as a Gate principal id. An agent is not a special case."),
+    labels: z
+        .array(z.string().min(1).max(40))
+        .default([])
+        .describe("Free-form tags. They are filtered on the board, not in search."),
+    startDate: IsoDateTime.nullable()
+        .default(null)
+        .describe("When work on it should begin. Only the timeline view draws it."),
+    dueDate: IsoDateTime.nullable()
+        .default(null)
+        .describe("When it is due. A card without one never matches a due-before filter."),
+    dependsOn: IntelId.nullable()
+        .default(null)
+        .describe("A node this task waits for. Any node, not only another task."),
+    idempotencyKey: IdempotencyKey,
+});
+// ⚠️ Moving a card IS this call: `status` and `position` together. There is deliberately no
+// `board_task_move` — it would be a second way to write one row, and a model reading `tools/list`
+// would have to guess which of the two applies.
+//
+// Every field is optional and absent means "leave it": a drag sends two fields, a rename sends one.
+// `null` is a value where the column is nullable, so clearing a due date is `dueDate: null` and not
+// its absence.
+export const BoardTaskUpdateInput = z.strictObject({
+    taskId: IntelId.describe("The card to change, by its node id."),
+    title: z
+        .string()
+        .min(1)
+        .max(240)
+        .optional()
+        .describe("Refused on purpose: a card's title lives on the node. Rename it with node_update."),
+    status: z.string().min(1).max(60).optional().describe("The column to move it to."),
+    position: z
+        .number()
+        .optional()
+        .describe("Where in the column. Use the midpoint between the two neighbours it lands between."),
+    assigneeId: z
+        .string()
+        .min(1)
+        .nullable()
+        .optional()
+        .describe("Who it is for. `null` unassigns it; leaving it out keeps whoever has it."),
+    labels: z
+        .array(z.string().min(1).max(40))
+        .optional()
+        .describe("The complete new tag list. Tags are replaced, not merged."),
+    startDate: IsoDateTime.nullable()
+        .optional()
+        .describe("When work should begin. `null` clears it."),
+    dueDate: IsoDateTime.nullable().optional().describe("When it is due. `null` clears it."),
+    dependsOn: IntelId.nullable()
+        .optional()
+        .describe("A node this card waits for. `null` clears the dependency."),
+    idempotencyKey: IdempotencyKey,
+});

