@anchrd/intel-api 0.13.0 → 0.15.0

package/dist/adapters/cloudflare/cloudflare.js

@@ -1,18 +1,14 @@
 import { createGateClient } from "@anchrd/gate-sdk";
 import { ulid } from "ulid";
-import { createAgentCosts } from "../../agent-costs/agent-costs.js";
-import { createAgentRuntimeService } from "../../agent-runtime/agent-runtime.js";
 import { createBrowserAuth } from "../../auth/auth.js";
 import { createBundle } from "../../bundle/bundle.js";
 import { createFlows } from "../../flows/flows.js";
 import { createIndexing, PermanentIndexingError } from "../../indexing/indexing.js";
 import { createIntel } from "../../intel/intel.js";
-import { createModelCatalog } from "../../model-catalog/model-catalog.js";
 import { createNodes } from "../../nodes/nodes.js";
 import { IntelError } from "../../shared/intel-error/intel-error.js";
 import { sha256Hex } from "../../shared/sha256/sha256.js";
 import { createTools } from "../../tools/tools.js";
-import { createCloudflareApi } from "../cloudflare-api/cloudflare-api.js";
 import { createContentStore } from "../content/content.js";
 import { createNodeRepository } from "../db/db.js";
 import { createFlowRepository } from "../db/db-flows.js";
@@ -20,7 +16,6 @@ import { createNodeIndexRepository } from "../db/db-indexing.js";
 import { createOAuthClientStore } from "../db/db-oauth.js";
 import { createDocumentConverter } from "../document-converter/document-converter.js";
 import { createFlowRuntime } from "../flow-runtime/flow-runtime.js";
-import { createGateApplications } from "../gate-applications/gate-applications.js";
 import { createIndexQueue, IndexMessage } from "../index-queue/index-queue.js";
 import { createJsonSchemaValidator } from "../json-schema/json-schema.js";
 import { createOpenId } from "../openid/openid.js";
@@ -28,7 +23,6 @@ import { createPortalTokenStore } from "../portal-tokens/portal-tokens.js";
 import { createRemoteTools } from "../remote-tools/remote-tools.js";
 import { createSemanticIndex } from "../semantic-index/semantic-index.js";
 import { createSessionCodec } from "../session-cookie/session-cookie.js";
-import { createToolDelegation } from "../tool-delegation/tool-delegation.js";
 import { createToolSourcePolicy } from "../tool-source-policy/tool-source-policy.js";
 // biome-ignore lint/performance/noBarrelFile: The package entry must expose Wrangler's named Workflow class.
 export { IntelFlowWorkflow } from "./cloudflare-flow-workflow.js";
@@ -82,22 +76,10 @@ export default {
             crypto,
             now,
         });
-        // Built before the tree since D30: saving an agent has to ask the portal, live, whether the
-        // person saving reaches every server they are delegating. The dependency runs one way — the
-        // tool service knows nothing about the tree, and the delegation lookup below reads D1 directly
-        // rather than through the node service.
-        const toolDelegation = createToolDelegation({
-            db: env.DB,
-            content: contentStore,
-            id: ulid,
-            now,
-        });
         const tools = createTools({
             portalUrl,
             remote: createRemoteTools({ fetch: globalThis.fetch.bind(globalThis) }),
             tokens: portalTokens,
-            delegation: toolDelegation.resolve,
-            audit: toolDelegation.audit,
             refresh: async (token) => {
                 try {
                     const refreshed = await oauth.refresh({
@@ -126,56 +108,9 @@ export default {
                 return await sha256Hex(crypto, JSON.stringify(value));
             },
         });
-        // ⚠️ Built before `nodes` and not after, because creating an agent has to be able to hand the
-        // runtime its key inside the same call (D29). Its `visibleNode` closes over `nodes` and is only
-        // ever called later, which is what keeps the two from being a cycle.
-        const agents = createAgentRuntimeService({
