@anchrd/intel-api 0.13.0 → 0.15.0

package/dist/nodes/nodes.types.d.ts

@@ -1,4 +1,4 @@
-import type { AddBoardTaskInput, AgentKeyRotated, AgentList, AppendTableRowsInput, AppendTableRowsResult, ArchiveNodeInput, BoardTaskResult, ConfigureBoardInput, ConfigureBoardResult, CreateAgentInput, CreatedAgent, CreateNodeInput, DefineTableInput, DeleteBoardTaskInput, DeleteBoardTaskResult, DeleteTableRowsInput, DeleteTableRowsResult, Flow, FlowVersion, GetAgentInput, GetBoardInput, ListAgentsInput, ListNodesInput, MoveBoardTaskInput, Node, NodeAgent, NodeAttachment, NodeBoard, NodeCitation, NodeDocument, NodeGraph, NodeGraphInput, NodeLink, NodeTable, NodeVersion, RedefineTableInput, ResolveNodeLinksInput, ResolveNodeLinksResult, ResourceGrant, ResourceGrantList, ResourceVerb, RevokeGrantInput, RotateAgentKeyInput, SaveAgentDefinitionInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, ShareInput, ShareResult, UpdateBoardTaskInput, UpdateNodeInput, UpdateTableRowsInput, UpdateTableRowsResult } from "@anchrd/intel-contract";
+import type { AppendTableRowsInput, AppendTableRowsResult, ArchiveNodeInput, CreateNodeInput, DefineTableInput, DeleteTableRowsInput, DeleteTableRowsResult, Flow, FlowVersion, ListNodesInput, Node, NodeAttachment, NodeCitation, NodeDocument, NodeGraph, NodeGraphInput, NodeLink, NodeTable, NodeVersion, RedefineTableInput, ResolveNodeLinksInput, ResolveNodeLinksResult, ResourceGrant, ResourceGrantList, ResourceVerb, RevokeGrantInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, ShareInput, ShareResult, UpdateNodeInput, UpdateTableRowsInput, UpdateTableRowsResult } from "@anchrd/intel-contract";
 import type { SemanticIndex } from "../adapters/semantic-index/semantic-index.types.js";
 export interface Actor {
     id: string;
@@ -10,9 +10,6 @@ export interface NewNode {
     actorId: string;
     idempotencyKey: string;
     auditId: string;
-    application?: {
-        id: string;
-    } | undefined;
 }
 export interface NewNodeVersion {
     version: NodeVersion;
@@ -27,7 +24,7 @@ export interface NewTableVersion {
     idempotencyKey: string;
     auditId: string;
 }
-export type SnapshotOperation = "node.table_update" | "node.table_delete" | "node.table_redefine" | "node.board_configure" | "node.board_task_add" | "node.board_task_update" | "node.board_task_move" | "node.board_task_delete";
+export type SnapshotOperation = "node.table_update" | "node.table_delete" | "node.table_redefine";
 /**
  * One version that replaces the readable state, written only against the state it replaces.
  *
@@ -35,11 +32,6 @@ export type SnapshotOperation = "node.table_update" | "node.table_delete" | "nod
  * read, so it has to know which state it replaces — the same optimistic concurrency the document
  * save uses, enforced in the same statement that inserts the row (#135).
  *
- * ⚠️ A board uses this too, and its `baseVersionId` is NOT the caller's (#285). The caller of a task
- * operation never sends one; the service reads the current version, applies the change by task id
- * and passes what it read. A refusal here therefore means "somebody wrote in between", which the
- * service answers by reading again and re-applying, so two agents moving two different tasks both
- * get through instead of one of them meeting `version_conflict`.
