@anchrd/intel-api 0.2.0

package/README.md

@@ -0,0 +1,96 @@
+# @anchrd/intel-api
+
+Intel is a customer-deployed, model-agnostic operating layer for company knowledge and processes. It
+gives people and MCP-capable AI clients the same governed access to three surfaces:
+
+- **Knowledge** — company content with sharing, immutable versions, retrieval, citations and a graph
+- **Flows** — versioned, durable processes that reference Knowledge and Tools
+- **Tools** — MCP capabilities discovered through a Cloudflare MCP Portal
+
+The UI, the HTTP API and the Intel MCP surface call the same application services, so authorization,
+validation and side effects never differ by surface. You deploy it into your own Cloudflare account
+against your own Gate; nothing runs on Anchrd infrastructure.
+
+This package contains the portable server, the Cloudflare adapter, the D1 migrations and the
+customer CLI.
+
+## Requirements
+
+- A [Gate](https://www.npmjs.com/package/@anchrd/gate-sdk) instance — Gate owns identity, capabilities
+  and the encrypted connection vault, and is the only required Anchrd dependency
+- A Cloudflare account with Workers, D1, R2, Queues and Workflows (Vectorize and Workers AI are
+  optional and only add semantic search and attachment conversion)
+- Node 22 or newer
+
+## Install
+
+```bash
+npm install @anchrd/intel-api @anchrd/intel-ui
+npx intel prepare
+npx intel bootstrap
+npx intel build
+npx intel doctor
+```
+
+Use the Cloudflare export from a customer Worker:
+
+```ts
+// biome-ignore lint/performance/noBarrelFile: Wrangler needs the named Workflow entrypoint.
+export { default, IntelFlowWorkflow } from "@anchrd/intel-api/cloudflare";
+```
+
+`intel build` reads an optional strict `intel.json`. Customer theme files override shadcn semantic
+tokens; SVG logo/favicon and complete language catalogs are embedded at build time. Installed builds
+land in `.intel/ui`, and migrations in `.intel/migrations`.
+
+Put `intel.json` next to the customer project's `package.json`:
+
+```json
+{
+  "ui": {
+    "theme": "./branding/theme.css",
+    "logo": "./branding/logo.svg",
+    "favicon": "./branding/favicon.svg",
+    "defaultLanguage": "en",
+    "languages": {}
+  }
+}
+```
+
+The theme is plain CSS containing shadcn semantic tokens such as `--primary`, `--background`,
+`--sidebar`, and `--radius`. It is loaded after Intel's defaults, so customer tokens win without a
+component fork. Unknown config fields, missing assets, non-SVG branding, and incomplete language
+catalogs fail the build. A ready-to-copy starting point is included under
+`node_modules/@anchrd/intel-api/examples`.
+
+Configure customer-specific `GATE_URL`, `INTEL_URL`, and the comma-separated exact-origin allowlist
+`TOOL_SOURCE_ORIGINS` in the deployment environment. The Worker requires `GATE_SERVICE_KEY` and a
+random `INTEL_SESSION_SECRET` of at least 32 bytes as Wrangler secrets. `ALLOW_INSECURE_OAUTH=true`
+is only supported for explicit local development; production OAuth issuers must use HTTPS. Gate OAuth
+uses PKCE and dynamic public-client registration; browser access tokens stay inside an encrypted
+`HttpOnly` cookie and are never exposed to the UI bundle or D1. Copy
+`node_modules/@anchrd/intel-api/examples/dev.vars.example` to `.dev.vars` for a local customer Worker.
+
+Approved MCP sources expose RFC 9728 metadata. The Tools UI follows that metadata, dynamically
+registers with Gate or Cloudflare Access, and completes a separate PKCE flow. Source access and
+refresh tokens are stored only in Gate's encrypted connection vault and refreshed just in time.
+The Intel audience token is never forwarded to another OAuth resource.
+
+The reference Wrangler deployment binds `DB`, `CONTENT`, `INDEXING`, `AI`, `SEARCH`, `FLOWS`, and
+`ASSETS`. Create `SEARCH` as a 1024-dimension cosine Vectorize index for the default multilingual
+Workers AI `@cf/baai/bge-m3` embedding adapter. `FLOWS` targets the exported
+`IntelFlowWorkflow` class. Tool sources speak standard Streamable HTTP MCP; Intel caches schemas
+and resolves the caller's Portal token just in time from Gate. Durable Flow state contains no
+browser, Gate, or provider credentials.
+
+## Related packages
+
+- [`@anchrd/intel-ui`](https://www.npmjs.com/package/@anchrd/intel-ui) — the browser application,
+  built from source with your own theme
+- [`@anchrd/intel-contract`](https://www.npmjs.com/package/@anchrd/intel-contract) — the shared wire
+  schemas
+
+## License
+
+Proprietary. Published publicly for installation convenience; this is not an open-source license and
+grants no right to use, copy, modify or redistribute the software. Contact Anchrd for licensing.

