@anchrd/intel-api 0.14.0 → 0.15.0

package/migrations/0019_one_name_for_the_grants.sql

@@ -0,0 +1,52 @@
+-- #392: the grant table takes the tree's name, and the table nobody reads goes.
+--
+-- Two changes to the same subject, in one file because they are one subject. After Agents and Board
+-- were parked (#385) `tree_grants` is the ONLY grant table left, and it stands beside
+-- `node_versions`, `node_links`, `node_vectors` and `node_index_state` under a name from a different
+-- vocabulary. `node_grants` is the name somebody would guess without looking.
+--
+-- ⚠️ It also closes a split that ran through four layers. D1 said `grants`, the contract says
+-- `ListGrantsInput`/`RevokeGrantInput`, HTTP says `/nodes/:nodeId/grants` — and the MCP surface
+-- alone said `share`. anchrd/intel#396 pulls the tools onto `grant`; this is the other half of the
+-- same move, and afterwards the same thing has the same name everywhere.
+--
+-- ⚠️ A rename is safe HERE and would not be one table up. `ALTER TABLE ... RENAME` makes every
+-- `REFERENCES` clause pointing AT the renamed table follow it — which is the trap the `nodes`
+-- rebuild exists to avoid (see `packages/api/CLAUDE.md`). `tree_grants` is a child: nothing points
+-- at it, so nothing can follow it anywhere. The direction is what makes the difference, not the
+-- statement.
+--
+-- ⚠️ Indexes do NOT follow a rename. They keep working — an index is bound to its table, not to its
+-- table's name — but they keep the old name in `sqlite_master` and would be the last place
+-- `tree_` survives. That is the lesson `0011` wrote down, and dropping and recreating one is free:
+-- an index holds no rows of its own and nothing points at it.
+ALTER TABLE tree_grants RENAME TO node_grants;
+
+DROP INDEX tree_grants_principal_idx;
+DROP INDEX tree_grants_node_idx;
+
+CREATE INDEX node_grants_principal_idx ON node_grants(
+  principal_type,
+  principal_id,
+  verb,
+  expires_at
+);
+
+CREATE INDEX node_grants_node_idx ON node_grants(node_id, verb);
+
+-- `resource_grants` has been dead since `0003`, which said so in its own header:
+--
+--   > `resource_grants` is deliberately left in place and untouched. The previous version of the
+--   > Worker reads it and keeps answering correctly until it is replaced; nothing in this version
+--   > reads it any more. Once no old Worker is left, the table holds only history and can be
+--   > dropped.
+--
+-- There is no old Worker. The condition has been met for five migrations and nobody announced the
+-- moment, because nothing forced one — and a customer should not receive a schema carrying a table
+-- no code has read since `0003`.
+--
+-- ⚠️ Dropped here rather than removed from `0000`, and that is deliberate. `0003` reads it: it is
+-- the source every `tree_grants` row was migrated FROM. Taking it out of `0000` would leave `0003`
+-- selecting from a table that never existed, so the history has to keep it and the end of the chain
+-- is where it can go. `0001` also deletes rows from it — same reason, same answer.
+DROP TABLE resource_grants;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anchrd/gate-sdk": "^0.7.0",
-    "@anchrd/intel-contract": "^0.12.0",
+    "@anchrd/intel-contract": "^0.13.0",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "fflate": "^0.8.3",

package/dist/adapters/cloudflare-api/cloudflare-api.d.ts

@@ -1,22 +0,0 @@
-import type { CloudflareAccountApi } from "./cloudflare-api.types.js";
-/**
- * ⚠️ `Authorization: Bearer`, and NOT `cf-aig-authorization`. The two hosts take different headers
- * and the agent runtime uses the other one: `gateway.ai.cloudflare.com` reads
- * `cf-aig-authorization`, this REST host reads the plain header. Swapping them produces a 401 that
- * says nothing about which of the two was wrong.
- */
-export interface CloudflareApiDeps {
-    accountId: string;
-    gatewayId: string;
-    /**
-     * A Cloudflare API token, read-only by intent.
-     *
-     * ⚠️ It is NOT the `AI_GATEWAY_TOKEN` the agent runtime holds. That one carries
-     * `AI Gateway: Run` and buys inference; this one carries `AI Gateway: Read` (and, for the model
-     * catalog, `Workers AI: Read`) and buys nothing at all. One credential for both would put a
-     * spending permission into the Worker that only ever reads.
-     */
-    token: string;
-    fetch: typeof fetch;
-}
-export declare function createCloudflareApi(deps: CloudflareApiDeps): CloudflareAccountApi;

