@anchrd/intel-api 0.14.0 → 0.15.0

package/dist/adapters/tool-delegation/tool-delegation.js

@@ -1,90 +0,0 @@
-import { AgentDefinition } from "@anchrd/intel-contract";
-import { reportUnexpectedError } from "../../shared/report-unexpected-error/report-unexpected-error.js";
-/**
- * The two D1 statements the delegated tool path needs (D30): who is acting, and a record that they
- * did.
- *
- * ⚠️ Its own adapter rather than a method on the node repository, and deliberately so. The question
- * is asked with a **Gate Application id** and no Intel actor at all — there is no ACL to apply,
- * because the answer is not "may you read this agent" but "which agent are you". Hanging it off the
- * tree's repository would put an unauthorized read next to authorized ones, which is the shape a
- * later reader copies by accident.
- */
-export function createToolDelegation(deps) {
-    return {
-        /**
-         * ⚠️ `null` has exactly ONE meaning here and it is a strong claim: "this caller is not an
-         * agent", after which the tool service treats them as an ordinary person with a portal
-         * connection of their own. Every other outcome — an archived agent, an agent with no definition
-         * version yet, a body R2 lost, a body that will not parse, a definition with no `tools` — is an
-         * agent that delegates NOTHING, and is answered as an empty delegation. That is the difference
-         * between "act as yourself" and "act on nobody's connection", and only one of them is safe to
-         * fall into by accident.
-         *
-         * The joins are therefore LEFT: a row in `agent_applications` is already the whole answer to
-         * "is this an agent", and losing it to a missing version would turn a fresh agent into a user.
-         */
-        async resolve(applicationId) {
-            const row = await deps.db
-                .prepare(`SELECT a.node_id AS node_id, n.archived_at AS archived_at,
-                 v.content_key AS content_key
-          FROM agent_applications a
-          LEFT JOIN nodes n ON n.id = a.node_id
-          LEFT JOIN node_versions v ON v.id = n.current_version_id
-          WHERE a.application_id = ?`)
-                .bind(applicationId)
-                .first();
-            if (!row)
-                return null;
-            const nothing = { agentId: row.node_id, delegatedBy: "", servers: [] };
-            // Archiving an agent switches its Gate Application off, but Gate's own state is not what
-            // Intel is allowed to depend on: an archived agent reaches nothing through Intel from the
-            // moment it is archived, whatever another system still thinks.
-            if (row.archived_at !== null || row.content_key === null)
-                return nothing;
-            const body = await deps.content.get(row.content_key);
-            if (body === null) {
-                reportUnexpectedError(new Error(`agent ${row.node_id} has no readable definition body`));
-                return nothing;
-            }
-            let parsed;
-            try {
-                parsed = JSON.parse(body);
-            }
-            catch {
-                parsed = null;
-            }
-            const definition = AgentDefinition.safeParse(parsed);
-            if (!definition.success) {
-                reportUnexpectedError(new Error(`agent ${row.node_id} has a definition Intel cannot parse`));
-                return nothing;
-            }
-            const tools = definition.data.tools;
-            if (!tools)
-                return nothing;
-            return {
-                agentId: row.node_id,
-                delegatedBy: tools.delegatedBy,
-                servers: tools.servers,
-            };
-        },
-        async audit(event) {
-            // ⚠️ The agent's node is the resource and the Application is the actor, which is the only
-            // pairing that reads correctly later: `actor_id` is what authenticated, `resource_id` is what
-            // a person searches for. The tool and the server are metadata, and the ARGUMENTS are absent —
-            // an append-only table is the last place a payload should be copied to.
-            await deps.db
-                .prepare(`INSERT INTO audit_events (
-          id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
-        ) VALUES (?, ?, 'tool.execute', 'agent', ?, ?, ?)`)
-                .bind(deps.id(), event.applicationId, event.agentId, JSON.stringify({
-                tool: event.tool,
-                server: event.server,
-                // Both principals, which is the whole point of the row: who acted, and whose portal
-                // connection made it possible (D30).
-                delegatedBy: event.delegatedBy,
-            }), deps.now().toISOString())
-                .run();
-        },
-    };
-}

