@anchrd/intel-api 0.14.0 → 0.16.0

package/dist/http/http.js

@@ -1,4 +1,9 @@
-import { AddBoardTaskInput, AppendTableRowsInput, ArchiveFlowInput, ArchiveNodeInput, CancelFlowRunInput, CompleteFlowRunStepInput, ConfigureBoardInput, CreateAgentInput, CreateFlowInput, CreateNodeInput, DefineTableInput, DeleteBoardTaskInput, DeleteTableRowsInput, ExecuteToolInput, GetFlowInput, GetFlowRunInput, GetFlowVersionInput, GetNodeInput, GetNodeVersionInput, ListAgentsInput, ListFlowRunsInput, ListFlowsInput, ListNodesInput, MoveBoardTaskInput, NodeGraphInput, PreviewFlowPublishInput, PublishFlowInput, RedefineTableInput, RelationGraphInput, ResolveNodeLinksInput, RevokeGrantInput, RotateAgentKeyInput, SaveAgentDefinitionInput, SaveAttachmentInput, SaveFlowVersionInput, SaveNodeVersionInput, SearchInput, ShareInput, StartFlowRunInput, TestToolInput, UnpublishFlowInput, UpdateBoardTaskInput, UpdateFlowInput, UpdateNodeInput, UpdateTableRowsInput, } from "@anchrd/intel-contract";
+import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
+import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
+import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
+import { RevokeGrantInput, ShareInput } from "@anchrd/intel-contract/share";
+import { AppendTableRowsInput, DefineTableInput, DeleteTableRowsInput, RedefineTableInput, UpdateTableRowsInput, } from "@anchrd/intel-contract/table";
+import { ExecuteToolInput, TestToolInput } from "@anchrd/intel-contract/tool";
 import { Hono } from "hono";
 import { z } from "zod";
 import { authorizeBearer, bearer, permits, } from "../shared/gate-authorization/gate-authorization.js";
@@ -78,16 +83,6 @@ function asFlowActor(authorization) {
         isAdmin: authorization.can("intel", "admin"),
     };
 }
-// The same `agents/run` the agent Worker asks for, resolved once at Intel's door. `intel/admin`
-// opens it for the same reason it opens every other one — `permits` is where that lives.
-function asAgentActor(authorization) {
-    return {
-        id: authorization.identity.id,
-        email: authorization.identity.email,
-        isAdmin: authorization.can("intel", "admin"),
-        canRun: permits(authorization, "agents", "run"),
-    };
-}
 export function createHttp(deps) {
     const app = new Hono();
     async function authenticated(headers) {
@@ -129,103 +124,20 @@ export function createHttp(deps) {
     // The caller's own identity, so the shell can name who is signed in. It needs no capability —
     // the answer is the token's own subject — and it returns nothing but id, email, and name.
     app.get("/session", (context) => {
-        const { identity } = context.get("authorization");
+        const authorization = context.get("authorization");
+        const { identity } = authorization;
         return context.json({
             id: identity.id,
             email: identity.email,
             name: identity.name ?? null,
+            // ⚠️ What the shell may DRAW, never what it may do (#416). Every admin route below still asks
+            // `requireCapability` for itself, and a browser that lied here would gain nothing but a
+            // button that answers 403.
+            isAdmin: authorization.can("intel", "admin"),
         });
     });
-    // What this deployment is equipped to do (#190) — facts about the installation, not about the
-    // caller, which is why it needs no capability beyond being signed in. `/session` stays identity
-    // only on purpose; this is the separate answer the UI asks for instead of reading a 503 as one.
-    // It sits behind the auth middleware like everything else, so an anonymous probe still learns
-    // nothing about whether a runtime exists.
-    app.get("/capabilities", (context) => {
-        return context.json({ agentRuntime: deps.agents.available() });
-    });
-    /**
-     * What the models on offer cost and how much they hold (#257).
