@anchrd/intel-ui 0.31.0 → 0.32.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-ui",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -33,7 +33,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@anchrd/intel-contract": "^0.19.0",
+    "@anchrd/intel-contract": "^0.20.0",
     "@blocknote/core": "^0.52.1",
     "@blocknote/react": "^0.52.1",
     "@blocknote/shadcn": "^0.52.1",

package/src/access-summary/access-summary.tsx

@@ -255,14 +255,25 @@ export function AccessSummary({
 export function ResourceAccessSummary({
   resourceId,
   ownerId,
+  kind = "node",
 }: {
   resourceId: string;
   ownerId: string;
+  // Which side of the tree the id belongs to (#530). A flow is not a node, so it is a different
+  // route — but the same answer, which is why one component draws both.
+  kind?: "node" | "flow";
 }) {
   const { data } = useIntelRouterContext();
   const grants = useQuery({
-    queryKey: ["effective-node-grants", resourceId],
-    queryFn: () => data.listEffectiveAccess(resourceId),
+    // ⚠️ Both kinds share the `effective-node-grants` prefix on purpose: a share mutation
+    // invalidates that prefix, and a flow grant changes what a folder summary above it shows just
+    // as a folder grant changes what the flow below it shows. Two prefixes would mean one of the
+    // two keeps drawing an access picture that is no longer in force.
+    queryKey: ["effective-node-grants", kind, resourceId],
+    queryFn: () =>
+      kind === "flow"
+        ? data.listEffectiveFlowAccess(resourceId)
+        : data.listEffectiveAccess(resourceId),
     retry: false,
     // Time cannot change this answer locally. Share mutations invalidate the whole effective prefix
     // because changing one folder also changes every descendant summary already on screen.

package/src/data/intel-data-provider/intel-data-provider.ts

@@ -55,8 +55,10 @@ import {
 import {
   ResourceAccessList,
   ResourceGrantList,
+  RevokeFlowGrantInput,
   RevokeGrantInput,
   RevokeGrantResult,
+  ShareFlowInput,
   ShareInput,
   ShareResult,
 } from "@anchrd/intel-contract/share";
@@ -384,6 +386,30 @@ export function createIntelDataProvider(
         { method: "POST", body: JSON.stringify(parsed) },
       );
     },
+    async listFlowGrants(flowId) {
+      return await request(`/flows/${encodeURIComponent(flowId)}/grants`, ResourceGrantList);
+    },
+    async listEffectiveFlowAccess(flowId) {
+      return await request(
+        `/flows/${encodeURIComponent(flowId)}/effective-access`,
+        ResourceAccessList,
+      );
+    },
+    async shareFlow(input) {
+      const parsed = ShareFlowInput.parse(input);
+      return await request(`/flows/${encodeURIComponent(parsed.flowId)}/grants`, ShareResult, {
+        method: "POST",
+        body: JSON.stringify(parsed),
+      });
+    },
+    async revokeFlowGrant(input) {
+      const parsed = RevokeFlowGrantInput.parse(input);
+      return await request(
+        `/flows/${encodeURIComponent(parsed.flowId)}/grants/${encodeURIComponent(parsed.grantId)}/revoke`,
+        RevokeGrantResult,
+        { method: "POST", body: JSON.stringify(parsed) },
+      );
+    },
     listFlows,
     async getFlow(flowId) {
       return await request(`/flows/${encodeURIComponent(flowId)}`, FlowDocument);

package/src/data/intel-data-provider/intel-data-provider.types.ts

@@ -54,8 +54,10 @@ import type {
 } from "@anchrd/intel-contract/node";
 import type {
   ResourceGrantList,
+  RevokeFlowGrantInput,
   RevokeGrantInput,
   RevokeGrantResult,
+  ShareFlowInput,
   ShareInput,
   ShareResult,
 } from "@anchrd/intel-contract/share";
@@ -147,6 +149,16 @@ export interface IntelDataProvider {
   // the new principal still cannot. A warning, never a refusal (ADR-0004 §4).
   shareNode(input: ShareInput): Promise<ShareResult>;
   revokeGrant(input: RevokeGrantInput): Promise<RevokeGrantResult>;
+  // The same four for one flow (#530). Separate calls rather than a widened `resourceId`, because
+  // the id names a different table on the other side and the routes are separate there too.
+  listFlowGrants(flowId: string): Promise<ResourceGrantList>;
+  listEffectiveFlowAccess(
+    flowId: string,
+  ): Promise<import("@anchrd/intel-contract/share").ResourceAccessList>;
+  // ⚠️ `ShareResult.unrunnable` is only ever filled in here: a grant on one flow does not reach the
+  // flows it calls, and this is where that gets said.
+  shareFlow(input: ShareFlowInput): Promise<ShareResult>;
+  revokeFlowGrant(input: RevokeFlowGrantInput): Promise<RevokeGrantResult>;
   listFlows(input?: ListFlowsInput): Promise<FlowList>;
   getFlow(flowId: string): Promise<FlowDocument>;
   // What a flow calls, read out of its graph. It answers a different question from `listTreeChildren`