package/dist/agent-costs/agent-costs.d.ts

@@ -1,16 +0,0 @@
-import type { AgentCostsDeps, AgentCostsService } from "./agent-costs.types.js";
-/**
- * What this agent has cost, read out of Cloudflare's AI Gateway log rather than computed here.
- *
- * ⚠️ Nothing in this file multiplies tokens by a price, and nothing may start to. The gateway
- * publishes the billed figure per call and it is the debit from the account balance, 1:1 — measured
- * on 2026-08-07 (#251). A price table beside it would be a second, self-maintained answer to a
- * question that already has a first one, and the day the two disagree the wrong one is the one
- * on screen.
- *
- * ⚠️ The three checks below are in the same order as the runtime proxy's, and for the same reasons:
- * the capability first so a refusal costs no storage read; the resource ACL second, because seeing
- * an agent and seeing its bill are the same question; the reader last, so nobody learns whether this
- * deployment holds a Cloudflare token before they are allowed to ask.
- */
-export declare function createAgentCosts(deps: AgentCostsDeps): AgentCostsService;

package/dist/agent-costs/agent-costs.js

@@ -1,105 +0,0 @@
-import { IntelError } from "../shared/intel-error/intel-error.js";
-/**
- * The windows the profile shows, longest last.
- *
- * Two, and both of them, because they answer different questions: thirty days is what an agent
- * costs to keep, seven is whether that changed. One number alone cannot say "this got more
- * expensive last week".
- */
-const Windows = [7, 30];
-const DayMs = 24 * 60 * 60 * 1_000;
-/**
- * What this agent has cost, read out of Cloudflare's AI Gateway log rather than computed here.
- *
- * ⚠️ Nothing in this file multiplies tokens by a price, and nothing may start to. The gateway
- * publishes the billed figure per call and it is the debit from the account balance, 1:1 — measured
- * on 2026-08-07 (#251). A price table beside it would be a second, self-maintained answer to a
- * question that already has a first one, and the day the two disagree the wrong one is the one
- * on screen.
- *
- * ⚠️ The three checks below are in the same order as the runtime proxy's, and for the same reasons:
- * the capability first so a refusal costs no storage read; the resource ACL second, because seeing
- * an agent and seeing its bill are the same question; the reader last, so nobody learns whether this
- * deployment holds a Cloudflare token before they are allowed to ask.
- */
-export function createAgentCosts(deps) {
-    return {
-        async read(actor, agentId) {
-            if (!actor.canRun) {
-                throw new IntelError(403, "permission_required", "Permission required");
-            }
-            const node = await deps.visibleNode(actor, agentId);
-            // Not found and not visible answer alike, as everywhere else in the tree.
-            if (node?.kind !== "agent") {
-                throw new IntelError(404, "agent_not_found", "Agent was not found");
-            }
-            if (!deps.gateway)
-                return empty("not_configured");
-            const until = deps.now();
-            const longest = Windows[Windows.length - 1] ?? 30;
-            const since = new Date(until.getTime() - longest * DayMs);
-            let page;
-            try {
-                page = await deps.gateway.gatewayCalls({ agentId, since, until });
-            }
-            catch {
-                // ⚠️ Swallowed on purpose, and named rather than rethrown. The run list beside these figures
-                // is answered by the runtime and is perfectly readable; letting a Cloudflare outage take the
-                // whole screen down would hide the tokens too — and the tokens are the half that never
-                // depended on Cloudflare being reachable.
-                return empty("unreadable");
-            }
-            return {
-                status: "read",
-                currency: "USD",
-                runs: perRun(page.calls),
-                windows: Windows.map((days) => window(days, page.calls, until)),
-                partial: page.partial,
-            };
-        },
-    };
-}
-function empty(status) {
-    return {
-        status,
-        currency: "USD",
-        // ⚠️ Empty, and the status is what stops it reading as "free". Nothing here invents a zero:
-        // `runs: []` with `status: "read"` really does mean this agent has cost nothing yet.
-        runs: [],
-        windows: Windows.map((days) => ({ days, cost: 0, calls: 0, models: [] })),
-        partial: false,
-    };
-}
-function perRun(calls) {
-    const byRun = new Map();
-    for (const call of calls) {
-        // A call the runtime could not stamp — anything from before #251 — belongs to no run and is
-        // dropped from the per-run view. It still counts towards the windows below: it is the agent's
-        // money either way, and only its place in the list is unknown.
-        if (!call.runId)
-            continue;
-        const known = byRun.get(call.runId);
-        if (known) {
-            known.cost += call.cost;
-            known.calls += 1;
-            continue;
-        }
-        byRun.set(call.runId, { runId: call.runId, cost: call.cost, calls: 1 });
-    }
-    return [...byRun.values()];
-}
-function window(days, calls, until) {
-    const from = until.getTime() - days * DayMs;
-    const inside = calls.filter((call) => {
-        const at = Date.parse(call.at);
-        // An unparseable timestamp counts towards the longest window rather than being dropped: the
-        // money was spent, and a total that quietly omits it is the wrong kind of wrong.
-        return Number.isNaN(at) ? days === Windows[Windows.length - 1] : at >= from;
-    });
-    return {
-        days,
-        cost: inside.reduce((total, call) => total + call.cost, 0),
-        calls: inside.length,
-        models: [...new Set(inside.map((call) => call.model).filter((model) => model.length > 0))],
-    };
-}

