@anchrd/intel-api 0.13.0 → 0.15.0

package/dist/bundle/bundle.js

@@ -1,6 +1,5 @@
-import { AgentDefinition, AgentMediaType, BlockNoteMediaType, BoardDocument, BoardMediaType, BundleImportResult, BundleManifest, BundleManifestFilename, DocumentLinkInlineType, FlowGraph, TableMediaType, } from "@anchrd/intel-contract";
+import { BlockNoteMediaType, BundleImportResult, BundleManifest, BundleManifestFilename, DocumentLinkInlineType, FlowGraph, TableMediaType, } from "@anchrd/intel-contract";
 import { Unzip, UnzipInflate, Zip, ZipDeflate, ZipPassThrough } from "fflate";
-import { repeatedBoardId, upgradeStoredBoard } from "../nodes/board/board.js";
 import { documentLinkTargets } from "../nodes/document-links/document-links.js";
 import { parseCsv } from "../shared/csv/csv.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
@@ -217,13 +216,11 @@ function nakedKindOf(name) {
     if (lower.endsWith(".csv")) {
         return { kind: "table", mediaType: TableMediaType, title: name.slice(0, -4) };
     }
-    // ⚠️ Before any plain `.json` rule and with a compound suffix on purpose (#285). A board is not
-    // recognisable from `.json` alone — an agent definition wears the same extension — so the export
-    // writes `.board.json` and a naked upload has to spell it out too. A file that only says `.json`
-    // is an attachment, which is what it was before boards existed.
-    if (lower.endsWith(".board.json")) {
-        return { kind: "board", mediaType: BoardMediaType, title: name.slice(0, -11) };
-    }
+    // ⚠️ `.board.json` had its own rule here until #390 and deliberately does not any more. This is
+    // the NAKED-folder path — a directory somebody picked, with no manifest — so a file called
+    // `plan.board.json` is a JSON file on a disk, and keeping it as an attachment preserves it. A
+    // real export is a different matter: its manifest declares the kind, and that is where such an
+    // entry is refused by name.
     return { kind: "attachment", mediaType: guessedMediaType(lower), title: name };
 }
 const KnownMediaTypes = {
@@ -402,41 +399,11 @@ export function createBundle(deps) {
                 },
             };
         }
-        // A board is one JSON file, exactly like an agent's definition: the document IS the board, so
-        // there is nothing to serialize differently for an export (#285). A board with no version yet
-        // exports as an empty file, the same way an agent without a definition does.
-        if (node.kind === "board") {
-            const path = `${directory}${uniqueName(used, base, ".board.json")}`;
-            return {
-                manifest: {
-                    id: node.id,
-                    kind: "board",
-                    title: node.title,
-                    description: node.description,
-                    mediaType: version?.mediaType ?? BoardMediaType,
-                    path,
-                },
-                content: version === null
-                    ? { type: "text", load: async () => "" }
-                    : { type: "text", load: textLoader(version.contentKey) },
-            };
-        }
-        if (node.kind === "agent") {
-            const path = `${directory}${uniqueName(used, base, ".json")}`;
-            return {
-                manifest: {
-                    id: node.id,
-                    kind: "agent",
-                    title: node.title,
-                    description: node.description,
-                    mediaType: version?.mediaType ?? "application/json",
-                    path,
-                },
-                content: version === null
-                    ? { type: "text", load: async () => "" }
-                    : { type: "text", load: textLoader(version.contentKey) },
-            };
-        }
+        // ⚠️ A row of a kind this build no longer makes — an `agent` or a `board` written before #390
+        // — falls through to the document branch and travels as its raw body. Deliberately forgiving:
+        // refusing here would make one leftover row enough to stop a whole subtree from being exported,
+        // and the file it produces is exactly the bytes that were stored. The IMPORT is where such a
+        // bundle is turned away, by name.