package/src/flows/flows.tsx

@@ -421,9 +421,6 @@ function FlowsEditor() {
   // Lifted out of the bar because the canvas dismisses it too — a click on the pane is the third way
   // out, next to the trigger and Escape.
   const [paletteOpen, setPaletteOpen] = usePaletteOpen();
-  // A flow is shared through the folder it is filed in, on the Intelligence screen (ADR-0004 §2). It
-  // has no share action of its own — a narrower grant beside the folder's would break the guarantee
-  // that a flow only reaches flows in its own subtree.
   const document = useQuery({
     queryKey: ["flow", selectedFlowId],
     queryFn: () => data.getFlow(selectedFlowId ?? ""),

package/src/i18n/de.json

@@ -76,7 +76,6 @@
   "resource.archive": "Archivieren",
   "resource.export": "Export",
   "resource.import": "Import",
-  "resource.downloadCsv": "CSV herunterladen",
   "resource.validate": "Prüfen",
   "resource.links": "Verweise",
   "resource.share": "Freigeben",
@@ -116,8 +115,6 @@
   "node.download": "Datei herunterladen",
   "node.attachmentHelp": "Die kanonische Datei liegt privat in Intel. Ihre KI-lesbare Projektion wird getrennt indexiert.",
   "node.table.summary": "{rows} Zeilen, {columns} Spalten",
-  "node.table.download": "CSV herunterladen",
-  "node.table.downloadFailed": "Die CSV konnte nicht erzeugt werden. Möglicherweise ist die Tabelle noch leer.",
   "node.table.empty": "Noch keine Zeilen. Zeilen werden von Flows angehängt.",
   "node.table.undefined": "Diese Tabelle hat noch keine Spalten.",
   "node.select": "Wähle ein Dokument oder einen Ordner, um damit zu arbeiten.",
@@ -364,5 +361,17 @@
   "flows.toolStepNeedsServer": "Dem Schritt „{label}“ fehlt noch ein Server.",
   "flows.toolFunctionsFailed": "Die Funktionsliste ließ sich nicht laden, daher ist die Auswahl möglicherweise unvollständig.",
   "flows.publishPreviewToolUnavailable": "Diesen Server erreichst du nicht, daher wird das Veröffentlichen abgelehnt.",
-  "flows.publishPreviewToolAllow": "Eingefroren auf: {functions}"
+  "flows.publishPreviewToolAllow": "Eingefroren auf: {functions}",
+  "flow.shareUnreadable": "Dieser Flow liest Dokumente, die diese Freigabe nicht abdeckt: {titles}.",
+  "flow.shareUnreadableMore": "{count} weitere liegen ebenfalls außer Reichweite, und du kannst sie nicht sehen.",
+  "flow.shareUnreadableHidden": "{count} Dokumente, die dieser Flow liest, liegen mit dieser Freigabe außer Reichweite. Du kannst sie nicht sehen.",
+  "flow.shareUnreadableHint": "Nichts ist blockiert. Ein Lauf hält für sie schlicht an dieser Stelle an.",
+  "flow.shareUnrunnable": "Dieser Flow ruft Flows auf, die diese Freigabe nicht abdeckt: {titles}.",
+  "flow.shareUnrunnableMore": "{count} weitere liegen ebenfalls außer Reichweite, und du kannst sie nicht sehen.",
+  "flow.shareUnrunnableHidden": "{count} Flows, die dieser aufruft, liegen mit dieser Freigabe außer Reichweite. Du kannst sie nicht sehen.",
+  "flow.shareUnrunnableHint": "Eine Freigabe auf einem Flow reicht nur bis zu diesem Flow. Gib die anderen ebenfalls frei oder den Ordner, in dem sie liegen. Mit „Prüfen“ sehen die Beschenkten es vor dem Start selbst.",
+  "flow.verbHint.read": "Diesen Flow öffnen und lesen",
+  "flow.verbHint.write": "Diesen Flow ändern",
+  "flow.verbHint.execute": "Diesen Flow starten",
+  "flow.verbHint.share": "Anderen Zugriff darauf geben"
 }