package/dist/agent-costs/agent-costs.types.d.ts

@@ -1,30 +0,0 @@
-import type { AgentCosts, Node } from "@anchrd/intel-contract";
-import type { CloudflareAccountApi } from "../adapters/cloudflare-api/cloudflare-api.types.js";
-import type { AgentActor } from "../agent-runtime/agent-runtime.types.js";
-import type { Actor } from "../nodes/nodes.types.js";
-export interface AgentCostsDeps {
-    /**
-     * Absent where the deployment configured no account id, gateway id or read token.
-     *
-     * ⚠️ Absent is a NAMED state and never an error: an installation that never wants Intel to hold a
-     * Cloudflare token is a supported installation, and it should read "not configured" rather than
-     * a 502 somebody spends an afternoon on.
-     */
-    gateway?: Pick<CloudflareAccountApi, "gatewayCalls">;
-    /**
-     * The tree's own visibility lookup, unchanged on the way through — the same one the runtime proxy
-     * uses. What an agent spends is as sensitive as what it does, and neither answer may be kinder
-     * than the other.
-     */
-    visibleNode(actor: Actor, nodeId: string): Promise<Node | null>;
-    now(): Date;
-}
-export interface AgentCostsService {
-    /**
-     * ⚠️ The answer shape lives in `@anchrd/intel-contract` and not here, because the browser parses
-     * it. A second declaration in this package is how the screen and the service start disagreeing
-     * about what `status` can say — and `status` is the field that separates "cost nothing" from "not
-     * known" (#251).
-     */
-    read(actor: AgentActor, agentId: string): Promise<AgentCosts>;
-}

package/dist/agent-costs/agent-costs.types.js

@@ -1 +0,0 @@
-export {};

package/dist/agent-runtime/agent-runtime.d.ts

@@ -1,16 +0,0 @@
-import type { AgentRuntimeDeps, AgentRuntimeService } from "./agent-runtime.types.js";
-/**
- * Intel's door to the agent runtime.
- *
- * ⚠️ The browser never talks to the runtime. It talks to Intel, and Intel forwards — one origin for
- * the page, one session cookie, no CORS, and no Gate token in browser JavaScript. What travels on
- * the forwarded call is the caller's OWN bearer, which the runtime then checks for `agents/run`
- * exactly as it would from any other client. Intel impersonates nobody: there is no service key on
- * this path, and a request that arrives without a usable session never reaches the binding.
- *
- * ⚠️ The three checks below are in this order on purpose. The capability comes first, so a caller
- * who may not drive agents at all causes no storage read; the resource ACL comes second, because it
- * is the question the runtime cannot answer; the binding comes last, so nobody learns whether this
- * deployment has a runtime before they are allowed to ask.
- */
-export declare function createAgentRuntimeService(deps: AgentRuntimeDeps): AgentRuntimeService;