-     *
-     * ⚠️ Intel asks Cloudflare, never the browser. The account endpoint needs a token and a token does
-     * not belong in a SPA — which is the sentence the hard-coded table in `packages/ui` used to carry
-     * as the reason it stayed hard-coded. This route is the answer to it: the figures cross the wire,
-     * the credential does not.
-     *
-     * ⚠️ No capability beyond being signed in. It is a fact about the installation and about nobody's
-     * data — the same footing `/capabilities` stands on.
-     *
-     * ⚠️ The `cache-control` is the caching the ticket asks for, and it is the caching that matters:
-     * the waste it names is "one fetch every time the select is opened", and that fetch is the
-     * browser's. A Worker isolate has nowhere durable to keep a table between requests, and inventing
-     * storage for a list of prices would cost more than the request it saved.
-     */
-    app.get("/models", async (context) => {
-        context.header("cache-control", "private, max-age=3600");
-        return context.json(await deps.models.list());
-    });
-    /**
-     * The agent runtime, reached through Intel.
-     *
-     * ⚠️ This list IS the door. The runtime serves more than what stands here — `/mcp` is the agent's
-     * own MCP surface, which the portal dials with its own credential (ADR-0005 §7), and
-     * `/mail/inbound` is authorized by a webhook signature. Neither is a browser path, and neither
-     * becomes one by being reachable: anything not named below is a 404 from Hono's router, so there
-     * is no allow-list beside the routes that could go quietly out of step with them.
-     *
-     * ⚠️ `agents/run` — not `knowledge/read`. Reading an agent's page is a knowledge read; driving the
-     * agent is the capability the runtime itself insists on, and Intel refuses on the same terms
-     * BEFORE the binding is touched, so a denial never reaches the runtime at all.
-     */
-    const runtimeRoutes = [
-        { method: "GET", pattern: "/state", path: () => "/state" },
-        { method: "GET", pattern: "/runs", path: () => "/runs" },
-        {
-            method: "GET",
-            pattern: "/runs/:runId",
-            path: (context) => `/runs/${encodeURIComponent(context.req.param("runId") ?? "")}`,
-        },
-        { method: "GET", pattern: "/log", path: () => "/log" },
-        { method: "POST", pattern: "/chat", path: () => "/chat" },
-        { method: "POST", pattern: "/pause", path: () => "/pause" },
-        { method: "POST", pattern: "/resume", path: () => "/resume" },
-        { method: "POST", pattern: "/run", path: () => "/run" },
-    ];
-    /**
-     * What this agent has cost — answered by Intel itself, not forwarded (#251).
-     *
-     * ⚠️ It stands under `/agents/:agentId` and is NOT in `runtimeRoutes`, which is the whole point of
-     * writing it out here. The runtime has no idea what anything costs: the figures come from
-     * Cloudflare's AI Gateway log, which needs an `AI Gateway: Read` token, and that token belongs in
-     * Intel rather than in the Worker that executes model-driven tool calls — the runtime's own
-     * `CLAUDE.md` keeps the number of credentials there deliberately small. The runtime's part is the
-     * stamp on the model call and nothing more.
-     *
-     * ⚠️ `agents/run`, matching the run list this stands beside. What an agent spends is as sensitive
-     * as what it did, and the two must not be reachable on different terms.
-     */
-    app.get("/agents/:agentId/costs", async (context) => {
-        const authorization = context.get("authorization");
-        return context.json(await deps.agentCosts.read(asAgentActor(authorization), context.req.param("agentId")));
-    });
-    for (const route of runtimeRoutes) {
-        app.on(route.method, `/agents/:agentId${route.pattern}`, async (context) => {
-            const authorization = context.get("authorization");
-            // The runtime's answer is returned untouched, headers included: the chat is a stream, and a
-            // body read here to inspect it would be a stream nobody could read afterwards.