package/src/i18n/en.json

@@ -76,7 +76,6 @@
   "resource.archive": "Archive",
   "resource.export": "Export",
   "resource.import": "Import",
-  "resource.downloadCsv": "Download CSV",
   "resource.validate": "Check",
   "resource.links": "Links",
   "resource.share": "Share",
@@ -116,8 +115,6 @@
   "node.download": "Download file",
   "node.attachmentHelp": "The canonical file is stored privately in Intel. Its AI-readable projection is indexed separately.",
   "node.table.summary": "{rows} rows, {columns} columns",
-  "node.table.download": "Download CSV",
-  "node.table.downloadFailed": "The CSV could not be created. The table may still be empty.",
   "node.table.empty": "No rows yet. Rows are appended by flows.",
   "node.table.undefined": "This table has no columns yet.",
   "node.select": "Select a document or folder to work with it.",
@@ -364,5 +361,17 @@
   "flows.toolStepNeedsServer": "The step “{label}” still needs a server.",
   "flows.toolFunctionsFailed": "The list of functions could not be loaded, so the selection may be incomplete.",
   "flows.publishPreviewToolUnavailable": "You do not reach this server, so publishing will be refused.",
-  "flows.publishPreviewToolAllow": "Frozen to: {functions}"
+  "flows.publishPreviewToolAllow": "Frozen to: {functions}",
+  "flow.shareUnreadable": "This flow reads documents this grant does not cover: {titles}.",
+  "flow.shareUnreadableMore": "{count} more are out of reach too, and you cannot see them.",
+  "flow.shareUnreadableHidden": "{count} documents this flow reads are out of reach with this grant. You cannot see them.",
+  "flow.shareUnreadableHint": "Nothing is blocked. A run will simply stop at that step for them.",
+  "flow.shareUnrunnable": "This flow calls flows this grant does not cover: {titles}.",
+  "flow.shareUnrunnableMore": "{count} more are out of reach too, and you cannot see them.",
+  "flow.shareUnrunnableHidden": "{count} flows this one calls are out of reach with this grant. You cannot see them.",
+  "flow.shareUnrunnableHint": "A grant on one flow reaches that flow alone. Share those flows too, or share the folder they are filed in. Let them check with Validate before they run it.",
+  "flow.verbHint.read": "Open this flow and read it",
+  "flow.verbHint.write": "Change this flow",
+  "flow.verbHint.execute": "Start this flow",
+  "flow.verbHint.share": "Give others access to it"
 }

package/src/i18n/es.json

@@ -76,7 +76,6 @@
   "resource.archive": "Archivar",
   "resource.export": "Exportar",
   "resource.import": "Importar",
-  "resource.downloadCsv": "Descargar CSV",
   "resource.validate": "Comprobar",
   "resource.links": "Enlaces",
   "resource.share": "Compartir",
@@ -116,8 +115,6 @@
   "node.download": "Descargar el archivo",
   "node.attachmentHelp": "El archivo canónico se guarda en privado en Intel. Su proyección legible por la IA se indexa por separado.",
   "node.table.summary": "{rows} filas, {columns} columnas",
-  "node.table.download": "Descargar CSV",
-  "node.table.downloadFailed": "No se pudo crear el CSV. Puede que la tabla todavía esté vacía.",
   "node.table.empty": "Todavía no hay filas. Las filas las añaden los flujos.",
   "node.table.undefined": "Esta tabla todavía no tiene columnas.",
   "node.select": "Elige un documento o una carpeta para trabajar con ello.",
@@ -364,5 +361,17 @@
   "flows.toolStepNeedsServer": "Al paso «{label}» todavía le falta un servidor.",
   "flows.toolFunctionsFailed": "No se pudo cargar la lista de funciones, así que la selección puede estar incompleta.",
   "flows.publishPreviewToolUnavailable": "No alcanzas este servidor, así que la publicación será rechazada.",
-  "flows.publishPreviewToolAllow": "Congelado en: {functions}"
+  "flows.publishPreviewToolAllow": "Congelado en: {functions}",
+  "flow.shareUnreadable": "Este flujo lee documentos que este acceso no cubre: {titles}.",
+  "flow.shareUnreadableMore": "{count} más también quedan fuera de alcance, y no puedes verlos.",
+  "flow.shareUnreadableHidden": "{count} documentos que lee este flujo quedan fuera de alcance con este acceso. No puedes verlos.",
+  "flow.shareUnreadableHint": "No se bloquea nada. Una ejecución simplemente se detendrá en ese paso para esa persona.",
+  "flow.shareUnrunnable": "Este flujo llama a flujos que este acceso no cubre: {titles}.",
+  "flow.shareUnrunnableMore": "{count} más también quedan fuera de alcance, y no puedes verlos.",
+  "flow.shareUnrunnableHidden": "{count} flujos a los que llama este quedan fuera de alcance con este acceso. No puedes verlos.",
+  "flow.shareUnrunnableHint": "Un acceso sobre un flujo llega solo a ese flujo. Comparte también esos flujos, o la carpeta donde están. Con «Validar» lo verán ellos mismos antes de ejecutarlo.",
+  "flow.verbHint.read": "Abrir este flujo y leerlo",
+  "flow.verbHint.write": "Cambiar este flujo",
+  "flow.verbHint.execute": "Iniciar este flujo",
+  "flow.verbHint.share": "Dar acceso a otras personas"
 }