package/dist/adapters/cloudflare-api/cloudflare-api.js

@@ -1,306 +0,0 @@
-import { z } from "zod";
-import { IntelError } from "../../shared/intel-error/intel-error.js";
-const ApiOrigin = "https://api.cloudflare.com/client/v4";
-/**
- * How many pages of gateway log are read before the answer is declared a floor.
- *
- * A run is several model turns and a five-minute schedule is 8 640 runs a month, so "read
- * everything" is not on the table. Twenty pages of fifty is the last thirty days of a busy agent
- * or the last few days of a very busy one; past that the screen says "at least this much" rather
- * than a number nobody can check.
- *
- * ⚠️ `PerPage` is Cloudflare's ceiling, not a chosen number. The endpoint answers `per_page=100`
- * with `HTTP 400` and `Number must be less than or equal to 50`, the adapter turns that into
- * `cloudflare_api_refused`, and the screen says `unreadable` — so the whole cost view read nothing,
- * ever, and looked like an outage while doing it (#294). Raising it back is not an optimisation;
- * it switches the feature off. `MaxPages` carries the reach instead: the product of the two is what
- * "the last thousand calls" means, and lowering one without raising the other halves the window
- * silently.
- */
-const MaxPages = 20;
-const PerPage = 50;
-/**
- * ⚠️ Cloudflare's ceiling on `/ai/models/search`, and a DIFFERENT number from `PerPage` above —
- * the limit belongs to the endpoint, not to the account. Neither may be copied onto the other's
- * call: 50 on the model catalog halves it, 100 on the log is refused outright.
- *
- * And the two fail in opposite ways, of which this is the worse one. The log endpoint REFUSES with
- * `HTTP 400 Number must be less than or equal to 50` — loud, and found in a day (#294). This one
- * IGNORES: measured against the live account (#297), `per_page=200` and `per_page=1000` both answer
- * `HTTP 200` with no error and `result_info.per_page: 100`.
- *
- * ⚠️ `result_info.total_count` cannot be used to notice a short answer either. The same account
- * reports `total_count: 286` and returns 61 entries on page 1, with page 2 empty — a reader that
- * paginated on that figure would loop over empty pages and call the result partial. The truthful
- * signal is a page that came back FULL, which the log reader already uses and this one does not
- * yet (anchrd/intel#330).
- */
-const ModelPerPage = 100;
-/**
- * How many pages of the model catalog are read before the reader gives up.
- *
- * ⚠️ It is a runaway brake and not a window, which is the opposite of `MaxPages` above. The log has
- * more calls than anybody wants to read; the catalog is finite and small — 61 entries on this
- * account — so the loop normally ends on the first short page and this number is never reached.
- * What it guards against is an endpoint that answers a full page forever, and a loop inside a
- * request nobody is watching.
- */
-const ModelMaxPages = 10;
-/**
- * The gateway's log entry, read tolerantly.
- *
- * ⚠️ `metadata` arrives as an object on some responses and as a JSON string on others, and neither
- * is documented as the one shape. Both are accepted; anything else means the call is unattributed,
- * which is a state the caller can see rather than a parse failure that blanks the whole window.
- */
-const LogEntry = z.object({
-    cost: z.number().nullish(),
-    model: z.string().nullish(),
-    created_at: z.string().nullish(),
-    metadata: z.union([z.string(), z.record(z.string(), z.unknown())]).nullish(),
-});
-/**
- * ⚠️ `result` is required, only its contents may be null. An optional field would let ANY JSON body
- * parse as an empty page — and an empty page reads as "this agent cost nothing", which is the one
- * answer this whole path exists to avoid giving by accident.
- */
-const LogResponse = z.object({
-    success: z.boolean().nullish(),
-    result: z.array(LogEntry).nullable(),
-});
-function readMetadata(raw) {
-    if (typeof raw === "string") {
-        try {
-            const parsed = JSON.parse(raw);
-            return parsed && typeof parsed === "object" && !Array.isArray(parsed)
-                ? parsed
-                : {};
-        }
-        catch {
-            return {};
-        }
-    }
-    return raw && typeof raw === "object" && !Array.isArray(raw)
-        ? raw
-        : {};
-}
-/**
- * ⚠️ Cloudflare's `properties` are a list of `{property_id, value}` pairs, not fields, and `value`
- * is a string for the scalars and an array of `{unit, price, currency}` for the price. The units are
- * the provider's own wording — "per M input tokens" — so they are matched loosely and never parsed
- * as a contract: an unrecognised unit costs a missing price, and a missing price shows nothing,
- * which is the behaviour #257 asks for anyway.
- */
-const PriceEntry = z.object({
-    unit: z.string(),
-    price: z.union([z.number(), z.string()]),
-    currency: z.string().nullish(),
-});
-const ModelProperty = z.object({
-    property_id: z.string(),
-    value: z.union([z.string(), z.number(), z.boolean(), z.array(PriceEntry)]),
-});
-const ModelEntry = z.object({
-    name: z.string(),
-    properties: z.array(ModelProperty).nullish(),
-});
-// Required for the same reason `LogResponse.result` is: a body this reader does not recognise must
-// not come out as "the account offers no models".
-const ModelResponse = z.object({
-    success: z.boolean().nullish(),
-    result: z.array(ModelEntry).nullable(),
-});
-function propertyOf(properties, id) {
-    return properties.find((property) => property.property_id === id)?.value;
-}
-function priceFor(entries, side) {
-    const found = entries.find((entry) => {
-        const unit = entry.unit.toLowerCase();