package/bin/intel.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { cp, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { createGateClient } from "@anchrd/gate-sdk";
+import { createCli } from "../dist/cli/cli.js";
+
+const uiCandidates = [
+  { dir: "node_modules/@anchrd/intel-ui", outDir: ".intel/ui" },
+  { dir: "packages/ui", outDir: "packages/ui/dist" },
+];
+const migrationCandidates = [
+  "node_modules/@anchrd/intel-api/migrations",
+  "packages/api/migrations",
+];
+
+// npm sets npm_execpath to its own JavaScript entry point. Running that through the current Node
+// binary avoids the .cmd shim entirely, which matters on Windows: Node has refused to spawn a .cmd
+// without a shell since CVE-2024-27980, and cmd.exe expands %NAME% even inside quotes, so a checkout
+// path containing a percent sign would be rewritten.
+function npmScriptPath(command) {
+  if (command !== "npm") return null;
+  const execPath = process.env.npm_execpath;
+  return execPath?.endsWith(".js") ? execPath : null;
+}
+
+// Only reached on the Windows shell fallback, where cmd.exe would otherwise split on whitespace.
+function quoteForCmd(argument) {
+  if (!/[\s"^&|<>()]/.test(argument)) return argument;
+  return `"${argument.replaceAll('"', '""')}"`;
+}
+
+function spawnArguments(command, args) {
+  const script = npmScriptPath(command);
+  if (script) return [process.execPath, [script, ...args]];
+  if (process.platform !== "win32") return [command, args];
+  return [`${command}.cmd`, args.map(quoteForCmd)];
+}
+
+async function isFile(path) {
+  try {
+    return (await stat(path)).isFile();
+  } catch (error) {
+    if (error?.code === "ENOENT" || error?.code === "ENOTDIR") return false;
+    throw error;
+  }
+}
+
+async function isDirectory(path) {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch (error) {
+    if (error?.code === "ENOENT" || error?.code === "ENOTDIR") return false;
+    throw error;
+  }
+}
+
+async function replaceDir(from, to) {
+  await mkdir(dirname(to), { recursive: true });
+  const backup = `${to}.old`;
+  await rm(backup, { recursive: true, force: true });
+  let hasBackup = false;
+  try {
+    await rename(to, backup);
+    hasBackup = true;
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  try {
+    await rename(from, to);
+  } catch (error) {
+    if (hasBackup) await rename(backup, to);
+    throw error;
+  }
+  if (hasBackup) await rm(backup, { recursive: true, force: true });
+}
+
+const cli = createCli({
+  env: process.env,
+  fetch: globalThis.fetch,
+  createGateInterfaces: (url, serviceKey) => createGateClient({ url, serviceKey }).interfaces,
+  readTextFile: async (path) => {
+    try {
+      return await readFile(path, "utf8");
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+  },
+  writeTextFile: async (path, content) => {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, content, "utf8");
+  },
+  resolveUi: async () => {
+    for (const candidate of uiCandidates) {
+      if (await isFile(`${candidate.dir}/package.json`)) {
+        return { dir: candidate.dir, outDir: resolve(process.cwd(), candidate.outDir) };
+      }
+    }
+    return null;
+  },
+  resolveMigrations: async () => {
+    for (const dir of migrationCandidates) {
+      if (await isDirectory(dir)) {
+        return { dir, outDir: resolve(process.cwd(), ".intel/migrations") };
+      }
+    }
+    return null;
+  },
+  copyDir: async (from, to) => {
+    await rm(to, { recursive: true, force: true });
+    await mkdir(dirname(to), { recursive: true });
+    await cp(from, to, { recursive: true });
+  },
+  exec: (command, args, { cwd }) =>
+    new Promise((resolveCode, reject) => {
+      const child = spawn(...spawnArguments(command, args), {
+        cwd,
+        stdio: "inherit",
+        shell: process.platform === "win32" && !npmScriptPath(command),
+      });
+      child.on("error", reject);
+      child.on("close", (code) => resolveCode(code ?? 1));
+    }),
+  replaceDir,
+  log: (message) => console.log(message),
+});
+
+try {
+  process.exitCode = await cli.run(process.argv.slice(2));
+} catch (error) {
+  console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 1;
+}