-            return await deps.agents.forward({
-                actor: asAgentActor(authorization),
-                token: context.get("token"),
-                agentId: context.req.param("agentId"),
-                method: route.method,
-                path: route.path(context),
-                ...(route.method === "POST" ? { body: await context.req.text() } : {}),
-                signal: context.req.raw.signal,
-            });
-        });
-    }
     app.get("/nodes", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const url = new URL(context.req.url);
         const unknownQuery = [];
         url.searchParams.forEach((_value, key) => {
@@ -244,69 +156,24 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.list(asActor(auth), input));
     });
     app.get("/nodes/graph", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const url = new URL(context.req.url);
         const input = NodeGraphInput.parse({
             limit: url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : undefined,
         });
         return context.json(await deps.nodes.graph(asActor(auth), input));
     });
-    // ⚠️ Before `/nodes/:nodeId`, or the router would read "agents" as a node ID. Same order and same
-    // reason as `/nodes/graph` above.
-    app.get("/nodes/agents", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
-        const url = new URL(context.req.url);
-        requireKnownQuery(url, ["parentId", "includeArchived"]);
-        const parentId = url.searchParams.get("parentId");
-        // ⚠️ The key is only set when the caller sent it. Omitted means the whole tree and `null` means
-        // the root level, so defaulting a missing parameter to `null` here would silently answer a
-        // different question than the one asked.
-        const input = ListAgentsInput.parse({
-            ...(url.searchParams.has("parentId") ? { parentId: parentId === "" ? null : parentId } : {}),
-            includeArchived: url.searchParams.get("includeArchived") === "true",
-        });
-        return context.json(await deps.nodes.listAgents(asActor(auth), input));
-    });
-    /**
-     * ⚠️ NO response in Intel's HTTP surface carries a credential any more (D29, #207).
-     *
-     * Creating an agent still mints its Gate Application with the caller's own bearer — so this needs
-     * `applications:write` in Gate on top of `knowledge:create` in Intel — but the key Gate issues
-     * once goes straight into the agent runtime over the service binding, inside this request. The
-     * answer is the same shape every agent read has. Until #207 it carried the key in plain text and
-     * a person had to put it into a Worker secret by hand, which is why an agent created here could
-     * never run (#200).
-     */
-    app.post("/nodes/agents", async (context) => {
-        const auth = requireCapability(context, "knowledge", "create");
-        const input = CreateAgentInput.parse(await context.req.json().catch(() => null));
-        return context.json(await deps.nodes.createAgent(asActor(auth), input, { token: context.get("token") }), 201);
-    });
-    /**
-     * The repair path, and the only one an agent that lost its key has (D29, #207).
-     *
-     * ⚠️ `knowledge/write`, not `agents/run`. Which principal an agent acts as is a property of the
-     * agent, changed by whoever may change the agent; being allowed to press "Run now" is a different
-     * question and answers a different one. The resource ACL on the node is checked by the service.
-     *
-     * ⚠️ Before `/nodes/:nodeId`, like every other literal segment under `/nodes`.
-     */
-    app.post("/nodes/agents/:nodeId/rotate-key", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = RotateAgentKeyInput.parse({ nodeId: context.req.param("nodeId") });
-        return context.json(await deps.nodes.rotateAgentKey(asActor(auth), input, { token: context.get("token") }));
-    });
     // ⚠️ Before `/nodes/:nodeId`, or the router would read "export" as a node ID. The root has no
     // node to address, so the whole installation — as this caller may read it — exports here (#136).
     app.get("/nodes/export", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         return zipResponse(await deps.bundle.exportSubtree(asBundleActor(auth), null));
     });
     // The reverse door (#137): a zip bundle — or a naked zipped folder — lands as a new subtree.