package/dist/agent-runtime/agent-runtime.js

@@ -1,150 +0,0 @@
-import { ProblemDetails } from "@anchrd/intel-contract";
-import { IntelError } from "../shared/intel-error/intel-error.js";
-/**
- * The host a service binding never resolves.
- *
- * A `Request` needs an absolute URL and a binding routes on the path alone, so this name exists
- * only to make one. `.internal` is not a resolvable TLD: a call that ever left this Worker by
- * mistake fails to connect rather than reaching a stranger who registered the domain.
- */
-const RuntimeOrigin = "https://intel-agent.internal";
-/**
- * Intel's door to the agent runtime.
- *
- * ⚠️ The browser never talks to the runtime. It talks to Intel, and Intel forwards — one origin for
- * the page, one session cookie, no CORS, and no Gate token in browser JavaScript. What travels on
- * the forwarded call is the caller's OWN bearer, which the runtime then checks for `agents/run`
- * exactly as it would from any other client. Intel impersonates nobody: there is no service key on
- * this path, and a request that arrives without a usable session never reaches the binding.
- *
- * ⚠️ The three checks below are in this order on purpose. The capability comes first, so a caller
- * who may not drive agents at all causes no storage read; the resource ACL comes second, because it
- * is the question the runtime cannot answer; the binding comes last, so nobody learns whether this
- * deployment has a runtime before they are allowed to ask.
- */
-export function createAgentRuntimeService(deps) {
-    async function reach(actor, agentId) {
-        if (!actor.canRun) {
-            throw new IntelError(403, "permission_required", "Permission required");
-        }
-        const node = await deps.visibleNode(actor, agentId);
-        // Not found and not visible answer alike, as everywhere else in the tree: the difference would
-        // tell somebody an agent exists that they may not see.
-        if (node?.kind !== "agent") {
-            throw new IntelError(404, "agent_not_found", "Agent was not found");
-        }
-        if (!deps.runtime) {
-            throw new IntelError(503, "agent_runtime_not_configured", "This installation has no agent runtime");
-        }
-        return deps.runtime;
-    }
-    async function forward(input) {
-        const runtime = await reach(input.actor, input.agentId);
-        const headers = new Headers({ authorization: `Bearer ${input.token}` });
-        if (input.body !== undefined)
-            headers.set("content-type", "application/json");
-        return await runtime.fetch(new Request(`${RuntimeOrigin}/agents/${encodeURIComponent(input.agentId)}${input.path}`, {
-            method: input.method,
-            headers,
-            ...(input.body === undefined ? {} : { body: input.body }),
-            ...(input.signal ? { signal: input.signal } : {}),
-        }));
-    }
-    /**
-     * The two routes Intel dials itself, rather than on a browser's behalf: `/key` and
-     * `/schedules/sync`.
-     *
-     * ⚠️ Neither goes through `forward`, and that is deliberate. `forward` asks `canRun` — the
-     * question for somebody driving an agent — while both of these belong to *maintaining* one, which
-     * Intel has already authorized with `knowledge/create` or `knowledge/write` plus the resource ACL.
-     * What travels instead is the caller's own bearer beside the handover secret: the bearer says who
-     * is behind the call, the secret says it came down Intel's binding at all. The runtime cannot
-     * check Intel's resource ACL — it knows Gate and nothing about the tree — so without the secret a
-     * published runtime hostname would open both routes to anybody holding `knowledge/write` (D29).
-     */
-    async function handover(call) {
-        if (!deps.runtime) {
-            throw new IntelError(503, "agent_runtime_not_configured", "This installation has no agent runtime");
-        }
-        const handoverSecret = deps.handoverSecret?.trim();
-        if (!handoverSecret) {
-            // ⚠️ Refused here rather than dialled and refused there. The runtime would answer 403, and
-            // a 403 reads like "this person may not" — which would send an operator looking at Gate
-            // permissions for a secret that was never set.
-            throw new IntelError(503, call.unconfigured.code, call.unconfigured.detail);