package/src/node-table/node-table.tsx

@@ -32,8 +32,10 @@ export function NodeTablePanel({ node }: { node: Node }) {
           query lives; the screen would otherwise have to load a table it does not show.
 
           ⚠️ The CSV export used to stand here too, as a button WITH TEXT beside two icon buttons.
-          Since #454 it is an entry in the title line's three-dot menu (`resource-menu.tsx`) — where
-          the bundle export sits as well, because both do the same: hand out the whole thing. */}
+          #454 moved it into the title line's three-dot menu, and #532 dropped it there: the bundle
+          export beside it already writes the table into the zip as `<title>.csv` (`bundle.ts`), so
+          the two entries handed out the same bytes. Taking a table home is `Export`, here and
+          nowhere else. */}
       <ActionSlot name="title-meta">
         {table.data
           ? i18n.t("node.table.summary", {

package/src/resource-menu/resource-menu.tsx

@@ -6,7 +6,6 @@ import { useNavigate, useRouterState } from "@tanstack/react-router";
 import {
   Archive,
   CornerLeftUp,
-  Download,
   Ellipsis,
   FileArchive,
   FolderDown,
@@ -49,9 +48,9 @@ import { useDateTime } from "@/time/time-context.tsx";
  * row menu could do is reached here — including moving, which is why this component owns the folder
  * picker rather than being handed one.
  *
- * ⚠️ An entry that does not apply is absent, never disabled: a folder has no retrieval mode, a flow
- * is shared through the folder it is filed in rather than on its own (ADR-0004 §2). A greyed-out row
- * still promises something is there.
+ * ⚠️ An entry that does not apply is absent, never disabled: a folder has no retrieval mode and no
+ * links, a flow has no version history of the node kind. A greyed-out row still promises something
+ * is there. Sharing applies to all of them since #530.
  */
 export type ResourceTarget = { type: "node"; node: Node } | { type: "flow"; flow: Flow };
 
@@ -83,13 +82,14 @@ function titleOf(target: ResourceTarget): string {
 /**
  * Which sentence explains a verb.
  *
- * ⚠️ One sentence per verb, and that is only true again since Agents were parked (#388). "Run"
- * used to mean two different things — starting the flows filed in a folder, and using an agent
- * through its chat, its schedules and its MCP address — so #143 gave the agent its own wording.
- * With one meaning left, a per-kind branch would be a fork nothing takes.
+ * ⚠️ The hint is about the SUBJECT as much as the verb, and the branch came back with #530. "See
+ * everything in here" is right for a folder and wrong for one flow, and a hint describing the wrong
+ * reach is worse than none — it is the sentence somebody reads INSTEAD of thinking about what they
+ * are granting. The wording that used to fork here was the agent's (#143), parked with it (#388);
+ * this is a different fork, on the subject rather than on a second meaning of one word.
  */
-export function verbHintKey(verb: ResourceVerb): string {
-  return `node.verbHint.${verb}`;
+export function verbHintKey(verb: ResourceVerb, subject: ResourceTarget["type"] = "node"): string {
+  return `${subject}.verbHint.${verb}`;
 }
 