-            ...(env.AGENT ? { runtime: env.AGENT } : {}),
-            ...(env.AGENT_HANDOVER_SECRET ? { handoverSecret: env.AGENT_HANDOVER_SECRET } : {}),
-            // The tree's own visibility lookup, unchanged: whether somebody may reach an agent is the
-            // same question as whether they may see the node, and no second answer is invented here.
-            visibleNode: async (actor, nodeId) => await nodes.visibleNode(actor, nodeId),
-        });
-        // ⚠️ One Cloudflare read client for both of the account's answers — the gateway's cost log
-        // (#251) and the Workers AI price list (#257) — because it is one token and one account. It is
-        // absent as a whole where any of the three variables is missing: a half-configured client would
-        // fail per call with a 401 that reads like a permission problem instead of saying, once, that
-        // this deployment was never given a token.
-        const gatewayAccountId = env.AI_GATEWAY_ACCOUNT_ID?.trim();
-        const gatewayId = env.AI_GATEWAY_ID?.trim();
-        const gatewayReadToken = env.AI_GATEWAY_READ_TOKEN?.trim();
-        const cloudflareApi = gatewayAccountId && gatewayId && gatewayReadToken
-            ? createCloudflareApi({
-                accountId: gatewayAccountId,
-                gatewayId,
-                token: gatewayReadToken,
-                fetch: globalThis.fetch.bind(globalThis),
-            })
-            : undefined;
-        const agentCosts = createAgentCosts({
-            ...(cloudflareApi ? { gateway: cloudflareApi } : {}),
-            visibleNode: async (actor, nodeId) => await nodes.visibleNode(actor, nodeId),
-            now,
-        });
-        const models = createModelCatalog({ ...(cloudflareApi ? { cloudflare: cloudflareApi } : {}) });
         const nodes = createNodes({
             repository: nodeRepository,
             content: contentStore,
-            // ⚠️ Built from `GATE_URL` alone — no service key is handed to it, and none would help. The
-            // Applications surface is admin-gated on a real principal, so every call carries the bearer
-            // of the person making it, which the tree passes in per operation (#182).
-            applications: createGateApplications({
-                fetch: globalThis.fetch.bind(globalThis),
-                gateUrl: env.GATE_URL,
-            }),
-            // The binding's presence IS the signal (#190) — no separate configuration option exists.
-            agentRuntimeAvailable: () => env.AGENT !== undefined,
-            // Where the Application key goes, and the only place it goes (D29). The same service the
-            // browser paths are proxied through, so there is one door to the runtime and not two.
-            agentKeys: { store: async (input) => await agents.storeKey(input) },
-            // The same door again (#214): a definition that was written is a schedule that has to be
-            // armed, and the runtime only looks when it is told to.
-            agentSchedules: { sync: async (input) => await agents.syncSchedules(input) },
             id: ulid,
             now,
             indexing: createIndexQueue(env.INDEXING),
@@ -247,9 +182,6 @@ export default {
                 },
                 indexing: createIndexQueue(env.INDEXING),
             }),
-            agents,
-            agentCosts,
-            models,
             auth,
         }).fetch(request);
     },
@@ -259,6 +191,7 @@ export default {
             content: createContentStore(env.CONTENT),
             semantic: env.AI && env.SEARCH ? createSemanticIndex({ ai: env.AI, index: env.SEARCH }) : undefined,
             converter: env.AI ? createDocumentConverter(env.AI) : undefined,
+            hash: async (content) => await sha256Hex(crypto, content),
             now: () => new Date(),
         });
         for (const message of batch.messages) {