-        }
-        return await deps.runtime.fetch(new Request(`${RuntimeOrigin}/agents/${encodeURIComponent(call.agentId)}${call.path}`, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${call.token}`,
-                "content-type": "application/json",
-                // ⚠️ Its own header, never folded into `authorization`: that one already carries the
-                // caller's Gate bearer on this very request, and two credentials in one header is how
-                // one of them ends up read as the other.
-                "x-intel-agent-handover": handoverSecret,
-            },
-            body: call.body,
-        }));
-    }
-    return {
-        forward,
-        async syncSchedules(input) {
-            const response = await handover({
-                agentId: input.agentId,
-                path: "/schedules/sync",
-                token: input.token,
-                // No schedules travel: the runtime re-reads the definition from Intel itself (#214).
-                body: "{}",
-                unconfigured: {
-                    code: "agent_schedule_sync_not_configured",
-                    detail: "This installation has no shared secret for reaching the agent runtime, so schedules cannot be armed",
-                },
-            });
-            if (response.ok)
-                return;
-            // ⚠️ Loud, and named after the state it leaves behind rather than after the call that failed.
-            // What the caller has to act on is not "the runtime answered 502" but "this agent's schedules
-            // are not armed", and the sentence says the repair: write the definition again.
-            throw new IntelError(502, "agent_schedules_not_armed", `The definition was saved, but the agent runtime did not arm its schedules (${response.status}). Saving the definition again arms them.`);
-        },
-        async storeKey(input) {
-            const response = await handover({
-                agentId: input.agentId,
-                path: "/key",
-                token: input.token,
-                body: JSON.stringify({ key: input.key }),
-                unconfigured: {
-                    code: "agent_key_handover_not_configured",
-                    detail: "This installation has no shared secret for handing an agent its application key",
-                },
-            });
-            if (response.ok)
-                return;
-            // ⚠️ The runtime's answer is read for its status and thrown away. Its body cannot be quoted
-            // here the way `request` quotes it: the call that produced it carried a credential, and an
-            // echoed body is the shortest path from a refusal to a key in a log. What the caller is told
-            // is that the agent has no usable key — which is the only thing they can act on anyway.
-            throw new IntelError(502, "agent_key_not_stored", `The agent runtime did not take this agent's application key (${response.status}), so the agent cannot run yet`);
-        },
-        // A plain fact, not a probe: the binding is either configured or it is not, and nothing is
-        // dialled to answer. Unlike `reach` this stands before any per-agent check — it names no agent.
-        available: () => deps.runtime !== undefined,
-        async request(input) {
-            const response = await forward(input);
-            const body = await response.json().catch(() => null);
-            if (!response.ok) {
-                const problem = ProblemDetails.safeParse(body);
-                // ⚠️ The runtime's own words, and only those. Its refusals are written to be read — by a
-                // person on the Log tab and by a model on the MCP surface alike — while anything it could
-                // not explain arrives as a generic 500 body. Nothing about the forwarded call is added
-                // here: the URL, the binding and above all the bearer stay out of every message.
-                throw new IntelError(response.status, problem.success
-                    ? (problem.data.code ?? "agent_runtime_refused")
-                    : "agent_runtime_refused", problem.success
-                    ? (problem.data.detail ?? problem.data.title)
-                    : "The agent runtime refused this call");
-            }
-            return body;
-        },
-    };
-}