 // ⚠️ The same reading `moveErrorKey` does for a move, for the changes this menu makes. A conflict is
@@ -271,37 +271,6 @@ export function ResourceMenu({
     },
   });
 
-  // #454: a table's CSV export — an ENTRY, not a button of its own. It was the only control WITH
-  // TEXT beside two icon buttons in the title line, and it was needed no more often than what sits
-  // in here anyway; it was merely wider. Intel has made the same decision twice already (#363 for
-  // status and archive, #346 for the import).
-  //
-  // ⚠️ It lives HERE and no longer in `NodeTablePanel`: there it hung off the table query in order
-  // to prevent an empty export. The condition survives the move without a second query — the
-  // canonical content IS the CSV, and if it is empty nothing is downloaded, it is refused instead.
-  // A file of zero bytes is the worse answer.
-  const downloadCsv = useMutation({
-    mutationFn: async () => {
-      if (target.type !== "node") throw new Error("csv export is a node's");
-      const document_ = await data.getNode(target.node.id);
-      const content = document_.content ?? "";
-      if (content === "") throw new Error("nothing to export yet");
-      return new Blob([content], { type: "text/csv;charset=utf-8" });
-    },
-    onSuccess: (blob) => {
-      const url = URL.createObjectURL(blob);
-      const anchor = document.createElement("a");
-      anchor.href = url;
-      // No doubled `.csv` when the title already carries the extension — unchanged from #40.
-      anchor.download = title.toLowerCase().endsWith(".csv") ? title : `${title}.csv`;
-      document.body.append(anchor);
-      anchor.click();
-      anchor.remove();
-      setTimeout(() => URL.revokeObjectURL(url), 0);
-    },
-  });
-  const isTable = target.type === "node" && target.node.kind === "table";
-
   const failure = rename.isError
     ? null // the rename dialog words its own refusal, beside the field that caused it
     : archive.isError
@@ -340,19 +309,21 @@ export function ResourceMenu({
           </DropdownMenuItem>
           {/* Every kind exports: a folder takes its subtree along, everything else is a bundle of
               one (#136). The entry sits with rename and move because it acts on the whole thing,
-              not on its content. */}
+              not on its content.
+
+              ⚠️ A table has NO second entry beside this one (#532). It used to carry "Download CSV"
+              here, and for a table WITH a header both handed out the same bytes: `bundle.ts` writes
+              such a node into the zip as `<title>.csv`. Two ways to one file are two strings, two
+              catalogs and two tests — the zip costs one step more and is the whole difference.
+
+              ⚠️ The one case where they differed is the table that has no header yet: `downloadCsv`
+              refused it out loud, `tableCsv` joins no segments and writes a file of zero bytes
+              (#534). That is the export's gap on every kind it can hit, not something this entry
+              was covering — which is why it is fixed there and not by keeping a second entry. */}
           <DropdownMenuItem onSelect={() => exportBundle.mutate()}>
             <FolderDown aria-hidden="true" />