package/dist/adapters/cloudflare/cloudflare-flow-workflow.d.ts

@@ -0,0 +1,21 @@
+import type { CloudflareEnv } from "./cloudflare.types.js";
+interface WorkflowEvent<Params> {
+    payload: Readonly<Params>;
+}
+interface WorkflowStep {
+    do<T>(name: string, callback: () => Promise<T>): Promise<T>;
+    waitForEvent(name: string, options: {
+        type: string;
+        timeout?: string | number;
+    }): Promise<unknown>;
+}
+interface FlowWorkflowParams {
+    runId: string;
+}
+interface IntelFlowWorkflowInstance {
+    run(event: Readonly<WorkflowEvent<FlowWorkflowParams>>, step: WorkflowStep): Promise<unknown>;
+}
+export declare const IntelFlowWorkflow: {
+    new (context: unknown, env: CloudflareEnv): IntelFlowWorkflowInstance;
+};
+export {};

package/dist/adapters/cloudflare/cloudflare-flow-workflow.js

@@ -0,0 +1,39 @@
+// The runtime module is provided by workerd and intentionally has no Node package resolution path.
+// @ts-expect-error cloudflare:workers is available inside the deployed Worker runtime.
+import { WorkflowEntrypoint as RuntimeWorkflowEntrypoint } from "cloudflare:workers";
+class WorkflowEntrypoint extends RuntimeWorkflowEntrypoint {
+}
+class IntelFlowWorkflowImplementation extends WorkflowEntrypoint {
+    async run(event, step) {
+        const fail = async (name, error) => await step.do(name, async () => {
+            const occurredAt = new Date().toISOString();
+            await this.env.DB.prepare(`UPDATE flow_runs
+          SET status = 'failed', error = ?, completed_at = ?, updated_at = ?
+          WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled')`)
+                .bind(error, occurredAt, occurredAt, event.payload.runId)
+                .run();
+            return { status: "failed", error };
+        });
+        for (let iteration = 0; iteration < 500; iteration += 1) {
+            const state = await step.do(`inspect flow run ${iteration}`, async () => {
+                const row = await this.env.DB.prepare("SELECT status, error FROM flow_runs WHERE id = ?")
+                    .bind(event.payload.runId)
+                    .first();
+                return row ?? { status: "failed", error: "Flow run disappeared" };
+            });
+            if (["completed", "failed", "cancelled"].includes(state.status))
+                return state;
+            try {
+                await step.waitForEvent(`wait for flow run ${iteration}`, {
+                    type: "advance",
+                    timeout: "365 days",
+                });
+            }
+            catch {
+                return await fail(`expire flow run ${iteration}`, "Flow run timed out waiting for progress");
+            }
+        }
+        return await fail("fail flow step limit", "Flow exceeded the maximum durable step count");
+    }
+}
+export const IntelFlowWorkflow = IntelFlowWorkflowImplementation;

package/dist/adapters/cloudflare/cloudflare.d.ts

@@ -0,0 +1,8 @@
+import type { CloudflareEnv, CloudflareExecutionContext, IndexQueueBatch } from "./cloudflare.types.js";
+export { IntelFlowWorkflow } from "./cloudflare-flow-workflow.js";
+export declare function isSpaNavigation(request: Request): boolean;
+declare const _default: {
+    fetch(request: Request, env: CloudflareEnv, _context: CloudflareExecutionContext): Promise<Response>;
+    queue(batch: IndexQueueBatch, env: CloudflareEnv): Promise<void>;
+};
+export default _default;