  */
 export interface NewSnapshotVersion {
     version: NodeVersion;
@@ -59,8 +51,6 @@ export interface NodeRepository {
         parentId: string | null;
         limit: number;
     }): Promise<BoundedChildren>;
-    listVisibleAgents(actor: Actor, input: ListAgentsInput): Promise<Node[]>;
-    listVisibleAgentDefinitionKeys(actor: Actor, folderId: string): Promise<string[]>;
     getVisible(actor: Actor, nodeId: string): Promise<Node | null>;
     listVisibleSubtree(actor: Actor, rootId: string | null): Promise<SubtreeNode[]>;
     can(actor: Actor, nodeId: string, verb: ResourceVerb): Promise<boolean>;
@@ -68,27 +58,6 @@ export interface NodeRepository {
     findIdempotentRevocation(actorId: string, idempotencyKey: string): Promise<boolean | null>;
     findSnapshotMetadata(actorId: string, operation: SnapshotOperation, idempotencyKey: string): Promise<Record<string, unknown> | null>;
     insertNode(input: NewNode): Promise<Node>;
-    agentApplicationId(nodeId: string): Promise<string | null>;
-    /**
-     * The audit row for replacing the key of the Application an agent runs as (D29, #207).
-     *
-     * ⚠️ Its own write because it is the only mutation on an agent node that changes nothing IN the
-     * node — no version, no row, nothing a reader could diff afterwards. Swapping which credential an
-     * agent acts with is the most security-relevant thing anybody does to it, and without this it
-     * would be the one act on the tree that leaves no trace in Intel at all. Gate audits its side;
-     * Gate does not know which Intel node the principal belongs to.
-     *
-     * ⚠️ `applicationId` names the principal and is a name, not a credential. The key itself is not a
-     * parameter here and must never become one — audit is metadata, and this is exactly the row a
-     * "helpful" second field would leak it into.
-     */
-    recordAgentKeyRotation(input: {
-        auditId: string;
-        actorId: string;
-        nodeId: string;
-        applicationId: string;
-        occurredAt: string;
-    }): Promise<void>;
     getVersion(versionId: string): Promise<NodeVersion | null>;
     appendVersion(input: NewNodeVersion): Promise<"saved" | "conflict">;
     appendTableVersion(input: NewTableVersion): Promise<NodeVersion>;
@@ -145,7 +114,21 @@ export interface NodeRepository {
         occurredAt: string;
     }): Promise<boolean>;
     searchVisible(actor: Actor, input: SearchInput): Promise<NodeCitation[]>;
-    hydrateVisibleCitations(actor: Actor, nodeIds: string[], scopeId?: string): Promise<NodeCitation[]>;
+    /**
+     * `scopeId` cuts the candidates to one folder subtree, which is how the semantic half of a scoped
+     * search is narrowed (#126): the vector index answers over everything and this join is where the
+     * subtree — a relation in D1, not a value on a vector — is applied. The ACL still applies too.
+     *
+     * ⚠️ One entry per node, and it names WHICH chunk answered (anchrd/intel#301). The passage a
+     * searcher is shown is then that card rather than whichever one happens to be first in the board;
+     * a node whose winning chunk has no `node_vectors` row — every vector written before #301 — falls
+     * back on the first full-text passage, which is exactly what this returned before.
+     */
+    hydrateVisibleCitations(actor: Actor, hits: Array<{
+        nodeId: string;
+        chunkKey: string;
+    }>, scopeId?: string): Promise<NodeCitation[]>;
+    invalidateVectors(): Promise<void>;
     listCurrentVersionIds(input: {
         after: string | null;
         limit: number;
@@ -193,90 +176,12 @@ export interface NodeAttachmentBody {
     attachment: NodeAttachment;
     body: ReadableStream<Uint8Array>;
 }
-/**
- * Gate's Applications surface, as the tree needs it (#182).
- *
- * ⚠️ Every call carries the CALLER's own Gate bearer, never a service key. Creating and switching a
- * machine principal is an administrative act in Gate, gated on `applications:write` and audited
- * there under the person who performed it; Intel's service key does not open that door at all
- * (Gate's two-token rule). The token is therefore a parameter of the operation rather than a field
- * of the actor: it must be impossible to reach for by accident from a service that has no business
- * with it, and it must never end up on an audit row or in a log line.
- */
-export interface AgentApplications {
-    /**
-     * A new machine principal, named so a person can recognise the agent behind it.