             {i18n.t("resource.export")}
           </DropdownMenuItem>
-          {/* Only a table has a CSV — and it stands beside the bundle export because both do the
-              same thing: hand out the whole thing, not a part of its content. */}
-          {isTable ? (
-            <DropdownMenuItem onSelect={() => downloadCsv.mutate()}>
-              <Download aria-hidden="true" />
-              {i18n.t("resource.downloadCsv")}
-            </DropdownMenuItem>
-          ) : null}
           {/* The other half of the same round trip, next to it rather than in the tree's plus
               (#346): one word in the menu, both sources under it. */}
           {importable ? (
@@ -387,15 +358,12 @@ export function ResourceMenu({
               {i18n.t("resource.links")}
             </DropdownMenuItem>
           ) : null}
-          {/* A flow has no share of its own: it is reached through the folder it is filed in, and a
-              narrower grant beside the folder's would break the rule that a flow only calls flows in
-              its own subtree (ADR-0004 §2). */}
-          {node ? (
-            <DropdownMenuItem onSelect={() => setSharing(true)}>
-              <Share2 aria-hidden="true" />
-              {i18n.t("resource.share")}
-            </DropdownMenuItem>
-          ) : null}
+          {/* Every kind of resource is shared here, a flow included since #530. What a grant on one
+              flow does NOT reach is said in the dialog rather than refused here. */}
+          <DropdownMenuItem onSelect={() => setSharing(true)}>
+            <Share2 aria-hidden="true" />
+            {i18n.t("resource.share")}
+          </DropdownMenuItem>
           {(node === null || node.kind !== "folder") && (
             <DropdownMenuItem onSelect={() => setVersionsOpen(true)}>
               <History aria-hidden="true" />
@@ -419,9 +387,6 @@ export function ResourceMenu({
       {/* Its own sentence, not `resourceErrorKey`'s: nothing was changed, something failed to
           arrive, and "the change was not saved" would send the reader looking for a change. */}
       {exportBundle.isError ? <MenuFailure>{i18n.t("resource.exportFailed")}</MenuFailure> : null}
-      {downloadCsv.isError ? (
-        <MenuFailure>{i18n.t("node.table.downloadFailed")}</MenuFailure>
-      ) : null}
       {/* The import's own sentence, and its own pickers — only where the entry exists, because two
           file inputs on every document's menu would be two elements nothing can ever open. */}
       {bundleImport.isError ? <MenuFailure>{i18n.t("tree.importFailed")}</MenuFailure> : null}
@@ -490,7 +455,7 @@ export function ResourceMenu({
           submit={(next) => rename.mutate(next)}
         />
       ) : null}
-      {sharing && node ? <SharePanel node={node} close={() => setSharing(false)} /> : null}
+      {sharing ? <SharePanel target={target} close={() => setSharing(false)} /> : null}
       {linksOpen && node ? <NodeLinksPanel node={node} close={() => setLinksOpen(false)} /> : null}
       {versionsOpen ? (
         <VersionHistory target={target} close={() => setVersionsOpen(false)} />
@@ -688,10 +653,10 @@ function NodeLinksPanel({ node, close }: { node: Node; close(): void }) {
   );
 }
 