     // The body IS the zip, streamed to the service rather than read whole here; `knowledge/create`
     // like every other way of making nodes, and the resource-level write check is the service's.
     async function importBundle(context, targetNodeId) {
-        const auth = requireCapability(context, "knowledge", "create");
+        const auth = requireCapability(context, "nodes", "create");
         const idempotencyKey = ImportIdempotencyKey.parse(context.req.header("idempotency-key"));
         const body = context.req.raw.body;
         if (body === null) {
@@ -324,7 +191,7 @@ export function createHttp(deps) {
     // ⚠️ Before `/nodes/:nodeId`, or the router would read "import" as a node ID.
     app.post("/nodes/import", async (context) => await importBundle(context, null));
     app.get("/nodes/:nodeId", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         return context.json(await deps.nodes.get(asActor(auth), context.req.param("nodeId")));
     });
     app.post("/nodes/:nodeId/import", async (context) => {
@@ -333,33 +200,19 @@ export function createHttp(deps) {
     });
     // One subtree — a folder with everything beneath it, or a single node — as a zip bundle (#136).
     app.get("/nodes/:nodeId/export", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const input = GetNodeInput.parse({ nodeId: context.req.param("nodeId") });
         return zipResponse(await deps.bundle.exportSubtree(asBundleActor(auth), input.nodeId));
     });
-    app.get("/nodes/:nodeId/agent", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
-        return context.json(await deps.nodes.getAgent(asActor(auth), { nodeId: context.req.param("nodeId") }));
-    });
-    app.post("/nodes/:nodeId/agent", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = SaveAgentDefinitionInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        // ⚠️ The caller's own bearer travels on, like it does when an agent is created: writing a
-        // definition also arms what it schedules, and that call is made as the person saving (#214).
-        return context.json(await deps.nodes.saveAgentDefinition(asActor(auth), input, { token: context.get("token") }), 201);
-    });
     app.get("/nodes/:nodeId/versions", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         return context.json(await deps.nodes.listVersions(asActor(auth), context.req.param("nodeId")));
     });
     // The content behind one row of the list above (#147): what a version-pinned citation points at.
     // Read capability like every other node read; the resource ACL and the node/version pairing are
     // the service's to refuse.
     app.get("/nodes/:nodeId/versions/:versionId/content", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const input = GetNodeVersionInput.parse({
             nodeId: context.req.param("nodeId"),
             versionId: context.req.param("versionId"),
@@ -371,13 +224,13 @@ export function createHttp(deps) {
     // resource address says nothing to an HTTP client, whose address for the bytes is the sibling
     // route below.
     app.get("/nodes/:nodeId/attachment/meta", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const input = GetNodeInput.parse({ nodeId: context.req.param("nodeId") });
         const { node, version } = await deps.nodes.getAttachment(asActor(auth), input.nodeId);
         return context.json({ node, version });
     });
     app.get("/nodes/:nodeId/attachment", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const { attachment, body } = await deps.nodes.readAttachment(asActor(auth), context.req.param("nodeId"));
         return new Response(body, {
             headers: {
@@ -389,13 +242,13 @@ export function createHttp(deps) {
         });
     });
     app.get("/nodes/:nodeId/table", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         return context.json(await deps.nodes.getTable(asActor(auth), context.req.param("nodeId")));
     });
     // Defining the header and appending rows are two routes because they are two decisions: the
     // header is written once and is the contract, an append is the everyday write (#40).
     app.post("/nodes/:nodeId/table", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = DefineTableInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
@@ -403,7 +256,7 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.defineTable(asActor(auth), input), 201);
     });
     app.post("/nodes/:nodeId/table/rows", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = AppendTableRowsInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
@@ -415,7 +268,7 @@ export function createHttp(deps) {
     // the `baseVersionId` that says which state they mean. Each writes one snapshot version, so the
     // 201 is the same statement the append's 201 makes.