-        return unit.includes(side) && unit.includes("token") && /\bm\b|million/.test(unit);
-    });
-    if (!found)
-        return undefined;
-    const value = typeof found.price === "string" ? Number(found.price) : found.price;
-    return Number.isFinite(value) ? value : undefined;
-}
-function readModel(entry) {
-    const properties = entry.properties ?? [];
-    const context = Number(propertyOf(properties, "context_window"));
-    const rawPrice = propertyOf(properties, "price");
-    const prices = Array.isArray(rawPrice) ? rawPrice : [];
-    const input = priceFor(prices, "input");
-    const output = priceFor(prices, "output");
-    return {
-        name: entry.name,
-        contextTokens: Number.isFinite(context) && context > 0 ? context : null,
-        // ⚠️ Both halves or neither. A model shown with an input price and no output price reads as if
-        // its answers were free, which is a worse statement than saying nothing.
-        price: input !== undefined && output !== undefined
-            ? { inputPerMillion: input, outputPerMillion: output }
-            : null,
-        functionCalling: String(propertyOf(properties, "function_calling") ?? "") === "true",
-    };
-}
-export function createCloudflareApi(deps) {
-    /**
-     * ⚠️ Neither the URL nor the body of a refusal is quoted onward. The URL carries the account id
-     * and the body carries whatever Cloudflare wrote about a token; this message is read by a person
-     * on a screen and by a model through the MCP surface alike. The status is kept, because it is the
-     * whole of what an operator can act on: 401/403 is the token's permissions, 404 is the gateway id,
-     * 429 is a limit.
-     */
-    async function get(path, query) {
-        const url = new URL(`${ApiOrigin}${path}`);
-        for (const [key, value] of Object.entries(query))
-            url.searchParams.set(key, value);
-        let response;
-        try {
-            response = await deps.fetch(url, {
-                headers: { authorization: `Bearer ${deps.token}`, accept: "application/json" },
-            });
-        }
-        catch {
-            throw new IntelError(502, "cloudflare_api_unreachable", "The Cloudflare API did not answer");
-        }
-        if (!response.ok) {
-            throw new IntelError(502, "cloudflare_api_refused", `The Cloudflare API refused this read (HTTP ${response.status})`);
-        }
-        return await response.json().catch(() => null);
-    }
-    return {
-        async gatewayCalls(query) {
-            const logPath = `/accounts/${encodeURIComponent(deps.accountId)}/ai-gateway/gateways/${encodeURIComponent(deps.gatewayId)}/logs`;
-            /**
-             * One window of the log, optionally cut to this agent by the gateway itself.
-             *
-             * The encoding Cloudflare documents nowhere, measured against the live gateway (#274):
-             * `filters` is a URL-encoded JSON array, and `value` is an ARRAY even for a single value.
-             *
-             *   filters=[{"key":"metadata.value","operator":"eq","value":["<id>"]}]  → 200, filtered
-             *   value as a scalar string  → 400 `Expected array, received string`
-             *   filters as a JSON object  → 400 `Expected array, received object`
-             *   filters[0][key]=… (brackets) and filters.0.key=… (dots) → 200, SILENTLY IGNORED
-             *
-             * ⚠️ The last line is why this was never guessed at: two of the five spellings answer 200
-             * with the whole unfiltered window, which reads exactly like a filter that matched
-             * everything. Two filters combine with AND (measured with `metadata.key` plus `runId`).
-             */
-            async function read(pages, filtered) {
-                const calls = [];
-                let partial = false;
-                for (let index = 1; index <= pages; index += 1) {
-                    const body = await get(logPath, {
-                        page: String(index),
-                        per_page: String(PerPage),
-                        start_date: query.since.toISOString(),
-                        end_date: query.until.toISOString(),
-                        order_by: "created_at",
-                        order_by_direction: "desc",
-                        ...(filtered
-                            ? {
-                                filters: JSON.stringify([
-                                    { key: "metadata.value", operator: "eq", value: [query.agentId] },
-                                ]),
-                            }
-                            : {}),
-                    });
-                    const parsed = LogResponse.safeParse(body);
-                    // A shape this reader cannot make sense of is a failure, not an empty window: an empty
-                    // window reads as "this agent cost nothing".
-                    if (!parsed.success) {
-                        throw new IntelError(502, "cloudflare_api_unreadable", "The Cloudflare API answered in a shape this version does not understand");
-                    }
-                    const entries = parsed.data.result ?? [];
-                    // ⚠️ The local check stays even under the server-side filter, and it is no longer belt
-                    // and braces: it is the only thing that could notice the filter matching the wrong rows.
-                    for (const entry of entries) {
-                        const metadata = readMetadata(entry.metadata);
-                        if (metadata.agentId !== query.agentId)
-                            continue;
-                        calls.push({
-                            runId: typeof metadata.runId === "string" ? metadata.runId : null,
-                            model: entry.model ?? "",