package/dist/adapters/cloudflare/cloudflare.types.d.ts

@@ -9,17 +9,6 @@ export interface CloudflareEnv {
     ASSETS?: {
         fetch(request: Request): Promise<Response>;
     };
-    /**
-     * The agent runtime Worker, bound as a service.
-     *
-     * ⚠️ Optional, and it has to be: a deployment may run Intel without agents, and a hard requirement
-     * here would make the whole installation fail to start over a feature nobody uses. Where it is
-     * absent the agent routes answer 503 by name; where it is present the browser reaches the runtime
-     * through Intel and never across a second origin (#178).
-     */
-    AGENT?: {
-        fetch(request: Request): Promise<Response>;
-    };
     DB: D1Database;
     CONTENT: R2Bucket;
     INDEXING: QueueProducer<IndexMessage>;
@@ -30,34 +19,6 @@ export interface CloudflareEnv {
     GATE_SERVICE_KEY: string;
     INTEL_URL: string;
     INTEL_SESSION_SECRET: string;
-    /**
-     * The shared secret that proves a key handover reached the agent runtime through this Worker
-     * (D29, #207). The SAME value the agent Worker holds as `AGENT_HANDOVER_SECRET`.
-     *
-     * ⚠️ Optional exactly like `AGENT`: a deployment may run Intel without agents, and a hard
-     * requirement would make the whole installation fail to start over a feature nobody uses. Where
-     * it is absent, creating an agent refuses by name instead of leaving one without a key.
-     */
-    AGENT_HANDOVER_SECRET?: string;
-    /**
-     * Where the AI Gateway lives and how to READ it (#251, #257).
-     *
-     * ⚠️ `AI_GATEWAY_READ_TOKEN` is not the agent runtime's `AI_GATEWAY_TOKEN` and must never be the
-     * same value. That one carries `AI Gateway: Run` and buys inference; this one carries
-     * `AI Gateway: Read` — plus `Workers AI: Read` for the model catalog — and buys nothing at all.
-     * One credential doing both would put a spending permission into the Worker that only reads.
-     *
-     * ⚠️ Cloudflare cannot scope `AI Gateway: Read` to a single gateway; it is account-wide, the same
-     * limitation `AI Gateway: Run` already had in #239. It is worth knowing when the token is created
-     * and is not a reason against the route: it reads and writes nothing.
-     *
-     * ⚠️ All three optional, together. A deployment that configures none of them gets a cost view that
-     * says "not configured" and a model catalog off the built-in table — both named states, neither an
-     * error. Intel without a Cloudflare token is a supported installation.
-     */
-    AI_GATEWAY_ACCOUNT_ID?: string;
-    AI_GATEWAY_ID?: string;
-    AI_GATEWAY_READ_TOKEN?: string;
     TOOL_SOURCE_ORIGINS: string;
     MCP_PORTAL_URL?: string;
     ALLOW_INSECURE_OAUTH?: string;

package/dist/adapters/db/db-flows.js

@@ -219,7 +219,7 @@ export function createFlowRepository(deps) {
           SELECT
             EXISTS (SELECT 1 FROM ancestors WHERE id = ?) AS in_subtree,
             EXISTS (
-              SELECT 1 FROM tree_grants grant_row
+              SELECT 1 FROM node_grants grant_row
               JOIN ancestors ON ancestors.id = grant_row.node_id
               WHERE grant_row.principal_type = 'organization'
                 AND grant_row.verb = 'execute'

package/dist/adapters/db/db-grants.js

@@ -5,7 +5,7 @@ const principalMatch = `(
 )`;
 function grantExists(nodeColumn) {
     return `EXISTS (
-    SELECT 1 FROM tree_grants grant_row
+    SELECT 1 FROM node_grants grant_row
     WHERE grant_row.node_id = ${nodeColumn}
       AND ${principalMatch}
       AND grant_row.verb = ?