         // A document: markdown stays `.md`, a BlockNote body is JSON and says so with its name.
         const mediaType = version?.mediaType ?? "text/markdown";
         const extension = mediaType === BlockNoteMediaType ? ".json" : ".md";
@@ -926,101 +893,42 @@ export function createBundle(deps) {
                         if (header.length === 0 || header.every((column) => column.trim().length === 0)) {
                             throw new IntelError(400, "import_invalid_table", `Bundle entry is not a table with a header row: ${entry.path}`);
                         }
+                        // ⚠️ Distinct column names, read the same way `DefineTableInput` and
+                        // `RedefineTableInput` read them — case-insensitively (#322). Both refuse a duplicate,
+                        // and the import used to walk past both: a table could only enter the tree this way
+                        // with two columns of one name.
+                        //
+                        // The consumer assumes the opposite and says so. `packages/ui/src/node-table` keys its
+                        // header cells and every row cell with the column name and carries the comment
+                        // "Column names are distinct by contract (`DefineTableInput`)" — true for the two write
+                        // paths, and false for this one. Two equal names are two React keys with one value, in
+                        // the header AND in every row.
+                        const seen = new Set(header.map((column) => column.trim().toLowerCase()));
+                        if (seen.size !== header.length) {
+                            throw new IntelError(400, "import_invalid_table", `Bundle entry has two columns of the same name: ${entry.path}`);
+                        }
                         // The whole file as one snapshot: the same shape a definition or a redefine writes
                         // (#135), so reading starts here and nothing older is expected to exist.
                         version = versionRowFor(entry, text, TableMediaType, await deps.hash(text), "snapshot");
                     }
                 }
-                else if (entry.kind === "board") {
-                    const text = entry.body === null ? "" : decodeText(entry.body, entry.path);
-                    if (text.trim().length > 0) {
-                        let document;
-                        try {
-                            // Same upgrade the stored read does (anchrd/intel#311): a bundle exported before
-                            // `terminal` existed is exactly an old board in a file, and importing it must not be
-                            // the one way to lose a board.
-                            document = BoardDocument.parse(upgradeStoredBoard(JSON.parse(text)));
-                        }
-                        catch {
-                            throw new IntelError(400, "import_invalid_board", `Bundle entry is not a board: ${entry.path}`);
-                        }
-                        /**
-                         * ⚠️ Refused by name, and refused rather than folded (anchrd/intel#321).
-                         *
-                         * A board arriving in a file is the ONE place a document somebody else wrote becomes
-                         * truth here — everywhere else a task id is minted by `deps.id()` and a status list
-                         * goes through `ConfigureBoardInput`, which has demanded distinct ids since #285. Two
-                         * tasks under one id threw `graph.addNode` out of the board's graph view, and two
-                         * statuses under one id drew the same cards in two lanes with a drop that had two
-                         * targets meaning one.
-                         *
-                         * Outside the catch above on purpose: swallowed into `import_invalid_board` this would
-                         * read as "that file is not a board", and whoever is holding the file would look for
-                         * the wrong thing. `repeatedBoardId` names the id, which is the line they have to fix.
-                         */
-                        const repeated = repeatedBoardId(document);
-                        if (repeated !== null) {
-                            throw new IntelError(400, "import_duplicate_board_id", repeated.list === "tasks"
-                                ? `Bundle entry names the task “${repeated.id}” twice: ${entry.path}`
-                                : `Bundle entry names the status “${repeated.id}” twice: ${entry.path}`);
-                        }
-                        // ⚠️ `references` are remapped the way a document's inline links are, and `dependsOn`
-                        // and `parentId` are NOT (#285). A task's references point at NODES, which the import
-                        // renumbers; its dependencies and its parent point at tasks inside this very file,
-                        // whose ids the import does not touch. Renumbering those would break every edge in the
-                        // board for no reason.