-                            cost: entry.cost ?? 0,
-                            at: entry.created_at ?? query.until.toISOString(),
-                        });
-                    }
-                    if (entries.length < PerPage)
-                        return { calls, partial: false };
-                    partial = index === pages;
-                }
-                return { calls, partial };
-            }
-            const answer = await read(MaxPages, true);
-            /**
-             * ⚠️ Anything at all is taken at face value, and that is a decision with a hole in it. A
-             * filter that degraded PARTLY — matching some of this agent's rows and not others — returns
-             * here, and the under-count is then handed out as `partial: false`, which claims to be a
-             * total. The probe below cannot see that case, because the probe is only reached when the
-             * filtered read found nothing. It is the price of not reading the whole log twice on every
-             * request, and it is worth knowing before somebody reads `partial: false` as "complete".
-             */
-            if (answer.calls.length > 0)
-                return answer;
-            /**
-             * ⚠️ Zero is the ONE answer this reader may not take at face value, and the reason is the
-             * way `filters` fails. Measured: `cached` filtered to `["false"]` answers 200 with zero rows
-             * although every row in that window carries `cached: false` — a value the index does not
-             * match empties the page instead of being refused. So the day metadata stops being indexed
-             * the way it is today, this would report "cost nothing" for an agent that spent money, under
-             * `status: "read"`. That is precisely the sentence #251 exists for.
-             *
-             * One unfiltered page is the probe: if the newest calls contain any of this agent's, the
-             * filter is lying and the honest answer is that the log could not be read. It costs one
-             * request and only in the empty case, which is a fresh agent or a quiet window — and in the
-             * case it replaces, a quiet agent on a busy gateway, it costs 2 requests where reading the
-             * whole log unfiltered used to cost 20.
-             *
-             * ⚠️ It is a probe and not a proof: an agent whose only calls are older than the newest
-             * `PerPage` of the whole gateway is invisible to it, and that case still reports zero. What
-             * it buys is that a filter which stopped working ENTIRELY cannot pass as silence.
-             *
-             * ⚠️ A probe that cannot run leaves the answer standing, deliberately. The read this is
-             * checking SUCCEEDED and said "no calls"; letting a second opinion that never arrived turn
-             * that into `unreadable` would report an outage for the most ordinary state there is — a
-             * fresh agent — because one extra request met a 429. The guard is a second opinion, not the
-             * answer.
-             */
-            const probe = await read(1, false).catch(() => null);
-            if (probe === null || probe.calls.length === 0)
-                return answer;
-            throw new IntelError(502, "cloudflare_api_unreadable", "The Cloudflare API answered no calls for this agent while its own log holds some");
-        },
-        async workersAiModels() {
-            const models = [];
-            for (let index = 1; index <= ModelMaxPages; index += 1) {
-                const body = await get(`/accounts/${encodeURIComponent(deps.accountId)}/ai/models/search`, {
-                    page: String(index),
-                    per_page: String(ModelPerPage),
-                    hide_experimental: "true",
-                });
-                const parsed = ModelResponse.safeParse(body);
-                if (!parsed.success) {
-                    throw new IntelError(502, "cloudflare_api_unreadable", "The Cloudflare API answered in a shape this version does not understand");
-                }
-                const entries = parsed.data.result ?? [];
-                models.push(...entries.map(readModel));
-                // ⚠️ A SHORT page is the end, and a full one is not a reason to believe the answer was
-                // complete (#330). Before this the reader took page one and stopped: a model past position
-                // 100 was simply absent from the select, `liveStatus` still said `read`, and nothing said
-                // the list was shorter than the account. A missing entry has no `source` to mark stale
-                // with, so the per-entry labelling that covers a fallback cannot cover this at all.
-                //
-                // ⚠️ `result_info.total_count` is NOT the test, which is why it is not parsed. Measured on
-                // the live account (#297): it reports 286 while page one returns 61 and page two is empty.
-                // A reader that paginated on that figure would loop over empty pages and call the result
-                // partial. The full page is the only honest signal.
-                if (entries.length < ModelPerPage)
-                    return models;
-            }
-            // Ten full pages is not a big account, it is an endpoint that stopped ending. Refusing is the
-            // honest answer: the catalog service falls back to its built-in table and the screen says the
-            // figures may be old — better than a list that is silently missing whatever came after.
-            throw new IntelError(502, "cloudflare_api_unreadable", "The Cloudflare API kept answering full pages of models past the read limit");
-        },
-    };
-}