package/dist/agent-runtime/agent-runtime.types.d.ts

@@ -1,122 +0,0 @@
-import type { Node } from "@anchrd/intel-contract";
-import type { Actor } from "../nodes/nodes.types.js";
-/**
- * The agent runtime Worker, as Intel is allowed to see it.
- *
- * One method, because that is all a service binding is. The Cloudflare adapter hands the binding
- * over unchanged; nothing below this line knows it is one, so the whole seam is testable with a
- * plain object that records what it was asked.
- */
-export interface AgentRuntimeBinding {
-    fetch(request: Request): Promise<Response>;
-}
-/**
- * Who is driving the agent.
- *
- * ⚠️ `canRun` is the caller's Gate capability, resolved once at the door — never something a body,
- * an MCP argument or a definition may say. It is spelled beside the actor rather than derived here
- * for the same reason `FlowActor` spells `canRun`: the service must not need a Gate client.
- */
-export interface AgentActor extends Actor {
-    canRun: boolean;
-}
-export interface AgentRuntimeDeps {
-    /**
-     * The shared secret that proves a key handover came down this binding (D29, #207).
-     *
-     * ⚠️ The SAME value the agent Worker holds as `AGENT_HANDOVER_SECRET`, and it travels on exactly
-     * one route. It is not a substitute for the caller's bearer, which travels beside it: the bearer
-     * says who is asking, this says the request came through Intel at all. The runtime cannot check
-     * Intel's resource ACLs — it knows Gate and nothing about the tree — so without this a published
-     * runtime hostname would let anybody with `knowledge/write` write the key of any agent.
-     *
-     * Absent, `storeKey` refuses by name rather than dialling the binding and being refused there:
-     * the deployment is misconfigured, and saying so beats a 403 that reads like a permission problem.
-     */
-    handoverSecret?: string;
-    /**
-     * Absent where a deployment runs no agent Worker. Every call then refuses by name instead of
-     * failing somewhere unreadable — a customer may deploy Intel without agents.
-     */
-    runtime?: AgentRuntimeBinding;
-    /**
-     * The tree's own visibility lookup, unchanged on the way through. It is the check the runtime
-     * cannot make: the runtime knows Gate capabilities and nothing about Intel's resource ACLs, so
-     * "may this person drive agents at all" is its question and "may they reach THIS agent" is ours.
-     */
-    visibleNode(actor: Actor, nodeId: string): Promise<Node | null>;
-}
-export interface ForwardInput {
-    actor: AgentActor;
-    /** The caller's own Gate bearer, passed on unchanged. Never a service key (D19). */
-    token: string;
-    agentId: string;
-    method: "GET" | "POST";
-    /** The path below `/agents/:agentId`, exactly as the runtime mounts it. */
-    path: string;
-    body?: string;
-    signal?: AbortSignal;
-}
-/**
- * One agent's Application key, on its way from Gate into the agent's Durable Object (D29, #207).
- *
- * ⚠️ It exists as a parameter and never as a field of anything stored. The value is in one local
- * variable from the moment Gate answers until this call returns, exactly as it was before D29 — what
- * changed is where it goes: into the runtime instead of into a response the browser reads.
- */
-export interface StoreKeyInput {
-    /** The caller's own Gate bearer, passed on unchanged. Never a service key (D19). */
-    token: string;
-    agentId: string;
-    key: string;
-}
-/**
- * Which agent's alarm has to be brought in line with the definition Intel just wrote (#214).
- *
- * ⚠️ It carries no schedules. The runtime re-reads the definition from Intel itself, with the
- * agent's own token, so this is a "look again" and never a second copy of the document — a schedule
- * pushed down this call would be one the agent could act on without it ever having been written.
- */
-export interface SyncSchedulesInput {
-    /** The caller's own Gate bearer, passed on unchanged. Never a service key (D19). */
-    token: string;
-    agentId: string;
-}
-export interface AgentRuntimeService {
-    /** The browser's way through: the runtime's answer, body and headers untouched. */
-    forward(input: ForwardInput): Promise<Response>;
-    /**
-     * Hands an agent the key of the Gate Application it runs as.
-     *
-     * ⚠️ The one door here that does NOT ask `canRun`, and that is deliberate. Its two callers —
-     * creating an agent and rotating its key — have already decided who may act: `knowledge/create`
-     * with a writable parent, or `knowledge/write` with the resource ACL of the agent node. Requiring
-     * `agents/run` on top would mean a person who may create agents but never run one creates keyless
-     * agents, which is #200 arrived at from the other side. The runtime makes the same distinction at
-     * its own door.
-     *
-     * ⚠️ It fails loudly. A handover that quietly did not happen is an agent that exists, looks
-     * right, and dies at its first run — the whole failure this ticket removes.
-     */
-    storeKey(input: StoreKeyInput): Promise<void>;
-    /**
-     * Arms the agent's alarm for whatever the definition Intel just wrote schedules (#214).
-     *
-     * ⚠️ Like `storeKey` and unlike everything else here, it does NOT ask `canRun`. Its two callers —
-     * creating an agent and saving its definition — have already decided who may act: `knowledge/
-     * create` with a writable parent, or `knowledge/write` with the resource ACL of the agent node.
-     * Requiring `agents/run` on top would mean an editor who may not drive agents saves a schedule
-     * that is never armed, which is the failure this exists to remove.
-     *
-     * ⚠️ It fails loudly, for the same reason `storeKey` does. A sync that quietly did not happen is
-     * an agent whose profile shows a schedule that will never fire.
-     */
-    syncSchedules(input: SyncSchedulesInput): Promise<void>;
-    /** The same door for a caller that wants the answer, not the response — Intel MCP uses this. */
-    request(input: ForwardInput): Promise<unknown>;
-    /**
-     * Whether this deployment has a runtime at all (#190). The answer `/capabilities` gives to an
-     * authenticated caller so the UI can stop offering agents instead of guessing from a 503.
-     */
-    available(): boolean;
-}