-// The one share dialog in the product. It sits on the folder that holds the documents and the
-// flows, which is where a permission decision belongs (ADR-0004 §2). Which verbs it offers is the
-// server's answer, not this component's: `execute` never appears on a document, because a document
-// has nothing to run.
+// The one share dialog in the product, for every kind of resource that can be shared — a folder, a
+// document, a table, and since #530 a flow on its own. Which verbs it offers is the server's
+// answer, not this component's: `execute` never appears on a document, because a document has
+// nothing to run, and all four appear on a flow.
 /**
  * Which of the three principals the dialog can SET (#431).
  *
@@ -709,7 +674,18 @@ function NodeLinksPanel({ node, close }: { node: Node; close(): void }) {
  */
 type SharePrincipalKind = "email" | "organization";
 
-function SharePanel({ node, close }: { node: Node; close(): void }) {
+// What the grant just made does not cover, in the two directions it can fail to (#530): documents
+// the grantee cannot read, and flows the grantee cannot start. Both are `null` until an answer
+// arrives, so "no warning yet" and "nothing to warn about" stay distinguishable.
+type ShareWarnings = { unreadable: UnreadableNodes; unrunnable: UnreadableNodes } | null;
+
+// Whether there is anything to say. A warning with neither a title nor a count is silence, and
+// drawing an empty box for it would make every ordinary grant look like it had a caveat.
+function withheld(value: UnreadableNodes): boolean {
+  return value.titles.length > 0 || value.hidden > 0;
+}
+
+function SharePanel({ target, close }: { target: ResourceTarget; close(): void }) {
   const { data } = useIntelRouterContext();
   const i18n = useI18n();
   const queryClient = useQueryClient();
@@ -718,31 +694,50 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
   const [verbs, setVerbs] = useState<ResourceVerb[]>(["read"]);
   // What the grant just made does not cover. It survives the form being cleared, because it is the
   // answer to the question the user just asked and they need a moment to read it.
-  const [unreadable, setUnreadable] = useState<UnreadableNodes | null>(null);
+  const [warnings, setWarnings] = useState<ShareWarnings>(null);
+  const isFlow = target.type === "flow";
+  const resourceId = idOf(target);
   const grants = useQuery({
-    queryKey: ["node-grants", node.id],
-    queryFn: () => data.listGrants(node.id),
+    queryKey: ["resource-grants", target.type, resourceId],
+    queryFn: () => (isFlow ? data.listFlowGrants(resourceId) : data.listGrants(resourceId)),
   });
+  // ⚠️ Both queries are invalidated by every mutation below, and the flow key is under the same
+  // effective prefix as the node key: a grant on a flow changes what the summary of the folder
+  // above it shows, and the other way round.
+  const invalidate = async () => {
+    await Promise.all([
+      queryClient.invalidateQueries({ queryKey: ["resource-grants", target.type, resourceId] }),
+      queryClient.invalidateQueries({ queryKey: ["effective-node-grants"] }),
+    ]);
+  };
   const share = useMutation({
     // One request per verb, because one grant is one verb. The keys differ so a retry of the whole
     // form replays each verb on its own rather than collapsing them into one.
     mutationFn: async () => {
-      let last: UnreadableNodes | null = null;
+      let last: ShareWarnings = null;
       for (const verb of verbs) {
+        const principal =
+          principalKind === "organization"
+            ? ({ type: "organization" } as const)
+            : ({ type: "email", email } as const);
         // The last verb's answer is the one kept: every request describes the access in force after
         // it, so the newest is the only one still true.
-        last = (
-          await data.shareNode({
-            resourceId: node.id,
-            principal:
-              principalKind === "organization"
-                ? { type: "organization" }
-                : { type: "email", email },
-            verb,
-            expiresAt: null,
-            idempotencyKey: crypto.randomUUID(),
-          })
-        ).unreadable;
+        const result = isFlow
+          ? await data.shareFlow({
+              flowId: resourceId,
+              principal,
+              verb,
+              expiresAt: null,
+              idempotencyKey: crypto.randomUUID(),
+            })
+          : await data.shareNode({
+              resourceId,
+              principal,
+              verb,
+              expiresAt: null,
+              idempotencyKey: crypto.randomUUID(),
+            });
+        last = { unreadable: result.unreadable, unrunnable: result.unrunnable };
       }
       return last;
     },
@@ -752,32 +747,28 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
       // until the review of #431 caught it, and "everyone in the organization" is the one setting
       // that must never be the quiet default for the NEXT grant somebody makes in the same dialog.
       setPrincipalKind("email");
-      setUnreadable(result);
+      setWarnings(result);
     },
     // ⚠️ `onSettled`, not `onSuccess`. One request per verb means a run can end halfway: three verbs
     // granted, the fourth refused. On `onSuccess` the list would then still show the state from
     // before, and the user would read a permission picture that is not the one in force. Of all the
     // things to be silently wrong about, access is the worst.
-    onSettled: async () => {
-      await Promise.all([
-        queryClient.invalidateQueries({ queryKey: ["node-grants", node.id] }),
-        queryClient.invalidateQueries({ queryKey: ["effective-node-grants"] }),
-      ]);
-    },
+    onSettled: invalidate,
   });
   const revoke = useMutation({
     mutationFn: (grantId: string) =>
-      data.revokeGrant({
-        resourceId: node.id,
-        grantId,
-        idempotencyKey: crypto.randomUUID(),
-      }),
-    onSettled: async () => {
-      await Promise.all([
-        queryClient.invalidateQueries({ queryKey: ["node-grants", node.id] }),
-        queryClient.invalidateQueries({ queryKey: ["effective-node-grants"] }),
-      ]);
-    },
+      isFlow
+        ? data.revokeFlowGrant({
+            flowId: resourceId,
+            grantId,
+            idempotencyKey: crypto.randomUUID(),
+          })
+        : data.revokeGrant({
+            resourceId,
+            grantId,
+            idempotencyKey: crypto.randomUUID(),
+          }),
+    onSettled: invalidate,
   });
 