package/dist/adapters/cloudflare-api/cloudflare-api.types.d.ts

@@ -1,64 +0,0 @@
-/**
- * The two things Intel reads out of the Cloudflare account, and nothing else.
- *
- * ⚠️ Both are READS, and the port says so by having no other verb. The token behind it is
- * account-wide — Cloudflare offers no per-gateway scope for `AI Gateway: Read`, the same limitation
- * `AI Gateway: Run` already had in #239 — so the narrowness has to come from what this interface
- * can express rather than from what the credential allows.
- */
-export interface CloudflareAccountApi {
-    /**
-     * The gateway's own log lines for one agent, within a window.
-     *
-     * ⚠️ `cost` here is the **debit from the Cloudflare balance**, 1:1 — measured on 2026-08-07
-     * against the running installation: balance $19.77 + spend $0.23 = the $20.00 that was loaded.
-     * Cloudflare takes its 5 % when the balance is topped up and passes inference through without a
-     * markup, so this number means "what this costs us" and needs no conversion. A reader who
-     * multiplied it by anything would be inventing a second, wrong price.
-     */
-    gatewayCalls(query: GatewayCallQuery): Promise<GatewayCallPage>;
-    /**
-     * What Cloudflare currently charges for the models it serves itself (#257).
-     *
-     * ⚠️ Workers AI only. Cloudflare publishes no price list for the Anthropic models it resells
-     * through Unified Billing, so those figures have no live source and stay a table — which is the
-     * whole reason the catalog says, per entry, where its numbers came from.
-     */
-    workersAiModels(): Promise<WorkersAiModel[]>;
-}
-export interface GatewayCallQuery {
-    /** The value stamped as `cf-aig-metadata.agentId` by the agent runtime. */
-    agentId: string;
-    since: Date;
-    until: Date;
-}
-export interface GatewayCall {
-    /** From `cf-aig-metadata.runId`. `null` for a call made before the stamp existed. */
-    runId: string | null;
-    model: string;
-    /** US dollars, as billed. */
-    cost: number;
-    at: string;
-}
-export interface GatewayCallPage {
-    calls: GatewayCall[];
-    /**
-     * The window was cut off at the page cap, so every total built from it is a floor rather than a
-     * total.
-     *
-     * ⚠️ It exists so the screen can say "at least". A sum that silently stopped counting is the same
-     * failure as a missing number pretending to be zero, only harder to notice.
-     */
-    partial: boolean;
-}
-export interface WorkersAiModel {
-    /** The full `@cf/...` id, exactly as a definition names it. */
-    name: string;
-    contextTokens: number | null;
-    price: {
-        inputPerMillion: number;
-        outputPerMillion: number;
-    } | null;
-    /** Whether this model can call a tool at all. An agent is a tool loop; one that cannot is useless. */
-    functionCalling: boolean;
-}