-                        const remapped = {
-                            statuses: document.statuses,
-                            tasks: document.tasks.map((task) => ({
-                                ...task,
-                                references: task.references.map((reference) => idMap.get(reference) ?? reference),
-                            })),
-                        };
-                        const body = JSON.stringify(remapped);
-                        version = versionRowFor(entry, body, BoardMediaType, await deps.hash(body), null);
-                        // Into the same link pass as an imported document: a board's references are `text`
-                        // links, so they have to survive the import the same way.
-                        documentBodies.set(entry.newId, { mediaType: BoardMediaType, content: body });
-                    }
-                }
-                else if (entry.kind === "agent") {
-                    const text = entry.body === null ? "" : decodeText(entry.body, entry.path);
-                    if (text.trim().length > 0) {
-                        let definition;
-                        try {
-                            definition = AgentDefinition.parse(JSON.parse(text));
-                        }
-                        catch {
-                            throw new IntelError(400, "import_invalid_agent", `Bundle entry is not an agent definition: ${entry.path}`);
-                        }
-                        const remapped = {
-                            ...definition,
-                            /**
-                             * ⚠️ A delegation NEVER travels in a file (#208, D30). `tools.delegatedBy` names
-                             * whose portal connection an agent acts on, and the only thing that may write it is
-                             * a person saving the agent in a session Intel authorized — the save path proves
-                             * they reach every named server first. A bundle is a document somebody hands over;
-                             * carrying the field through would let a crafted file name a local user and hand an
-                             * imported agent that person's connection, with no act of theirs anywhere.
-                             *
-                             * The consequence is deliberate and mild: an imported agent arrives with no tools,
-                             * and whoever wants it to have some gives them in the profile — which is the same
-                             * act D30 made the only way in.
-                             */
-                            tools: null,
-                            references: definition.references.map((reference) => idMap.has(reference.nodeId)
-                                ? { ...reference, nodeId: idMap.get(reference.nodeId) }
-                                : reference),
-                            schedules: definition.schedules.map((schedule) => idMap.has(schedule.target.id)
-                                ? {
-                                    ...schedule,
-                                    target: { ...schedule.target, id: idMap.get(schedule.target.id) },
-                                }
-                                : schedule),
-                        };
-                        const body = JSON.stringify(remapped);
-                        version = versionRowFor(entry, body, AgentMediaType, await deps.hash(body), null);
-                    }
+                else if (entry.kind === "board" || entry.kind === "agent") {
+                    /**
+                     * ⚠️ Refused by name, and the name says WHY rather than what the parser tripped over.
+                     *
+                     * Agents and Boards were parked with #385; nothing in this build can hold either kind.
+                     * A bundle that carries one is not malformed — it is a correct export of an installation
+                     * that still had the feature, and the person holding it is usually moving a tree between
+                     * two installations rather than the author of the file. Left to the schema they would get
+                     * `unexpected enum value`, look for a broken file, and find nothing wrong with it.
+                     *
+                     * The refusal names the entry, the kind and the branch the feature is parked on, so the
+                     * answer to "where did my board go" is in the message and not in somebody's memory.
+                     *
+                     * ⚠️ Only a MANIFEST can reach this, because only a manifest declares a kind. A naked
+                     * folder holding a `plan.board.json` imports it as an attachment — see `kindOfFile`.
+                     */
+                    throw new IntelError(400, "import_kind_parked", `Bundle entry “${entry.path}” is a ${entry.kind}, and ${entry.kind}s are not part of this installation any more (anchrd/intel#385). The bundle was exported from a version that still had them; the code is on the branch parked/agents-and-board. Remove the entry from the bundle to import the rest.`);
                 }
                 else if (entry.kind === "attachment") {
                     const bytes = entry.body ?? new Uint8Array(0);

package/dist/cli/cli.js

@@ -12,15 +12,9 @@ const interfaces = [
         functions: ["read", "create", "write", "publish", "run", "share"],
     },
     { handle: "tools", functions: ["read", "test", "execute", "admin"] },
-    // Declared here, and not by a service of its own, because Gate scopes the rules it returns to the
-    // service whose key asked (least privilege). The agent runtime authorizes its callers with this
-    // installation's Gate service key against the same audience Intel uses, so a handle registered
-    // anywhere else would never appear in the rules that `can("agents", "run")` reads.