package/dist/contract/bundle.d.ts

@@ -57,11 +57,30 @@ export declare const BundleManifestEntry: z.ZodObject<{
     }>>;
 }, z.core.$strict>;
 export type BundleManifestEntry = z.infer<typeof BundleManifestEntry>;
+/**
+ * What an export leaves out on purpose, named so a bundle says it rather than a reader guessing:
+ * version history, grants/shares, flow runs, and archived nodes are not in any bundle (#136).
+ *
+ * ⚠️ `unpublished-flow-changes` is the FIFTH, and it is the one exception to ADR-0006's own
+ * headline (#585). A bundle carries the current state of everything — except a flow that has been
+ * published, which travels as its PUBLISHED graph. Edits made after that publication are in no
+ * bundle, and they are not history: they are the newest state there is. The word exists because the
+ * loss is only acceptable while it is named, and `version-history` does not name it — a reader who
+ * saw only that word would expect the newest graph and get one that is deliberately older.
+ *
+ * ⚠️ These are WIRE values: an older reader refuses a bundle naming an exclusion it does not know,
+ * the same way it would refuse an unknown `kind`. The enum grows only for something an installation
+ * genuinely leaves behind, never as a place to note a nicety (ADR-0006, #433). Growing it costs the
+ * direction nobody migrates in — a bundle written HERE is refused by an installation older than
+ * this line, while every bundle written before it still parses, which is the direction 0.22.0's
+ * rebuild actually runs.
+ */
 export declare const BundleExclusion: z.ZodEnum<{
     "version-history": "version-history";
     grants: "grants";
     "flow-runs": "flow-runs";
     "archived-nodes": "archived-nodes";
+    "unpublished-flow-changes": "unpublished-flow-changes";
 }>;
 export type BundleExclusion = z.infer<typeof BundleExclusion>;
 export declare const BundleManifest: z.ZodObject<{
@@ -92,13 +111,37 @@ export declare const BundleManifest: z.ZodObject<{
         grants: "grants";
         "flow-runs": "flow-runs";
         "archived-nodes": "archived-nodes";
+        "unpublished-flow-changes": "unpublished-flow-changes";
     }>>;
 }, z.core.$strict>;
 export type BundleManifest = z.infer<typeof BundleManifest>;
+/**
+ * What one import made. Import always creates new nodes — no merge, no overwrite, no restored IDs
+ * (#137, phase 1) — so the answer is counts and the new roots, never a diff. `replayed` marks the
+ * idempotent second answer to the same key: nothing was created twice.
+ *
+ * ⚠️ `excluded` is what the IMPORT knows about itself, never what the bundle claimed (ADR-0006,
+ * #433). A subtree moved between installations arrives with one version per node, no grants and no
+ * runs, and until now nothing said so at the moment somebody could still act on it — the word stood
+ * only in a `manifest.json` inside the zip that had already been written.
+ *
+ * It is deliberately NOT read back out of that manifest. A hand-written bundle saying `excluded: []`
+ * would then make the import report that nothing was left behind, and the import would launder
+ * somebody else's claim into an answer that sounds like its own — the trap `absence` is bound
+ * against in `BundleManifestEntry` above (#534, #560). The five exclusions hold for every import
+ * this build performs, with a manifest or from a naked folder, so this is a constant of the code.
+ */
 export declare const BundleImportResult: z.ZodObject<{
     nodes: z.ZodNumber;
     flows: z.ZodNumber;
     rootNodeIds: z.ZodArray<z.ZodString>;
     replayed: z.ZodBoolean;
+    excluded: z.ZodArray<z.ZodEnum<{
+        "version-history": "version-history";
+        grants: "grants";
+        "flow-runs": "flow-runs";
+        "archived-nodes": "archived-nodes";
+        "unpublished-flow-changes": "unpublished-flow-changes";
+    }>>;
 }, z.core.$strict>;
 export type BundleImportResult = z.infer<typeof BundleImportResult>;