     app.post("/nodes/:nodeId/table/rows/update", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = UpdateTableRowsInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
@@ -423,75 +276,27 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.updateTableRows(asActor(auth), input), 201);
     });
     app.post("/nodes/:nodeId/table/rows/delete", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = DeleteTableRowsInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
         }
         return context.json(await deps.nodes.deleteTableRows(asActor(auth), input), 201);
     });
-    app.post("/nodes/:nodeId/table/redefine", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+    app.patch("/nodes/:nodeId/table", async (context) => {
+        const auth = requireCapability(context, "nodes", "write");
         const input = RedefineTableInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
         }
         return context.json(await deps.nodes.redefineTable(asActor(auth), input), 201);
     });
-    // The board (#285). One read and five task operations, all action-style POSTs for the same reason
-    // the table mutations are: what they address is a task ID in the body, and none of them has an
-    // address of its own to PUT to. Every one writes a version, so they all answer 201 like the
-    // table's do.
-    app.get("/nodes/:nodeId/board", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
-        return context.json(await deps.nodes.getBoard(asActor(auth), { nodeId: context.req.param("nodeId") }));
-    });
-    app.post("/nodes/:nodeId/board/configure", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = ConfigureBoardInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.configureBoard(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = AddBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.addBoardTask(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks/update", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = UpdateBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.updateBoardTask(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks/move", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = MoveBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.moveBoardTask(asActor(auth), input), 201);
-    });
-    app.post("/nodes/:nodeId/board/tasks/delete", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
-        const input = DeleteBoardTaskInput.parse(await context.req.json().catch(() => null));
-        if (input.nodeId !== context.req.param("nodeId")) {
-            throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
-        }
-        return context.json(await deps.nodes.deleteBoardTask(asActor(auth), input), 201);
-    });
     // ⚠️ There is deliberately no route for the sixth board operation. `board_repair_task_ids`
     // (anchrd/intel#341) is MCP-only until a screen calls it: the routes here are what the browser
     // reaches, nothing in `intel-data-provider` asks for it, and a route with no caller is the thing
     // YAGNI is about. The screen is anchrd/intel#358, and it brings this route with it.
     app.get("/nodes/:nodeId/links", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         return context.json(await deps.nodes.listLinks(asActor(auth), context.req.param("nodeId")));
     });
     // A document link's name, for whoever is reading the text (#41). A POST because the list of IDs
@@ -502,27 +307,27 @@ export function createHttp(deps) {
     // There is no route to create or delete a link any more. A relationship is written where it is
     // meant, in the text, and `POST /nodes/:nodeId/versions` is what records it.
     app.post("/nodes/links/resolve", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const input = ResolveNodeLinksInput.parse(await context.req.json().catch(() => null));
         return context.json(await deps.nodes.resolveLinks(asActor(auth), input));
     });
     app.post("/nodes/search", async (context) => {
-        const auth = requireCapability(context, "knowledge", "read");
+        const auth = requireCapability(context, "nodes", "read");
         const input = SearchInput.parse(await context.req.json().catch(() => null));
         return context.json(await deps.nodes.search(asActor(auth), input));
     });
-    app.post("/search/reindex", async (context) => {
+    app.post("/nodes/reindex", async (context) => {
         const auth = requireCapability(context, "intel", "admin");
         z.strictObject({}).parse(await context.req.json().catch(() => null));
         return context.json(await deps.nodes.reindex(asActor(auth)), 202);
     });
     app.post("/nodes", async (context) => {
-        const auth = requireCapability(context, "knowledge", "create");
+        const auth = requireCapability(context, "nodes", "create");
         const input = CreateNodeInput.parse(await context.req.json().catch(() => null));
         return context.json(await deps.nodes.create(asActor(auth), input), 201);
     });
     app.post("/nodes/:nodeId/versions", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = SaveNodeVersionInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
@@ -530,7 +335,7 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.save(asActor(auth), input), 201);
     });
     app.post("/nodes/:nodeId/attachment", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = SaveAttachmentInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
@@ -538,7 +343,7 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.saveAttachment(asActor(auth), input), 201);
     });
     app.patch("/nodes/:nodeId", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = UpdateNodeInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
@@ -546,21 +351,21 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.update(asActor(auth), input));
     });
     app.post("/nodes/:nodeId/archive", async (context) => {
-        const auth = requireCapability(context, "knowledge", "write");
+        const auth = requireCapability(context, "nodes", "write");
         const input = ArchiveNodeInput.parse(await context.req.json().catch(() => null));
         if (input.nodeId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body node IDs differ");
         }
         // The caller's own bearer, for the one thing archiving may have to do in Gate: switch off the
         // Application behind an agent (#182). Every other kind never reaches it.