-    //
-    // Without it there is no state between "administrator" and "not at all": the runtime falls back to
-    // `intel:admin`, which is the first-grant exit in the same sense as everywhere else, not the way a
-    // team lets a colleague talk to an agent.
-    { handle: "agents", functions: ["run"] },
+    // ⚠️ `agents:run` is deliberately NOT here any more (#390). `bootstrap` declares, it never
+    // revokes, so an installation that has the interface keeps it as a harmless leftover — but a new
+    // one is not asked to decide about a permission nothing reads.
     // `mcp:connect` means the same thing at every MCP service of this installation. A separate name
     // for the same thing forces the operator to check, service by service, which permission carries
     // portal access.

package/dist/http/http.js

@@ -1,4 +1,4 @@
-import { AddBoardTaskInput, AppendTableRowsInput, ArchiveFlowInput, ArchiveNodeInput, CancelFlowRunInput, CompleteFlowRunStepInput, ConfigureBoardInput, CreateAgentInput, CreateFlowInput, CreateNodeInput, DefineTableInput, DeleteBoardTaskInput, DeleteTableRowsInput, ExecuteToolInput, GetFlowInput, GetFlowRunInput, GetFlowVersionInput, GetNodeInput, GetNodeVersionInput, ListAgentsInput, ListFlowRunsInput, ListFlowsInput, ListNodesInput, MoveBoardTaskInput, NodeGraphInput, PreviewFlowPublishInput, PublishFlowInput, RedefineTableInput, RelationGraphInput, ResolveNodeLinksInput, RevokeGrantInput, RotateAgentKeyInput, SaveAgentDefinitionInput, SaveAttachmentInput, SaveFlowVersionInput, SaveNodeVersionInput, SearchInput, ShareInput, StartFlowRunInput, TestToolInput, UnpublishFlowInput, UpdateBoardTaskInput, UpdateFlowInput, UpdateNodeInput, UpdateTableRowsInput, } from "@anchrd/intel-contract";
+import { AppendTableRowsInput, ArchiveFlowInput, ArchiveNodeInput, CancelFlowRunInput, CompleteFlowRunStepInput, CreateFlowInput, CreateNodeInput, DefineTableInput, DeleteTableRowsInput, ExecuteToolInput, GetFlowInput, GetFlowRunInput, GetFlowVersionInput, GetNodeInput, GetNodeVersionInput, ListFlowRunsInput, ListFlowsInput, ListNodesInput, NodeGraphInput, PreviewFlowPublishInput, PublishFlowInput, RedefineTableInput, RelationGraphInput, ResolveNodeLinksInput, RevokeGrantInput, SaveAttachmentInput, SaveFlowVersionInput, SaveNodeVersionInput, SearchInput, ShareInput, StartFlowRunInput, TestToolInput, UnpublishFlowInput, UpdateFlowInput, UpdateNodeInput, UpdateTableRowsInput, } from "@anchrd/intel-contract";
 import { Hono } from "hono";
 import { z } from "zod";
 import { authorizeBearer, bearer, permits, } from "../shared/gate-authorization/gate-authorization.js";
@@ -78,16 +78,6 @@ function asFlowActor(authorization) {
         isAdmin: authorization.can("intel", "admin"),
     };
 }
-// The same `agents/run` the agent Worker asks for, resolved once at Intel's door. `intel/admin`
-// opens it for the same reason it opens every other one — `permits` is where that lives.