package/dist/contract/bundle.js

@@ -79,9 +79,31 @@ export const BundleManifestEntry = z
     message: "Only a table or attachment entry may declare an absence",
     path: ["absence"],
 });
-// What an export leaves out on purpose, named so a bundle says it rather than a reader guessing:
-// version history, grants/shares, flow runs, and archived nodes are not in any bundle (#136).
-export const BundleExclusion = z.enum(["version-history", "grants", "flow-runs", "archived-nodes"]);
+/**
+ * What an export leaves out on purpose, named so a bundle says it rather than a reader guessing:
+ * version history, grants/shares, flow runs, and archived nodes are not in any bundle (#136).
+ *
+ * ⚠️ `unpublished-flow-changes` is the FIFTH, and it is the one exception to ADR-0006's own
+ * headline (#585). A bundle carries the current state of everything — except a flow that has been
+ * published, which travels as its PUBLISHED graph. Edits made after that publication are in no
+ * bundle, and they are not history: they are the newest state there is. The word exists because the
+ * loss is only acceptable while it is named, and `version-history` does not name it — a reader who
+ * saw only that word would expect the newest graph and get one that is deliberately older.
+ *
+ * ⚠️ These are WIRE values: an older reader refuses a bundle naming an exclusion it does not know,
+ * the same way it would refuse an unknown `kind`. The enum grows only for something an installation
+ * genuinely leaves behind, never as a place to note a nicety (ADR-0006, #433). Growing it costs the
+ * direction nobody migrates in — a bundle written HERE is refused by an installation older than
+ * this line, while every bundle written before it still parses, which is the direction 0.22.0's
+ * rebuild actually runs.
+ */
+export const BundleExclusion = z.enum([
+    "version-history",
+    "grants",
+    "flow-runs",
+    "archived-nodes",
+    "unpublished-flow-changes",
+]);
 export const BundleManifest = z.strictObject({
     version: z.literal(1),
     exportedAt: IsoDateTime,
@@ -92,12 +114,26 @@ export const BundleManifest = z.strictObject({
     excluded: z.array(BundleExclusion),
 });
 // ── Bundle import (#137) ────────────────────────────────────────────────────────────────────────
-// What one import made. Import always creates new nodes — no merge, no overwrite, no restored IDs
-// (#137, phase 1) — so the answer is counts and the new roots, never a diff. `replayed` marks the
-// idempotent second answer to the same key: nothing was created twice.
+/**
+ * What one import made. Import always creates new nodes — no merge, no overwrite, no restored IDs
+ * (#137, phase 1) — so the answer is counts and the new roots, never a diff. `replayed` marks the
+ * idempotent second answer to the same key: nothing was created twice.
+ *
+ * ⚠️ `excluded` is what the IMPORT knows about itself, never what the bundle claimed (ADR-0006,
+ * #433). A subtree moved between installations arrives with one version per node, no grants and no
+ * runs, and until now nothing said so at the moment somebody could still act on it — the word stood
+ * only in a `manifest.json` inside the zip that had already been written.
+ *
+ * It is deliberately NOT read back out of that manifest. A hand-written bundle saying `excluded: []`
+ * would then make the import report that nothing was left behind, and the import would launder
+ * somebody else's claim into an answer that sounds like its own — the trap `absence` is bound
+ * against in `BundleManifestEntry` above (#534, #560). The five exclusions hold for every import
+ * this build performs, with a manifest or from a naked folder, so this is a constant of the code.
+ */
 export const BundleImportResult = z.strictObject({
     nodes: z.number().int().nonnegative(),
     flows: z.number().int().nonnegative(),
     rootNodeIds: z.array(IntelId),
     replayed: z.boolean(),
+    excluded: z.array(BundleExclusion),
 });

package/dist/contract/contract.d.ts

@@ -38,6 +38,38 @@ export declare const IdempotencyKey: z.ZodString;
 export declare function baseVersion(rule: string): z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
 export declare const UI_LANGUAGES: readonly ["en", "de", "es"];
 export type UiLanguage = (typeof UI_LANGUAGES)[number];
+/**
+ * A set of things the reader is only partly entitled to see: the ones they may see BY NAME, the
+ * rest as a NUMBER (ADR-0004 §3). Never the titles of the rest, in any field, ever — a warning or a
+ * refusal must not become a way of reading the tree.
+ *
+ * ⚠️ It lives here rather than in `share.ts` because two domains state it: a grant says what it
+ * does not reach (`UnreadableNodes`), and a refusal says who is still calling in
+ * (`ProblemDetails.callers`, #448). `contract.ts` may not import from `share.ts` — the graph
+ * between these files has to stay acyclic — and a copy would be a second place for one rule to
+ * drift, which is what `IdempotencyKey` and `baseVersion` above exist against.
+ */
+export declare const NamedOrCounted: z.ZodObject<{
+    titles: z.ZodArray<z.ZodString>;
+    hidden: z.ZodNumber;
+}, z.core.$strict>;
+export type NamedOrCounted = z.infer<typeof NamedOrCounted>;
+/**
+ * ⚠️ `callers` is the one member here that is not about every problem, and it is deliberate (#448).
+ * RFC 9457 allows extension members for exactly this: `folder_execute_in_use` refuses to narrow a
+ * library folder while flows from outside still call into it, and the CALLERS are the only thing
+ * that makes the refusal actionable. They used to exist only inside `detail` — an English sentence
+ * built on the server — so a German or Spanish surface could do nothing but print it verbatim, and
+ * no surface could shorten it or link the titles.
+ *
+ * The split is the point: the server decides WHAT is named and what is only counted, because that
+ * is an authorization answer nobody else can give; the surface decides how the sentence READS,
+ * because that is a language answer no server can give.
+ *
+ * `detail` keeps its sentence rather than emptying out — MCP hands a model prose and has nothing to
+ * formulate with, and an empty `detail` beside a new field would be the worst of the three states.
+ * It is absent on every other problem, so a reader must not treat its presence as guaranteed.
+ */
 export declare const ProblemDetails: z.ZodObject<{
     type: z.ZodString;
     status: z.ZodNumber;
@@ -45,6 +77,10 @@ export declare const ProblemDetails: z.ZodObject<{
     detail: z.ZodOptional<z.ZodString>;
     instance: z.ZodOptional<z.ZodString>;
     code: z.ZodOptional<z.ZodString>;
+    callers: z.ZodOptional<z.ZodObject<{
+        titles: z.ZodArray<z.ZodString>;
+        hidden: z.ZodNumber;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ProblemDetails = z.infer<typeof ProblemDetails>;
 export declare const SessionUser: z.ZodObject<{