   /**
@@ -817,19 +808,45 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
       {/* ⚠️ `status`, not `alert`, and beside the grant rather than in place of it: the access was
           given. A node reference across the folder edge is a possible failure, not a way around
           permissions, so nothing here blocks anything (ADR-0004 §4). */}
-      {unreadable && (unreadable.titles.length > 0 || unreadable.hidden > 0) && (
+      {warnings && withheld(warnings.unreadable) && (
         <div role="status" className="mb-4 rounded-md border bg-muted p-3 text-sm">
-          {unreadable.titles.length > 0 ? (
+          {warnings.unreadable.titles.length > 0 ? (
             <p>
-              {i18n.t("node.shareUnreadable", { titles: unreadable.titles.join(", ") })}
-              {unreadable.hidden > 0
-                ? ` ${i18n.t("node.shareUnreadableMore", { count: unreadable.hidden })}`
+              {i18n.t(`${target.type}.shareUnreadable`, {
+                titles: warnings.unreadable.titles.join(", "),
+              })}
+              {warnings.unreadable.hidden > 0
+                ? ` ${i18n.t(`${target.type}.shareUnreadableMore`, { count: warnings.unreadable.hidden })}`
                 : ""}
             </p>
           ) : (
-            <p>{i18n.t("node.shareUnreadableHidden", { count: unreadable.hidden })}</p>
+            <p>
+              {i18n.t(`${target.type}.shareUnreadableHidden`, {
+                count: warnings.unreadable.hidden,
+              })}
+            </p>
+          )}
+          <p className="mt-1 text-xs text-muted-foreground">
+            {i18n.t(`${target.type}.shareUnreadableHint`)}
+          </p>
+        </div>
+      )}
+      {/* The half a folder grant never needed: a grant on ONE flow stops at that flow, so the flows
+          it calls are somebody else's to grant. `status` and not `alert` for the same reason as
+          above — the access was given, and this says what it does not reach (#530). */}
+      {warnings && withheld(warnings.unrunnable) && (
+        <div role="status" className="mb-4 rounded-md border bg-muted p-3 text-sm">
+          {warnings.unrunnable.titles.length > 0 ? (
+            <p>
+              {i18n.t("flow.shareUnrunnable", { titles: warnings.unrunnable.titles.join(", ") })}
+              {warnings.unrunnable.hidden > 0
+                ? ` ${i18n.t("flow.shareUnrunnableMore", { count: warnings.unrunnable.hidden })}`
+                : ""}
+            </p>
+          ) : (
+            <p>{i18n.t("flow.shareUnrunnableHidden", { count: warnings.unrunnable.hidden })}</p>
           )}
-          <p className="mt-1 text-xs text-muted-foreground">{i18n.t("node.shareUnreadableHint")}</p>
+          <p className="mt-1 text-xs text-muted-foreground">{i18n.t("flow.shareUnrunnableHint")}</p>
         </div>
       )}
       {grants.data && grants.data.items.length > 0 ? (
@@ -922,7 +939,13 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
                 It is a warning and not a block, deliberately: the library is a documented, wanted
                 shape, MCP has always been able to make one, and refusing it here would put a person
                 back below a model on the same tree — the very asymmetry this ticket removed. */}
-            {verbs.includes("execute") ? (
+            {/* ⚠️ Only on a node, and that is not an oversight. What makes a folder a library is
+                `execute` for the organization ON THE FOLDER: `callReach` reads `node_grants` along
+                the callee's ancestors and nothing else, so the same grant on a flow itself makes no
+                library and reaches no caller outside its subtree. Showing this line there would
+                warn about a consequence that cannot happen — and about a refusal on the way back
+                that would never come (#530). */}
+            {!isFlow && verbs.includes("execute") ? (
               <p role="note" className="font-medium text-destructive">
                 {i18n.t("node.shareLibraryWarning")}
               </p>
@@ -946,7 +969,9 @@ function SharePanel({ node, close }: { node: Node; close(): void }) {
                 className="size-4 rounded border outline-none focus-visible:ring-2 focus-visible:ring-ring"
               />
               <span>{i18n.t(`node.verb.${verb}`)}</span>
-              <span className="text-xs text-muted-foreground">{i18n.t(verbHintKey(verb))}</span>
+              <span className="text-xs text-muted-foreground">
+                {i18n.t(verbHintKey(verb, target.type))}
+              </span>
             </label>
           ))}
         </fieldset>

package/src/title-row/title-row.tsx

@@ -98,6 +98,15 @@ export function TitleRow({
             {target.type === "node" && target.node.kind === "folder" ? (
               <ResourceAccessSummary resourceId={target.node.id} ownerId={target.node.ownerId} />
             ) : null}
+            {/* A flow carries its own grants since #530, so who reaches it is worth showing where
+                it stands — the same question the folder above already answers here. */}
+            {target.type === "flow" ? (
+              <ResourceAccessSummary
+                kind="flow"
+                resourceId={target.flow.id}
+                ownerId={target.flow.ownerId}
+              />
+            ) : null}
             <span data-slot="title-meta" className="text-sm text-muted-foreground" />
           </div>
           {description ? <DescriptionDisclosure key={targetId} description={description} /> : null}