package/dist/agent-runtime/agent-runtime.types.js

@@ -1 +0,0 @@
-export {};

package/dist/model-catalog/model-catalog.d.ts

@@ -1,2 +0,0 @@
-import type { ModelCatalogDeps, ModelCatalogService } from "./model-catalog.types.js";
-export declare function createModelCatalog(deps: ModelCatalogDeps): ModelCatalogService;

package/dist/model-catalog/model-catalog.js

@@ -1,99 +0,0 @@
-/**
- * The figures this package knows without asking anybody, and the ONLY place they are written down.
- *
- * ⚠️ It moved here out of `packages/ui` with #257, and the move is the point rather than the
- * tidying. The comment it used to carry accused itself correctly — *"it is a copy and it ages
- * silently"* — and named the reason it stayed a copy: the Cloudflare endpoint needs a token, and a
- * token does not belong in a SPA. It belongs here. What the browser gets is the answer, never the
- * credential, and the Workers AI half of this table is overwritten by the live one on every read.
- *
- * ⚠️ The Anthropic entries have no live source and will not get one. Cloudflare resells those models
- * through Unified Billing and publishes no price list for them, so they stay `builtin` even on a
- * perfectly healthy read — which is exactly why `source` is per entry and not per response.
- *
- * ⚠️ Workers AI models without `function_calling` are deliberately absent from the live merge. An
- * agent is a tool loop; a model that cannot call a tool cannot run one.
- *
- * Collected 2026-08-06 from `GET /accounts/{id}/ai/models/search` and from Anthropic's model list.
- */
-const builtin = [
-    entry("anthropic", "claude-opus-5", "Opus 5", 1_000_000, 5, 25),
-    entry("anthropic", "claude-sonnet-5", "Sonnet 5", 1_000_000, 3, 15),
-    entry("anthropic", "claude-sonnet-4", "Sonnet 4", 200_000, 3, 15),
-    entry("anthropic", "claude-haiku-4-5", "Haiku 4.5", 200_000, 1, 5),
-    entry("workers-ai", "@cf/openai/gpt-oss-120b", "GPT-OSS 120B", 128_000, 0.35, 0.75),
-    entry("workers-ai", "@cf/openai/gpt-oss-20b", "GPT-OSS 20B", 128_000, 0.2, 0.3),
-    entry("workers-ai", "@cf/moonshotai/kimi-k2.6", "Kimi K2.6", 262_144, 0.95, 4),
-    entry("workers-ai", "@cf/moonshotai/kimi-k2.7-code", "Kimi K2.7 Code", 262_144, 0.95, 4),
-    entry("workers-ai", "@cf/zai-org/glm-5.2", "GLM 5.2", 262_144, 1.4, 4.4),
-    entry("workers-ai", "@cf/zai-org/glm-4.7-flash", "GLM 4.7 Flash", 131_072, 0.0605, 0.4),
-    entry("workers-ai", "@cf/google/gemma-4-26b-a4b-it", "Gemma 4 26B", 256_000, 0.1, 0.3),
-    entry("workers-ai", "@cf/nvidia/nemotron-3-120b-a12b", "Nemotron 3 120B", 256_000, 0.5, 1.5),
-    entry("workers-ai", "@cf/meta/llama-4-scout-17b-16e-instruct", "Llama 4 Scout", 131_000, 0.27, 0.85),
-    entry("workers-ai", "@cf/meta/llama-3.3-70b-instruct-fp8-fast", "Llama 3.3 70B Fast", 24_000, 0.293, 2.253),
-    entry("workers-ai", "@cf/mistralai/mistral-small-3.1-24b-instruct", "Small 3.1 24B", 128_000, 0.351, 0.555),
-    entry("workers-ai", "@cf/ibm-granite/granite-4.0-h-micro", "Granite 4.0 Micro", 131_000, 0.017, 0.112),
-    entry("workers-ai", "@cf/qwen/qwen3-30b-a3b-fp8", "Qwen3 30B", 32_768, 0.0509, 0.335),