-     *
-     * ⚠️ The returned key is plain text, the only time it exists in readable form anywhere, and it is
-     * gone from Gate the moment this call returns. It is passed straight back to the caller who asked
-     * for it and is written nowhere on the way (D27).
-     */
-    create(input: {
-        token: string;
-        name: string;
-    }): Promise<{
-        id: string;
-        key: string;
-    }>;
-    /**
-     * A replacement key for an Application that already exists, invalidating every earlier one.
-     *
-     * ⚠️ Gate issues before it revokes, so a failed rotation leaves the old key working. That is what
-     * makes `rotate-key` a safe repair rather than a way to lock an agent out: the only state this
-     * can leave behind is "new key issued, runtime never got it", and rotating again fixes it.
-     */
-    rotateKey(input: {
-        token: string;
-        applicationId: string;
-    }): Promise<{
-        key: string;
-    }>;
-    setEnabled(input: {
-        token: string;
-        applicationId: string;
-        enabled: boolean;
-    }): Promise<void>;
-}
 export interface GateCaller {
     token: string;
 }
 export interface NodesDeps {
     repository: NodeRepository;
     content: ContentStore;
-    applications: AgentApplications;
-    agentRuntimeAvailable(): boolean;
-    /**
-     * The runtime's key store, as the tree needs it (D29, #207).
-     *
-     * ⚠️ This is where the Application key GOES, and it is the only place it goes. Gate hands it out
-     * once, this port carries it into the agent's Durable Object over the service binding, and the
-     * local variable that held it dies with the call. Nothing in this file writes it to D1, R2, an
-     * audit row, a log line or a response — the proof is the absence of the value in every argument
-     * every port was called with, not a redaction somebody could forget.
-     */
-    agentKeys: {
-        store(input: {
-            token: string;
-            agentId: string;
-            key: string;
-        }): Promise<void>;
-    };
-    /**
-     * The runtime's alarm, brought in line with the definition that was just written (#214).
-     *
-     * ⚠️ Required, not optional, and it carries no schedules. The runtime arms its alarm only when
-     * something tells it to look — a chat turn, a resume, a manual run, or this call — so a definition
-     * written without it leaves an agent whose schedules are visible in its profile and fire never.
-     * What travels is the agent's ID and the caller's bearer; the runtime re-reads the definition from
-     * Intel with the agent's own token, which is what keeps a schedule something that was written
-     * before it can be acted on.
-     */
-    agentSchedules: {
-        sync(input: {
-            token: string;
-            agentId: string;
-        }): Promise<void>;
-    };
     id(): string;
     now(): Date;
     externalFlowCallers(actor: Actor, folderId: string): Promise<{
@@ -339,47 +244,6 @@ export interface NodeService {
     updateTableRows(actor: Actor, input: UpdateTableRowsInput): Promise<UpdateTableRowsResult>;
     deleteTableRows(actor: Actor, input: DeleteTableRowsInput): Promise<DeleteTableRowsResult>;
     redefineTable(actor: Actor, input: RedefineTableInput): Promise<NodeTable>;
-    /**
-     * A board and the five operations that change it (#285).
-     *
-     * ⚠️ Not one "save the board" call, deliberately. Every write here names a TASK ID and the server
-     * applies it to the document it just read, so two callers touching two different tasks both get
-     * through — the same problem `appendTableRows` solves for a table, arrived at from the other side.
-     * A whole-document write would put every concurrent editor into `version_conflict` and force each
-     * of them to read a board of thousands of tasks before changing one word on one card.
-     */
-    getBoard(actor: Actor, input: GetBoardInput): Promise<NodeBoard>;
-    configureBoard(actor: Actor, input: ConfigureBoardInput): Promise<ConfigureBoardResult>;
-    addBoardTask(actor: Actor, input: AddBoardTaskInput): Promise<BoardTaskResult>;
-    updateBoardTask(actor: Actor, input: UpdateBoardTaskInput): Promise<BoardTaskResult>;
-    moveBoardTask(actor: Actor, input: MoveBoardTaskInput): Promise<BoardTaskResult>;
-    deleteBoardTask(actor: Actor, input: DeleteBoardTaskInput): Promise<DeleteBoardTaskResult>;
-    getAgent(actor: Actor, input: GetAgentInput): Promise<NodeAgent>;
-    /**
-     * An agent node, its first definition, and the Gate Application it runs as (#182, D29).