package/dist/adapters/cloudflare-api/cloudflare-api.types.js

@@ -1 +0,0 @@
-export {};

package/dist/adapters/gate-applications/gate-applications.d.ts

@@ -1,23 +0,0 @@
-import type { AgentApplications } from "../../nodes/nodes.types.js";
-/**
- * Intel's door to Gate's Applications surface (`anchrd/gate#223`/`#224`, Gate 0.10.x).
- *
- * ⚠️ This is the one Gate call Intel makes with the CALLER's bearer instead of its service key, and
- * that is not a shortcut — the service key does not open this door. A Gate service key authorizes
- * `/api/v1/authorization` and `/api/v1/schema` and nothing else (Gate's two-token rule); the
- * Applications routes are admin-gated and resolve a real principal, so the person creating an agent
- * needs `applications:write` in Gate and their act is audited in Gate under their own name. A
- * service key here would have made Intel the author of every machine principal an installation ever
- * grew, which is the opposite of what an audit trail is for.
- *
- * ⚠️ Nothing this module receives from Gate is logged, wrapped into a message, or returned other
- * than through the one typed answer below. `create` is handed a plain-text key, and the shortest
- * path from here to a leak is an error that quotes the response body — so no refusal names anything
- * but the status Gate answered with.
- */
-export interface GateApplicationsDeps {
-    fetch: (url: string, init?: RequestInit) => Promise<Response>;
-    gateUrl: string;
-    timeoutMs?: number;
-}
-export declare function createGateApplications(deps: GateApplicationsDeps): AgentApplications;