package/dist/adapters/cloudflare/cloudflare.js

@@ -0,0 +1,200 @@
+import { createGateClient } from "@anchrd/gate-sdk";
+import { ulid } from "ulid";
+import { createBrowserAuth } from "../../auth/auth.js";
+import { createFlows } from "../../flows/flows.js";
+import { createIndexing, PermanentIndexingError } from "../../indexing/indexing.js";
+import { createIntel } from "../../intel/intel.js";
+import { createKnowledge } from "../../knowledge/knowledge.js";
+import { IntelError } from "../../shared/intel-error/intel-error.js";
+import { sha256Hex } from "../../shared/sha256/sha256.js";
+import { createTools } from "../../tools/tools.js";
+import { createContentStore } from "../content/content.js";
+import { createKnowledgeRepository } from "../db/db.js";
+import { createFlowRepository } from "../db/db-flows.js";
+import { createKnowledgeIndexRepository } from "../db/db-indexing.js";
+import { createOAuthClientStore } from "../db/db-oauth.js";
+import { createDocumentConverter } from "../document-converter/document-converter.js";
+import { createFlowRuntime } from "../flow-runtime/flow-runtime.js";
+import { createIndexQueue, IndexMessage } from "../index-queue/index-queue.js";
+import { createJsonSchemaValidator } from "../json-schema/json-schema.js";
+import { createOpenId } from "../openid/openid.js";
+import { createPortalTokenStore } from "../portal-tokens/portal-tokens.js";
+import { createRemoteTools } from "../remote-tools/remote-tools.js";
+import { createSemanticIndex } from "../semantic-index/semantic-index.js";
+import { createSessionCodec } from "../session-cookie/session-cookie.js";
+import { createToolSourcePolicy } from "../tool-source-policy/tool-source-policy.js";
+// biome-ignore lint/performance/noBarrelFile: The package entry must expose Wrangler's named Workflow class.
+export { IntelFlowWorkflow } from "./cloudflare-flow-workflow.js";
+const workerPrefixes = ["/api", "/auth", "/.well-known", "/mcp", "/health"];
+export function isSpaNavigation(request) {
+    if (request.method !== "GET" && request.method !== "HEAD")
+        return false;
+    if (!request.headers.get("accept")?.includes("text/html"))
+        return false;
+    const { pathname } = new URL(request.url);
+    return !workerPrefixes.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+// A missing variable would otherwise surface deep inside a request as an opaque URL or crypto
+// error. Naming it once here keeps a misconfigured deployment diagnosable.
+const requiredVariables = [
+    "GATE_URL",
+    "GATE_SERVICE_KEY",
+    "INTEL_URL",
+    "INTEL_SESSION_SECRET",
+    "TOOL_SOURCE_ORIGINS",
+];
+function assertConfigured(env) {
+    const missing = requiredVariables.filter((name) => !env[name]?.trim());
+    if (missing.length) {
+        throw new IntelError(500, "configuration_missing", `Intel is missing required configuration: ${missing.join(", ")}`);
+    }
+}
+export default {
+    async fetch(request, env, _context) {
+        if (env.ASSETS && isSpaNavigation(request)) {
+            return await env.ASSETS.fetch(new Request(new URL("/", request.url), { method: "GET" }));
+        }
+        assertConfigured(env);
+        const now = () => new Date();
+        const semantic = env.AI && env.SEARCH ? createSemanticIndex({ ai: env.AI, index: env.SEARCH }) : undefined;
+        const knowledge = createKnowledge({
+            repository: createKnowledgeRepository({ db: env.DB, now }),
+            content: createContentStore(env.CONTENT),
+            id: ulid,
+            now,
+            indexing: createIndexQueue(env.INDEXING),
+            semantic,
+            hash: async (content) => {
+                const source = typeof content === "string"
+                    ? new TextEncoder().encode(content)
+                    : Uint8Array.from(content).buffer;
+                return await sha256Hex(crypto, source);
+            },
+        });
+        const gate = createGateClient({ url: env.GATE_URL, serviceKey: env.GATE_SERVICE_KEY });
+        const oauth = createOpenId({
+            fetch: globalThis.fetch.bind(globalThis),
+            allowInsecure: env.ALLOW_INSECURE_OAUTH === "true",
+        });
+        const intelResource = `${env.INTEL_URL.replace(/\/+$/, "")}/mcp`;
+        const portalUrl = env.MCP_PORTAL_URL?.trim() || null;
+        const portalTokens = createPortalTokenStore({
+            db: env.DB,
+            secret: env.INTEL_SESSION_SECRET,
+            crypto,
+            now,
+        });
+        const auth = createBrowserAuth({
+            baseUrl: env.INTEL_URL,
+            gateUrl: env.GATE_URL,
+            resource: intelResource,
+            oauth,