-     *
-     * ⚠️ The answer carries NO key. The one Gate issues goes straight into the agent runtime over the
-     * service binding, inside this call, and the caller never sees it — which is what makes an agent
-     * created through the screen able to run without a terminal step (#200, #207).
-     */
-    createAgent(actor: Actor, input: CreateAgentInput, caller: GateCaller): Promise<CreatedAgent>;
-    /**
-     * Replace the key of the Application an agent runs as, and give the new one to the runtime.
-     *
-     * ⚠️ The repair path for an agent that answers `agent_key_missing`, and the only one: Gate keeps
-     * a key hashed, so an agent whose Durable Object lost its key cannot be handed the old one back.
-     * It is a write on the agent node — `knowledge/write` and the resource ACL — not a run.
-     */
-    rotateAgentKey(actor: Actor, input: RotateAgentKeyInput, caller: GateCaller): Promise<AgentKeyRotated>;
-    /**
-     * A new definition version for an agent, and the alarm that goes with it (#214).
-     *
-     * ⚠️ It takes the caller's bearer for the same reason `createAgent` does: the runtime is told to
-     * re-arm over the service binding, and what travels on that call is the person behind this request
-     * — never a service key (D19).
-     */
-    saveAgentDefinition(actor: Actor, input: SaveAgentDefinitionInput, caller: GateCaller): Promise<NodeAgent>;
-    listAgents(actor: Actor, input: ListAgentsInput): Promise<AgentList>;
     getAttachment(actor: Actor, nodeId: string): Promise<NodeAttachment>;
     readAttachment(actor: Actor, nodeId: string): Promise<NodeAttachmentBody>;
     listVersions(actor: Actor, nodeId: string): Promise<{
@@ -420,27 +284,62 @@ export interface NodeIndexTarget {
     description: string | null;
     contentKeys: string[];
     mediaType: string;
-    kind: "document" | "attachment" | "table" | "agent" | "board";
+    kind: "document" | "attachment" | "table";
     updatedAt: string;
 }
 /**
  * One passage of a node, as the full-text index holds it.
  *
- * ⚠️ A list, and most kinds put exactly one in it. A board puts one per TASK (#285): "where do I
- * stand with X" has to find a card, and a board indexed as one blob would answer with the whole
- * board every time — the passage a searcher is shown would be whichever thousand characters the
- * snippet happened to cut, from a task that may have nothing to do with the question.
+ * ⚠️ A list, and every kind left after #390 puts exactly one in it. It stays a list because the
+ * chunked shape is what `node_fts` and `node_vectors` are built around (#285, anchrd/intel#301) —
+ * the one thing that would have to be rebuilt to unpick it.
  *
  * `title` is what the passage is called rather than what the node is called: for a task it is the
  * task's own title, which is the text the FTS table weights highest.
  */
 export interface IndexChunk {
+    /**
+     * What this passage is called inside its node (anchrd/intel#301).
+     *
+     * `""` for a node that is one passage, which since #390 is every kind. The full-text index does
+     * not store it; the vector index is NAMED by it, and that is why it stays: the name written
+     * before anchrd/intel#301 is the bare node id, so nothing an installation already holds has to be
+     * renamed or embedded again.
+     */
+    key: string;
     title: string;
     text: string;
 }
+/**
+ * What the vector index holds for one chunk of one node (anchrd/intel#301).
+ *
+ * `fingerprint` is over the exact text that was embedded, so the next pass can tell an untouched
+ * card from a changed one without asking Vectorize — whose writes are asynchronous and would answer
+ * about the save before last. `passage` is what a searcher is shown when this vector is the hit.