package/dist/contract/contract.js

@@ -57,6 +57,37 @@ export function baseVersion(rule) {
 // `i18n.unit.ts` compares it against the catalogs actually built in; a language listed here without
 // a file gives a red run there instead of a UI that starts on a catalog which does not exist.
 export const UI_LANGUAGES = ["en", "de", "es"];
+/**
+ * A set of things the reader is only partly entitled to see: the ones they may see BY NAME, the
+ * rest as a NUMBER (ADR-0004 §3). Never the titles of the rest, in any field, ever — a warning or a
+ * refusal must not become a way of reading the tree.
+ *
+ * ⚠️ It lives here rather than in `share.ts` because two domains state it: a grant says what it
+ * does not reach (`UnreadableNodes`), and a refusal says who is still calling in
+ * (`ProblemDetails.callers`, #448). `contract.ts` may not import from `share.ts` — the graph
+ * between these files has to stay acyclic — and a copy would be a second place for one rule to
+ * drift, which is what `IdempotencyKey` and `baseVersion` above exist against.
+ */
+export const NamedOrCounted = z.strictObject({
+    titles: z.array(z.string().min(1).max(240)),
+    hidden: z.number().int().nonnegative(),
+});
+/**
+ * ⚠️ `callers` is the one member here that is not about every problem, and it is deliberate (#448).
+ * RFC 9457 allows extension members for exactly this: `folder_execute_in_use` refuses to narrow a
+ * library folder while flows from outside still call into it, and the CALLERS are the only thing
+ * that makes the refusal actionable. They used to exist only inside `detail` — an English sentence
+ * built on the server — so a German or Spanish surface could do nothing but print it verbatim, and
+ * no surface could shorten it or link the titles.
+ *
+ * The split is the point: the server decides WHAT is named and what is only counted, because that
+ * is an authorization answer nobody else can give; the surface decides how the sentence READS,
+ * because that is a language answer no server can give.
+ *
+ * `detail` keeps its sentence rather than emptying out — MCP hands a model prose and has nothing to
+ * formulate with, and an empty `detail` beside a new field would be the worst of the three states.
+ * It is absent on every other problem, so a reader must not treat its presence as guaranteed.
+ */
 export const ProblemDetails = z.strictObject({
     type: z.string(),
     status: z.number().int().min(400).max(599),
@@ -64,6 +95,7 @@ export const ProblemDetails = z.strictObject({
     detail: z.string().optional(),
     instance: z.string().optional(),
     code: z.string().optional(),
+    callers: NamedOrCounted.optional(),
 });
 // Who the caller is, as Gate resolved it from the bearer: no token, and no capability list.
 //