+            clients: createOAuthClientStore(env.DB),
+            sessions: createSessionCodec({ secret: env.INTEL_SESSION_SECRET, crypto }),
+            portalUrl,
+            portalTokens,
+            now,
+        });
+        const tools = createTools({
+            portalUrl,
+            remote: createRemoteTools({ fetch: globalThis.fetch.bind(globalThis) }),
+            tokens: portalTokens,
+            refresh: async (token) => {
+                try {
+                    const refreshed = await oauth.refresh({
+                        issuer: token.issuer,
+                        clientId: token.clientId,
+                        resource: token.resource,
+                        refreshToken: token.refreshToken ?? "",
+                    });
+                    return {
+                        ...token,
+                        accessToken: refreshed.accessToken,
+                        refreshToken: refreshed.refreshToken ?? token.refreshToken,
+                        expiresAt: now().getTime() + Math.max(30, refreshed.expiresIn) * 1_000,
+                    };
+                }
+                catch {
+                    // A refusal from the portal's issuer means the grant is gone; the caller drops the token
+                    // and asks the user to reconnect rather than retrying a dead credential.
+                    return null;
+                }
+            },
+            now,
+            validate: createJsonSchemaValidator(),
+            sourceAllowed: createToolSourcePolicy(env.TOOL_SOURCE_ORIGINS),
+            fingerprint: async (value) => {
+                return await sha256Hex(crypto, JSON.stringify(value));
+            },
+        });
+        const flows = createFlows({
+            repository: createFlowRepository({ db: env.DB, now }),
+            runtime: createFlowRuntime(env.FLOWS),
+            id: ulid,
+            now,
+            knowledgeExists: async (actor, resourceId) => {
+                try {
+                    await knowledge.get(actor, resourceId);
+                    return true;
+                }
+                catch (error) {
+                    if (error instanceof IntelError && error.status === 404)
+                        return false;
+                    throw error;
+                }
+            },
+            toolFingerprint: async (actor, toolName) => {
+                const catalog = await tools
+                    .catalog({ id: actor.id, email: actor.email, canExecute: true })
+                    .catch(() => null);
+                return catalog?.items.find((item) => item.name === toolName)?.fingerprint ?? null;
+            },
+            unavailableTools: async (actor, toolNames) => await tools.unavailable({ id: actor.id, email: actor.email, canExecute: true }, toolNames),
+        });
+        return await createIntel({
+            baseUrl: env.INTEL_URL,
+            gateUrl: env.GATE_URL,
+            gate,
+            knowledge,
+            flows,
+            tools,
+            auth,
+        }).fetch(request);
+    },
+    async queue(batch, env) {
+        const indexing = createIndexing({
+            repository: createKnowledgeIndexRepository(env.DB),
+            content: createContentStore(env.CONTENT),
+            semantic: env.AI && env.SEARCH ? createSemanticIndex({ ai: env.AI, index: env.SEARCH }) : undefined,
+            converter: env.AI ? createDocumentConverter(env.AI) : undefined,
+            now: () => new Date(),
+        });
+        for (const message of batch.messages) {
+            const parsed = IndexMessage.safeParse(message.body);
+            if (!parsed.success) {
+                console.warn("Intel discarded an invalid indexing queue message");
+                message.ack();
+                continue;
+            }
+            try {
+                await indexing.index(parsed.data.versionId);
+                message.ack();
+            }
+            catch (error) {
+                if (error instanceof PermanentIndexingError) {
+                    console.warn("Intel discarded a permanently unindexable Knowledge version", {
+                        versionId: parsed.data.versionId,
+                        error: error.message,
+                    });
+                    message.ack();
+                    continue;
+                }
+                console.error("Intel indexing failed; Cloudflare retry policy will apply", {
+                    versionId: parsed.data.versionId,
+                    error: error instanceof Error ? error.message : "indexing_failed",
+                });
+                message.retry();
+            }
+        }
+    },
+};