+ */
+export interface NodeVectorRecord {
+    chunkKey: string;
+    fingerprint: string;
+    passage: string;
+}
 export interface NodeIndexRepository {
     getTarget(versionId: string): Promise<NodeIndexTarget | null>;
+    /**
+     * The node behind this version when the reason `getTarget` refused it is that the node has been
+     * ARCHIVED — and null for every other reason (anchrd/intel#348).
+     *
+     * ⚠️ The distinction is the whole method. `getTarget` answers null for two very different
+     * situations: the node is archived, or this version has been superseded by a later save. The
+     * first one means "take this node out of the vector index"; the second is a queue message that
+     * arrived late — the ordinary case, because Cloudflare Queues deliver at least once — and acting
+     * on it would delete the vectors of a node that is perfectly alive. So this asks for the archived
+     * case by name and never infers it from an absence.
+     */
+    archivedNodeId(versionId: string): Promise<string | null>;
     replace(target: NodeIndexTarget, chunks: IndexChunk[]): Promise<void>;
+    listVectors(nodeId: string): Promise<NodeVectorRecord[]>;
+    replaceVectors(target: NodeIndexTarget, records: NodeVectorRecord[]): Promise<void>;
+    deleteVectors(nodeId: string): Promise<void>;
     markIndexed(versionId: string, occurredAt: string): Promise<void>;
     markError(versionId: string, message: string, occurredAt: string): Promise<void>;
 }

package/dist/tools/tools.js

@@ -1,4 +1,3 @@
-import { serverOf } from "@anchrd/intel-contract";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 import { ServerDirectoryTool, toolServersFrom, } from "./tool-servers/tool-servers.js";
@@ -7,18 +6,14 @@ const MaxTools = 1_000;
 const MaxResultBytes = 1_000_000;
 // Refresh slightly early so a call cannot start with a token that expires mid-flight.
 const RefreshWindowMs = 30_000;
-/**
- * An agent that delegates nothing — no servers, or no delegator to act for.
- *
- * ⚠️ It is answered without touching the token store at all. `delegatedBy` is empty for an archived
- * agent, one whose definition Intel could not read, and one that was never given tools; asking the
- * store for the connection of user "" would be a lookup that can only ever fail, on a path that has
- * already decided the answer.
+/*
+ * ⚠️ Until #390 this file answered two kinds of caller: a person, and an agent acting on somebody
+ * else's portal connection (D30). The second one is gone with the agents, and with it the
+ * delegation lookup, the cut against the portal's server directory, and the audit row that named
+ * both principals. What is left is the rule the delegation was an exception to: the token is read
+ * per actor and never shared — one operator token for everybody would make every catalog the same
+ * one and the portal's Access policies decorative (ADR-0003).
  */
-function delegatesNothing(who) {
-    return (who.delegation !== null &&
-        (who.delegation.servers.length === 0 || who.delegation.delegatedBy.length === 0));
-}
 export function createTools(deps) {
     function portal() {
         if (!deps.portalUrl || !deps.sourceAllowed(deps.portalUrl)) {
@@ -26,23 +21,10 @@ export function createTools(deps) {
         }
         return deps.portalUrl;
     }
-    // One lookup per request, before anything else happens: everything below has to know whether it
-    // is answering a person or an agent, and a second lookup could answer differently mid-call.
-    async function acting(actor) {
-        const delegation = await deps.delegation(actor.id);
-        return {
-            actor,
-            connectionOf: delegation?.delegatedBy ?? actor.id,
-            delegation,
-        };
-    }
     // Authorization for tools lives entirely in the portal, so "may this user act" reduces to "does
-    // this user have a usable portal token". ⚠️ The token is read per actor and never shared: one
-    // operator token for everybody would make every catalog the same one and the portal's Access
-    // policies decorative (ADR-0003). For an agent the actor IS somebody else — the delegator — which
-    // is the whole of D30 and the reason this takes an `Acting` rather than a `ToolActor`.
-    async function accessToken(who) {
-        const stored = await deps.tokens.read(who.connectionOf);
+    // this user have a usable portal token".