package/dist/contract/flow-run.d.ts

@@ -223,8 +223,8 @@ export declare const CompleteFlowRunStepInput: z.ZodObject<{
 }, z.core.$strict>;
 export type CompleteFlowRunStepInput = z.infer<typeof CompleteFlowRunStepInput>;
 export declare const FlowRunTrigger: z.ZodEnum<{
-    subflow: "subflow";
     manual: "manual";
+    subflow: "subflow";
 }>;
 export type FlowRunTrigger = z.infer<typeof FlowRunTrigger>;
 export declare const FlowRunFailure: z.ZodObject<{
@@ -246,8 +246,8 @@ export declare const FlowRunSummary: z.ZodObject<{
         cancelled: "cancelled";
     }>;
     trigger: z.ZodEnum<{
-        subflow: "subflow";
         manual: "manual";
+        subflow: "subflow";
     }>;
     startedAt: z.ZodISODateTime;
     completedAt: z.ZodNullable<z.ZodISODateTime>;
@@ -282,8 +282,8 @@ export declare const FlowRunList: z.ZodObject<{
             cancelled: "cancelled";
         }>;
         trigger: z.ZodEnum<{
-            subflow: "subflow";
             manual: "manual";
+            subflow: "subflow";
         }>;
         startedAt: z.ZodISODateTime;
         completedAt: z.ZodNullable<z.ZodISODateTime>;

package/dist/contract/flow.d.ts

@@ -947,7 +947,9 @@ export declare const RelationNodeKind: z.ZodEnum<{
     document: "document";
     table: "table";
     attachment: "attachment";
+    board: "board";
     flow: "flow";
+    task: "task";
 }>;
 export type RelationNodeKind = z.infer<typeof RelationNodeKind>;
 export declare const RelationNode: z.ZodObject<{
@@ -957,7 +959,9 @@ export declare const RelationNode: z.ZodObject<{
         document: "document";
         table: "table";
         attachment: "attachment";
+        board: "board";
         flow: "flow";
+        task: "task";
     }>;
     title: z.ZodString;
     inScope: z.ZodBoolean;
@@ -1007,7 +1011,9 @@ export declare const RelationGraph: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
             flow: "flow";
+            task: "task";
         }>;
         title: z.ZodString;
         inScope: z.ZodBoolean;

package/dist/contract/flow.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { baseVersion, IdempotencyKey, IntelId, IsoDateTime, LinkConfiguration, } from "./contract.js";
+import { NodeKind } from "./node.js";
 import { serverOf, ToolName, ToolServerHandle } from "./tool.js";
 export const FlowNodeId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/);
 export const FlowPosition = z.strictObject({ x: z.number().finite(), y: z.number().finite() });
@@ -462,7 +463,13 @@ export const FlowPublishPreview = z.strictObject({
 // What accesses what, for one level of the shared tree (#19). A folder answers it for its contents,
 // a single flow for itself. Documents and flows are two kinds of thing that share one tree
 // (ADR-0004 §1), so the graph carries both and says which of them it is.
-export const RelationNodeKind = z.enum(["folder", "document", "attachment", "table", "flow"]);
+//
+// ⚠️ **DERIVED from `NodeKind`, not written out beside it** (#376). It was a hand-kept copy until
+// D66 added two kinds, and the copy did not follow — the graph would have gone on answering about
+// four kinds while the tree held six, and nothing would have said so. That is the same failure
+// `check:boundaries` refuses elsewhere; here the extra member `flow` had kept it out of the
+// checker's reach.
+export const RelationNodeKind = z.enum([...NodeKind.options, "flow"]);
 export const RelationNode = z.strictObject({
     id: IntelId,
     kind: RelationNodeKind,