-function asAgentActor(authorization) {
-    return {
-        id: authorization.identity.id,
-        email: authorization.identity.email,
-        isAdmin: authorization.can("intel", "admin"),
-        canRun: permits(authorization, "agents", "run"),
-    };
-}
 export function createHttp(deps) {
     const app = new Hono();
     async function authenticated(headers) {
@@ -136,94 +126,6 @@ export function createHttp(deps) {
             name: identity.name ?? null,
         });
     });
-    // What this deployment is equipped to do (#190) — facts about the installation, not about the
-    // caller, which is why it needs no capability beyond being signed in. `/session` stays identity
-    // only on purpose; this is the separate answer the UI asks for instead of reading a 503 as one.
-    // It sits behind the auth middleware like everything else, so an anonymous probe still learns
-    // nothing about whether a runtime exists.
-    app.get("/capabilities", (context) => {
-        return context.json({ agentRuntime: deps.agents.available() });
-    });
-    /**
-     * What the models on offer cost and how much they hold (#257).
-     *
-     * ⚠️ Intel asks Cloudflare, never the browser. The account endpoint needs a token and a token does
-     * not belong in a SPA — which is the sentence the hard-coded table in `packages/ui` used to carry
-     * as the reason it stayed hard-coded. This route is the answer to it: the figures cross the wire,
-     * the credential does not.
-     *
-     * ⚠️ No capability beyond being signed in. It is a fact about the installation and about nobody's
-     * data — the same footing `/capabilities` stands on.
-     *
-     * ⚠️ The `cache-control` is the caching the ticket asks for, and it is the caching that matters:
-     * the waste it names is "one fetch every time the select is opened", and that fetch is the
-     * browser's. A Worker isolate has nowhere durable to keep a table between requests, and inventing
-     * storage for a list of prices would cost more than the request it saved.
-     */
-    app.get("/models", async (context) => {
-        context.header("cache-control", "private, max-age=3600");
-        return context.json(await deps.models.list());
-    });
-    /**
-     * The agent runtime, reached through Intel.
-     *
-     * ⚠️ This list IS the door. The runtime serves more than what stands here — `/mcp` is the agent's
-     * own MCP surface, which the portal dials with its own credential (ADR-0005 §7), and
-     * `/mail/inbound` is authorized by a webhook signature. Neither is a browser path, and neither
-     * becomes one by being reachable: anything not named below is a 404 from Hono's router, so there
-     * is no allow-list beside the routes that could go quietly out of step with them.
-     *
-     * ⚠️ `agents/run` — not `knowledge/read`. Reading an agent's page is a knowledge read; driving the
-     * agent is the capability the runtime itself insists on, and Intel refuses on the same terms
-     * BEFORE the binding is touched, so a denial never reaches the runtime at all.
-     */
-    const runtimeRoutes = [
-        { method: "GET", pattern: "/state", path: () => "/state" },
-        { method: "GET", pattern: "/runs", path: () => "/runs" },
-        {
-            method: "GET",
-            pattern: "/runs/:runId",
-            path: (context) => `/runs/${encodeURIComponent(context.req.param("runId") ?? "")}`,
-        },
-        { method: "GET", pattern: "/log", path: () => "/log" },
-        { method: "POST", pattern: "/chat", path: () => "/chat" },
-        { method: "POST", pattern: "/pause", path: () => "/pause" },
-        { method: "POST", pattern: "/resume", path: () => "/resume" },
-        { method: "POST", pattern: "/run", path: () => "/run" },
-    ];
-    /**
-     * What this agent has cost — answered by Intel itself, not forwarded (#251).
-     *
-     * ⚠️ It stands under `/agents/:agentId` and is NOT in `runtimeRoutes`, which is the whole point of
-     * writing it out here. The runtime has no idea what anything costs: the figures come from
-     * Cloudflare's AI Gateway log, which needs an `AI Gateway: Read` token, and that token belongs in
-     * Intel rather than in the Worker that executes model-driven tool calls — the runtime's own
-     * `CLAUDE.md` keeps the number of credentials there deliberately small. The runtime's part is the
-     * stamp on the model call and nothing more.