+    async function accessToken(actor) {
+        const stored = await deps.tokens.read(actor.id);
         if (!stored) {
             throw new IntelError(401, "portal_not_connected", "The portal has not signed this user in yet");
         }
@@ -58,10 +40,10 @@ export function createTools(deps) {
             // A token that cannot be renewed is dropped: leaving it would keep failing every call with a
             // stale credential. The browser answers this by signing in silently again (#60); an MCP
             // client sees the code and repeats its own authorization.
-            await deps.tokens.clear(who.connectionOf);
+            await deps.tokens.clear(actor.id);
             throw new IntelError(401, "portal_reconnect_required", "The portal sign-in for this user has expired");
         }
-        await deps.tokens.write(who.connectionOf, refreshed);
+        await deps.tokens.write(actor.id, refreshed);
         return refreshed.accessToken;
     }
     /**
@@ -79,8 +61,8 @@ export function createTools(deps) {
      * and the reason is in the log" — the same rule `adapters/json-schema` learned the hard way in
      * #229, where a catch-all that renamed the failure hid it for weeks.
      */
-    async function remoteTools(who) {
-        const token = await accessToken(who);
+    async function remoteTools(actor) {
+        const token = await accessToken(actor);
         const remote = await deps.remote
             .list(portal(), token, AbortSignal.timeout(CallTimeoutMs))
             .catch((error) => {
@@ -108,13 +90,13 @@ export function createTools(deps) {
      * be indistinguishable from "you have no servers", and the difference decides whether a screen
      * says "connect something" or "this portal cannot be delegated from".
      */
-    async function serverList(who, toolNames) {
+    async function serverList(actor, toolNames) {
         if (!toolNames.includes(ServerDirectoryTool)) {
             throw new IntelError(502, "tool_servers_unavailable", `The portal does not offer ${ServerDirectoryTool}, so its servers cannot be listed`);
         }
         const answer = await deps.remote.call({
             url: portal(),
-            accessToken: await accessToken(who),
+            accessToken: await accessToken(actor),
             name: ServerDirectoryTool,
             arguments: {},
             signal: AbortSignal.timeout(CallTimeoutMs),
@@ -128,40 +110,9 @@ export function createTools(deps) {
     /**
      * One live tools/list is both the catalog and the authorization answer: the portal only returns
      * what this user may reach. Nothing here is cached as a permission.
-     *
-     * ⚠️ For an agent the list is cut to the delegated servers, and the cut is made against the
-     * portal's own directory rather than against the tool names — `tool-servers.ts` says why the
-     * namespace alone is not enough to attribute a tool. The second return value is the attribution
-     * itself, so the audit below names the server the cut actually used rather than guessing again.
      */
-    async function capabilities(who) {
-        const delegated = who.delegation;
-        const serverOfTool = new Map();
-        if (delegatesNothing(who))
-            return { items: [], serverOfTool };
-        let remote = await remoteTools(who);
-        if (delegated) {
-            const directory = await serverList(who, remote.map((tool) => tool.name));
-            // ⚠️ Attributed against every identifier the portal DECLARED — including rows it marked
-            // disabled — and only then checked against the delegation. Attributing against the offerable
-            // subset (or against the delegation itself) would widen it: with `wiki` delegated and
-            // `wiki_extra` merely declared, `wiki_extra__read` starts with `wiki_` and would be handed
-            // over as a `wiki` tool. The longest match over the widest declared set is the only reading
-            // that no missing row can loosen.
-            const delegatedSet = new Set(delegated.servers);
-            // ⚠️ And the attribution is then required to land on a server that is still OFFERABLE — the
-            // narrow set, enabled and confirmed. Wide for attribution, narrow for permission: a portal
-            // that switches a server off takes it away from the agent here, which is revocation reaching
-            // an agent without anybody touching its definition (D30).