package/dist/adapters/db/db-indexing.js

@@ -1,3 +1,7 @@
+// How much of a chunk is kept as the passage a searcher is shown. The same 480 characters
+// `hydrateVisibleCitations` cuts out of the full-text row, so a citation reads the same length
+// whether it came from a card's own vector or from the fallback beside it.
+const maxPassageCharacters = 480;
 function mapTarget(row, contentKeys) {
     return {
         nodeId: row.node_id,
@@ -68,6 +72,81 @@ export function createNodeIndexRepository(db) {
                     .bind(target.versionId, target.nodeId, chunk.title, chunk.text, target.nodeId, target.versionId)),
             ]);
         },
+        /**
+         * ⚠️ `archived_at IS NOT NULL` carries this on its own, and it is the whole guard
+         * (anchrd/intel#348). `getTarget` above answers null for two reasons and only one of them means
+         * "purge": the other is a queue message for a version a later save superseded, and Cloudflare
+         * Queues deliver at least once, so those arrive as a matter of course. Acting on one would empty
+         * the vector index of a live board behind the back of the save that had just filled it — and
+         * nothing would report it, because a search that finds less is not an error.
+         *
+         * ⚠️ Deliberately NOT `current_version_id = v.id` as well, although that is what would make this
+         * the mirror image of `getTarget`. Symmetry is not a reason to write a condition: once the node
+         * IS archived, every version of it says the same thing about that node's vectors, so the extra
+         * clause could only ever refuse a purge that was right. A condition no test can turn red is a
+         * condition the next reader has to guess the purpose of.
+         */
+        async archivedNodeId(versionId) {
+            const row = await db
+                .prepare(`SELECT n.id AS node_id
+          FROM node_versions v
+          JOIN nodes n ON n.id = v.node_id
+          WHERE v.id = ? AND n.archived_at IS NOT NULL`)
+                .bind(versionId)
+                .first();
+            return row?.node_id ?? null;
+        },
+        async listVectors(nodeId) {
+            const result = await db
+                .prepare(`SELECT chunk_key, fingerprint, passage FROM node_vectors WHERE node_id = ?`)
+                .bind(nodeId)
+                .all();
+            return (result.results ?? []).map((row) => ({
+                chunkKey: row.chunk_key,
+                fingerprint: row.fingerprint,
+                passage: row.passage,
+            }));
+        },
+        /**
+         * The record of every vector this node has, replacing the record it had.
+         *
+         * ⚠️ The same delete-then-insert in ONE batch as `replace` above, and the same guard in front of
+         * every statement: a pass for a version that is no longer current, or for a node that has been
+         * archived meanwhile, writes nothing at all rather than half a record. What must not happen is
+         * the delete landing without the inserts — the next pass would then re-embed the whole board,
+         * which is exactly the cost anchrd/intel#301 exists to avoid.
+         */
+        async replaceVectors(target, records) {
+            await db.batch([
+                db
+                    .prepare(`DELETE FROM node_vectors WHERE node_id = ? AND EXISTS (
+            SELECT 1 FROM nodes
+            WHERE id = ? AND current_version_id = ? AND archived_at IS NULL
+          )`)
+                    .bind(target.nodeId, target.nodeId, target.versionId),
+                ...records.map((record) => db
+                    .prepare(`INSERT INTO node_vectors (node_id, chunk_key, version_id, fingerprint, passage)
+              SELECT ?, ?, ?, ?, ? WHERE EXISTS (
+                SELECT 1 FROM nodes
+                WHERE id = ? AND current_version_id = ? AND archived_at IS NULL
+              )`)
+                    .bind(target.nodeId, record.chunkKey, target.versionId, record.fingerprint, record.passage.slice(0, maxPassageCharacters), target.nodeId, target.versionId)),
+            ]);
+        },
+        /**
+         * The record of one node, gone — because its vectors are (anchrd/intel#348).
+         *
+         * ⚠️ No guard at all, and the absence is deliberate in both directions. There is no
+         * `archived_at IS NOT NULL`: the state this write exists to prevent is a row that outlives the
+         * vector it names, and a node restored between the deletion and this statement would keep
+         * exactly that — a record claiming vectors that are gone, which the next pass reads as "already
+         * embedded" and skips, leaving those cards silently unfindable. And there is no version
+         * condition: `archivedNodeId` has already established which node this is, from that same
+         * version, and a second reading of a moving row is a second answer rather than a safer one.
+         */
+        async deleteVectors(nodeId) {
+            await db.prepare("DELETE FROM node_vectors WHERE node_id = ?").bind(nodeId).run();
+        },
         async markIndexed(versionId, occurredAt) {
             await db
                 .prepare(`UPDATE node_index_state