-     *
-     * ⚠️ `agents/run`, matching the run list this stands beside. What an agent spends is as sensitive
-     * as what it did, and the two must not be reachable on different terms.
-     */
-    app.get("/agents/:agentId/costs", async (context) => {
-        const authorization = context.get("authorization");
-        return context.json(await deps.agentCosts.read(asAgentActor(authorization), context.req.param("agentId")));
-    });
-    for (const route of runtimeRoutes) {
-        app.on(route.method, `/agents/:agentId${route.pattern}`, async (context) => {
-            const authorization = context.get("authorization");
-            // The runtime's answer is returned untouched, headers included: the chat is a stream, and a
-            // body read here to inspect it would be a stream nobody could read afterwards.
-            return await deps.agents.forward({
-                actor: asAgentActor(authorization),
-                token: context.get("token"),
-                agentId: context.req.param("agentId"),
-                method: route.method,
-                path: route.path(context),
-                ...(route.method === "POST" ? { body: await context.req.text() } : {}),
-                signal: context.req.raw.signal,
-            });
-        });
-    }
     app.get("/nodes", async (context) => {
         const auth = requireCapability(context, "knowledge", "read");
         const url = new URL(context.req.url);
@@ -251,51 +153,6 @@ export function createHttp(deps) {
         });
         return context.json(await deps.nodes.graph(asActor(auth), input));
     });
-    // ⚠️ Before `/nodes/:nodeId`, or the router would read "agents" as a node ID. Same order and same
-    // reason as `/nodes/graph` above.
-    app.get("/nodes/agents", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
-        const url = new URL(context.req.url);
-        requireKnownQuery(url, ["parentId", "includeArchived"]);
-        const parentId = url.searchParams.get("parentId");
-        // ⚠️ The key is only set when the caller sent it. Omitted means the whole tree and `null` means
-        // the root level, so defaulting a missing parameter to `null` here would silently answer a
-        // different question than the one asked.
-        const input = ListAgentsInput.parse({
-            ...(url.searchParams.has("parentId") ? { parentId: parentId === "" ? null : parentId } : {}),
-            includeArchived: url.searchParams.get("includeArchived") === "true",
-        });
-        return context.json(await deps.nodes.listAgents(asActor(auth), input));
-    });
-    /**
-     * ⚠️ NO response in Intel's HTTP surface carries a credential any more (D29, #207).
-     *
-     * Creating an agent still mints its Gate Application with the caller's own bearer — so this needs
-     * `applications:write` in Gate on top of `knowledge:create` in Intel — but the key Gate issues
-     * once goes straight into the agent runtime over the service binding, inside this request. The
-     * answer is the same shape every agent read has. Until #207 it carried the key in plain text and
-     * a person had to put it into a Worker secret by hand, which is why an agent created here could
-     * never run (#200).
-     */
-    app.post("/nodes/agents", async (context) => {
-        const auth = requireCapability(context, "knowledge", "create");
-        const input = CreateAgentInput.parse(await context.req.json().catch(() => null));
-        return context.json(await deps.nodes.createAgent(asActor(auth), input, { token: context.get("token") }), 201);
-    });
-    /**
-     * The repair path, and the only one an agent that lost its key has (D29, #207).
-     *
-     * ⚠️ `knowledge/write`, not `agents/run`. Which principal an agent acts as is a property of the
-     * agent, changed by whoever may change the agent; being allowed to press "Run now" is a different
-     * question and answers a different one. The resource ACL on the node is checked by the service.
-     *
-     * ⚠️ Before `/nodes/:nodeId`, like every other literal segment under `/nodes`.