-            const offerable = new Set(directory.servers.map((server) => server.handle));
-            remote = remote.filter((tool) => {
-                const handle = serverOf(tool.name, directory.declared);
-                if (handle === null || !delegatedSet.has(handle) || !offerable.has(handle))
-                    return false;
-                serverOfTool.set(tool.name, handle);
-                return true;
-            });
-        }
+    async function capabilities(actor) {
+        const remote = await remoteTools(actor);
         const items = [];
         for (const tool of remote) {
             items.push({
@@ -174,63 +125,27 @@ export function createTools(deps) {
                 }),
             });
         }
-        return { items, serverOfTool };
-    }
-    /**
-     * ⚠️ The refusal that costs nothing. A delegated caller naming a tool outside every delegated
-     * namespace is turned away here — before the token store, before `tools/list`, before the portal
-     * hears anything at all. The authoritative cut still happens in `capabilities`, against the
-     * portal's directory; this one exists so the portal is never touched on behalf of a call that was
-     * always going to be refused, and so the refusal can name the tool and the servers (D30).
-     */
-    function requireDelegated(who, name) {
-        const delegated = who.delegation;
-        if (!delegated)
-            return;
-        if (delegatesNothing(who)) {
-            throw new IntelError(403, "tool_not_delegated", `${name} is not available: this agent has no delegated MCP servers`);
-        }
-        if (serverOf(name, delegated.servers) === null) {
-            throw new IntelError(403, "tool_not_delegated", `${name} is not part of this agent's delegated servers (${delegated.servers.join(", ")})`);
-        }
+        return items;
     }
-    async function requireCapability(who, name) {
-        const reachable = await capabilities(who);
-        const found = reachable.items.find((capability) => capability.name === name);
+    async function requireCapability(actor, name) {
+        const found = (await capabilities(actor)).find((capability) => capability.name === name);
         if (!found) {
             throw new IntelError(404, "tool_not_available", `Tool ${name} is not available to you`);
         }
-        return { capability: found, server: reachable.serverOfTool.get(name) };
+        return found;
     }
-    async function call(who, input) {
-        if (!who.actor.canExecute) {
+    async function call(actor, input) {
+        if (!actor.canExecute) {
             throw new IntelError(403, "tool_execute_forbidden", "Tool execution permission is required");
         }
-        requireDelegated(who, input.name);
-        const { capability, server } = await requireCapability(who, input.name);
+        const capability = await requireCapability(actor, input.name);
         const validation = deps.validate(capability.inputSchema, input.arguments);
         if (!validation.valid) {
             throw new IntelError(400, "tool_arguments_invalid", validation.detail ?? "Invalid arguments");
         }
-        // ⚠️ Written before the call, not after it: an audit that only records what succeeded is a
-        // record of the harmless half. Both principals are named — the agent that acted and the person
-        // whose connection carried it (D30) — and no argument is.
-        //
-        // ⚠️ The server is the one the CUT used, carried out of `capabilities`, not a second guess made
-        // against the delegated handles. Re-deriving it here would name `wiki` for a tool the cut
-        // attributed to `wiki_extra`, and an audit row that names the wrong system is worse than none.
-        if (who.delegation) {
-            await deps.audit({
-                agentId: who.delegation.agentId,
-                applicationId: who.actor.id,
-                delegatedBy: who.delegation.delegatedBy,
-                server: server ?? "",
-                tool: capability.name,
-            });
-        }
         const result = await deps.remote.call({
             url: portal(),
-            accessToken: await accessToken(who),
+            accessToken: await accessToken(actor),
             name: capability.name,
             arguments: input.arguments,
             signal: AbortSignal.timeout(CallTimeoutMs),
@@ -250,23 +165,13 @@ export function createTools(deps) {
     }
     return {
         async catalog(actor) {
-            const who = await acting(actor);
-            if (delegatesNothing(who))
-                return { portalConnected: true, items: [] };
-            const stored = await deps.tokens.read(who.connectionOf);
+            const stored = await deps.tokens.read(actor.id);
             // No portal sign-in yet is a normal state, not an error: the browser answers it by running
-            // the silent sign-in and asking again (#60). For an agent it is the ordinary shape of
-            // revocation — the delegator disconnected, so the agent reaches nothing (D30).
+            // the silent sign-in and asking again (#60).
             if (!stored)
                 return { portalConnected: false, items: [] };
             try {
-                const { items, serverOfTool } = await capabilities(who);
-                // ⚠️ Named only for a delegated caller, and it costs nothing there: the attribution had to
-                // be made anyway to cut the list. For an ordinary user it would mean a second portal
-                // request per call — `serverList` is not on their path — and their screen never asks the
-                // question. The runtime's is the one that does (#289).