-];
-function entry(provider, model, name, contextTokens, inputPerMillion, outputPerMillion) {
-    return {
-        provider,
-        model,
-        name,
-        contextTokens,
-        price: { inputPerMillion, outputPerMillion },
-        source: "builtin",
-    };
-}
-/**
- * The model's own name, taken from its id rather than invented.
- *
- * A live Workers AI model that is not in the table above has no written-out name anywhere, and
- * "@cf/qwen/qwen3-30b-a3b-fp8" prettified by any rule short enough to write here comes out wrong —
- * so the last segment of the id is used as it stands. A raw name is easier to recognise as raw than
- * a wrong one is to recognise as wrong.
- */
-function nameFromId(model) {
-    const segments = model.split("/");
-    return segments[segments.length - 1] ?? model;
-}
-export function createModelCatalog(deps) {
-    return {
-        async list() {
-            if (!deps.cloudflare)
-                return { entries: builtin, liveStatus: "not_configured" };
-            try {
-                const live = await deps.cloudflare.workersAiModels();
-                const merged = new Map(builtin.map((known) => [`${known.provider}:${known.model}`, known]));
-                for (const model of live) {
-                    // ⚠️ A model that cannot call a tool is skipped rather than listed without figures. It
-                    // would be an offer that produces a broken agent for whoever took it.
-                    if (!model.functionCalling)
-                        continue;
-                    const key = `workers-ai:${model.name}`;
-                    const known = merged.get(key);
-                    merged.set(key, {
-                        provider: "workers-ai",
-                        model: model.name,
-                        name: known?.name ?? nameFromId(model.name),
-                        // ⚠️ The live figure wins, and a live figure that is MISSING wins too — falling back to
-                        // the table for one of the two halves would produce an entry that is half fresh and
-                        // half years old, labelled fresh. Either the account answered for this model or it did
-                        // not.
-                        contextTokens: model.contextTokens,
-                        price: model.price,
-                        source: "cloudflare",
-                    });
-                }
-                return { entries: [...merged.values()], liveStatus: "read" };
-            }
-            catch {
-                // ⚠️ Named, not thrown. The select has to render either way — an agent whose model cannot be
-                // chosen is an agent nobody can repair from that screen — and the alternative to a stale
-                // price here is no price at all, which helps nobody choose. What the caller gets is the
-                // table plus the reason it is the table, and the screen says so.
-                return { entries: builtin, liveStatus: "unreadable" };
-            }
-        },
-    };
-}