-        return context.json(await deps.nodes.archive(asActor(auth), input, { token: context.get("token") }));
+        return context.json(await deps.nodes.archive(asActor(auth), input));
     });
     app.get("/nodes/:nodeId/grants", async (context) => {
-        const auth = requireCapability(context, "knowledge", "share");
+        const auth = requireCapability(context, "nodes", "share");
         return context.json(await deps.nodes.listGrants(asActor(auth), context.req.param("nodeId")));
     });
     app.post("/nodes/:nodeId/grants", async (context) => {
-        const auth = requireCapability(context, "knowledge", "share");
+        const auth = requireCapability(context, "nodes", "share");
         const input = ShareInput.parse(await context.req.json().catch(() => null));
         if (input.resourceId !== context.req.param("nodeId")) {
             throw new IntelError(400, "node_id_mismatch", "Path and body resource IDs differ");
@@ -568,7 +373,7 @@ export function createHttp(deps) {
         return context.json(await deps.nodes.share(asActor(auth), input), 201);
     });
     app.post("/nodes/:nodeId/grants/:grantId/revoke", async (context) => {
-        const auth = requireCapability(context, "knowledge", "share");
+        const auth = requireCapability(context, "nodes", "share");
         const input = RevokeGrantInput.parse(await context.req.json().catch(() => null));
         if (input.resourceId !== context.req.param("nodeId") ||
             input.grantId !== context.req.param("grantId")) {
@@ -757,7 +562,7 @@ export function createHttp(deps) {
         const input = GetFlowRunInput.parse({ runId: context.req.param("runId") });
         return context.json(await deps.flows.listRunSteps(asFlowActor(auth), input.runId));
     });
-    app.post("/flow-runs/:runId/complete", async (context) => {
+    app.post("/flow-runs/:runId/steps/complete", async (context) => {
         const auth = requireCapability(context, "flows", "run");
         const input = CompleteFlowRunStepInput.parse(await context.req.json().catch(() => null));
         if (input.runId !== context.req.param("runId")) {

package/dist/http/http.types.d.ts

@@ -1,10 +1,7 @@
 import type { GateClient } from "@anchrd/gate-sdk";
-import type { AgentCostsService } from "../agent-costs/agent-costs.types.js";
-import type { AgentRuntimeService } from "../agent-runtime/agent-runtime.types.js";
 import type { BrowserAuth } from "../auth/auth.types.js";
 import type { BundleService } from "../bundle/bundle.types.js";
 import type { FlowService } from "../flows/flows.types.js";
-import type { ModelCatalogService } from "../model-catalog/model-catalog.types.js";
 import type { NodeService } from "../nodes/nodes.types.js";
 import type { ToolService } from "../tools/tools.types.js";
 export interface HttpDeps {
@@ -13,11 +10,6 @@ export interface HttpDeps {
     flows: FlowService;
     tools: ToolService;
     bundle: BundleService;
-    agents: AgentRuntimeService;
-    /** What an agent has cost, read out of the AI Gateway log rather than computed here (#251). */
-    agentCosts: AgentCostsService;
-    /** What the models on offer cost, read from Cloudflare rather than typed out here (#257). */
-    models: ModelCatalogService;
     resource: string;
     resourceMetadataUrl: string;
     auth?: Pick<BrowserAuth, "resolve">;