package/dist/contract/node.d.ts

@@ -4,6 +4,8 @@ export declare const NodeKind: z.ZodEnum<{
     document: "document";
     table: "table";
     attachment: "attachment";
+    board: "board";
+    task: "task";
 }>;
 export type NodeKind = z.infer<typeof NodeKind>;
 export declare const Node: z.ZodObject<{
@@ -14,6 +16,8 @@ export declare const Node: z.ZodObject<{
         document: "document";
         table: "table";
         attachment: "attachment";
+        board: "board";
+        task: "task";
     }>;
     title: z.ZodString;
     description: z.ZodNullable<z.ZodString>;
@@ -67,6 +71,8 @@ export declare const CreateNodeInput: z.ZodObject<{
         document: "document";
         table: "table";
         attachment: "attachment";
+        board: "board";
+        task: "task";
     }>;
     title: z.ZodString;
     description: z.ZodDefault<z.ZodNullable<z.ZodString>>;
@@ -133,6 +139,8 @@ export declare const NodeList: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -172,6 +180,8 @@ export declare const NodeDocument: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -208,6 +218,8 @@ export declare const NodeAttachment: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -244,6 +256,8 @@ export declare const NodeTable: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -266,8 +280,8 @@ export declare const NodeLinkRelation: z.ZodEnum<{
 }>;
 export type NodeLinkRelation = z.infer<typeof NodeLinkRelation>;
 export declare const NodeLinkOrigin: z.ZodEnum<{
-    manual: "manual";
     text: "text";
+    manual: "manual";
 }>;
 export type NodeLinkOrigin = z.infer<typeof NodeLinkOrigin>;
 export declare const NodeLink: z.ZodObject<{
@@ -281,8 +295,8 @@ export declare const NodeLink: z.ZodObject<{
         implements: "implements";
     }>;
     origin: z.ZodEnum<{
-        manual: "manual";
         text: "text";
+        manual: "manual";
     }>;
     label: z.ZodNullable<z.ZodString>;
     createdBy: z.ZodString;
@@ -301,8 +315,8 @@ export declare const NodeLinkList: z.ZodObject<{
             implements: "implements";
         }>;
         origin: z.ZodEnum<{
-            manual: "manual";
             text: "text";
+            manual: "manual";
         }>;
         label: z.ZodNullable<z.ZodString>;
         createdBy: z.ZodString;
@@ -340,6 +354,8 @@ export declare const NodeGraph: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -360,8 +376,8 @@ export declare const NodeGraph: z.ZodObject<{
             implements: "implements";
         }>;
         origin: z.ZodEnum<{
-            manual: "manual";
             text: "text";
+            manual: "manual";
         }>;
         label: z.ZodNullable<z.ZodString>;
         createdBy: z.ZodString;
@@ -392,8 +408,8 @@ export declare const NodeCitation: z.ZodObject<{
     freshness: z.ZodISODateTime;
     score: z.ZodNumber;
     match: z.ZodEnum<{
-        semantic: "semantic";
         lexical: "lexical";
+        semantic: "semantic";
         hybrid: "hybrid";
     }>;
 }, z.core.$strict>;
@@ -408,8 +424,8 @@ export declare const SearchResult: z.ZodObject<{
         freshness: z.ZodISODateTime;
         score: z.ZodNumber;
         match: z.ZodEnum<{
-            semantic: "semantic";
             lexical: "lexical";
+            semantic: "semantic";
             hybrid: "hybrid";
         }>;
     }, z.core.$strict>>;