package/dist/adapters/cloudflare/cloudflare.types.d.ts

@@ -0,0 +1,29 @@
+import type { R2Bucket } from "../content/content.types.js";
+import type { D1Database } from "../db/db.types.js";
+import type { MarkdownAiBinding } from "../document-converter/document-converter.types.js";
+import type { WorkflowBinding } from "../flow-runtime/flow-runtime.types.js";
+import type { IndexMessage } from "../index-queue/index-queue.js";
+import type { QueueBatch, QueueProducer } from "../index-queue/index-queue.types.js";
+import type { VectorizeBinding, WorkersAiBinding } from "../semantic-index/semantic-index.types.js";
+export interface CloudflareEnv {
+    ASSETS?: {
+        fetch(request: Request): Promise<Response>;
+    };
+    DB: D1Database;
+    CONTENT: R2Bucket;
+    INDEXING: QueueProducer<IndexMessage>;
+    FLOWS: WorkflowBinding;
+    AI?: WorkersAiBinding & MarkdownAiBinding;
+    SEARCH?: VectorizeBinding;
+    GATE_URL: string;
+    GATE_SERVICE_KEY: string;
+    INTEL_URL: string;
+    INTEL_SESSION_SECRET: string;
+    TOOL_SOURCE_ORIGINS: string;
+    MCP_PORTAL_URL?: string;
+    ALLOW_INSECURE_OAUTH?: string;
+}
+export interface CloudflareExecutionContext {
+    waitUntil(promise: Promise<unknown>): void;
+}
+export type IndexQueueBatch = QueueBatch<unknown>;

package/dist/adapters/cloudflare/cloudflare.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/content/content.d.ts

@@ -0,0 +1,3 @@
+import type { ContentStore } from "../../knowledge/knowledge.types.js";
+import type { R2Bucket } from "./content.types.js";
+export declare function createContentStore(bucket: R2Bucket): ContentStore;

package/dist/adapters/content/content.js

@@ -0,0 +1,22 @@
+export function createContentStore(bucket) {
+    return {
+        async get(key) {
+            return (await (await bucket.get(key))?.text()) ?? null;
+        },
+        async getBytes(key) {
+            return (await (await bucket.get(key))?.arrayBuffer()) ?? null;
+        },
+        async getStream(key) {
+            return (await bucket.get(key))?.body ?? null;
+        },
+        async put(key, content, mediaType) {
+            await bucket.put(key, content, { httpMetadata: { contentType: mediaType } });
+        },
+        async putBytes(key, content, mediaType) {
+            await bucket.put(key, content, { httpMetadata: { contentType: mediaType } });
+        },
+        async delete(key) {
+            await bucket.delete(key);
+        },
+    };
+}

package/dist/adapters/content/content.types.d.ts

@@ -0,0 +1,14 @@
+export interface R2ObjectBody {
+    body: ReadableStream<Uint8Array>;
+    text(): Promise<string>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}
+export interface R2Bucket {
+    get(key: string): Promise<R2ObjectBody | null>;
+    put(key: string, value: string | ArrayBuffer, options?: {
+        httpMetadata?: {
+            contentType?: string;
+        };
+    }): Promise<unknown>;
+    delete(key: string): Promise<void>;
+}

package/dist/adapters/content/content.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/db/db-flows.d.ts

@@ -0,0 +1,6 @@
+import type { FlowRepository } from "../../flows/flows.types.js";
+import type { D1Database } from "./db.types.js";
+export declare function createFlowRepository(deps: {
+    db: D1Database;
+    now(): Date;
+}): FlowRepository;