-                const reached = who.delegation ? [...new Set(serverOfTool.values())].sort() : undefined;
-                return { portalConnected: true, items, ...(reached ? { reached } : {}) };
+                return { portalConnected: true, items: await capabilities(actor) };
             }
             catch (error) {
                 if (disconnected(error))
@@ -275,25 +180,13 @@ export function createTools(deps) {
             }
         },
         async servers(actor) {
-            const who = await acting(actor);
-            if (delegatesNothing(who))
-                return { portalConnected: true, items: [] };
-            const stored = await deps.tokens.read(who.connectionOf);
+            const stored = await deps.tokens.read(actor.id);
             if (!stored)
                 return { portalConnected: false, items: [] };
             try {
-                const remote = await remoteTools(who);
-                const { servers } = await serverList(who, remote.map((tool) => tool.name));
-                // ⚠️ An agent sees its own delegation, never the delegator's whole shelf. Its catalog is cut
-                // anyway, so the uncut list would grant nothing — it would only tell an agent, and through
-                // it a model, which other systems the person it acts for is connected to.
-                const delegated = who.delegation;
-                return {
-                    portalConnected: true,
-                    items: delegated
-                        ? servers.filter((server) => delegated.servers.includes(server.handle))
-                        : servers,
-                };
+                const remote = await remoteTools(actor);
+                const { servers } = await serverList(actor, remote.map((tool) => tool.name));
+                return { portalConnected: true, items: servers };
             }
             catch (error) {
                 if (disconnected(error))
@@ -301,23 +194,19 @@ export function createTools(deps) {
                 throw error;
             }
         },
-        execute: async (actor, input) => await call(await acting(actor), input),
+        execute: async (actor, input) => await call(actor, input),
         async test(actor, input) {
-            const who = await acting(actor);
-            requireDelegated(who, input.name);
-            const { capability } = await requireCapability(who, input.name);
+            const capability = await requireCapability(actor, input.name);
             if (capability.annotations.readOnlyHint !== true ||
                 capability.annotations.destructiveHint === true) {
                 throw new IntelError(409, "tool_test_unsafe", "Only explicitly read-only, non-destructive tools can run in the test surface");
             }
-            return await call(who, input);
+            return await call(actor, input);
         },
         async unavailable(actor, names) {
             if (names.length === 0)
                 return [];
-            const who = await acting(actor);
-            const reachable = await capabilities(who);
-            const available = new Set(reachable.items.map((capability) => capability.name));
+            const available = new Set((await capabilities(actor)).map((capability) => capability.name));
             return names.filter((name) => !available.has(name));
         },
     };

package/dist/tools/tools.types.d.ts

@@ -35,25 +35,6 @@ export interface RemoteTools {
         signal: AbortSignal;
     }): Promise<ToolTestResult>;
 }
-/**
- * What an agent's definition delegates, resolved from the Gate Application the caller authenticated
- * as (D30). `null` from the port means "this caller is not an agent" — the ordinary user path.
- *
- * ⚠️ Read fresh on every call and never cached as a permission. It is the same rule the catalog
- * follows: the answer has to be able to change between two runs without anybody editing anything.
- */
-export interface ToolDelegation {
-    agentId: string;
-    delegatedBy: string;
-    servers: string[];
-}
-export interface ToolAuditEvent {
-    agentId: string;
-    applicationId: string;
-    delegatedBy: string;
-    server: string;
-    tool: string;
-}
 export interface ToolDeps {
     portalUrl: string | null;
     remote: RemoteTools;
@@ -66,8 +47,6 @@ export interface ToolDeps {
         valid: boolean;
         detail?: string;
     };
-    delegation(applicationId: string): Promise<ToolDelegation | null>;
-    audit(event: ToolAuditEvent): Promise<void>;
 }
 export interface ToolService {
     catalog(actor: ToolActor): Promise<ToolCatalog>;