package/dist/contract/node.js

@@ -4,17 +4,27 @@ import { baseVersion, IdempotencyKey, IntelId, IsoDateTime } from "./contract.js
 // (those stay behind each door, where `/session` deliberately does not carry them). `agentRuntime`
 // says whether an agent Worker is bound at all (#190): without it the UI offers no "New agent" and
 // an agent node explains itself instead of rendering views that could only end in a 503.
-// The fourth kind is `table` (#40), the fifth is `agent` (#139) and the sixth is `board` (#285).
+// The fourth kind is `table` (#40); `board` and `task` are the fifth and sixth (**D66**, #376).
 // Each is a kind of node, not a kind of thing: it hangs in the same folder tree, inherits the same
 // folder grants, carries the same immutable versions and the same R2 body as a document
-// (ADR-0004 §1, ADR-0005 §1). Only the media type and the operations below differ.
+// (ADR-0004 §1). Only the media type and the operations below differ. `agent` is NOT among them —
+// D65 moved agents out of Intel entirely (ADR-0007).
 //
-// ⚠️ `agent` being optional is load-bearing (ADR-0005 §1): an installation without a single agent
-// node is complete, not unfinished, and nothing here asks anyone to classify a document as a skill
-// or a policy in order to file it. The same holds for `board`: it is a file somebody may make, not
-// a place the tree grows a special corner for — which is exactly why a board is one node carrying
-// its tasks and not a folder that only tasks may live in (#285).
-export const NodeKind = z.enum(["folder", "document", "attachment", "table"]);
+// ⚠️ **The sentence that stood here said the opposite, and it was right for its day.** Until
+// 2026-08-20 this comment read *"a board is one node carrying its tasks and not a folder that only
+// tasks may live in (#285)"*. D66 reverses it, and the reason is not taste:
+//
+//   * **The tree has to hide `task` on EVERY level query.** As a kind that is a condition on a
+//     column already in the statement; as a `document` plus a side-table row it would be a join on
+//     the hottest path. And with tasks hidden a board has no visible children, so the chevron falls
+//     away with no rule of its own.
+//   * **`audit_list` exists since #620.** A task that is a node makes "task assigned to Paul" an
+//     event `anchrd/signals` can pick up. Inside one board's content every change looks the same
+//     from outside — "the board changed" — and nothing can act on it.
+//
+// ⚠️ What did NOT change: `status`, `assignee`, the dates and the ordering live in `board_tasks`,
+// not on the node. They are filter columns and would stand empty on every other kind.
+export const NodeKind = z.enum(["folder", "document", "attachment", "table", "board", "task"]);
 export const Node = z.strictObject({
     id: IntelId,
     parentId: IntelId.nullable(),
@@ -170,7 +180,13 @@ export const PurgeNodeInput = z.strictObject({
     nodeId: IntelId.describe("Node to delete for good. It must already be archived — a living node has no path into nothing."),
     idempotencyKey: IdempotencyKey,
 });
-export const PurgeNodePreviewInput = z.strictObject({ nodeId: IntelId });
+// The question `PurgeNodeInput` cannot be asked afterwards: what goes with it, while it is all
+// still there to be counted. Described since #586, because the count reached MCP that day — and a
+// surface that may delete without being able to look first is the state `destructive.md` calls a
+// confirmation that cannot name what disappears.
+export const PurgeNodePreviewInput = z.strictObject({
+    nodeId: IntelId.describe("Archived node a purge would delete. Answers how many items would go with it and how many documents link to it from outside, and changes nothing. A node that is not archived is refused here for the same reason node_purge refuses it."),
+});
 export const PurgeNodePreview = z.strictObject({
     inboundLinks: z.number().int().nonnegative(),
     totalItems: z.number().int().positive(),

package/dist/contract/share.d.ts

@@ -24,6 +24,14 @@ export declare const ListFlowGrantsInput: z.ZodObject<{
     flowId: z.ZodString;
 }, z.core.$strict>;
 export type ListFlowGrantsInput = z.infer<typeof ListFlowGrantsInput>;
+export declare const ListEffectiveAccessInput: z.ZodObject<{
+    resourceId: z.ZodString;
+}, z.core.$strict>;
+export type ListEffectiveAccessInput = z.infer<typeof ListEffectiveAccessInput>;
+export declare const ListFlowEffectiveAccessInput: z.ZodObject<{
+    flowId: z.ZodString;
+}, z.core.$strict>;
+export type ListFlowEffectiveAccessInput = z.infer<typeof ListFlowEffectiveAccessInput>;
 export declare const ResourceGrant: z.ZodObject<{
     id: z.ZodString;
     resourceId: z.ZodString;