-     */
-    app.post("/nodes/agents/:nodeId/rotate-key", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = RotateAgentKeyInput.parse({ nodeId: context.req.param("nodeId") });
-        return context.json(await deps.nodes.rotateAgentKey(asActor(auth), input, { token: context.get("token") }));
-    });
     // ⚠️ Before `/nodes/:nodeId`, or the router would read "export" as a node ID. The root has no
     // node to address, so the whole installation — as this caller may read it — exports here (#136).
     app.get("/nodes/export", async (context) => {
@@ -337,20 +194,6 @@ export function createHttp(deps) {
         const input = GetNodeInput.parse({ nodeId: context.req.param("nodeId") });
         return zipResponse(await deps.bundle.exportSubtree(asBundleActor(auth), input.nodeId));
     });
-    app.get("/nodes/:nodeId/agent", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
-        return context.json(await deps.nodes.getAgent(asActor(auth), { nodeId: context.req.param("nodeId") }));
-    });
-    app.post("/nodes/:nodeId/agent", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = SaveAgentDefinitionInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        // ⚠️ The caller's own bearer travels on, like it does when an agent is created: writing a
-        // definition also arms what it schedules, and that call is made as the person saving (#214).
-        return context.json(await deps.nodes.saveAgentDefinition(asActor(auth), input, { token: context.get("token") }), 201);
-    });
     app.get("/nodes/:nodeId/versions", async (context) => {
         const auth = requireCapability(context, "knowledge", "read");
         return context.json(await deps.nodes.listVersions(asActor(auth), context.req.param("nodeId")));
@@ -438,54 +281,10 @@ export function createHttp(deps) {
         }
         return context.json(await deps.nodes.redefineTable(asActor(auth), input), 201);
     });
-    // The board (#285). One read and five task operations, all action-style POSTs for the same reason
-    // the table mutations are: what they address is a task ID in the body, and none of them has an
-    // address of its own to PUT to. Every one writes a version, so they all answer 201 like the
-    // table's do.
-    app.get("/nodes/:nodeId/board", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
-        return context.json(await deps.nodes.getBoard(asActor(auth), { nodeId: context.req.param("nodeId") }));
-    });
-    app.post("/nodes/:nodeId/board/configure", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = ConfigureBoardInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.configureBoard(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = AddBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.addBoardTask(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks/update", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = UpdateBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.updateBoardTask(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks/move", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = MoveBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.moveBoardTask(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks/delete", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = DeleteBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.deleteBoardTask(asActor(auth), input), 201);
-    });
+    // ⚠️ There is deliberately no route for the sixth board operation. `board_repair_task_ids`
+    // (anchrd/intel#341) is MCP-only until a screen calls it: the routes here are what the browser
+    // reaches, nothing in `intel-data-provider` asks for it, and a route with no caller is the thing
+    // YAGNI is about. The screen is anchrd/intel#358, and it brings this route with it.
     app.get("/nodes/:nodeId/links", async (context) => {
         const auth = requireCapability(context, "knowledge", "read");
         return context.json(await deps.nodes.listLinks(asActor(auth), context.req.param("nodeId")));

package/dist/http/http.types.d.ts

@@ -1,10 +1,7 @@
 import type { GateClient } from "@anchrd/gate-sdk";
-import type { AgentCostsService } from "../agent-costs/agent-costs.types.js";
-import type { AgentRuntimeService } from "../agent-runtime/agent-runtime.types.js";
 import type { BrowserAuth } from "../auth/auth.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
 import type { FlowService } from "../flows/flows.types.js";
-import type { ModelCatalogService } from "../model-catalog/model-catalog.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
 import type { ToolService } from "../tools/tools.types.js";
 export interface HttpDeps {
@@ -13,11 +10,6 @@ export interface HttpDeps {
     flows: FlowService;
     tools: ToolService;
     bundle: BundleService;
-    agents: AgentRuntimeService;
-    /** What an agent has cost, read out of the AI Gateway log rather than computed here (#251). */
-    agentCosts: AgentCostsService;
-    /** What the models on offer cost, read from Cloudflare rather than typed out here (#257). */
-    models: ModelCatalogService;
     resource: string;
     resourceMetadataUrl: string;
     auth?: Pick<BrowserAuth, "resolve">;