package/dist/adapters/gate-applications/gate-applications.js

@@ -1,88 +0,0 @@
-import { z } from "zod";
-import { IntelError } from "../../shared/intel-error/intel-error.js";
-// Tolerant on purpose, unlike Intel's own contracts: this is somebody else's wire format, and a
-// field Gate adds tomorrow must not stop an installation from creating an agent. Only what Intel
-// actually reads is named.
-const CreatedApplication = z.object({ id: z.string().min(1), key: z.string().min(1) });
-// The same tolerance, for the same reason. Only the key is read: the ID is the one Intel asked with.
-const RotatedApplication = z.object({ key: z.string().min(1) });
-const DefaultTimeoutMs = 10_000;
-export function createGateApplications(deps) {
-    const base = deps.gateUrl.replace(/\/+$/, "");
-    const timeoutMs = deps.timeoutMs ?? DefaultTimeoutMs;
-    // Gate's refusals, translated once. A 401/403 is the caller's missing `applications:write` and is
-    // permanent until somebody acts in Gate, so it is answered as a refusal rather than as an outage;
-    // everything else — a 5xx, a timeout, a DNS failure — is "Gate did not answer", and the caller is
-    // told that no agent was created rather than left to guess.
-    function refusal(status) {
-        if (status === 401 || status === 403) {
-            return new IntelError(403, "agent_application_forbidden", "Gate refused this account the management of applications — creating an agent needs the applications permission in Gate");
-        }
-        return new IntelError(502, "agent_application_unavailable", `Gate could not manage this agent's application (${status})`);
-    }
-    async function call(path, token, body) {
-        try {
-            return await deps.fetch(`${base}/api/v1/applications${path}`, {
-                method: "POST",
-                headers: {
-                    "content-type": "application/json",
-                    authorization: `Bearer ${token}`,
-                },
-                body: JSON.stringify(body),
-                signal: AbortSignal.timeout(timeoutMs),
-            });
-        }
-        catch {
-            // ⚠️ The caught error is dropped rather than described. A fetch failure carries the URL, and
-            // the URL is the one place the bearer could still be if a caller ever put it in a query.
-            throw new IntelError(502, "agent_application_unavailable", "Gate did not answer, so no agent application was created or changed");
-        }
-    }
-    return {
-        async create(input) {
-            const response = await call("", input.token, { name: input.name });
-            if (!response.ok)
-                throw refusal(response.status);
-            const parsed = CreatedApplication.safeParse(await response.json().catch(() => null));
-            if (!parsed.success) {
-                // ⚠️ A 2xx Intel cannot read means a principal MAY exist in Gate that Intel cannot record.
-                // Nothing has been written on this side yet, so the agent does not come into being; the
-                // operator finds an unused application in Gate's list rather than an agent that half works.
-                throw new IntelError(502, "agent_application_unavailable", "Gate answered the application creation in a shape Intel cannot read");
-            }
-            return { id: parsed.data.id, key: parsed.data.key };
-        },
-        async rotateKey(input) {
-            // Gate issues the replacement FIRST and only then revokes what was there, so a rotation that
-            // fails leaves the old key working rather than locking the agent out (`applications.ts` in
-            // `anchrd/gate`). Intel relies on that: the handover to the runtime happens after this call,
-            // and until it succeeds the agent keeps running on the key it had.
-            const response = await call(`/${encodeURIComponent(input.applicationId)}/rotate-key`, input.token, {});
-            if (response.status === 404) {
-                throw new IntelError(502, "agent_application_missing", "Gate does not know this agent's application any more");
-            }
-            if (!response.ok)
-                throw refusal(response.status);
-            const parsed = RotatedApplication.safeParse(await response.json().catch(() => null));
-            if (!parsed.success) {
-                // ⚠️ A 2xx Intel cannot read means the OLD key is already revoked in Gate and the new one is
-                // lost. The agent is broken either way, so the caller is told the rotation failed and rotates
-                // again — which is safe, because rotating twice is just another new key.
-                throw new IntelError(502, "agent_application_unavailable", "Gate answered the key rotation in a shape Intel cannot read");
-            }
-            return { key: parsed.data.key };
-        },
-        async setEnabled(input) {
-            // Both routes are idempotent in Gate, which is what lets a retried archive heal a run that
-            // failed between the two writes instead of needing a repair path of its own.
-            const response = await call(`/${encodeURIComponent(input.applicationId)}/${input.enabled ? "enable" : "disable"}`, input.token, {});
-            // A 404 is the one status worth separating: the Application behind this agent is gone from
-            // Gate, and telling the operator that is more use than a generic outage they would retry.
-            if (response.status === 404) {
-                throw new IntelError(502, "agent_application_missing", "Gate does not know this agent's application any more");
-            }
-            if (!response.ok)
-                throw refusal(response.status);
-        },
-    };
-}

package/dist/adapters/tool-delegation/tool-delegation.d.ts

@@ -1,22 +0,0 @@
-import type { ContentStore } from "../../nodes/nodes.types.js";
-import type { ToolAuditEvent, ToolDelegation } from "../../tools/tools.types.js";
-import type { D1Database } from "../db/db.types.js";
-/**
- * The two D1 statements the delegated tool path needs (D30): who is acting, and a record that they
- * did.
- *
- * ⚠️ Its own adapter rather than a method on the node repository, and deliberately so. The question
- * is asked with a **Gate Application id** and no Intel actor at all — there is no ACL to apply,
- * because the answer is not "may you read this agent" but "which agent are you". Hanging it off the
- * tree's repository would put an unauthorized read next to authorized ones, which is the shape a
- * later reader copies by accident.
- */
-export declare function createToolDelegation(deps: {
-    db: D1Database;
-    content: ContentStore;
-    id(): string;
-    now(): Date;
-}): {
-    resolve(applicationId: string): Promise<ToolDelegation | null>;
-    audit(event: ToolAuditEvent): Promise<void>;
-};