package/dist/contract/share.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { IdempotencyKey, IntelId, IsoDateTime } from "./contract.js";
+import { IdempotencyKey, IntelId, IsoDateTime, NamedOrCounted } from "./contract.js";
 // ⚠️ There is no `ContextPolicy`, and it is not coming back in this shape (#76). It said whether a
 // document should be pinned into a context, be found by relevance, or be named explicitly — an
 // instruction to a retrieval Intel does not perform. Intel hands out references and the agent
@@ -23,6 +23,21 @@ export const ListGrantsInput = z.strictObject({
 export const ListFlowGrantsInput = z.strictObject({
     flowId: IntelId.describe("Flow whose direct grants to list. Access inherited from the folder it is filed in is not a grant on this flow and is not listed here."),
 });
+// ⚠️ A DIFFERENT question from the two above, not a fuller answer to them (#586). The `*GrantsInput`
+// pair asks what sits ON this one resource; these two ask who REACHES it once inheritance is
+// resolved — every grant along the folders above plus the owners, who need no grant row at all. On
+// the everyday resource, whose access comes from the folder it is filed in, the first answer is
+// empty and this one is not, so a caller that reaches for the wrong one is told "nobody" about
+// something half the organization can open.
+//
+// Two inputs rather than one widened `resourceId`, for the reason the pair above gives: the id
+// names a different table, and the queries behind them are two statements over two sets of tables.
+export const ListEffectiveAccessInput = z.strictObject({
+    resourceId: IntelId.describe("Node to answer for. The answer crosses the folders above it and names owners as well as grants, so it is not the list node_grant_list gives."),
+});
+export const ListFlowEffectiveAccessInput = z.strictObject({
+    flowId: IntelId.describe("Flow to answer for. The answer includes what the folder it is filed in passes down and names owners as well as grants, so it is not the list flow_grant_list gives."),
+});
 export const ResourceGrant = z.strictObject({
     id: IntelId,
     resourceId: IntelId,
@@ -71,10 +86,11 @@ export const RevokeFlowGrantInput = z.strictObject({
 //
 // ⚠️ `titles` holds only the documents the sharer may see; everything else is in `hidden` as a
 // number. A warning must not become a way of reading titles out of the tree.
-export const UnreadableNodes = z.strictObject({
-    titles: z.array(z.string().min(1).max(240)),
-    hidden: z.number().int().nonnegative(),
-});
+//
+// It IS `NamedOrCounted` — one schema, under the name this domain calls it by. The shape moved to
+// `contract.ts` when a refusal started carrying it too (#448); it is not restated here, because two
+// declarations of one rule are two places for it to drift.
+export const UnreadableNodes = NamedOrCounted;
 // The grant is in the answer, so the warning cannot be mistaken for a refusal: it is written first
 // and described afterwards. Blocking would force everyone who uses a central policy document to
 // duplicate it, which is the opposite of what one tree is for (ADR-0004 §4).

package/dist/contract/table.d.ts

@@ -28,6 +28,8 @@ export declare const AppendTableRowsResult: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -75,6 +77,8 @@ export declare const UpdateTableRowsResult: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;
@@ -118,6 +122,8 @@ export declare const DeleteTableRowsResult: z.ZodObject<{
             document: "document";
             table: "table";
             attachment: "attachment";
+            board: "board";
+            task: "task";
         }>;
         title: z.ZodString;
         description: z.ZodNullable<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-contract",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -16,6 +16,14 @@
       "types": "./dist/contract/contract.d.ts",
       "default": "./dist/contract/contract.js"
     },
+    "./audit": {
+      "types": "./dist/contract/audit.d.ts",
+      "default": "./dist/contract/audit.js"
+    },
+    "./board": {
+      "types": "./dist/contract/board.d.ts",
+      "default": "./dist/contract/board.js"
+    },
     "./bundle": {
       "types": "./dist/contract/bundle.d.ts",
       "default": "./dist/contract/bundle.js"